@rightkit/release 0.2.174 → 0.3.0

package/ownership.mjs

@@ -156,7 +156,31 @@ function resolveLocalPath(root, sourceFile, pathValue, coverage, display, invent
   } catch { coverage.push({ path: display, status: "unscanned", reason: `${reasonPrefix}-path-unresolved${detail ? `:${detail}` : ""}` }); }
 }
 
-function parseCargo(parsed, file, out, workspace, root, coverage, inventory) {
+// A Git dependency pinned by a full 40-hex `rev` is immutable. When its URL is third-party it is equivalent to a registry
+// dependency and is not a gap (Orthic-Labs/rightkit#677). A first-party URL (Orthic-Labs, bogusyogi, or an org listed in
+// ownership-repositories.json) stays an unscanned fatal gap because first-party code must be scanned. A branch, a tag, a
+// short rev or no rev is always an unscanned coverage gap.
+const FULL_GIT_REV = /^[0-9a-f]{40}$/i;
+export const PINNED_GIT_DEPENDENCY = "pinned-git-dependency";
+const FIRST_PARTY_GIT_ORGS = new Set(["github.com/orthic-labs", "github.com/bogusyogi"]);
+const gitHostOrg = (url) => {
+  const text = String(url).trim();
+  const match = /^(?:[a-z][a-z0-9+.-]*:\/\/)?(?:[^@/\s]+@)?([^/:\s]+)[/:]+([^/\s]+)/i.exec(text);
+  return match ? `${match[1]}/${match[2]}`.toLowerCase() : null;
+};
+let configuredFirstParty;
+function firstPartyGitOrgs() {
+  if (configuredFirstParty) return configuredFirstParty;
+  const orgs = new Set(FIRST_PARTY_GIT_ORGS);
+  try {
+    const config = JSON.parse(readFileSync(new URL("./ownership-repositories.json", import.meta.url), "utf8"));
+    for (const repo of config.repositories ?? []) { const key = gitHostOrg(repo.repositoryIdentity ?? ""); if (key) orgs.add(key); }
+  } catch { /* the built-in first-party orgs still apply */ }
+  return (configuredFirstParty = orgs);
+}
+export const isFirstPartyGitUrl = (url) => { const key = gitHostOrg(url); return key === null || firstPartyGitOrgs().has(key); };
+
+function parseCargo(parsed, file, out, workspace, root, coverage, inventory, covered = []) {
   const pathSpec = (pathValue, sourceFile, display) => {
     resolveLocalPath(root, sourceFile, pathValue, coverage, display, inventory);
   };
@@ -176,7 +200,15 @@ function parseCargo(parsed, file, out, workspace, root, coverage, inventory) {
       if (!raw || typeof raw !== "string" && (typeof raw !== "object" || Array.isArray(raw)) || features.some((x) => typeof x !== "string") || requirement !== null && typeof requirement !== "string") throw new Error(`malformed dependency declaration: ${alias}`);
       addDependency(out, "cargo", name, file, { alias: name === alias ? null : alias, section: `${prefix}${section}`, requirement, features, defaultFeatures: spec["default-features"] ?? inherited["default-features"] ?? null, source, resolvedVersion: null, local: !!pathValue || !!git });
       if (pathValue) pathSpec(pathValue, spec.path ? file : path.posix.join(workspace.dir ?? ".", "Cargo.toml"), file);
-      if (git) coverage.push({ path: file, status: "unscanned", reason: `git-dependency-source:${name}` });
+      if (git) {
+        const rev = spec.rev ?? inherited.rev;
+        const moving = [spec.branch, inherited.branch, spec.tag, inherited.tag].some((value) => value !== undefined);
+        if (typeof git === "string" && typeof rev === "string" && FULL_GIT_REV.test(rev) && !moving && !isFirstPartyGitUrl(git)) {
+          // Immutable third-party source, not a gap: kept out of `coverage` (every coverage row blocks the gate) and reported on
+          // `deps.covered`. `scanned: false` records that the source is pinned, not examined.
+          covered.push({ path: file, status: PINNED_GIT_DEPENDENCY, reason: `git-dependency-source:${name}`, fingerprint: `${git}@${rev.toLowerCase()}`, scanned: false });
+        } else coverage.push({ path: file, status: "unscanned", reason: `git-dependency-source:${name}` });
+      }
     }
     for (const [target, value] of Object.entries(table.target ?? {})) addTable(value, `${prefix}target.'${target}'.`);
   };
@@ -375,7 +407,7 @@ function resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDi
 }
 
