@rightkit/release 0.2.165 → 0.2.172

package/ownership.mjs

@@ -1,8 +1,7 @@
 // RightKit ownership scan. Public exports retain the original findings-array API.
 import { isBlockingFinding } from "./ownership-verdict.mjs";
 import { spawnSync } from "./background-process.mjs";
-import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, policyEntryDigest, resolveKeyLogTrust, sha256, verifyException, verifyProtectedProvenance } from "./ownership-approval.mjs";
-import installedManifest from "./rightkit-ownership.json" with { type: "json" };
+import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, resolveKeyLogTrust, sha256, verifyProtectedProvenance } from "./ownership-approval.mjs";
 import { parse as parseToml } from "smol-toml";
 import { sourceNonCode } from "./ownership-source.mjs";
 import { OWNERSHIP_LOCKFILES, transitiveDependencies } from "./ownership-lockfiles.mjs";
@@ -40,12 +39,20 @@ function sourceMatchers(manifest) {
     const flags = [...new Set(`m${sources.map(({ re }) => re.flags.replace(/[gy]/g, "")).join("")}`)].join("");
     prefilter = new RegExp(sources.map(({ f }) => `(?:${f.pattern})`).join("|") || "(?!)", flags);
   } catch { prefilter = /[\s\S]/; }
-  const matchers = { digest, sources, prefilter };
+  // `excludePaths` (exact files or directory prefixes) keeps a source rule off the paths that
+  // hold its own positive samples, such as the scanner's fixtures.
+  const excluded = new Map(sources.filter(({ f }) => f.excludePaths?.length).map(({ f }) => [f.id, f.excludePaths]));
+  const matchers = { digest, sources, prefilter, excluded };
   catalogCache.set(digest, matchers);
   if (catalogCache.size > 8) catalogCache.delete(catalogCache.keys().next().value);
   return matchers;
 }
 
