@rightkit/release 0.2.174 → 0.3.0

package/release.mjs

@@ -45,6 +45,7 @@ import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { assertNoQaControl, assertNoWebBundleMocks } from "./qa-control-scan.mjs";
+import { assertReleaseDependencies } from "./release-dependencies.mjs";
 import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
 import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 import { assertNoReleaseSwitches, commandTokens, resolveFeatureClosure } from "./release-switch-scan.mjs";
@@ -374,6 +375,7 @@ try {
   // A `node recipe-build.mjs --plan <JSON>` prePackage hides each step's `--features` in one argument: the closure and the
   // command token scan see every prepare / build / postBuild step (a plan that cannot be read or validated fails closed).
   const closureCommands = [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, ...commandList(target.postSign), target.gradle].filter(Boolean).flatMap((c) => expandRecipeBuildCommands(c, { root }));
+  assertReleaseDependencies({ root, config, target, commands: closureCommands });
   let treeText;
   try {
     const closure = resolveFeatureClosure({
@@ -1132,9 +1134,13 @@ function signExistingRefusal(source) {
 // The renderer comes from this monorepo's own packages/ci when present, else from the repository's installed @rightkit/ci; with
 // neither the file is refused, because an unverifiable sign-existing.yml must not be accepted.
 async function loadRightKitCiRenderer(root) {
-  const candidates = [pathToFileURL(fileURLToPath(new URL("../ci/sync.mjs", import.meta.url))).href];
+  return (await loadRightKitCiModule(root, "sync.mjs", "renderLanes"))?.renderLanes ?? null;
+}
+
+async function loadRightKitCiModule(root, file, exportName) {
+  const candidates = [pathToFileURL(fileURLToPath(new URL(`../ci/${file}`, import.meta.url))).href];
   try {
-    candidates.push(pathToFileURL(createRequire(path.join(root, "package.json")).resolve("@rightkit/ci/sync.mjs")).href);
+    candidates.push(pathToFileURL(createRequire(path.join(root, "package.json")).resolve(`@rightkit/ci/${file}`)).href);
   } catch {
     // not installed in the repository; the sibling candidate may still apply
   }
@@ -1142,7 +1148,7 @@ async function loadRightKitCiRenderer(root) {
     try {
       if (href.startsWith("file:") && !existsSync(fileURLToPath(href))) continue;
       const loaded = await import(href);
-      if (typeof loaded.renderLanes === "function") return loaded.renderLanes;
+      if (typeof loaded[exportName] === "function") return loaded;
     } catch {
       // try the next candidate
     }
@@ -1165,6 +1171,57 @@ async function signExistingRenderRefusal(root, manifest, source) {
 }
 
