@rightkit/release 0.2.164 → 0.2.172

package/ownership-evidence.mjs

@@ -41,7 +41,7 @@ function createEvidence(repoRoot, {
   if (trustState.protection?.ok !== true && !pendingWithoutTrust) throw new Error("protected ownership trust location was not verified");
   if (!trustState.trust && !pendingWithoutTrust) throw new Error("protected ownership trust registry is missing");
   let enrollmentPending = trustState.enrolled !== true;
-  if (committed && enrollmentPending && !allowPendingAdvisory && !trustState.trust?.rootFingerprint) throw new Error("protected ownership evidence requires both distinct, unrevoked approval keys to be enrolled");
+  // Pending approval enrollment is a reported warning, never a failure: enrollment existed only for retired signed approvals (#262).
   // A valid protected registry with incomplete key enrollment can still drive
   // a useful local backlog scan. It cannot assert a protected source binding or verify
   // approval signatures, so this result is deliberately advisory.
@@ -88,7 +88,7 @@ function createEvidence(repoRoot, {
   }
   const floor = trustState.trust
     ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest, ...(policyBundleDigest !== undefined ? { policyBundleDigest } : {}) })
-    : { ok: false, problems: ["protected ownership floor is unavailable until trust registry enrollment"] };
+    : { ok: true, problems: [], warnings: ["protected ownership floor is unavailable: no protected trust registry is enrolled on this host (warning only)"] };
   floor.warnings = [...(floor.warnings ?? []), ...(bundleProblem ? [bundleProblem] : [])];
   // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
   const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
@@ -149,13 +149,16 @@ function createEvidence(repoRoot, {
     catch (error) { if (error?.code !== "ENOENT") throw error; return { root: registered, digest: sha256([]) }; }
   });
   const approvalsDigest = enrollmentPending ? null : sha256(approvals);
+  const resultWarnings = [...scans.flatMap(({ scanned, root: registered }) => (scanned.warnings ?? []).filter((w) => w.startsWith("exception #")).map((w) => (registered === "." ? w : `${registered}: ${w}`))), ...evidenceDiagnostics];
   const result = {
     ok: scans.every(({ scanned }) => scanned.ok),
     findings: scans.flatMap(({ scanned, prefix }) => (scanned.findings ?? []).map((entry) => rebase(entry, prefix))),
     violations: scans.flatMap(({ scanned, prefix }) => (scanned.violations ?? []).map((entry) => rebase(entry, prefix))),
-    problems: [...scans.flatMap(({ scanned }) => scanned.problems ?? []), ...evidenceDiagnostics, ...(enrollmentPending ? floor.problems : [])],
+    problems: scans.flatMap(({ scanned }) => scanned.problems ?? []),
     rows: scans.flatMap(({ scanned, root: registered }) => (scanned.rows ?? []).map((row) => ({ ...row, root: registered }))),
     covered: scans.flatMap(({ scanned, prefix }) => (scanned.covered ?? []).map((entry) => rebase(entry, prefix))),
+    // Stale plain exception entries (match no finding) are warnings, never blockers (Orthic-Labs/rightkit#262).
+    ...(resultWarnings.length ? { warnings: resultWarnings } : {}),
     coverage: contentCoverage,
     metadata: {
       repositoryIdentity, commit, tree, catalogDigest, contentDigests, coverage: contentCoverage,
@@ -182,8 +185,8 @@ function createEvidence(repoRoot, {
     contentDigest: enrollmentPending ? null : contentDigest,
     checkedAt: new Date().toISOString(),
   };
-  const warning = enrollmentPending ? "WARNING: ownership approval enrollment is pending; findings remain backlog diagnostics and no protected evidence or approvals are asserted" : undefined;
-  return { ok: !enrollmentPending && result.ok && floor.ok && contentCoverage.length === 0, ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), ...(floor.warnings.length ? { warnings: floor.warnings } : {}), evidence, result, floor, contentCoverage };
+  const warning = enrollmentPending ? "WARNING: ownership approval enrollment is pending (warning only: exceptions are plain git-reviewed entries); the advisory evidence asserts no protected source binding" : undefined;
+  return { ok: result.ok && floor.ok && contentCoverage.length === 0, ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), ...(floor.warnings.length ? { warnings: floor.warnings } : {}), evidence, result, floor, contentCoverage };
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */

package/ownership-git-inventory.mjs

@@ -12,6 +12,38 @@ const DEFAULT_MAX_FILE_BYTES = 2 * 1024 * 1024;
 const CACHE_LIMIT = 128 * 1024 * 1024;
 const blobCache = new Map();
 let cacheBytes = 0;
+// Dirty inputs kept for reuse. Reused only while size & mtime are unchanged; bounded like the Rust scanner.
+const HASH_CACHE_BYTES = 64 * 1024 * 1024;
+// A file modified more recently than this is never kept: a same-size rewrite inside one timestamp tick is indistinguishable.
+const RACY_WINDOW_MS = 2000;
+const hashCache = new Map();
+let hashCacheBytes = 0;
+
+function signatureOf(abs) {
+  try {
+    const stat = lstatSync(abs, { bigint: true });
+    return stat.isFile() ? { key: `${stat.size}:${stat.mtimeNs}`, size: Number(stat.size), mtimeMs: Number(stat.mtimeNs / 1000000n) } : undefined;
+  } catch { return undefined; }
+}
+
+// Read & hash one dirty input. A kept copy is reused only when size & mtime are unchanged; a file whose size or
+// mtime moved while it was read is returned but never kept. This scanner is single-threaded, so one worker at a time.
+function readHashed(abs) {
+  const before = signatureOf(abs);
+  if (before) {
+    const kept = hashCache.get(abs);
+    if (kept?.key === before.key) return { bytes: kept.bytes, sum: kept.sum };
+    if (kept) { hashCacheBytes -= kept.bytes.length; hashCache.delete(abs); }
+  }
+  const bytes = readFileSync(abs), sum = sha256(bytes);
+  if (before) {
+    const after = signatureOf(abs);
+    if (after?.key === before.key && bytes.length === before.size && before.mtimeMs + RACY_WINDOW_MS <= Date.now() && hashCacheBytes + before.size <= HASH_CACHE_BYTES) {
+      hashCache.set(abs, { key: before.key, bytes, sum }); hashCacheBytes += before.size;
+    }
+  }
+  return { bytes, sum };
+}
 
 function gitEnv() {
   const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^GIT_/i.test(key)));
@@ -19,10 +51,10 @@ function gitEnv() {
   return env;
 }
 
-function runGit(root, repositoryRoot, args, { input, maxBuffer = MAX_LIST_BYTES } = {}) {
+function runGit(root, repositoryRoot, args, { input, maxBuffer = MAX_LIST_BYTES, timeout = 2500 } = {}) {
   const executable = process.platform === "win32" ? "C:\\Program Files\\Git\\cmd\\git.exe" : "/usr/bin/git";
   const result = spawnSync(executable, ["-C", root, "--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${os.devNull}`, "-c", `safe.directory=${repositoryRoot}`, ...args], {
-    encoding: "buffer", env: gitEnv(), windowsHide: true, maxBuffer, timeout: 2500, ...(input ? { input } : {}),
+    encoding: "buffer", env: gitEnv(), windowsHide: true, maxBuffer, timeout, ...(input ? { input } : {}),
   });
   if (result?.error || result?.status !== 0) throw new Error(`ownership inventory: git ${args[0]} failed${result?.error?.code ? ` (${result.error.code})` : ""}`);
   return result.stdout;
@@ -95,7 +127,9 @@ export function gitListedInventory(appRoot, { relevant = () => true, protectedPa
   catch (error) { return { files: [], coverage: [{ path: ".", status: "unscanned", reason: `repository-root-unavailable:${error.code ?? "error"}` }] }; }
   let listing, dirtyBytes;
   try {
-    listing = runGit(root, safeRoot, ["ls-files", "--stage", "--cached", "--others", "--exclude-standard", "-z"]);
+    // Listing walks the whole worktree (--others), which takes seconds on a CI checkout; the short
+    // default stays for the per-object calls.
+    listing = runGit(root, safeRoot, ["ls-files", "--stage", "--cached", "--others", "--exclude-standard", "-z"], { timeout: 60_000 });
     dirtyBytes = runGit(root, safeRoot, ["diff-files", "--name-only", "-z", "--no-ext-diff", "--no-textconv", "--relative"]);
   } catch (error) { return { files: [], coverage: [{ path: ".", status: "unscanned", reason: `git-inventory-failed:${error.message}` }] }; }
   const dirty = new Set(dirtyBytes.length ? dirtyBytes.subarray(0, dirtyBytes.length - (dirtyBytes.at(-1) === 0 ? 1 : 0)).toString("utf8").split("\0") : []);
@@ -193,7 +227,7 @@ export function gitListedInventory(appRoot, { relevant = () => true, protectedPa
       if (!stat.isFile()) { coverage.push({ path: rel, status: "unscanned", reason: "not-regular-file" }); continue; }
     }
     const inNodeModules = rel.split("/").includes("node_modules");
-    let bytes, oid = indexed?.oid, digest, cacheKey;
+    let bytes, oid = indexed?.oid, digest, cacheKey, prehashed;
     if (isRelevant && entry.overLimit) {
       // Size-limit coverage was already recorded before any blob or file read.
     } else if (isRelevant) {
@@ -203,7 +237,7 @@ export function gitListedInventory(appRoot, { relevant = () => true, protectedPa
         else if (isDirty) {
           if (stat.size > entry.maxFileBytes) {
             coverage.push({ path: rel, status: "unscanned", reason: "file-over-size-limit" });
-          } else bytes = readFileSync(abs);
+          } else ({ bytes, sum: prehashed } = readHashed(abs));
         } else {
           coverage.push({ path: rel, status: "unscanned", reason: "git-blob-cache-miss" });
         }
@@ -212,7 +246,7 @@ export function gitListedInventory(appRoot, { relevant = () => true, protectedPa
         coverage.push({ path: rel, status: "unscanned", reason: "file-over-size-limit" });
         bytes = undefined;
       }
-      if (bytes && isDirty) { digest = sha256(bytes); cacheKey = `sha256:${digest}`; }
+      if (bytes && isDirty) { digest = prehashed ?? sha256(bytes); cacheKey = `sha256:${digest}`; }
       else if (bytes) { digest = `git:${oid}`; cacheKey = `gitblob:${oid}`; }
     } else if (!isDirty && oid) { digest = `git:${oid}`; cacheKey = `gitblob:${oid}`; }
     files.push({ rel, abs, size: bytes?.length ?? entry.cleanBlobSize ?? stat?.size, bytes, oid, digest, cacheKey, inNodeModules });
@@ -220,4 +254,4 @@ export function gitListedInventory(appRoot, { relevant = () => true, protectedPa
   return { files, coverage };
 }
 
