@rightkit/release 0.2.19 → 0.2.21

package/cargo-contract.mjs

@@ -0,0 +1,159 @@
+import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const SKIP_DIRECTORIES = new Set([".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
+const CRATES_IO_SOURCES = new Set([
+  "registry+https://github.com/rust-lang/crates.io-index",
+  "registry+https://index.crates.io/",
+]);
+
+export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {
+  const scanRoot = path.resolve(root);
+  const boundary = findRepositoryRoot(scanRoot);
+  const published = publishedVersions instanceof Map
+    ? publishedVersions
+    : new Map(Object.entries(publishedVersions ?? {}));
+  const manifests = findCargoManifests(scanRoot);
+  const cargoHome = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-home-"));
+  try {
+    for (const manifestPath of manifests) {
+      const manifestLabel = path.relative(boundary, manifestPath) || "Cargo.toml";
+      assertNoRightKitCargoOverrides(manifestPath, boundary, `${label}/${manifestLabel}`);
+      const dependencies = readCargoManifestDependencies(manifestPath, cargoHome, `${label}/${manifestLabel}`);
+      assertPublishedRightKitCargoDependencies(dependencies, published, `${label}/${manifestLabel}`);
+    }
+  } finally {
+    rmSync(cargoHome, { recursive: true, force: true });
+  }
+  return manifests.length;
+}
+
+export function assertPublishedRightKitCargoDependencies(dependencies, published, label) {
+  let checked = 0;
+  for (const dependency of dependencies.filter(({ name }) => name.startsWith("rightkit-"))) {
+    checked += 1;
+    const expected = published.get(dependency.name);
+    if (!expected) throw new Error(`${label} ${dependency.name} is not a published RightKit crate`);
+    if (!CRATES_IO_SOURCES.has(dependency.source) || dependency.path || dependency.registry || dependency.req !== `=${expected}`) {
+      throw new Error(`${label} ${dependency.name} must use the exact crates.io version "=${expected}"`);
+    }
+  }
+  return checked;
+}
+
+export function assertNoRightKitCargoOverrides(manifestPath, repoRoot, label) {
+  const boundary = path.resolve(repoRoot);
+  const manifest = path.resolve(manifestPath);
+  assertInsideBoundary(manifest, boundary);
+  assertNoRightKitOverrides(readToml(manifest, label), label, path.relative(boundary, manifest) || "Cargo.toml");
+
+  for (const configPath of findRepoCargoConfigs(path.dirname(manifest), boundary)) {
+    const source = path.relative(boundary, configPath);
+    const parsed = readToml(configPath, source);
+    assertNoRightKitOverrides(parsed, label, source);
+    const cratesIo = parsed.source?.["crates-io"];
+    if (cratesIo && typeof cratesIo === "object"
+      && ["replace-with", "directory", "git", "registry", "local-registry"].some((key) => key in cratesIo)) {
+      throw new Error(`${label} has forbidden crates.io source replacement in ${source}`);
+    }
+  }
+}
+
+function readCargoManifestDependencies(manifestPath, cargoHome, label) {
+  const result = spawnSync(
+    "cargo",
+    ["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath],
+    {
+      cwd: path.dirname(manifestPath),
+      encoding: "utf8",
+      env: { ...process.env, CARGO_HOME: cargoHome },
+      windowsHide: true,
+    },
+  );
+  if (result.status !== 0) {
+    throw new Error(`${label} Cargo metadata rejected manifest; RightKit dependencies must use exact crates.io versions: ${String(result.stderr ?? "").trim()}`);
+  }
+  const metadata = JSON.parse(result.stdout);
+  const expectedPath = path.resolve(manifestPath).toLowerCase();
+  const pkg = metadata.packages.find(({ manifest_path: candidate }) => path.resolve(candidate).toLowerCase() === expectedPath);
+  if (!pkg && path.resolve(metadata.workspace_root, "Cargo.toml").toLowerCase() === expectedPath) return [];
+  if (!pkg) throw new Error(`${label} was not returned by Cargo metadata`);
+  return pkg.dependencies;
+}
+
+function assertNoRightKitOverrides(parsed, label, source) {
+  for (const overrides of Object.values(parsed.patch ?? {})) {
