@rightkit/release 0.2.20 → 0.2.22

package/model-promote.test.mjs

@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import { createHash, generateKeyPairSync } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+import {
+  RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
+  defaultWindowsRuntimeArtifactSigningKeyFile,
+  loadRuntimeArtifactSigningKey,
+  promoteRuntimeArtifact,
+  runtimeArtifactUploadEnv,
+} from "./model-promote.mjs";
+
+const { privateKey } = generateKeyPairSync("ed25519");
+const artifactDigest = "a".repeat(64);
+const evidenceDigest = "b".repeat(64);
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+
+function request(overrides = {}) {
+  return {
+    authority: "heardright",
+    privateKey,
+    keyId: RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
+    artifactFile: "C:/fixtures/parakeet.onnx",
+    evidenceFile: "C:/fixtures/eval.json",
+    config: {
+      artifact: {
+        filename: "parakeet.onnx",
+        sha256: artifactDigest,
+        sizeBytes: 42,
+      },
+      evidence: { sha256: evidenceDigest },
+      manifest: {
+        artifactKind: "asr-model",
+        entitlement: { appKey: "scraperight", tier: "pro" },
+        distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+        target: { os: "windows", arch: "x86_64" },
+        versions: {
+          runtime: "rightkit-asr-0.1.0",
+          model: "parakeet-tdt-0.6b-v3",
+          tokenizer: "sentencepiece-2026-07-14",
+          preprocessing: "rightkit-asr-0.1.0",
+          license: "cc-by-4.0",
+          provenance: "heardright-approved-2026-07-14",
+        },
+        provenance: {
+          source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
+          sourceRevision: "0123456789abcdef",
+          licenseId: "CC-BY-4.0",
+          noticeSha256: "c".repeat(64),
+        },
+        promotion: {
+          promotionId: "hr-asr-2026-07-14-001",
+          promotedAt: "2026-07-14T12:00:00.000Z",
+        },
+      },
+    },
+    ...overrides,
+  };
+}
+
+function boundaries(events) {
+  return {
+    metadata: async (file) => file.endsWith("eval.json")
+      ? { sha256: evidenceDigest, sizeBytes: 10 }
+      : { sha256: artifactDigest, sizeBytes: 42 },
+    upload: async ({ purpose }) => { events.push(`upload:${purpose}`); },
+    register: async () => { events.push("register"); },
+  };
+}
+
+test("uploads immutable object, registers signed envelope, then replaces stable pointer", async () => {
+  const events = [];
+  const result = await promoteRuntimeArtifact(request(), boundaries(events));
+
+  assert.deepEqual(events, ["upload:object", "register", "upload:pointer"]);
+  assert.equal(result.envelope.signature.keyId, RUNTIME_ARTIFACT_TRUSTED_KEY_ID);
+  assert.equal(result.envelope.manifest.object.sha256, artifactDigest);
+  assert.equal(result.envelope.manifest.promotion.evidenceSha256, evidenceDigest);
+  assert.match(result.envelope.manifest.pointerKey, /\/current\/manifest\.json$/);
+});
+
+test("dry-run validates and signs without invoking process or network boundaries", async () => {
+  const events = [];
+  const result = await promoteRuntimeArtifact(request({ dryRun: true }), boundaries(events));
+  assert.deepEqual(events, []);
+  assert.deepEqual(result.steps, ["upload immutable object", "register signed envelope", "replace stable pointer"]);
+  assert.equal(result.envelope.signature.algorithm, "Ed25519");
+});
+
+test("never registers or publishes a pointer after immutable upload failure", async () => {
+  const events = [];
+  const deps = boundaries(events);
+  deps.upload = async ({ purpose }) => {
+    events.push(`upload:${purpose}`);
+    throw new Error("R2 failed");
+  };
+  await assert.rejects(promoteRuntimeArtifact(request(), deps), /R2 failed/);
+  assert.deepEqual(events, ["upload:object"]);
+});
+
+test("never publishes a pointer when RightApps registration fails", async () => {
+  const events = [];
+  const deps = boundaries(events);
+  deps.register = async () => {
+    events.push("register");
+    throw new Error("registration failed");
+  };
+  await assert.rejects(promoteRuntimeArtifact(request(), deps), /registration failed/);
+  assert.deepEqual(events, ["upload:object", "register"]);
+});
+
+test("fails before mutation on digest, authority, key-id, or lane contradiction", async () => {
+  const badRequests = [
+    request({ authority: "scraperight" }),
+    request({ keyId: "untrusted-key" }),
+    request({ config: { ...request().config, artifact: { ...request().config.artifact, sha256: "d".repeat(64) } } }),
+    request({ config: {
+      ...request().config,
+      manifest: {
+        ...request().config.manifest,
+        entitlement: { appKey: "scraperight", tier: "public" },
+        distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
+      },
+    } }),
+    request({ config: {