-export function clearGitListedInventoryCacheForTests() { blobCache.clear(); cacheBytes = 0; }
+export function clearGitListedInventoryCacheForTests() { blobCache.clear(); cacheBytes = 0; hashCache.clear(); hashCacheBytes = 0; }

package/ownership-lockfiles.mjs

@@ -89,9 +89,79 @@ function parsePnpmYaml(text) {
   return root;
 }
 
+// Workspace membership: a manifest is a root of a lock only when the lock's workspace owns it.
+// Membership is decided only from a definition we fully understand; anything else (no
+// definition, unsupported glob syntax, unparsable file) returns null = "every manifest is a
+// member", which keeps the unresolved-root gap rather than hiding it.
+const UNSUPPORTED_GLOB = /[\[\]{}\\]/;
+const globPath = (value) => path.posix.normalize(String(value).trim().replace(/^(?:\.\/)+/, "").replace(/\/+$/, "") || ".").replace(/^\.$/, "");
+function matchSegments(pattern, parts) {
+  if (!pattern.length) return !parts.length;
+  if (pattern[0] === "**") { for (let i = 0; i <= parts.length; i++) if (matchSegments(pattern.slice(1), parts.slice(i))) return true; return false; }
+  if (!parts.length) return false;
+  const source = [...pattern[0]].map((c) => c === "*" ? "[^/]*" : c === "?" ? "[^/]" : c.replace(/[.+^$|()]/g, "\\$&")).join("");
+  return new RegExp(`^${source}$`).test(parts[0]) && matchSegments(pattern.slice(1), parts.slice(1));
+}
+function globMatches(glob, rel) {
+  if (UNSUPPORTED_GLOB.test(glob)) throw new Error("unsupported glob syntax");
+  const pattern = globPath(glob), segments = pattern ? pattern.split("/") : [];
+  return matchSegments(segments, rel ? rel.split("/") : []);
+}
+/** A directory or any of its ancestors matches the glob. */
+const underGlob = (glob, rel) => { const parts = rel ? rel.split("/") : []; for (let n = parts.length; n >= 1; n--) if (globMatches(glob, parts.slice(0, n).join("/"))) return true; return false; };
+const stringList = (value) => { if (value === undefined) return []; if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new Error("not a string list"); return value; };
+const dependencyTables = ["dependencies", "dev-dependencies", "build-dependencies"];
+function cargoPathDependencies(doc) {
+  const out = [], take = (table) => { if (object(table)) for (const dep of Object.values(table)) if (object(dep) && typeof dep.path === "string") out.push(dep.path); };
+  for (const name of dependencyTables) take(doc[name]);
+  take(doc.workspace?.dependencies);
+  if (object(doc.target)) for (const target of Object.values(doc.target)) if (object(target)) for (const name of dependencyTables) take(target[name]);
+  return out;
+}
+/** Predicate over a manifest directory relative to the lock directory ("" is the root), or null when undecidable. */
+function cargoMembership(manifests, lockDir) {
+  try {
+    const rootRel = path.posix.join(lockDir, "Cargo.toml"), docs = new Map();
+    for (const { rel, bytes } of manifests) { try { docs.set(path.posix.relative(lockDir, path.posix.dirname(rel)), parseToml(bytes.toString("utf8"))); } catch { /* a bad manifest fails its own parse later */ } }
+    const root = docs.get("");
+    if (!manifests.some((m) => m.rel === rootRel) || !root || !object(root.workspace)) return null;
+    const patterns = [...stringList(root.workspace.members), ...stringList(root.workspace["default-members"])], excludes = stringList(root.workspace.exclude);
+    const excluded = (rel) => excludes.some((glob) => underGlob(glob, rel));
+    const members = new Set([""]), queue = [""];
+    for (const rel of docs.keys()) if (rel && !excluded(rel) && patterns.some((glob) => globMatches(glob, rel))) { members.add(rel); queue.push(rel); }
+    // Cargo adds path dependencies that live inside the workspace directory as members too.
+    for (let at = 0; at < queue.length; at++) for (const dep of cargoPathDependencies(docs.get(queue[at]) ?? {})) {
+      const target = path.posix.normalize(path.posix.join(queue[at] || ".", dep)).replace(/^\.$/, "");
+      if (target.startsWith("..") || path.posix.isAbsolute(target) || members.has(target) || excluded(target)) continue;
+      members.add(target); queue.push(target);
+    }
+    return (rel) => members.has(rel);
+  } catch { return null; }
+}
+/** pnpm-workspace.yaml `packages:` globs; the root importer is always a member. */
+function pnpmMembership(bytes) {
+  if (!bytes) return null;
+  try {
+    const lines = bytes.toString("utf8").split(/\r?\n/), globs = [];
+    const start = lines.findIndex((line) => /^packages\s*:/.test(line));
+    if (start < 0) return null;
+    const inline = lines[start].replace(/^packages\s*:/, "").replace(/\s+#.*$/, "").trim();
+    if (inline) { const list = scalar(inline); if (!Array.isArray(list)) return null; globs.push(...list); }
+    else for (const line of lines.slice(start + 1)) {