 function dependenciesFromInventory(appRoot, inventory) {
-  const deps = [], coverage = [], contentDigests = [];
+  const deps = [], coverage = [], contentDigests = [], covered = [];
   // Workspace inheritance is loaded before member manifests.
   const manifestNames = new Set(["Cargo.toml", "package.json", "Package.swift"]);
   const manifests = inventory.files.filter((x) => manifestNames.has(path.posix.basename(x.rel)));
@@ -419,7 +451,7 @@ function dependenciesFromInventory(appRoot, inventory) {
     if (base === "Cargo.toml") {
       const dir = path.posix.dirname(rel);
       const workspace = workspaces.filter((x) => x.dir === "." || dir === x.dir || dir.startsWith(`${x.dir}/`)).sort((a, b) => b.dir.length - a.dir.length)[0] ?? { dir: ".", deps: {} };
-      try { parseCargo(parseToml(text), rel, deps, workspace, appRoot, coverage, inventory); }
+      try { parseCargo(parseToml(text), rel, deps, workspace, appRoot, coverage, inventory, covered); }
       catch { coverage.push({ path: rel, status: "unscanned", reason: "invalid-cargo-toml" }); }
     }
     else if (base === "package.json") {
@@ -453,6 +485,7 @@ function dependenciesFromInventory(appRoot, inventory) {
   resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDigests);
   Object.defineProperty(deps, "coverage", { value: coverage, enumerable: false });
   Object.defineProperty(deps, "contentDigests", { value: contentDigests, enumerable: false });
+  Object.defineProperty(deps, "covered", { value: covered, enumerable: false });
   Object.defineProperty(deps, "manifests", { value: files, enumerable: false });
   return deps;
 }

package/package-recipe-targets.mjs

@@ -25,6 +25,7 @@ const withoutRecipe = (target) => {
 };
 const QUIET_TAURI_ENV = { TAURI_SIGNING_PRIVATE_KEY: "", TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" };
 const RECIPE_BUILD = fileURLToPath(new URL("./recipe-build.mjs", import.meta.url));
+const CREATE_MAC_UPDATER = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url));
 const PROFILE = /^[a-z][a-z0-9_-]*$/;
 
 function relativeInside(value, label) {
@@ -160,7 +161,7 @@ export function expandWinPackageTarget(target, { appRoot, config = {}, env = pro
   };
 }
 
-const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot"]);
+const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot", "updater"]);
 const MAC_TRIPLES = ["aarch64-apple-darwin", "x86_64-apple-darwin"];
 const MAC_CLEANUP_KEYS = new Set(["staleApps", "staleDmgVolumes", "lsclean"]);
 
