@rightkit/release 0.2.174 → 0.4.0

package/protected-credentials.mjs

@@ -7,7 +7,8 @@ import { isManagedHost, refuseManagedEnvSecrets } from "./managed-host-secrets.m
 // Protected credential loaders for release sites that previously read only
 // ambient environment variables. The storage pattern matches release-token.mjs:
 // macOS Keychain generic passwords (account $USER) and, on Windows, a protected
-// token file under %APPDATA%\RightKit. Values are returned to the caller only;
+// token file under %APPDATA%\RightKit for legacy non-updater sites. Updater
+// signing uses M11's native OS-store child-exec boundary. Other values return to the caller only;
 // they are never logged, and diagnostics name the secret, never its value.
 export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 
@@ -16,6 +17,7 @@ export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 export const PROTECTED_SECRETS = Object.freeze({
   "cloudflare-api-token": { label: "Cloudflare API token", keychain: "rightkit-cloudflare-api-token", file: "cloudflare-api-token.token" },
   "qa-receipt-key": { label: "RightKit QA receipt key", keychain: null, file: "qa-receipt-key.token", darwinFile: true },
+  "updater-signing-key": { label: "RightKit updater signing key", keychain: "rightsuite-updater-key", providerExec: true },
 });
 
 export class ProtectedSecretMissingError extends Error {
@@ -39,6 +41,7 @@ export function protectedSecretStoreCommand(name, platform = process.platform) {
   if (platform === "darwin" && spec.darwinFile) return null;
   if (platform === "darwin") return `security add-generic-password -a "$USER" -s ${spec.keychain} -U -w`;
   if (platform === "win32") {
+    if (spec.providerExec) return `$rightkitSecure = Read-Host -AsSecureString '${spec.label}'; $rightkitPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($rightkitSecure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rightkitPointer) | & rightkit-credentials.exe set --namespace '${spec.keychain}' --account ([Environment]::UserName) --replace } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rightkitPointer) }`;
     return `powershell -NoProfile -Command "$s = Read-Host -AsSecureString '${spec.label}'; $d = Join-Path $env:APPDATA 'RightKit'; New-Item -ItemType Directory -Force -Path $d | Out-Null; [IO.File]::WriteAllText((Join-Path $d '${spec.file}'), [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($s)))"`;
   }
   return null;
@@ -78,6 +81,9 @@ export function createCredentialStore({
     read(name) {
       if (!PROTECTED_SECRETS[name]) throw new Error(`unknown protected secret: ${name}`);
       const spec = PROTECTED_SECRETS[name];
+      // Signing keys stay inside the native provider's child-exec boundary.
+      // No JavaScript/file/environment fallback can export this credential.
+      if (spec.providerExec) throw new ProtectedSecretMissingError(name, protectedSecretStoreCommand(name, platform));
       let value;
       if (platform === "darwin") {
         // Receipt MAC keys are provisioned by right-release itself as a 0600 file, never from the Keychain.
@@ -98,6 +104,7 @@ export function createCredentialStore({
 // when the store has no value. A missing store entry on a managed host never
 // permits the environment fallback.
 export function resolveEnvBackedSecret({ name, envName, env = process.env, credentialStore, required = true }) {
+  if (PROTECTED_SECRETS[name]?.providerExec) throw new Error("updater signing requires the OS credential provider execution boundary");
   refuseManagedEnvSecrets(env, [envName]);
   if (!required) return undefined;
   const store = credentialStore ?? createCredentialStore({ env });
@@ -111,6 +118,26 @@ export function resolveEnvBackedSecret({ name, envName, env = process.env, crede
   }
 }
 
+// M11 owns OS acquisition & secret lifetime. The release adapter supplies only
+// non-secret identity plus an absolute native child executable and literal argv.
+export function execWithUpdaterCredential(command, args, {
+  env = process.env, cwd = process.cwd(), run = spawnSync,
+  provider = process.platform === "win32" ? "rightkit-credentials.exe" : "rightkit-credentials",
+  account = os.userInfo().username,
+} = {}) {
+  for (const key of Object.keys(env)) {
+    if (["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"].includes(key.toUpperCase()) && env[key]) {
+      throw new Error("updater signing key/password must come from the OS credential provider");
+    }
+  }
+  if (!path.isAbsolute(command)) throw new Error("credential provider child must be an absolute native executable");
+  const result = run(provider, ["exec", "--namespace", PROTECTED_SECRETS["updater-signing-key"].keychain,
+    "--account", account, "--env", "TAURI_SIGNING_PRIVATE_KEY", "--", command, ...args],
+  { cwd, env: { ...env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" }, stdio: "inherit", shell: false, windowsHide: true });
+  if (result.error?.code === "ENOENT") throw new Error("OS credential provider unavailable: install rightkit-credentials >=0.2.2 on PATH before updater signing");
+  return result;
+}
+
 export function resolveCloudflareApiToken({ env = process.env, credentialStore, required = true } = {}) {
   return resolveEnvBackedSecret({ name: "cloudflare-api-token", envName: "CLOUDFLARE_API_TOKEN", env, credentialStore, required });
 }

package/publication-artifacts.mjs

@@ -41,7 +41,9 @@ export function assertArtifactUnchanged(artifact) {
   return artifact.bytes;
 }
 
