@rightkit/release 0.2.144 → 0.2.146

package/README.md

@@ -25,6 +25,15 @@ Signing and publication rules are in the workspace file `docs/rules/release-sign
 | Checks | `deps`, `hardening`, `harden`, `hardeningscan`, `cargo-target` |
 | Ownership | `ownership`, `ownership-approval`, `ownership-report` |
 
+## QA receipts (warn-and-record)
+
+`right-release qa --stage source|installed --platform mac|win` still runs `rightkit-qa` and writes a signed receipt, and receipt verification is unchanged. A missing or invalid receipt no longer blocks a release. `build`, `upload`, `publish-update` and `github` print `[right-release] QA warning: ...` to stderr, continue, and record the outcome:
+
+- Source stage: sealed into the manifest as `qa: { status: "passed", sourceReceiptDigest, floorDigest }` or `qa: { status: "missing" | "rejected", reason }`.
+- Installed stage: written to `.right-release/state/<releaseId>/<platformDir>/qa-installed.json` as `{ status, reason?, receiptDigest?, checkedAt, provider }`. It is written when publication starts, so a later upload failure still leaves a record.
+
+Audit ad hoc or on a weekly schedule with `right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]`. It reads the app repo's sealed manifests and state and lists source and installed QA status per release and platform (passed, missing, rejected, not-uploaded). It exits 0 when every uploaded build has passing QA and 1 when any uploaded build lacks it. An installed receipt can only chain to a build sealed with a passing source receipt, so a build sealed with `qa.status: "missing"` needs source QA and a rebuild before installed QA can pass.
+
 ## Local app install (macOS)
 
 Agents must not run `osascript`, `open`, `screencapture`, or `notifyutil -p` directly. Install a signed build through:
@@ -66,6 +75,8 @@ Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (c
 
 `updater.kind: "appinstaller"` (default remains the Tauri minisign flow) generates `msix.appInstaller.out` (https `uri`/`msixUri`); trust is the MSIX Authenticode signature, so no `.sig` is produced and `publish-update` records the sealed package digest.
 
+Never cancel an MSIX deployment from app or updater code. Cancelling `AddPackageAsync` while it is in `RegistrationChanged` leaves the package `Modified, NeedsRemediation` (0x80073CF8, AppX event 751); the app then cannot activate, so the OnLaunch feed check never runs and cannot self-heal. Measured recovery (SwiftRight SliceApp R5 W08, 2026-10-10): `Add-AppxPackage -AppInstallerFile <feed uri>` restores launch by deploying the feed's newer version, with user data intact; `-RegisterByFamilyName`, `Reset-AppxPackage` and relaunching do not. Recovery when the feed offers no newer version is unverified, so publish the next version to the feed before directing a user to that command.
+
 macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
 
 Build a SwiftPM app with `right-release build --platform mac|win` (add `--config <path>` when the config is not `right-release.config.mjs`). Build is tier-neutral and never uploads, so it rejects `--tier` and takes no `--upload`/`--no-upload`; the old `release --tier patch --no-upload` form no longer works. Pick the tier only at upload: `right-release upload --release <sealed-id> --platform mac|win --tier patch|update`.

package/build-release.mjs

@@ -24,7 +24,7 @@ import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
-import { assertSourceQaAdmission } from "./release-qa-receipt.mjs";
+import { admitSourceQa } from "./release-qa-audit.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
@@ -254,15 +254,9 @@ try {
   for (const check of preflight) {
     if (check.status !== "ok") console.error(`[right-release] preflight ${check.name}: ${check.detail}`);
   }
-  // Hardening step 4: source QA admits the candidate build/sign. The receipt digest is sealed into the manifest so
-  // upload/publication can require installed QA chained to it. Dev lanes (install-app --dev) never reach this file.
-  let qaAdmission;
-  try {
-    qaAdmission = assertSourceQaAdmission({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath) });
-  } catch (error) {
-    if (error?.code !== "QA_ADMISSION_REFUSED") throw error;
-    fail(error.message);
-  }
+  // Hardening step 4: source QA is recorded, not enforced. A missing or rejected receipt warns loudly and the outcome
+  // is sealed into the manifest (`qa.status`) for `right-release qa audit`. Dev lanes (install-app --dev) never reach this file.
+  const qaAdmission = admitSourceQa({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath) });
 
