@rightkit/release 0.2.151 → 0.2.154

package/ownership-command.mjs

@@ -18,6 +18,7 @@ import { spawnSync } from "./background-process.mjs";
 import { main as stagedMain } from "./ownership-staged.mjs";
 import { loadTrustedExternal } from "./ownership-approval.mjs";
 import { trustComparison } from "./ownership-policy-bundle.mjs";
+import { isBlockingFinding } from "./ownership-verdict.mjs";
 
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
 
@@ -37,7 +38,7 @@ export function trustCompare(args, { print, trustLoader = loadTrustedExternal }
   return 0;
 }
 
-export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value), trustLoader = loadTrustedExternal } = {}) {
+export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value), stderr = (line) => console.error(line), trustLoader = loadTrustedExternal } = {}) {
   if (args.includes("--help")) {
     print("right-release ownership [--app <dir>] [--json]\nright-release ownership --staged [--app <dir>] [--json]  (pre-commit gate: scans the index, not the working tree)\nright-release ownership --write-manifest [--rightkit <dir>] [--approve-new-capabilities]\n--approve-new-capabilities permits new capability ids during local generation only. Existing owner conflicts are always refused. Protected installation authorization remains separate.");
     return 0;
@@ -58,20 +59,27 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   }
   const app = path.resolve(flag(args, "--app") ?? process.cwd());
   const top = gitRunner("git", ["-C", app, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true });
-  if (top.status !== 0) return failClosed(args, "repository", "could not resolve --app to a Git repository");
+  if (top.status !== 0) return refuse(args, { type: "repository", message: "could not resolve --app to a Git repository" }, { print, stderr });
   const repoRoot = path.resolve(String(top.stdout).trim());
   let checked;
   try { checked = evidenceFactory(repoRoot, app); }
-  catch (error) { return failClosed(args, "protected-evidence", error.message, print); }
+  catch (error) {
+    // A refusal from the protected checkout carries its check name and offending paths.
+    const blocked = error?.blocked ? [blockedCheck(error.blocked.check, error.message, error.blocked.paths)] : undefined;
+    return refuse(args, { type: "protected-evidence", message: error.message, blocked }, { print, stderr });
+  }
   const result = checked.result;
   if (args.includes("--audit-json")) return printAuditJson(result, print);
+  // A refusal names every blocking check on stderr and in the JSON `blocked` field. Advise-tier findings never refuse.
+  const blocked = checked.enrollmentPending || checked.ok ? undefined : blockingChecks(checked);
+  if (blocked) reportBlocked(blocked, stderr);
   if (args.includes("--json")) {
     const error = checked.enrollmentPending ? undefined : !checked.floor.ok
       ? { type: "ownership-floor", message: checked.floor.problems.join("; ") }
       : result.coverage.length
         ? { type: "ownership-coverage", message: `${result.coverage.length} ownership coverage gap(s)` }
         : undefined;
-    print(JSON.stringify({ ok: checked.ok, ...(checked.enrollmentPending ? { enrollmentPending: true, warning: checked.warning } : {}), ...(error ? { error } : {}), rows: result.rows, violations: result.violations, covered: result.covered, problems: [...result.problems, ...checked.floor.problems], coverage: result.coverage, metadata: result.metadata }, null, 2));
+    print(JSON.stringify({ ok: checked.ok, ...(checked.enrollmentPending ? { enrollmentPending: true, warning: checked.warning } : {}), ...(error ? { error } : {}), ...(blocked ? { blocked } : {}), rows: result.rows, violations: result.violations, covered: result.covered, problems: [...result.problems, ...checked.floor.problems], coverage: result.coverage, metadata: result.metadata }, null, 2));
   } else {
     print(`RightKit ownership: ${path.basename(app)}`);
     print(formatTable(result.rows));
@@ -79,7 +87,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
       print(`  OWN COPY ${v.fingerprint} (${v.package}) ${v.file}${v.line ? `:${v.line}` : ""}  ${v.text}`);
     }
     for (const p of result.problems) print(`  ${checked.enrollmentPending ? "DIAGNOSTIC" : "EXCEPTION"} ${p}`);
-    print(checked.enrollmentPending ? `[right-release] ${checked.warning}` : checked.ok ? "[right-release] ownership passed" : `[right-release] ownership FAILED: ${[...result.problems, ...checked.floor.problems].join("; ") || "move these to RightKit or add a reviewed, dated exception"}`);
+    print(verdictLine(checked, result, blocked));
   }
   // CI lanes may pass `--advisory-when-pending`: before approval keys are enrolled the scan asserts
   // nothing, so findings print as diagnostics and the step exits 0. Release lanes never pass it.
@@ -115,9 +123,62 @@ function printAuditJson(result, print) {
   }
 }
 
