@rightkit/release 0.2.174 → 0.4.0

package/npm-license-notices.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+// `right-release license-notices npm [--config <file>] [--output <file>] [--product-name <name>] [--check]`: writes the
+// third-party npm license appendix (one HTML file) for an app's production dependency closure, from
+// `pnpm licenses list --prod --json`, the installed packages' own LICENSE / COPYING / NOTICE files, and the lockfile hash.
+//
+//   legal: { npmNotices: { output: "legal/THIRD_PARTY_NPM_LICENSES.html", productName: "ViewRight", exclude: ["@rightkit/"] } }
+//
+// `output` and `productName` may also come from `--output` / `--product-name`. `exclude` is a list of package-name prefixes left
+// out (default `["@rightkit/"]`). A package that ships no license file gets the standard published text for its declared SPDX
+// license (MIT or ISC), labelled as a fallback; any other license without a file is an error, never invented text.
+// The page records the app version, the sha256 of `pnpm-lock.yaml` and `generated-by=right-release license-notices npm`, so the
+// same inputs always produce the same bytes. `--check` writes nothing and exits 1 when the file on disk differs.
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+
+const fail = (message) => { throw new CommandSpecError(message); };
+
+// Generic published SPDX text, used ONLY when an installed package ships no license file of its own.
+export const SPDX_FALLBACK_TEXT = {
+  MIT: `Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.`,
+  ISC: `Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.`,
+};
+
+export const escapeHtml = (value) => String(value)
+  .replaceAll("&", "&amp;")
+  .replaceAll("<", "&lt;")
+  .replaceAll(">", "&gt;")
+  .replaceAll('"', "&quot;");
+
+/** Flatten `pnpm licenses list --json` (license -> entries) into a sorted list, minus excluded name prefixes. */
+export function collectNpmPackages(groups, exclude = ["@rightkit/"]) {
+  return Object.entries(groups)
+    .flatMap(([license, entries]) => entries.map((entry) => ({ ...entry, license })))
+    .filter((entry) => !exclude.some((prefix) => entry.name.startsWith(prefix)))
+    .sort((a, b) => `${a.name}@${a.versions.join(",")}`.localeCompare(`${b.name}@${b.versions.join(",")}`));
+}
+
+/**
+ * Render the appendix. `readNames(dir)` lists a package directory and `readText(file)` reads one file (both injectable).
+ * Returns `{ html, packageCount, fallbackCount }`.
+ */
+export function renderNpmNotices({ productName, version, lockHash, packages, readNames = (dir) => readdirSync(dir), readText = (file) => readFileSync(file, "utf8") }) {
+  let fallbackCount = 0;
+  const sections = packages.map((entry) => {
+    const packageRoot = entry.paths[0];
+    const files = readNames(packageRoot).filter((name) => /^(?:license|copying|notice)(?:[._-]|$)/i.test(name)).sort();
+    let texts;
+    if (files.length) {
+      texts = files.map((name) => `<h3>${escapeHtml(name)}</h3><pre>${escapeHtml(readText(path.join(packageRoot, name)))}</pre>`).join("\n");
+    } else {
+      const fallback = SPDX_FALLBACK_TEXT[entry.license];
+      if (!fallback) {
+        fail(`${entry.name} ${entry.versions.join(", ")} has no packaged license/notice file and no SPDX fallback text for declared license "${entry.license}"; bundle the file or extend SPDX_FALLBACK_TEXT`);
+      }
+      fallbackCount += 1;
+      texts = `<h3>No packaged license file found</h3><p><em>This package's installed npm distribution does not include a LICENSE/COPYING/NOTICE file. The text below is the standard published license text for its declared SPDX license (${escapeHtml(entry.license)}), not package-specific content.</em></p><pre>${escapeHtml(fallback)}</pre>`;
+    }
+    return `<section><h2>${escapeHtml(entry.name)} ${escapeHtml(entry.versions.join(", "))}</h2><p>Declared license: ${escapeHtml(entry.license)}</p>${texts}</section>`;
+  });
+  const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>${escapeHtml(productName)} npm third-party licenses</title></head><body>
+<h1>${escapeHtml(productName)} npm third-party licenses</h1>
+<p>Build provenance: ${escapeHtml(productName)} ${escapeHtml(version)}; inputs: pnpm-lock.yaml sha256=${lockHash}; generated-by=right-release license-notices npm</p>
+${sections.join("\n")}
+</body></html>\n`;
+  return { html, packageCount: packages.length, fallbackCount };
+}
+
+/** Resolve options from config + flags. */
