@rightkit/release 0.2.174 → 0.4.0

package/local-publish.mjs

@@ -1,27 +1,39 @@
 #!/usr/bin/env node
-// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac under
-// Adrian's local-build grant (2026-10-14, committed .rightkit-local-build.json). It does not weaken the
-// publication gate: it runs the unit's own CI tests (ci/gate.config.json, ci/asset-gated.json,
-// scripts/ci/gate.mjs semantics), packs the artifact, writes a schema-1 evidence file with one darwin receipt
-// (hostPolicy "darwin-only"), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
+// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac (npm and
+// crates) or from Windows (crates only) under Adrian's local-build grant (2026-10-14, committed
+// .rightkit-local-build.json). It does not weaken the publication gate: it runs the unit's own CI tests
+// (ci/gate.config.json, ci/asset-gated.json, scripts/ci/gate.mjs semantics), packs the artifact, writes a
+// schema-1 evidence file with one receipt for the publishing host (hostPolicy "darwin-only" on the Mac,
+// "win32-only" on Windows), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
 // (publishGatedTarball for npm, runCargoPublish for cargo). There is no way to skip a test or the evidence.
+//
+// Batch mode (`cargo --crates a,b,c | --crates-file f --local`): fmt, the secret scan and clippy run ONCE for
+// the batch at one commit and tree and are recorded in every crate's evidence as a `batch` receipt that the
+// publication gate validates (publication-gate.mjs batchReceiptProblems); each crate still runs its own tests,
+// all-features check, packaging, gate, publish and registry readback, and writes its own evidence file. Crates
+// of one dependency layer publish concurrently (bounded); layer N+1 starts only after every layer-N crate is
+// visible in the registry index with the verified checksum.
 import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-import { runCargoSync } from "./managed-cargo.mjs";
+import { runCargoAsync, runCargoSync, spawnCollect } from "./managed-cargo.mjs";
 import { localBuildGranted, LOCAL_BUILD_FILE } from "./execution-policy.mjs";
-import { GATE_SCHEMA, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
-import { runCargoPublish } from "./publish-cargo.mjs";
+import { GATE_SCHEMA, MAX_CARGO_JOBS, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
+import { runCargoPublish, runCargoReadOnly, scanCrateForSecrets } from "./publish-cargo.mjs";
 import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
-import { readCargoPackage } from "./crate-graph.mjs";
+import { pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
 import { recordPublished, stageSourceVersions } from "./rightkit-sync.mjs";
 import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
 export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
+export const LOCAL_WIN32_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); published from the Windows host, the macOS run is not part of this receipt";
+// The hosts `--local` accepts and the host policy each records in the evidence.
+export const LOCAL_HOST_POLICIES = Object.freeze({ darwin: "darwin-only", win32: "win32-only" });
+const localHostPolicyReason = (platform) => (platform === "win32" ? LOCAL_WIN32_HOST_POLICY_REASON : LOCAL_HOST_POLICY_REASON);
 const STEP_TIMEOUT_MS = 30 * 60 * 1000;
 
 export class LocalPublishError extends Error {
@@ -29,22 +41,121 @@ export class LocalPublishError extends Error {
 }
 const refuse = (message) => { throw new LocalPublishError(message); };
 
+export const DEFAULT_CONCURRENCY = 4;
+const MAX_CONCURRENCY = 8;
+const CRATE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const JOBS_SUBCOMMANDS = new Set(["test", "clippy", "check", "package"]);
+export function withCargoJobs(args, jobs) {
+  return jobs !== undefined && JOBS_SUBCOMMANDS.has(args[0])
+    ? [args[0], "--jobs", String(jobs), ...args.slice(1)] : args;
+}
+
+const crateList = (text, what) => {
+  const names = String(text ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+  for (const name of names) if (!CRATE_NAME.test(name)) refuse(`${what}: invalid crate name ${JSON.stringify(name)}`);
+  return names;
+};
+
+/**
+ * A crates file: one crate per line, blank lines separate dependency layers (earlier layers publish first),
+ * `#` starts a comment. Returns the layers; refuses a bad name, a repeated crate or an empty file.