-function failClosed(args, type, message, print = (value) => console.log(value)) {
-  if (args.includes("--audit-json")) { console.error(`[right-release] ownership audit failed: ${message}`); return 1; }
-  if (args.includes("--json")) print(JSON.stringify({ ok: false, error: { type, message }, rows: [], violations: [], covered: [], problems: [message], coverage: [], metadata: null }, null, 2));
+// Each refusal names its blocking check and the first offending paths. Stderr and the JSON `blocked` field carry the same list.
+const BLOCKED_PATH_LIMIT = 10;
+
+function blockedCheck(check, message, paths = []) {
+  return { check, message, count: paths.length, paths: paths.slice(0, BLOCKED_PATH_LIMIT) };
+}
+
+// The checks that refuse a scan that did not pass. Advise-tier findings are never listed here.
+function blockingChecks(checked) {
+  const result = checked.result;
+  const checks = [];
+  const blocking = (result.violations ?? []).filter(isBlockingFinding);
+  if (blocking.length) checks.push(blockedCheck("ownership-violation", `${blocking.length} block-tier finding(s) duplicate RightKit owners`, blocking.map((entry) => entry.file).filter(Boolean)));
+  const floorProblems = checked.floor?.ok === false ? checked.floor.problems ?? [] : [];
+  if (floorProblems.length) checks.push(blockedCheck("ownership-floor", floorProblems.join("; ")));
+  const problems = (result.problems ?? []).filter((problem) => !floorProblems.includes(problem));
+  if (problems.length) checks.push(blockedCheck("ownership-problem", problems.join("; ")));
+  const gaps = result.coverage ?? [];
+  if (gaps.length) checks.push(blockedCheck("ownership-coverage", `${gaps.length} coverage gap(s): ${[...new Set(gaps.map((gap) => gap.reason))].join(", ")}`, gaps.map((gap) => gap.path)));
+  if (!checks.length) checks.push(blockedCheck("ownership-unknown", "scan reported not ok without a listed cause"));
+  return checks;
+}
+
+function reportBlocked(checks, stderr) {
+  for (const check of checks) {
+    stderr(`[right-release] refused by check ${check.check}: ${check.message}`);
+    for (const file of check.paths) stderr(`  - ${file}`);
+    if (check.count > check.paths.length) stderr(`  ... and ${check.count - check.paths.length} more`);
+  }
+}
+
+function tierCounts(violations) {
+  const counts = { block: 0, advise: 0 };
+  for (const violation of violations) counts[isBlockingFinding(violation) ? "block" : "advise"] += 1;
+  return counts;
+}
+
+// The human verdict line. Advise-only results pass and say so; a refusal names its checks.
+function verdictLine(checked, result, blocked) {
+  if (checked.enrollmentPending) return `[right-release] ${checked.warning}`;
+  if (checked.ok) {
+    const counts = tierCounts(result.violations ?? []);
+    return counts.advise
+      ? `[right-release] ownership ADVISE: block ${counts.block}, advise ${counts.advise} (reported, not refused)`
+      : "[right-release] ownership passed";
+  }
+  const hint = blocked.some((entry) => entry.check === "ownership-violation") ? "; move these to RightKit or add a reviewed, dated exception" : "";
+  return `[right-release] ownership FAILED: ${blocked.map((entry) => `${entry.check}: ${entry.message}`).join("; ")}${hint}`;
+}
+
+// Refusal before any verdict: unresolved repository, protected evidence, or a dirty protected checkout.
+function refuse(args, { type, message, blocked }, { print = (value) => console.log(value), stderr = (line) => console.error(line) } = {}) {
+  const checks = blocked ?? [blockedCheck(type, message)];
+  reportBlocked(checks, stderr);
+  if (args.includes("--audit-json")) { stderr(`[right-release] ownership audit failed: ${message}`); return 1; }
+  if (args.includes("--json")) print(JSON.stringify({ ok: false, error: { type, message }, blocked: checks, rows: [], violations: [], covered: [], problems: [message], coverage: [], metadata: null }, null, 2));
   else print(`[right-release] ownership FAILED: ${message}`);
   return 1;
 }