+export function resolveNoticeOptions(config, flags = {}) {
+  const declared = config?.legal?.npmNotices ?? {};
+  if (typeof declared !== "object" || declared === null || Array.isArray(declared)) fail("legal.npmNotices must be an object");
+  const unknown = Object.keys(declared).filter((key) => !["output", "productName", "exclude"].includes(key));
+  if (unknown.length) fail(`legal.npmNotices has unknown key(s): ${unknown.join(", ")} (allowed: output, productName, exclude)`);
+  const output = flags.output ?? declared.output;
+  const productName = flags.productName ?? declared.productName;
+  const exclude = declared.exclude ?? ["@rightkit/"];
+  if (output === undefined) fail("no output file: set legal.npmNotices.output or pass --output");
+  relativeInside(output, "legal.npmNotices.output");
+  if (typeof productName !== "string" || !productName.trim()) fail("no product name: set legal.npmNotices.productName or pass --product-name");
+  if (!Array.isArray(exclude) || exclude.some((prefix) => typeof prefix !== "string")) fail("legal.npmNotices.exclude must be a list of name prefixes");
+  if ((config?.packageManager ?? "pnpm") !== "pnpm") fail(`license-notices npm supports pnpm apps only (config.packageManager is ${config.packageManager})`);
+  return { output, productName, exclude };
+}
+
+/** Generate (or check) the appendix for the app at `appRoot`. `spawnSyncFn` is injectable. */
+export function generateNpmNotices({ appRoot, config, flags = {}, check = false, spawnSyncFn = spawnSync }) {
+  const { output, productName, exclude } = resolveNoticeOptions(config, flags);
+  const version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
+  const result = spawnSyncFn("pnpm", ["licenses", "list", "--prod", "--json"], {
+    cwd: appRoot,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+    shell: process.platform === "win32",
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) fail(result.stderr || "pnpm licenses list failed");
+  const packages = collectNpmPackages(JSON.parse(result.stdout), exclude);
+  const lockHash = createHash("sha256").update(readFileSync(path.join(appRoot, "pnpm-lock.yaml"))).digest("hex");
+  const { html, packageCount, fallbackCount } = renderNpmNotices({ productName, version, lockHash, packages });
+  const target = path.join(appRoot, output);
+  if (check) {
+    const current = existsSync(target) ? readFileSync(target, "utf8") : null;
+    return { target, packageCount, fallbackCount, upToDate: current === html };
+  }
+  mkdirSync(path.dirname(target), { recursive: true });
+  writeFileSync(target, html);
+  return { target, packageCount, fallbackCount, upToDate: true };
+}
+
+export function parseNoticeArgs(argv) {
+  const opts = { config: "right-release.config.mjs", output: undefined, productName: undefined, check: false };
+  const rest = argv[0] === "npm" ? argv.slice(1) : argv;
+  if (argv[0] !== "npm") throw new Error("expected: license-notices npm");
+  for (let i = 0; i < rest.length; i += 1) {
+    const arg = rest[i];
+    if (arg === "--config" || arg === "--output" || arg === "--product-name") {
+      const value = rest[i + 1];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} needs a value`);
+      opts[arg === "--product-name" ? "productName" : arg.slice(2)] = value;
+      i += 1;
+    } else if (arg === "--check") opts.check = true;
+    else throw new Error(`unknown license-notices argument: ${arg}`);
+  }
+  return opts;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const opts = parseNoticeArgs(argv);
+  const { config, appRoot } = await loadAppConfig(opts.config);
+  const outcome = generateNpmNotices({ appRoot, config, flags: { output: opts.output, productName: opts.productName }, check: opts.check });
+  if (opts.check) {
+    if (!outcome.upToDate) {
+      console.error(`right-release license-notices: ${outcome.target} is out of date; run right-release license-notices npm`);
+      return 1;
+    }
+    console.log(`${outcome.target} is up to date (${outcome.packageCount} package notices)`);
+    return 0;
+  }
+  console.log(`wrote ${outcome.packageCount} package notices (${outcome.fallbackCount} used an SPDX fallback text)`);
+  return 0;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().then((code) => { process.exitCode = code; }, (error) => {
+    console.error(`right-release license-notices: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/ownership-command.mjs