+      ...request().config,
+      manifest: {
+        ...request().config.manifest,
+        promotion: {
+          ...request().config.manifest.promotion,
+          authorityAppKey: "scraperight",
+        },
+      },
+    } }),
+  ];
+  for (const input of badRequests) {
+    const events = [];
+    await assert.rejects(promoteRuntimeArtifact(input, boundaries(events)));
+    assert.deepEqual(events, []);
+  }
+});
+
+test("right-release routes model promote to the portable promotion lane", () => {
+  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--authority", "heardright"], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /model promote requires --config/);
+  assert.doesNotMatch(result.stderr, /unknown command/);
+});
+
+test("model promote help documents the portable config and secure key inputs", () => {
+  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--help"], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /artifact\.file/);
+  assert.match(result.stdout, /evidence\.sha256/);
+  assert.match(result.stdout, /RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE/);
+  assert.match(result.stdout, /RIGHTAPPS_RELEASE_TOKEN/);
+});
+
+test("portable CLI dry-run validates real files and signs without network mutation or secret output", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "rightkit-model-promote-test-"));
+  try {
+    const artifact = Buffer.from("tiny model fixture");
+    const evidence = Buffer.from('{"certified":true}');
+    const testKeys = generateKeyPairSync("ed25519");
+    const keyPem = testKeys.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    await Promise.all([
+      writeFile(path.join(root, "model.onnx"), artifact),
+      writeFile(path.join(root, "evidence.json"), evidence),
+      writeFile(path.join(root, "key.pem"), keyPem, { mode: 0o600 }),
+    ]);
+    const config = {
+      artifact: {
+        file: "model.onnx",
+        filename: "model.onnx",
+        sha256: createHash("sha256").update(artifact).digest("hex"),
+        sizeBytes: artifact.length,
+      },
+      evidence: {
+        file: "evidence.json",
+        sha256: createHash("sha256").update(evidence).digest("hex"),
+      },
+      manifest: request().config.manifest,
+    };
+    await writeFile(path.join(root, "promotion.json"), JSON.stringify(config));
+
+    const result = spawnSync(process.execPath, [
+      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
+      "--authority", "heardright",
+      "--config", path.join(root, "promotion.json"),
+      "--signing-key-file", path.join(root, "key.pem"),
+      "--dry-run",
+    ], { cwd: root, encoding: "utf8", windowsHide: true });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /\[dry-run\] runtime artifact promotion validated/);
+    assert.match(result.stdout, /upload immutable object -> register signed envelope -> replace stable pointer/);
+    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /BEGIN PRIVATE KEY/);
+    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /Uploading|POST https:/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("uses the canonical Windows signing-key path and supports a Keychain-fed PEM environment value", async () => {
+  assert.equal(
+    defaultWindowsRuntimeArtifactSigningKeyFile({ APPDATA: "C:/Users/test/AppData/Roaming" }),
+    path.join("C:/Users/test/AppData/Roaming", "RightKit", "runtime-artifact-signing-key.pem"),
+  );
+  assert.equal(
+    await loadRuntimeArtifactSigningKey({ env: { RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "line1\\nline2" }, platform: "darwin" }),
+    "line1\nline2",
+  );
+});
+
+test("does not forward signing or RightApps credentials into the Wrangler uploader process", () => {
+  const env = runtimeArtifactUploadEnv({
+    CLOUDFLARE_API_TOKEN: "cloudflare-token",
+    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "private-pem",
+    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE: "key.pem",
+    RIGHTAPPS_RELEASE_TOKEN: "release-token",
+    RIGHTAPPS_RELEASE_TOKEN_FILE: "release.token",
+  });
+  assert.equal(env.CLOUDFLARE_API_TOKEN, "cloudflare-token");
+  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY, undefined);
+  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE, undefined);
+  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN, undefined);
+  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN_FILE, undefined);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -14,6 +14,11 @@
     "*.py"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test *.test.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -23,8 +28,5 @@
     "url": "git+https://github.com/adrdsouza/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "scripts": {
-    "test": "node --test *.test.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs"
-  }
-}
+  "packageManager": "pnpm@11.12.0"
+}