   // A tool being INSTALLED is not the same as it being the one PATH picks. The
   // vendored-OpenSSL build shells out to `perl`, and under Git Bash/MSYS that
@@ -517,7 +511,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     version: config.version,
     commit,
     ownershipEvidence,
-    qa: { sourceReceiptDigest: qaAdmission.digest, floorDigest: qaAdmission.floorDigest },
+    qa: qaAdmission,
     platform,
     cacheKey,
     // Portable contracts sign only raw executables — installer/embedding

package/cli/right-release.mjs

@@ -184,7 +184,8 @@ Commands:
                                                       Stage SwiftPM app; build+sign MSIX (Windows) or assemble+sign+notarize .app (macOS); never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
-  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa and write the sealed QA receipt (required to build/upload)
+  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa and write the sealed QA receipt (a missing receipt warns and is recorded; it never blocks)
+  qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build

package/github-release.mjs

@@ -7,7 +7,7 @@ import { readVerifiedArtifact, assertArtifactUnchanged, digestBytes, verifyArtif
 import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
-import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
+import { admitInstalledQa } from "./release-qa-audit.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 import { RIGHTRELEASE_MANIFEST_SIGNER, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
 
@@ -395,13 +395,11 @@ if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(
     plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
   } else {
     options.repo ||= repositoryFromRemote(repoRoot);
-    // Hardening step 4: the direct GitHub lane is a publication path too; it needs installed QA like `upload` does.
+    // Hardening step 4: the direct GitHub lane is a publication path too; installed QA is recorded like `upload` does, never enforced.
     if (!options.dryRun) {
       const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", options.releaseId, options.platform === "win" ? "windows" : "mac"));
       const configPath = path.resolve("right-release.config.mjs");
-      try {
-        assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform: options.platform, configName: "right-release.config.mjs", releaseConfigSha256: existsSync(configPath) ? createHash("sha256").update(readFileSync(configPath)).digest("hex") : undefined });
-      } catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; console.error(`right-release github: ${error.message}`); process.exit(1); }
+      admitInstalledQa({ repoRoot, manifest: sealed.manifest, platform: options.platform, configName: "right-release.config.mjs", releaseConfigSha256: existsSync(configPath) ? createHash("sha256").update(readFileSync(configPath)).digest("hex") : undefined }, { provider: "github-releases" });
     }
     plan = prepareGitHubRelease({ repoRoot, ...options });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.144",
+  "version": "0.2.146",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/pe-imports.mjs

@@ -55,5 +55,7 @@ export function readPeImports(bytes) {
       delayImports.add(cstring(name));
     }
   }
-  return { machine, architecture: PE_MACHINES[machine] ?? `0x${machine.toString(16)}`, imports: [...imports], delayImports: [...delayImports] };
+  // Optional header Subsystem is at offset 68 in both PE32 and PE32+ (2 = WINDOWS_GUI, 3 = WINDOWS_CUI).
+  const subsystem = buf.readUInt16LE(optional + 68);
+  return { machine, architecture: PE_MACHINES[machine] ?? `0x${machine.toString(16)}`, subsystem, imports: [...imports], delayImports: [...delayImports] };
 }

package/publish-update.mjs

@@ -13,7 +13,7 @@ import { assertCleanSource } from "./source-gate.mjs";
 import { verifyPublicationRelease, PublicationError, assertArtifactUnchanged, digestBytes } from "./publication-artifacts.mjs";
 import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
 import { verifyPlatformTrust } from "./github-release.mjs";
-import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
+import { admitInstalledQa } from "./release-qa-audit.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
@@ -69,10 +69,9 @@ if (!dryRun || releaseId) {
   if (!installer) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed installer required for platform trust verification");
   verifyPlatformTrust({ sealed, installer: path.join(sealed.sealedDir, installer.name) });
   for (const artifact of sealed.artifacts.values()) assertArtifactUnchanged(artifact);
-  // Hardening step 4: installed QA on these exact artifact hashes and commit must have passed (R2 patch + update tiers).
+  // Hardening step 4: installed QA is recorded, not enforced (R2 patch + update tiers); a missing receipt warns and is written to state.
   if (!dryRun) {
-    try { assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: digestBytes(readFileSync(configPath)) }); }
-    catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; fail(error.message); }
+    admitInstalledQa({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: digestBytes(readFileSync(configPath)) }, { provider: "r2" });
   }
 }
 const artifactFile = (declared) => {