@@ -6,6 +6,7 @@
 //   right-release ownership [--app <dir>] --audit-json   (Legion governance.capability-ownership provider)
 //   right-release ownership trust-compare [--json]   (print this host's protected-trust digest; policy-bundle drift is a warning, never a block)
 //   right-release ownership trust-sync               (retired: prints why and exits 0)
+//   right-release ownership trust-refresh [--dry-run] [--app <dir>]   (elevated, key-neutral: merge new repository registrations and floors from the installed release into protected trust)
 //   right-release ownership --write-manifest [--rightkit <rightkit>] [--approve-new-capabilities]
 // --approve-new-capabilities permits new ids during local generation only.
 // Existing owner changes are always refused; installation needs protected authorization.
@@ -75,7 +76,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   if (args[0] === "trust-compare") return trustCompare(args, { print, trustLoader });
   if (args.includes("--staged")) return stagedMain(args, { print });
   if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
-  if (["enroll", "approve-key", "revoke-key"].includes(args[0])) {
+  if (["enroll", "approve-key", "revoke-key", "trust-refresh"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
     return keyMain(args, { runner: gitRunner, print });
   }

package/ownership-dependency-allowlist.json

@@ -791,6 +791,7 @@
       "repositoryIdentity": "https://github.com/bogusyogi/postright",
       "dependencies": [
         "cargo:jiff",
+        "cargo:serde",
         "cargo:serde_json",
         "cargo:tauri",
         "cargo:tauri-build",
@@ -1035,7 +1036,7 @@
       ]
     },
     {
-      "repositoryIdentity": "https://github.com/orthic-labs/pulse",
+      "repositoryIdentity": "https://github.com/bogusyogi/pulse",
       "dependencies": [
         "cargo:chrono",
         "cargo:dirs",

package/ownership-evidence.mjs

@@ -23,6 +23,7 @@ function rootContains(root, candidate) {
 
 function createEvidence(repoRoot, {
   scanRoot = repoRoot,
+  scope: requestedScope = null,
   manifestPath = path.join(path.dirname(fileURLToPath(import.meta.url)), MANIFEST_FILE),
   scan = checkApp,
   trustLoader = loadTrustedExternal,
@@ -33,6 +34,7 @@ function createEvidence(repoRoot, {
   policyBundleProvider = runningPolicyBundle,
 } = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
   const root = path.resolve(repoRoot);
+  const scope = requestedScope ? [...new Set(requestedScope)].sort() : null;
   const manifestBytes = readFileSync(manifestPath);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
   let trustState = trustLoader();
@@ -114,21 +116,27 @@ function createEvidence(repoRoot, {
     }
   }
   const registration = registrationCheck?.registration ?? null;
-  const requestedRootRegistered = registration?.roots.some((registered) => rootContains(registered, requestedRoot)) ?? false;
-  if (registration && !requestedRootRegistered) {
-    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${requestedRoot}`);
-    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${requestedRoot}`);
+  if (scope && !useCommittedSource) throw new Error("a scoped ownership scan requires the committed-source scan; this host's trust enrollment cannot provide it");
+  // A scoped scan covers its scope roots; the unscoped scan covers the requested root.
+  const coverageTargets = scope ?? [requestedRoot];
+  const unregisteredTargets = registration ? coverageTargets.filter((target) => !registration.roots.some((registered) => rootContains(registered, target))) : [];
+  const requestedRootRegistered = unregisteredTargets.length === 0;
+  for (const target of unregisteredTargets) {
+    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${target}`);
+    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${target}`);
   }
 
