@rightkit/release 0.2.173 → 0.3.0

package/release.mjs

@@ -45,7 +45,9 @@ import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { assertNoQaControl, assertNoWebBundleMocks } from "./qa-control-scan.mjs";
+import { assertReleaseDependencies } from "./release-dependencies.mjs";
 import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 import { assertNoReleaseSwitches, commandTokens, resolveFeatureClosure } from "./release-switch-scan.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { runAndroidRelease, validateAndroidTarget } from "./android-release.mjs";
@@ -356,7 +358,7 @@ try {
     { label: "target.package", command: target.package },
     { label: "nativeAssembly.packageHook", command: nativeAssembly?.packageHook },
     { label: "nativeAssembly.finalizer", command: nativeFinalizer },
-    { label: "target.postSign", command: target.postSign },
+    ...commandList(target.postSign).map((command, index) => ({ label: Array.isArray(target.postSign) ? `target.postSign[${index}]` : "target.postSign", command })),
     { label: "target.gradle", command: target.gradle },
   ] });
 } catch (error) { fail(error.message); }
@@ -370,6 +372,10 @@ try {
 const releaseSwitchInventoryPath = path.resolve(root, config.releaseSwitches?.inventory ?? "switches.json");
 const releaseSwitchInventoryText = existsSync(releaseSwitchInventoryPath) ? readFileSync(releaseSwitchInventoryPath, "utf8") : null;
 try {
+  // A `node recipe-build.mjs --plan <JSON>` prePackage hides each step's `--features` in one argument: the closure and the
+  // command token scan see every prepare / build / postBuild step (a plan that cannot be read or validated fails closed).
+  const closureCommands = [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, ...commandList(target.postSign), target.gradle].filter(Boolean).flatMap((c) => expandRecipeBuildCommands(c, { root }));
+  assertReleaseDependencies({ root, config, target, commands: closureCommands });
   let treeText;
   try {
     const closure = resolveFeatureClosure({
@@ -379,7 +385,7 @@ try {
       rust: config.releaseSwitches?.rust,
       features: config.releaseSwitches?.features ?? [],
       triple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
-      commandTexts: [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, target.postSign, target.gradle],
+      commandTexts: closureCommands,
     });
     if (closure.skipped) console.log(`right-release: feature closure skipped (${closure.skipped})`);
     else treeText = closure.treeText;
@@ -388,7 +394,7 @@ try {
     console.log(`right-release: dry run: ${error.message}`);
   }
   // remoteHost: rightkit-daemon `remote` is refused in the closure unless the app declares releaseSwitches.remoteHost: true.
-  const closureInput = { treeText, remoteHost: config.releaseSwitches?.remoteHost, commands: [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, target.postSign, target.gradle].filter(Boolean).map((c) => commandTokens(c)) };
+  const closureInput = { treeText, remoteHost: config.releaseSwitches?.remoteHost, commands: closureCommands.map((c) => commandTokens(c)) };
   if (releaseSwitchInventoryText != null) {
     assertNoReleaseSwitches({ ...closureInput, sourceRoot: root, inventoryText: releaseSwitchInventoryText, appForbid: config.releaseSwitches?.forbid ?? [] }, "source switch inventory");
   } else if (treeText != null || closureInput.commands.length) {
@@ -494,7 +500,7 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
     assertNoQaControlBinaries("macOS app staged for the DMG", [stagedApp], { requireBinary: true, prePack: true });
   }
   if (runMacPhase("sign")) {
-    await signMacos(signingEntries, root, "signing", macSigning.nestedCode);
+    await signMacos(signingEntries, root, "signing", macSigning.nestedCode, macSigning.nestedSigning);
     if (sidecarPlan && !opts.dryRun) {
       const app = signingEntries.find((entry) => /\.app\/?$/.test(entry.file));
       if (!app) fail("mediaSidecar on macOS needs an .app entry in sign.prePackageFiles");
@@ -563,14 +569,14 @@ if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_C
   // and still installs a binary Windows rejects.
   await verifyWindowsEmbedding({ root, target, files, markers: bundleMarkerReceipts });
   await signWindows(files, "installer", root);
-  if (target.postSign) await runCommand(target.postSign, root);
+  if (target.postSign) await runCommands(target.postSign, root);
   const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => resolveReleaseArtifactPath(root, artifact.file)))];
   if (!updaterFiles.length) fail(`${config.app} win must declare updater.artifacts for post-code-signing minisign`);
   await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...(target.updater?.keyFile ? ["--key-file", String(target.updater.keyFile)] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
 }
 
 if (target.postSign && opts.platform !== "win" && (opts.platform !== "mac" || runMacPhase("post-sign"))) {
-  await runCommand(target.postSign, root);
+  await runCommands(target.postSign, root);
 }
 
 if (opts.platform === "mac") {
@@ -933,6 +939,17 @@ async function runPackageScript(pm, script, cwd) {
   await run(pm, ["run", script], cwd);
 }
 