package/publish-swift.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+// Publish RightKitSwift to a Swift package registry, gated exactly like `publish cargo`:
+// secret scan -> swift test -> release build -> deterministic source archive + hash ->
+// registry dry-run -> publish. Canonical source stays under tools/rightkit/swift; the
+// registry package is an output only. No Git distribution repo, no path/Git dependency.
+//
+// swift-tools is macOS/Linux only, so the plan builder, arg parser, and version check are
+// pure and unit-tested on any OS (publish-swift.test.mjs); the swift steps run where swift exists.
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { scanCrateForSecrets } from "./publish-cargo.mjs";
+
+const IDENTIFIER = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/i;
+
+export function parseSwiftPublishArgs(argv, env = process.env) {
+  const allowed = new Set(["--scope", "--url", "--dry-run", "--allow-dirty"]);
+  let scope = env.RIGHTKIT_SWIFT_REGISTRY_SCOPE ?? "rightsuite";
+  let url = env.RIGHTKIT_SWIFT_REGISTRY_URL ?? "";
+  let dryRun = false;
+  let allowDirty = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!allowed.has(arg)) throw new Error(`unexpected argument: ${arg}`);
+    if (arg === "--dry-run") dryRun = true;
+    else if (arg === "--allow-dirty") allowDirty = true;
+    else {
+      const value = argv[(index += 1)];
+      if (value === undefined) throw new Error(`${arg} needs a value`);
+      if (arg === "--scope") scope = value;
+      if (arg === "--url") url = value;
+    }
+  }
+  if (!IDENTIFIER.test(scope)) throw new Error(`invalid registry scope: ${scope}`);
+  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  if (!dryRun && !url) throw new Error("registry publish needs --url or RIGHTKIT_SWIFT_REGISTRY_URL");
+  return { scope, url, dryRun, allowDirty };
+}
+
+// The VERSION file is the single source of truth; Package.swift must name the package and the
+// version must be a clean semver so the registry archive is reproducible.
+export function readPackageIdentity(packageDir) {
+  const manifest = path.join(packageDir, "Package.swift");
+  if (!fs.existsSync(manifest)) throw new Error(`Package.swift not found: ${manifest}`);
+  const versionFile = path.join(packageDir, "VERSION");
+  if (!fs.existsSync(versionFile)) throw new Error(`VERSION not found: ${versionFile}`);
+  const version = fs.readFileSync(versionFile, "utf8").trim();
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`VERSION is not clean semver: "${version}"`);
+  }
+  const nameMatch = fs.readFileSync(manifest, "utf8").match(/name:\s*"([^"]+)"/);
+  if (!nameMatch) throw new Error("could not read package name from Package.swift");
+  return { name: nameMatch[1], version };
+}
+
+export function buildSwiftPublishPlan({ packageDir, scope, name, version, url, dryRun, allowDirty = false }) {
+  const packageId = `${scope}.${name}`;
+  const archive = path.join(packageDir, ".build", `${name}-${version}.zip`);
+  const plan = [
+    { label: "secret scan", internal: "secret-scan" },
+    { label: "tests", command: "swift", args: ["test", "--package-path", packageDir] },
+    { label: "release build", command: "swift", args: ["build", "-c", "release", "--package-path", packageDir] },
+    // Deterministic source archive; its bytes are what the registry stores, so hash it for the log.
+    { label: "source archive", command: "swift", args: ["package", "--package-path", packageDir, "archive-source", "-o", archive] },
+    { label: "archive hash", internal: "archive-hash", archive },
+  ];
+  if (dryRun) {
+    plan.push({ label: "registry dry-run (validate only)", internal: "dry-run-note", packageId, version });
+    return plan;
+  }
+  plan.push({
+    label: "registry publish",
+    command: "swift",
+    args: ["package-registry", "publish", packageId, version, "--url", url, "--package-path", packageDir],
+  });
+  return plan;
+}
+
+export function runSwiftPublish(options, execute = spawnSync) {
+  const packageDir = options.packageDir;
+  const { name, version } = readPackageIdentity(packageDir);
+  const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
+
+  for (const step of plan) {
+    process.stdout.write(`[right-release] swift ${step.label}\n`);
+    if (step.internal === "secret-scan") {
+      const violations = scanCrateForSecrets(packageDir);
+      if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
+      continue;
+    }
+    if (step.internal === "dry-run-note") {
+      process.stdout.write(`[right-release] dry-run OK: ${step.packageId} ${step.version} (not published)\n`);
+      continue;
+    }
+    if (step.internal === "archive-hash") {
+      const bytes = fs.readFileSync(step.archive);
+      process.stdout.write(`sha256 ${createHash("sha256").update(bytes).digest("hex")}  ${path.basename(step.archive)}\n`);
+      continue;
+    }
+    const result = execute(step.command, step.args, { cwd: packageDir, encoding: "utf8", windowsHide: true, stdio: "inherit" });
+    if (result.error) {
+      if (result.error.code === "ENOENT") {
+        throw new Error(`${step.command} not found — run publish swift on macOS/Linux with the Swift toolchain installed`);
+      }
+      throw result.error;
+    }
+    if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
+  }
+  return { name, version, published: !options.dryRun };
+}
+
+if (process.argv[1]?.endsWith("publish-swift.mjs")) {
+  try {
+    const options = parseSwiftPublishArgs(process.argv.slice(2));
+    const packageDir = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "../../swift/RightKitSwift");
+    runSwiftPublish({ ...options, packageDir });
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+  }
+}