@@ -179,6 +180,8 @@ function macCleanupSpec(value) {
  * The app path and DMG path are `notarize.app` and `notarize.file`; DMG branding is `targets.mac.dmg`.
  * Architecture: `triple` (an explicit arch triple) beats `universal`; `universal: false` means this host's arch.
  * `cleanup` runs built-in steps in recipe-build before the build (stale DMG volumes, stale .app bundles, lsregister).
+ * `updater: true | "<app-relative .tar.gz>"` emits the Tauri updater tarball and its signature from the signed, stapled .app:
+ * it prepends a `create-mac-updater` command to `postSign` (default output `<App>.app.tar.gz` beside the app's working root).
  */
 export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
   if (!target?.macPackage) return withoutRecipe(target);
@@ -196,6 +199,8 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   const cwd = spec.tauriCwd ?? ".";
   if (typeof cwd !== "string" || path.isAbsolute(cwd) || cwd.split(/[\\/]/).includes("..")) fail("targets.mac.macPackage.tauriCwd must be a relative path inside the app");
   const cleanupSpec = macCleanupSpec(spec.cleanup);
+  if (spec.updater !== undefined && spec.updater !== true && spec.updater !== false && typeof spec.updater !== "string") fail("targets.mac.macPackage.updater must be true or an app-relative .tar.gz path");
+  if (typeof spec.updater === "string" && !/\.tar\.gz$/i.test(relativeInside(spec.updater, "targets.mac.macPackage.updater"))) fail("targets.mac.macPackage.updater must end in .tar.gz");
   // Tauri's universal-apple-darwin target builds both slices and lipos them itself.
   const triple = spec.triple ?? (spec.universal === false ? (process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin") : "universal-apple-darwin");
   if (spec.triple !== undefined) {
@@ -225,8 +230,17 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
     : undefined;
   const wrapped = extras.prepare.length || extras.postBuild.length || cleanup;
   const { macPackage, recipe: _ignoredMac, ...rest } = target;
+  // The updater tarball is made from the signed .app, so it runs in postSign, ahead of any postSign the app declares.
+  const updaterOutput = spec.updater === true ? `${productName}.app.tar.gz` : typeof spec.updater === "string" ? relativeInside(spec.updater, "targets.mac.macPackage.updater") : undefined;
+  const postSign = updaterOutput === undefined ? {} : {
+    postSign: [
+      { cmd: process.execPath, args: [CREATE_MAC_UPDATER, "--app", app, "--output", updaterOutput] },
+      ...(target.postSign === undefined ? [] : Array.isArray(target.postSign) ? target.postSign : [target.postSign]),
+    ],
+  };
   return {
     ...rest,
+    ...postSign,
     prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
     sign: { ...(target.sign ?? {}), prePackageFiles },
     notarize: { ...target.notarize, app, appBeforePackage: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.174",
+  "version": "0.3.0",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/pe-content.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// Signature-independent PE content digest and import-closure check (bogusyogi/rightkit#445).
+//   right-release pe digest <file> [--algorithm sha256|sha384|sha512] [--json]
+//   right-release pe imports <file> [--allow <dll[,dll...]>]... [--allow-file <path>] [--json]
+// Pure Buffer parsing, so both run on any host. The digest follows the Authenticode image hash: the CheckSum field,
+// the Certificate Table directory entry and the certificate data itself are excluded, so re-signing or timestamping
+// a binary never changes it.
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { readPeImports } from "./pe-imports.mjs";
+
+const ALGORITHMS = new Set(["sha256", "sha384", "sha512"]);
+function fail(message, code = "PE_INVALID") { throw Object.assign(new Error(message), { code }); }
+
+function layout(buf) {
+  if (buf.length < 0x40 || buf.readUInt16LE(0) !== 0x5a4d) fail("not a PE file (missing MZ)");
+  const pe = buf.readUInt32LE(0x3c);
+  if (pe + 24 > buf.length || buf.readUInt32LE(pe) !== 0x00004550) fail("not a PE file (missing PE signature)");
+  const sectionCount = buf.readUInt16LE(pe + 6);
+  const optionalSize = buf.readUInt16LE(pe + 20);
+  const optional = pe + 24;
+  const magic = buf.readUInt16LE(optional);
+  if (magic !== 0x20b && magic !== 0x10b) fail("unsupported PE optional header");
+  const directories = optional + (magic === 0x20b ? 112 : 96);
+  const numberOfDirectories = buf.readUInt32LE(directories - 4);
+  const checksumAt = optional + 64;
+  const sizeOfHeaders = buf.readUInt32LE(optional + 60);
+  const certEntryAt = directories + 4 * 8;
+  const hasCert = numberOfDirectories > 4;
+  if (checksumAt + 4 > buf.length || sizeOfHeaders > buf.length || (hasCert && certEntryAt + 8 > buf.length)) fail("truncated PE headers");
+  const sectionsAt = optional + optionalSize;
+  const sections = [];
+  for (let i = 0; i < sectionCount; i++) {
+    const at = sectionsAt + i * 40;
+    if (at + 40 > buf.length) fail("truncated PE section table");
+    const rawSize = buf.readUInt32LE(at + 16);
+    const rawPtr = buf.readUInt32LE(at + 20);
+    if (rawSize > 0 && rawPtr + rawSize > buf.length) fail("PE section extends past the end of the file");