-export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId }, deps = {}) {
+// `streamRoles`: sealed entries of these roles are hash-verified by a streamed read and returned WITHOUT their bytes (the caller reads
+// byte ranges of `file`), so a large IPA is never held in memory.
+export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId, streamRoles = [], ownershipScope = null }, deps = {}) {
   let sealed;
   try { sealed = verifySealedRelease(sealedDir); }
   catch (error) {
@@ -52,7 +54,7 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!/^[a-f0-9]{40}$/.test(commit ?? "") || manifest.commit !== commit
     || (app && manifest.app !== app) || (version && manifest.version !== version)
     || manifest.platform !== platform || (releaseId && manifest.releaseId !== releaseId)) throw new PublicationError("PUBLICATION_SOURCE_MISMATCH", "sealed release source or product identity mismatch");
-  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot);
+  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot, ownershipScope);
   if (!ownership.ok || manifest.ownershipEvidence?.commit !== commit) throw new PublicationError("PUBLICATION_OWNERSHIP_INVALID", `sealed ownership evidence rejected: ${ownership.reason ?? "commit mismatch"}`);
   if (!manifest.checkpoints?.includes("signed") || !manifest.checkpoints?.includes("hardened")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "signed & hardened seal checkpoints are required");
   if (configPath && digestBytes(readFileSync(configPath)) !== manifest.signing?.configSha256) throw new PublicationError("PUBLICATION_POLICY_MISMATCH", "release config differs from sealed signing policy");
@@ -65,14 +67,16 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   let notarized = false;
   let signed = false;
   let androidVerified = false;
+  let iosVerified = false;
   for (const receipt of receipts) {
     const artifact = readVerifiedArtifact(path.resolve(appRoot, receipt.file), receipt);
     let value;
     try { value = JSON.parse(artifact.bytes); } catch { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "invalid sealed signing receipt"); }
     if (value.schema !== 1) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "malformed sealed signing receipt");
     if (value.contract !== undefined) {
-      verifyAndroidPublicationReceipt(value, manifest, platform);
-      androidVerified = true; signed = true;
+      if (value.contract === IOS_RECEIPT_CONTRACT) { verifyIosPublicationReceipt(value, manifest, platform); iosVerified = true; }
+      else { verifyAndroidPublicationReceipt(value, manifest, platform); androidVerified = true; }
+      signed = true;
       continue;
     }
     if (Array.isArray(value.files)) {
@@ -93,10 +97,11 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!signed) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed native signing evidence is required");
   if (platform === "mac" && !notarized) throw new PublicationError("PUBLICATION_NOTARIZATION_MISSING", "sealed notarization evidence is required");
   if (platform === "android" && !androidVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed android AAB upload-key receipt is required");
+  if (platform === "ios" && !iosVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed iOS IPA build receipt is required");
   const artifacts = new Map();
   for (const entry of manifest.files ?? []) {
     if (typeof entry.name !== "string" || path.basename(entry.name) !== entry.name || artifacts.has(entry.name)) throw new PublicationError("PUBLICATION_SEAL_INVALID", "unsafe or duplicate sealed artifact name");
-    artifacts.set(entry.name, readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
+    artifacts.set(entry.name, streamRoles.includes(entry.role) ? verifyArtifactFile(path.join(sealedDir, entry.name), entry) : readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
   }
   if (!artifacts.size) throw new PublicationError("PUBLICATION_SEAL_INVALID", "sealed release has no artifacts");
   return { ...sealed, artifacts };
@@ -124,6 +129,26 @@ function verifyAndroidPublicationReceipt(value, manifest, platform) {
   if (value.file.name !== aab.name) invalid("android AAB receipt names a different file than the sealed aab entry");
 }
 