+function sourceExcluded(matchers, id, rel) {
+  const paths = matchers.excluded?.get(id);
+  return Boolean(paths?.some((p) => rel === p || rel.startsWith(p.endsWith("/") ? p : `${p}/`)));
+}
+
 function sourceFindings(file, matchers) {
   const ext = path.posix.extname(file.rel).toLowerCase();
   const key = `${matchers.digest}:${ext}:${file.cacheKey ?? inputDigest(file)}`;
@@ -194,7 +201,7 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   const inventory = gitListedInventory(appRoot, {
     repositoryRoot,
     protectedPaths: [...protectedPaths],
-    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
+    relevant: (rel) => ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase()),
     maxFileBytes: (rel) => CODE_EXT.has(path.posix.extname(rel).toLowerCase()) || protectedPaths.has(rel) ? 2 * 1024 * 1024 : 64 * 1024 * 1024,
   });
   for (const item of inventory.coverage) if (item.reason === "file-over-size-limit") item.reason = protectedPaths.has(item.path) ? "protected-provenance-file-over-2MiB" : CODE_EXT.has(path.posix.extname(item.path).toLowerCase()) ? "source-file-over-2MiB" : "manifest-file-over-64MiB";
@@ -214,7 +221,7 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
     if (entry.mode === "160000" || entry.type === "commit") { coverage.push({ path: rel, status: "unscanned", reason: "committed-gitlink" }); continue; }
     if (entry.type !== "blob") { coverage.push({ path: rel, status: "unscanned", reason: "committed-unsupported-entry" }); continue; }
-    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
+    const relevant = protectedPaths.has(entry.rel) || ["Cargo.toml", "package.json", "Package.swift", "Package.resolved", "ownership-exceptions.json", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel)) || CODE_EXT.has(path.posix.extname(rel).toLowerCase());
     const bytes = relevant ? entry.bytes : undefined;
     if (relevant && !bytes) coverage.push({ path: rel, status: "unscanned", reason: "committed-blob-unavailable" });
     const isExceptionFile = path.posix.basename(rel) === "ownership-exceptions.json";
@@ -579,7 +586,7 @@ function scanInternal(appRoot, manifest, { inventory = fileInventory(appRoot), t
     }
     if (size > 2 * 1024 * 1024) { coverage.push({ path: rel, status: "unscanned", reason: "source-file-over-2MiB" }); continue; }
     contentDigests.push({ path: rel, digest: inputDigest(file) });
-    for (const finding of sourceFindings(file, matchers)) findings.push({ ...finding, file: rel });
+    for (const finding of sourceFindings(file, matchers)) if (!sourceExcluded(matchers, finding.fingerprint, rel)) findings.push({ ...finding, file: rel });
   }
   if (pathPrefix) {
     const prefix = (p) => p === "." ? pathPrefix.slice(0, -1) : `${pathPrefix}${p}`;
@@ -675,31 +682,42 @@ function enrollmentPending(trust, state) {
 function findingPolicy(c, f) {
   return { tier: f.tier ?? c.tier ?? "block", ...(f.policy ? { policy: f.policy } : {}) };
 }
+/**
+ * Plain exception entries (Orthic-Labs/rightkit#262), reviewed through git, no signatures:
+ * { capability, package (alias: crate), reason, owner, date }, optional narrowing { fingerprint, path }.
+ * An entry marks every finding of that capability/package (and fingerprint/path when given) `excepted`;
+ * an entry that matches no finding is reported as a stale warning; a malformed or legacy signed entry is a problem.
+ */
+export function validateExceptionEntry(entry) {
+  const problems = [];
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return ["not an object"];
+  if (entry.payload || entry.signature !== undefined || entry.schema !== undefined) return ["legacy signed exception record; replace it with a plain entry {capability, package, reason, owner, date}"];
+  for (const key of ["capability", "reason", "owner"]) if (typeof entry[key] !== "string" || !entry[key].trim()) problems.push(`missing ${key}`);
+  const owner = entry.package ?? entry.crate;
+  if (typeof owner !== "string" || !owner.trim()) problems.push("missing package (crate or package)");
+  if (typeof entry.date !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry.date) || Number.isNaN(Date.parse(`${entry.date}T00:00:00Z`))) problems.push("date must be YYYY-MM-DD");
+  for (const key of ["fingerprint", "path"]) if (entry[key] !== undefined && (typeof entry[key] !== "string" || !entry[key])) problems.push(`${key} must be a non-empty string when present`);
+  return problems;
+}
+export function exceptionMatches(entry, finding) {
+  const owner = entry.package ?? entry.crate;
+  if (finding.capability !== entry.capability || finding.package !== owner) return false;
+  if (entry.fingerprint !== undefined && finding.fingerprint !== entry.fingerprint) return false;
+  if (entry.path !== undefined && !(finding.file === entry.path || finding.file?.startsWith(`${entry.path.replace(/\/$/, "")}/`))) return false;
+  return true;
+}
 export function evaluate(findings, exceptions, options = {}) {
-  const today = options.today ?? new Date().toISOString().slice(0, 10), problems = [], covered = [], violations = [], warnings = [];
-  const metadata = options.metadata ?? findings.metadata ?? {};
-  const catalogDigest = metadata.catalogDigest ?? options.catalogDigest ?? "";
-  const identity = options.repositoryIdentity ?? metadata.repositoryIdentity ?? "";
+  const problems = [], covered = [], violations = [], warnings = [];
   for (const e of exceptions) {
-    const p = e?.payload ?? e ?? {};
-    const where = `exception #${e?.index} (${p.fingerprint ?? "?"})`;
-    const missing = ["fingerprint", "occurrences", "policyDigest", "minimumScannerVersion", "minimumCatalogVersion", "issued", "reason", "owner", "expires", "requestId"].filter((k) => !p[k] || (Array.isArray(p[k]) && !p[k].length));
-    if (missing.length) { problems.push(`${where}: missing ${missing.join(", ")}`); continue; }
-    const approvedBy = e.approvedBy ?? p.approvedBy;
-    if (approvedBy !== undefined && approvedBy !== "Adrian") { problems.push(`${where}: approvedBy must be Adrian`); continue; }
-    if (!/^\d{4}-\d{2}-\d{2}$/.test(p.expires) || Number.isNaN(Date.parse(`${p.expires}T00:00:00Z`)) || p.expires < today) { problems.push(`${where}: invalid or expired expires date`); continue; }
-    if (!p.trackingRef || typeof p.trackingRef !== "object" || !p.trackingRef.verified || !/^https:\/\//.test(p.trackingRef.url ?? "") || !p.trackingRef.id) { problems.push(`${where}: tracking must be a verified RightKit request reference`); continue; }
-    let policyDigest;
-    try { policyDigest = policyEntryDigest(options.manifest ?? installedManifest, p.fingerprint); } catch (error) { problems.push(`${where}: ${error.message}`); continue; }
-    const { index, ...record } = e;
-    const verification = verifyException(record, { repositoryIdentity: identity, catalogDigest, policyDigest, findings, trust: options.trust, today, scannerVersion: options.scannerVersion ?? metadata.scannerVersion ?? SCANNER_VERSION, catalogVersion: options.catalogVersion ?? metadata.catalogVersion });
-    if (!verification?.ok) { problems.push(`${where}: signature verification failed${verification?.problems?.length ? ` (${verification.problems.join("; ")})` : ""}`); continue; }
-    const matching = findings.filter((f) => f.fingerprint === p.fingerprint && p.occurrences.some((item) => item.path === f.file && item.hash === occurrenceHash(f)));
-    if (!matching.length) { problems.push(`${where}: stale, matches no signed occurrence`); continue; }
-    for (const f of matching) covered.push({ ...f, occurrenceHash: occurrenceHash(f), exception: e });
+    const where = `exception #${e?.index} (${e?.capability ?? "?"}/${e?.package ?? e?.crate ?? "?"})`;
+    const invalid = validateExceptionEntry(e);
+    if (invalid.length) { problems.push(`${where}: ${invalid.join("; ")}`); continue; }
+    const matching = findings.filter((f) => exceptionMatches(e, f));
+    if (!matching.length) { warnings.push(`${where}: stale, matches no current finding (remove it from the exceptions file)`); continue; }
+    for (const f of matching) if (!covered.some((x) => x.occurrenceHash === occurrenceHash(f))) covered.push({ ...f, occurrenceHash: occurrenceHash(f), exception: e });
   }
   const pending = enrollmentPending(options.trust, options.trustEnrollment);
-  if (pending) warnings.push("approval enrollment pending; detected findings remain open backlog requests until distinct Windows & macOS keys are enrolled");
+  if (pending) warnings.push("approval enrollment pending (warning only): exceptions are plain git-reviewed entries and no scan result depends on enrolled approval keys");
   for (const f of findings) if (!covered.some((x) => x.occurrenceHash === occurrenceHash(f))) violations.push({ ...f, occurrenceHash: occurrenceHash(f) });
   return { violations, covered, problems, warnings, enrollmentPending: pending };
 }
@@ -744,7 +762,7 @@ function checkAppInternal(appRoot, manifest, options, readAuthority) {
   const result = evaluate(scanned.findings, loadExceptions(appRoot), { ...options, manifest, trust, trustEnrollment: enrollment, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
-  return { ok: !result.enrollmentPending && !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
+  return { ok: !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
 }
 
