@rightkit/release 0.2.161 → 0.2.162

package/disk-policy.json

@@ -47,7 +47,9 @@
     {"id": "leftover-node-modules-medium-packages", "platform": "mac", "path": "/Volumes/D/claude/rightkit/packages/*/node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
     {"id": "leftover-legion-snap", "platform": "mac", "path": "/Volumes/D/claude/legion-snap-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
     {"id": "leftover-legion-final", "platform": "mac", "path": "/Volumes/D/claude/legion-final-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
-    {"id": "leftover-pulse-bak", "platform": "win", "path": "${LOCALAPPDATA}\\Programs\\Pulse.bak-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"}
+    {"id": "leftover-pulse-bak", "platform": "win", "path": "${LOCALAPPDATA}\\Programs\\Pulse.bak-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "qa-evidence-runs", "platform": "mac", "path": "/Volumes/D/claude/*/.cache/rightkit-qa/*", "capBytes": 5368709120, "action": "sweep", "unit": "self", "staleDays": 3, "skipTracked": true},
+    {"id": "qa-evidence-runs", "platform": "win", "path": "D:\\claude\\*\\.cache\\rightkit-qa\\*", "capBytes": 5368709120, "action": "sweep", "unit": "self", "staleDays": 3, "skipTracked": true}
   ],
   "protectedSegments": ["Application Support", "Keychains", "Keychain", "HeardRightNext", "Credentials", ".ssh", ".rightkit-managed", ".rightkit-swept"]
 }

package/disk-policy.mjs

@@ -187,14 +187,25 @@ export function windowsLockProbe(candidate) {
   return false;
 }
 
-export function planSweep({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), staleDays = policy.staleDays, openPaths, inUse, size = (p) => pathSize(p, { platform }) } = {}) {
+// True when git tracks anything at or under `target` (a tracked file is never swept). Not in a repository: not tracked.
+export function gitTracksPath(target) {
+  const top = spawnSync("git", ["-C", path.dirname(target), "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  if (top.status !== 0) return false;
+  const listed = spawnSync("git", ["-C", String(top.stdout).trim(), "ls-files", "-z", "--", target], { encoding: "utf8" });
+  if (listed.status !== 0) return true; // cannot prove untracked: keep it
+  return String(listed.stdout).length > 0;
+}
+
+export function planSweep({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), staleDays, openPaths, inUse, tracked = gitTracksPath, size = (p) => pathSize(p, { platform }) } = {}) {
   const key = platformKey(platform);
-  const cutoff = now - staleDays * 86400_000;
+  const effectiveDays = staleDays ?? policy.staleDays;
   const candidates = [];
   const skipped = [];
   const seen = new Set();
   const lockCheck = inUse ?? (key === "win" ? windowsLockProbe : (p) => inUseByOpenPaths(p, openPaths));
   for (const writer of policy.writers.filter((w) => w.platform === key && w.action === "sweep")) {
+    // `--days N` overrides every writer; otherwise a writer may carry its own window (QA evidence: 3 days).
+    const cutoff = now - (staleDays ?? writer.staleDays ?? policy.staleDays) * 86400_000;
     let roots; let literal;
     try { roots = writerMatches(writer, { env, home }); literal = literalRoot(expandPolicyPath(writer.path, { env, home })); } catch { continue; }
     const units = [];
@@ -216,12 +227,13 @@ export function planSweep({ policy, platform = process.platform, env = process.e
       if (st.isSymbolicLink()) { skipped.push({ ...base, reason: "symlink" }); continue; }
       if (!isInsideRoot(unit, root)) { skipped.push({ ...base, reason: "outside-root" }); continue; }
       if (isProtectedPath(unit, policy)) { skipped.push({ ...base, reason: "protected" }); continue; }
+      if (writer.skipTracked && tracked(unit)) { skipped.push({ ...base, reason: "tracked" }); continue; }
       if (hasFreshContent(unit, cutoff)) { skipped.push({ ...base, reason: "fresh" }); continue; }
       if (lockCheck(unit)) { skipped.push({ ...base, reason: "in-use" }); continue; }
       candidates.push({ ...base, root, bytes: size(unit), mtime: new Date(st.mtimeMs).toISOString() });
     }
   }
-  return { schema: 1, platform: key, staleDays, candidates, skipped, totalBytes: candidates.reduce((s, c) => s + c.bytes, 0) };
+  return { schema: 1, platform: key, staleDays: effectiveDays, candidates, skipped, totalBytes: candidates.reduce((s, c) => s + c.bytes, 0) };
 }
 