+// iOS IPA receipt (ios-package-recipe.mjs: contract "ios-xcodebuild-archive-automatic-v1"). The receipt was already read from the
+// manifest's signing.receipts and hash-verified by the caller; here it must describe exactly the sealed "ipa" file, for the team
+// and bundle id pinned in the sealed signing policy. Fails closed with a specific message on any mismatch.
+const IOS_RECEIPT_CONTRACT = "ios-xcodebuild-archive-automatic-v1";
+function verifyIosPublicationReceipt(value, manifest, platform) {
+  const invalid = (message) => { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", message); };
+  if (platform !== "ios" || manifest.platform !== "ios") invalid("iOS IPA receipt in a non-iOS release");
+  const pinnedTeam = manifest.signing?.teamId;
+  if (!/^[A-Z0-9]{10}$/.test(pinnedTeam ?? "")) invalid("sealed signing policy has no pinned iOS team id");
+  if (value.teamId !== pinnedTeam) invalid("iOS IPA receipt team id is not the pinned team");
+  if (!manifest.signing?.bundleId || value.bundleId !== manifest.signing.bundleId) invalid("iOS IPA receipt bundle id is not the pinned bundle id");
+  if (!value.marketingVersion || !value.buildNumber) invalid("iOS IPA receipt has no version identity");
+  const ipas = (manifest.files ?? []).filter((entry) => entry.role === "ipa");
+  if (ipas.length !== 1) invalid(ipas.length ? "sealed release has more than one ipa entry" : "sealed release has no ipa entry");
+  const [ipa] = ipas;
+  if (!/^[a-f0-9]{64}$/.test(value.file?.sha256 ?? "") || value.file.sha256 !== ipa.sha256) invalid("iOS IPA receipt sha256 differs from the sealed ipa entry");
+  if (!Number.isInteger(value.file.sizeBytes) || value.file.sizeBytes !== ipa.sizeBytes) invalid("iOS IPA receipt size differs from the sealed ipa entry");
+  if (value.file.name !== ipa.name) invalid("iOS IPA receipt names a different file than the sealed ipa entry");
+}
+
 // Bounded memory for large artifacts. Transport must read back against this digest.
 export function verifyArtifactFile(file, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "")) throw new PublicationError("PUBLICATION_SEAL_INVALID", "publication hash evidence is required");

package/publication-gate.mjs

@@ -13,6 +13,7 @@ import { fileURLToPath } from "node:url";
 import { digestBytes, readVerifiedArtifact } from "./publication-artifacts.mjs";
 
 export const GATE_SCHEMA = 1;
+export const MAX_CARGO_JOBS = 64;
 export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
 // Swift packages (RightKitSwift) are Apple-only; Windows cannot run them.
 export const requiredHosts = (kind) => (kind === "swift" ? Object.freeze(["darwin"]) : REQUIRED_HOSTS);
@@ -20,6 +21,11 @@ const SHA = /^[0-9a-f]{40}$/;
 // The one definition of a recorded darwin-only host policy (release evidence and the runtime budget gate share it).
 export const isDarwinOnlyPolicy = (source) => source?.hostPolicy === "darwin-only"
   && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
+// The symmetric recorded win32-only host policy: a crate published from the Windows host under the local-build grant.
+export const isWin32OnlyPolicy = (source) => source?.hostPolicy === "win32-only"
+  && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
+/** The one host a recorded single-host policy names ("darwin" or "win32"), or null when none is recorded. */
+export const singleHostOfPolicy = (source) => (isDarwinOnlyPolicy(source) ? "darwin" : isWin32OnlyPolicy(source) ? "win32" : null);
 
 export function defaultEvidencePath(workspaceRoot, kind, name) {
   return path.join(workspaceRoot, "release-evidence", "gate", `${kind}-${name.replace(/^@/, "").replace("/", "-")}.json`);
@@ -48,11 +54,75 @@ function describeCommitMismatch(evidenceCommit, head, packagePath, git) {
   return parts.join("; ");
 }
 