package/publish-swift.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import { parseSwiftPublishArgs, buildSwiftPublishPlan, readPackageIdentity } from "./publish-swift.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(here, "../../swift/RightKitSwift");
+
+test("dry-run needs no url; publish requires one", () => {
+  assert.deepEqual(parseSwiftPublishArgs(["--dry-run"], {}), {
+    scope: "rightsuite", url: "", dryRun: true, allowDirty: false,
+  });
+  assert.throws(() => parseSwiftPublishArgs([], {}), /needs --url/);
+  assert.equal(parseSwiftPublishArgs(["--url", "https://reg.local"], {}).url, "https://reg.local");
+});
+
+test("env supplies scope and url; --allow-dirty is dry-run only", () => {
+  const parsed = parseSwiftPublishArgs([], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e", RIGHTKIT_SWIFT_REGISTRY_SCOPE: "acme" });
+  assert.deepEqual(parsed, { scope: "acme", url: "https://e", dryRun: false, allowDirty: false });
+  assert.throws(() => parseSwiftPublishArgs(["--allow-dirty"], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e" }), /only valid with --dry-run/);
+  assert.throws(() => parseSwiftPublishArgs(["--bogus"], {}), /unexpected argument/);
+});
+
+test("reads the real package identity from VERSION + Package.swift", () => {
+  const { name, version } = readPackageIdentity(packageDir);
+  assert.equal(name, "RightKitSwift");
+  assert.match(version, /^\d+\.\d+\.\d+/);
+});
+
+test("dry-run plan stops before publish; real plan ends with publish", () => {
+  const base = { packageDir, scope: "rightsuite", name: "RightKitSwift", version: "0.1.0", url: "https://reg.local" };
+  const dry = buildSwiftPublishPlan({ ...base, dryRun: true });
+  assert.equal(dry[0].internal, "secret-scan");
+  assert.ok(dry.some((s) => s.label === "tests" && s.command === "swift"));
+  assert.ok(!dry.some((s) => s.label === "registry publish"), "dry-run must not publish");
+
+  const real = buildSwiftPublishPlan({ ...base, dryRun: false });
+  const publish = real.at(-1);
+  assert.equal(publish.label, "registry publish");
+  assert.deepEqual(publish.args, [
+    "package-registry", "publish", "rightsuite.RightKitSwift", "0.1.0", "--url", "https://reg.local", "--package-path", packageDir,
+  ]);
+});

package/publish-update.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
 import { pruneReleaseObjects } from "./prune-r2.mjs";
 import { loadReleaseToken } from "./release-token.mjs";
+import { registerRightAppsRelease } from "./rightapps-register.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
@@ -272,18 +273,12 @@ function patchInstallerKey(artifact) {
 }
 