+ */
+export function parseCrateLayers(text) {
+  const layers = []; let current = [];
+  const flush = () => { if (current.length) layers.push(current); current = []; };
+  for (const raw of String(text ?? "").split(/\r?\n/)) {
+    if (raw.trim().startsWith("#")) continue;
+    const line = raw.replace(/\s+#.*$/, "").trim();
+    if (!line) { flush(); continue; }
+    if (!CRATE_NAME.test(line)) refuse(`crates file: invalid crate name ${JSON.stringify(line)}`);
+    current.push(line);
+  }
+  flush();
+  const all = layers.flat();
+  const repeated = all.find((name, index) => all.indexOf(name) !== index);
+  if (repeated) refuse(`crates file names ${repeated} more than once`);
+  if (!all.length) refuse("crates file names no crate");
+  return layers;
+}
+
+/** An explicit layering must put every in-batch dependency of a crate in a STRICTLY earlier layer. */
+export function checkCrateLayers(layers, dependsOn) {
+  const layerOf = new Map();
+  layers.forEach((layer, index) => layer.forEach((name) => layerOf.set(name, index)));
+  for (const [name, index] of layerOf) {
+    for (const dependency of dependsOn(name)) {
+      if (!layerOf.has(dependency)) continue;
+      if (layerOf.get(dependency) >= index) refuse(`${name} (layer ${index + 1}) depends on ${dependency} (layer ${layerOf.get(dependency) + 1}); a dependency must be in an earlier layer`);
+    }
+  }
+  return layers;
+}
+
+/** Layers derived from the in-batch dependency edges: layer = 1 + the deepest in-batch dependency. */
+export function deriveCrateLayers(crates, dependsOn) {
+  const member = new Set(crates);
+  const level = new Map(); const visiting = new Set();
+  const visit = (name) => {
+    if (level.has(name)) return level.get(name);
+    if (visiting.has(name)) refuse(`dependency cycle among the batch crates at ${name}`);
+    visiting.add(name);
+    const depth = Math.max(-1, ...dependsOn(name).filter((dependency) => member.has(dependency) && dependency !== name).map(visit)) + 1;
+    visiting.delete(name); level.set(name, depth);
+    return depth;
+  };
+  crates.forEach(visit);
+  const layers = [];
+  for (const name of crates) (layers[level.get(name)] ??= []).push(name);
+  return layers;
+}
+
 export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   const flag = kind === "npm" ? "--package" : "--crate";
+  const batchFlags = kind === "cargo" ? ", --crates <a,b,c>, --crates-file <file>, --concurrency <n>, --allow-ignored-units <a,b>" : "";
   let unit; let workspace; let local = false; let allowIgnored = false;
+  let qualifyOnly = false; let bundle; let jobsText;
+  let crates; let cratesFile; let concurrency = DEFAULT_CONCURRENCY; let allowIgnoredUnits = [];
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--local") local = true;
     else if (arg === flag) unit = argv[++i];
     else if (arg === "--workspace") workspace = argv[++i];
+    else if (kind === "cargo" && arg === "--qualify-only") qualifyOnly = true;
+    else if (kind === "cargo" && arg === "--bundle") bundle = argv[++i];
     // Same meaning as publish.yml's allow_ignored: this unit may have ignored tests; the count is recorded.
     else if (arg === "--allow-ignored") allowIgnored = true;
-    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --allow-ignored, --local)`);
+    else if (kind === "cargo" && arg === "--crates") crates = crateList(argv[++i], "--crates");
+    else if (kind === "cargo" && arg === "--crates-file") cratesFile = argv[++i];
+    else if (kind === "cargo" && arg === "--concurrency") concurrency = Number(argv[++i]);
+    else if (kind === "cargo" && arg === "--allow-ignored-units") allowIgnoredUnits = crateList(argv[++i], "--allow-ignored-units");
+    else if (kind === "cargo" && arg === "--jobs") jobsText = argv[++i] ?? "";
+    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>${batchFlags}, --workspace <dir>, --allow-ignored, --local)`);
   }
   if (!local) refuse("--local is required");
+  if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_CONCURRENCY) refuse(`--concurrency must be an integer from 1 to ${MAX_CONCURRENCY}`);
+  const workspaceRoot = path.resolve(workspace ?? cwd);
+  if (qualifyOnly && (crates !== undefined || cratesFile !== undefined)) refuse("--qualify-only currently requires one --crate");
+  if (qualifyOnly && !String(bundle ?? "").trim()) refuse("--qualify-only requires --bundle <new-directory>");
+  if (bundle !== undefined && !qualifyOnly) refuse("--bundle requires --qualify-only");
+  const bundleDir = bundle === undefined ? undefined : path.resolve(cwd, bundle);
+  let jobs;
+  if (jobsText !== undefined) {
+    if (!/^[0-9]+$/.test(jobsText) || Number(jobsText) < 1 || Number(jobsText) > MAX_CARGO_JOBS) refuse(`--jobs must be an integer from 1 to ${MAX_CARGO_JOBS}`);
+    if (!qualifyOnly) refuse("--jobs requires --qualify-only");
+    jobs = Number(jobsText);
+  }
+  if (kind === "cargo" && (crates !== undefined || cratesFile !== undefined)) {
+    if (unit !== undefined) refuse("--crate cannot be combined with --crates or --crates-file");
+    if (crates !== undefined && cratesFile !== undefined) refuse("use --crates or --crates-file, not both");
+    if (crates !== undefined && !crates.length) refuse("--crates names no crate");