+    if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) continue;
+    for (const [name, specifier] of Object.entries(overrides)) {
+      const packageName = typeof specifier === "object" && specifier ? specifier.package : undefined;
+      if (name.startsWith("rightkit-") || packageName?.startsWith("rightkit-")) {
+        throw new Error(`${label} has forbidden RightKit Cargo override ${name} in ${source}`);
+      }
+    }
+  }
+  for (const [name, specifier] of Object.entries(parsed.replace ?? {})) {
+    const packageName = typeof specifier === "object" && specifier ? specifier.package : undefined;
+    if (name.split(":", 1)[0].startsWith("rightkit-") || packageName?.startsWith("rightkit-")) {
+      throw new Error(`${label} has forbidden RightKit Cargo override ${name} in ${source}`);
+    }
+  }
+}
+
+function readToml(file, label) {
+  const script = "import json,pathlib,sys,tomllib; json.dump(tomllib.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')),sys.stdout,default=str)";
+  const command = process.platform === "win32" ? "py" : "python3";
+  const args = process.platform === "win32" ? ["-3.11", "-c", script, file] : ["-c", script, file];
+  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(`${label} is not valid TOML: ${String(result.stderr ?? "").trim()}`);
+  return JSON.parse(result.stdout);
+}
+
+function findCargoManifests(root) {
+  const found = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_DIRECTORIES.has(entry.name)) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) visit(full);
+      else if (entry.isFile() && entry.name === "Cargo.toml") found.push(full);
+    }
+  };
+  visit(root);
+  return found;
+}
+
+function findRepoCargoConfigs(start, repoRoot) {
+  const boundary = path.resolve(repoRoot);
+  let current = path.resolve(start);
+  assertInsideBoundary(current, boundary);
+  const configs = [];
+  while (true) {
+    for (const filename of ["config", "config.toml"]) {
+      const candidate = path.join(current, ".cargo", filename);
+      if (existsSync(candidate)) configs.push(candidate);
+    }
+    if (current.toLowerCase() === boundary.toLowerCase()) break;
+    current = path.dirname(current);
+  }
+  return configs;
+}
+
+function assertInsideBoundary(candidate, boundary) {
+  const relative = path.relative(boundary, candidate);
+  if (relative !== "" && (relative.startsWith("..") || path.isAbsolute(relative))) {
+    throw new Error(`${candidate} is outside ${boundary}`);
+  }
+}
+
+function findRepositoryRoot(start) {
+  const original = path.resolve(start);
+  let current = original;
+  while (true) {
+    if (existsSync(path.join(current, ".git"))) return current;
+    const parent = path.dirname(current);
+    if (parent === current) return original;
+    current = parent;
+  }
+}

package/cli/right-release.mjs

@@ -47,6 +47,13 @@ if (first === "--version" || first === "-v") {
   } else {
     run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
   }
+} else if (first === "model") {
+  const rest = args.slice(1);
+  if (rest[0] !== "promote") {
+    console.error("right-release model: expected promote");
+    process.exit(2);
+  }
+  run("model-promote.mjs", rest.slice(1));
 } else if (first === "lsclean") {
   runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
 } else if (first === "generate-dmg-background") {
@@ -113,6 +120,8 @@ Commands:
   release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
   publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
+  model promote --authority heardright --config <file> [--dry-run]
+                                                      Sign and promote one runtime/model artifact
   doctor [--platform mac|win]                        Inspect one app's release config
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories

package/model-promote.mjs

@@ -0,0 +1,262 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+import {
+  buildRuntimeArtifactManifest,
+  signRuntimeArtifactManifest,