+const text = (value) => typeof value === "string" && value.trim() !== "";
+const escapeRegExp = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// A batch publication (local-publish.mjs --crates) runs fmt, the secret scan and clippy ONCE for the whole
+// batch at one commit and tree, then copies that receipt into every crate's evidence run as `run.batch`.
+// The receipt proves, for THIS crate, the same three checks a per-crate run proves; it is bound to the evidence
+// commit and to the HEAD tree (the git tree of that commit), so it cannot be carried to another commit.
+export const BATCH_CHECKS = Object.freeze(["fmt", "secret-scan", "clippy"]);
+const BATCH_COMMAND = Object.freeze({
+  fmt: /\bfmt\b.*--check\b/,
+  "secret-scan": /\S/,
+  clippy: /\bclippy\b.*--all-targets\b.*-D warnings\s*$/,
+});
+
+/** Problems with a batch receipt for the crate `evidence.name` (empty when it proves fmt, secret scan and clippy).
+ * `tree` is the current HEAD tree when known; `undefined` skips only that comparison. */
+export function batchReceiptProblems(batch, evidence, tree) {
+  if (!batch || typeof batch !== "object" || Array.isArray(batch)) return ["batch receipt must be an object"];
+  const problems = [];
+  if (!text(batch.id)) problems.push("batch.id");
+  if (batch.commit !== evidence.commit) problems.push(`batch.commit (must equal ${evidence.commit})`);
+  if (!SHA.test(String(batch.tree ?? ""))) problems.push("batch.tree (must be a 40-hex git tree)");
+  else if (tree !== undefined && batch.tree !== tree) problems.push(`batch.tree (must equal the HEAD tree ${tree})`);
+  if (!(Array.isArray(batch.crates) && batch.crates.includes(evidence.name))) problems.push("batch.crates (must name this crate)");
+  const checks = Array.isArray(batch.checks) ? batch.checks : [];
+  for (const name of BATCH_CHECKS) {
+    const rows = checks.filter((row) => row?.name === name);
+    if (!rows.length) { problems.push(`batch check ${name} missing`); continue; }
+    for (const row of rows) {
+      if (row.ok !== true) problems.push(`batch check ${name} not ok`);
+      if (row.commit !== evidence.commit || row.tree !== batch.tree) problems.push(`batch check ${name} not bound to the batch commit and tree`);
+      if (!(text(row.command) && BATCH_COMMAND[name].test(row.command))) problems.push(`batch check ${name} command`);
+    }
+    // fmt is workspace-wide; clippy and the secret scan name the crates they covered.
+    if (name !== "fmt" && !rows.some((row) => Array.isArray(row.crates) && row.crates.includes(evidence.name))) problems.push(`batch check ${name} does not cover this crate`);
+  }
+  return problems;
+}
+
+/**
+ * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
+ * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
+ * `cargo clippy -p <name> ... -D warnings` step, or a valid batch receipt covering the crate), and `fmt` and
+ * `secretScan` (a valid batch receipt covering the crate). Every run on the proving host (darwin, or win32 under a win32-only policy) at the evidence commit must prove a
+ * step for it to count. Call after the gate accepted the evidence (the gate binds commit, tree and artifact).
+ */
+export function provenGateSteps(evidence) {
+  const none = { tests: false, clippy: false, fmt: false, secretScan: false };
+  if (!evidence || !SHA.test(String(evidence.commit ?? "")) || !text(evidence.name)) return none;
+  // The proving host is the one a recorded win32-only policy names; every other evidence is proved on darwin.
+  const proofHost = isWin32OnlyPolicy(evidence) ? "win32" : "darwin";
+  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === proofHost);
+  if (!runs.length || runs.some((run) => run.commit !== evidence.commit)) return none;
+  const name = escapeRegExp(evidence.name);
+  const stepProves = (run, pattern, needTests) => (Array.isArray(run.steps) ? run.steps : []).some((step) => step?.ok === true
+    && pattern.test(String(step.command ?? "")) && (!needTests || (step.executed > 0 && step.failed === 0)));
+  const batchOk = (run) => run.batch !== undefined && batchReceiptProblems(run.batch, evidence, undefined).length === 0;
+  return {
+    tests: runs.every((run) => stepProves(run, new RegExp(`^cargo test -p ${name}( |$)`), true)),
+    clippy: runs.every((run) => batchOk(run) || stepProves(run, new RegExp(`^cargo clippy -p ${name} .*-- -D warnings$`), false)),
+    fmt: runs.every(batchOk),
+    secretScan: runs.every(batchOk),
+  };
+}
+
 // Names of the fields of one host run that do not qualify (empty when the run qualifies). Every run binds to
 // the same unit, commit and artifact: commit, host arch, feature set and artifactSha256 equal to the evidence.
-function invalidRunFields(run, evidence) {
+function invalidRunFields(run, evidence, tree) {
   const bad = [];
-  const text = (value) => typeof value === "string" && value.trim() !== "";
   if (run.commit !== evidence.commit) bad.push(`commit (must equal ${evidence.commit})`);
   if (!text(run.host?.arch)) bad.push("host.arch");
   if (!(Array.isArray(run.features) && run.features.length > 0 && run.features.every(text))) bad.push("features");
@@ -62,6 +132,8 @@ function invalidRunFields(run, evidence) {
   if (!text(run.timestamp)) bad.push("timestamp");
   if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
   if (run.failed !== 0) bad.push("failed (must be 0)");
+  if (run.jobs !== undefined && !(Number.isInteger(run.jobs) && run.jobs >= 1 && run.jobs <= MAX_CARGO_JOBS)) bad.push(`jobs (must be an integer from 1 to ${MAX_CARGO_JOBS})`);
+  if (run.batch !== undefined) bad.push(...batchReceiptProblems(run.batch, evidence, tree ?? null).map((problem) => `batch: ${problem}`));
   return bad;
 }
 