+    if (cratesFile !== undefined && !String(cratesFile ?? "").trim()) refuse("--crates-file needs a file");
+    const repeated = crates?.find((name, index) => crates.indexOf(name) !== index);
+    if (repeated) refuse(`--crates names ${repeated} more than once`);
+    return { kind, unit: undefined, allowIgnored, allowIgnoredUnits, workspaceRoot, concurrency, batch: { crates, file: cratesFile === undefined ? undefined : path.resolve(cwd, cratesFile) } };
+  }
   if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
-  if (kind === "cargo" && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(unit ?? "")) refuse("publish cargo --local requires --crate <name>");
-  return { kind, unit, allowIgnored, workspaceRoot: path.resolve(workspace ?? cwd) };
+  if (kind === "cargo" && !CRATE_NAME.test(unit ?? "")) refuse("publish cargo --local requires --crate <name> (or --crates / --crates-file)");
+  return { kind, unit, allowIgnored, allowIgnoredUnits, workspaceRoot, concurrency, batch: undefined, ...(qualifyOnly ? { qualifyOnly, bundleDir } : {}), ...(jobs === undefined ? {} : { jobs }) };
 }
 
 function defaultGit(args, cwd) {
@@ -74,6 +185,40 @@ function defaultRun(command, args, options) {
   return command === "cargo" ? runCargoSync(args, settings) : spawnSync(command, args, settings);
 }
 
+// Async twin used by batch mode so crates of one layer can overlap their uploads and index waits. The broker
+// still runs builds one at a time; `await` on a synchronous fake works the same.
+function defaultRunAsync(command, args, options) {
+  const settings = { encoding: "utf8", maxBuffer: 512 * 1024 * 1024, timeout: STEP_TIMEOUT_MS, windowsHide: true, ...options };
+  return command === "cargo" ? runCargoAsync(args, settings) : spawnCollect(command, args, settings);
+}
+
+/**
+ * `execute` for runCargoPublish in batch mode: the async Cargo runner, with the output of a step that would
+ * inherit stdio echoed line by line under the crate name (concurrent crates would otherwise interleave raw).
+ */
+export function batchCargoExecute(label, { run = runCargoAsync, out = process.stdout, err = process.stderr } = {}) {
+  return async (_command, args, settings) => {
+    const { stdio, ...rest } = settings;
+    const result = await run(args, { ...rest, timeout: STEP_TIMEOUT_MS, maxBuffer: 512 * 1024 * 1024 });
+    if (stdio === "inherit") {
+      for (const [stream, text] of [[out, result.stdout], [err, result.stderr]]) {
+        for (const line of String(text ?? "").split(/\r?\n/)) if (line) stream.write(`[${label}] ${line}\n`);
+      }
+    }
+    return result;
+  };
+}
+
+// Registry versions-file writers (recordPublished, stageSourceVersions) read-modify-write one shared JSON file
+// and its consumer copies. They are synchronous, but the lock keeps the whole write one unit even if a writer
+// becomes async, so concurrent crates of a layer can never interleave two updates.
+let versionsTail = Promise.resolve();
+const withVersionsLock = (task) => {
+  const result = versionsTail.then(task);
+  versionsTail = result.catch(() => {});
+  return result;
+};
+
 async function defaultLoadWorkspaceModules(workspaceRoot) {
   const load = (file) => import(pathToFileURL(path.join(workspaceRoot, "scripts", "ci", file)).href);
   const [results, upload] = await Promise.all([load("test-results.mjs"), load("upload.mjs")]);
@@ -92,7 +237,7 @@ export function allFeatureCheckSets(entry = {}) {
 }
 
 /** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
-export function localTestPlan({ kind, unit, dir, config, manifest }) {
+export function localTestPlan({ kind, unit, dir, config, manifest, batch = false, platform = "darwin" }) {
   if (kind === "npm") {
     if (!manifest?.scripts?.test) refuse(`${unit} has no test script; --local never publishes an untested package`);
     return {
@@ -104,33 +249,88 @@ export function localTestPlan({ kind, unit, dir, config, manifest }) {
     };
   }
   const entry = config?.rust?.[unit] ?? {};
-  if (entry.os && !entry.os.includes("macos")) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this Mac`);
+  // gate.config.json names hosts "macos" and "windows" (scripts/ci/gate.mjs HOST).
+  const gateHost = platform === "win32" ? "windows" : "macos";
+  if (entry.os && !entry.os.includes(gateHost)) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this ${platform === "win32" ? "Windows host" : "Mac"}`);
   const featureSets = entry.featureSets ?? [[]];
+  // Stream Cargo artifact records to the broker; libtest summaries remain plain text for ResultScanner.
   const steps = [];
   for (const features of featureSets) {
-    steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--show-output"], test: true });
-    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
+    steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--show-output"], test: true });
+    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
   }
-  steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
-  for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--all-targets", ...features], test: false });
+  // Batch mode lints the whole batch once (batchClippyInvocations) and records it as a batch receipt.