+      if (!line.trim() || /^\s*#/.test(line)) continue;
+      if (!/^\s+-\s/.test(line)) break;
+      globs.push(scalar(line.replace(/^\s+-\s+/, "").replace(/\s+#.*$/, "")));
+    }
+    if (!globs.length || globs.some((glob) => typeof glob !== "string" || !glob.replace(/^!/, ""))) return null;
+    const positive = globs.filter((glob) => !glob.startsWith("!")), negative = globs.filter((glob) => glob.startsWith("!")).map((glob) => glob.slice(1));
+    for (const glob of globs) globMatches(glob.replace(/^!/, ""), ""); // throws on unsupported syntax
+    return (rel) => !rel || positive.some((glob) => globMatches(glob, rel)) && !negative.some((glob) => underGlob(glob, rel));
+  } catch { return null; }
+}
+
 function graph() {
   const nodes = new Map(), roots = [];
-  return { nodes, roots, diagnostics: [], add(id, name, version, source, local = false) {
+  return { nodes, roots, diagnostics: [], info: [], add(id, name, version, source, local = false) {
     if (typeof name !== "string" || !name || typeof version !== "string" || !version) fail("package name/version missing");
     const node = { id, name, version, source, local, edges: [] }; nodes.set(id, node); return node;
   } };
@@ -107,7 +177,7 @@ function sourceFor(value, fallback = "registry") {
   if (typeof value === "string" && /^(git\+|git:|https?:.*\.git)/.test(value)) return value.startsWith("git+") ? value : `git+${value}`;
   return value || fallback;
 }
-function cargoGraph(text, manifests) {
+function cargoGraph(text, manifests, lockDir) {
   const lock = parseToml(text), g = graph();
   if (!Array.isArray(lock.package) || ![1, 2, 3, 4].includes(lock.version ?? 1)) throw new LockError("lockfile-unsupported-format", "Cargo lock version/package list");
   for (const [i, pkg] of lock.package.entries()) g.add(String(i), pkg.name, pkg.version, pkg.source ?? `path:${pkg.name}`, !pkg.source);
@@ -121,11 +191,16 @@ function cargoGraph(text, manifests) {
       connect(g.nodes.get(String(i)), candidates.length === 1 ? candidates[0] : null, ref);
     }
   }
+  const membership = cargoMembership(manifests, lockDir);
   for (const { rel, bytes } of manifests) {
     const pkg = parseToml(bytes.toString("utf8")).package;
     if (!pkg) continue; // Virtual workspace: member manifests supply roots.
     const candidates = [...g.nodes.values()].filter((n) => n.name === pkg.name && n.local && (typeof pkg.version !== "string" || n.version === pkg.version));
-    if (candidates.length !== 1) { g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: rel }); continue; }
+    if (candidates.length !== 1) {
+      // Only a manifest the workspace does not own is informational; a member that fails to resolve is a gap.
+      const outside = membership && !membership(path.posix.relative(lockDir, path.posix.dirname(rel)));
+      (outside ? g.info : g.diagnostics).push({ reason: outside ? "manifest-outside-workspace" : "lockfile-root-unresolved", detail: rel }); continue;
+    }
     g.roots.push(candidates[0].id);
   }
   return g;
@@ -169,7 +244,7 @@ function packageLockGraph(text, manifests, lockDir) {
   }
   return g;
 }
-function pnpmGraph(text, manifests, lockDir) {
+function pnpmGraph(text, manifests, lockDir, workspaceBytes) {
   const lock = parsePnpmYaml(text), version = String(lock.lockfileVersion), g = graph();
   if (!/^(?:9|6)(?:\.\d+)?$/.test(version) || !object(lock.importers) || !object(lock.packages ?? {})) throw new LockError("lockfile-unsupported-format", "pnpm requires v6/v9 importers");
   const v9 = version.startsWith("9"), packages = lock.packages ?? {}, snapshots = v9 ? lock.snapshots ?? {} : packages;
@@ -211,9 +286,13 @@ function pnpmGraph(text, manifests, lockDir) {
       for (const [name, raw] of Object.entries(pkg[section] ?? {})) connect(node, resolve(node, name, raw), name, section === "optionalDependencies");
     }
   }
+  const membership = pnpmMembership(workspaceBytes);
   for (const { rel, bytes } of manifests) {
     const id = path.posix.relative(lockDir, path.posix.dirname(rel)) || ".", node = g.nodes.get(`importer:${id}`);
-    if (!node) { g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: rel }); continue; }
+    if (!node) {
+      const outside = membership && !membership(id === "." ? "" : id);
+      (outside ? g.info : g.diagnostics).push({ reason: outside ? "manifest-outside-workspace" : "lockfile-root-unresolved", detail: rel }); continue;
+    }
     node.name = JSON.parse(bytes.toString("utf8")).name ?? id;
     const pkg = JSON.parse(bytes.toString("utf8")), importer = lock.importers[id];
     for (const section of sections) for (const name of Object.keys(pkg[section] ?? {})) if (!Object.hasOwn(importer[section] ?? {}, name)) g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: `${rel}: ${section}.${name}` });
@@ -224,7 +303,7 @@ function pnpmGraph(text, manifests, lockDir) {
 