 export const HOLDING_DIR = ".rightkit-swept";

package/ownership-approval.mjs

@@ -285,15 +285,22 @@ function versionAtLeast(actual, minimum) {
   }
   return true;
 }
+// The protected policy bundle (scanner source, catalog, registry, dependency allowlist) is still fingerprinted and a pin
+// that differs from the running bundle is reported, but only as a warning: trust-sync, the human-approved way to
+// re-pin it, is retired (Adrian, decisions.md), so no check refuses on a missing or stale pinned bundle.
+export const TRUST_SYNC_RETIRED = "right-release ownership trust-sync is retired: no release, ownership or QA check needs a human-approved policy bundle any more. The bundle is still fingerprinted; `right-release ownership trust-compare` reports drift as a warning with a semantic diff.";
+
+export const POLICY_BUNDLE_DRIFT_WARNING = "ownership policy bundle (scanner source, catalog, registry or dependency allowlist) differs from the bundle pinned in protected trust (warning only; trust-sync is retired)";
 export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest, policyBundleDigest } = {}) {
   const problems = [];
-  if (!trust) return { ok: false, problems: ["external ownership trust unavailable"] };
+  const warnings = [];
+  if (!trust) return { ok: false, problems: ["external ownership trust unavailable"], warnings };
   if (!versionAtLeast(scannerVersion, trust.minimumScannerVersion)) problems.push("scanner version missing, malformed, or below protected minimum");
   if (!versionAtLeast(catalogVersion, trust.minimumCatalogVersion)) problems.push("catalog version missing, malformed, or below protected minimum");
   if (trust.minimumCatalogDigest && trust.minimumCatalogDigest !== catalogDigest) problems.push("catalog digest below protected pinned digest");
-  // Trust written before the bundle existed has no policyBundle and stays unpinned until the next trust-sync.
-  if (trust.policyBundle?.digest && policyBundleDigest !== undefined && trust.policyBundle.digest !== policyBundleDigest) problems.push("ownership policy bundle (scanner source, catalog, registry or dependency allowlist) differs from the protected pinned bundle; run trust-sync");
-  return { ok: problems.length === 0, problems };
+  // Trust written before the bundle existed has no policyBundle: nothing to compare.
+  if (trust.policyBundle?.digest && policyBundleDigest !== undefined && trust.policyBundle.digest !== policyBundleDigest) warnings.push(POLICY_BUNDLE_DRIFT_WARNING);
+  return { ok: problems.length === 0, problems, warnings };
 }
 function protectedLocation(file, platform, { runner = spawnSync, inspect = lstatSync, stat = statSync, requireNonElevated = true } = {}) {
   const problems = [];

package/ownership-command.mjs

@@ -4,20 +4,22 @@
 //
 //   right-release ownership [--app <dir>] [--json]
 //   right-release ownership [--app <dir>] --audit-json   (Legion governance.capability-ownership provider)
-//   right-release ownership trust-compare [--json]   (print this host's protected-trust digest)
+//   right-release ownership trust-compare [--json]   (print this host's protected-trust digest; policy-bundle drift is a warning, never a block)
+//   right-release ownership trust-sync               (retired: prints why and exits 0)
 //   right-release ownership --write-manifest [--rightkit <rightkit>] [--approve-new-capabilities]
 // --approve-new-capabilities permits new ids during local generation only.
 // Existing owner changes are always refused; installation needs protected authorization.
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { formatTable } from "./ownership.mjs";
+import { SCANNER_VERSION, formatTable } from "./ownership.mjs";
 import { writeOwnershipCatalog } from "./ownership-catalog.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { main as stagedMain } from "./ownership-staged.mjs";
 import { loadTrustedExternal } from "./ownership-approval.mjs";
-import { trustComparison } from "./ownership-policy-bundle.mjs";
+import { diffPolicyBundles, runningPolicyBundle, trustComparison } from "./ownership-policy-bundle.mjs";
+import { POLICY_BUNDLE_DRIFT_WARNING, TRUST_SYNC_RETIRED } from "./ownership-approval.mjs";
 import { isBlockingFinding } from "./ownership-verdict.mjs";
 