+// A hook may be one command object or an ordered array of them (e.g. create-mac-updater then lsclean).
+function commandList(value) {
+  if (value == null) return [];
+  return Array.isArray(value) ? value : [value];
+}
+
+// Runs in order; run() exits the process on the first failure, so the chain fails closed.
+async function runCommands(value, root, options) {
+  for (const command of commandList(value)) await runCommand(command, root, options);
+}
+
 async function runCommand(command, root, { env = {}, captureStdout = false } = {}) {
   const cwd = path.resolve(root, command.cwd ?? ".");
   return run(command.cmd, command.args ?? [], cwd, { ...(await commandEnv(command, root)), ...env }, {
@@ -1117,9 +1134,13 @@ function signExistingRefusal(source) {
 // The renderer comes from this monorepo's own packages/ci when present, else from the repository's installed @rightkit/ci; with
 // neither the file is refused, because an unverifiable sign-existing.yml must not be accepted.
 async function loadRightKitCiRenderer(root) {
-  const candidates = [pathToFileURL(fileURLToPath(new URL("../ci/sync.mjs", import.meta.url))).href];
+  return (await loadRightKitCiModule(root, "sync.mjs", "renderLanes"))?.renderLanes ?? null;
+}
+
+async function loadRightKitCiModule(root, file, exportName) {
+  const candidates = [pathToFileURL(fileURLToPath(new URL(`../ci/${file}`, import.meta.url))).href];
   try {
-    candidates.push(pathToFileURL(createRequire(path.join(root, "package.json")).resolve("@rightkit/ci/sync.mjs")).href);
+    candidates.push(pathToFileURL(createRequire(path.join(root, "package.json")).resolve(`@rightkit/ci/${file}`)).href);
   } catch {
     // not installed in the repository; the sibling candidate may still apply
   }
@@ -1127,7 +1148,7 @@ async function loadRightKitCiRenderer(root) {
     try {
       if (href.startsWith("file:") && !existsSync(fileURLToPath(href))) continue;
       const loaded = await import(href);
-      if (typeof loaded.renderLanes === "function") return loaded.renderLanes;
+      if (typeof loaded[exportName] === "function") return loaded;
     } catch {
       // try the next candidate
     }
@@ -1150,6 +1171,57 @@ async function signExistingRenderRefusal(root, manifest, source) {
 }
 
