@rightkit/release 0.2.151 → 0.2.153

package/ownership-mandatory-set.mjs

@@ -0,0 +1,273 @@
+#!/usr/bin/env node
+// right-release ownership-mandatory: Table 1 mandatory-owner-set check (plan task 5.1).
+//
+// A registered app must declare every Table 1 owner (rows M1-M23) at or above the required version,
+// from the registry. Report mode (default) prints per-app findings and exits 0; --enforce exits 1
+// on any missing owner, below-required version, or path/git/patch override ("not-on-registry").
+// Mode switching of the ownership gate itself (Report -> Enforce) is a separate step; this check
+// is read-only and never changes ownership mode.
+//
+//   right-release ownership-mandatory [--workspace <dir>] [--app <name|dir>]... [--profile desktop|apple]
+//                                     [--amendment v2.1] [--enforce] [--json]
+//
+// App-side declaration (optional): <app>/rightkit-mandatory.json
+//   { "profile": "desktop", "notApplicable": { "M16": "reason text" } }
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as parseToml } from "smol-toml";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+export const DATA_FILE = "ownership-mandatory-set.json";
+export const loadData = () => JSON.parse(readFileSync(path.join(packageRoot, DATA_FILE), "utf8"));
+
+const SKIP_DIRS = new Set(["node_modules", "target", ".git", "rk-snapshot", "vendor", "dist", "build", "examples", "fixtures", "benchmarks", ".pnpm-store"]);
+const MAX_MANIFESTS = 2000;
+
+// ---- versions -------------------------------------------------------------------------------
+/** Lower bound of the first comparator in a Cargo/npm requirement, or null when none can be proven. */
+export function lowerBound(spec) {
+  if (typeof spec !== "string") return null;
+  let s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "");
+  const m = /(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?/.exec(s);
+  if (!m || /^(\*|latest|x|)$/i.test(s)) return null;
+  const n = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
+  return { major: Number(m[1]), minor: n(m[2]), patch: n(m[3]), pre: m[4] ?? null };
+}
+export const parseVersion = lowerBound;
+export function compareVersions(a, b) {
+  for (const k of ["major", "minor", "patch"]) if (a[k] !== b[k]) return a[k] < b[k] ? -1 : 1;
+  if (a.pre === b.pre) return 0;
+  if (a.pre === null) return 1;
+  if (b.pre === null) return -1;
+  return a.pre < b.pre ? -1 : 1;
+}
+const show = (v) => `${v.major}.${v.minor}.${v.patch}${v.pre ? `-${v.pre}` : ""}`;
+
+// ---- manifest discovery & parsing ---------------------------------------------------------
+export function findManifests(root) {
+  const found = [];
+  const walk = (dir, depth) => {
+    if (found.length >= MAX_MANIFESTS || depth > 8) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.isSymbolicLink()) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) { if (!SKIP_DIRS.has(e.name) && !e.name.startsWith(".")) walk(full, depth + 1); }
+      else if (e.name === "Cargo.toml" || e.name === "package.json") found.push(full);
+    }
+  };
+  walk(root, 0);
+  return found.sort();
+}
+
+const isNonRegistry = (v) => v && typeof v === "object" && ("path" in v || "git" in v);
+
+/** Collect dependency facts: { owner, ecosystem, kind: "registry"|"override", dev, spec, via, file }. */
+export function readManifest(file, root) {
+  const rel = path.relative(root, file).split(path.sep).join("/");
+  const text = readFileSync(file, "utf8");
+  const facts = [];
+  let workspaceDeps;
+  if (path.basename(file) === "Cargo.toml") {
+    let doc;
+    try { doc = parseToml(text); } catch (error) { return { rel, facts, error: `unparseable Cargo.toml: ${error.message}` }; }
+    workspaceDeps = doc.workspace?.dependencies;
+    const wsTable = workspaceDeps ?? {};
+    const sections = (table, dev) => {
+      for (const [section, isDev] of [["dependencies", dev], ["build-dependencies", dev], ["dev-dependencies", true]]) {
+        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev);
+      }
+    };
+    const add = (key, raw, dev) => {
+      let value = raw;
+      if (value && typeof value === "object" && value.workspace === true && wsTable[key] !== undefined) value = { ...(typeof wsTable[key] === "object" ? wsTable[key] : { version: wsTable[key] }), ...value };