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
@@ -27,14 +29,41 @@ function flag(args, name) {
   return i >= 0 ? args[i + 1] : undefined;
 }
 
+/** Semantic drift of the bundle pinned in protected trust against the bundle this checkout runs; null when none is pinned or they match. */
+export function policyBundleDrift(trust, { runningBundle = () => runningPolicyBundle({ scannerVersion: SCANNER_VERSION }) } = {}) {
+  const pinned = trust?.policyBundle;
+  if (!pinned?.digest) return null;
+  let running;
+  try { running = runningBundle(); } catch (error) { return { warning: `policy bundle could not be computed: ${error.message}`, diff: null }; }
+  if (running.digest === pinned.digest) return null;
+  return { warning: POLICY_BUNDLE_DRIFT_WARNING, pinnedDigest: pinned.digest, runningDigest: running.digest, diff: diffPolicyBundles(pinned, running) };
+}
+
+function driftLines(drift) {
+  const lines = [`WARNING: ${drift.warning}`];
+  if (drift.diff) {
+    const { filesAdded, filesRemoved, filesChanged, scannerVersion, catalogChanged, registryChanged, allowlistChanged, qaFloorChanged } = drift.diff;
+    if (scannerVersion) lines.push(`  scanner version: ${scannerVersion.from} -> ${scannerVersion.to}`);
+    for (const [label, list] of [["files added", filesAdded], ["files removed", filesRemoved], ["files changed", filesChanged]]) if (list.length) lines.push(`  ${label}: ${list.join(", ")}`);
+    const moved = Object.entries({ catalog: catalogChanged, registry: registryChanged, allowlist: allowlistChanged, "qa floor": qaFloorChanged }).filter(([, changed]) => changed).map(([name]) => name);
+    if (moved.length) lines.push(`  changed digests: ${moved.join(", ")}`);
+  }
+  return lines;
+}
+
 /** Print this host's protected-trust digest. The Mac's digest is the reference; see docs/OWNERSHIP-ENFORCEMENT.md. */
-export function trustCompare(args, { print, trustLoader = loadTrustedExternal } = {}) {
+export function trustCompare(args, { print, trustLoader = loadTrustedExternal, runningBundle } = {}) {
   let state;
   try { state = trustLoader(); } catch (error) { print(`[right-release] trust-compare: protected trust unreadable (${error.message})`); return 1; }
   if (!state?.trust) { print("[right-release] trust-compare: no protected trust on this host (not enrolled)"); return 1; }
   const { digest, components } = trustComparison(state.trust);
-  if (args.includes("--json")) print(JSON.stringify({ platform: process.platform, digest, components }, null, 2));
-  else { print(`trust digest (${process.platform}): ${digest}`); for (const [name, value] of Object.entries(components)) print(`  ${name}: ${typeof value === "object" && value !== null ? JSON.stringify(value) : value ?? "none"}`); }
+  const drift = policyBundleDrift(state.trust, runningBundle ? { runningBundle } : undefined);
+  if (args.includes("--json")) print(JSON.stringify({ platform: process.platform, digest, components, ...(drift ? { warnings: [drift] } : {}) }, null, 2));
+  else {
+    print(`trust digest (${process.platform}): ${digest}`);
+    for (const [name, value] of Object.entries(components)) print(`  ${name}: ${typeof value === "object" && value !== null ? JSON.stringify(value) : value ?? "none"}`);
+    if (drift) for (const line of driftLines(drift)) print(line);
+  }
   return 0;
 }
 