 function checkCommitted(appRoot, manifest, options, acquire, readAuthority = readCommittedKeyAuthority) {
@@ -812,7 +830,7 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined, metadata });
   const coverage = [...new Map(metadata.coverage.map((x) => [`${x.path}\0${x.reason}`, x])).values()];
   const rows = capabilityTable(manifest, scanned.deps, { ...result, coverage });
-  return { ok: !result.enrollmentPending && !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
+  return { ok: !result.violations.some(isBlockingFinding) && !result.problems.length && !coverage.length, rows, ...result, findings: scanned.findings, coverage, metadata };
 }
 
 /** Protected production scan: acquire and inspect exact HEAD blobs without reading checkout contents. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.165",
+  "version": "0.2.172",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -18,10 +18,13 @@
   },
   "files": [
     "cli",
+    "bin",
+    "templates",
     "*.mjs",
     "*.json",
     "*.sh",
     "msix-repair-guard.ps1",
+    "bin/darwin/rightkit-swap",
     "*.py",
     "LICENSE-MIT",
     "LICENSE-APACHE",
@@ -35,14 +38,14 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Orthic-Labs/rightkit.git",
+    "url": "git+https://github.com/bogusyogi/rightkit.git",
     "directory": "packages/release"
   },
   "dependencies": {
-    "smol-toml": "1.9.0"
+    "smol-toml": "1.9.1"
   },
   "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test": "node --import ./test-support/broker-guard.mjs --test --test-concurrency=1 --test-force-exit *.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "test:signer:windows": "node sign-release-manifest.integration.mjs",
     "doctor:all": "node --test right-suite-contract.test.mjs",

package/portable-development.mjs

@@ -1,16 +1,19 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { spawnSync } from "./background-process.mjs";
+import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
 
 const CHUNK_BYTES = 1024 * 1024;
 
-/** Install an unsigned development payload through an owned, versioned `current` pointer. */
+/**
+ * Install an unsigned development payload in place at the fixed path `<installRoot>/current` (a real directory).
+ * No versions/ folder, no digest folder, no symlink or junction. The previous copy is kept once, as
+ * `<installRoot>/current.previous` (rename it back to roll back); nothing ever runs from it. A legacy `current`
+ * symlink or junction from the old layout is moved aside to `.previous` the same way.
+ */
 export function installPortableDevelopment(descriptor, { root, platform = process.platform, env = process.env } = {}) {
-  const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}\n`);
-  let backup = null;
-  let switched = false;
-  let versionRoot;
+  const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}
+`);
   let digest;
   let current;
   try {
@@ -27,110 +30,40 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     const sourceEntrypoint = resolveContained(source, descriptor.entrypoint, "entrypoint");
     const sourceEntrypointInfo = fs.lstatSync(sourceEntrypoint);
     if (!sourceEntrypointInfo.isFile() || sourceEntrypointInfo.isSymbolicLink()) throw new Error("development entrypoint must be a regular file inside sourceDirectory");
-    const sourceDigest = digestTree(source);
-    digest = sourceDigest;
-    versionRoot = path.join(installRoot, "versions", `dev-${digest}`);
+    digest = digestTree(source);
     current = path.join(installRoot, "current");
-    emit("STAGE", { sourceDirectory: source, versionRoot, digest });
-
-    fs.mkdirSync(path.dirname(versionRoot), { recursive: true });
-    if (exists(versionRoot)) {
-      if (digestTree(versionRoot) !== digest) throw new Error(`development version digest collision: ${versionRoot}`);
-    } else {
-      const staging = path.join(path.dirname(versionRoot), `.stage-${process.pid}-${randomSuffix()}`);
-      try {
-        copyTree(source, staging);
-        if (digestTree(staging) !== digest) throw new Error("staged development payload did not match source digest");
-        fs.renameSync(staging, versionRoot);
-      } catch (error) {
-        removeIfExists(staging);
-        throw error;
-      }
-    }
+    const staging = stagingPathOf(current);
+    const previous = previousPathOf(current);
+    emit("STAGE", { sourceDirectory: source, current, staging, digest });
+    if (exists(current) && !fs.lstatSync(current).isDirectory() && !fs.lstatSync(current).isSymbolicLink()) throw new Error(`development current is not a directory; refusing to replace: ${current}`);
 