@@ -88,17 +160,23 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
       missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
     }
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
+    // A batch receipt is bound to the HEAD tree as well as the commit; read it only when a run carries one.
+    // `tree ?? null` below makes an unreadable tree fail the comparison (null never equals a 40-hex tree).
+    const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
+    if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
     // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
     // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
     // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    const darwinOnly = (kind === "npm" || kind === "cargo") && isDarwinOnlyPolicy(evidence);
-    for (const host of darwinOnly ? ["darwin"] : requiredHosts(kind)) {
+    // A crate published from the Windows host under the local-build grant records the symmetric
+    // hostPolicy "win32-only" + reason, and then the one required receipt is the Windows run.
+    const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
+    for (const host of singleHost ? [singleHost] : requiredHosts(kind)) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
       // Every run on the host must qualify: a failing run is not masked by a passing run beside it.
       matching.forEach((run, index) => {
-        const fields = invalidRunFields(run, evidence);
+        const fields = invalidRunFields(run, evidence, tree);
         if (fields.length) missing.push(`${label} run receipt ${index} invalid: ${fields.join(", ")}`);
       });
     }

package/publish-cargo.mjs

@@ -2,8 +2,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
+import { spawnSync } from "./background-process.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
 import { recordPublished } from "./rightkit-sync.mjs";
@@ -23,7 +24,7 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const crate = valueAfter(argv, "--crate");
   if (!crate) throw new Error("publish cargo requires --crate <name>");
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(crate)) throw new Error(`invalid crate name: ${crate}`);
-  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence"]);
+  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence", "--from-evidence"]);
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!arg.startsWith("--")) continue;
@@ -33,12 +34,45 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const dryRun = argv.includes("--dry-run");
   const allowDirty = argv.includes("--allow-dirty");
   if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  const fromEvidence = valueAfter(argv, "--from-evidence");
+  if (argv.includes("--from-evidence") && (!fromEvidence || fromEvidence.startsWith("--"))) throw new Error("--from-evidence requires a gate evidence file");
+  if (fromEvidence && (dryRun || allowDirty || argv.includes("--evidence"))) throw new Error("--from-evidence cannot be combined with --dry-run, --allow-dirty or --evidence");
   return {
     crate,
     dryRun,
     allowDirty,
     workspaceRoot: path.resolve(valueAfter(argv, "--workspace") ?? cwd),
-    evidence: valueAfter(argv, "--evidence"),
+    evidence: fromEvidence ?? valueAfter(argv, "--evidence"),
+    ...(fromEvidence ? { fromEvidence: true } : {}),
+  };
+}
+
+const OFFLINE_CACHE_MISS = /(?:attempting to make an HTTP request, but --offline was specified|as a reminder, you're using offline mode(?: \(--offline\))?)/i;
+const OFFLINE_READ_ONLY_COMMANDS = new Set(["metadata", "package"]);
+
+/** Retry only a Cargo offline cache miss for metadata/package inspection, once with normal network access. */
+export async function runCargoReadOnly(args, settings, execute, onOfflineFailure = () => {}) {
+  const subcommand = args[0];
+  if (!OFFLINE_READ_ONLY_COMMANDS.has(subcommand) || !args.includes("--offline")) {
+    return execute("cargo", args, settings);
+  }
+  const first = await execute("cargo", args, settings);
+  if (!first.error && first.status === 0) return first;
+  const diagnostic = `${first.stdout ?? ""}\n${first.stderr ?? ""}`;
+  if (!OFFLINE_CACHE_MISS.test(diagnostic)) return first;
+  onOfflineFailure(first);
+  const retryArgs = args.filter((arg) => arg !== "--offline");
+  const retry = await execute("cargo", retryArgs, settings);
+  if (!retry.error && retry.status === 0) return { ...retry, usedOfflineFallback: true };
+  const labeled = (result) => String(result ?? "");
+  const stdout = `[offline attempt]\n${labeled(first.stdout)}\n[online retry]\n${labeled(retry.stdout)}`;
+  const stderr = `[offline attempt]\n${labeled(first.stderr)}\n[online retry]\n${labeled(retry.stderr)}`;
+  return {
+    ...retry,
+    stdout,
+    stderr,
+    ...(retry.error ? { error: new Error(`${retry.error.message}\n${stdout}\n${stderr}`) } : {}),
+    offlineFallbackFailed: true,
   };
 }
 
@@ -53,11 +87,24 @@ export function runtimeBudgetDeferral(crateDir, crate) {
   return `${data.reason} (${data.approvedBy}, ${data.approved}; ci/runtime-budget-deferred.json)`;
 }
 