+  if (!batch) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
+  for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--message-format=json-render-diagnostics", "--all-targets", ...features], test: false });
   return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), steps };
 }
 
+/**
+ * The clippy invocations that replace each crate's own `cargo clippy -p <crate> --no-deps --all-targets
+ * <featureSets[0]> -- -D warnings`: same flags and lint level, so the same lints on the same code. Crates
+ * whose first feature set is empty or `--all-features` share one `-p a -p b` invocation (the flags mean the
+ * same for every crate); any other feature set runs per crate, because `--features x` must not reach a crate
+ * that lacks x. The caller passes ONE dependency layer: no selected crate depends on another, so `-p` does not
+ * unify extra features into a selected crate and each is linted with exactly the features it was before.
+ * Crates with a different RIGHTKIT_REQUIRE_ASSETS (asset-gated) stay apart so the environment is unchanged.
+ */
+export function batchClippyInvocations(layer, { featuresOf = () => [], assetGatedOf = () => false } = {}) {
+  const groups = new Map();
+  for (const unit of layer) {
+    const features = featuresOf(unit) ?? [];
+    const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
+    const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}`;
+    if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
+    groups.get(key).crates.push(unit);
+  }
+  return [...groups.values()].map(({ crates, features, assetGated }) => ({
+    crates, assetGated,
+    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
+  }));
+}
+
 const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
 const tarballName = (name, version) => `${name.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
 const tail = (text, lines = 40) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
 
+// Tests run under hosted-CI conditions: no inherited credentials (a managed host refuses a token from the
+// environment) and no sibling product checkouts (CI holds rightkit alone).
+function testEnv(deps, isAssetGated) {
+  const inherited = Object.fromEntries(Object.entries(deps.env ?? process.env).filter(([key]) => !/(TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)/i.test(key)));
+  return { ...inherited, RIGHTKIT_REQUIRE_ASSETS: isAssetGated ? "0" : "1", RIGHTKIT_ISOLATED_CHECKOUT: "1", CARGO_TERM_COLOR: "never" };
+}
+
+function assertLocalHost(deps, workspaceRoot, kind) {
+  const platform = deps.platform ?? process.platform;
+  if (!(deps.localBuildGranted ?? localBuildGranted)(workspaceRoot)) refuse(`--local needs the local-build grant: a committed ${LOCAL_BUILD_FILE} (allow "build-test-publish") naming this repository at ${workspaceRoot}`);
+  if (!Object.hasOwn(LOCAL_HOST_POLICIES, platform)) refuse(`--local publishes from the Mac only (host policy: darwin-only) or from Windows (host policy: win32-only); this host is ${platform}`);
+  // The npm path reads the registry token from the macOS Keychain and ships a Developer-ID-signed helper: Mac only.
+  if (kind === "npm" && platform !== "darwin") refuse(`publish npm --local needs the macOS Keychain npm token and runs on the Mac only; Windows publishes crates (publish cargo --local); this host is ${platform}`);
+  return platform;
+}
+
 export async function runLocalPublish(kind, argv, deps = {}) {
+  const parsed = parseLocalPublishArgs(kind, argv, deps.cwd);
+  if (parsed.batch) return runLocalPublishBatch(parsed, deps);
+  return publishUnit(parsed, deps, null);
+}
+
+/**
+ * Qualify and publish ONE unit. `batch` (cargo batch mode only) is `{ head, tree, receipt, commands }`: the
+ * batch-level fmt, secret scan and clippy already ran at `head`/`tree`, so this unit skips its own clippy and
+ * copies the receipt into its evidence; everything else (tests, all-features check, packaging, the gate, the
+ * publish and the registry readback) runs for this unit exactly as in single mode.
+ */
+async function publishUnit(parsed, deps, batch) {
   const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
-  const { unit, allowIgnored, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
-  const platform = deps.platform ?? process.platform;
+  const { kind, unit, allowIgnored, workspaceRoot } = parsed;
   const git = deps.git ?? defaultGit;
   const readJson = deps.readJson ?? defaultReadJson;
-  const run = deps.run ?? defaultRun;
+  const run = deps.run ?? (batch ? defaultRunAsync : defaultRun);
 
   // 1. Preconditions, fail closed.