-    validateCurrent(current, installRoot, platform);
-    if (exists(current)) {
-      backup = path.join(installRoot, `.current-backup-${process.pid}-${randomSuffix()}`);
-      fs.renameSync(current, backup);
-    }
+    fs.mkdirSync(installRoot, { recursive: true });
+    removeIfExists(staging);
     try {
-      fs.symlinkSync(versionRoot, current, platform === "win32" ? "junction" : "dir");
-      switched = true;
-      emit("ACTIVATE", { current, versionRoot });
-      const activeRoot = fs.realpathSync(current);
-      if (!samePath(activeRoot, fs.realpathSync(versionRoot), platform)) throw new Error("development current pointer did not resolve to staged version");
-      const entrypoint = resolveContained(versionRoot, descriptor.entrypoint, "entrypoint");
-      const entryDigest = hashFile(entrypoint);
-      if (entryDigest !== hashFile(path.join(source, descriptor.entrypoint))) throw new Error("development entrypoint readback did not match source");
-      if (backup) removeIfExists(backup);
-      emit("PRUNE", pruneDevelopmentVersions(installRoot, versionRoot, { platform }));
-      emit("SUCCEEDED", { installRoot, current, versionRoot, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
-      return { installRoot, current, versionRoot, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
+      copyTree(source, staging);
+      if (digestTree(staging) !== digest) throw new Error("staged development payload did not match source digest");
     } catch (error) {
-      if (switched) removeIfExists(current);
-      if (backup && exists(backup)) fs.renameSync(backup, current);
+      removeIfExists(staging);
       throw error;
     }
+    const sourceEntryDigest = hashFile(sourceEntrypoint);
+    let entryDigest;
+    swapInPlace({
+      staging, destination: current, previous,
+      verify: (destination) => {
+        entryDigest = hashFile(resolveContained(destination, descriptor.entrypoint, "entrypoint"));
+        if (entryDigest !== sourceEntryDigest) throw new Error("development entrypoint readback did not match source");
+      },
+    });
+    emit("ACTIVATE", { current, previous });
+    emit("SUCCEEDED", { installRoot, current, previous, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
+    return { installRoot, current, previous, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
   } catch (error) {
-    emit("FAILED", { installRoot: descriptor?.installRoot, versionRoot, digest, message: error?.message ?? String(error) });
+    emit("FAILED", { installRoot: descriptor?.installRoot, current, digest, message: error?.message ?? String(error) });
     throw error;
   }
 }
 