+      const name = typeof value === "object" && typeof value.package === "string" ? value.package : key;
+      const spec = typeof value === "string" ? value : value?.version;
+      const unresolved = raw && typeof raw === "object" && raw.workspace === true && wsTable[key] === undefined;
+      facts.push({ owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
+    };
+    sections(doc, false);
+    for (const target of Object.values(doc.target ?? {})) sections(target, false);
+    for (const [key, raw] of Object.entries(wsTable)) {
+      // workspace.dependencies only counts through members that opt in (above); record path/git overrides here.
+      if (isNonRegistry(raw)) facts.push({ owner: typeof raw.package === "string" ? raw.package : key, ecosystem: "cargo", kind: "override", dev: false, spec: raw.version ?? null, via: "workspace.dependencies path/git", file: rel, declarationOnly: true });
+    }
+    for (const [registry, table] of Object.entries(doc.patch ?? {})) {
+      for (const [key, raw] of Object.entries(table ?? {})) {
+        if (isNonRegistry(raw)) facts.push({ owner: typeof raw.package === "string" ? raw.package : key, ecosystem: "cargo", kind: "override", dev: false, spec: null, via: `[patch.${registry}]`, file: rel, patch: true });
+      }
+    }
+  } else {
+    let doc;
+    try { doc = JSON.parse(text); } catch (error) { return { rel, facts, error: `unparseable package.json: ${error.message}` }; }
+    for (const [section, dev] of [["dependencies", false], ["optionalDependencies", false], ["peerDependencies", false], ["devDependencies", true]]) {
+      for (const [name, spec] of Object.entries(doc[section] ?? {})) {
+        const alias = typeof spec === "string" ? /^npm:((?:@[^@/]+\/)?[^@]+)@/.exec(spec) : null;
+        const owner = alias ? alias[1] : name;
+        const local = typeof spec === "string" && /^(workspace:|file:|link:|portal:|git\+|git:|github:|https?:)/.test(spec);
+        facts.push({ owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
+      }
+    }
+    for (const table of [doc.pnpm?.overrides, doc.overrides, doc.resolutions]) {
+      for (const [key, spec] of Object.entries(table ?? {})) {
+        if (typeof spec === "string" && /^(workspace:|file:|link:|portal:|git\+|github:)/.test(spec)) {
+          facts.push({ owner: key.replace(/@[^@/]*$/, ""), ecosystem: "npm", kind: "override", dev: false, spec, via: "package override", file: rel, patch: true });
+        }
+      }
+    }
+  }
+  return { rel, facts, workspaceDeps };
+}
+
+/** A member's `{ workspace = true }` names a table in an ancestor manifest's [workspace.dependencies]; resolve it across files. */
+export function resolveWorkspaceInheritance(manifests) {
+  const roots = manifests.filter((m) => m.workspaceDeps && Object.keys(m.workspaceDeps).length);
+  for (const m of manifests) {
+    for (const fact of m.facts) {
+      if (!fact.inheritsWorkspace) continue;
+      const dir = path.posix.dirname(m.rel);
+      const owner = roots
+        .filter((r) => r.workspaceDeps[fact.inheritsWorkspace] !== undefined)
+        .filter((r) => { const rd = path.posix.dirname(r.rel); return rd === "." || dir === rd || dir.startsWith(`${rd}/`); })
+        .sort((a, b) => path.posix.dirname(b.rel).length - path.posix.dirname(a.rel).length)[0];
+      if (!owner) continue;
+      const declared = owner.workspaceDeps[fact.inheritsWorkspace];
+      const table = declared && typeof declared === "object" ? declared : { version: declared };
+      fact.spec = table.version ?? null;
+      fact.kind = isNonRegistry(table) ? "override" : "registry";
+      if (isNonRegistry(table)) fact.via = "path" in table ? "path dependency" : "git dependency";
+      if (typeof table.package === "string") fact.owner = table.package;
+    }
+  }
+}
+
+// ---- evaluation --------------------------------------------------------------------------
+/** Merge row owners into one requirement per (ecosystem,name): max min, any allowDev, union of rows. */
+function requirements(rows) {
+  const map = new Map();
+  for (const row of rows) for (const o of row.owners) {
+    const key = `${o.ecosystem}:${o.name}`;
+    const cur = map.get(key) ?? { ...o, rows: [] };
+    if (compareVersions(lowerBound(o.min), lowerBound(cur.min)) > 0) cur.min = o.min;