 
+// `workflows` block entries render from code, so they are admitted only when the block passes @rightkit/ci's own
+// validateWorkflows and each file is byte-for-byte the @rightkit/ci render. With no resolvable @rightkit/ci they are refused.
+async function validateDeclaredWorkflowBlock(root, appName, manifest, declaredFiles) {
+  const validator = (await loadRightKitCiModule(root, "workflows.mjs", "validateWorkflows"))?.validateWorkflows;
+  const renderLanes = await loadRightKitCiRenderer(root);
+  if (!validator || !renderLanes) fail(`${appName} right-git-ci-only policy cannot verify .rightgit.json workflows: @rightkit/ci is not available (install @rightkit/ci as a devDependency)`);
+  const errors = [];
+  validator(manifest, errors);
+  if (errors.length > 0) fail(`${appName} right-git-ci-only policy refuses the .rightgit.json workflows block: ${errors.join("; ")}`);
+  let rendered;
+  try {
+    rendered = renderLanes(manifest, root);
+  } catch (error) {
+    fail(`${appName} right-git-ci-only policy cannot render the .rightgit.json workflows block: ${error.message}`);
+  }
+  for (const file of declaredFiles) {
+    const expected = rendered.find((entry) => entry.filename === file)?.content;
+    const actual = await readFile(path.join(root, ".github", "workflows", file), "utf8");
+    if (typeof expected !== "string" || actual.replace(/\r\n?/g, "\n") !== expected.replace(/\r\n?/g, "\n")) {
+      fail(`${appName} ${file} is not byte-for-byte the @rightkit/ci render of its .rightgit.json workflows entry (run right-git sync)`);
+    }
+  }
+}
+
+// Structural backstop for declared workflows (after render equality): the one top-level permissions block is exactly
+// `contents: read`, no other permissions key exists, no secrets reference, every `uses:` is commit-pinned, and every
+// checkout step sets persist-credentials: false. Steps are split on step-list indentation, not matched as free text.
+function declaredWorkflowPolicyRefusal(appName, workflow, source) {
+  const refuse = (why) => fail(`${appName} right-git managed ${workflow} violates the declared-workflow policy: ${why}`);
+  const lines = source.replace(/\r\n?/g, "\n").split("\n");
+  const permissionsAt = lines.flatMap((line, i) => (/^\s*permissions\s*:/.test(line) ? [i] : []));
+  if (permissionsAt.length !== 1 || lines[permissionsAt[0]] !== "permissions:" || lines[permissionsAt[0] + 1] !== "  contents: read" || /^ {2,}\S/.test(lines[permissionsAt[0] + 2] ?? "")) refuse("permissions must be exactly one top-level `contents: read`");
+  if (/\bsecrets\b/i.test(source)) refuse("it references the secrets context");
+  let step = null;
+  const steps = [];
+  for (const line of lines) {
+    if (/^ {6}- /.test(line)) { step = [line]; steps.push(step); }
+    else if (step && (/^ {7,}\S/.test(line) || line === "")) step.push(line);
+    else step = null;
+  }
+  for (const body of steps) {
+    const uses = /^ {6}- uses: (\S+)|^ {8}uses: (\S+)/m.exec(body.join("\n"));
+    if (!uses) continue;
+    const ref = uses[1] ?? uses[2];
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+@[0-9a-f]{40}$/.test(ref)) refuse(`action ${ref} is not commit-pinned`);
+    if (/^actions\/checkout@/.test(ref) && !body.some((line) => /^ {10}persist-credentials: false\s*$/.test(line))) refuse("a checkout step does not set persist-credentials: false");
+    if (body.some((line) => /persist-credentials:\s*true/.test(line))) refuse("persist-credentials: true");
+  }
+  if (/^\s*(?:- )?uses:/m.test(lines.filter((l) => !steps.some((b) => b.includes(l))).join("\n"))) refuse("a uses: sits outside a step list");
+}
+
 async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
@@ -1188,15 +1245,29 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     || lanes.some((lane) => !safeLanes.has(lane))) {
     fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from [${[...safeLanes].map((lane) => `"${lane}"`).join(", ")}] and including "ci" or "swift-check"`);
   }
-  const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
+  // Workflows declared under the manifest's `workflows` block (@rightkit/ci workflows.mjs: explicit `file`,
+  // else `<name>.yml`) are managed files too, in addition to the lane files.
+  const declaredWorkflows = manifest?.workflows;
+  if (declaredWorkflows !== undefined && (declaredWorkflows === null || typeof declaredWorkflows !== "object" || Array.isArray(declaredWorkflows))) {
+    fail(`${appName} right-git-ci-only policy requires .rightgit.json workflows to be an object`);
+  }
+  const declaredFiles = Object.entries(declaredWorkflows ?? {}).map(([name, config]) => {
+    if (config === null || typeof config !== "object" || Array.isArray(config)) fail(`${appName} right-git-ci-only policy requires .rightgit.json workflows.${name} to be an object`);
+    const file = typeof config?.file === "string" ? config.file : `${name}.yml`;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,60}\.yml$/.test(file)) fail(`${appName} right-git-ci-only policy refuses workflow file name ${JSON.stringify(file)} declared by .rightgit.json`);
+    return file;
+  });
+  const expectedWorkflows = [...new Set([...lanes.map((lane) => `${lane}.yml`), ...declaredFiles])].sort();
   if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
     fail(`${appName} right-git-ci-only policy requires workflows declared by .rightgit.json; expected ${expectedWorkflows.join(", ")}, got: ${workflows.join(", ")}`);
   }
+  if (declaredFiles.length > 0) await validateDeclaredWorkflowBlock(root, appName, manifest, declaredFiles);
   for (const workflow of expectedWorkflows) {
     const source = await readFile(path.join(root, ".github", "workflows", workflow), "utf8");
     if (!source.startsWith("# Managed by right-git")) {
       fail(`${appName} ${workflow} is not marked as right-git managed`);
     }
+    if (declaredFiles.includes(workflow)) declaredWorkflowPolicyRefusal(appName, workflow, source);
     const jobSpan = (jobName) => {
       const marker = `\n  ${jobName}:\n`;
       const start = source.indexOf(marker);