-/**
- * Development installs keep only the active version: dev builds are rebuilt from source, so there is
- * no rollback copy. A version a running process still uses is skipped and removed by the next
- * install. Never throws: a prune problem must not fail an install that already activated.
- */
-export function pruneDevelopmentVersions(installRoot, keepRoot, { platform = process.platform, runningExecutables = null } = {}) {
-  const versionsRoot = path.join(installRoot, "versions");
-  const removed = []; const skipped = []; let reclaimedBytes = 0;
-  let running = null;
-  const inUse = (dir) => {
-    if (platform === "win32") return false; // Windows: a loaded image or DLL makes the rename below fail.
-    running ??= runningExecutables ?? listRunningExecutables();
-    return running.some((exe) => isWithin(dir, exe, platform));
-  };
-  const candidates = [];
-  for (const [dir, pattern] of [[versionsRoot, /^(dev-[0-9a-f]+|\.stage-.+|\.prune-.+)$/], [installRoot, /^\.(current-backup|prune)-.+$/]]) {
-    let names = [];
-    try { names = fs.readdirSync(dir); } catch { continue; }
-    for (const name of names) if (pattern.test(name)) candidates.push(path.join(dir, name));
-  }
-  for (const candidate of candidates) {
-    if (samePath(candidate, keepRoot, platform)) continue;
-    if (path.basename(candidate).includes(`-${process.pid}-`)) continue; // this process's own stage/backup
-    try {
-      if (inUse(candidate)) { skipped.push({ path: candidate, reason: "in-use" }); continue; }
-      const bytes = treeBytes(candidate);
-      // Rename first: on Windows this fails while any file inside is loaded, so a running version is skipped whole.
-      const doomed = path.basename(candidate).startsWith(".prune-") ? candidate : path.join(path.dirname(candidate), `.prune-${randomSuffix()}`);
-      if (doomed !== candidate) fs.renameSync(candidate, doomed);
-      fs.rmSync(doomed, { recursive: true, force: true });
-      removed.push(candidate); reclaimedBytes += bytes;
-    } catch (error) {
-      skipped.push({ path: candidate, reason: error?.code ?? error?.message ?? String(error) });
-    }
-  }
-  return { kept: keepRoot, removed: removed.length, skipped, reclaimedBytes };
-}
-
-function listRunningExecutables() {
-  const result = spawnSync("ps", ["-axo", "comm="], { encoding: "utf8" });
-  return result.status === 0 ? result.stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => path.isAbsolute(line)) : [];
-}
-
-function treeBytes(target) {
-  let total = 0;
-  const stat = fs.lstatSync(target);
-  if (!stat.isDirectory()) return stat.size;
-  for (const entry of fs.readdirSync(target, { withFileTypes: true })) {
-    const child = path.join(target, entry.name);
-    total += entry.isDirectory() && !entry.isSymbolicLink() ? treeBytes(child) : fs.lstatSync(child).size;
-  }
-  return total;
-}
-
 function validateDescriptor(descriptor, root, platform) {
   if (!descriptor || descriptor.kind !== "portable" || descriptor.activation?.kind !== "current") throw new Error("unsupported portable development descriptor");
   if (typeof root !== "string" || !path.isAbsolute(root)) throw new Error("repository root must be absolute");
@@ -214,24 +147,8 @@ function copyTree(source, target) {
   }
 }
 
-function validateCurrent(current, installRoot, platform) {
-  if (!exists(current)) return;
-  const stat = fs.lstatSync(current);
-  if (!stat.isSymbolicLink()) throw new Error(`development current pointer is not a symlink or junction; refusing to replace: ${current}`);
-  let target;
-  try { target = fs.realpathSync(current); } catch (error) { throw new Error(`development current pointer is dangling or unreadable: ${current}`, { cause: error }); }
-  const versionsRoot = path.join(installRoot, "versions");
-  const versionName = path.basename(target);
-  if (!isWithin(fs.realpathSync(installRoot), target, platform)
-    || !samePath(path.dirname(target), fs.realpathSync(versionsRoot), platform)
-    || !versionName || versionName === "." || versionName === "..") {
-    throw new Error(`development current pointer does not resolve to an owned version: ${current}`);
-  }
-}
-
 function removeIfExists(target) {
   if (!exists(target)) return;
   fs.rmSync(target, { recursive: true, force: true });
 }
 
-function randomSuffix() { return `${Date.now()}-${Math.random().toString(16).slice(2)}`; }

package/preflight.mjs

@@ -341,13 +341,11 @@ export function ownershipCheck(repoRoot, options = {}) {
   try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot); }
   catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
   const { result, evidence, floor } = checked;
-  if (checked.enrollmentPending) {
-    const diagnostics = [...(result.problems ?? []), ...(result.violations ?? []).map((entry) => `${entry.fingerprint} at ${entry.file}${entry.line ? `:${entry.line}` : ""}`)];
-    return { ...warn("ownership", `${checked.warning}${diagnostics.length ? `; ${diagnostics.length} diagnostic finding/problem(s) retained` : ""}`, null), evidence, diagnostics, result, floor };
-  }
   if (checked.ok) {
     const excepted = result.covered.length;
-    return { ...ok("ownership", excepted ? `no unapproved copies (${excepted} signed findings)` : "no copies of RightKit-owned capabilities"), evidence };
+    const detail = excepted ? `no unapproved copies (${excepted} excepted findings)` : "no copies of RightKit-owned capabilities";
+    // Pending approval enrollment is a warning only (#262); real findings still fail below.
+    return checked.enrollmentPending ? { ...warn("ownership", `${detail}; ${checked.warning}`, null), evidence, result, floor } : { ...ok("ownership", detail), evidence };
   }
   const first = result.violations[0];
   const detail = !floor.ok
@@ -355,7 +353,7 @@ export function ownershipCheck(repoRoot, options = {}) {
     : first
       ? `${result.violations.length} own cop${result.violations.length === 1 ? "y" : "ies"} of RightKit capabilities, e.g. ${first.fingerprint} at ${first.file}${first.line ? `:${first.line}` : ""}`
       : result.problems[0] ?? result.coverage[0]?.reason ?? "ownership scan incomplete";
-  return { ...fail("ownership", detail, "run: right-release ownership (move to RightKit, or request a signed, dated exception)"), evidence };
+  return { ...fail("ownership", detail, "run: right-release ownership (move to RightKit, or add a dated entry to the repo exceptions file)"), evidence };
 }
 