+    sections.push({ rawSize, rawPtr });
+  }
+  // The certificate table directory holds a FILE OFFSET (not an RVA).
+  const cert = hasCert ? { offset: buf.readUInt32LE(certEntryAt), size: buf.readUInt32LE(certEntryAt + 4) } : { offset: 0, size: 0 };
+  if (cert.size === 0 && cert.offset !== 0) fail("PE certificate table has an offset but no size");
+  if (cert.size > 0) {
+    if (cert.offset + cert.size > buf.length) fail("PE certificate table extends past the end of the file");
+    // The certificate table must be the terminal region: bytes after it would otherwise escape the digest.
+    if (cert.offset + cert.size !== buf.length) fail("PE certificate table is not the terminal region of the file (bytes follow it)");
+    if (cert.offset < sizeOfHeaders) fail("PE certificate table overlaps the headers");
+    for (const s of sections) if (s.rawSize > 0 && s.rawPtr + s.rawSize > cert.offset) fail("PE certificate table overlaps a section");
+  }
+  return { checksumAt, sizeOfHeaders, certEntryAt, hasCert, sections, cert };
+}
+
+/** Authenticode-style SHA-2 digest of a PE image, independent of its signature, timestamp and CheckSum. */
+export function peContentDigest(bytes, { algorithm = "sha256" } = {}) {
+  if (!ALGORITHMS.has(algorithm)) fail(`unsupported digest algorithm: ${algorithm}`, "PE_USAGE");
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  const l = layout(buf);
+  const hash = createHash(algorithm);
+  hash.update(buf.subarray(0, l.checksumAt));
+  if (l.hasCert) {
+    hash.update(buf.subarray(l.checksumAt + 4, l.certEntryAt));
+    hash.update(buf.subarray(l.certEntryAt + 8, l.sizeOfHeaders));
+  } else {
+    hash.update(buf.subarray(l.checksumAt + 4, l.sizeOfHeaders));
+  }
+  // Every byte after the headers up to the certificate table (or end of file) is hashed: sections, inter-section gaps and overlay.
+  const trailEnd = l.cert.size > 0 ? l.cert.offset : buf.length;
+  if (trailEnd > l.sizeOfHeaders) hash.update(buf.subarray(l.sizeOfHeaders, trailEnd));
+  return hash.digest("hex");
+}
+
+const normalize = (name) => String(name).trim().toLowerCase();
+
+function allowMatcher(allowed) {
+  const entries = allowed.map(normalize).filter(Boolean);
+  return (dll) => entries.some((entry) => (entry.endsWith("*") ? dll.startsWith(entry.slice(0, -1)) : dll === entry));
+}
+
+/**
+ * Check that every DLL a PE imports (regular and delay-load) is in `allowedDlls`. Names compare case-insensitively;
+ * a trailing `*` allows a prefix (`api-ms-win-*`). An empty allow list refuses every import.
+ * @returns {{ok: boolean, architecture: string, imports: string[], delayImports: string[], unexpected: string[]}}
+ */
+export function verifyImportClosure(bytes, allowedDlls) {
+  if (!Array.isArray(allowedDlls)) fail("allowedDlls must be an array", "PE_USAGE");
+  const info = readPeImports(bytes);
+  const allowed = allowMatcher(allowedDlls);
+  const all = [...new Set([...info.imports, ...info.delayImports].map(normalize))].sort();
+  const unexpected = all.filter((dll) => !allowed(dll));
+  return { ok: unexpected.length === 0, architecture: info.architecture, imports: info.imports, delayImports: info.delayImports, unexpected };
+}
+
+const USAGE = "usage: right-release pe digest <file> [--algorithm sha256|sha384|sha512] [--json] | pe imports <file> [--allow dll,...] [--allow-file <path>] [--json]";
+
+function parseArgs(argv) {
+  const [sub, file, ...rest] = argv;
+  const opts = { sub, file, algorithm: "sha256", allow: [], json: false };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--json") opts.json = true;
+    else if (["--algorithm", "--allow", "--allow-file"].includes(arg)) {
+      const value = rest[++i];
+      if (value === undefined || value.startsWith("--")) fail(`${arg} needs a value`, "PE_USAGE");
+      if (arg === "--algorithm") opts.algorithm = value;
+      else if (arg === "--allow") opts.allow.push(...value.split(","));
+      else opts.allow.push(...readFileSync(value, "utf8").split(/\r?\n/).map((l) => l.replace(/#.*/, "").trim()).filter(Boolean));
+    } else fail(`unknown pe argument: ${arg}`, "PE_USAGE");
+  }
+  if (!["digest", "imports"].includes(sub) || !file) fail(USAGE, "PE_USAGE");
+  return opts;
+}
+
+export function main(argv = process.argv.slice(2), out = console) {
+  let opts;
+  try { opts = parseArgs(argv); } catch (error) { out.error(error.message); return 2; }
+  try {
+    const bytes = readFileSync(opts.file);
+    if (opts.sub === "digest") {
+      const digest = peContentDigest(bytes, { algorithm: opts.algorithm });
+      out.log(opts.json ? JSON.stringify({ file: opts.file, algorithm: opts.algorithm, digest }) : `${opts.algorithm}:${digest}`);
+      return 0;
+    }
+    const result = verifyImportClosure(bytes, opts.allow);
+    out.log(opts.json ? JSON.stringify({ file: opts.file, ...result }) : [`${opts.file} (${result.architecture})`, ...result.imports.map((d) => `  import ${d}`), ...result.delayImports.map((d) => `  delay-import ${d}`), ...result.unexpected.map((d) => `  UNEXPECTED ${d}`)].join("\n"));
+    return result.ok ? 0 : 1;
+  } catch (error) {
+    out.error(error.message);
+    return error.code === "PE_USAGE" ? 2 : 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exit(main());

