@rightkit/release 0.2.20 → 0.2.22

package/right-suite-contract.test.mjs

@@ -10,8 +10,13 @@ import {
   assertPublishedRightKitCargoDependencies,
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
+import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
 
 const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+// The Right Suite web layer's repo + filesystem path is `rightsites` post the 2026-07-15 naming lock;
+// a not-yet-renamed checkout may still have `rightapps`. Resolve whichever exists so the contract
+// passes on both. (The runtime service namespace stays `rightapps` — that is deliberately untouched.)
+const siteRepoDir = existsSync(path.join(workspace, "rightsites")) ? "rightsites" : "rightapps";
 const versionsPath = path.join(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "rightkit-versions.json");
 const versions = JSON.parse(readFileSync(versionsPath, "utf8"));
 const isolatedCargoHome = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-home-"));
@@ -21,7 +26,9 @@ const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
   { key: "heardright", root: "heardright/tauri-app-next", repoRoot: "heardright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac.sh"] },
+  // mac-dmg.mjs is the release file, as in HeardRight/CodeRight. build-mac.sh only delegates to it,
+  // so asserting the mirror call against the wrapper failed a pipeline that does mirror.
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
@@ -310,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.20");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.22");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
   assert.equal(versions.npm["@rightkit/tauri"], "0.1.0");
@@ -329,7 +336,7 @@ test("license v2 public vector is identical at every portable consumer boundary"
   );
   for (const relativePath of [
     "tools/rightkit/packages/license/test-vectors/license-v2.json",
-    "rightapps/packages/api/src/licensing/test-vectors/license-v2.json",
+    `${siteRepoDir}/packages/api/src/licensing/test-vectors/license-v2.json`,
     "scraperight/tests/fixtures/license-v2.json",
   ]) {
     assert.equal(
@@ -450,6 +457,12 @@ for (const app of apps) {
   });
 }
 
+test("HeardRight and ScrapeRight expose one locked ASR promotion adapter contract", async () => {
+  const heard = (await import(`${pathToFileURL(path.join(workspace, "heardright/tauri-app-next/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
+  const scrape = (await import(`${pathToFileURL(path.join(workspace, "scraperight/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
+  assert.equal(assertAsrAdapterPair(heard.runtimeArtifacts?.asr, scrape.runtimeArtifacts?.asr), true);
+});
+
 function findFiles(root, filename) {
   const found = [];
   const visit = (dir) => {
@@ -488,7 +501,7 @@ test("Right Suite has no hosted workflow files", () => {
 
 test("RightApps brand hosts expose app-keyed update manifest proxies", () => {
   for (const app of apps) {
-    const siteRoot = path.join(workspace, "rightapps", app.key);
+    const siteRoot = path.join(workspace, siteRepoDir, app.key);
     for (const route of ["patches", "latest"]) {
       const routeFile = path.join(siteRoot, "src", "routes", "releases", `${route}.json`, "index.ts");
       const source = readFileSync(routeFile, "utf8");

package/rightapps-register.mjs

@@ -0,0 +1,31 @@
+const DEFAULT_API_BASE = "https://api.spoares.com";
+const REGISTRATION_ROUTES = new Set([
+  "/v1/admin/apps/patches",
+  "/v1/admin/apps/releases",
+  "/v1/admin/apps/runtime-artifacts",
+]);
+
+export async function registerRightAppsRelease(route, body, {
+  token,
+  env = process.env,
+  fetchImpl = fetch,
+} = {}) {
+  if (!token?.trim()) throw new Error("RIGHTAPPS_RELEASE_TOKEN release token is required for RightApps registration");
+  if (!REGISTRATION_ROUTES.has(route)) {
+    throw new Error("RightApps registration route is not approved");
+  }
+  const apiBase = (env.RIGHTAPPS_API_URL || DEFAULT_API_BASE).replace(/\/$/, "");
+  const response = await fetchImpl(`${apiBase}${route}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token.trim()}`,
+      "content-type": "application/json",
+      "x-store-slug": env.RIGHTAPPS_STORE_SLUG || "rightapps",
+    },
+    body: JSON.stringify(body),
+  });
+  const text = await response.text();
+  if (!response.ok) throw new Error(`RightApps registration failed: ${response.status} ${text}`);
+  if (!text) return null;
+  try { return JSON.parse(text); } catch { return text; }
+}