package/ownership-evidence.mjs

@@ -90,7 +90,7 @@ function createEvidence(repoRoot, {
     : { ok: false, problems: ["protected ownership floor is unavailable until trust registry enrollment"] };
   if (bundleProblem) { floor.ok = false; floor.problems = [bundleProblem, ...floor.problems.filter((problem) => !problem.startsWith("ownership policy bundle"))]; }
   // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
-  const real = (p) => { try { return realpathSync(p); } catch { return path.resolve(p); } };
+  const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
   const requestedRoot = path.relative(real(root), real(scanRoot)).replaceAll("\\", "/") || ".";
   if (requestedRoot.startsWith("../") || requestedRoot === ".." || path.isAbsolute(requestedRoot)) throw new Error("ownership evidence scan root must be inside repository");
   const evidenceDiagnostics = [];

package/ownership-key-authority.mjs

@@ -37,7 +37,7 @@ function validateAuthority(authority) {
   if (typeof authority.checkoutPath !== "string" || !path.isAbsolute(authority.checkoutPath) || authority.checkoutPath.includes("\0")) throw new Error("protected key authority checkoutPath must be absolute");
   const repositoryIdentity = canonicalRepositoryIdentity(authority.repositoryIdentity);
   if (repositoryIdentity !== authority.repositoryIdentity) throw new Error("protected key authority identity must be canonical");
-  const checkoutPath = realpathSync(authority.checkoutPath);
+  const checkoutPath = realpathSync.native(authority.checkoutPath);
   if (!statSync(checkoutPath).isDirectory()) throw new Error("protected key authority checkoutPath must be a directory");
   return { repositoryIdentity, checkoutPath };
 }

package/ownership-key-command.mjs

@@ -41,7 +41,8 @@ function readLog(root) {
 }
 function ensureCleanMetadata(root, run, rels) {
   for (const rel of rels) assertSafeMetadataParents(root, rel);
-  const result = run("git", ["-C", root, "status", "--porcelain=v1", "--untracked-files=all"]);
+  // Limited to the metadata paths: an unscoped status of a large checkout overflows the child's output buffer.
+  const result = run("git", ["-C", root, "status", "--porcelain=v1", "--untracked-files=all", "--", ...rels]);
   if (result.status !== 0) throw new Error("could not inspect repository metadata status");
   const status = String(result.stdout ?? "");
   for (const rel of rels) {
@@ -49,7 +50,7 @@ function ensureCleanMetadata(root, run, rels) {
   }
 }
 function metadataIsDirty(root, run) {
-  const r = run("git", ["-C", root, "status", "--porcelain=v1", "--untracked-files=all"]);
+  const r = run("git", ["-C", root, "status", "--porcelain=v1", "--untracked-files=all", "--", LOG, REQUEST_DIR]);
   if (r.status !== 0) throw new Error("could not inspect repository metadata status");
   return String(r.stdout ?? "").split(/\r?\n/).some((line) => {
     const file = line.slice(3).replaceAll('"', "");
@@ -355,7 +356,7 @@ export async function main(args, deps = {}) {
   try {
     if (!platform) throw new Error(`ownership key management unsupported platform: ${process.platform}`);
     // Delegate BEFORE taking the command lock: the desktop-session child needs that same lock.
-    if (args[0] === "trust-sync" && needsDesktopDelegation({ hostPlatform: deps.hostPlatform, env: deps.env, run, elevatedCheck: deps.elevatedCheck })) return delegateTrustSync(deps, run, print);
+    if (args[0] === "trust-sync" && !args.includes("--check") && needsDesktopDelegation({ hostPlatform: deps.hostPlatform, env: deps.env, run, elevatedCheck: deps.elevatedCheck })) return delegateTrustSync(deps, run, print);
     const helper = deps.helper ?? helperFor(run);
     const lockPath = deps.lockPath ?? path.join(os.tmpdir(), "rightkit-key-command.lock");
     let lockFd;
@@ -524,6 +525,17 @@ async function trustSync(_args, d) {
   if (!trust?.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host; run ownership enroll");
   if (trust.trust.rootFingerprint !== pin) throw new Error("committed key log root does not match this host's protected trust");
   const baseline = d.baseline ?? parse(readFileSync(path.join(here, "ownership-default-policy.json"), "utf8"), "ownership default policy");
+  if (_args.includes("--check")) {
+    // Read-only: say whether a sync would ask for approval, and for what. Asks nothing, elevates nothing, writes no trust.
+    const request = makeTrustRequest(log, pin, baseline, d.authority);
+    try {
+      const summary = (d.summarize ?? summarizeRequestFile)({ file: request.file, digest: request.digest, existing: trust.trust, ...(d.summaryInputs ?? {}) });
+      if (!summary.changed) { d.print("trust already current: no approval needed"); return 0; }
+      d.print(summary.lines.join("\n"));
+      d.print("approval needed: trust-sync on this host would ask for the change above");
+      return 3;
+    } finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
+  }
   const installed = await installCheckpoint(log, pin, baseline, d);
   if (installed === false) { d.print("trust already current"); return 0; }
   postVerify(d.root, log, d);