package/publication-gate.mjs

@@ -48,11 +48,73 @@ function describeCommitMismatch(evidenceCommit, head, packagePath, git) {
   return parts.join("; ");
 }
 
+const text = (value) => typeof value === "string" && value.trim() !== "";
+const escapeRegExp = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// A batch publication (local-publish.mjs --crates) runs fmt, the secret scan and clippy ONCE for the whole
+// batch at one commit and tree, then copies that receipt into every crate's evidence run as `run.batch`.
+// The receipt proves, for THIS crate, the same three checks a per-crate run proves; it is bound to the evidence
+// commit and to the HEAD tree (the git tree of that commit), so it cannot be carried to another commit.
+export const BATCH_CHECKS = Object.freeze(["fmt", "secret-scan", "clippy"]);
+const BATCH_COMMAND = Object.freeze({
+  fmt: /\bfmt\b.*--check\b/,
+  "secret-scan": /\S/,
+  clippy: /\bclippy\b.*--all-targets\b.*-D warnings\s*$/,
+});
+
+/** Problems with a batch receipt for the crate `evidence.name` (empty when it proves fmt, secret scan and clippy).
+ * `tree` is the current HEAD tree when known; `undefined` skips only that comparison. */
+export function batchReceiptProblems(batch, evidence, tree) {
+  if (!batch || typeof batch !== "object" || Array.isArray(batch)) return ["batch receipt must be an object"];
+  const problems = [];
+  if (!text(batch.id)) problems.push("batch.id");
+  if (batch.commit !== evidence.commit) problems.push(`batch.commit (must equal ${evidence.commit})`);
+  if (!SHA.test(String(batch.tree ?? ""))) problems.push("batch.tree (must be a 40-hex git tree)");
+  else if (tree !== undefined && batch.tree !== tree) problems.push(`batch.tree (must equal the HEAD tree ${tree})`);
+  if (!(Array.isArray(batch.crates) && batch.crates.includes(evidence.name))) problems.push("batch.crates (must name this crate)");
+  const checks = Array.isArray(batch.checks) ? batch.checks : [];
+  for (const name of BATCH_CHECKS) {
+    const rows = checks.filter((row) => row?.name === name);
+    if (!rows.length) { problems.push(`batch check ${name} missing`); continue; }
+    for (const row of rows) {
+      if (row.ok !== true) problems.push(`batch check ${name} not ok`);
+      if (row.commit !== evidence.commit || row.tree !== batch.tree) problems.push(`batch check ${name} not bound to the batch commit and tree`);
+      if (!(text(row.command) && BATCH_COMMAND[name].test(row.command))) problems.push(`batch check ${name} command`);
+    }
+    // fmt is workspace-wide; clippy and the secret scan name the crates they covered.
+    if (name !== "fmt" && !rows.some((row) => Array.isArray(row.crates) && row.crates.includes(evidence.name))) problems.push(`batch check ${name} does not cover this crate`);
+  }
+  return problems;
+}
+
+/**
+ * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
+ * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
+ * `cargo clippy -p <name> ... -D warnings` step, or a valid batch receipt covering the crate), and `fmt` and
+ * `secretScan` (a valid batch receipt covering the crate). Every darwin run at the evidence commit must prove a
+ * step for it to count. Call after the gate accepted the evidence (the gate binds commit, tree and artifact).
+ */
+export function provenGateSteps(evidence) {
+  const none = { tests: false, clippy: false, fmt: false, secretScan: false };
+  if (!evidence || !SHA.test(String(evidence.commit ?? "")) || !text(evidence.name)) return none;
+  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === "darwin");
+  if (!runs.length || runs.some((run) => run.commit !== evidence.commit)) return none;
+  const name = escapeRegExp(evidence.name);
+  const stepProves = (run, pattern, needTests) => (Array.isArray(run.steps) ? run.steps : []).some((step) => step?.ok === true
+    && pattern.test(String(step.command ?? "")) && (!needTests || (step.executed > 0 && step.failed === 0)));
+  const batchOk = (run) => run.batch !== undefined && batchReceiptProblems(run.batch, evidence, undefined).length === 0;
+  return {
+    tests: runs.every((run) => stepProves(run, new RegExp(`^cargo test -p ${name}( |$)`), true)),
+    clippy: runs.every((run) => batchOk(run) || stepProves(run, new RegExp(`^cargo clippy -p ${name} .*-- -D warnings$`), false)),
+    fmt: runs.every(batchOk),
+    secretScan: runs.every(batchOk),
+  };
+}
+
 // Names of the fields of one host run that do not qualify (empty when the run qualifies). Every run binds to
 // the same unit, commit and artifact: commit, host arch, feature set and artifactSha256 equal to the evidence.
-function invalidRunFields(run, evidence) {
+function invalidRunFields(run, evidence, tree) {
   const bad = [];
-  const text = (value) => typeof value === "string" && value.trim() !== "";
   if (run.commit !== evidence.commit) bad.push(`commit (must equal ${evidence.commit})`);
   if (!text(run.host?.arch)) bad.push("host.arch");
   if (!(Array.isArray(run.features) && run.features.length > 0 && run.features.every(text))) bad.push("features");
@@ -62,6 +124,7 @@ function invalidRunFields(run, evidence) {
   if (!text(run.timestamp)) bad.push("timestamp");
   if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
   if (run.failed !== 0) bad.push("failed (must be 0)");
+  if (run.batch !== undefined) bad.push(...batchReceiptProblems(run.batch, evidence, tree ?? null).map((problem) => `batch: ${problem}`));
   return bad;
 }
 
@@ -88,6 +151,10 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
       missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
     }
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
+    // A batch receipt is bound to the HEAD tree as well as the commit; read it only when a run carries one.
+    // `tree ?? null` below makes an unreadable tree fail the comparison (null never equals a 40-hex tree).
+    const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
+    if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
     // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
     // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
     // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
@@ -98,7 +165,7 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
       // Every run on the host must qualify: a failing run is not masked by a passing run beside it.
       matching.forEach((run, index) => {
-        const fields = invalidRunFields(run, evidence);
+        const fields = invalidRunFields(run, evidence, tree);
         if (fields.length) missing.push(`${label} run receipt ${index} invalid: ${fields.join(", ")}`);
       });
     }

package/publish-cargo.mjs

@@ -2,7 +2,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
@@ -53,11 +53,22 @@ export function runtimeBudgetDeferral(crateDir, crate) {
   return `${data.reason} (${data.approvedBy}, ${data.approved}; ci/runtime-budget-deferred.json)`;
 }
 