   // The release app's manifest/config can be nested, but the external registry
   // defines repository coverage. Scan every protected root so a nested release
   // cannot omit sibling packages or engine source by narrowing scanRoot.
-  const scanRoots = registration?.roots ? [...registration.roots] : [];
-  if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
-  const scans = (scanRoots.length ? scanRoots : [requestedRoot]).map((registered) => {
+  const overlapsScope = (registered) => !scope || scope.some((target) => rootContains(registered, target) || rootContains(target, registered));
+  const scanRoots = registration?.roots ? registration.roots.filter(overlapsScope) : [];
+  if (scope) { for (const target of unregisteredTargets) if (!scanRoots.includes(target)) scanRoots.push(target); }
+  else if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
+  const scans = (scanRoots.length ? scanRoots : [scope ? "." : requestedRoot]).map((registered) => {
     const absolute = registered === "." ? root : path.resolve(root, ...registered.split("/"));
     const scanned = useCommittedSource
-      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source })
+      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source, ...(scope ? { scope } : {}) })
       : scan(absolute, manifest, { trust: { trust: trustState.trust, enrolled: trustState.enrolled, pending: enrollmentPending }, scannerVersion, catalogVersion, ...(enrollmentPending ? { enrollmentPendingAdvisory: true } : {}) });
     if (repositoryIdentity && canonicalRepositoryIdentity(scanned.metadata?.repositoryIdentity) !== repositoryIdentity) throw new Error(`ownership evidence: scanner observed a different repository identity under ${registered}`);
     if (useCommittedSource && scanned.metadata?.commit !== commit) throw new Error(`ownership evidence: scanner observed a different source commit under ${registered}`);
@@ -181,6 +189,7 @@ function createEvidence(repoRoot, {
     floorOk: floor.ok,
     visibility: registration?.visibility ?? null,
     registrationDigest: registration ? sha256(registration) : null,
+    ...(scope ? { ownershipScope: scope, ownershipScopeClosed: [...new Set(scans.flatMap(({ scanned }) => scanned.metadata?.ownershipScopeClosed ?? scope))].sort() } : {}),
     registeredRoots: registration ? [...registration.roots] : [],
     contentDigest: enrollmentPending ? null : contentDigest,
     checkedAt: new Date().toISOString(),
@@ -190,13 +199,13 @@ function createEvidence(repoRoot, {
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */
-export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
-  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
+export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
 }
 
 /** Alias spelling makes the immutable-source contract explicit at adapter boundaries. */
-export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
-  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true });
+export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true });
 }
 
 // Injection seam is deliberately named for tests and is not used by release commands.
@@ -219,21 +228,24 @@ export function runProtectedLocalOwnershipCheck(repoRoot, scanRoot = repoRoot) {
 }
 
 /** Re-scan exact source and compare every sealed binding before release upload. */
-export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot) {
-  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot));
+export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null) {
+  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope), scope);
 }
 
 export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
-  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options));
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options), options.scope ?? null);
 }
 
-function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent) {
+function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent, scope = null) {
   if (!expected || expected.schema !== 1) return { ok: false, reason: "sealed ownership evidence is missing or malformed" };
+  // The sealed scope must equal what the current config yields; the re-scan below uses that same scope.
+  const wanted = scope ? [...new Set(scope)].sort() : null;
+  if (JSON.stringify(expected.ownershipScope ?? null) !== JSON.stringify(wanted)) return { ok: false, reason: "ownership evidence ownershipScope changed after build" };
   let current;
   try { current = createCurrent(); }
   catch (error) { return { ok: false, reason: error.message }; }
-  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest"]) {
-    const unchanged = key === "registeredRoots" || key === "keyCheckpoint" || key === "keyAuthority"
+  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest", "ownershipScopeClosed"]) {
+    const unchanged = key === "registeredRoots" || key === "ownershipScopeClosed" || key === "keyCheckpoint" || key === "keyAuthority"
       ? JSON.stringify(expected[key]) === JSON.stringify(current.evidence[key])
       : expected[key] === current.evidence[key];
     if (!unchanged) return { ok: false, reason: `ownership evidence ${key} changed after build` };