-export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false }) {
+// Plan step label -> the `provenGateSteps` key whose proof lets that step be skipped.
+const PROVEN_STEP = Object.freeze({ "secret scan": "secretScan", format: "fmt", tests: "tests", clippy: "clippy" });
+
+/**
+ * `proven` (from `provenGateSteps(evidence)`) removes a secret scan, format, tests or clippy step the evidence
+ * already proves for this exact commit; the runtime budget, package contents, archive hash and registry steps
+ * are never skippable. `verifyOnPublish` (real publish only) drops the separate registry dry-run and lets the
+ * real `cargo publish` run Cargo's own verify build (no `--no-verify`), so the package compiles once, before
+ * the upload, instead of in a dry-run and not at all in the publish. `packageVerified` is set only after
+ * explicit evidence reuse proves a successful standalone package verification; hash checking stays mandatory.
+ */
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false, packageVerified = false, offlineReadOnly = false }) {
+  const offline = offlineReadOnly ? ["--offline"] : [];
   const dryRunArgs = ["publish", "--dry-run", "-p", crate];
-  const packageArgs = ["package", "--list", "-p", crate];
+  const packageArgs = ["package", "--list", ...offline, "-p", crate];
   if (allowDirty) dryRunArgs.push("--allow-dirty");
   if (allowDirty) packageArgs.push("--allow-dirty");
+  const verifyHere = verifyOnPublish && !dryRun;
   const plan = [
     { label: "secret scan", internal: "secret-scan", crateDir },
     // Runtime-budget crates (runtime-budgets.mjs) must carry a measured runtime-budget.json for this
@@ -67,15 +114,18 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
-    { label: "registry dry-run", command: "cargo", args: dryRunArgs },
-  ];
+    ...((verifyHere || packageVerified) ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
+  ].filter((step) => !(PROVEN_STEP[step.label] && proven[PROVEN_STEP[step.label]] === true));
   if (!dryRun) plan.push(
     // `publish --dry-run` leaves its archive under target/package/tmp-crate on current Cargo; package
-    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads.
-    { label: "package archive", command: "cargo", args: ["package", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
-    { label: "package location", command: "cargo", args: ["metadata", "--format-version", "1", "--no-deps"], capture: true },
+    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads. Always
+    // online and --locked, like qualification: offline packaging resolves the archive's Cargo.lock from
+    // only the .crate files already downloaded, so a sibling published since then silently resolves to an
+    // older version and the archive no longer matches its evidence hash.
+    { label: "package archive", command: "cargo", args: ["package", "--locked", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
+    { label: "package location", command: "cargo", args: ["metadata", ...offline, "--format-version", "1", "--no-deps"], capture: true },
     { label: "archive hash check", internal: "verify-archive" },
-    { label: "registry publish", command: "cargo", args: ["publish", "--no-verify", "-p", crate] },
+    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", ...(packageVerified ? ["--locked"] : []), "--no-verify", "-p", crate] },
     { label: "registry readback", internal: "registry-readback" },
   );
   return plan;
@@ -119,7 +169,45 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   };
   const gate = (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { dryRun: options.dryRun });
   const expectedSha256 = gate.evidence?.artifactSha256;
-  const plan = buildCargoPublishPlan({ ...options, crateDir });
+  // Explicit evidence reuse enters through the same gate: current commit, version, clean source, host runs
+  // and artifact digest must match. Windows evidence keeps its actual win32 host policy on the Mac.
+  const reuseEvidence = options.fromEvidence === true;
+  if (reuseEvidence && (options.dryRun || options.allowDirty || !options.evidence)) throw new Error("--from-evidence requires a real publish, clean source and explicit evidence");
+  const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
+  if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
+  if (reuseEvidence) {
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml and Cargo.lock");
+    const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
+    const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
+    const command = `cargo package --locked -p ${options.crate}`;
+    if (!runs.length || !runs.every((run) => run.steps?.some((step) => step.ok === true && step.command === command))) {
+      throw new Error("--from-evidence requires a verified cargo package --locked receipt for this artifact");
+    }
+    // Load the shared planner after module initialization: local-publish itself imports this publisher.
+    // Validate the complete current qualification matrix, not merely one passing test and lint command.
+    const { localTestPlan } = await import("./local-publish.mjs");
+    let config;
+    try { config = JSON.parse(fs.readFileSync(path.join(options.workspaceRoot, "ci", "gate.config.json"), "utf8")); }
+    catch { throw new Error("--from-evidence cannot read current ci/gate.config.json"); }
+    for (const run of runs) {
+      if (!Array.isArray(run.steps) || run.steps.some((step) => step?.ok !== true || (step.failed ?? 0) !== 0)) {
+        throw new Error("--from-evidence refuses an unsuccessful qualification step");
+      }
+      const expected = localTestPlan({ kind: "cargo", unit: options.crate, dir: `crates/${options.crate}`, config, batch: Boolean(run.batch), platform: proofHost });
+      for (const step of expected.steps) {
+        const text = `${step.command} ${step.args.join(" ")}`;
+        if (!run.steps.some((row) => row.command === text && row.ok === true && (!step.test || (row.executed > 0 && row.failed === 0)))) {
+          throw new Error(`--from-evidence missing configured qualification step: ${text}`);
+        }
+      }
+    }
+  }
+  const plan = buildCargoPublishPlan({ ...options, crateDir, proven,
+    verifyOnPublish: !reuseEvidence && options.verifyOnPublish === true, packageVerified: reuseEvidence, offlineReadOnly: options.offlineReadOnly === true });
+  for (const [label, key] of Object.entries(PROVEN_STEP)) {
+    if (proven[key] === true) process.stdout.write(`[right-release] cargo ${label}: proven by the gate evidence for this commit, not repeated\n`);
+  }
 