package/release-qa-audit.mjs

@@ -0,0 +1,145 @@
+// Warn-and-record QA admission plus the ad hoc `right-release qa audit` scan.
+//
+// A missing or invalid QA receipt never blocks a release. The gates in release-qa-receipt.mjs still verify
+// receipts exactly as before; this module turns a refusal into a loud stderr warning and a durable record
+// (the sealed manifest `qa` field for the source stage, `state/<releaseId>/<platformDir>/qa-installed.json`
+// for the installed stage). `qa audit` reads those records so a weekly run can flag released builds
+// that lack passing QA.
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { assertInstalledQaAdmission, assertSourceQaAdmission, qaReceiptPath, readQaReceipt } from "./release-qa-receipt.mjs";
+
+const platformDirOf = (platform) => (platform === "win" ? "windows" : platform);
+
+/** "missing" when no receipt exists; "rejected" for anything else the gate refused (bad receipt, no key, wrong commit). */
+function refusalStatus(error) {
+  return /^no (?:source|installed) QA receipt/.test(error.message) ? "missing" : "rejected";
+}
+const refusalReason = (error) => String(error.message).split("\n  run:")[0];
+
+export function formatQaWarning({ status, reason, command }) {
+  return `[right-release] QA warning: ${reason}; release continues and is recorded as QA ${status} for audit.${command ? ` Run: ${command}` : ""}`;
+}
+
+function admit(check, { warn = (line) => console.error(line) } = {}) {
+  try { return { status: "passed", result: check() }; }
+  catch (error) {
+    if (error?.code !== "QA_ADMISSION_REFUSED") throw error;
+    const outcome = { status: refusalStatus(error), reason: refusalReason(error), command: error.command ?? null };
+    warn(formatQaWarning(outcome));
+    return outcome;
+  }
+}
+
+/** Build stage. Returns the `qa` block sealed into the release manifest. */
+export function admitSourceQa(opts, hooks) {
+  const outcome = admit(() => assertSourceQaAdmission(opts), hooks);
+  if (outcome.status === "passed") return { status: "passed", sourceReceiptDigest: outcome.result.digest, floorDigest: outcome.result.floorDigest };
+  return { status: outcome.status, reason: outcome.reason };
+}
+
+export const installedQaRecordPath = ({ repoRoot, releaseId, platform }) =>
+  path.join(repoRoot, ".right-release", "state", releaseId, platformDirOf(platform), "qa-installed.json");
+
+/** Publication stage (upload, publish-update, github). Records the outcome durably and never blocks. */
+export function admitInstalledQa(opts, { provider, now = () => new Date(), ...hooks } = {}) {
+  const outcome = admit(() => assertInstalledQaAdmission(opts), hooks);
+  const record = {
+    status: outcome.status,
+    ...(outcome.status === "passed" ? { receiptDigest: outcome.result.digest } : { reason: outcome.reason }),
+    checkedAt: now().toISOString(),
+    provider,
+  };
+  const file = installedQaRecordPath({ repoRoot: opts.repoRoot, releaseId: opts.manifest.releaseId, platform: opts.platform });
+  try {
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`);
+  } catch (error) {
+    (hooks.warn ?? ((line) => console.error(line)))(`[right-release] QA warning: could not record installed QA status at ${file} (${error.message}); release continues.`);
+  }
+  return record;
+}
+
+const readJson = (file) => { try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; } };
+const subdirs = (dir) => (existsSync(dir) ? readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name) : []);
+
+function sourceStatus(manifest) {
+  const qa = manifest.qa;
+  if (qa?.status === "passed" || (!qa?.status && qa?.sourceReceiptDigest)) return { status: "passed" };
+  if (qa?.status) return { status: qa.status, ...(qa.reason ? { reason: qa.reason } : {}) };
+  return { status: "missing", reason: "sealed manifest records no source QA" };
+}
+
+function installedStatus({ repoRoot, releaseId, platformDir }) {
+  const stateDir = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
+  const record = readJson(path.join(stateDir, "qa-installed.json"));
+  const published = existsSync(stateDir) && readdirSync(stateDir).some((name) => /^verified-.*\.json$/.test(name));
+  if (record) return { uploaded: true, status: record.status, ...(record.reason ? { reason: record.reason } : {}), ...(record.checkedAt ? { checkedAt: record.checkedAt } : {}) };