package/rightapps-register.test.mjs

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { registerRightAppsRelease } from "./rightapps-register.mjs";
+
+test("registers through the shared durable release-token boundary", async () => {
+  const calls = [];
+  const response = await registerRightAppsRelease("/v1/admin/apps/runtime-artifacts", { schema: 1 }, {
+    token: "durable-token",
+    env: { RIGHTAPPS_API_URL: "https://rightapps.example", RIGHTAPPS_STORE_SLUG: "rightapps" },
+    fetchImpl: async (url, init) => {
+      calls.push({ url, init });
+      return { ok: true, text: async () => '{"id":"registered"}' };
+    },
+  });
+  assert.deepEqual(response, { id: "registered" });
+  assert.equal(calls[0].url, "https://rightapps.example/v1/admin/apps/runtime-artifacts");
+  assert.equal(calls[0].init.headers.authorization, "Bearer durable-token");
+});
+
+test("rejects absent durable token and non-admin registration paths before network", async () => {
+  let called = false;
+  const fetchImpl = async () => { called = true; };
+  await assert.rejects(registerRightAppsRelease("/v1/admin/apps/runtime-artifacts", {}, { token: "", fetchImpl }), /release token/i);
+  await assert.rejects(registerRightAppsRelease("https://evil.invalid", {}, { token: "token", fetchImpl }), /route/i);
+  await assert.rejects(registerRightAppsRelease("/v1/admin/apps/../../evil", {}, { token: "token", fetchImpl }), /route/i);
+  assert.equal(called, false);
+});

package/rightkit-versions.json

@@ -4,14 +4,23 @@
   "npm": {
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
-    "@rightkit/release": "0.2.20",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.22",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
   "cargo": {
     "rightkit-license": "0.1.2",
     "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
-  "stagedCargo": {}
+  "stagedCargo": {},
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.0"
+    }
+  }
 }