 async function register(route, body) {
-  if (!releaseToken) fail("RIGHTAPPS_RELEASE_TOKEN is required to register an update");
-  const response = await fetch(`${API_BASE}${route}`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${releaseToken}`,
-      "content-type": "application/json",
-      "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
-    },
-    body: JSON.stringify(body),
-  });
-  if (!response.ok) fail(`registration failed: ${response.status} ${await response.text()}`);
-  console.log(await response.text());
+  try {
+    const response = await registerRightAppsRelease(route, body, { token: releaseToken });
+    if (response !== null) console.log(typeof response === "string" ? response : JSON.stringify(response));
+  } catch (error) {
+    fail(error.message);
+  }
 }
 
 function fail(message) {

package/qa-contract.mjs

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+
+export function validateQaBackdoorContract(root, packageScripts = {}) {
+  if (!existsSync(path.join(root, "right-qa.config.mjs"))) return [];
+
+  const issues = [];
+  const cargoPath = path.join(root, "src-tauri", "Cargo.toml");
+  if (!existsSync(cargoPath)) return ["right-qa.config.mjs requires src-tauri/Cargo.toml"];
+
+  const cargoToml = readFileSync(cargoPath, "utf8");
+  const dependency = cargoToml.match(/tauri-plugin-wdio-webdriver\s*=\s*\{([^}]*)\}/s)?.[1] ?? "";
+  if (!dependency) issues.push("Cargo.toml must declare tauri-plugin-wdio-webdriver");
+  else if (!/optional\s*=\s*true/.test(dependency)) issues.push("tauri-plugin-wdio-webdriver must be optional");
+
+  const qaFeature = cargoToml.match(/qa-native\s*=\s*\[([^\]]*)\]/s)?.[1] ?? "";
+  if (!/dep:tauri-plugin-wdio-webdriver/.test(qaFeature)) {
+    issues.push("qa-native must enable dep:tauri-plugin-wdio-webdriver");
+  }
+
+  const rustSource = readRustSources(path.join(root, "src-tauri", "src")).replace(/\s+/g, " ");
+  if (!/cfg\s*\(\s*all\s*\(\s*not\s*\(\s*debug_assertions\s*\)\s*,\s*feature\s*=\s*"qa-native"\s*\)\s*\)/.test(rustSource)
+      || !/compile_error!/.test(rustSource)) {
+    issues.push("Rust must compile_error when qa-native is enabled outside debug builds");
+  }
+  if (!/cfg\s*\(\s*all\s*\(\s*debug_assertions\s*,\s*feature\s*=\s*"qa-native"\s*\)\s*\)/.test(rustSource)
+      || !/tauri_plugin_wdio_webdriver::init/.test(rustSource)) {
+    issues.push("WebDriver registration must require debug_assertions and qa-native");
+  }
+  if (!/RIGHTKIT_QA_NATIVE/.test(rustSource)) {
+    issues.push("WebDriver registration must also require RIGHTKIT_QA_NATIVE");
+  }
+
+  for (const [name, command] of Object.entries(packageScripts)) {
+    if (!/qa-native|RIGHTKIT_QA_NATIVE/.test(command)) continue;
+    if (/^(qa|test|dev)(:|$)/.test(name)) continue;
+    if (/(release|publish|build|dmg|installer|package)/i.test(name) || /\btauri\s+build\b/.test(command)) {
+      issues.push(`package script ${name} must not enable native QA`);
+    }
+  }
+  return issues;
+}
+
+export function assertQaBackdoorContract(root, packageScripts = {}) {
+  const issues = validateQaBackdoorContract(root, packageScripts);
+  if (issues.length) throw new Error(`production QA backdoor contract failed:\n- ${issues.join("\n- ")}`);
+}
+
+function readRustSources(root) {
+  if (!existsSync(root)) return "";
+  const files = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const absolute = path.join(dir, entry.name);
+      if (entry.isDirectory()) visit(absolute);
+      else if (entry.isFile() && entry.name.endsWith(".rs")) files.push(absolute);
+    }
+  };
+  visit(root);
+  return files.sort().map((file) => readFileSync(file, "utf8")).join("\n");
+}