package/rightkit-ownership.json

@@ -671,6 +671,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-crypto",
+      "capability": "crypto-primitives",
+      "summary": "Neutral SHA-256, HMAC-SHA256, constant-time compare, base64/base64url, hex, BLAKE3 text hash, canonical JSON and HMAC approval tokens",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of hand-rolling HMAC, constant-time compare, base64 or approval tokens.",
+        "Not a general cryptography suite: no encryption, signatures or key derivation."
+      ]
+    },
     {
       "package": "rightkit-daemon",
       "capability": "local-services",
@@ -1320,6 +1331,17 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-google-identity",
+      "capability": "google-identity",
+      "summary": "Google sign-in building blocks: PKCE, redirect, token request body, ID-token claim validation and refresh-token store; Android Credential Manager seam",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of hand-rolling Google OAuth request shapes.",
+        "ID-token signatures are not verified here; callers must not grant access on claims alone."
+      ]
+    },
     {
       "package": "rightkit-hooks",
       "capability": "lifecycle-hooks",
@@ -1416,6 +1438,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-identity",
+      "capability": "installation-identity",
+      "summary": "Installation identity with clone detection and startup claim, build identity (git rev, dirty flag, profile, channel, UTC stamp), device pairing with signed transcript, owner approval and resume tickets, bearer-token device auth with per-IP rate limit",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of writing their own install ids, pairing transcripts or bearer-token checks.",
+        "Key agreement is out of scope: the caller supplies the shared secret."
+      ]
+    },
     {
       "package": "rightkit-job-queue",
       "capability": "persistent-jobs",
@@ -2946,12 +2979,12 @@
     {
       "package": "rightkit-spend",
       "capability": "spend-ledger",
-      "summary": "Spend reservation, allowance and compare-and-swap ledger on SQLite: integer micro-units, idempotent reserve on request id, in-flight and overrun handling, opaque allowance periods",
+      "summary": "Spend reservation, allowance and compare-and-swap ledger on SQLite: integer micro-units, idempotent reserve on request id, in-flight and overrun handling, opaque allowance periods, optional account key and per-reservation currency, billed-unknown commit, caller-transaction (`_in`) variants, strict transition mode",
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
         "Declaration-only: the ledger tables and reservation state machine are not an ownership fingerprint.",
-        "Price rows live in rightkit-llm; the ledger stores opaque route and price-version text and no currency."
+        "Price rows live in rightkit-llm; the ledger stores opaque route and price-version text; an allowance holds no currency and a reservation holds only the currency text the caller passes."
       ]
     },
     {
@@ -3078,6 +3111,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-time",
+      "capability": "time-civil",
+      "summary": "RFC 3339 parse and format, fixed UTC offsets, civil date math and HTTP-date formatting",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: apps call this crate instead of hand-rolling RFC 3339, civil date math or HTTP-date formatting.",
+        "No time zone database: named zones and DST rules are not owned here; callers pass a fixed offset."
+      ]
+    },
     {
       "package": "rightkit-transcript",
       "capability": "timed-transcripts",

package/rightkit-versions.json

@@ -31,7 +31,7 @@
     "@rightkit/qa": "0.4.9",
     "@rightkit/qa-chrome": "0.1.8",
     "@rightkit/react-shell": "0.6.8",
-    "@rightkit/release": "0.2.174",
+    "@rightkit/release": "0.3.0",
     "@rightkit/settings-ui": "0.5.0",
     "@rightkit/tauri": "0.2.1",
     "@rightkit/tauri-shell": "0.1.1",
@@ -211,7 +211,8 @@
       "0.2.164",
       "0.2.165",
       "0.2.172",
-      "0.2.173"
+      "0.2.173",
+      "0.2.174"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -458,7 +459,7 @@
       "rightkit-browser": "0.3.1",
       "rightkit-cache": "0.2.0",
       "rightkit-channel-memory": "0.2.1",
-      "rightkit-child-process": "0.4.1",
+      "rightkit-child-process": "0.4.3",
       "rightkit-compose": "0.1.0",
       "rightkit-contracts": "0.1.5",
       "rightkit-control": "0.3.0",
@@ -542,7 +543,7 @@
       "@rightkit/qa": "0.4.9",
       "@rightkit/qa-chrome": "0.1.8",
       "@rightkit/react-shell": "0.6.8",
-      "@rightkit/release": "0.2.173",
+      "@rightkit/release": "0.2.174",
       "@rightkit/settings-ui": "0.5.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.2.1",