+} from "./runtime-artifact-manifest.mjs";
+import { loadReleaseToken } from "./release-token.mjs";
+import { registerRightAppsRelease } from "./rightapps-register.mjs";
+
+export const RUNTIME_ARTIFACT_TRUSTED_KEY_ID = "rightkit-runtime-artifacts-2026-07";
+const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
+
+export async function promoteRuntimeArtifact(input, deps = {}) {
+  const metadata = deps.metadata ?? fileMetadata;
+  const upload = deps.upload;
+  const register = deps.register;
+  const { config } = input;
+  assertPromotionConfig(config);
+  if (input.authority !== "heardright") throw new Error("model promotion authority must be heardright");
+  if (input.keyId !== RUNTIME_ARTIFACT_TRUSTED_KEY_ID) throw new Error(`untrusted runtime artifact key id: ${input.keyId}`);
+  if (!input.privateKey) throw new Error("runtime artifact signing key is required");
+
+  const [artifact, evidence] = await Promise.all([
+    metadata(input.artifactFile),
+    metadata(input.evidenceFile),
+  ]);
+  assertMetadata(artifact, config.artifact, "artifact");
+  if (evidence.sha256 !== config.evidence.sha256) throw new Error("evidence SHA-256 does not match promotion config");
+
+  const manifest = buildRuntimeArtifactManifest({
+    ...config.manifest,
+    filename: config.artifact.filename,
+    sha256: artifact.sha256,
+    sizeBytes: artifact.sizeBytes,
+    promotion: {
+      ...config.manifest.promotion,
+      authorityAppKey: input.authority,
+      evidenceSha256: evidence.sha256,
+    },
+  });
+  const envelope = signRuntimeArtifactManifest(manifest, input.privateKey, input.keyId);
+  const isR2 = manifest.distribution.delivery !== "bundled";
+  const steps = isR2
+    ? ["upload immutable object", "register signed envelope", "replace stable pointer"]
+    : ["register signed envelope"];
+  if (input.dryRun) return { envelope, steps };
+  if (typeof register !== "function") throw new Error("RightApps registration boundary is required");
+  if (isR2 && typeof upload !== "function") throw new Error("R2 upload boundary is required");
+
+  if (isR2) {
+    await upload({
+      purpose: "object",
+      file: input.artifactFile,
+      key: manifest.object.r2Key,
+      lane: manifest.distribution.delivery,
+    });
+  }
+  await register(envelope);
+  if (isR2) {
+    await upload({
+      purpose: "pointer",
+      content: `${JSON.stringify(envelope)}\n`,
+      key: manifest.pointerKey,
+      lane: manifest.distribution.delivery,
+    });
+  }
+  return { envelope, steps };
+}
+
+export function defaultWindowsRuntimeArtifactSigningKeyFile(env = process.env) {
+  const appData = env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+  return path.join(appData, "RightKit", "runtime-artifact-signing-key.pem");
+}
+
+export async function loadRuntimeArtifactSigningKey({ env = process.env, platform = process.platform, explicitFile } = {}) {
+  const direct = env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY;
+  if (direct?.trim()) return direct.replace(/\\n/g, "\n");
+  const configuredFile = explicitFile || env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE;
+  if (configuredFile) return readNonemptySecret(path.resolve(configuredFile));
+  if (platform === "win32") return readNonemptySecret(defaultWindowsRuntimeArtifactSigningKeyFile(env));
+  throw new Error("RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY or RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE is required");
+}
+
+export function runtimeArtifactUploadEnv(source = process.env) {
+  const env = { ...source };
+  delete env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY;
+  delete env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE;
+  delete env.RIGHTAPPS_RELEASE_TOKEN;
+  delete env.RIGHTAPPS_RELEASE_TOKEN_FILE;
+  return env;
+}
+
+async function main() {
+  if (process.argv.slice(2).some((arg) => arg === "--help" || arg === "-h")) {
+    printHelp();
+    return;
+  }
+  const args = parseArgs(process.argv.slice(2));
+  const configPath = path.resolve(args.config);