   let targetDir;
   let artifact;
@@ -159,21 +247,39 @@ export async function runCargoPublish(options, execute = (_command, args, settin
       continue;
     }
     if (step.label === "registry publish") assertArtifactUnchanged(artifact);
-    const result = execute(step.command, step.args, {
+    // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
+    const isReadOnlyInspection = ["package contents", "package location"].includes(step.label);
+    const settings = {
       cwd: options.workspaceRoot,
       encoding: "utf8",
       windowsHide: true,
-      stdio: step.capture ? "pipe" : "inherit",
-    });
-    if (result.error) throw result.error;
+      stdio: step.capture || (options.offlineReadOnly === true && isReadOnlyInspection) ? "pipe" : "inherit",
+    };
+    const result = options.offlineReadOnly === true && isReadOnlyInspection
+      ? await runCargoReadOnly(step.args, settings, execute, (failed) => {
+        process.stderr.write(`[right-release] offline Cargo inspection missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`);
+      })
+      : await execute(step.command, step.args, settings);
+    if (result.error) {
+      if (result.offlineFallbackFailed) throw new Error(`${step.label} failed: ${result.error.message}`);
+      throw result.error;
+    }
     if (result.status !== 0) {
-      if (step.capture && result.stderr) process.stderr.write(result.stderr);
-      throw new Error(`${step.label} failed with exit code ${result.status}`);
+      if (result.offlineFallbackFailed || step.label === "package archive") {
+        if (result.stdout) process.stdout.write(result.stdout);
+        if (result.stderr) process.stderr.write(result.stderr);
+      } else if (step.capture && result.stderr) process.stderr.write(result.stderr);
+      const fallback = result.offlineFallbackFailed ? `\n${result.stdout ?? ""}\n${result.stderr ?? ""}` : "";
+      throw new Error(`${step.label} failed with exit code ${result.status}${fallback}`);
     }
     if (step.label === "package location") {
+      if (result.stderr) process.stderr.write(result.stderr);
       const metadata = JSON.parse(result.stdout);
       if (typeof metadata.target_directory !== "string" || !path.isAbsolute(metadata.target_directory)) throw new Error("invalid Cargo package target directory");
       targetDir = metadata.target_directory;
+    } else if (step.label === "package archive") {
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
     } else if (step.capture) {
       if (result.stderr) process.stderr.write(result.stderr);
       const files = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);

package/publish-update.mjs

@@ -14,7 +14,7 @@ import { verifyPublicationRelease, PublicationError, assertArtifactUnchanged, di
 import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
 import { verifyPlatformTrust } from "./github-release.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
-import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease } from "./github-updater-release.mjs";
+import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, assertUpdaterSignature, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease } from "./github-updater-release.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
@@ -116,7 +116,20 @@ function git(args) {
 if (!githubLane && tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if ((githubLane || tier === "update") && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
-if (sealed) for (const artifact of artifacts) signatureFor(artifact);
+// Cryptographic gate before any upload: every sealed minisign signature must verify over the
+// exact final artifact bytes against the declared public key. No declared key means the
+// signature cannot be verified, so a sealed (real) publish fails closed; key-id pinning is
+// supplementary only. Integrator owns declaring distribution.updaterPublicKey in app configs
+// (suite key already pinned per-app as tauri plugins.updater.pubkey).
+const updaterPublicKey = config.distribution?.updaterPublicKey ?? config.distribution?.updaterPubkey ?? target?.updater?.pubkey ?? target?.updater?.publicKey;
+if (sealed) for (const artifact of artifacts) {
+  const signature = signatureFor(artifact);
+  if (!appInstallerKind) {
+    if (!updaterPublicKey) throw new PublicationError("PUBLICATION_SIGNATURE_UNVERIFIABLE", `no updater public key declared (distribution.updaterPublicKey); refusing to upload ${path.basename(artifact.file)} with an unverified signature`);
+    assertUpdaterSignature(assertArtifactUnchanged(verifiedArtifact(artifact.file)), signature, updaterPublicKey, `signature of ${path.basename(artifact.file)}`);
+    assertUpdaterKeyId(signature, config.distribution.updaterKeyId, `signature of ${path.basename(artifact.file)}`);
+  }
+}
 let releaseToken = null;
 if (!githubLane && !dryRun && (tier === "update" || artifacts.length > 0)) {
   try {