 export function formatPreflight(checks) {

package/publication-artifacts.mjs

@@ -3,6 +3,7 @@ import { readFileSync, statSync, openSync, fstatSync, readSync, closeSync } from
 import path from "node:path";
 import { verifySealedRelease } from "./release-state.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
+import { validateMediaSidecarReceipt } from "./media-sidecar.mjs";
 
 export class PublicationError extends Error {
   constructor(code, message) { super(`[${code}] ${message}`); this.name = "PublicationError"; this.code = code; }
@@ -55,15 +56,25 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!ownership.ok || manifest.ownershipEvidence?.commit !== commit) throw new PublicationError("PUBLICATION_OWNERSHIP_INVALID", `sealed ownership evidence rejected: ${ownership.reason ?? "commit mismatch"}`);
   if (!manifest.checkpoints?.includes("signed") || !manifest.checkpoints?.includes("hardened")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "signed & hardened seal checkpoints are required");
   if (configPath && digestBytes(readFileSync(configPath)) !== manifest.signing?.configSha256) throw new PublicationError("PUBLICATION_POLICY_MISMATCH", "release config differs from sealed signing policy");
+  if (manifest.mediaSidecars !== undefined) {
+    try { validateMediaSidecarReceipt(manifest.mediaSidecars); }
+    catch (error) { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", error.message); }
+  }
   const receipts = manifest.signing?.receipts;
   if (!Array.isArray(receipts) || !receipts.length) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed signing receipts are required");
   let notarized = false;
   let signed = false;
+  let androidVerified = false;
   for (const receipt of receipts) {
     const artifact = readVerifiedArtifact(path.resolve(appRoot, receipt.file), receipt);
     let value;
     try { value = JSON.parse(artifact.bytes); } catch { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "invalid sealed signing receipt"); }
     if (value.schema !== 1) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "malformed sealed signing receipt");
+    if (value.contract !== undefined) {
+      verifyAndroidPublicationReceipt(value, manifest, platform);
+      androidVerified = true; signed = true;
+      continue;
+    }
     if (Array.isArray(value.files)) {
       if (!value.files.length || value.files.some((item) => !/^[a-f0-9]{64}$/.test(item.after?.sha256 ?? "") || item.timestampPresent !== true
         || (platform === "win" ? item.authenticode !== "Valid" || item.subject !== "CN=Damned Ventures LLC" : item.codesign !== "strict-valid" || item.identity !== value.identity))) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "sealed signature verification evidence rejected");
@@ -81,6 +92,7 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   }
   if (!signed) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed native signing evidence is required");
   if (platform === "mac" && !notarized) throw new PublicationError("PUBLICATION_NOTARIZATION_MISSING", "sealed notarization evidence is required");
+  if (platform === "android" && !androidVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed android AAB upload-key receipt is required");
   const artifacts = new Map();
   for (const entry of manifest.files ?? []) {
     if (typeof entry.name !== "string" || path.basename(entry.name) !== entry.name || artifacts.has(entry.name)) throw new PublicationError("PUBLICATION_SEAL_INVALID", "unsafe or duplicate sealed artifact name");
@@ -90,6 +102,28 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   return { ...sealed, artifacts };
 }
 