+  const configRoot = path.dirname(configPath);
+  const raw = JSON.parse(await readFile(configPath, "utf8"));
+  assertExactKeys(raw, ["artifact", "evidence", "manifest"], "promotion config");
+  assertExactKeys(raw.artifact, ["file", "filename", "sha256", "sizeBytes"], "artifact");
+  assertExactKeys(raw.evidence, ["file", "sha256"], "evidence");
+  const config = {
+    artifact: {
+      filename: raw.artifact.filename,
+      sha256: raw.artifact.sha256,
+      sizeBytes: raw.artifact.sizeBytes,
+    },
+    evidence: { sha256: raw.evidence.sha256 },
+    manifest: raw.manifest,
+  };
+  const privateKey = await loadRuntimeArtifactSigningKey({ explicitFile: args.signingKeyFile });
+  const releaseToken = args.dryRun ? null : await loadReleaseToken();
+  const runtime = {
+    metadata: fileMetadata,
+    upload: defaultUpload,
+    register: (envelope) => registerRuntimeArtifact(envelope, releaseToken),
+  };
+  const result = await promoteRuntimeArtifact({
+    authority: args.authority,
+    keyId: args.keyId,
+    privateKey,
+    artifactFile: path.resolve(configRoot, raw.artifact.file),
+    evidenceFile: path.resolve(configRoot, raw.evidence.file),
+    config,
+    dryRun: args.dryRun,
+  }, runtime);
+  const manifest = result.envelope.manifest;
+  console.log(`${args.dryRun ? "[dry-run] " : ""}runtime artifact promotion validated`);
+  console.log(`  app/kind: ${manifest.entitlement.appKey}/${manifest.artifactKind}`);
+  console.log(`  target: ${manifest.target.os}/${manifest.target.arch}`);
+  console.log(`  delivery: ${manifest.distribution.delivery}`);
+  console.log(`  object sha256: ${manifest.object.sha256}`);
+  console.log(`  pointer: ${manifest.pointerKey ?? "bundled"}`);
+  console.log(`  order: ${result.steps.join(" -> ")}`);
+}
+
+function printHelp() {
+  console.log(`right-release model promote --authority heardright --config <promotion.json> [options]
+
+The JSON config has exactly:
+  artifact: { file, filename, sha256, sizeBytes }
+  evidence: { file, sha256 }
+  manifest: { artifactKind, entitlement, distribution, target, versions, provenance,
+              promotion: { promotionId, promotedAt } }
+artifact.file and evidence.file resolve relative to the config; artifact.sha256,
+artifact.sizeBytes, and evidence.sha256 must exactly match those files.
+
+Options:
+  --dry-run                 Validate real files and sign, without R2 or RightApps mutations
+  --signing-key-file <pem>  Override the protected PEM path
+  --key-id <id>             Must equal ${RUNTIME_ARTIFACT_TRUSTED_KEY_ID}
+
+Signing key inputs (never printed): RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY or
+RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE. Windows defaults to
+%APPDATA%/RightKit/runtime-artifact-signing-key.pem. Live promotion also uses
+the durable RIGHTAPPS_RELEASE_TOKEN boundary.`);
+}
+
+function parseArgs(args) {
+  let authority = "";
+  let config = "";
+  let signingKeyFile;
+  let keyId = process.env.RIGHTKIT_RUNTIME_ARTIFACT_KEY_ID || RUNTIME_ARTIFACT_TRUSTED_KEY_ID;
+  let dryRun = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--authority") authority = args[++i] ?? "";
+    else if (arg === "--config") config = args[++i] ?? "";
+    else if (arg === "--signing-key-file") signingKeyFile = args[++i] ?? "";
+    else if (arg === "--key-id") keyId = args[++i] ?? "";
+    else if (arg === "--dry-run") dryRun = true;
+    else throw new Error(`unknown model promote argument: ${arg}`);
+  }
+  if (!config) throw new Error("model promote requires --config <path>");
+  if (!authority) throw new Error("model promote requires --authority heardright");
+  return { authority, config, signingKeyFile, keyId, dryRun };
+}
+
+async function fileMetadata(file) {
+  const info = await stat(file);
+  if (!info.isFile() || info.size <= 0) throw new Error(`promotion input is not a nonempty file: ${file}`);
+  const hash = createHash("sha256");
+  await new Promise((resolve, reject) => {