package/qa-build-features.mjs

@@ -12,17 +12,10 @@ import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 
-export const FORBIDDEN_FEATURES = Object.freeze(["devtools", "content-devtools", "qa-native", "qa-control", "dev-native", "dev-inspect",
-  // Per-app test-automation features (M20 owner gap): HeardRight `qa-shot`/`qa-tools`, ViewRight `dev-control`/`bench-native`.
-  "qa-shot", "qa-tools", "dev-control", "bench-native",
-  // D4 (M21/M23): rightkit-daemon `test-mode` compiles the override selectors; never in a release build.
-  "test-mode"]);
-// rightkit-qa 0.6.0 moved the embedded control server (the former rightkit-qa-driver `qa-control`) behind its `control`
-// feature. It emits the same QA_CONTROL_MARKER, so the binary layer refuses it unchanged; this is the source layer.
-export const QUALIFIED_FORBIDDEN_FEATURES = Object.freeze(["rightkit-qa/control", "rightkit-qa?/control"]);
-// The only forbidden features an allow-listed app may enable: rightkit-tauri-shell's `content-devtools` (and the Tauri
-// `devtools` it switches on). See devtools-policy.mjs; every other app is refused them.
-const DEVTOOLS_FEATURES = Object.freeze(["devtools", "content-devtools"]);
+const featureRegistry = JSON.parse(readFileSync(new URL("./release-switch-registry.json", import.meta.url), "utf8"));
+const DEVTOOLS_FEATURES = Object.freeze(featureRegistry.conditionalForbiddenFeatures["content-only"]);
+export const FORBIDDEN_FEATURES = Object.freeze([...featureRegistry.forbiddenFeatures.filter((name) => !name.includes("/")), ...DEVTOOLS_FEATURES]);
+export const QUALIFIED_FORBIDDEN_FEATURES = Object.freeze(featureRegistry.forbiddenFeatures.filter((name) => name.includes("/")));
 const FORBIDDEN_DEPENDENCY = "tauri-plugin-wdio-webdriver";
 const MANAGERS = new Set(["pnpm", "npm", "yarn", "bun", "npx"]);
 
@@ -36,7 +29,7 @@ export function isForbiddenFeature(item, { allowDevtools = false } = {}) {
   const name = featureName(text);
   if (allowDevtools && DEVTOOLS_FEATURES.includes(name)) return false;
   // `control` is too generic to forbid by bare name; rightkit-qa's dev-only server feature is refused when qualified.
-  if (QUALIFIED_FORBIDDEN_FEATURES.includes(text.replace(/\s+/g, ""))) return true;
+  if (QUALIFIED_FORBIDDEN_FEATURES.includes(text.replace(/\s+/g, "").replace("?/", "/"))) return true;
   return text === `dep:${FORBIDDEN_DEPENDENCY}` || FORBIDDEN_FEATURES.includes(name);
 }
 
@@ -154,6 +147,7 @@ export function parseCargoFeaturesAndDependencies(manifestText) {
 function dependencyInfo(spec) {
   const list = spec.match(/features\s*=\s*(\[)/);
   return {
+    package: spec.match(/package\s*=\s*["']([^"']+)["']/)?.[1],
     optional: /optional\s*=\s*true/.test(spec),
     features: list ? strings(balanced(spec, list.index + list[0].length - 1, "[", "]")) : [],
   };
@@ -162,6 +156,15 @@ function dependencyInfo(spec) {
 export function cargoManifestIssues(manifestText, label = "Cargo.toml", { allowDevtools = false } = {}) {
   const { features, dependencies } = parseCargoFeaturesAndDependencies(manifestText);
   const issues = [];
+  const canonicalFeature = (item) => {
+    const match = /^([^/]+?)(\?)?\/(.+)$/.exec(item);
+    return match ? `${dependencies.get(match[1])?.package ?? match[1]}/${match[3]}` : item;
+  };
+  for (const [alias, dep] of dependencies) {
+    if (dep.package && dep.package !== alias && !dep.optional) for (const feature of dep.features) {
+      if (isForbiddenFeature(`${dep.package ?? alias}/${feature}`, { allowDevtools })) issues.push(`${label}: dependency \`${alias}\` enables forbidden feature \`${dep.package ?? alias}/${feature}\``);
+    }
+  }
   const tauri = dependencies.get("tauri");
   if (!allowDevtools && tauri?.features.includes("devtools")) issues.push(`${label}: dependency \`tauri\` lists feature \`devtools\` unconditionally (inspector ships in release builds)`);
   // The crate was renamed from rightkit-control; apps still on the old published name must stay covered.
@@ -185,7 +188,7 @@ export function cargoManifestIssues(manifestText, label = "Cargo.toml", { allowD
     const item = stack.pop();
     if (reached.has(item)) continue;
     reached.add(item);
-    if (isForbiddenFeature(item, { allowDevtools })) issues.push(`${label}: default feature set reaches \`${item}\``);
+    if (isForbiddenFeature(canonicalFeature(item), { allowDevtools })) issues.push(`${label}: default feature set reaches \`${item}\``);
     if (features.has(item)) stack.push(...features.get(item));
   }
   return issues;