-  if (!(deps.localBuildGranted ?? localBuildGranted)(workspaceRoot)) refuse(`--local needs the local-build grant: a committed ${LOCAL_BUILD_FILE} (allow "build-test-publish") naming this repository at ${workspaceRoot}`);
-  if (platform !== "darwin") refuse(`--local publishes from the Mac only (host policy: darwin-only); this host is ${platform}`);
+  const platform = assertLocalHost(deps, workspaceRoot, kind);
+  if (parsed.qualifyOnly && fs.existsSync(parsed.bundleDir)) refuse(`qualification bundle already exists: ${parsed.bundleDir}`);
   const dir = kind === "npm" ? `packages/${unit.slice("@rightkit/".length)}` : `crates/${unit}`;
   const unitPath = path.join(workspaceRoot, dir);
   if (!fs.existsSync(unitPath)) refuse(`unit directory not found: ${unitPath}`);
@@ -148,33 +348,45 @@ export async function runLocalPublish(kind, argv, deps = {}) {
   if (typeof version !== "string" || !version.trim()) refuse(`${unit} has no literal version`);
   const head = git(["rev-parse", "HEAD"], workspaceRoot);
   if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
-  const dirty = git(["status", "--porcelain", "--", dir], workspaceRoot);
+  if (batch) {
+    // The batch receipt is valid for one commit and tree only; a moved HEAD would make it describe other code.
+    if (head !== batch.head) refuse(`${unit}: HEAD moved to ${head} during the batch (batch commit ${batch.head})`);
+    const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
+    if (tree !== batch.tree) refuse(`${unit}: HEAD tree ${tree} differs from the batch tree ${batch.tree}`);
+  }
+  const dirty = git(["status", "--porcelain", "--", dir, ...(parsed.qualifyOnly ? ["Cargo.toml", "Cargo.lock"] : [])], workspaceRoot);
   if (dirty === null) refuse(`cannot read git status for ${dir}`);
   if (dirty !== "") refuse(`tree is not clean for ${dir}; commit first:\n${dirty}`);
   if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
-  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, darwin-only policy)`);
+  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
   // 2. The unit's own tests, exactly as the CI gate defines them.
   const gateConfig = readJson(path.join(workspaceRoot, "ci", "gate.config.json")) ?? {};
   const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
   const gatedSection = assetGated[kind === "npm" ? "npm" : "crates"] ?? {};
   const isAssetGated = Object.hasOwn(gatedSection, unit);
-  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest });
+  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest, batch: Boolean(batch), platform });
+  if (parsed.qualifyOnly) {
+    const violations = (deps.scanSecrets ?? scanCrateForSecrets)(unitPath);
+    if (violations.length) refuse(`qualification secret scan rejected: ${violations.join(", ")}`);
+    plan.steps.unshift({ command: "cargo", args: ["fmt", "-p", unit, "--check"], test: false });
+  }
   const modules = await (deps.loadWorkspaceModules ?? defaultLoadWorkspaceModules)(workspaceRoot);
   const { ResultScanner, TEST_COMMAND, judgeUnit } = modules.results;
-  // Run the unit's tests under hosted-CI conditions: no inherited credentials (a managed host refuses a
-  // token from the environment) and no sibling product checkouts (CI holds rightkit alone).
-  const inherited = Object.fromEntries(Object.entries(deps.env ?? process.env).filter(([key]) => !/(TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)/i.test(key)));
-  const env = { ...inherited, RIGHTKIT_REQUIRE_ASSETS: isAssetGated ? "0" : "1", RIGHTKIT_ISOLATED_CHECKOUT: "1", CARGO_TERM_COLOR: "never" };
-  const steps = [];
+  const env = testEnv(deps, isAssetGated);
+  // Ignored tests are refused unless the unit is named: --allow-ignored / --allow-ignored-units, or a
+  // written reason in ci/gate.config.json (rust.<crate>.allowIgnored). The count stays in the evidence.
+  const configReason = kind === "cargo" && typeof gateConfig?.rust?.[unit]?.allowIgnored === "string" ? gateConfig.rust[unit].allowIgnored.trim() : "";
+  const ignoredAllowed = Boolean(allowIgnored || parsed.allowIgnoredUnits?.includes(unit) || configReason);
+  const steps = parsed.qualifyOnly ? [{ command: `scanCrateForSecrets ${dir}`, ok: true }] : [];
   for (const step of plan.steps) {
     const commandText = `${step.command} ${step.args.join(" ")}`;
     log(`[right-release] ${plan.id}: ${commandText}`);
-    const result = run(step.command, step.args, { cwd: workspaceRoot, env });
+    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: workspaceRoot, env });
     const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
     if (result.error || result.status !== 0) {
       steps.push(row);
-      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\nstdout:\n${result.stdout ?? ""}\nstderr:\n${result.stderr ?? ""}`);
     }
     row.ok = true;
     if (row.isTest) {
@@ -185,7 +397,7 @@ export async function runLocalPublish(kind, argv, deps = {}) {
     }
     steps.push(row);
   }
-  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: allowIgnored ? [unit] : [], allowMissingAssets: isAssetGated ? [unit] : [] });
+  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: ignoredAllowed ? [unit] : [], allowMissingAssets: isAssetGated ? [unit] : [] });
   if (verdict.status === "fail" || steps.some((s) => s.failed > 0)) refuse(`${plan.id} not qualified: ${verdict.problems.join("; ") || "failed tests reported"}`);
   if (!(verdict.executed > 0)) refuse(`${plan.id} executed no test`);
   log(`[right-release] ${plan.id}: ${verdict.executed} passed, 0 failed, ${verdict.skipped} skipped, ${verdict.ignored} ignored${isAssetGated ? " (asset-gated: RIGHTKIT_REQUIRE_ASSETS=0, skips recorded)" : ""}`);
@@ -204,40 +416,52 @@ export async function runLocalPublish(kind, argv, deps = {}) {
     if (kind === "npm") {
       // The feed a tarball ships must list the version it ships with (#319): stage it before packing.