package/qa-contract.test.mjs

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { validateQaBackdoorContract } from "./qa-contract.mjs";
+
+function fixture({ optional = true, releaseScript = "right-release release --tier patch" } = {}) {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-qa-"));
+  mkdirSync(path.join(root, "src-tauri", "src"), { recursive: true });
+  writeFileSync(path.join(root, "right-qa.config.mjs"), "export default {};\n");
+  writeFileSync(path.join(root, "src-tauri", "Cargo.toml"), `
+[features]
+qa-native = ["dep:tauri-plugin-wdio-webdriver"]
+[dependencies]
+tauri-plugin-wdio-webdriver = { version = "1.2.0", optional = ${optional} }
+`);
+  writeFileSync(path.join(root, "src-tauri", "src", "lib.rs"), `
+#[cfg(all(not(debug_assertions), feature = "qa-native"))]
+compile_error!("qa-native must never be enabled in release builds");
+#[cfg(all(debug_assertions, feature = "qa-native"))]
+fn qa_enabled() -> bool { std::env::var("RIGHTKIT_QA_NATIVE").as_deref() == Ok("1") }
+#[cfg(all(debug_assertions, feature = "qa-native"))]
+fn add_plugin() { tauri_plugin_wdio_webdriver::init(); }
+`);
+  return { root, scripts: { "qa:native": "tauri dev --features qa-native", "release:patch:win": releaseScript } };
+}
+
+test("accepts a debug-only, runtime-gated native QA surface", () => {
+  const value = fixture();
+  assert.deepEqual(validateQaBackdoorContract(value.root, value.scripts), []);
+});
+
+test("rejects a non-optional WebDriver plugin", () => {
+  const value = fixture({ optional: false });
+  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /must be optional/);
+});
+
+test("rejects release scripts that enable native QA", () => {
+  const value = fixture({ releaseScript: "tauri build --features qa-native" });
+  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /release:patch:win/);
+});
+
+test("does not impose native QA on an app before its config lands", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-no-qa-"));
+  assert.deepEqual(validateQaBackdoorContract(root, {}), []);
+});

package/release.mjs

@@ -5,6 +5,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
+import { assertQaBackdoorContract } from "./qa-contract.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -141,6 +142,8 @@ if (opts.upload && !target.publish) {
   }
 }
 
+sweepStaleRustArtifacts();
+
 console.log(`right-release: done (${Date.now() - started}ms)`);
 releaseLock.release();
 
@@ -160,6 +163,32 @@ async function mustExist(file, message) {
   await access(file).catch(() => fail(message));
 }
 
+// Post-release target/ hygiene: `cargo sweep --installed` deletes artifacts left
+// by toolchains rustup no longer has (each update orphans a multi-GB pile per
+// app) and never touches anything the current toolchains produced. Runs after
+// publish so it cannot race an artifact, and is best-effort: a missing
+// cargo-sweep or a sweep failure must never fail a release.
+function sweepStaleRustArtifacts() {
+  const candidates = [...new Set([root, workdir].flatMap((base) => [base, path.join(base, "src-tauri")]))];
+  const projects = candidates.filter((dir) => existsSync(path.join(dir, "target")));
+  for (const dir of projects) {
+    if (opts.dryRun) {
+      console.log(`dry-run: cargo sweep --installed ${dir}`);
+      continue;
+    }
+    try {
+      const result = spawnSync("cargo", ["sweep", "--installed", dir], { stdio: "inherit" });
+      if (result.status !== 0) {
+        console.log("right-release: stale-artifact sweep skipped (install with: cargo install cargo-sweep)");
+        return;
+      }
+    } catch {
+      console.log("right-release: stale-artifact sweep skipped (install with: cargo install cargo-sweep)");
+      return;
+    }
+  }
+}
+
 async function runInstall(pm, cwd) {
   if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd);
   else if (pm === "npm") await run("npm", ["ci"], cwd);
@@ -180,6 +209,7 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
+  assertQaBackdoorContract(root, scripts);
   const workflowDir = path.join(root, ".github", "workflows");
   if (existsSync(workflowDir)) {
     const workflows = await readdir(workflowDir);

package/release.test.mjs

@@ -264,6 +264,21 @@ test("Windows update re-signs the updater artifact after Azure code signing", ()
   assert.ok(publishAt > updaterAt, result.stdout);
 });
 
+test("release sweeps stale rust artifacts when a target dir exists", () => {
+  const config = fixture();
+  const dir = path.dirname(config);
+  mkdirSync(path.join(dir, "src-tauri", "target"), { recursive: true });
+  const result = run(config, "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /dry-run: cargo sweep --installed .*src-tauri/);
+});
+
+test("release skips the sweep when no target dir exists", () => {
+  const result = run(fixture(), "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /cargo sweep/);
+});
+
 test("release lock is single-flight and is cleaned after success", () => {
   const { dir, config } = lockFixture();
   const lockPath = path.join(dir, ".cache", "right-release", "mac.lock.json");