@@ -45,7 +74,8 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   }
   if (args[0] === "trust-compare") return trustCompare(args, { print, trustLoader });
   if (args.includes("--staged")) return stagedMain(args, { print });
-  if (["enroll", "approve-key", "revoke-key", "trust-sync"].includes(args[0])) {
+  if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
+  if (["enroll", "approve-key", "revoke-key"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
     return keyMain(args, { runner: gitRunner, print });
   }
@@ -79,7 +109,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
       : result.coverage.length
         ? { type: "ownership-coverage", message: `${result.coverage.length} ownership coverage gap(s)` }
         : undefined;
-    print(JSON.stringify({ ok: checked.ok, ...(checked.enrollmentPending ? { enrollmentPending: true, warning: checked.warning } : {}), ...(error ? { error } : {}), ...(blocked ? { blocked } : {}), rows: result.rows, violations: result.violations, covered: result.covered, problems: [...result.problems, ...checked.floor.problems], coverage: result.coverage, metadata: result.metadata }, null, 2));
+    print(JSON.stringify({ ok: checked.ok, ...(checked.enrollmentPending ? { enrollmentPending: true, warning: checked.warning } : {}), ...(error ? { error } : {}), ...(blocked ? { blocked } : {}), rows: result.rows, violations: result.violations, covered: result.covered, problems: [...result.problems, ...checked.floor.problems], ...(checked.warnings ? { warnings: checked.warnings } : {}), coverage: result.coverage, metadata: result.metadata }, null, 2));
   } else {
     print(`RightKit ownership: ${path.basename(app)}`);
     print(formatTable(result.rows));
@@ -88,6 +118,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
     }
     for (const p of result.problems) print(`  ${checked.enrollmentPending ? "DIAGNOSTIC" : "EXCEPTION"} ${p}`);
     print(verdictLine(checked, result, blocked));
+    for (const warning of checked.warnings ?? []) print(`  WARNING ${warning}`);
   }
   // CI lanes may pass `--advisory-when-pending`: before approval keys are enrolled the scan asserts
   // nothing, so findings print as diagnostics and the step exits 0. Release lanes never pass it.

package/ownership-dependency-allowlist-seed.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Propose or regenerate dependency-allowlist baselines from each registered repository's CURRENT direct
-// dependencies. This only edits the committed proposal file; it takes effect solely through Adrian's trust-sync.
+// dependencies. This only edits the committed proposal file; it is advisory until a protected trust copy carries it (trust-sync is retired).
 //   node ownership-dependency-allowlist-seed.mjs --workspace <dir> [--write]
 // Existing approvals are never removed (union with the current file); block-tier catalog dependencies
 // and RightKit packages are never recorded as approvals.