 /** Lock bytes stay bound to the scan inventory or committed snapshot; no installed graph reads. */
 export function transitiveDependencies(appRoot, inventory, manifests, catalogOwners, coverage, contentDigests, targets) {
-  const result = [], cache = new Map(), groups = new Map(), files = new Map(inventory.files.map((file) => [file.rel, file])), targetNames = new Set(targets);
+  const result = [], info = [], cache = new Map(), groups = new Map(), files = new Map(inventory.files.map((file) => [file.rel, file])), targetNames = new Set(targets);
   const diagnostic = (rel, reason, detail) => coverage.push({ path: rel, status: "unscanned", reason, ...(detail ? { detail } : {}) });
   const read = (rel) => {
     if (cache.has(rel)) return cache.get(rel);
@@ -268,8 +347,10 @@ export function transitiveDependencies(appRoot, inventory, manifests, catalogOwn
     try {
       const text = read(rel).toString("utf8"), base = path.posix.basename(rel), dir = path.posix.dirname(rel);
       if (base === "yarn.lock") throw new LockError("lockfile-unsupported-format", "yarn transitive graph");
-      const g = group.ecosystem === "cargo" ? cargoGraph(text, group.manifests) : base === "pnpm-lock.yaml" ? pnpmGraph(text, group.manifests, dir) : packageLockGraph(text, group.manifests, dir);
+      const g = group.ecosystem === "cargo" ? cargoGraph(text, group.manifests, dir) : base === "pnpm-lock.yaml" ? pnpmGraph(text, group.manifests, dir, read(path.posix.join(dir, "pnpm-workspace.yaml"))) : packageLockGraph(text, group.manifests, dir);
       for (const entry of g.diagnostics) diagnostic(rel, entry.reason, entry.detail);
+      // Non-blocking: manifests outside the lock's workspace are reported, never counted as coverage gaps.
+      for (const entry of g.info) info.push({ path: rel, status: "info", reason: entry.reason, detail: entry.detail });
       for (const node of g.nodes.values()) for (const detail of node.unresolved ?? []) diagnostic(rel, "lockfile-unresolved-dependency", detail);
       // Retain only nodes leading to block fingerprints. Unrelated lock inventory cannot
       // multiply traversal work; owner boundaries cannot authorize app/workspace nodes.
@@ -307,5 +388,7 @@ export function transitiveDependencies(appRoot, inventory, manifests, catalogOwn
       }
     } catch (error) { diagnostic(rel, error.reason ?? "lockfile-parse-failed", error.message); }
   }
-  return result.sort((a, b) => a.dependencyPath.length - b.dependencyPath.length || JSON.stringify(a.dependencyPath).localeCompare(JSON.stringify(b.dependencyPath)));
+  result.sort((a, b) => a.dependencyPath.length - b.dependencyPath.length || JSON.stringify(a.dependencyPath).localeCompare(JSON.stringify(b.dependencyPath)));
+  Object.defineProperty(result, "info", { value: info, enumerable: false });
+  return result;
 }