package/runtime-budgets.mjs

@@ -755,16 +755,18 @@ export function appRuntimeBudgetAdoptionCheck({ appRoot, app, version, cargoLock
   const used = Object.keys(classes).filter((name) => locked.has(name));
   if (used.length === 0) return null;
   const problems = [];
+  // A crate whose ceilings or scale RightKit has not declared yet cannot be measured against anything, so it
+  // never blocks an app: it is reported as pending (warn) until the crate declares its budget.
+  const pending = used.filter((name) => !classes[name].ceilings || !classes[name].requiredScale);
+  const measurable = used.filter((name) => !pending.includes(name));
   const adoptionPath = path.join(appRoot, APP_ADOPTION_FILE);
   let records = [];
-  if (!exists(adoptionPath)) problems.push(`${APP_ADOPTION_FILE} is missing`);
+  if (!exists(adoptionPath)) { if (measurable.length) problems.push(`${APP_ADOPTION_FILE} is missing`); }
   else {
     try { records = JSON.parse(readFile(adoptionPath, "utf8")).measurements ?? []; } catch (error) { problems.push(`${APP_ADOPTION_FILE} is not valid JSON: ${error.message}`); }
   }
-  for (const crate of used) {
+  for (const crate of measurable) {
     const { ceilings, requiredScale } = classes[crate];
-    if (!ceilings) { problems.push(`${crate}: ceilings undeclared (declare them in its runtime-budget.json and regenerate ${CLASSES_FILE})`); continue; }
-    if (!requiredScale) { problems.push(`${crate}: requiredScale undeclared`); continue; }
     const mine = records.map((m, index) => ({ m, index })).filter(({ m }) => m?.crate === crate && m.scope === "installed" && locked.get(crate).has(m.crateVersion));
     if (mine.length === 0) { problems.push(`${crate} ${[...locked.get(crate)].join("/")}: no installed-scope measurement of ${app}`); continue; }
     const good = mine.filter(({ m, index }) => {
@@ -781,9 +783,14 @@ export function appRuntimeBudgetAdoptionCheck({ appRoot, app, version, cargoLock
     });
     if (good.length === 0 && !problems.some((p) => p.startsWith(`${crate}`))) problems.push(`${crate}: no qualifying measurement`);
   }
-  return problems.length
-    ? { name: RUNTIME_BUDGET_CHECK, status: "fail", detail: `${app} uses held-resource crate(s) ${used.join(", ")}: ${problems.join("; ")}`, fix: `record an installed measurement of ${app} for each crate in ${APP_ADOPTION_FILE} (docs/RUNTIME-BUDGETS.md)` }
-    : { name: RUNTIME_BUDGET_CHECK, status: "ok", detail: `${app} has installed measurements for ${used.join(", ")}` };
+  const pendingNote = pending.length ? `; pending RightKit budget declaration (not blocking): ${pending.join(", ")}` : "";
+  if (problems.length) {
+    return { name: RUNTIME_BUDGET_CHECK, status: "fail", detail: `${app} uses held-resource crate(s) ${measurable.join(", ")}: ${problems.join("; ")}${pendingNote}`, fix: `record an installed measurement of ${app} for each crate in ${APP_ADOPTION_FILE} (docs/RUNTIME-BUDGETS.md)` };
+  }
+  if (pending.length) {
+    return { name: RUNTIME_BUDGET_CHECK, status: "warn", detail: `${app} uses held-resource crate(s) whose RightKit ceilings are not declared yet: ${pending.join(", ")}${measurable.length ? `; measured: ${measurable.join(", ")}` : ""}`, fix: "RightKit declares the crate ceilings; then record installed measurements (docs/RUNTIME-BUDGETS.md)" };
+  }
+  return { name: RUNTIME_BUDGET_CHECK, status: "ok", detail: `${app} has installed measurements for ${used.join(", ")}` };
 }
 
 // ---------------------------------------------------------------- record (measurement provenance)