+    cur.allowDev = Boolean(cur.allowDev || o.allowDev);
+    cur.rows.push(row.id);
+    map.set(key, cur);
+  }
+  return map;
+}
+
+function judge(req, facts) {
+  const mine = facts.filter((f) => f.owner === req.name && f.ecosystem === req.ecosystem);
+  const overrides = mine.filter((f) => f.kind === "override");
+  const counted = mine.filter((f) => f.kind === "registry" && (req.allowDev || !f.dev));
+  const devOnly = !counted.length && mine.some((f) => f.kind === "registry" && f.dev);
+  const min = lowerBound(req.min);
+  const base = { owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
+  const bounds = counted.map((f) => ({ f, v: lowerBound(f.spec) }));
+  const best = bounds.filter((b) => b.v).sort((a, b) => compareVersions(b.v, a.v))[0];
+  const declaredAt = best ? show(best.v) : null;
+  const registryExempt = req.registry === false;
+  if (overrides.length && !registryExempt) {
+    return { ...base, status: "not-on-registry", declared: declaredAt, evidence: overrides.map((f) => `${f.file}: ${f.via}${f.spec ? ` (${f.spec})` : ""}`) };
+  }
+  if (!counted.length && !(registryExempt && overrides.length)) {
+    return { ...base, status: "missing", declared: null, evidence: devOnly ? ["declared only under dev-dependencies"] : [] };
+  }
+  if (!counted.length) return { ...base, status: "ok", declared: "path/git (registry not required)", evidence: overrides.map((f) => `${f.file}: ${f.via}`) };
+  if (!best) return { ...base, status: "below-required", declared: null, evidence: counted.map((f) => `${f.file}: version not provable from ${JSON.stringify(f.spec)}`) };
+  if (compareVersions(best.v, min) < 0) return { ...base, status: "below-required", declared: declaredAt, evidence: [`${best.f.file}: ${best.f.spec} < ${req.min}`] };
+  return { ...base, status: "ok", declared: declaredAt, evidence: [] };
+}
+
+export function loadAppDeclaration(root, data) {
+  const file = path.join(root, data.appDeclarationFile);
+  if (!existsSync(file)) return { profile: data.defaultProfile, notApplicable: {}, problems: [] };
+  const problems = [];
+  let doc = {};
+  try { doc = JSON.parse(readFileSync(file, "utf8")); } catch (error) { problems.push(`${data.appDeclarationFile} unparseable: ${error.message}`); }
+  const notApplicable = {};
+  for (const [id, reason] of Object.entries(doc.notApplicable ?? {})) {
+    if (typeof reason === "string" && reason.trim().length >= 10) notApplicable[id] = reason.trim();
+    else problems.push(`${id}: N/A declaration needs a reason (>= 10 chars); ignored`);
+  }
+  return { profile: doc.profile ?? data.defaultProfile, notApplicable, problems };
+}
+
+export function checkApp(root, { data = loadData(), profile, amendments = [] } = {}) {
+  const name = path.basename(root);
+  if (!existsSync(root) || !statSync(root).isDirectory()) return { app: name, root, scanned: false, profile: profile ?? data.defaultProfile, owners: [], pending: [], notApplicable: [], problems: ["app root missing"], violations: 0 };
+  const declaration = loadAppDeclaration(root, data);
+  const active = profile ?? declaration.profile;
+  const problems = [...declaration.problems];
+  if (!data.profiles[active]) problems.push(`unknown profile "${active}"`);
+  const rows = data.rows.filter((r) => r.profile === active).map((r) => ({ ...r, owners: [...r.owners] }));
+  for (const key of amendments) {
+    const amendment = data.amendments?.[key];
+    if (!amendment) { problems.push(`unknown amendment "${key}"`); continue; }
+    for (const extra of amendment.rows.filter((r) => r.profile === active)) {
+      const row = rows.find((r) => r.id === extra.id);
+      if (row) row.owners.push(...extra.owners);
+    }
+  }
+  const notApplicable = Object.entries(declaration.notApplicable).map(([id, reason]) => ({ row: id, reason }));
+  const applicable = rows.filter((r) => !(r.id in declaration.notApplicable));
+  const pending = data.pendingRows.filter((r) => r.profile === active).map((r) => ({ row: r.id, name: r.name, status: "owner-pending", note: r.ownerPending }));
+  const manifests = findManifests(root).map((f) => readManifest(f, root));
+  resolveWorkspaceInheritance(manifests);
+  for (const m of manifests) if (m.error) problems.push(`${m.rel}: ${m.error}`);