-export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false }) {
+// Plan step label -> the `provenGateSteps` key whose proof lets that step be skipped.
+const PROVEN_STEP = Object.freeze({ "secret scan": "secretScan", format: "fmt", tests: "tests", clippy: "clippy" });
+
+/**
+ * `proven` (from `provenGateSteps(evidence)`) removes a secret scan, format, tests or clippy step the evidence
+ * already proves for this exact commit; the runtime budget, package contents, archive hash and registry steps
+ * are never skippable. `verifyOnPublish` (real publish only) drops the separate registry dry-run and lets the
+ * real `cargo publish` run Cargo's own verify build (no `--no-verify`), so the package compiles once, before
+ * the upload, instead of in a dry-run and not at all in the publish.
+ */
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false }) {
   const dryRunArgs = ["publish", "--dry-run", "-p", crate];
   const packageArgs = ["package", "--list", "-p", crate];
   if (allowDirty) dryRunArgs.push("--allow-dirty");
   if (allowDirty) packageArgs.push("--allow-dirty");
+  const verifyHere = verifyOnPublish && !dryRun;
   const plan = [
     { label: "secret scan", internal: "secret-scan", crateDir },
     // Runtime-budget crates (runtime-budgets.mjs) must carry a measured runtime-budget.json for this
@@ -67,15 +78,15 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
-    { label: "registry dry-run", command: "cargo", args: dryRunArgs },
-  ];
+    ...(verifyHere ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
+  ].filter((step) => !(PROVEN_STEP[step.label] && proven[PROVEN_STEP[step.label]] === true));
   if (!dryRun) plan.push(
     // `publish --dry-run` leaves its archive under target/package/tmp-crate on current Cargo; package
     // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads.
     { label: "package archive", command: "cargo", args: ["package", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
     { label: "package location", command: "cargo", args: ["metadata", "--format-version", "1", "--no-deps"], capture: true },
     { label: "archive hash check", internal: "verify-archive" },
-    { label: "registry publish", command: "cargo", args: ["publish", "--no-verify", "-p", crate] },
+    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", "--no-verify", "-p", crate] },
     { label: "registry readback", internal: "registry-readback" },
   );
   return plan;
@@ -119,7 +130,14 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   };
   const gate = (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { dryRun: options.dryRun });
   const expectedSha256 = gate.evidence?.artifactSha256;
-  const plan = buildCargoPublishPlan({ ...options, crateDir });
+  // Only the local publisher (local-publish.mjs) sets `trustEvidenceSteps`: it ran the tests and clippy for this
+  // exact commit itself and wrote them into the evidence the gate above just validated. A plain publish proves
+  // nothing in advance, so `proven` stays empty and every step runs.
+  const proven = options.trustEvidenceSteps === true && !options.dryRun ? provenGateSteps(gate.evidence) : {};
+  const plan = buildCargoPublishPlan({ ...options, crateDir, proven, verifyOnPublish: options.verifyOnPublish === true });
+  for (const [label, key] of Object.entries(PROVEN_STEP)) {
+    if (proven[key] === true) process.stdout.write(`[right-release] cargo ${label}: proven by the gate evidence for this commit, not repeated\n`);
+  }
 
   let targetDir;
   let artifact;
@@ -159,7 +177,8 @@ export async function runCargoPublish(options, execute = (_command, args, settin
       continue;
     }
     if (step.label === "registry publish") assertArtifactUnchanged(artifact);
-    const result = execute(step.command, step.args, {
+    // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
+    const result = await execute(step.command, step.args, {
       cwd: options.workspaceRoot,
       encoding: "utf8",
       windowsHide: true,

package/release-dependencies-command.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { assertReleaseDependencies } from "./release-dependencies.mjs";
+import { nodeHostTriple } from "./stage-sidecar-command.mjs";
+import { expandPackageRecipeTarget } from "./package-recipe-targets.mjs";
+
+/** Standalone policy check: host target by default, all declared release targets on request. */
+export async function main(argv, { cwd = process.cwd(), platform = process.platform, arch = process.arch, run } = {}) {
+  let configPath = "right-release.config.mjs", selected, allTargets = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (["--config", "--platform"].includes(arg)) {
+      const value = argv[++i];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} needs a value`);
+      if (arg === "--config") configPath = value; else selected = value;
+    } else if (arg === "--all-targets") allTargets = true;
+    else throw new Error(`unknown check-release-dependencies argument: ${arg}`);
+  }
+  if (allTargets && selected) throw new Error("use --platform or --all-targets");
+  const file = path.resolve(cwd, configPath);
+  const root = path.dirname(file);
+  const config = (await import(pathToFileURL(file).href)).default;
+  if (config?.releaseDependencies === undefined) throw new Error("check-release-dependencies requires releaseDependencies in config");
+  const host = { darwin: "mac", win32: "win", linux: "linux" }[platform];
+  const platforms = allTargets ? Object.keys(config.targets ?? {}) : [selected ?? host];
+  if (!platforms.length) throw new Error("no release targets declared");
+  const results = [];
+  for (const name of platforms) {
+    let target = config.targets?.[name];
+    if (!name || !target) throw new Error(`no release target for ${name ?? platform}; use --platform or --all-targets`);
+    target = expandPackageRecipeTarget(target, { platform: name, appRoot: root, config });
+    if (name !== host && !(target.cargoTarget ?? target.targetTriple ?? target.rustTarget)) throw new Error(`${name} must declare cargoTarget, targetTriple or rustTarget`);
+    if (!allTargets && !selected) target = { ...target, cargoTarget: nodeHostTriple(platform, arch) };
+    results.push(assertReleaseDependencies({ root, config, target, run }));
+  }
+  return results;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  main(process.argv.slice(2)).then((results) => console.log(JSON.stringify(results, null, 2))).catch((error) => {
+    console.error(`right-release check-release-dependencies: ${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/release-dependencies.mjs