package/ownership-key-elevation.mjs

@@ -169,7 +169,7 @@ export function capSummary(lines, { maxLines = 16, maxChars = 1600 } = {}) {
 
 export function buildMacConfirmScript(text) {
   // The text field takes keyboard focus, so stray typing never presses a button; approval needs "yes" typed.
-  return `display dialog ${appleScriptText(`${text}\n\nType yes below, then click Approve.`)} default answer "" with title ${appleScriptText(CONFIRM_TITLE)} buttons {"Cancel","Approve\u2026"} default button "Approve\u2026" cancel button "Cancel" with icon caution`;
+  return `display dialog ${appleScriptText(`${text}\n\nType the word yes below (not your password), then click Approve.`)} default answer "" with title ${appleScriptText(CONFIRM_TITLE)} buttons {"Cancel","Approve\u2026"} default button "Approve\u2026" cancel button "Cancel" with icon caution`;
 }
 
 export const WINDOWS_APPROVE_PREFIX = "RK_CONFIRM_APPROVED:";
@@ -189,7 +189,16 @@ export function buildWindowsConfirmScript(text, nonce = "") {
 
 function readLineSync() {
   const buf = Buffer.alloc(1); let line = "";
-  for (;;) { let n = 0; try { n = readSync(0, buf, 0, 1, null); } catch { return line; } if (n === 0 || buf[0] === 10) return line; line += String.fromCharCode(buf[0]); }
+  for (;;) {
+    let n = 0;
+    try { n = readSync(0, buf, 0, 1, null); } catch (error) {
+      // A terminal whose stdin is non-blocking reports "no input yet" as EAGAIN: wait for the human, do not treat it as an answer.
+      if (error?.code === "EAGAIN") { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50); continue; }
+      return line;
+    }
+    if (n === 0 || buf[0] === 10) return line;
+    line += String.fromCharCode(buf[0]);
+  }
 }
 