+  if (!published) return { uploaded: false, status: "not-uploaded" };
+  // Uploaded before outcomes were recorded: fall back to the receipt file the old gate required.
+  const receipt = readQaReceipt(qaReceiptPath({ repoRoot, releaseId, platform: platformDir === "windows" ? "win" : platformDir, stage: "installed" }));
+  if (receipt?.status === "passed") return { uploaded: true, status: "passed", reason: "legacy upload; receipt file present, not re-verified" };
+  return { uploaded: true, status: "missing", reason: "uploaded with no recorded installed QA outcome" };
+}
+
+/** Scan the app repo's sealed manifests and state. Returns rows plus `ok` (false when any uploaded build lacks passing QA). */
+export function auditQa({ repoRoot, since } = {}) {
+  const sealedRoot = path.join(repoRoot, ".right-release", "sealed");
+  const rows = [];
+  for (const releaseId of subdirs(sealedRoot).sort()) {
+    for (const platformDir of subdirs(path.join(sealedRoot, releaseId)).sort()) {
+      const manifest = readJson(path.join(sealedRoot, releaseId, platformDir, "release-manifest.json"));
+      if (!manifest) continue;
+      if (since && String(manifest.sealedAt ?? "") < since) continue;
+      const installed = installedStatus({ repoRoot, releaseId, platformDir });
+      const source = sourceStatus(manifest);
+      const { uploaded, ...installedRest } = installed;
+      rows.push({
+        releaseId, platform: platformDir, version: manifest.version ?? null, sealedAt: manifest.sealedAt ?? null, uploaded,
+        source, installed: installedRest,
+        ok: !uploaded || (source.status === "passed" && installedRest.status === "passed"),
+      });
+    }
+  }
+  return { repoRoot, since: since ?? null, rows, ok: rows.every((row) => row.ok) };
+}
+
+export function formatAuditTable(report) {
+  if (!report.rows.length) return "right-release qa audit: no sealed releases found";
+  const header = ["release", "platform", "source", "installed", "result"];
+  const body = report.rows.map((row) => [row.releaseId, row.platform, row.source.status, row.installed.status, row.ok ? (row.uploaded ? "ok" : "ok (not uploaded)") : "FLAG"]);
+  const widths = header.map((_, column) => Math.max(header[column].length, ...body.map((line) => line[column].length)));
+  const line = (cells) => cells.map((cell, column) => cell.padEnd(widths[column])).join("  ").trimEnd();
+  const flagged = report.rows.filter((row) => !row.ok);
+  return [
+    line(header), ...body.map(line),
+    "",
+    flagged.length
+      ? `${flagged.length} uploaded build(s) lack passing QA:\n${flagged.map((row) => `  ${row.releaseId} ${row.platform}: ${[row.source.status !== "passed" && `source ${row.source.status}${row.source.reason ? ` (${row.source.reason})` : ""}`, row.installed.status !== "passed" && `installed ${row.installed.status}${row.installed.reason ? ` (${row.installed.reason})` : ""}`].filter(Boolean).join("; ")}`).join("\n")}`
+      : "all uploaded builds have passing QA",
+  ].join("\n");
+}
+
+function repoRootOf(dir) {
+  const result = spawnSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true });
+  const top = result.status === 0 ? String(result.stdout ?? "").trim() : "";
+  return top && existsSync(path.join(top, ".right-release")) ? top : path.resolve(dir);
+}
+
+export function auditMain(args, { stdout = (text) => console.log(text), stderr = (text) => console.error(text) } = {}) {
+  let app = process.cwd(), json = false, since;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--app") app = args[++index];
+    else if (arg === "--json") json = true;
+    else if (arg === "--since") since = args[++index];
+    else if (arg === "-h" || arg === "--help") { stdout("usage: right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]"); return 0; }
+    else { stderr(`right-release qa audit: unknown argument: ${arg}`); return 2; }
+  }
+  if (!app) { stderr("right-release qa audit: --app requires a directory"); return 2; }
+  if (since !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(since)) { stderr("right-release qa audit: --since must be YYYY-MM-DD"); return 2; }
+  const report = auditQa({ repoRoot: repoRootOf(app), since });
+  stdout(json ? JSON.stringify(report, null, 2) : formatAuditTable(report));
+  return report.ok ? 0 : 1;
+}