+  const facts = manifests.flatMap((m) => m.facts);
+  const owners = [...requirements(applicable).values()].map((req) => judge(req, facts));
+  // A profile that is unknown, marked unratified, or has no rows checks nothing; an app may not select it, so it fails rather than passing empty.
+  const profileStatus = !data.profiles[active] ? "unknown-profile" : (data.profiles[active].ratified === false || !data.rows.some((r) => r.profile === active)) ? "unratified" : null;
+  if (profileStatus) {
+    problems.push(`profile "${active}" is ${profileStatus === "unratified" ? "unratified or has no rows" : "unknown"}; no mandatory set is checked`);
+    owners.push({ owner: `profile:${active}`, ecosystem: "profile", rows: [], required: "ratified profile", status: profileStatus, declared: null, evidence: ["an app may not select a profile that is not ratified"] });
+  }
+  const violations = owners.filter((o) => o.status !== "ok").length;
+  return { app: name, root, scanned: true, profile: active, manifests: manifests.length, owners, pending, notApplicable, problems, violations };
+}
+
+export function checkApps(roots, options = {}) {
+  const data = options.data ?? loadData();
+  const apps = roots.map((r) => checkApp(r, { ...options, data }));
+  return { schema: 1, mode: options.enforce ? "enforce" : "report", amendments: options.amendments ?? [], apps, failed: apps.some((a) => !a.scanned || a.violations > 0) };
+}
+
+export function renderText(report) {
+  const out = [`ownership-mandatory (${report.mode}) — Table 1 mandatory owner set`];
+  for (const app of report.apps) {
+    const count = (s) => app.owners.filter((o) => o.status === s).length;
+    out.push("", `${app.app} [${app.profile}] ${app.scanned ? `ok=${count("ok")} missing=${count("missing")} below-required=${count("below-required")} not-on-registry=${count("not-on-registry")}` : "UNSCANNED"}`
+      + (app.pending.length ? ` pending=${app.pending.map((p) => p.row).join(",")}` : "") + (app.notApplicable.length ? ` n/a=${app.notApplicable.map((n) => n.row).join(",")}` : ""));
+    for (const o of app.owners.filter((x) => x.status !== "ok")) out.push(`  ${o.status.padEnd(15)} ${o.owner} (${o.rows.join(",")}) requires ${o.required}${o.declared ? `, declared ${o.declared}` : ""}${o.evidence.length ? ` — ${o.evidence.join("; ")}` : ""}`);
+    for (const n of app.notApplicable) out.push(`  n/a             ${n.row}: ${n.reason}`);
+    for (const p of app.problems) out.push(`  problem         ${p}`);
+  }
+  out.push("", `${report.apps.filter((a) => !a.scanned || a.violations).length}/${report.apps.length} apps fail the mandatory set${report.mode === "enforce" ? "" : " (report mode: exit 0)"}`);
+  return `${out.join("\n")}\n`;
+}
+
+const flags = (args, name) => args.flatMap((a, i) => (a === name ? [args[i + 1]] : []));
+export async function main(args, io = {}) {
+  const stdout = io.stdout ?? process.stdout, stderr = io.stderr ?? process.stderr;
+  const data = loadData();
+  const workspace = path.resolve(flags(args, "--workspace")[0] ?? path.resolve(packageRoot, "../../.."));
+  const requested = flags(args, "--app");
+  const roots = (requested.length ? requested : data.defaultApps).map((a) => (path.isAbsolute(a) || a.includes(path.sep) ? path.resolve(a) : path.join(workspace, a)));
+  const amendments = flags(args, "--amendment").map((a) => a.replace(/^v?/, "v"));
+  const profile = flags(args, "--profile")[0];
+  if (profile && !data.profiles[profile]) { stderr.write(`[right-release] ownership-mandatory: unknown profile "${profile}"\n`); return 2; }
+  const unknownAmendment = amendments.find((a) => !data.amendments?.[a]);
+  if (unknownAmendment) { stderr.write(`[right-release] ownership-mandatory: unknown amendment "${unknownAmendment}"\n`); return 2; }
+  const report = checkApps(roots, { data, profile, amendments, enforce: args.includes("--enforce") });
+  stdout.write(args.includes("--json") ? `${JSON.stringify(report, null, 2)}\n` : renderText(report));
+  return args.includes("--enforce") && report.failed ? 1 : 0;
+}
+
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  try { process.exitCode = await main(process.argv.slice(2)); }
+  catch (error) { console.error(`[right-release] ownership-mandatory: ${error.message}`); process.exitCode = 1; }
+}