@@ -0,0 +1,60 @@
+// App-specific release dependency policy. Development builds never call this gate.
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { resolveCargoTree } from "./release-switch-scan.mjs";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
+import { nodeHostTriple } from "./stage-sidecar-command.mjs";
+import { resolveNativeFinalizerConfig } from "./native-release-finalization.mjs";
+
+function crateNames(names) {
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !/^[A-Za-z0-9_][A-Za-z0-9_-]*$/.test(name))) {
+    throw new TypeError("releaseDependencies.forbiddenCrates must be an array of exact Cargo package names");
+  }
+  return [...new Set(names)];
+}
+
+/** Exact package matches from `cargo tree -e normal --prefix none`, deduplicated across versions. */
+export function forbiddenCrateFindings(treeText, forbiddenCrates) {
+  const denied = new Set(crateNames(forbiddenCrates));
+  const found = new Set();
+  for (const line of String(treeText).split(/\r?\n/)) {
+    const match = line.match(/^([A-Za-z0-9_][A-Za-z0-9_-]*) v\d[^\s]*(?:\s|$)/);
+    if (match && denied.has(match[1])) found.add(match[1]);
+  }
+  return [...found].sort();
+}
+
+/**
+ * Enforce config.releaseDependencies for one release target before packaging.
+ * `commands` may supply already-expanded release hooks; `run` injects the Cargo runner for tests.
+ * Returns { skipped } without Cargo when no policy is declared, else { manifest, target, trees, forbiddenCrates }.
+ * Cargo errors, empty output, invalid policy & forbidden packages throw; dry runs obey this gate too.
+ */
+export function assertReleaseDependencies({ root, config = {}, target = {}, commands, run } = {}) {
+  const policy = config.releaseDependencies;
+  if (policy === undefined) return { skipped: "no releaseDependencies policy" };
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) throw new TypeError("releaseDependencies must be an object");
+  const forbiddenCrates = crateNames(policy.forbiddenCrates);
+  if (policy.features !== undefined && (!Array.isArray(policy.features) || policy.features.some((feature) => typeof feature !== "string" || !feature.trim() || feature.startsWith("-")))) {
+    throw new TypeError("releaseDependencies.features must be an array of Cargo feature names");
+  }
+  if (policy.noDefaultFeatures !== undefined && typeof policy.noDefaultFeatures !== "boolean") throw new TypeError("releaseDependencies.noDefaultFeatures must be boolean");
+  const manifest = policy.manifest ?? target.cargoManifest ?? config.releaseSwitches?.manifest ?? config.nativeAssembly?.cargoManifest ?? config.nativeAssembly?.manifest;
+  if (manifest !== undefined && (typeof manifest !== "string" || !manifest || !existsSync(path.resolve(root, manifest)))) {
+    throw new Error(`release dependencies: declared Cargo manifest does not exist: ${manifest}`);
+  }
+  const triple = target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? nodeHostTriple();
+  const commandList = (value) => value == null ? [] : Array.isArray(value) ? value : [value];
+  const hooks = commands ?? [target.prePackage, target.package, config.nativeAssembly?.packageHook,
+    resolveNativeFinalizerConfig(config.nativeAssembly), ...commandList(target.postSign), target.gradle].filter(Boolean);
+  const closure = resolveCargoTree({
+    root, manifest: manifest === undefined ? undefined : path.relative(root, path.resolve(root, manifest)), features: [...(config.releaseSwitches?.features ?? []), ...(policy.features ?? [])],
+    noDefaultFeatures: policy.noDefaultFeatures ?? false,
+    triple, commandTexts: hooks.flatMap((command) => expandRecipeBuildCommands(command, { root })),
+    edges: "normal", prefix: "none", label: "release dependencies", run,
+  });
+  if (!/^[A-Za-z0-9_][A-Za-z0-9_-]* v\d[^\s]*(?:\s|$)/m.test(closure.treeText)) throw new Error("release dependencies: cargo tree returned no package records");
+  const found = forbiddenCrateFindings(closure.treeText, forbiddenCrates);
+  if (found.length) throw new Error(found.map((crate) => `FAIL: ${crate} is in the release dependency tree (${triple})`).join("\n"));
+  return { manifest: closure.manifest, target: triple, trees: closure.trees.length, forbiddenCrates };
+}