 
+// `workflows` block entries render from code, so they are admitted only when the block passes @rightkit/ci's own
+// validateWorkflows and each file is byte-for-byte the @rightkit/ci render. With no resolvable @rightkit/ci they are refused.
+async function validateDeclaredWorkflowBlock(root, appName, manifest, declaredFiles) {
+  const validator = (await loadRightKitCiModule(root, "workflows.mjs", "validateWorkflows"))?.validateWorkflows;
+  const renderLanes = await loadRightKitCiRenderer(root);
+  if (!validator || !renderLanes) fail(`${appName} right-git-ci-only policy cannot verify .rightgit.json workflows: @rightkit/ci is not available (install @rightkit/ci as a devDependency)`);
+  const errors = [];
+  validator(manifest, errors);
+  if (errors.length > 0) fail(`${appName} right-git-ci-only policy refuses the .rightgit.json workflows block: ${errors.join("; ")}`);
+  let rendered;
+  try {
+    rendered = renderLanes(manifest, root);
+  } catch (error) {
+    fail(`${appName} right-git-ci-only policy cannot render the .rightgit.json workflows block: ${error.message}`);
+  }
+  for (const file of declaredFiles) {
+    const expected = rendered.find((entry) => entry.filename === file)?.content;
+    const actual = await readFile(path.join(root, ".github", "workflows", file), "utf8");
+    if (typeof expected !== "string" || actual.replace(/\r\n?/g, "\n") !== expected.replace(/\r\n?/g, "\n")) {
+      fail(`${appName} ${file} is not byte-for-byte the @rightkit/ci render of its .rightgit.json workflows entry (run right-git sync)`);
+    }
+  }
+}
+
+// Structural backstop for declared workflows (after render equality): the one top-level permissions block is exactly
+// `contents: read`, no other permissions key exists, no secrets reference, every `uses:` is commit-pinned, and every
+// checkout step sets persist-credentials: false. Steps are split on step-list indentation, not matched as free text.
+function declaredWorkflowPolicyRefusal(appName, workflow, source) {
+  const refuse = (why) => fail(`${appName} right-git managed ${workflow} violates the declared-workflow policy: ${why}`);
+  const lines = source.replace(/\r\n?/g, "\n").split("\n");
+  const permissionsAt = lines.flatMap((line, i) => (/^\s*permissions\s*:/.test(line) ? [i] : []));
+  if (permissionsAt.length !== 1 || lines[permissionsAt[0]] !== "permissions:" || lines[permissionsAt[0] + 1] !== "  contents: read" || /^ {2,}\S/.test(lines[permissionsAt[0] + 2] ?? "")) refuse("permissions must be exactly one top-level `contents: read`");
+  if (/\bsecrets\b/i.test(source)) refuse("it references the secrets context");
+  let step = null;
+  const steps = [];
+  for (const line of lines) {
+    if (/^ {6}- /.test(line)) { step = [line]; steps.push(step); }
+    else if (step && (/^ {7,}\S/.test(line) || line === "")) step.push(line);
+    else step = null;
+  }
+  for (const body of steps) {
+    const uses = /^ {6}- uses: (\S+)|^ {8}uses: (\S+)/m.exec(body.join("\n"));
+    if (!uses) continue;
+    const ref = uses[1] ?? uses[2];
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+@[0-9a-f]{40}$/.test(ref)) refuse(`action ${ref} is not commit-pinned`);
+    if (/^actions\/checkout@/.test(ref) && !body.some((line) => /^ {10}persist-credentials: false\s*$/.test(line))) refuse("a checkout step does not set persist-credentials: false");
+    if (body.some((line) => /persist-credentials:\s*true/.test(line))) refuse("persist-credentials: true");
+  }
+  if (/^\s*(?:- )?uses:/m.test(lines.filter((l) => !steps.some((b) => b.includes(l))).join("\n"))) refuse("a uses: sits outside a step list");
+}
+
 async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
@@ -1173,15 +1245,29 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     || lanes.some((lane) => !safeLanes.has(lane))) {
     fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from [${[...safeLanes].map((lane) => `"${lane}"`).join(", ")}] and including "ci" or "swift-check"`);
   }
-  const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
+  // Workflows declared under the manifest's `workflows` block (@rightkit/ci workflows.mjs: explicit `file`,
+  // else `<name>.yml`) are managed files too, in addition to the lane files.
+  const declaredWorkflows = manifest?.workflows;
+  if (declaredWorkflows !== undefined && (declaredWorkflows === null || typeof declaredWorkflows !== "object" || Array.isArray(declaredWorkflows))) {
+    fail(`${appName} right-git-ci-only policy requires .rightgit.json workflows to be an object`);
+  }
+  const declaredFiles = Object.entries(declaredWorkflows ?? {}).map(([name, config]) => {
+    if (config === null || typeof config !== "object" || Array.isArray(config)) fail(`${appName} right-git-ci-only policy requires .rightgit.json workflows.${name} to be an object`);
+    const file = typeof config?.file === "string" ? config.file : `${name}.yml`;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,60}\.yml$/.test(file)) fail(`${appName} right-git-ci-only policy refuses workflow file name ${JSON.stringify(file)} declared by .rightgit.json`);
+    return file;
+  });
+  const expectedWorkflows = [...new Set([...lanes.map((lane) => `${lane}.yml`), ...declaredFiles])].sort();
   if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
     fail(`${appName} right-git-ci-only policy requires workflows declared by .rightgit.json; expected ${expectedWorkflows.join(", ")}, got: ${workflows.join(", ")}`);
   }
+  if (declaredFiles.length > 0) await validateDeclaredWorkflowBlock(root, appName, manifest, declaredFiles);
   for (const workflow of expectedWorkflows) {
     const source = await readFile(path.join(root, ".github", "workflows", workflow), "utf8");
     if (!source.startsWith("# Managed by right-git")) {
       fail(`${appName} ${workflow} is not marked as right-git managed`);
     }
+    if (declaredFiles.includes(workflow)) declaredWorkflowPolicyRefusal(appName, workflow, source);
     const jobSpan = (jobName) => {
       const marker = `\n  ${jobName}:\n`;
       const start = source.indexOf(marker);
@@ -1462,12 +1548,12 @@ function macSignInvocation(items, receiptPath, extra = []) {
   return [SIGN_MACOS, ...extra, "--receipt", receiptPath, "--manifest", manifest];
 }
 
-async function signMacos(entries, root, phase = "signing", nestedCode = []) {
+async function signMacos(entries, root, phase = "signing", nestedCode = [], nestedSigning) {
   const files = entries.map((entry) => entry.file);
   const receipt = phase === "signing" ? macosReceiptPath(root, "signing") : path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `macos-${phase}.json`);
   // Directory entries (.app bundles): nested code first (default settings unless sign.nestedCode names it), then the bundle itself.
   let nested = [];
-  try { ({ nested } = opts.dryRun ? { nested: [] } : planMacSigning({ entries, nestedCode })); } catch (error) { fail(error.message); }
+  try { ({ nested } = opts.dryRun ? { nested: [] } : planMacSigning({ entries, nestedCode, nestedSigning, root })); } catch (error) { fail(error.message); }
   if (opts.dryRun && (nestedCode.length || entries.some(hasNonDefaultSettings))) {
     console.log(`right-release: dry-run: per-file signing matrix (${nestedCode.length} nestedCode rule(s), ${entries.filter(hasNonDefaultSettings).length} entry setting(s)); nested code is resolved against the built bundle at sign time`);
   }