package/ownership.mjs

@@ -480,7 +480,7 @@ function scanRepositoryRoot(appRoot) {
   if (!rootPath || !path.isAbsolute(rootPath)) return { root: path.resolve(appRoot), prefix: "", pathBase: "scan-root", commit };
   // Git prints the resolved root (macOS /private/var/...); resolve the app root the same way so a
   // symlinked spelling (/var, /tmp) is not mistaken for a path outside the repository.
-  const real = (p) => { try { return realpathSync(p); } catch { return path.resolve(p); } };
+  const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
   const root = real(rootPath), app = real(appRoot);
   const relative = path.relative(root, app);
   if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return { root: app, prefix: "", pathBase: "scan-root", commit };
@@ -758,7 +758,7 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
   if ((options.expectedCommit && committed.commit !== options.expectedCommit) || (options.expectedTree && committed.tree !== options.expectedTree)) throw new Error("committed ownership: source handle does not match expected commit/tree");
   // Compare real paths: Git reports the resolved root (macOS /private/var/...), while callers
   // may pass a symlinked spelling of the same directory (/var/..., /tmp/...).
-  const real = (p) => { try { return realpathSync(p); } catch { return path.resolve(p); } };
+  const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
   const relativeRoot = path.relative(real(committed.repositoryRoot), real(appRoot));
   if (relativeRoot === ".." || relativeRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeRoot)) throw new Error("committed ownership: scan root is outside committed repository");
   const pathPrefix = relativeRoot ? `${relativeRoot.split(path.sep).join("/")}/` : "";

package/package.json

@@ -1,18 +1,30 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.151",
+  "version": "0.2.153",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-release": "cli/right-release.mjs"
   },
+  "rightkit": {
+    "publishCheck": {
+      "binSmoke": {
+        "right-release": [
+          "--version"
+        ]
+      }
+    }
+  },
   "files": [
     "cli",
     "*.mjs",
     "*.json",
     "*.sh",
+    "msix-repair-guard.ps1",
     "*.py",
+    "LICENSE-MIT",
+    "LICENSE-APACHE",
     "!*.test.mjs",
     "!standalone-clone-evidence.json"
   ],
@@ -23,11 +35,11 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/bogusyogi/rightkit.git",
+    "url": "git+https://github.com/Orthic-Labs/rightkit.git",
     "directory": "packages/release"
   },
   "dependencies": {
-    "smol-toml": "1.7.0"
+    "smol-toml": "1.9.0"
   },
   "scripts": {
     "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",

package/packaged-app-identity.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Packaged macOS app identity assertions (M19 owner gap 3): codesign Identifier,
+// TeamIdentifier, hardened runtime, no ad-hoc signature, expected cdhash, and
+// lipo architectures. Asserts only what the caller declares; it never signs.
+// Usage: right-release identity-scan --target <path> [--identifier <id>] [--team <OU>]
+//          [--cdhash <hex>] [--arch <arch>]... [--allow-adhoc]
+import { spawnSync } from "./background-process.mjs";
+import { fileURLToPath } from "node:url";
+
+/** Parse `codesign -dv --verbose=4` output (stderr text) into fields. */
+export function parseCodesignDisplay(text) {
+  const out = { authorities: [] };
+  for (const line of String(text).split(/\r?\n/)) {
+    const m = /^([A-Za-z][A-Za-z0-9 ]*)=(.*)$/.exec(line.trim());
+    if (!m) continue;
+    const [, key, value] = m;
+    if (key === "Authority") out.authorities.push(value);
+    else if (key === "Identifier") out.identifier = value;
+    else if (key === "TeamIdentifier") out.team = value;
+    else if (key === "CDHash") out.cdhash = value.toLowerCase();
+    else if (key === "Signature") out.signature = value;
+  }
+  const flags = /flags=0x[0-9a-f]+\(([^)]*)\)/i.exec(String(text));
+  out.flags = flags ? flags[1].split(",").map((s) => s.trim()).filter(Boolean) : [];
+  out.adhoc = out.signature === "adhoc" || out.flags.includes("adhoc");
+  out.runtime = out.flags.includes("runtime");
+  return out;
+}
+
+/** Parse `lipo -archs` output. */
+export function parseLipoArchs(text) {
+  return String(text).trim().split(/\s+/).filter(Boolean);
+}
+
+/** Return the list of failures for the declared expectations (empty = pass). */
+export function assertPackagedIdentity(display, archs, expected = {}) {
+  const failures = [];
+  if (!expected.allowAdhoc && display.adhoc) failures.push("signature is ad-hoc; a release must be Developer ID signed");
+  if (expected.identifier && display.identifier !== expected.identifier) {
+    failures.push(`Identifier must be ${expected.identifier} (got ${display.identifier ?? "none"})`);
+  }
+  if (expected.team && display.team !== expected.team) {
+    failures.push(`TeamIdentifier must be ${expected.team} (got ${display.team ?? "none"})`);
+  }
+  if (expected.cdhash && display.cdhash !== String(expected.cdhash).toLowerCase()) {
+    failures.push(`CDHash must be ${expected.cdhash} (got ${display.cdhash ?? "none"})`);
+  }
+  if (!expected.allowAdhoc && !display.runtime) failures.push("hardened runtime flag is missing");
+  for (const arch of expected.archs ?? []) {
+    if (!archs.includes(arch)) failures.push(`missing architecture ${arch} (has ${archs.join(",") || "none"})`);
+  }
+  return failures;
+}
+
+function capture(cmd, args) {
+  const r = spawnSync(cmd, args, { encoding: "utf8" });
+  return { status: r.status ?? 1, output: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+function main(argv) {
+  const expected = { archs: [] };
+  let target = "";
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--target") target = argv[++i] ?? "";
+    else if (a === "--identifier") expected.identifier = argv[++i];
+    else if (a === "--team") expected.team = argv[++i];
+    else if (a === "--cdhash") expected.cdhash = argv[++i];
+    else if (a === "--arch") expected.archs.push(argv[++i]);
+    else if (a === "--allow-adhoc") expected.allowAdhoc = true;
+    else { console.error(`identity-scan: unknown argument ${a}`); return 2; }
+  }
+  if (!target) { console.error("usage: right-release identity-scan --target <path> [--identifier <id>] [--team <OU>] [--cdhash <hex>] [--arch <arch>]... [--allow-adhoc]"); return 2; }
+  const display = capture("codesign", ["-dv", "--verbose=4", target]);
+  if (display.status !== 0) { console.error(`identity-scan: codesign could not read ${target}:\n${display.output}`); return 1; }
+  let archs = [];
+  if (expected.archs.length) {
+    const lipo = capture("lipo", ["-archs", target]);
+    if (lipo.status !== 0) { console.error(`identity-scan: lipo failed:\n${lipo.output}`); return 1; }
+    archs = parseLipoArchs(lipo.output);
+  }
+  const failures = assertPackagedIdentity(parseCodesignDisplay(display.output), archs, expected);
+  for (const f of failures) console.error(`identity-scan: ${f}`);
+  if (!failures.length) console.log(`identity-scan: ${target} ok`);
+  return failures.length ? 1 : 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) process.exit(main(process.argv.slice(2)));