package/ownership-evidence.mjs

@@ -78,7 +78,8 @@ function createEvidence(repoRoot, {
   // When a protected registry exists, key enrollment controls signing
   // authority; scanner and catalog floors still apply during pending enrollment.
   // Step 2: the protected trust pins the policy bundle (catalog + registry + dependency allowlist + scanner version +
-  // scanner source digests). Trust without a pinned bundle (written before it existed) is unpinned until trust-sync.
+  // scanner source digests). It is fingerprinted and compared for drift only: a pin that differs, or a bundle that cannot be
+  // computed, is a warning, never a block (trust-sync is retired).
   let policyBundleDigest;
   let bundleProblem = null;
   if (trustState.trust?.policyBundle?.digest) {
@@ -88,7 +89,7 @@ function createEvidence(repoRoot, {
   const floor = trustState.trust
     ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest, ...(policyBundleDigest !== undefined ? { policyBundleDigest } : {}) })
     : { ok: false, problems: ["protected ownership floor is unavailable until trust registry enrollment"] };
-  if (bundleProblem) { floor.ok = false; floor.problems = [bundleProblem, ...floor.problems.filter((problem) => !problem.startsWith("ownership policy bundle"))]; }
+  floor.warnings = [...(floor.warnings ?? []), ...(bundleProblem ? [bundleProblem] : [])];
   // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
   const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
   const requestedRoot = path.relative(real(root), real(scanRoot)).replaceAll("\\", "/") || ".";
@@ -152,7 +153,7 @@ function createEvidence(repoRoot, {
     ok: scans.every(({ scanned }) => scanned.ok),
     findings: scans.flatMap(({ scanned, prefix }) => (scanned.findings ?? []).map((entry) => rebase(entry, prefix))),
     violations: scans.flatMap(({ scanned, prefix }) => (scanned.violations ?? []).map((entry) => rebase(entry, prefix))),
-    problems: [...scans.flatMap(({ scanned }) => scanned.problems ?? []), ...evidenceDiagnostics, ...(enrollmentPending ? floor.problems : floor.problems.filter((problem) => problem.startsWith("ownership policy bundle")))],
+    problems: [...scans.flatMap(({ scanned }) => scanned.problems ?? []), ...evidenceDiagnostics, ...(enrollmentPending ? floor.problems : [])],
     rows: scans.flatMap(({ scanned, root: registered }) => (scanned.rows ?? []).map((row) => ({ ...row, root: registered }))),
     covered: scans.flatMap(({ scanned, prefix }) => (scanned.covered ?? []).map((entry) => rebase(entry, prefix))),
     coverage: contentCoverage,
@@ -182,7 +183,7 @@ function createEvidence(repoRoot, {
     checkedAt: new Date().toISOString(),
   };
   const warning = enrollmentPending ? "WARNING: ownership approval enrollment is pending; findings remain backlog diagnostics and no protected evidence or approvals are asserted" : undefined;
-  return { ok: !enrollmentPending && result.ok && floor.ok && contentCoverage.length === 0, ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), evidence, result, floor, contentCoverage };
+  return { ok: !enrollmentPending && result.ok && floor.ok && contentCoverage.length === 0, ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), ...(floor.warnings.length ? { warnings: floor.warnings } : {}), evidence, result, floor, contentCoverage };
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */

package/ownership-key-command.mjs

@@ -5,10 +5,9 @@ import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawnSync, spawnSyncInteractive, windowsPowerShellEnvironment } from "./background-process.mjs";
 import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "./ownership-key-log.mjs";
-import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
+import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, TRUST_SYNC_RETIRED, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
-import { buildMacInvocation, confirmTrustChange, delegateToDesktop, hasTerminal, needsDesktopDelegation } from "./ownership-key-elevation.mjs";
-import { summarizeRequestFile } from "./ownership-trust-summary.mjs";
+import { buildMacInvocation, hasTerminal } from "./ownership-key-elevation.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const LOG = ".rightkit/ownership-keys.json";
@@ -321,7 +320,7 @@ function buildWindowsElevationInvocation(nodeExe, trustScript, requestPath, dige
   const parentScript = `$ErrorActionPreference='Stop'; try { $env:NODE_OPTIONS=$null; $env:NODE_PATH=$null; $p=Start-Process -FilePath ${quote(powershell)} -ArgumentList ${quote(`-NoProfile -EncodedCommand ${childEncoded}`)} -Verb RunAs -WindowStyle Hidden -Wait -PassThru; exit $p.ExitCode } catch { exit 1 }`;
   return { parentExecutable: powershell, parentArgs: ["-NoProfile", "-EncodedCommand", Buffer.from(parentScript, "utf16le").toString("base64")], childScript };
 }
-export const __testOnly = Object.freeze({ elevate, buildWindowsElevationInvocation, assertSafeMetadataParents, detectMinimizeHook, trustSyncGate, installCheckpoint });
+export const __testOnly = Object.freeze({ elevate, buildWindowsElevationInvocation, assertSafeMetadataParents, detectMinimizeHook, installCheckpoint });
 function trustState() { return loadTrustedExternal(); }
 function currentLogTrust(root, log, trust = trustState(), authority, injected = false) {
   if (!trust.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host");
@@ -353,10 +352,10 @@ export async function main(args, deps = {}) {
   const print = deps.print ?? console.log;
   const app = path.resolve(flag(args, "--app") ?? process.cwd());
   const root = deps.root ?? repoRoot(app, run);
+  if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
   try {
     if (!platform) throw new Error(`ownership key management unsupported platform: ${process.platform}`);
     // Delegate BEFORE taking the command lock: the desktop-session child needs that same lock.
-    if (args[0] === "trust-sync" && !args.includes("--check") && needsDesktopDelegation({ hostPlatform: deps.hostPlatform, env: deps.env, run, elevatedCheck: deps.elevatedCheck })) return delegateTrustSync(deps, run, print);
     const helper = deps.helper ?? helperFor(run);
     const lockPath = deps.lockPath ?? path.join(os.tmpdir(), "rightkit-key-command.lock");
     let lockFd;
@@ -371,8 +370,7 @@ export async function main(args, deps = {}) {
       if (verb === "enroll") return await enroll(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "approve-key") return await approve(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "revoke-key") return await revoke(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
-      if (verb === "trust-sync") return await trustSync(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
-      throw new Error("expected enroll, approve-key, revoke-key, or trust-sync");
+      throw new Error("expected enroll, approve-key, or revoke-key (trust-sync is retired)");
     } finally {
       closeSync(lockFd);
       rmSync(lockPath, { force: true });
@@ -508,53 +506,6 @@ async function resumeRootEnrollment(log, d) {
   print(`Ownership root enrollment recovery completed: ${pin}; active keys: ${state.keys.length}`);
   return 0;
 }
-function delegateTrustSync(deps, run, print) {
-  const result = delegateToDesktop({ run, command: deps.desktopCommand ?? [process.execPath, ...(process.argv[1] ? [path.resolve(process.argv[1])] : []), ...process.argv.slice(2)], ...(deps.desktopOptions ?? {}) });
-  if (result.output) print(result.output.trimEnd());
-  if (result.status !== 0) throw new Error(`desktop-session trust-sync failed (exit ${result.status}); see output above`);
-  return 0;
-}
-/** Advance this host's protected checkpoint to the committed key log (after another host approved or revoked a key). */
-async function trustSync(_args, d) {
-  d = { ...d, label: "RightKit ownership trust-sync", gate: trustSyncGate(d) };
-  const log = readLog(d.root);
-  const pin = log.events[0]?.payload?.rootFingerprint;
-  const state = verifyKeyLog(log, { rootFingerprint: pin });
-  if (!state.ok) throw new Error(`committed key log is invalid: ${state.problems.join("; ")}`);
-  const trust = (d.trustLoader ?? trustState)();
-  if (!trust?.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host; run ownership enroll");
-  if (trust.trust.rootFingerprint !== pin) throw new Error("committed key log root does not match this host's protected trust");
-  const baseline = d.baseline ?? parse(readFileSync(path.join(here, "ownership-default-policy.json"), "utf8"), "ownership default policy");
-  if (_args.includes("--check")) {
-    // Read-only: say whether a sync would ask for approval, and for what. Asks nothing, elevates nothing, writes no trust.
-    const request = makeTrustRequest(log, pin, baseline, d.authority);
-    try {
-      const summary = (d.summarize ?? summarizeRequestFile)({ file: request.file, digest: request.digest, existing: trust.trust, ...(d.summaryInputs ?? {}) });
-      if (!summary.changed) { d.print("trust already current: no approval needed"); return 0; }
-      d.print(summary.lines.join("\n"));
-      d.print("approval needed: trust-sync on this host would ask for the change above");
-      return 3;
-    } finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
-  }
-  const installed = await installCheckpoint(log, pin, baseline, d);
-  if (installed === false) { d.print("trust already current"); return 0; }
-  postVerify(d.root, log, d);
-  d.print(`Ownership trust synced to key-log sequence ${log.events.length - 1}; active keys: ${state.keys.length}`);
-  return 0;
-}
-/**
- * Informed-consent gate: summarize the exact request bytes (digest-checked) against the installed trust,
- * skip when nothing changes, otherwise require explicit approval before any elevation prompt.
- */
-function trustSyncGate(d) {
-  return (request) => {
-    const existing = (d.trustLoader ?? trustState)()?.trust ?? null;
-    const summary = (d.summarize ?? summarizeRequestFile)({ file: request.file, digest: request.digest, existing, ...(d.summaryInputs ?? {}) });
-    if (!summary.changed) return false;
-    (d.confirm ?? confirmTrustChange)({ lines: summary.lines, run: d.run, interactiveRun: d.run.interactive, print: d.print, hostPlatform: d.hostPlatform, ...(d.confirmOptions ?? {}) });
-    return true;
-  };
-}
 async function installCheckpoint(log, rootFingerprint, baseline, d) {
   const request = makeTrustRequest(log, rootFingerprint, baseline, d.authority);
   try {