package/rightkit-ownership.json

@@ -671,6 +671,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-crypto",
+      "capability": "crypto-primitives",
+      "summary": "Neutral SHA-256, HMAC-SHA256, constant-time compare, base64/base64url, hex, BLAKE3 text hash, canonical JSON and HMAC approval tokens",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of hand-rolling HMAC, constant-time compare, base64 or approval tokens.",
+        "Not a general cryptography suite: no encryption, signatures or key derivation."
+      ]
+    },
     {
       "package": "rightkit-daemon",
       "capability": "local-services",
@@ -1320,6 +1331,17 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-google-identity",
+      "capability": "google-identity",
+      "summary": "Google sign-in building blocks: PKCE, redirect, token request body, ID-token claim validation and refresh-token store; Android Credential Manager seam",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of hand-rolling Google OAuth request shapes.",
+        "ID-token signatures are not verified here; callers must not grant access on claims alone."
+      ]
+    },
     {
       "package": "rightkit-hooks",
       "capability": "lifecycle-hooks",
@@ -1416,6 +1438,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-identity",
+      "capability": "installation-identity",
+      "summary": "Installation identity with clone detection and startup claim, build identity (git rev, dirty flag, profile, channel, UTC stamp), device pairing with signed transcript, owner approval and resume tickets, bearer-token device auth with per-IP rate limit",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of writing their own install ids, pairing transcripts or bearer-token checks.",
+        "Key agreement is out of scope: the caller supplies the shared secret."
+      ]
+    },
     {
       "package": "rightkit-job-queue",
       "capability": "persistent-jobs",
@@ -2946,12 +2979,12 @@
     {
       "package": "rightkit-spend",
       "capability": "spend-ledger",
-      "summary": "Spend reservation, allowance and compare-and-swap ledger on SQLite: integer micro-units, idempotent reserve on request id, in-flight and overrun handling, opaque allowance periods",
+      "summary": "Spend reservation, allowance and compare-and-swap ledger on SQLite: integer micro-units, idempotent reserve on request id, in-flight and overrun handling, opaque allowance periods, optional account key and per-reservation currency, billed-unknown commit, caller-transaction (`_in`) variants, strict transition mode",
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
         "Declaration-only: the ledger tables and reservation state machine are not an ownership fingerprint.",
-        "Price rows live in rightkit-llm; the ledger stores opaque route and price-version text and no currency."
+        "Price rows live in rightkit-llm; the ledger stores opaque route and price-version text; an allowance holds no currency and a reservation holds only the currency text the caller passes."
       ]
     },
     {
@@ -3078,6 +3111,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-time",
+      "capability": "time-civil",
+      "summary": "RFC 3339 parse and format, fixed UTC offsets, civil date math and HTTP-date formatting",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of hand-rolling RFC 3339, civil date math or HTTP-date formatting.",
+        "No time zone database: named zones and DST rules are not owned here; callers pass a fixed offset."
+      ]
+    },
     {
       "package": "rightkit-transcript",
       "capability": "timed-transcripts",

package/rightkit-signing-agent.mjs

@@ -11,6 +11,11 @@ import { parseCodesignArgv } from "./codesign-argv.mjs";
 
 export const AGENT_LABEL = "dev.rightkit.signing-agent";
 export const MAX_FRAME = 1024 * 1024;
+// A typed codesign `--identifier` (reverse-DNS characters only; never starts with "-", so it cannot read as an option).
+export const AGENT_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
+// Request schema 2 is codesign-only and is the sole schema that may carry per-item `identifier`. Schema 1 stays valid and
+// byte-compatible for everything else; an agent that predates schema 2 refuses it (and any unknown item field) outright.
+export const CODESIGN_IDENTIFIER_SCHEMA = 2;
 export const NOTARIZATION_TIMEOUT_MS = 1800000;
 export const MAX_NOTARIZATION_TIMEOUT_MS = 7200000;
 export class SigningAgentError extends Error {
@@ -72,7 +77,7 @@ export function validateSigningRequest(request, { roots, stagingRoot, io = fs }
   const notary = ["notarize", "staple"].includes(request?.type);
   if (!["codesign", "codesign-argv", "updater", "notarize", "staple"].includes(request?.type)) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported signing request type");
   shape(request, [...common, ...(notary ? ["path", "profile", "staple", "app", "validateOnly"] : request.type === "codesign-argv" ? ["argv", "targets"] : [request.type === "codesign" ? "items" : "files"])]);
-  if (request.schema !== 1 || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > (notary ? MAX_NOTARIZATION_TIMEOUT_MS : 180000)) {
+  if (!(request.schema === 1 || (request.type === "codesign" && request.schema === CODESIGN_IDENTIFIER_SCHEMA)) || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > (notary ? MAX_NOTARIZATION_TIMEOUT_MS : 180000)) {
     fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid schema or signing deadline");
   }
   if (!Array.isArray(request.allowedRoots) || !request.allowedRoots.length || request.allowedRoots.length > 32) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Allowed roots required");
@@ -142,7 +147,8 @@ export function validateSigningRequest(request, { roots, stagingRoot, io = fs }
   }
   if (!Array.isArray(request.items) || !request.items.length || request.items.length > 4096) fail("MAC_SIGNING_AGENT_PROTOCOL", "Codesign items required");
   const items = request.items.map((item) => {
-    shape(item, ["path", "identity", "entitlements", "runtime", "timestamp", "force", "preserveEntitlements"]);
+    shape(item, ["path", "identity", "entitlements", "runtime", "timestamp", "force", "preserveEntitlements", ...(request.schema === CODESIGN_IDENTIFIER_SCHEMA ? ["identifier"] : [])]);
+    if (item.identifier !== undefined && (typeof item.identifier !== "string" || !AGENT_IDENTIFIER_PATTERN.test(item.identifier))) fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid codesign identifier");
     if (typeof item.identity !== "string" || !item.identity.trim() || item.identity === "-" || item.identity.includes("\0") || item.identity.length > 512) fail("MAC_SIGNING_AGENT_PROTOCOL", "Real signing identity required");
     for (const field of ["runtime", "timestamp", "force", "preserveEntitlements"]) if (item[field] !== undefined && typeof item[field] !== "boolean") fail("MAC_SIGNING_AGENT_PROTOCOL", "Signing options must be boolean");
     return { ...item, path: checked(item.path), ...(item.entitlements !== undefined ? { entitlements: checked(item.entitlements, { entitlements: true }) } : {}) };
@@ -156,7 +162,7 @@ export function authenticateSigningToken(candidate, token) {
 }
 export function executeSigningRequest(request, { run = spawnSync, home = os.userInfo().homedir,
   username = os.userInfo().username, pnpm, environmentPath, now = Date.now } = {}) {
-  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid, capabilities: ["codesign", "codesign-argv", "updater", "notarize", "staple"] };
+  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid, capabilities: ["codesign", "codesign-argv", "updater", "notarize", "staple", "codesign-identifier"] };
   const deadline = now() + request.timeoutMs;
   const env = { HOME: home, PATH: environmentPath, TMPDIR: path.join(signingAgentPaths(home).directory, "tmp") };
   if (request.type === "codesign-argv") {
@@ -191,7 +197,7 @@ export function executeSigningRequest(request, { run = spawnSync, home = os.user
       // Preserve caller's inside-out ordering. No arbitrary argv reaches spawn.
       for (const item of request.items) {
         const args = [...(item.force ? ["--force"] : []), ...(item.runtime ? ["--options", "runtime"] : []),
-          ...(item.timestamp ? ["--timestamp"] : []), "--sign", item.identity,
+          ...(item.timestamp ? ["--timestamp"] : []), ...(item.identifier !== undefined ? ["--identifier", item.identifier] : []), "--sign", item.identity,
           ...(item.entitlements ? ["--entitlements", item.entitlements] : []),
           ...(item.preserveEntitlements ? ["--preserve-metadata=entitlements"] : []), item.path];
         results.push(invoke("/usr/bin/codesign", args).result);