package/ownership-key-command.mjs

@@ -8,6 +8,8 @@ import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "
 import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, TRUST_SYNC_RETIRED, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { buildMacInvocation, hasTerminal } from "./ownership-key-elevation.mjs";
+import { mergeRepositoriesFromInstalledRelease, prepareTrustUpdate, REPOSITORY_REGISTRY_MALFORMED_CODE } from "./ownership-key-trust.mjs";
+import { summarizeTrustChange } from "./ownership-trust-summary.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const LOG = ".rightkit/ownership-keys.json";
@@ -355,14 +357,24 @@ export async function main(args, deps = {}) {
   if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
   try {
     if (!platform) throw new Error(`ownership key management unsupported platform: ${process.platform}`);
+    const refresh = args[0] === "trust-refresh";
     // Delegate BEFORE taking the command lock: the desktop-session child needs that same lock.
-    const helper = deps.helper ?? helperFor(run);
+    // trust-refresh signs nothing, so it never touches the native key helper.
+    const helper = deps.helper ?? (refresh ? null : helperFor(run));
     const lockPath = deps.lockPath ?? path.join(os.tmpdir(), "rightkit-key-command.lock");
     let lockFd;
     lockFd = acquireCommandLock(lockPath);
     try {
       commandTemp = mkdtempSync(path.join(os.tmpdir(), "rightkit-key-command-"));
       const authority = resolveAuthority(root, run, deps.authority);
+      if (refresh) {
+        // Key-neutral: no key log event, no metadata commit, so no minimize hook. A dry run changes nothing at all,
+        // so it also skips the fetch and fast-forward that the real ceremony performs.
+        const dryRun = args.includes("--dry-run");
+        const transport = dryRun ? null : syncBeforeCeremony(root, run);
+        const headSnapshot = dryRun ? null : git(run, root, ["rev-parse", "HEAD"]);
+        return await trustRefresh(args, { ...deps, run, print, root, authority, transport, headSnapshot });
+      }
       const hook = detectMinimizeHook(root, run, deps);
       const transport = syncBeforeCeremony(root, run);
       const headSnapshot = git(run, root, ["rev-parse", "HEAD"]);
@@ -370,7 +382,7 @@ export async function main(args, deps = {}) {
       if (verb === "enroll") return await enroll(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "approve-key") return await approve(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "revoke-key") return await revoke(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
-      throw new Error("expected enroll, approve-key, or revoke-key (trust-sync is retired)");
+      throw new Error("expected enroll, approve-key, revoke-key, or trust-refresh (trust-sync is retired)");
     } finally {
       closeSync(lockFd);
       rmSync(lockPath, { force: true });
@@ -571,6 +583,61 @@ async function revoke(args, d) {
   print(`Ownership key revoked: ${keyId}; active keys: ${verifyKeyLog(next, { rootFingerprint: pin }).keys.length}`);
   return 0;
 }
+const repositoryNames = (list) => list.map((identity) => String(identity).replace(/^https:\/\/github\.com\//i, "")).join(", ");
+
+/**
+ * Key-neutral elevated trust update. Builds the same request an approve-key checkpoint update sends (current committed
+ * key log, the host's pinned root fingerprint, the protected authority) so performProtectedTrustUpdate runs its
+ * additions-only registration merge and floor raise from the INSTALLED release. It adds no key event, writes nothing
+ * under .rightkit/ and creates no commit. Elevation, the pinned request digest and the installed-sibling-script rule
+ * are the unchanged elevate() path.
+ */
+async function trustRefresh(args, d) {
+  const { print, root } = d;
+  const dryRun = args.includes("--dry-run");
+  const rest = args.slice(1);