package/ownership.mjs

@@ -562,7 +562,7 @@ function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), t
       if (blocked.has(`${d.ecosystem}:${d.name}`) || evaluateDependency(allowlistPolicy.allowlist, repositoryIdentity, { ecosystem: d.ecosystem, name: d.name, kind: sourceKind(d.source) }, { owners }).allowed) continue;
       findings.push({ fingerprint: ALLOWLIST_FINDING_ID, capability: "dependency-allowlist", package: "RightKit dependency allowlist", tier: allowlistPolicy.tier, file: d.file, line: 0, kind: "dependency", ecosystem: d.ecosystem, name: d.name,
         alias: d.alias, section: d.section, requirement: d.requirement, features: d.features, defaultFeatures: d.defaultFeatures, local: d.local, source: d.source, resolvedVersion: d.resolvedVersion,
-        text: `${d.ecosystem} dependency ${d.name} is not in ${ALLOWLIST_FILE}; propose it there and Adrian activates it via trust-sync`, provenance: d.source });
+        text: `${d.ecosystem} dependency ${d.name} is not in ${ALLOWLIST_FILE}; propose it there (advisory until protected trust carries the allowlist; trust-sync is retired)`, provenance: d.source });
     }
   }
   const blockRules = manifest.capabilities.flatMap((c) => c.fingerprints.filter((f) => f.type === "dependency" && findingPolicy(c, f).tier === "block").map((f) => ({ c, f })));
@@ -598,8 +598,8 @@ function shippedAllowlist() {
   try { const parsed = JSON.parse(readFileSync(shippedAllowlistFile, "utf8")); return validateAllowlist(parsed).ok ? parsed : null; } catch { return null; }
 }
 /**
- * Which allowlist applies and how hard. The protected trust copy (activated by trust-sync) governs every repository
- * registered in trust and blocks. Before trust-sync, or while approval enrollment is pending, the shipped proposal
+ * Which allowlist applies and how hard. The protected trust copy governs every repository
+ * registered in trust and blocks. When no trust copy applies, or while approval enrollment is pending, the shipped proposal
  * is advisory and only for repositories it has a baseline for.
  */
 export function dependencyAllowlistPolicy(trust, repositoryIdentity, { pending = false, shipped } = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.161",
+  "version": "0.2.162",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -31,7 +31,7 @@
     "@rightkit/qa": "0.4.8",
     "@rightkit/qa-chrome": "0.1.6",
     "@rightkit/react-shell": "0.6.4",
-    "@rightkit/release": "0.2.161",
+    "@rightkit/release": "0.2.162",
     "@rightkit/settings-ui": "0.4.4",
     "@rightkit/tauri": "0.2.1",
     "@rightkit/tauri-shell": "0.1.1",
@@ -202,7 +202,8 @@
       "0.2.156",
       "0.2.158",
       "0.2.159",
-      "0.2.160"
+      "0.2.160",
+      "0.2.161"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -512,7 +513,7 @@
       "@rightkit/qa": "0.4.8",
       "@rightkit/qa-chrome": "0.1.6",
       "@rightkit/react-shell": "0.6.4",
-      "@rightkit/release": "0.2.160",
+      "@rightkit/release": "0.2.161",
       "@rightkit/settings-ui": "0.4.4",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.2.1",