package/release-switch-scan.mjs

@@ -120,7 +120,13 @@ function readPackageScripts(root) {
 // skip is `rust === false` (releaseSwitches.rust: false, an explicit "this app has no Rust") and only when no candidate
 // manifest exists. Returns { treeText, manifest } or { skipped: <reason> }. Throws when cargo fails: the caller fails closed.
 // `run` is injectable for tests: (command, args, options) => { status, stdout, stderr, error }.
-export function resolveFeatureClosure({ root, manifest, cargoManifest, rust, features = [], scripts, triple, commandTexts = [], run = spawnSync } = {}) {
+export function resolveFeatureClosure(options = {}) {
+  return resolveCargoTree(options);
+}
+
+/** Shared Cargo tree resolver; keeps each build command's feature selection separate. */
+export function resolveCargoTree({ root, manifest, cargoManifest, rust, features = [], scripts, triple, commandTexts = [],
+  edges = "features,no-dev", prefix, noDefaultFeatures = false, label = "feature closure", run = spawnSync } = {}) {
   const { rel, declared, candidates } = resolveCargoManifestPath({ root, cargoManifest, manifest });
   if (!rel) {
     if (rust === false) return { skipped: "releaseSwitches.rust is false: the app declares no Rust" };
@@ -129,7 +135,8 @@ export function resolveFeatureClosure({ root, manifest, cargoManifest, rust, fea
   if (declared.length && !declared.some((c) => existsSync(path.join(root, c)))) {
     throw new Error(`release-switch-manifest-missing: declared manifest ${declared.join(", ")} does not exist under ${root}`);
   }
-  const baseArgs = ["tree", "-e", "features,no-dev", "--locked", "--manifest-path", path.join(root, rel), "--target", triple || "all"];
+  const baseArgs = ["tree", "--color", "never", "-e", edges, "--locked", "--manifest-path", path.join(root, rel), "--target", triple || "all"];
+  if (prefix) baseArgs.push("--prefix", prefix);
   const pkgScripts = scripts ?? readPackageScripts(root);
   // One cargo tree per distinct (features, no-default-features, manifest) combination, one combination per build command
   // (flags gathered over the command and the package.json scripts it runs). A `--no-default-features` in one command never
@@ -143,30 +150,33 @@ export function resolveFeatureClosure({ root, manifest, cargoManifest, rust, fea
       if (script && depth < 3 && Object.hasOwn(pkgScripts, script) && !seen.has(script)) expand(String(pkgScripts[script]), depth + 1, new Set([...seen, script]));
     };
     expand(text, 0, new Set());
-    let noDefault = false;
+    let noDefault = noDefaultFeatures;
+    let allFeatures = false;
     const enabled = [...features];
     for (const t of expanded) {
       const tokens = commandTokens(t);
       if (tokens.includes("--no-default-features")) noDefault = true;
+      if (tokens.includes("--all-features")) allFeatures = true;
       enabled.push(...featuresInTokens(tokens).enabled);
     }
     const list = [...new Set(enabled)].sort();
-    combos.set(`${rel}|${noDefault}|${list.join(",")}`, { noDefault, list });
+    combos.set(`${rel}|${noDefault}|${allFeatures}|${list.join(",")}`, { noDefault, allFeatures, list });
   };
   const texts = commandTexts.filter(Boolean);
   if (texts.length === 0) comboFor("");
   for (const text of texts) comboFor(text);
   const trees = [];
-  for (const { noDefault, list } of combos.values()) {
+  for (const { noDefault, allFeatures, list } of combos.values()) {
     const args = [...baseArgs];
     if (noDefault) args.push("--no-default-features");
+    if (allFeatures) args.push("--all-features");
     if (list.length) args.push("--features", list.join(","));
     const result = run("cargo", args, { cwd: root, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (result.error || result.status !== 0) {
-      throw new Error(`feature closure: \`cargo ${args.join(" ")}\` failed (${result.error?.message ?? `exit ${result.status}`}): ${String(result.stderr ?? "").trim().slice(0, 600)}. The resolved feature graph is the authoritative test-mode check, so a release cannot continue without it.`);
+      throw new Error(`${label}: \`cargo ${args.join(" ")}\` failed (${result.error?.message ?? `exit ${result.status}`}): ${String(result.stderr ?? "").trim().slice(0, 600)}. The resolved feature graph is the authoritative test-mode check, so a release cannot continue without it.`);
     }
     const out = String(result.stdout ?? "");
-    if (!out.trim()) throw new Error("feature closure: `cargo tree` printed nothing; cannot verify");
+    if (!out.trim()) throw new Error(`${label}: \`cargo tree\` printed nothing; cannot verify`);
     trees.push(out);
   }
   const treeText = trees.join("\n");