+  const unexpected = rest.filter((arg, i) => !(arg === "--dry-run" || arg === "--app" || rest[i - 1] === "--app"));
+  if (unexpected.length) throw new Error(`trust-refresh accepts only --dry-run and --app <dir>; unexpected: ${unexpected.join(" ")}`);
+  assertSafeMetadataParents(root, LOG);
+  const hostTrust = (d.trustLoader ?? trustState)();
+  const existing = hostTrust?.trust;
+  if (!existing?.rootFingerprint) throw new Error("this host is not enrolled: protected ownership trust has no pinned root. trust-refresh never creates trust; run `right-release ownership enroll` first");
+  const log = readLog(root);
+  if (!log.events.length) throw new Error("no root key log exists in this checkout");
+  // Verifies the local log against the pinned root, the protected authority, and (unless injected) the committed HEAD blob.
+  currentLogTrust(root, log, hostTrust, d.authority, Boolean(d.resolveTrust));
+  const pin = existing.rootFingerprint;
+  const requestBytes = Buffer.from(json({ schema: 1, log, rootFingerprint: pin, baseline: null, authority: d.authority }));
+  const registry = d.installedRegistry ? { registry: d.installedRegistry } : {};
+  const merge = mergeRepositoriesFromInstalledRelease(prepareTrustUpdate(existing, JSON.parse(requestBytes.toString("utf8"))), registry);
+  const unusable = merge.warnings.find((item) => item.code === REPOSITORY_REGISTRY_MALFORMED_CODE);
+  if (unusable) throw new Error(`the installed release's repository registry is missing or malformed (${unusable.message}); refusing to refresh trust from it`);
+  const summary = summarizeTrustChange({ existing, requestBytes, ...registry });
+  const before = new Set((existing.repositories ?? []).map((entry) => entry.repositoryIdentity));
+  const added = merge.trust.repositories.map((entry) => entry.repositoryIdentity).filter((identity) => !before.has(identity));
+  print(added.length
+    ? `trust-refresh would add ${added.length} repositor${added.length === 1 ? "y" : "ies"} to protected trust: ${repositoryNames(added)}`
+    : "trust-refresh would add no repository registrations");
+  for (const line of summary.lines) print(`  ${line}`);
+  if (!summary.changed) { print("Protected ownership trust is already current; nothing to elevate."); return 0; }
+  if (dryRun) { print("Dry run: nothing was elevated or written."); return 0; }
+  if (git(d.run, root, ["rev-parse", "HEAD"]) !== d.headSnapshot) throw new Error("repository HEAD changed during ownership ceremony");
+  const request = makeTrustRequest(log, pin, null, d.authority);
+  try {
+    if (request.digest !== summary.payloadDigest) throw new Error("trust request bytes differ from the summarized request; refusing to elevate");
+    try { await (d.elevate ?? elevate)(d.run, request.file, request.digest); }
+    catch (error) {
+      if (platform === "macos" && !hasTerminal()) error.message += ". macOS elevation needs a human: run `right-release ownership trust-refresh` at a terminal for the sudo prompt, or approve the administrator dialog on the desktop; an unattended agent session without a tty cannot pass it";
+      throw error;
+    }
+  } finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
+  postVerify(root, log, d);
+  const present = ((d.trustLoader ?? trustState)().trust?.repositories ?? []).map((entry) => entry.repositoryIdentity);
+  const missing = added.filter((identity) => !present.includes(identity));
+  if (missing.length) throw new Error(`elevated update finished but protected trust still lacks: ${repositoryNames(missing)}`);
+  print(`Protected trust now registers ${present.length} repositories: ${repositoryNames(present)}`);
+  return 0;
+}
 async function signWithHelper(run, helper, log, operation, subject, signer) {
   const draft = createKeyEvent(log, { operation, subject, signerKeyId: signer.keyId });
   const input = temp("draft"), output = temp("draft-signed");