package/ownership-mandatory-set.json

@@ -66,7 +66,7 @@
           "name": "@rightkit/platform-ui",
           "ecosystem": "npm",
           "min": "0.2.8",
-          "registryMax": "0.2.7"
+          "registryMax": "0.2.8"
         },
         {
           "name": "@rightkit/theme",
@@ -155,7 +155,7 @@
           "name": "rightkit-fs",
           "ecosystem": "cargo",
           "min": "0.4.0",
-          "registryMax": "0.3.3"
+          "registryMax": "0.4.1"
         }
       ]
     },
@@ -168,7 +168,7 @@
           "name": "rightkit-db",
           "ecosystem": "cargo",
           "min": "0.4.0",
-          "registryMax": "0.3.2"
+          "registryMax": "0.4.0"
         }
       ]
     },
@@ -186,7 +186,7 @@
           "name": "@rightkit/settings-ui",
           "ecosystem": "npm",
           "min": "0.4.4",
-          "registryMax": "0.4.3"
+          "registryMax": "0.4.4"
         }
       ]
     },
@@ -211,7 +211,7 @@
           "name": "rightkit-license",
           "ecosystem": "cargo",
           "min": "0.2.0",
-          "registryMax": "0.1.3"
+          "registryMax": "0.2.0"
         },
         {
           "name": "rightkit-device",
@@ -222,7 +222,7 @@
           "name": "@rightkit/license",
           "ecosystem": "npm",
           "min": "0.2.0",
-          "registryMax": "0.1.8"
+          "registryMax": "0.2.0"
         }
       ]
     },
@@ -235,7 +235,7 @@
           "name": "rightkit-license",
           "ecosystem": "cargo",
           "min": "0.2.0",
-          "registryMax": "0.1.3"
+          "registryMax": "0.2.0"
         }
       ]
     },
@@ -260,7 +260,7 @@
           "name": "@rightkit/onboarding",
           "ecosystem": "npm",
           "min": "0.3.3",
-          "registryMax": "0.3.2"
+          "registryMax": "0.3.3"
         }
       ]
     },
@@ -272,8 +272,8 @@
         {
           "name": "rightkit-logs",
           "ecosystem": "cargo",
-          "min": "0.2.2",
-          "registryMax": "0.2.1"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         },
         {
           "name": "@rightkit/logs",
@@ -292,7 +292,7 @@
           "name": "rightkit-crash",
           "ecosystem": "cargo",
           "min": "0.2.2",
-          "registryMax": "0.2.1"
+          "registryMax": "0.3.0"
         }
       ]
     },
@@ -305,7 +305,7 @@
           "name": "rightkit-http",
           "ecosystem": "cargo",
           "min": "0.3.0",
-          "registryMax": "0.2.5"
+          "registryMax": "0.3.0"
         }
       ]
     },
@@ -330,7 +330,7 @@
           "name": "@rightkit/release",
           "ecosystem": "npm",
           "min": "0.2.153",
-          "registryMax": "0.2.151",
+          "registryMax": "0.2.165",
           "allowDev": true
         }
       ]
@@ -344,20 +344,21 @@
           "name": "rightkit-qa",
           "ecosystem": "cargo",
           "min": "0.2.16",
-          "registryMax": "0.2.14",
+          "registryMax": "0.6.1",
           "allowDev": true
         },
         {
           "name": "rightkit-qa-driver",
           "ecosystem": "cargo",
           "min": "0.3.0",
+          "note": "deprecated shim; the QA owner is rightkit-qa with the `control` feature (Ember #280)",
           "allowDev": true
         },
         {
           "name": "@rightkit/qa",
           "ecosystem": "npm",
           "min": "0.4.8",
-          "registryMax": "0.4.7",
+          "registryMax": "0.4.8",
           "allowDev": true
         },
         {
@@ -378,7 +379,7 @@
           "name": "rightkit-agent-tools",
           "ecosystem": "cargo",
           "min": "0.1.2",
-          "registryMax": "0.1.2"
+          "registryMax": "0.1.4"
         }
       ]
     }
@@ -399,6 +400,25 @@
       "ownerPending": "No selected owner (D4 unratified); never fails."
     }
   ],
+  "appAmendments": {
+    "ember": {
+      "issue": "Orthic-Labs/rightkit#280",
+      "source": "Orthic-Labs/ember#240 port to the mandatory set",
+      "profile": "desktop",
+      "note": "App-specific not-applicable rulings, ratified for Ember. An app declares them in rightkit-mandatory.json notApplicable with the reason given here. Free and open source apps (MIT OR Apache-2.0, no paid features, activation or signer) and apps with no daemon, no SQLite state and no restart-surviving jobs owe none of these rows.",
+      "notApplicable": {
+        "M3": "No engine child process and no restart-surviving jobs: exports and imports are in-process jobs on the activity stack. The ffmpeg sidecar already runs through rightkit-ffmpeg.",
+        "M4": "No engine child process and no restart-surviving jobs: exports and imports are in-process jobs on the activity stack.",
+        "M6": "No local service or daemon-discovered data location. The control channel and MCP are opt-in developer and agent ports.",
+        "M7": "No local service or daemon-discovered data location. The control channel and MCP are opt-in developer and agent ports.",
+        "M9": "No SQLite app state. Preferences are JSON through rightkit-app-settings; the photo catalog is a JSON-lines journal.",
+        "M12": "Free and open source (MIT OR Apache-2.0): no paid features, activation or signer. rightkit-device identity is adopted. Applies to OSS apps.",
+        "M13": "Free and open source (MIT OR Apache-2.0): no paid features, activation or signer. Applies to OSS apps.",
+        "M14": "@rightkit/legal needs six proprietary roles and imports node:crypto, so it cannot run in a webview; @rightkit/onboarding mandates a legal step first. Ember ships @rightkit/legal-ui for its licences and notices and holds its first-run notice until its text is approved. OSS profile; the legal and onboarding owners need an OSS mode and a mode without a legal step.",
+        "M22": "rightkit-agent-tools needs a daemon-backed app control service. Ember's agent surface is its own MCP server over engine command ids, being ported to rightkit-mcp. Applies to non-daemon apps."
+      }
+    }
+  },
   "amendments": {
     "v2.1": {
       "description": "TABLE1-AMENDMENT-v2.1 (draft): @rightkit/tauri-shell joins M1. Opt-in via --amendment v2.1.",