package/release-qa-command.mjs

@@ -3,6 +3,7 @@
 //
 //   right-release qa --stage source    --platform mac|win [--config right-release.config.mjs]
 //   right-release qa --stage installed --platform mac|win --release <sealed-id> [--config right-release.config.mjs]
+//   right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]   (release-qa-audit.mjs; exit 1 when an uploaded build lacks passing QA)
 //
 // The release config declares the app's QA plan:
 //   qa: { version: "1", config: "rightkit-qa.toml", runner?: "<path to rightkit-qa>",
@@ -18,6 +19,7 @@ import { spawnSync } from "./background-process.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { verifySealedRelease } from "./release-state.mjs";
+import { auditMain } from "./release-qa-audit.mjs";
 import { darwinKeyFile, PROTECTED_SECRETS } from "./protected-credentials.mjs";
 import {
   buildQaReceipt, currentPolicyBundleDigest, dependencyClosure, ensureQaReceiptKey, evaluateRequiredChecks, loadQaFloor,
@@ -114,11 +116,12 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, deps =
 }
 
 function usage(code) {
-  console.log("usage: right-release qa --stage source|installed --platform mac|win [--release <sealed-id>] [--config right-release.config.mjs]");
+  console.log("usage: right-release qa --stage source|installed --platform mac|win [--release <sealed-id>] [--config right-release.config.mjs]\n       right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]");
   process.exit(code);
 }
 
 export async function main(args) {
+  if (args[0] === "audit") process.exit(auditMain(args.slice(1)));
   let stage = "", platform = process.platform === "win32" ? "win" : "mac", releaseId = "", configName = "right-release.config.mjs";
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.144",
+    "@rightkit/release": "0.2.146",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -176,7 +176,9 @@
       "0.2.140",
       "0.2.141",
       "0.2.142",
-      "0.2.143"
+      "0.2.143",
+      "0.2.144",
+      "0.2.145"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -276,7 +278,7 @@
     "rightkit-browser": "0.2.3",
     "rightkit-cache": "0.1.0",
     "rightkit-contracts": "0.1.2",
-    "rightkit-control": "0.1.9",
+    "rightkit-control": "0.1.11",
     "rightkit-crash": "0.2.0",
     "rightkit-db": "0.3.2",
     "rightkit-embed": "0.3.1",
@@ -333,7 +335,7 @@
       "rightkit-audio": "0.2.0",
       "rightkit-browser": "0.2.2",
       "rightkit-cache": "0.1.0",
-      "rightkit-control": "0.1.9",
+      "rightkit-control": "0.1.11",
       "rightkit-crash": "0.2.0",
       "rightkit-db": "0.3.2",
       "rightkit-embed": "0.3.1",
@@ -388,7 +390,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.144",
+      "@rightkit/release": "0.2.146",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -504,7 +506,9 @@
     "rightkit-control": [
       "0.1.6",
       "0.1.7",
-      "0.1.8"
+      "0.1.8",
+      "0.1.9",
+      "0.1.10"
     ],
     "rightkit-secrets": [
       "0.1.0",