package/ownership-mandatory-set.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // right-release ownership-mandatory: Table 1 mandatory-owner-set check (plan task 5.1).
 //
+// This evaluates declarations only; it does not establish active target/features, lock resolution or production adoption.
 // A registered app must declare every Table 1 owner (rows M1-M23) at or above the required version,
 // from the registry. Report mode (default) prints per-app findings and exits 0; --enforce exits 1
 // on any missing owner, below-required version, or path/git/patch override ("not-on-registry").
@@ -25,14 +26,51 @@ const SKIP_DIRS = new Set(["node_modules", "target", ".git", "rk-snapshot", "ven
 const MAX_MANIFESTS = 2000;
 
 // ---- versions -------------------------------------------------------------------------------
-/** Lower bound of the first comparator in a Cargo/npm requirement, or null when none can be proven. */
+/**
+ * Proven minimum of a Cargo/npm requirement: a version every satisfying version is guaranteed >=, or null when
+ * none can be proven (upper-only `<9`, `*`, `latest`, malformed, or a `||` branch with no proven minimum).
+ * Space/comma comparators AND (proven minimum = max of lower contributions; `<`/`<=` contribute none); `||`
+ * branches union (proven minimum = min of branch minima, null if any branch is unprovable). Hyphen ranges
+ * contribute their lower end. `>`, `>=`, `=`, `^`, `~`, bare & wildcard partials contribute their version
+ * (missing/`x`/`*` components read as 0), so `>1.2.3` proves 1.2.3 (sound, never above the true floor).
+ */
 export function lowerBound(spec) {
   if (typeof spec !== "string") return null;
-  let s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "");
-  const m = /(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?/.exec(s);
-  if (!m || /^(\*|latest|x|)$/i.test(s)) return null;
-  const n = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
-  return { major: Number(m[1]), minor: n(m[2]), patch: n(m[3]), pre: m[4] ?? null };
+  const s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "").trim();
+  if (!s || /^(\*|latest|x)$/i.test(s)) return null;
+  const part = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
+  const versionOf = (text) => {
+    const m = /^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(text);
+    if (m?.[4] && m[4].split(".").some((id) => !id || (/^\d+$/.test(id) && id.length > 1 && id.startsWith("0")))) return null;
+    return m ? { major: Number(m[1]), minor: part(m[2]), patch: part(m[3]), pre: m[4] ?? null } : null;
+  };
+  const branchBound = (branch) => {
+    const raw = branch.split(/[\s,]+/).filter(Boolean);
+    const tokens = [];
+    for (let i = 0; i < raw.length; i += 1) {
+      if (/^(>=|<=|>|<|=|\^|~)$/.test(raw[i]) && i + 1 < raw.length) { tokens.push(raw[i] + raw[i + 1]); i += 1; }
+      else tokens.push(raw[i]);
+    }
+    if (!tokens.length) return null;
+    const lowers = [];
+    let skipUpperEnd = false;
+    for (const token of tokens) {
+      if (token === "-") { skipUpperEnd = true; continue; }
+      if (skipUpperEnd) { skipUpperEnd = false; continue; }
+      if (/^(\*|x|latest)$/i.test(token)) continue;
+      const m = /^(>=|<=|>|<|=|\^|~)?(.+)$/.exec(token);
+      const version = m && versionOf(m[2]);
+      if (!version) return null;
+      if (m[1] === "<" || m[1] === "<=") continue;
+      lowers.push(version);
+    }
+    return lowers.length ? lowers.reduce((best, v) => (compareVersions(v, best) > 0 ? v : best)) : null;
+  };
+  const branches = s.split("||").map((b) => b.trim());
+  if (branches.some((b) => !b)) return null;
+  const bounds = branches.map(branchBound);
+  if (bounds.some((b) => b === null)) return null;
+  return bounds.reduce((best, v) => (compareVersions(v, best) < 0 ? v : best));
 }
 export const parseVersion = lowerBound;
 export function compareVersions(a, b) {
@@ -40,7 +78,19 @@ export function compareVersions(a, b) {
   if (a.pre === b.pre) return 0;
   if (a.pre === null) return 1;
   if (b.pre === null) return -1;
-  return a.pre < b.pre ? -1 : 1;
+  const left = a.pre.split("."), right = b.pre.split(".");
+  for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+    if (left[i] === undefined) return -1;
+    if (right[i] === undefined) return 1;
+    if (left[i] === right[i]) continue;
+    const an = /^\d+$/.test(left[i]), bn = /^\d+$/.test(right[i]);
+    if (an && bn) {
+      const av = BigInt(left[i]), bv = BigInt(right[i]);
+      if (av !== bv) return av < bv ? -1 : 1;
+    } else if (an !== bn) return an ? -1 : 1;
+    else return left[i] < right[i] ? -1 : 1;
+  }
+  return 0;
 }
 const show = (v) => `${v.major}.${v.minor}.${v.patch}${v.pre ? `-${v.pre}` : ""}`;
 