 /**

package/ownership-mandatory-set.json

@@ -0,0 +1,420 @@
+{
+  "schema": 1,
+  "source": {
+    "table": "private-audits/TABLE1-MANDATORY.md:56-78 (M1-M23 requirement catalog)",
+    "versions": "private-audits/inventory/REQUIRED-VERSIONS.md (source versions at rightkit HEAD a15e62fd, registry readback 2026-10-13)",
+    "note": "min = required version (source version at P1.7 HEAD). registryMax = highest registry version at readback; where registryMax < min the required version is not yet published, so every consumer fails until it ships."
+  },
+  "defaultProfile": "desktop",
+  "defaultApps": [
+    "heardright",
+    "scraperight",
+    "coderight",
+    "cutright",
+    "genright",
+    "postright",
+    "viewright",
+    "mailright",
+    "pulse",
+    "ember"
+  ],
+  "appDeclarationFile": "rightkit-mandatory.json",
+  "profiles": {
+    "desktop": {
+      "description": "Default: every desktop app owes every row unless the app declares N/A with a reason."
+    },
+    "apple": {
+      "description": "Table 1-Apple is an unratified draft. Profile is supported by the data model; no Apple rows are shipped.",
+      "ratified": false
+    }
+  },
+  "rows": [
+    {
+      "id": "M1",
+      "name": "Window host",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-tauri-shell",
+          "ecosystem": "cargo",
+          "min": "0.3.0"
+        },
+        {
+          "name": "rightkit-device",
+          "ecosystem": "cargo",
+          "min": "0.1.3"
+        },
+        {
+          "name": "@rightkit/tauri",
+          "ecosystem": "npm",
+          "min": "0.2.0",
+          "registryMax": "0.2.0"
+        }
+      ]
+    },
+    {
+      "id": "M2",
+      "name": "App frame",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "@rightkit/react-shell",
+          "ecosystem": "npm",
+          "min": "0.6.4"
+        },
+        {
+          "name": "@rightkit/platform-ui",
+          "ecosystem": "npm",
+          "min": "0.2.8",
+          "registryMax": "0.2.7"
+        },
+        {
+          "name": "@rightkit/theme",
+          "ecosystem": "npm",
+          "min": "0.2.3",
+          "registryMax": "0.2.3"
+        }
+      ]
+    },
+    {
+      "id": "M3",
+      "name": "Engine supervision",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-job-queue",
+          "ecosystem": "cargo",
+          "min": "0.3.0"
+        },
+        {
+          "name": "rightkit-child-process",
+          "ecosystem": "cargo",
+          "min": "0.4.0"
+        }
+      ]
+    },
+    {
+      "id": "M4",
+      "name": "Window/CLI protocol",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-job-queue",
+          "ecosystem": "cargo",
+          "min": "0.3.0"
+        },
+        {
+          "name": "rightkit-sidecar",
+          "ecosystem": "cargo",
+          "min": "0.2.0"
+        }
+      ]
+    },
+    {
+      "id": "M5",
+      "name": "Other child processes",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-child-process",
+          "ecosystem": "cargo",
+          "min": "0.4.0"
+        }
+      ]
+    },
+    {
+      "id": "M6",
+      "name": "Data location",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-daemon",
+          "ecosystem": "cargo",
+          "min": "0.2.0"
+        }
+      ]
+    },
+    {
+      "id": "M7",
+      "name": "Local services",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-daemon",
+          "ecosystem": "cargo",
+          "min": "0.2.0"
+        }
+      ]
+    },
+    {
+      "id": "M8",
+      "name": "Safe file writes",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-fs",
+          "ecosystem": "cargo",
+          "min": "0.4.0",
+          "registryMax": "0.3.3"
+        }
+      ]
+    },
+    {
+      "id": "M9",
+      "name": "Database",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-db",
+          "ecosystem": "cargo",
+          "min": "0.4.0",
+          "registryMax": "0.3.2"
+        }
+      ]
+    },
+    {
+      "id": "M10",
+      "name": "Settings",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-app-settings",
+          "ecosystem": "cargo",
+          "min": "0.2.0"
+        },
+        {
+          "name": "@rightkit/settings-ui",
+          "ecosystem": "npm",
+          "min": "0.4.4",
+          "registryMax": "0.4.3"
+        }
+      ]
+    },
+    {
+      "id": "M11",
+      "name": "Secrets",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-credentials",
+          "ecosystem": "cargo",
+          "min": "0.2.0"
+        }
+      ]
+    },
+    {
+      "id": "M12",