package/preflight.mjs

@@ -23,6 +23,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
+import { appRuntimeBudgetAdoptionCheck } from "./runtime-budgets.mjs";
 import { isSwiftProject } from "./project-type.mjs";
 
 export const PREFLIGHT_OK = "ok";
@@ -137,6 +138,17 @@ export function nextFreeVersion(sealedDir, app, currentVersion, { readdir = read
   return { taken: [...taken], collision: true, suggestion };
 }
 
+/** The path itself, or its nearest existing ancestor (df cannot measure a directory that does not exist yet). */
+export function nearestExisting(target) {
+  let current = path.resolve(target);
+  for (;;) {
+    if (existsSync(current)) return current;
+    const parent = path.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
 function freeDiskGb(targetPath) {
   if (process.platform === "win32") {
     const drive = path.parse(path.resolve(targetPath)).root.replace(/\\$/, "");
@@ -168,18 +180,20 @@ export function collectPreflight({
   platform,
   appRoot,
   repoRoot,
+  env = process.env,
   app,
   version,
   configPath,
   cargoLockPaths = [],
   nativeLayout,
   targetLink,
-  minFreeGb = 25,
-  env = process.env,
+  minFreeGb = Number.isFinite(Number(env.RIGHT_RELEASE_MIN_FREE_GB)) && Number(env.RIGHT_RELEASE_MIN_FREE_GB) > 0 ? Number(env.RIGHT_RELEASE_MIN_FREE_GB) : 25,
   versionProbe = commandVersion,
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
+  runtimeBudgetAdoption = appRuntimeBudgetAdoptionCheck,
+  freeDisk = freeDiskGb,
   projectType,
   msix = false,
   findSdkTool = findWindowsSdkTool,
@@ -288,7 +302,9 @@ export function collectPreflight({
   }
 
   if (appRoot) {
-    const free = freeDiskGb(appRoot);
+    // The floor protects the volume builds write to: the cargo target directory when the layout names one
+    // (builds go there, often on a different drive from the app), else the app root.
+    const free = freeDisk(nearestExisting(nativeLayout?.targetDir ?? appRoot) ?? appRoot);
     if (free === null) {
       checks.push(warn("disk", "could not determine free disk space", null));
     } else {
@@ -304,6 +320,12 @@ export function collectPreflight({
     }
   }
 