@@ -75,21 +125,21 @@ export function readManifest(file, root) {
     try { doc = parseToml(text); } catch (error) { return { rel, facts, error: `unparseable Cargo.toml: ${error.message}` }; }
     workspaceDeps = doc.workspace?.dependencies;
     const wsTable = workspaceDeps ?? {};
-    const sections = (table, dev) => {
+    const sections = (table, dev, target = null) => {
       for (const [section, isDev] of [["dependencies", dev], ["build-dependencies", dev], ["dev-dependencies", true]]) {
-        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev);
+        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev, target);
       }
     };
-    const add = (key, raw, dev) => {
+    const add = (key, raw, dev, target) => {
       let value = raw;
       if (value && typeof value === "object" && value.workspace === true && wsTable[key] !== undefined) value = { ...(typeof wsTable[key] === "object" ? wsTable[key] : { version: wsTable[key] }), ...value };
       const name = typeof value === "object" && typeof value.package === "string" ? value.package : key;
       const spec = typeof value === "string" ? value : value?.version;
       const unresolved = raw && typeof raw === "object" && raw.workspace === true && wsTable[key] === undefined;
-      facts.push({ owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
+      facts.push({ target, optional: Boolean(value?.optional), owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
     };
     sections(doc, false);
-    for (const target of Object.values(doc.target ?? {})) sections(target, false);
+    for (const [target, table] of Object.entries(doc.target ?? {})) sections(table, false, target);
     for (const [key, raw] of Object.entries(wsTable)) {
       // workspace.dependencies only counts through members that opt in (above); record path/git overrides here.
       if (isNonRegistry(raw)) facts.push({ owner: typeof raw.package === "string" ? raw.package : key, ecosystem: "cargo", kind: "override", dev: false, spec: raw.version ?? null, via: "workspace.dependencies path/git", file: rel, declarationOnly: true });
@@ -107,7 +157,7 @@ export function readManifest(file, root) {
         const alias = typeof spec === "string" ? /^npm:((?:@[^@/]+\/)?[^@]+)@/.exec(spec) : null;
         const owner = alias ? alias[1] : name;
         const local = typeof spec === "string" && /^(workspace:|file:|link:|portal:|git\+|git:|github:|https?:)/.test(spec);
-        facts.push({ owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
+        facts.push({ declarationSection: section, optional: section === "optionalDependencies", peer: section === "peerDependencies", owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
       }
     }
     for (const table of [doc.pnpm?.overrides, doc.overrides, doc.resolutions]) {
@@ -164,7 +214,7 @@ function judge(req, facts) {
   const counted = mine.filter((f) => f.kind === "registry" && (req.allowDev || !f.dev));
   const devOnly = !counted.length && mine.some((f) => f.kind === "registry" && f.dev);
   const min = lowerBound(req.min);
-  const base = { owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
+  const base = { evidenceKind: "declaration", qualification: "unverified", activeTarget: null, lockResolution: null, productionUse: null, declarations: mine.map((f) => ({ file: f.file, spec: f.spec, dev: f.dev, target: f.target ?? null, optional: f.optional ?? false, peer: f.peer ?? false })), owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
   const bounds = counted.map((f) => ({ f, v: lowerBound(f.spec) }));
   const best = bounds.filter((b) => b.v).sort((a, b) => compareVersions(b.v, a.v))[0];
   const declaredAt = best ? show(best.v) : null;
@@ -218,7 +268,7 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
   resolveWorkspaceInheritance(manifests);
   for (const m of manifests) if (m.error) problems.push(`${m.rel}: ${m.error}`);
   const facts = manifests.flatMap((m) => m.facts);
-  const owners = [...requirements(applicable).values()].map((req) => judge(req, facts));
+  const owners = [...requirements(applicable).values()].map((req) => { const result = judge(req, facts); return { ...result, declarationStatus: result.status }; });
   // A profile that is unknown, marked unratified, or has no rows checks nothing; an app may not select it, so it fails rather than passing empty.
   const profileStatus = !data.profiles[active] ? "unknown-profile" : (data.profiles[active].ratified === false || !data.rows.some((r) => r.profile === active)) ? "unratified" : null;
   if (profileStatus) {
@@ -236,7 +286,7 @@ export function checkApps(roots, options = {}) {
 }
 
 export function renderText(report) {
-  const out = [`ownership-mandatory (${report.mode}) — Table 1 mandatory owner set`];
+  const out = [`ownership-mandatory (${report.mode}) — Table 1 owner declarations (active-target, lock & production qualification unverified)`];
   for (const app of report.apps) {
     const count = (s) => app.owners.filter((o) => o.status === s).length;
     out.push("", `${app.app} [${app.profile}] ${app.scanned ? `ok=${count("ok")} missing=${count("missing")} below-required=${count("below-required")} not-on-registry=${count("not-on-registry")}` : "UNSCANNED"}`

package/ownership-repositories.json

@@ -15,7 +15,7 @@
     { "repositoryIdentity": "https://github.com/orthic-labs/legion", "roots": ["."], "visibility": "public" },
     { "repositoryIdentity": "https://github.com/bogusyogi/workright", "roots": ["."], "visibility": "private" },
     { "repositoryIdentity": "https://github.com/orthic-labs/sellright", "roots": ["."], "visibility": "public" },
-    { "repositoryIdentity": "https://github.com/orthic-labs/pulse", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/pulse", "roots": ["."], "visibility": "private" },
     { "repositoryIdentity": "https://github.com/bogusyogi/swiftright", "roots": ["."], "visibility": "private" }
   ]
 }