+    const stream = createReadStream(file);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", resolve);
+  });
+  return { sha256: hash.digest("hex"), sizeBytes: info.size };
+}
+
+async function defaultUpload({ file, content, key, lane }) {
+  const bucketAlias = lane === "private-r2" ? "private" : "public";
+  const env = runtimeArtifactUploadEnv();
+  if (file) return run(process.execPath, [UPLOAD, file, key, bucketAlias], env);
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), "rightkit-runtime-pointer-"));
+  const pointerFile = path.join(tempRoot, "manifest.json");
+  try {
+    await writeFile(pointerFile, content, { encoding: "utf8", mode: 0o600 });
+    await run(process.execPath, [UPLOAD, pointerFile, key, bucketAlias], env);
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+async function registerRuntimeArtifact(envelope, releaseToken) {
+  return registerRightAppsRelease("/v1/admin/apps/runtime-artifacts", envelope, { token: releaseToken });
+}
+
+function run(command, args, env = process.env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { cwd: process.cwd(), env, stdio: "inherit", windowsHide: true });
+    child.on("error", reject);
+    child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`${command} exited ${code}`)));
+  });
+}
+
+async function readNonemptySecret(file) {
+  const value = await readFile(file, "utf8");
+  if (!value.trim()) throw new Error(`runtime artifact signing key file is empty: ${file}`);
+  return value;
+}
+
+function assertPromotionConfig(value) {
+  assertExactKeys(value, ["artifact", "evidence", "manifest"], "promotion config");
+  assertExactKeys(value.artifact, ["filename", "sha256", "sizeBytes"], "artifact");
+  assertExactKeys(value.evidence, ["sha256"], "evidence");
+  assertExactKeys(value.manifest, [
+    "artifactKind", "entitlement", "distribution", "target", "versions", "provenance", "promotion",
+  ], "manifest config");
+  assertExactKeys(value.manifest.promotion, ["promotionId", "promotedAt"], "manifest config promotion");
+}
+
+function assertMetadata(actual, expected, label) {
+  if (actual.sha256 !== expected.sha256) throw new Error(`${label} SHA-256 does not match promotion config`);
+  if (actual.sizeBytes !== expected.sizeBytes) throw new Error(`${label} size does not match promotion config`);
+}
+
+function assertExactKeys(value, expected, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+  const allowed = new Set(expected);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`${label} has unknown field ${key}`);
+  for (const key of expected) if (!Object.hasOwn(value, key)) throw new Error(`${label}.${key} is required`);
+}
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
+  main().catch((error) => {
+    console.error(`right-release model promote: ${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/model-promote.test.mjs

@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import { createHash, generateKeyPairSync } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+import {
+  RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
+  defaultWindowsRuntimeArtifactSigningKeyFile,
+  loadRuntimeArtifactSigningKey,
+  promoteRuntimeArtifact,
+  runtimeArtifactUploadEnv,
+} from "./model-promote.mjs";
+
+const { privateKey } = generateKeyPairSync("ed25519");
+const artifactDigest = "a".repeat(64);
+const evidenceDigest = "b".repeat(64);
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+
+function request(overrides = {}) {
+  return {
+    authority: "heardright",
+    privateKey,
+    keyId: RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
+    artifactFile: "C:/fixtures/parakeet.onnx",
+    evidenceFile: "C:/fixtures/eval.json",
+    config: {
+      artifact: {
+        filename: "parakeet.onnx",
+        sha256: artifactDigest,
+        sizeBytes: 42,
+      },
+      evidence: { sha256: evidenceDigest },
+      manifest: {
+        artifactKind: "asr-model",
+        entitlement: { appKey: "scraperight", tier: "pro" },