+  // Held-resource crates are proven at adoption: an app that links one needs its own installed measurement.
+  if (appRoot && !swift) {
+    const adoption = runtimeBudgetAdoption({ appRoot, app, version, cargoLockPaths });
+    if (adoption) checks.push(adoption);
+  }
+
   if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
     const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));

package/prune-r2.mjs

@@ -3,16 +3,41 @@ import { resolveCloudflareApiToken } from "./protected-credentials.mjs";
 const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID || "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
 const BUCKETS = { public: "rightapps-downloads", private: "rightapps-updates" };
 
-export async function pruneReleaseObjects({ app, platform, keep, dryRun = false, env = process.env, credentialStore }) {
+// Versioned install sources (`<app>/installers/<platform>/versions/<version>/<file>`) back MSIX App Installer
+// repair: Windows re-adds a package from the URI it was installed from, so the newest `previous` versions
+// beyond the explicitly kept keys survive pruning.
+const VERSIONED = (app, platform) => new RegExp(`^${app.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/installers/${platform}/versions/([^/]+)/`);
+const versionParts = (v) => v.split(/[.+-]/).map((x) => (/^\d+$/.test(x) ? Number(x) : -1));
+export function compareVersions(a, b) {
+  const x = versionParts(a), y = versionParts(b);
+  for (let i = 0; i < Math.max(x.length, y.length); i++) { const d = (x[i] ?? 0) - (y[i] ?? 0); if (d) return d; }
+  return 0;
+}
+export function previousVersionKeys({ app, platform, keys, keep, previous = 1 }) {
+  const re = VERSIONED(app, platform);
+  const kept = new Set([...keep].map((key) => re.exec(key)?.[1]).filter(Boolean));
+  const others = new Map();
+  for (const key of keys) {
+    const version = re.exec(key)?.[1];
+    if (!version || kept.has(version)) continue;
+    others.set(version, [...(others.get(version) ?? []), key]);
+  }
+  const newest = [...others.keys()].sort((a, b) => compareVersions(b, a)).slice(0, previous);
+  return new Set(newest.flatMap((version) => others.get(version)));
+}
+
+export async function pruneReleaseObjects({ app, platform, keep, dryRun = false, env = process.env, credentialStore, retainPreviousVersions = 0 }) {
   if (!new Set(["mac", "windows"]).has(platform)) throw new Error(`invalid R2 prune platform: ${platform}`);
   const token = resolveCloudflareApiToken({ env, credentialStore, required: !dryRun });
   for (const [alias, bucket] of Object.entries(BUCKETS)) {
-    const retained = new Set(keep[alias] ?? []);
+    let retained = new Set(keep[alias] ?? []);
     if (dryRun) {
       console.log(`[dry-run] PRUNE ${bucket}/${app}/${platform} keep=${[...retained].sort().join(",") || "<none>"}`);
       continue;
     }
-    for (const key of await listObjects(bucket, app, token)) {
+    const listed = await listObjects(bucket, app, token);
+    if (retainPreviousVersions > 0) retained = new Set([...retained, ...previousVersionKeys({ app, platform, keys: listed, keep: retained, previous: retainPreviousVersions })]);
+    for (const key of listed) {
       if (!isReleaseObject(app, platform, key) || retained.has(key)) continue;
       console.log(`DELETE ${bucket}/${key}`);
       await deleteObject(bucket, key, token);

package/publication-gate.mjs

@@ -17,6 +17,9 @@ export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
 // Swift packages (RightKitSwift) are Apple-only; Windows cannot run them.
 export const requiredHosts = (kind) => (kind === "swift" ? Object.freeze(["darwin"]) : REQUIRED_HOSTS);
 const SHA = /^[0-9a-f]{40}$/;
+// The one definition of a recorded darwin-only host policy (release evidence and the runtime budget gate share it).
+export const isDarwinOnlyPolicy = (source) => source?.hostPolicy === "darwin-only"
+  && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
 
 export function defaultEvidencePath(workspaceRoot, kind, name) {
   return path.join(workspaceRoot, "release-evidence", "gate", `${kind}-${name.replace(/^@/, "").replace("/", "-")}.json`);
@@ -28,6 +31,40 @@ function defaultGit(args, cwd) {
   return (result.stdout ?? "").trim();
 }
 