package/rightkit-versions.json

@@ -31,7 +31,7 @@
     "@rightkit/qa": "0.4.9",
     "@rightkit/qa-chrome": "0.1.8",
     "@rightkit/react-shell": "0.6.8",
-    "@rightkit/release": "0.2.173",
+    "@rightkit/release": "0.3.0",
     "@rightkit/settings-ui": "0.5.0",
     "@rightkit/tauri": "0.2.1",
     "@rightkit/tauri-shell": "0.1.1",
@@ -210,7 +210,9 @@
       "0.2.163",
       "0.2.164",
       "0.2.165",
-      "0.2.172"
+      "0.2.172",
+      "0.2.173",
+      "0.2.174"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -384,7 +386,7 @@
     "rightkit-automation": "0.4.1",
     "rightkit-browser": "0.3.1",
     "rightkit-cache": "0.2.0",
-    "rightkit-channel-memory": "0.1.0",
+    "rightkit-channel-memory": "0.2.1",
     "rightkit-child-process": "0.4.3",
     "rightkit-compose": "0.1.0",
     "rightkit-contracts": "0.1.5",
@@ -456,8 +458,8 @@
       "rightkit-automation": "0.4.1",
       "rightkit-browser": "0.3.1",
       "rightkit-cache": "0.2.0",
-      "rightkit-channel-memory": "0.1.0",
-      "rightkit-child-process": "0.4.1",
+      "rightkit-channel-memory": "0.2.1",
+      "rightkit-child-process": "0.4.3",
       "rightkit-compose": "0.1.0",
       "rightkit-contracts": "0.1.5",
       "rightkit-control": "0.3.0",
@@ -541,7 +543,7 @@
       "@rightkit/qa": "0.4.9",
       "@rightkit/qa-chrome": "0.1.8",
       "@rightkit/react-shell": "0.6.8",
-      "@rightkit/release": "0.2.172",
+      "@rightkit/release": "0.2.174",
       "@rightkit/settings-ui": "0.5.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.2.1",
@@ -812,6 +814,9 @@
     ],
     "rightkit-hotkeys": [
       "0.1.0"
+    ],
+    "rightkit-channel-memory": [
+      "0.1.0"
     ]
   }
 }