       const feedFile = path.join(workspaceRoot, "packages", "release", "rightkit-versions.json");
-      if (fs.existsSync(feedFile)) (deps.stageSourceVersions ?? stageSourceVersions)([{ registry: "npm", name: unit, version }], { file: feedFile, root: workspaceRoot, log });
+      if (fs.existsSync(feedFile)) await withVersionsLock(() => (deps.stageSourceVersions ?? stageSourceVersions)([{ registry: "npm", name: unit, version }], { file: feedFile, root: workspaceRoot, log }));
       const args = ["--dir", dir, "pack", "--pack-destination", scratch];
       packCommands.push(`pnpm ${args.join(" ")}`);
-      const packed = run("pnpm", args, { cwd: workspaceRoot, env });
+      const packed = await run("pnpm", args, { cwd: workspaceRoot, env });
       if (packed.error || packed.status !== 0) refuse(`pnpm pack failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
       artifactFile = path.join(scratch, tarballName(unit, version));
       if (!fs.existsSync(artifactFile)) refuse(`pnpm pack did not produce ${path.basename(artifactFile)}`);
       const checked = modules.checkNpmTarball({ file: artifactFile, name: unit, version, dir, spawn: deps.spawnSync ?? spawnSync });
       if (checked.problems.length) refuse(`${unit}: packed tarball refused:\n  - ${checked.problems.join("\n  - ")}`);
     } else {
-      packCommands.push(`cargo package --locked -p ${unit}`);
-      const packed = run("cargo", ["package", "--locked", "-p", unit], { cwd: workspaceRoot, env });
+      // A combined publish verifies once in `cargo publish`; detached qualification verifies here before
+      // its evidence leaves this host, so the publishing host can reuse that exact archive's proof.
+      const packageArgs = ["package", "--locked", ...(parsed.qualifyOnly ? [] : ["--no-verify"]), "-p", unit];
+      packCommands.push(`cargo ${packageArgs.join(" ")}`);
+      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: workspaceRoot, env });
       if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
-      packCommands.push("cargo metadata --format-version 1 --no-deps");
-      const meta = run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
+      if (parsed.qualifyOnly) steps.push({ command: `cargo ${packageArgs.join(" ")}`, ok: true });
+      const metadataArgs = ["metadata", "--offline", "--format-version", "1", "--no-deps"];
+      const meta = await runCargoReadOnly(metadataArgs, { cwd: workspaceRoot, env }, (_command, args, settings) => run("cargo", args, settings),
+        (failed) => log(`[right-release] offline Cargo metadata missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`));
+      const actualMetadataArgs = meta.usedOfflineFallback ? metadataArgs.filter((arg) => arg !== "--offline") : metadataArgs;
+      packCommands.push(`cargo ${actualMetadataArgs.join(" ")}`);
       let targetDir;
       try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
-      if (meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) refuse("cannot read the Cargo target directory");
+      if (meta.error || meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) {
+        refuse(`cannot read the Cargo target directory\n${tail(`${meta.error?.message ?? ""}\n${meta.stdout ?? ""}\n${meta.stderr ?? ""}`)}`);
+      }
       artifactFile = path.join(targetDir, "package", `${unit}-${version}.crate`);
       if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
     }
     const artifactSha256 = sha256(fs.readFileSync(artifactFile));
 
     // 4. Evidence in the normal schema, then the EXISTING gate.
-    const commands = [...plan.steps.map((s) => `${s.command} ${s.args.join(" ")}`), ...packCommands];
+    const commands = [...plan.steps.map((s) => `${s.command} ${s.args.join(" ")}`), ...packCommands, ...(batch ? batch.commands : [])];
     const timestamp = (deps.now ?? (() => new Date().toISOString()))();
     const evidence = {
       schema: GATE_SCHEMA, kind, name: unit, version, commit: head, artifactSha256,
-      hostPolicy: "darwin-only", hostPolicyReason: LOCAL_HOST_POLICY_REASON,
+      hostPolicy: LOCAL_HOST_POLICIES[platform], hostPolicyReason: localHostPolicyReason(platform),
       runs: [{
-        host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
+        host: { os: platform, arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
         command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
-        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored, allowIgnored,
+        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored, allowIgnored: ignoredAllowed,
+        ...(configReason ? { allowIgnoredReason: configReason } : {}),
         requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
+        ...(parsed.jobs === undefined ? {} : { jobs: parsed.jobs }),
+        ...(batch ? { batch: structuredClone(batch.receipt) } : {}),
         steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
       }],
     };
@@ -248,12 +472,28 @@ export async function runLocalPublish(kind, argv, deps = {}) {
     const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath };
     (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { write: (line) => log(line.replace(/\n$/, "")) });
 
+    if (parsed.qualifyOnly) {
+      // Keep bytes and their normal gate evidence together outside the checkout. Never overwrite a bundle.