package/ownership-report.mjs

@@ -39,16 +39,15 @@ function statusFor(row, report) {
   return "not-detected";
 }
 
+// Plain exception entries (Orthic-Labs/rightkit#262) that matched no finding in this scan are stale and listed for cleanup.
 function exceptionRequests(root, app, report) {
   const file = path.join(root, EXCEPTIONS_FILE);
   if (!existsSync(file)) return [];
   let records;
   try { records = JSON.parse(readFileSync(file, "utf8")).exceptions ?? []; } catch { return []; }
-  const payload = (record) => record?.payload ?? record;
-  const confirmed = new Set((report.covered ?? []).map((finding) => payload(finding.exception)?.requestId).filter(Boolean));
-  return records.filter((record) => !confirmed.has(payload(record)?.requestId)).map((record) => {
-    const details = payload(record);
-    const request = { app, requestId: details.requestId ?? null, fingerprint: details.fingerprint ?? null, paths: details.paths ?? [], reason: details.reason ?? null, owner: details.owner ?? null, expires: details.expires ?? null, tracking: details.trackingRef ?? details.tracking ?? null, state: "request-pending-verification" };
+  const matched = new Set((report.covered ?? []).map((finding) => finding.exception).filter(Boolean).map((entry) => JSON.stringify([entry.capability, entry.package ?? entry.crate, entry.fingerprint ?? null, entry.path ?? null])));
+  return records.filter((record) => !matched.has(JSON.stringify([record?.capability, record?.package ?? record?.crate, record?.fingerprint ?? null, record?.path ?? null]))).map((record) => {
+    const request = { app, capability: record?.capability ?? null, package: record?.package ?? record?.crate ?? null, reason: record?.reason ?? null, owner: record?.owner ?? null, date: record?.date ?? null, state: "stale-exception-entry" };
     return { ...request, contentHash: sha256(canonicalJson(request)) };
   });
 }
@@ -148,7 +147,7 @@ export function renderOwnershipMarkdown(report) {
   }
   lines.push("", "## Capability status", "", "| App | Capability | Status | Detection | Availability |", "|---|---|---|---|---|");
   for (const app of report.apps) for (const row of app.rows) lines.push(`| ${app.app} | ${row.capability} | ${row.status} | ${row.detection} | ${row.available.map((x) => `${x.package}@${x.version} (${x.state})`).join(", ") || "none recorded"} |`);
-  lines.push("", `Blocks: ${report.blocks.length} · Exception requests awaiting verification: ${report.exceptionRequests.length}`, "", "Exception requests are unverified records; only scanner-validated signed exceptions are reported as excepted.", "");
+  lines.push("", `Blocks: ${report.blocks.length} · Stale exception entries: ${report.exceptionRequests.length}`, "", "Exception entries are plain records reviewed through git; an entry that matches no finding is stale and should be removed.", "");
   if (report.warnings?.length) {
     lines.splice(-2, 0, "## Warnings", "", ...report.warnings.map((warning) => `- ${warning.app}: WARNING: ${warning.message}; ${warning.findings.length} finding(s), ${warning.problems.length} problem(s) retained as diagnostics`), "");
   }