package/runtime-budgets.mjs

@@ -199,7 +199,7 @@ export function renderRuntimeBudgetBody(budget) {
     const host = `${m.host?.os}/${m.host?.arch}${m.host?.model ? ` (${m.host.model})` : ""}`;
     const scale = `${count(m.dataScale?.count)} ${m.dataScale?.unit} (${m.dataScale?.description})`;
     const app = m.scope === "installed" && m.app ? `, app ${m.app.name} ${m.app.version}` : "";
-    const observed = BUDGET_FIGURES.map((k) => `${FIGURE_LABEL[k]} ${m.observed?.[k] === undefined ? "n/a" : FORMAT[k](m.observed[k])}`).join(", ");
+    const observed = BUDGET_FIGURES.map((k) => `${FIGURE_LABEL[k]} ${m.observed?.[k] === undefined || m.observed?.[k] === null ? "n/a (not measurable on this host)" : FORMAT[k](m.observed[k])}`).join(", ");
     out.push(`- Measured: ${host}, ${budget.crate} ${m.crateVersion} at ${String(m.commit).slice(0, 12)}, ${scale}, ${m.scope}${app}, \`${m.command}\`, ${m.date}, evidence ${String(m.evidence?.sha256 ?? "none").slice(0, 12)}: ${observed}.`);
   }
   return out;
@@ -291,6 +291,10 @@ export function measurementStaleness(commit, crateDir, git = defaultGit, deps =
 
 // ---------------------------------------------------------------- bench evidence
 
+// Figures a host cannot measure by design. macOS has no per-process disk-operation count (rightkit-child-process
+// usage.rs: ru_inblock/ru_oublock stay 0 there), so disk_ops_per_s may be "unavailable" on darwin only.
+export const HOST_UNAVAILABLE_FIGURES = Object.freeze({ darwin: Object.freeze(["diskOpsPerSecond"]) });
+export const figureUnavailableOn = (os, key) => (HOST_UNAVAILABLE_FIGURES[os] ?? []).includes(key);
 const RESULT_NUMBERS = Object.freeze({ resident_bytes: "residentMemoryBytes", idle_cpu_percent: "idleCpuPercent", wakeups_per_s: "wakeupsPerSecond", disk_ops_per_s: "diskOpsPerSecond", scale_count: "scaleCount" });
 const RESULT_WORDS = Object.freeze(["crate", "version", "scale_unit"]);
 