+// Android AAB receipt (android-release.mjs: contract "android-aab-upload-key-v1"). The receipt was already read from the
+// manifest's signing.receipts and hash-verified by the caller; here it must describe exactly the sealed "aab" file and be
+// signed by the pinned upload certificate. Fails closed with a specific message on any mismatch.
+const ANDROID_RECEIPT_CONTRACT = "android-aab-upload-key-v1";
+function verifyAndroidPublicationReceipt(value, manifest, platform) {
+  const invalid = (message) => { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", message); };
+  if (value.contract !== ANDROID_RECEIPT_CONTRACT) invalid(`unrecognized signing receipt contract: ${JSON.stringify(value.contract)}`);
+  if (platform !== "android" || manifest.platform !== "android") invalid("android AAB receipt in a non-android release");
+  const signer = value.signer?.certSha256;
+  if (!/^[a-f0-9]{64}$/.test(signer ?? "")) invalid("android AAB receipt has no signer certificate sha256");
+  if (value.signer.debugCertificate === true || /Android Debug/i.test(String(value.signer.subject ?? ""))) invalid("android AAB receipt is signed with the Android debug certificate");
+  const pinned = manifest.signing?.uploadCertSha256;
+  if (!/^[a-f0-9]{64}$/.test(pinned ?? "")) invalid("sealed signing policy has no pinned android upload certificate");
+  if (signer !== pinned) invalid("android AAB signer certificate is not the pinned upload certificate");
+  const aabs = (manifest.files ?? []).filter((entry) => entry.role === "aab");
+  if (aabs.length !== 1) invalid(aabs.length ? "sealed release has more than one aab entry" : "sealed release has no aab entry");
+  const [aab] = aabs;
+  if (!/^[a-f0-9]{64}$/.test(value.file?.sha256 ?? "") || value.file.sha256 !== aab.sha256) invalid("android AAB receipt sha256 differs from the sealed aab entry");
+  if (!Number.isInteger(value.file.sizeBytes) || value.file.sizeBytes !== aab.sizeBytes) invalid("android AAB receipt size differs from the sealed aab entry");
+  if (value.file.name !== aab.name) invalid("android AAB receipt names a different file than the sealed aab entry");
+}
+
 // Bounded memory for large artifacts. Transport must read back against this digest.
 export function verifyArtifactFile(file, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "")) throw new PublicationError("PUBLICATION_SEAL_INVALID", "publication hash evidence is required");

package/publish-update.mjs

@@ -14,6 +14,7 @@ import { verifyPublicationRelease, PublicationError, assertArtifactUnchanged, di
 import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
 import { verifyPlatformTrust } from "./github-release.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
+import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease } from "./github-updater-release.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
@@ -44,9 +45,18 @@ if (!["win", "mac"].includes(platform)) throw new PublicationError("PUBLICATION_
 const configPath = path.resolve(configName);
 const root = path.dirname(configPath);
 const config = (await import(pathToFileURL(configPath))).default;
-if (config?.distribution?.provider !== "r2-rightapps") {
-  fail("release config distribution.provider must be r2-rightapps");
+const provider = config?.distribution?.provider;
+if (provider !== "r2-rightapps" && provider !== "github-releases") {
+  fail("release config distribution.provider must be r2-rightapps or github-releases");
 }
+// github-releases: the same sealed, suite-key-signed updater artifacts, published as release assets plus a Tauri v2
+// static latest.json (github-updater-release.mjs). Nothing below forks the r2 signing or platforms code.
+const githubLane = provider === "github-releases";
+let githubRepo = "";
+if (githubLane) {
+  try { githubRepo = assertGitHubRepository(config.distribution.repository); } catch (error) { fail(error.message); }
+}
+const githubKey = (item) => item.key ?? path.basename(item.file);
 const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
 const installers = target?.installer?.artifacts ?? [];
@@ -59,19 +69,24 @@ if (!dryRun || releaseId) {
   const commit = git(["rev-parse", "HEAD"]);
   assertCleanSource({ status: git(["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release publish-update" });
   sealed = verifyPublicationRelease({ sealedDir: path.join(repoRoot, ".right-release", "sealed", releaseId, platform === "win" ? "windows" : "mac"), repoRoot, appRoot: root, commit, app: config.app, version: versionForStorage, platform, configPath, releaseId });
-  const routes = sealed.manifest.routes?.[tier] ?? [];
-  const configured = [...(tier === "patch" ? installers.map((item) => ({ ...item, role: "installer" })) : []), ...artifacts.map((item) => ({ ...item, key: tier === "patch" ? patchInstallerKey(item) : item.key, role: "updater" }))];
+  const routes = sealed.manifest.routes?.[githubLane ? "update" : tier] ?? [];
+  const configured = githubLane
+    ? artifacts.map((item) => ({ ...item, key: githubKey(item), role: "updater" }))
+    : [...(tier === "patch" ? installers.map((item) => ({ ...item, role: "installer" })) : []), ...artifacts.map((item) => ({ ...item, key: tier === "patch" ? patchInstallerKey(item) : item.key, role: "updater" }))];
   for (const item of configured) {
-    if (!routes.some((route) => route.key === item.key && route.role === item.role && route.bucket === (tier === "patch" ? "public" : "private") && route.name === path.basename(item.file) && (!item.signature || route.signature === path.basename(item.signature)))) throw new PublicationError("PUBLICATION_ROUTE_INVALID", `config route is not sealed: ${item.key}`);
+    if (!routes.some((route) => route.key === item.key && route.role === item.role && route.bucket === (tier === "patch" && !githubLane ? "public" : "private") && route.name === path.basename(item.file) && (!item.signature || route.signature === path.basename(item.signature)))) throw new PublicationError("PUBLICATION_ROUTE_INVALID", `config route is not sealed: ${item.key}`);
   }
   if (!configured.length) throw new PublicationError("PUBLICATION_ROUTE_INVALID", "seal has no configured upload route");
   const installer = sealed.manifest.files.find((item) => item.role.split("+").includes("installer"));
-  if (!installer) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed installer required for platform trust verification");
-  verifyPlatformTrust({ sealed, installer: path.join(sealed.sealedDir, installer.name) });
+  if (!installer && !githubLane) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed installer required for platform trust verification");
+  // A github-releases app may ship only updater bundles and portable zips; their trust is the sealed signing
+  // receipts plus the updater signature, so platform trust runs only when a sealed installer exists.
+  if (installer) verifyPlatformTrust({ sealed, installer: path.join(sealed.sealedDir, installer.name) });
+  else console.log("no sealed installer; skipping installer platform trust check (github-releases updater-only seal)");
   for (const artifact of sealed.artifacts.values()) assertArtifactUnchanged(artifact);
   // Hardening step 4: installed QA is recorded, not enforced (R2 patch + update tiers); a missing receipt warns and is written to state.
   if (!dryRun) {
-    admitInstalledQa({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: digestBytes(readFileSync(configPath)) }, { provider: "r2" });
+    admitInstalledQa({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: digestBytes(readFileSync(configPath)) }, { provider: githubLane ? "github-releases" : "r2" });
   }
 }
 const artifactFile = (declared) => {
@@ -98,12 +113,12 @@ function git(args) {
   return result.stdout.trim();
 }
 