package/ownership-scan-worker.mjs

@@ -68,11 +68,11 @@ function scanProtected(appRoot, options, createEvidence) {
   const before = scanInputs(appRoot, options);
   const preliminary = { ok: true, enrollmentPending: before.enrollmentPending, violations: [], problems: [], coverage: before.metadata.coverage, metadata: before.metadata };
   const preflight = ownershipVerdict(preliminary, before.trust);
-  if (!preflight.admit && preflight.code !== "RK_OWNERSHIP_PENDING_ENROLLMENT") return { ...before, report: { ...preliminary, ok: false }, verdict: preflight };
+  if (!preflight.admit) return { ...before, report: { ...preliminary, ok: false }, verdict: preflight };
   let checked;
   try { checked = createEvidence(); }
   catch (error) {
-    if (preflight.code !== "RK_OWNERSHIP_PENDING_ENROLLMENT") throw error;
+    if (!before.enrollmentPending) throw error;
     const report = { ...preliminary, ok: false, problems: [error.message] };
     return { ...before, report, verdict: ownershipVerdict(report, before.trust) };
   }

package/ownership-verdict.mjs

@@ -40,19 +40,22 @@ const refuse = (code, problems) => ({ admit: false, code, problems });
 /** One fail-closed contract for protected scan workers & broker admission. */
 export function ownershipVerdict(report, trust) {
   if (!validReport(report)) return refuse("RK_OWNERSHIP_MALFORMED_REPORT", ["ownership report has missing, unknown, or wrong-typed fields"]);
-  if (report.enrollmentPending) return refuse("RK_OWNERSHIP_PENDING_ENROLLMENT", ["protected ownership approval enrollment is pending", ...report.problems]);
+  // Pending approval enrollment is a reported warning, never a refusal (#262): every real finding gate below still applies.
+  const warnings = report.enrollmentPending ? ["protected ownership approval enrollment is pending (warning only; it existed only for retired signed approvals)"] : [];
+  const withWarnings = (verdict) => (warnings.length ? { ...verdict, warnings } : verdict);
+  const noRegistry = report.enrollmentPending && !trust;
   let registration;
-  try {
+  if (!noRegistry) try {
     registration = verifyRepositoryRegistration(trust, report.metadata.repositoryIdentity, { files: [
       ...report.violations.map((entry) => entry.file), ...(report.findings ?? []).map((entry) => entry.file),
       ...(report.metadata.contentDigests ?? []).map((entry) => entry.path),
     ] });
   } catch { return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", ["protected repository registry is missing or malformed"]); }
-  if (!registration.ok) return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", registration.problems);
+  if (!noRegistry && !registration.ok) return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", registration.problems);
   const scannedRoots = report.metadata.roots?.map((entry) => entry.root) ?? [report.metadata.pathPrefix?.replace(/\/$/, "") || "."];
-  if (new Set(scannedRoots).size !== scannedRoots.length || sha256([...scannedRoots].sort()) !== sha256([...registration.registration.roots].sort()))
+  if (!noRegistry && (new Set(scannedRoots).size !== scannedRoots.length || sha256([...scannedRoots].sort()) !== sha256([...registration.registration.roots].sort())))
     return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", ["scan roots do not exactly cover protected repository registration"]);
-  const floor = validateOwnershipFloor(trust, report.metadata);
+  const floor = noRegistry ? { ok: true, problems: [] } : validateOwnershipFloor(trust, report.metadata);
   if (!floor.ok) return refuse("RK_OWNERSHIP_POLICY_DOWNGRADE", floor.problems);
   const incomplete = [...report.coverage, ...report.metadata.coverage].filter((entry) => entry.status !== "complete");
   if (incomplete.length) return refuse("RK_OWNERSHIP_INCOMPLETE_COVERAGE", [...new Set(incomplete.map((entry) => entry.path + ": " + entry.reason))]);
@@ -61,8 +64,8 @@ export function ownershipVerdict(report, trust) {
   if (report.problems.length) return refuse("RK_OWNERSHIP_UNVERIFIED", report.problems);
   if (!report.ok) return refuse("RK_OWNERSHIP_REPORT_FAILED", ["protected ownership scanner reported ok:false"]);
   const advisory = report.violations.filter((entry) => !isBlockingFinding(entry));
-  if (advisory.length) return { admit: true, code: "RK_OWNERSHIP_ADVISORY", problems: advisory.map((entry) => entry.capability + " (" + entry.fingerprint + " in " + entry.file + ") is owned by " + entry.package + " [advise]") };
-  return { admit: true, code: "RK_OWNERSHIP_CLEAN", problems: [] };
+  if (advisory.length) return withWarnings({ admit: true, code: "RK_OWNERSHIP_ADVISORY", problems: advisory.map((entry) => entry.capability + " (" + entry.fingerprint + " in " + entry.file + ") is owned by " + entry.package + " [advise]") });
+  return withWarnings({ admit: true, code: "RK_OWNERSHIP_CLEAN", problems: [] });
 }
 
 /** SHA-256 over every required authenticated cache binding; never directory or age. */