package/runtime-artifact-manifest.mjs

@@ -0,0 +1,247 @@
+import { sign as edSign, verify as edVerify } from "node:crypto";
+
+export const RUNTIME_ARTIFACT_SCHEMA = 1;
+export const RUNTIME_ARTIFACT_KINDS = Object.freeze([
+  "asr-model",
+  "ocr-model",
+  "ort-runtime",
+  "media-runtime",
+  "tokenizer",
+  "preprocessing",
+]);
+export const RIGHT_SUITE_APP_KEYS = Object.freeze([
+  "viewright",
+  "heardright",
+  "mailright",
+  "scraperight",
+  "coderight",
+]);
+
+const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios"]);
+const TARGET_ARCHES = new Set(["x86_64", "aarch64", "universal"]);
+const VERSION_FIELDS = Object.freeze([
+  "runtime",
+  "model",
+  "tokenizer",
+  "preprocessing",
+  "license",
+  "provenance",
+]);
+const SHA256 = /^[0-9a-f]{64}$/;
+
+export function buildRuntimeArtifactManifest(input) {
+  const entitlement = cloneObject(input.entitlement);
+  const target = cloneObject(input.target);
+  const manifest = {
+    schema: RUNTIME_ARTIFACT_SCHEMA,
+    artifactKind: input.artifactKind,
+    entitlement,
+    distribution: cloneObject(input.distribution),
+    target,
+    object: {
+      r2Key: "",
+      filename: input.filename,
+      sha256: input.sha256,
+      sizeBytes: input.sizeBytes,
+    },
+    pointerKey: "",
+    versions: cloneObject(input.versions),
+    provenance: cloneObject(input.provenance),
+    promotion: cloneObject(input.promotion),
+  };
+  if (manifest.distribution?.delivery === "bundled") {
+    manifest.object.r2Key = null;
+    manifest.pointerKey = null;
+  } else {
+    manifest.object.r2Key = runtimeArtifactObjectKey(manifest);
+    manifest.pointerKey = runtimeArtifactManifestPointerKey(manifest);
+  }
+  return validateRuntimeArtifactManifest(manifest);
+}
+
+export function runtimeArtifactObjectKey(value) {
+  const appKey = value?.entitlement?.appKey;
+  const digest = value?.object?.sha256 ?? value?.sha256;
+  const filename = value?.object?.filename ?? value?.filename;
+  assertAppKey(appKey, "entitlement.appKey");
+  assertSha256(digest, "object.sha256");
+  assertFilename(filename);
+  return `${appKey}/runtime-artifacts/objects/sha256/${digest}/${filename}`;
+}
+
+export function runtimeArtifactManifestPointerKey(value) {
+  const appKey = value?.entitlement?.appKey;
+  const kind = value?.artifactKind;
+  const os = value?.target?.os;
+  const arch = value?.target?.arch;
+  assertAppKey(appKey, "entitlement.appKey");
+  if (!RUNTIME_ARTIFACT_KINDS.includes(kind)) fail("artifactKind is unsupported");
+  if (!TARGET_OSES.has(os)) fail("target.os is unsupported");
+  if (!TARGET_ARCHES.has(arch)) fail("target.arch is unsupported");
+  return `${appKey}/runtime-artifacts/${kind}/${os}/${arch}/current/manifest.json`;
+}
+
+export function validateRuntimeArtifactManifest(value) {
+  assertPlainObject(value, "manifest");
+  assertExactKeys(value, [
+    "schema", "artifactKind", "entitlement", "distribution", "target", "object", "pointerKey",
+    "versions", "provenance", "promotion",
+  ], "manifest");
+  if (value.schema !== RUNTIME_ARTIFACT_SCHEMA) fail("schema must be 1");
+  if (!RUNTIME_ARTIFACT_KINDS.includes(value.artifactKind)) fail("artifactKind is unsupported");
+
+  assertPlainObject(value.entitlement, "entitlement");
+  assertExactKeys(value.entitlement, ["appKey", "tier"], "entitlement");
+  assertAppKey(value.entitlement.appKey, "entitlement.appKey");
+  if (!["pro", "public", "bundled"].includes(value.entitlement.tier)) fail("entitlement.tier is unsupported");
+
+  assertPlainObject(value.distribution, "distribution");
+  assertExactKeys(value.distribution, ["delivery", "bucket"], "distribution");
+  const laneContracts = {
+    "private-r2": { tier: "pro", bucket: "rightapps-updates" },
+    "public-r2": { tier: "public", bucket: "rightapps-downloads" },
+    bundled: { tier: "bundled", bucket: null },
+  };
+  const lane = laneContracts[value.distribution.delivery];
+  if (!lane) fail("distribution.delivery is unsupported");
+  if (value.entitlement.tier !== lane.tier || value.distribution.bucket !== lane.bucket) {
+    fail("distribution lane contradicts entitlement tier or bucket");
+  }
+  if (["asr-model", "ocr-model", "tokenizer"].includes(value.artifactKind)
+      && (value.distribution.delivery !== "private-r2" || value.entitlement.tier !== "pro")) {
+    fail("model artifacts must use private-r2 with Pro entitlement");
+  }
+
+  assertPlainObject(value.target, "target");
+  assertExactKeys(value.target, ["os", "arch"], "target");
+  if (!TARGET_OSES.has(value.target.os)) fail("target.os is unsupported");
+  if (!TARGET_ARCHES.has(value.target.arch)) fail("target.arch is unsupported");
+
+  assertPlainObject(value.object, "object");
+  assertExactKeys(value.object, ["r2Key", "filename", "sha256", "sizeBytes"], "object");
+  assertFilename(value.object.filename);
+  assertSha256(value.object.sha256, "object.sha256");
+  if (!Number.isSafeInteger(value.object.sizeBytes) || value.object.sizeBytes <= 0) fail("object.sizeBytes must be a positive safe integer");
+  if (value.distribution.delivery === "bundled") {
+    if (value.object.r2Key !== null || value.pointerKey !== null) fail("bundled artifacts must not claim R2 keys");
+  } else {
+    if (value.object.r2Key !== runtimeArtifactObjectKey(value)) fail("object.r2Key contradicts its immutable SHA-256 object key");
+    if (value.pointerKey !== runtimeArtifactManifestPointerKey(value)) fail("pointerKey must be the replace-only stable current manifest key");
+  }
+
+  assertPlainObject(value.versions, "versions");
+  assertExactKeys(value.versions, VERSION_FIELDS, "versions");