+      fs.mkdirSync(parsed.bundleDir, { recursive: false });
+      const bundledArtifact = path.join(parsed.bundleDir, path.basename(artifactFile));
+      const bundledEvidence = path.join(parsed.bundleDir, "gate.json");
+      fs.copyFileSync(artifactFile, bundledArtifact, fs.constants.COPYFILE_EXCL);
+      if (sha256(fs.readFileSync(bundledArtifact)) !== artifactSha256) refuse("qualification archive changed while copying");
+      fs.copyFileSync(evidencePath, bundledEvidence, fs.constants.COPYFILE_EXCL);
+      log(`[right-release] qualified ${unit}@${version}; bundle ${parsed.bundleDir}; publish cargo --crate ${unit} --from-evidence ${bundledEvidence}`);
+      return { kind, name: unit, version, commit: head, artifactSha256, evidencePath: bundledEvidence, artifactFile: bundledArtifact, qualifiedOnly: true };
+    }
+
     // 5. The EXISTING publish path.
     if (kind === "npm") {
       (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath }, deps.publishDeps ?? {});
     } else {
-      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath }, undefined, deps.cargoDeps ?? {});
-      (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version });
+      // trustEvidenceSteps: the evidence just written (and validated by the gate above) proves this commit's tests
+      // and clippy, so the publisher does not repeat them; verifyOnPublish: Cargo's verify build runs in the
+      // publish itself. Package contents, the runtime budget, the archive hash and the readback always run.
+      const execute = deps.cargoExecute ?? (batch ? batchCargoExecute(unit) : undefined);
+      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath, trustEvidenceSteps: true, verifyOnPublish: true, offlineReadOnly: true }, execute, deps.cargoDeps ?? {});
+      await withVersionsLock(() => (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version }));
     }
     log(`[right-release] published ${unit}@${version}`);
     return { kind, name: unit, version, commit: head, artifactSha256, evidencePath };
@@ -262,6 +502,109 @@ export async function runLocalPublish(kind, argv, deps = {}) {
   }
 }
 
+/**
+ * Batch publish (cargo only): validate the whole batch and run fmt, the secret scan and clippy once at one
+ * commit and tree, failing the batch closed before anything is uploaded; then publish layer by layer, the
+ * crates of a layer concurrently (bounded by --concurrency). A failure stops new work: no crate of a later
+ * layer starts, crates of the failing layer that were already running finish, and the refusal lists what
+ * published. Re-run with the published crates removed from the list.
+ */
+async function runLocalPublishBatch(parsed, deps) {
+  const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
+  const { workspaceRoot, concurrency } = parsed;
+  const git = deps.git ?? defaultGit;
+  const readJson = deps.readJson ?? defaultReadJson;
+  const run = deps.run ?? defaultRunAsync;
+  const platform = assertLocalHost(deps, workspaceRoot, "cargo");
+
+  // 1. The crate list and its dependency layers.
+  const requested = parsed.batch.file ? parseCrateLayers((deps.readText ?? ((file) => fs.readFileSync(file, "utf8")))(parsed.batch.file)) : [parsed.batch.crates];
+  const crates = requested.flat();
+  const dependenciesOf = deps.batchDependencies ?? ((unit) => {
+    const members = new Set(crates);
+    return pathDependencyDirs(path.join(workspaceRoot, "crates", unit)).map((dir) => path.basename(dir)).filter((name) => members.has(name) && name !== unit);
+  });
+  const layers = parsed.batch.file ? checkCrateLayers(requested, dependenciesOf) : deriveCrateLayers(crates, dependenciesOf);
+
+  // 2. Preconditions for every crate before anything runs, fail closed.
+  const gateConfig = readJson(path.join(workspaceRoot, "ci", "gate.config.json")) ?? {};
+  const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
+  const isAssetGated = (unit) => Object.hasOwn(assetGated.crates ?? {}, unit);
+  const versions = new Map();
+  for (const unit of crates) {
+    const dir = `crates/${unit}`;
+    if (!fs.existsSync(path.join(workspaceRoot, dir))) refuse(`unit directory not found: ${path.join(workspaceRoot, dir)}`);
+    const pkg = (deps.readCargoPackage ?? readCargoPackage)(path.join(workspaceRoot, dir));
+    if (pkg.name !== unit) refuse(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crates entry ${unit}`);
+    if (typeof pkg.version !== "string" || !pkg.version.trim()) refuse(`${unit} has no literal version`);
+    versions.set(unit, pkg.version);
+    localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true, platform }); // refuses an OS-restricted crate now, not mid-batch
+  }
+  const head = git(["rev-parse", "HEAD"], workspaceRoot);
+  if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
+  const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
+  if (!tree || !/^[0-9a-f]{40}$/.test(tree)) refuse("cannot resolve the HEAD tree");
+  // Every batch crate and the workspace manifest and lock must match the commit the batch checks are bound to.