-if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
-if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
+if (!githubLane && tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
+if ((githubLane || tier === "update") && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
 if (sealed) for (const artifact of artifacts) signatureFor(artifact);
 let releaseToken = null;
-if (!dryRun && (tier === "update" || artifacts.length > 0)) {
+if (!githubLane && !dryRun && (tier === "update" || artifacts.length > 0)) {
   try {
     releaseToken = await loadReleaseToken();
   } catch (error) {
@@ -111,6 +126,52 @@ if (!dryRun && (tier === "update" || artifacts.length > 0)) {
   }
 }
 
+if (githubLane) {
+  const version = config.version || target.updater.version;
+  if (!version) fail(`${config.app} config must expose version or targets.${platform}.updater.version`);
+  try {
+    const tag = githubTag(version);
+    const notes = process.env.RIGHT_RELEASE_NOTES || `${config.app} ${version}`;
+    const platforms = {};
+    const assets = new Map();
+    for (const artifact of artifacts) {
+      assertUpdaterPlatform(artifact.platform);
+      const file = artifactFile(artifact.file);
+      const name = assertAssetName(path.basename(file));
+      // Same signature source and process as the r2 lane: the sealed minisign .sig written by sign-updater.
+      const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
+      if (!dryRun && !appInstallerKind) assertUpdaterKeyId(signature, config.distribution.updaterKeyId, `signature of ${name}`);
+      platforms[artifact.platform] = { signature, url: githubAssetUrl(githubRepo, tag, name) };
+      assets.set(file, { file, evidence: dryRun ? undefined : verifiedArtifact(file) });
+      if (!appInstallerKind) {
+        const sigFile = artifactFile(artifact.signature);
+        assets.set(sigFile, { file: sigFile, evidence: dryRun ? undefined : verifiedArtifact(artifact.signature) });
+      }
+    }
+    for (const asset of assets.values()) if (asset.evidence) assertArtifactUnchanged(asset.evidence);
+    const latest = buildLatestJson({ version, notes, pubDate: new Date().toISOString(), platforms });
+    for (const asset of assets.values()) console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD ${githubRepo}@${tag}/${path.basename(asset.file)}`);
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD ${githubRepo}@${tag}/latest.json`);
+    console.log(JSON.stringify(latest));
+    const stateDir = path.join(root, ".right-release", "state", releaseId || "dry-run", platform === "win" ? "windows" : "mac", "github-updater");
+    const result = publishGitHubUpdaterRelease({
+      repo: githubRepo,
+      tag,
+      title: `${config.app} ${version}`,
+      notes,
+      assets: [...assets.values()].map((asset) => ({ file: asset.file, evidence: asset.evidence })),
+      latest,
+      stateDir,
+      dryRun,
+    });
+    console.log(`publish-update: github-releases ${result.status} ${tag}${result.latestJsonUrl ? ` ${result.latestJsonUrl}` : ""}`);
+  } catch (error) {
+    fail(error.message);
+  }
+  if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform, configPath, releaseId });
+  process.exit(0);
+}
+
 if (tier === "patch") {
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");

package/qa-adoption-exemptions.json

@@ -0,0 +1,5 @@
+{
+  "schema": 1,
+  "description": "Repositories that are not apps and so need no RightKit QA lane. RightKit-owned: a change needs a RightKit release. Never list an app here; there is no per-app opt-out. The RightKit source tree itself is recognised by packages/release/package.json (name @rightkit/release) and needs no entry.",
+  "nonAppRepositories": []
+}