+        distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+        target: { os: "windows", arch: "x86_64" },
+        versions: {
+          runtime: "rightkit-asr-0.1.0",
+          model: "parakeet-tdt-0.6b-v3",
+          tokenizer: "sentencepiece-2026-07-14",
+          preprocessing: "rightkit-asr-0.1.0",
+          license: "cc-by-4.0",
+          provenance: "heardright-approved-2026-07-14",
+        },
+        provenance: {
+          source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
+          sourceRevision: "0123456789abcdef",
+          licenseId: "CC-BY-4.0",
+          noticeSha256: "c".repeat(64),
+        },
+        promotion: {
+          promotionId: "hr-asr-2026-07-14-001",
+          promotedAt: "2026-07-14T12:00:00.000Z",
+        },
+      },
+    },
+    ...overrides,
+  };
+}
+
+function boundaries(events) {
+  return {
+    metadata: async (file) => file.endsWith("eval.json")
+      ? { sha256: evidenceDigest, sizeBytes: 10 }
+      : { sha256: artifactDigest, sizeBytes: 42 },
+    upload: async ({ purpose }) => { events.push(`upload:${purpose}`); },
+    register: async () => { events.push("register"); },
+  };
+}
+
+test("uploads immutable object, registers signed envelope, then replaces stable pointer", async () => {
+  const events = [];
+  const result = await promoteRuntimeArtifact(request(), boundaries(events));
+
+  assert.deepEqual(events, ["upload:object", "register", "upload:pointer"]);
+  assert.equal(result.envelope.signature.keyId, RUNTIME_ARTIFACT_TRUSTED_KEY_ID);
+  assert.equal(result.envelope.manifest.object.sha256, artifactDigest);
+  assert.equal(result.envelope.manifest.promotion.evidenceSha256, evidenceDigest);
+  assert.match(result.envelope.manifest.pointerKey, /\/current\/manifest\.json$/);
+});
+
+test("dry-run validates and signs without invoking process or network boundaries", async () => {
+  const events = [];
+  const result = await promoteRuntimeArtifact(request({ dryRun: true }), boundaries(events));
+  assert.deepEqual(events, []);
+  assert.deepEqual(result.steps, ["upload immutable object", "register signed envelope", "replace stable pointer"]);
+  assert.equal(result.envelope.signature.algorithm, "Ed25519");
+});
+
+test("never registers or publishes a pointer after immutable upload failure", async () => {
+  const events = [];
+  const deps = boundaries(events);
+  deps.upload = async ({ purpose }) => {
+    events.push(`upload:${purpose}`);
+    throw new Error("R2 failed");
+  };
+  await assert.rejects(promoteRuntimeArtifact(request(), deps), /R2 failed/);
+  assert.deepEqual(events, ["upload:object"]);
+});
+
+test("never publishes a pointer when RightApps registration fails", async () => {
+  const events = [];
+  const deps = boundaries(events);
+  deps.register = async () => {
+    events.push("register");
+    throw new Error("registration failed");
+  };
+  await assert.rejects(promoteRuntimeArtifact(request(), deps), /registration failed/);
+  assert.deepEqual(events, ["upload:object", "register"]);
+});
+
+test("fails before mutation on digest, authority, key-id, or lane contradiction", async () => {
+  const badRequests = [
+    request({ authority: "scraperight" }),
+    request({ keyId: "untrusted-key" }),
+    request({ config: { ...request().config, artifact: { ...request().config.artifact, sha256: "d".repeat(64) } } }),
+    request({ config: {
+      ...request().config,
+      manifest: {
+        ...request().config.manifest,
+        entitlement: { appKey: "scraperight", tier: "public" },
+        distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
+      },
+    } }),
+    request({ config: {
+      ...request().config,
+      manifest: {
+        ...request().config.manifest,
+        promotion: {
+          ...request().config.manifest.promotion,
+          authorityAppKey: "scraperight",
+        },
+      },
+    } }),
+  ];
+  for (const input of badRequests) {
+    const events = [];
+    await assert.rejects(promoteRuntimeArtifact(input, boundaries(events)));
+    assert.deepEqual(events, []);