@@ -312,7 +316,8 @@ export function parseBudgetResult(text) {
   for (const key of RESULT_WORDS) { if (!nonEmpty(fields[key])) problems.push(`missing field ${key}`); else value[key] = fields[key]; }
   for (const [key, name] of Object.entries(RESULT_NUMBERS)) {
     const n = Number(fields[key]);
-    if (fields[key] === undefined || fields[key] === "" || !Number.isFinite(n) || n < 0) problems.push(`field ${key} must be a non-negative number`);
+    if (fields[key] === "unavailable" && name !== "residentMemoryBytes" && name !== "scaleCount") value[name] = null;
+    else if (fields[key] === undefined || fields[key] === "" || !Number.isFinite(n) || n < 0) problems.push(`field ${key} must be a non-negative number`);
     else value[name] = n;
   }
   return problems.length ? { ok: false, problems } : { ok: true, problems: [], value };
@@ -412,6 +417,7 @@ function validateMeasurement(m, index) {
   }
   if (!nonEmpty(m.command)) problems.push(`${at} has no command`);
   for (const key of BUDGET_FIGURES) {
+    if (m.observed?.[key] === null && figureUnavailableOn(m.host?.os, key)) continue;
     if (!isNumber(m.observed?.[key]) || m.observed[key] < 0) problems.push(`${at} observed.${key} must be a non-negative number`);
   }
   if (isNumber(m.observed?.residentMemoryBytes) && m.observed.residentMemoryBytes === 0) {
@@ -507,12 +513,12 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
   }
   for (const { m, index } of counted) {
     for (const key of BUDGET_FIGURES) {
-      if (ceilings[key] !== undefined && m.observed[key] > ceilings[key]) {
+      if (ceilings[key] !== undefined && m.observed[key] !== null && m.observed[key] > ceilings[key]) {
         problems.push(`measurement[${index}] on ${m.host.os}/${m.host.arch} exceeds the ${FIGURE_LABEL[key]} ceiling: observed ${m.observed[key]} > ${ceilings[key]}`);
       }
     }
   }
-  const withinCeilings = (m) => BUDGET_FIGURES.every((key) => ceilings[key] !== undefined && m.observed[key] <= ceilings[key]);
+  const withinCeilings = (m) => BUDGET_FIGURES.every((key) => ceilings[key] !== undefined && (m.observed[key] === null ? figureUnavailableOn(m.host?.os, key) : m.observed[key] <= ceilings[key]));
   const atScale = (m) => requiredScale !== null && m.dataScale.unit === requiredScale.unit && m.dataScale.count >= requiredScale.minCount;
   const staleness = new Map();
   const stale = (m) => {
@@ -749,16 +755,18 @@ export function appRuntimeBudgetAdoptionCheck({ appRoot, app, version, cargoLock
   const used = Object.keys(classes).filter((name) => locked.has(name));
   if (used.length === 0) return null;
   const problems = [];
+  // A crate whose ceilings or scale RightKit has not declared yet cannot be measured against anything, so it
+  // never blocks an app: it is reported as pending (warn) until the crate declares its budget.
+  const pending = used.filter((name) => !classes[name].ceilings || !classes[name].requiredScale);
+  const measurable = used.filter((name) => !pending.includes(name));
   const adoptionPath = path.join(appRoot, APP_ADOPTION_FILE);
   let records = [];
-  if (!exists(adoptionPath)) problems.push(`${APP_ADOPTION_FILE} is missing`);
+  if (!exists(adoptionPath)) { if (measurable.length) problems.push(`${APP_ADOPTION_FILE} is missing`); }
   else {
     try { records = JSON.parse(readFile(adoptionPath, "utf8")).measurements ?? []; } catch (error) { problems.push(`${APP_ADOPTION_FILE} is not valid JSON: ${error.message}`); }
   }
-  for (const crate of used) {
+  for (const crate of measurable) {
     const { ceilings, requiredScale } = classes[crate];
-    if (!ceilings) { problems.push(`${crate}: ceilings undeclared (declare them in its runtime-budget.json and regenerate ${CLASSES_FILE})`); continue; }
-    if (!requiredScale) { problems.push(`${crate}: requiredScale undeclared`); continue; }
     const mine = records.map((m, index) => ({ m, index })).filter(({ m }) => m?.crate === crate && m.scope === "installed" && locked.get(crate).has(m.crateVersion));
     if (mine.length === 0) { problems.push(`${crate} ${[...locked.get(crate)].join("/")}: no installed-scope measurement of ${app}`); continue; }
     const good = mine.filter(({ m, index }) => {
@@ -768,16 +776,21 @@ export function appRuntimeBudgetAdoptionCheck({ appRoot, app, version, cargoLock
       if (evidenceProblems.length) { problems.push(`${crate}: ${evidenceProblems.join("; ")}`); return false; }
       if (m.app.name !== app) { problems.push(`${crate}: measurement[${index}] is for app ${m.app.name}, not ${app}`); return false; }
       if (version && m.app.version !== version) { problems.push(`${crate}: measurement[${index}] was taken at ${app} ${m.app.version}, not the current ${version}`); return false; }
-      const over = BUDGET_FIGURES.filter((k) => m.observed[k] > ceilings[k]);
+      const over = BUDGET_FIGURES.filter((k) => m.observed[k] !== null && m.observed[k] > ceilings[k]);
       if (over.length) { problems.push(`${crate}: measurement[${index}] exceeds ${over.join(", ")}`); return false; }
       if (m.dataScale.unit !== requiredScale.unit || m.dataScale.count < requiredScale.minCount) { problems.push(`${crate}: measurement[${index}] is below the required scale ${requiredScale.minCount} ${requiredScale.unit}`); return false; }
       return true;
     });
     if (good.length === 0 && !problems.some((p) => p.startsWith(`${crate}`))) problems.push(`${crate}: no qualifying measurement`);
   }
-  return problems.length
-    ? { name: RUNTIME_BUDGET_CHECK, status: "fail", detail: `${app} uses held-resource crate(s) ${used.join(", ")}: ${problems.join("; ")}`, fix: `record an installed measurement of ${app} for each crate in ${APP_ADOPTION_FILE} (docs/RUNTIME-BUDGETS.md)` }
-    : { name: RUNTIME_BUDGET_CHECK, status: "ok", detail: `${app} has installed measurements for ${used.join(", ")}` };
+  const pendingNote = pending.length ? `; pending RightKit budget declaration (not blocking): ${pending.join(", ")}` : "";
+  if (problems.length) {
+    return { name: RUNTIME_BUDGET_CHECK, status: "fail", detail: `${app} uses held-resource crate(s) ${measurable.join(", ")}: ${problems.join("; ")}${pendingNote}`, fix: `record an installed measurement of ${app} for each crate in ${APP_ADOPTION_FILE} (docs/RUNTIME-BUDGETS.md)` };
+  }
+  if (pending.length) {
+    return { name: RUNTIME_BUDGET_CHECK, status: "warn", detail: `${app} uses held-resource crate(s) whose RightKit ceilings are not declared yet: ${pending.join(", ")}${measurable.length ? `; measured: ${measurable.join(", ")}` : ""}`, fix: "RightKit declares the crate ceilings; then record installed measurements (docs/RUNTIME-BUDGETS.md)" };
+  }
+  return { name: RUNTIME_BUDGET_CHECK, status: "ok", detail: `${app} has installed measurements for ${used.join(", ")}` };
 }
 
 // ---------------------------------------------------------------- record (measurement provenance)
@@ -813,6 +826,9 @@ export function recordMeasurement({ crateDir, resultFile, scope, command, descri
   const v = parsed.value;
   if (v.crate !== pkg.name) throw new Error(`bench output is for ${v.crate}, crate is ${pkg.name}`);
   if (v.version !== pkg.version) throw new Error(`bench output is for version ${v.version}, crate is ${pkg.version}`);
+  for (const key of BUDGET_FIGURES) {
+    if (v[key] === null && !figureUnavailableOn(host.os, key)) throw new Error(`bench output rejected: ${key} is unavailable, which is allowed only where the host cannot measure it (${JSON.stringify(HOST_UNAVAILABLE_FIGURES)})`);
+  }
   if (!SCOPES.includes(scope)) throw new Error(`--scope must be one of ${SCOPES.join(", ")}`);
   if (scope === "installed" && !(nonEmpty(app?.name) && nonEmpty(app?.version))) throw new Error("--scope installed needs --app and --app-version");
   if (!nonEmpty(command)) throw new Error("--command (the exact bench command) is required");