package/swift-package-command.mjs

@@ -29,7 +29,7 @@ export function windowsStageOptions({ config, base }) {
   const w = config.windows;
   if (!w?.exe || !w?.out) throw fail("SWIFT_PACKAGE_CONFIG", "windows.exe and windows.out are required");
   return { exe: rel(base, w.exe), out: rel(base, w.stageDir ?? `${w.out}.stage`), searchDirs: relList(base, w.searchDirs),
-    include: relList(base, w.include), systemDlls: w.systemDlls, dependencies: w.dependencies, architecture: w.architecture };
+    include: relList(base, w.include), systemDlls: w.systemDlls, dependencies: w.dependencies, architecture: w.architecture, subsystem: w.subsystem };
 }
 
 export function msixOptions({ config, base }, staged) {

package/swift-windows-stage.mjs

@@ -41,7 +41,9 @@ function findInDirs(name, dirs) {
  *   systemDlls[] (extra allowed), dependencies[{ name, provides[] }], architecture }
  * Returns a manifest; throws SWIFT_STAGE_UNRESOLVED listing every missing DLL.
  */
-export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], systemDlls = [], dependencies = [], architecture, clean = true } = {}) {
+const PE_SUBSYSTEMS = { gui: 2, console: 3 };
+
+export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], systemDlls = [], dependencies = [], architecture, subsystem, clean = true } = {}) {
   if (!exe || !out) throw fail("SWIFT_STAGE_OPTIONS", "exe and out are required");
   exe = path.resolve(exe); out = path.resolve(out);
   if (!/\.exe$/i.test(exe) || !existsSync(exe) || !statSync(exe).isFile()) throw fail("SWIFT_STAGE_OPTIONS", `exe must be an existing .exe: ${exe}`);
@@ -71,6 +73,14 @@ export function stageSwiftWindows({ exe, out, searchDirs = [], include = [], sys
     const info = readPeImports(readFileSync(item.source));
     if (!["x64", "arm64"].includes(info.architecture)) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture}; only x64 and arm64 are supported`);
     arch ??= info.architecture;
+    if (item.from === "<root>" && subsystem) {
+      const want = PE_SUBSYSTEMS[subsystem];
+      if (!want) throw fail("SWIFT_STAGE_OPTIONS", `windows.subsystem must be "gui" or "console", got ${JSON.stringify(subsystem)}`);
+      if (info.subsystem !== want) {
+        throw fail("SWIFT_STAGE_SUBSYSTEM", `${item.source} has PE subsystem ${info.subsystem}, expected ${want} (${subsystem})` +
+          (subsystem === "gui" ? "; link with -Xlinker /SUBSYSTEM:WINDOWS -Xlinker /ENTRY:mainCRTStartup so launching it opens no console window" : ""));
+      }
+    }
     if (info.architecture !== arch) throw fail("SWIFT_STAGE_ARCH", `${item.source} is ${info.architecture} but package architecture is ${arch}`);
     for (const dep of [...info.imports, ...info.delayImports]) {
       const dk = lower(dep);

package/upload-release.mjs

@@ -10,7 +10,7 @@ import { verifySealedRelease } from "./release-state.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
 import { recordPublishedVersion } from "./artifact-storage.mjs";
-import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
+import { admitInstalledQa } from "./release-qa-audit.mjs";
 
 const args = process.argv.slice(2);
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
@@ -60,10 +60,9 @@ if (!configuredRepo) fail("release config distribution.repository is required fo
 if (repo && repo !== configuredRepo) fail(`--repo must match configured distribution.repository (${configuredRepo})`);
 repo = configuredRepo;
 
-// Hardening step 4: installed QA on these exact artifact hashes and commit must have passed before any upload.
+// Hardening step 4: installed QA is recorded, not enforced; a missing receipt warns and the outcome is written to state.
 if (!dryRun) {
-  try { assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: createHash("sha256").update(readFileSync(configPath)).digest("hex") }); }
-  catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; fail(error.message); }
+  admitInstalledQa({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: createHash("sha256").update(readFileSync(configPath)).digest("hex") }, { provider: "github-releases" });
 }
 const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
 const verifiedMarker = path.join(stateRoot, `verified-${tier}-github-releases.json`);