+      "name": "Licence/device",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-license",
+          "ecosystem": "cargo",
+          "min": "0.2.0",
+          "registryMax": "0.1.3"
+        },
+        {
+          "name": "rightkit-device",
+          "ecosystem": "cargo",
+          "min": "0.1.3"
+        },
+        {
+          "name": "@rightkit/license",
+          "ecosystem": "npm",
+          "min": "0.2.0",
+          "registryMax": "0.1.8"
+        }
+      ]
+    },
+    {
+      "id": "M13",
+      "name": "Pro entitlement",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-license",
+          "ecosystem": "cargo",
+          "min": "0.2.0",
+          "registryMax": "0.1.3"
+        }
+      ]
+    },
+    {
+      "id": "M14",
+      "name": "Legal/onboarding",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "@rightkit/legal",
+          "ecosystem": "npm",
+          "min": "0.3.1",
+          "registryMax": "0.3.1"
+        },
+        {
+          "name": "@rightkit/legal-ui",
+          "ecosystem": "npm",
+          "min": "0.2.2",
+          "registryMax": "0.2.2"
+        },
+        {
+          "name": "@rightkit/onboarding",
+          "ecosystem": "npm",
+          "min": "0.3.3",
+          "registryMax": "0.3.2"
+        }
+      ]
+    },
+    {
+      "id": "M15",
+      "name": "Logging",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-logs",
+          "ecosystem": "cargo",
+          "min": "0.2.2",
+          "registryMax": "0.2.1"
+        },
+        {
+          "name": "@rightkit/logs",
+          "ecosystem": "npm",
+          "min": "0.1.4",
+          "registryMax": "0.1.4"
+        }
+      ]
+    },
+    {
+      "id": "M16",
+      "name": "Crash reporting",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-crash",
+          "ecosystem": "cargo",
+          "min": "0.2.2",
+          "registryMax": "0.2.1"
+        }
+      ]
+    },
+    {
+      "id": "M17",
+      "name": "HTTP",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-http",
+          "ecosystem": "cargo",
+          "min": "0.3.0",
+          "registryMax": "0.2.5"
+        }
+      ]
+    },
+    {
+      "id": "M18",
+      "name": "Updates",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "@rightkit/app-update",
+          "ecosystem": "npm",
+          "min": "0.2.5"
+        }
+      ]
+    },
+    {
+      "id": "M19",
+      "name": "Release tooling",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "@rightkit/release",
+          "ecosystem": "npm",
+          "min": "0.2.153",
+          "registryMax": "0.2.151",
+          "allowDev": true
+        }
+      ]
+    },
+    {
+      "id": "M20",
+      "name": "QA",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-qa",
+          "ecosystem": "cargo",
+          "min": "0.2.16",
+          "registryMax": "0.2.14",
+          "allowDev": true
+        },
+        {
+          "name": "rightkit-qa-driver",
+          "ecosystem": "cargo",
+          "min": "0.3.0",
+          "allowDev": true
+        },
+        {
+          "name": "@rightkit/qa",
+          "ecosystem": "npm",
+          "min": "0.4.8",
+          "registryMax": "0.4.7",
+          "allowDev": true
+        },
+        {
+          "name": "@rightkit/qa-chrome",
+          "ecosystem": "npm",
+          "min": "0.1.6",
+          "registryMax": "0.1.6",
+          "allowDev": true
+        }
+      ]
+    },
+    {
+      "id": "M22",
+      "name": "Agent surface",
+      "profile": "desktop",
+      "owners": [
+        {
+          "name": "rightkit-mcp",
+          "ecosystem": "cargo",
+          "min": "0.6.0",
+          "registryMax": "0.5.3"
+        }
+      ]
+    }
+  ],
+  "pendingRows": [
+    {
+      "id": "M21",
+      "name": "Test mode",
+      "profile": "desktop",
+      "owners": [],
+      "ownerPending": "No selected owner (D4 unratified); never fails."
+    },
+    {
+      "id": "M23",
+      "name": "Release-time switches",
+      "profile": "desktop",
+      "owners": [],
+      "ownerPending": "No selected owner (D4 unratified); never fails."
+    }
+  ],
+  "amendments": {
+    "v2.1": {
+      "description": "TABLE1-AMENDMENT-v2.1 (draft): @rightkit/tauri-shell joins M1. Opt-in via --amendment v2.1.",
+      "rows": [
+        {
+          "id": "M1",
+          "profile": "desktop",
+          "owners": [
+            {
+              "name": "@rightkit/tauri-shell",
+              "ecosystem": "npm",
+              "min": "0.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  }
+}