package/stage-binary.mjs

@@ -9,7 +9,7 @@ import { resolveTargetRoot } from "./cargo-target.mjs";
  * The build broker writes Cargo output to per-generation folders (`<managed>/rightkit-build-control/ws/<hash>/g/<gen>/...`)
  * and `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. Those are build output only: their path is not
  * stable, so NOTHING may run from them. macOS ties privacy grants to the path an app runs from, so a dev or QA binary is
- * copied in place to `<root>/.rightkit-dev-bin/<triple-or-host>/<name>` (keeping `<name>.previous`) and run from there.
+ * copied in place to `<root>/.rightkit-dev-bin/<triple-or-host>/<name>` (replaced in place, no `.previous` kept) and run from there.
  */
 export const DEV_STAGE_DIRECTORY = ".rightkit-dev-bin";
 

package/stage-sidecar-command.mjs

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
-// `right-release stage-sidecar [--config right-release.config.mjs] [--target <triple>]` (bogusyogi/rightkit#345):
-// stages the config's declarative `sidecars` into src-tauri/binaries with Tauri externalBin naming.
+// `right-release stage-sidecar [--config right-release.config.mjs] [--target <triple>] [--check] [--json]` (bogusyogi/rightkit#345):
+// stages the config's declarative `sidecars` into src-tauri/binaries with Tauri externalBin naming. `--check` validates
+// the manifest and prints the plan without building, downloading, copying or deleting anything (for template gates).
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { resolveTargetTriple, stageSidecars } from "./stage-sidecar.mjs";
+import { planSidecarStaging, resolveTargetTriple, stageSidecars } from "./stage-sidecar.mjs";
 
 export function parseStageSidecarArgs(argv) {
-  const opts = { config: "right-release.config.mjs", target: undefined, json: false };
+  const opts = { config: "right-release.config.mjs", target: undefined, json: false, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--target") {
@@ -15,11 +16,35 @@ export function parseStageSidecarArgs(argv) {
       opts[arg.slice(2)] = value;
       i += 1;
     } else if (arg === "--json") opts.json = true;
+    else if (arg === "--check") opts.check = true;
     else throw new Error(`unknown stage-sidecar argument: ${arg}`);
   }
   return opts;
 }
 
+const NODE_ARCH = { x64: "x86_64", arm64: "aarch64" };
+const NODE_OS = { darwin: "apple-darwin", win32: "pc-windows-msvc", linux: "unknown-linux-gnu" };
+
+/** Host triple from Node alone (no subprocess), so `--check` stays free of effects. */
+export function nodeHostTriple(platform = process.platform, arch = process.arch) {
+  const cpu = NODE_ARCH[arch];
+  const system = NODE_OS[platform];
+  if (!cpu || !system) throw new Error(`cannot derive a target triple from ${platform}/${arch}; pass --target`);
+  return `${cpu}-${system}`;
+}
+
+/** Human-readable plan lines for `--check`. */
+export function formatSidecarPlan(plan) {
+  const lines = [`right-release stage-sidecar --check: target ${plan.target}, mode ${plan.mode}, stageDir ${plan.stageDir}${plan.wipeStageDir ? " (wipeStageDir)" : ""}`];
+  for (const entry of plan.entries) {
+    if (entry.skipped) lines.push(`  [${entry.index}] ${entry.kind}: skipped (platforms ${entry.platforms.join(",")})`);
+    else lines.push(`  [${entry.index}] ${entry.kind}: ${entry.outputs.join(", ")}${entry.externalBin ? " (externalBin)" : ""}${entry.clean ? " (clean)" : ""}${entry.url ? ` <- ${entry.url}` : ""}`);
+  }
+  if (plan.nestedBrokerRisk) lines.push("  warning: running inside an outer broker build; staging would fail with STAGE_SIDECAR_NESTED_BROKER (run stage-sidecar in recipe prepare, before the Tauri build)");
+  lines.push("right-release stage-sidecar --check: manifest is valid; nothing was staged");
+  return lines;
+}
+
 async function main() {
   const opts = parseStageSidecarArgs(process.argv.slice(2));
   const configPath = path.resolve(opts.config);
@@ -27,6 +52,13 @@ async function main() {
   const loaded = await import(pathToFileURL(configPath).href);
   const config = loaded.default ?? loaded.config ?? loaded;
   if (config?.sidecars === undefined) throw new Error(`${opts.config} declares no sidecars`);
+  if (opts.check) {
+    const target = opts.target ?? process.env.TAURI_ENV_TARGET_TRIPLE ?? nodeHostTriple();
+    const plan = planSidecarStaging({ manifest: config.sidecars, target });
+    if (opts.json) console.log(JSON.stringify(plan, null, 2));
+    else for (const line of formatSidecarPlan(plan)) console.log(line);
+    return;
+  }
   const target = resolveTargetTriple({ target: opts.target, cwd: appRoot });
   const result = await stageSidecars({ appRoot, manifest: config.sidecars, target });
   if (opts.json) console.log(JSON.stringify(result, null, 2));