+  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock"], workspaceRoot);
+  if (dirty === null) refuse("cannot read git status for the batch");
+  if (dirty !== "") refuse(`tree is not clean for the batch crates or the workspace manifest; commit first:\n${dirty}`);
+  const registryHas = deps.registryHas ?? defaultRegistryHas;
+  const published = (await Promise.all(crates.map(async (unit) => ((await registryHas({ kind: "cargo", name: unit, version: versions.get(unit) })) ? `${unit}@${versions.get(unit)}` : null)))).filter(Boolean);
+  if (published.length) refuse(`already on the crates.io registry: ${published.join(", ")}; bump the version or remove them from the batch`);
+  log(`[right-release] local publish cargo batch: ${crates.length} crate(s) in ${layers.length} layer(s) at ${head.slice(0, 12)}, concurrency ${concurrency} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
+
+  // 3. Batch-level checks, once, at the batch commit. Each is recorded in every crate's evidence.
+  const env = testEnv(deps, false);
+  const stamp = { commit: head, tree };
+  const checks = []; const commands = [];
+  const batchCheck = async (name, command, args, crateNames, runEnv = env) => {
+    const text = `${command} ${args.join(" ")}`;
+    log(`[right-release] batch ${name}: ${text}`);
+    const result = await run(command, args, { cwd: workspaceRoot, env: runEnv });
+    if (result.error || result.status !== 0) refuse(`batch ${name} failed (${result.error?.message ?? `exit ${result.status}`}): ${text}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    checks.push({ name, command: text, ok: true, ...stamp, ...(crateNames ? { crates: crateNames } : {}) });
+    commands.push(text);
+  };
+  await batchCheck("fmt", "cargo", ["fmt", "--all", "--check"]);
+  log("[right-release] batch secret-scan: crate directories of the batch");
+  const scan = deps.scanSecrets ?? scanCrateForSecrets;
+  const violations = crates.flatMap((unit) => scan(path.join(workspaceRoot, "crates", unit)).map((file) => `${unit}: ${file}`));
+  if (violations.length) refuse(`batch secret scan rejected: ${violations.join(", ")}`);
+  const scanText = `scanCrateForSecrets ${crates.map((unit) => `crates/${unit}`).join(" ")}`;
+  checks.push({ name: "secret-scan", command: scanText, ok: true, ...stamp, crates });
+  commands.push(scanText);
+  const featuresOf = (unit) => (gateConfig?.rust?.[unit]?.featureSets ?? [[]])[0];
+  for (const layer of layers) {
+    for (const invocation of batchClippyInvocations(layer, { featuresOf, assetGatedOf: isAssetGated })) {
+      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated));
+    }
+  }
+  const receipt = { id: `batch-${head.slice(0, 12)}-${sha256(JSON.stringify(layers)).slice(0, 8)}`, ...stamp, crates, checks };
+
+  // 4. Publish layer by layer. A crate's publish returns only after its registry readback proved the exact
+  // checksum visible in the index, so layer N+1 starts only once every layer-N dependency is visible.
+  const batch = { head, tree, receipt, commands };
+  const results = [];
+  for (const [index, layer] of layers.entries()) {
+    log(`[right-release] batch layer ${index + 1}/${layers.length}: ${layer.join(", ")}`);
+    const queue = [...layer]; const failures = [];
+    const worker = async () => {
+      while (!failures.length && queue.length) {
+        const unit = queue.shift();
+        try { results.push(await publishUnit({ ...parsed, kind: "cargo", unit, batch: undefined }, deps, batch)); }
+        catch (error) { failures.push({ unit, message: error.message }); }
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, layer.length) }, worker));
+    if (failures.length) {
+      const done = results.map((r) => `${r.name}@${r.version}`);
+      refuse(`batch stopped in layer ${index + 1}/${layers.length}; published so far: ${done.join(", ") || "none"}\n${failures.map((f) => `- ${f.unit}: ${f.message}`).join("\n")}`);
+    }
+  }
+  log(`[right-release] batch published ${results.length} crate(s): ${results.map((r) => `${r.name}@${r.version}`).join(", ")}`);
+  return { kind: "cargo", batch: true, commit: head, tree, results };
+}
+
 const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
 if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const [kind, ...rest] = process.argv.slice(2);