+  }
+});
+
+test("right-release routes model promote to the portable promotion lane", () => {
+  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--authority", "heardright"], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /model promote requires --config/);
+  assert.doesNotMatch(result.stderr, /unknown command/);
+});
+
+test("model promote help documents the portable config and secure key inputs", () => {
+  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--help"], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /artifact\.file/);
+  assert.match(result.stdout, /evidence\.sha256/);
+  assert.match(result.stdout, /RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE/);
+  assert.match(result.stdout, /RIGHTAPPS_RELEASE_TOKEN/);
+});
+
+test("portable CLI dry-run validates real files and signs without network mutation or secret output", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "rightkit-model-promote-test-"));
+  try {
+    const artifact = Buffer.from("tiny model fixture");
+    const evidence = Buffer.from('{"certified":true}');
+    const testKeys = generateKeyPairSync("ed25519");
+    const keyPem = testKeys.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    await Promise.all([
+      writeFile(path.join(root, "model.onnx"), artifact),
+      writeFile(path.join(root, "evidence.json"), evidence),
+      writeFile(path.join(root, "key.pem"), keyPem, { mode: 0o600 }),
+    ]);
+    const config = {
+      artifact: {
+        file: "model.onnx",
+        filename: "model.onnx",
+        sha256: createHash("sha256").update(artifact).digest("hex"),
+        sizeBytes: artifact.length,
+      },
+      evidence: {
+        file: "evidence.json",
+        sha256: createHash("sha256").update(evidence).digest("hex"),
+      },
+      manifest: request().config.manifest,
+    };
+    await writeFile(path.join(root, "promotion.json"), JSON.stringify(config));
+
+    const result = spawnSync(process.execPath, [
+      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
+      "--authority", "heardright",
+      "--config", path.join(root, "promotion.json"),
+      "--signing-key-file", path.join(root, "key.pem"),
+      "--dry-run",
+    ], { cwd: root, encoding: "utf8", windowsHide: true });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /\[dry-run\] runtime artifact promotion validated/);
+    assert.match(result.stdout, /upload immutable object -> register signed envelope -> replace stable pointer/);
+    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /BEGIN PRIVATE KEY/);
+    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /Uploading|POST https:/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("uses the canonical Windows signing-key path and supports a Keychain-fed PEM environment value", async () => {
+  assert.equal(
+    defaultWindowsRuntimeArtifactSigningKeyFile({ APPDATA: "C:/Users/test/AppData/Roaming" }),
+    path.join("C:/Users/test/AppData/Roaming", "RightKit", "runtime-artifact-signing-key.pem"),
+  );
+  assert.equal(
+    await loadRuntimeArtifactSigningKey({ env: { RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "line1\\nline2" }, platform: "darwin" }),
+    "line1\nline2",
+  );
+});
+
+test("does not forward signing or RightApps credentials into the Wrangler uploader process", () => {
+  const env = runtimeArtifactUploadEnv({
+    CLOUDFLARE_API_TOKEN: "cloudflare-token",
+    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "private-pem",
+    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE: "key.pem",
+    RIGHTAPPS_RELEASE_TOKEN: "release-token",
+    RIGHTAPPS_RELEASE_TOKEN_FILE: "release.token",
+  });
+  assert.equal(env.CLOUDFLARE_API_TOKEN, "cloudflare-token");
+  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY, undefined);
+  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE, undefined);
+  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN, undefined);
+  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN_FILE, undefined);
+});