+// Explains a receipt commit that is not the publishing HEAD. The gate still refuses it (exact-commit rule,
+// docs/RIGHTKIT-SHARED-PACKAGES.md "Publication gate" rule 1); this only says whether the receipt is an
+// ancestor with an unchanged unit path (re-qualify by re-running on HEAD) or unrelated/changed.
+function describeCommitMismatch(evidenceCommit, head, packagePath, git) {
+  const known = git(["cat-file", "-t", evidenceCommit], packagePath);
+  if (known !== "commit") return "receipt commit is not a commit object in this repository";
+  // `merge-base --is-ancestor` prints nothing: "" means ancestor, null (non-zero exit) means not.
+  const ancestor = git(["merge-base", "--is-ancestor", evidenceCommit, head], packagePath) !== null;
+  const relation = ancestor ? git(["rev-list", "--count", `${evidenceCommit}..${head}`], packagePath) : null;
+  const changed = git(["diff", "--name-only", evidenceCommit, head, "--", "."], packagePath);
+  const parts = [];
+  parts.push(ancestor ? `receipt commit is an ancestor, ${relation ?? "?"} commit(s) behind HEAD` : "receipt commit is not an ancestor of HEAD");
+  if (changed === null) parts.push("cannot diff the unit path");
+  else parts.push(changed === "" ? "unit path unchanged since the receipt (re-run the host runs on HEAD to re-qualify)" : `unit path changed since the receipt: ${changed.split("\n").slice(0, 5).join(", ")}`);
+  return parts.join("; ");
+}
+
+// Names of the fields of one host run that do not qualify (empty when the run qualifies). Every run binds to
+// the same unit, commit and artifact: commit, host arch, feature set and artifactSha256 equal to the evidence.
+function invalidRunFields(run, evidence) {
+  const bad = [];
+  const text = (value) => typeof value === "string" && value.trim() !== "";
+  if (run.commit !== evidence.commit) bad.push(`commit (must equal ${evidence.commit})`);
+  if (!text(run.host?.arch)) bad.push("host.arch");
+  if (!(Array.isArray(run.features) && run.features.length > 0 && run.features.every(text))) bad.push("features");
+  if (run.artifactSha256 !== evidence.artifactSha256) bad.push("artifactSha256 (must equal the evidence hash)");
+  if (!text(run.command)) bad.push("command");
+  if (!text(run.operator)) bad.push("operator");
+  if (!text(run.timestamp)) bad.push("timestamp");
+  if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
+  if (run.failed !== 0) bad.push("failed (must be 0)");
+  return bad;
+}
+
 // Returns { ok, missing[] }. Pure apart from the injected git/readFile.
 export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
   const missing = [];
@@ -43,25 +80,27 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
   if (evidence) {
     if (evidence.schema !== GATE_SCHEMA) missing.push(`evidence schema must be ${GATE_SCHEMA}`);
     if (evidence.kind !== kind || evidence.name !== name) missing.push(`evidence is for ${evidence.kind}:${evidence.name}, expected ${kind}:${name}`);
-    if (version && evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
+    // A missing publishing version must refuse: a skipped comparison would qualify any evidence version.
+    if (typeof version !== "string" || version.trim() === "") missing.push("publishing version is unknown (manifest has no literal version), cannot bind the receipt to it");
+    else if (evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
     if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
-    else if (head && evidence.commit !== head) missing.push(`evidence commit ${evidence.commit} != current HEAD ${head}`);
+    else if (head && evidence.commit !== head) {
+      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
+    }
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
     // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
     // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
     // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    const darwinOnly = (kind === "npm" || kind === "cargo") && evidence.hostPolicy === "darwin-only"
-      && typeof evidence.hostPolicyReason === "string" && evidence.hostPolicyReason.trim() !== "";
+    const darwinOnly = (kind === "npm" || kind === "cargo") && isDarwinOnlyPolicy(evidence);
     for (const host of darwinOnly ? ["darwin"] : requiredHosts(kind)) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
-      const good = matching.some((run) => run.commit === evidence.commit
-        && Number.isInteger(run.passed) && run.passed > 0 && run.failed === 0
-        && typeof run.command === "string" && run.command.trim()
-        && typeof run.operator === "string" && run.operator.trim()
-        && typeof run.timestamp === "string" && run.timestamp.trim());
-      if (!good) missing.push(`${label} run receipt must name commit ${evidence.commit}, command, operator, timestamp, passed>0 and failed=0`);
+      // Every run on the host must qualify: a failing run is not masked by a passing run beside it.
+      matching.forEach((run, index) => {
+        const fields = invalidRunFields(run, evidence);
+        if (fields.length) missing.push(`${label} run receipt ${index} invalid: ${fields.join(", ")}`);
+      });
     }
     if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
   }