+  for (const field of VERSION_FIELDS) assertNonempty(value.versions[field], `versions.${field}`);
+
+  assertPlainObject(value.provenance, "provenance");
+  assertExactKeys(value.provenance, ["source", "sourceRevision", "licenseId", "noticeSha256"], "provenance");
+  assertHttpsUrl(value.provenance.source, "provenance.source");
+  assertNonempty(value.provenance.sourceRevision, "provenance.sourceRevision");
+  assertNonempty(value.provenance.licenseId, "provenance.licenseId");
+  assertSha256(value.provenance.noticeSha256, "provenance.noticeSha256");
+  if (normalizeLicense(value.versions.license) !== normalizeLicense(value.provenance.licenseId)) {
+    fail("license version contradicts provenance licenseId");
+  }
+
+  assertPlainObject(value.promotion, "promotion");
+  assertExactKeys(value.promotion, ["authorityAppKey", "promotionId", "promotedAt", "evidenceSha256"], "promotion");
+  assertAppKey(value.promotion.authorityAppKey, "promotion.authorityAppKey");
+  assertNonempty(value.promotion.promotionId, "promotion.promotionId");
+  const promotedAt = new Date(value.promotion.promotedAt);
+  if (Number.isNaN(promotedAt.getTime()) || promotedAt.toISOString() !== value.promotion.promotedAt) fail("promotion.promotedAt must be an exact ISO-8601 UTC timestamp");
+  assertSha256(value.promotion.evidenceSha256, "promotion.evidenceSha256");
+  return value;
+}
+
+export function canonicalRuntimeArtifactManifest(manifest) {
+  validateRuntimeArtifactManifest(manifest);
+  return JSON.stringify(sortDeep(manifest));
+}
+
+export function signRuntimeArtifactManifest(manifest, privateKey, keyId) {
+  assertNonempty(keyId, "signature.keyId");
+  const canonical = Buffer.from(canonicalRuntimeArtifactManifest(manifest), "utf8");
+  return {
+    manifest,
+    signature: {
+      algorithm: "Ed25519",
+      keyId,
+      value: edSign(null, canonical, privateKey).toString("base64url"),
+    },
+  };
+}
+
+export function verifyRuntimeArtifactEnvelope(value, publicKey) {
+  assertPlainObject(value, "envelope");
+  assertExactKeys(value, ["manifest", "signature"], "envelope");
+  validateRuntimeArtifactManifest(value.manifest);
+  assertPlainObject(value.signature, "signature");
+  assertExactKeys(value.signature, ["algorithm", "keyId", "value"], "signature");
+  if (value.signature.algorithm !== "Ed25519") fail("signature algorithm must be Ed25519");
+  assertNonempty(value.signature.keyId, "signature.keyId");
+  assertNonempty(value.signature.value, "signature.value");
+  let signature;
+  try {
+    signature = Buffer.from(value.signature.value, "base64url");
+  } catch {
+    fail("signature is not base64url");
+  }
+  if (signature.length !== 64 || !edVerify(null, Buffer.from(canonicalRuntimeArtifactManifest(value.manifest), "utf8"), publicKey, signature)) {
+    fail("signature verification failed");
+  }
+  return value.manifest;
+}
+
+function sortDeep(value) {
+  if (Array.isArray(value)) return value.map(sortDeep);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sortDeep(value[key])]));
+  }
+  return value;
+}
+
+function assertExactKeys(value, expected, label) {
+  const expectedSet = new Set(expected);
+  for (const key of Object.keys(value)) if (!expectedSet.has(key)) fail(`${label} has unknown field ${key}`);
+  for (const key of expected) if (!Object.hasOwn(value, key)) fail(`${label}.${key} is required`);
+}
+
+function assertPlainObject(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) fail(`${label} must be a plain object`);
+}
+
+function assertAppKey(value, label) {
+  if (!RIGHT_SUITE_APP_KEYS.includes(value)) fail(`${label} is not a Right Suite app`);
+}
+
+function assertFilename(value) {
+  assertNonempty(value, "object.filename");
+  if (value === "." || value === ".." || value.includes("/") || value.includes("\\") || value.includes("..")) fail("object.filename must be one safe basename");
+}
+
+function assertSha256(value, label) {
+  if (typeof value !== "string" || !SHA256.test(value)) fail(`${label} must be lowercase SHA-256`);
+}
+
+function assertNonempty(value, label) {
+  if (typeof value !== "string" || value.trim() !== value || value.length === 0) fail(`${label} must be a nonempty exact string`);
+}
+
+function assertHttpsUrl(value, label) {
+  assertNonempty(value, label);
+  let url;
+  try { url = new URL(value); } catch { fail(`${label} must be an HTTPS URL`); }
+  if (url.protocol !== "https:") fail(`${label} must be an HTTPS URL`);
+}
+
+function normalizeLicense(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+
+function cloneObject(value) {
+  return value && typeof value === "object" ? structuredClone(value) : value;
+}
+
+function fail(message) {
+  throw new Error(`invalid runtime artifact manifest: ${message}`);
+}

package/runtime-artifact-manifest.test.mjs

@@ -0,0 +1,128 @@
+import assert from "node:assert/strict";
+import { generateKeyPairSync } from "node:crypto";
+import test from "node:test";
+
+import {
+  buildRuntimeArtifactManifest,
+  runtimeArtifactManifestPointerKey,
+  runtimeArtifactObjectKey,
+  signRuntimeArtifactManifest,
+  validateRuntimeArtifactManifest,
+  verifyRuntimeArtifactEnvelope,
+} from "./runtime-artifact-manifest.mjs";
+
+const digest = "a".repeat(64);
+const evidenceDigest = "b".repeat(64);
+
+function validManifest(overrides = {}) {
+  return buildRuntimeArtifactManifest({
+    artifactKind: "asr-model",
+    filename: "parakeet-tdt-v3.onnx",
+    sha256: digest,
+    sizeBytes: 42,
+    entitlement: { appKey: "scraperight", tier: "pro" },
+    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+    target: { os: "windows", arch: "x86_64" },
+    versions: {
+      runtime: "onnxruntime-1.22.0",
+      model: "parakeet-tdt-0.6b-v3",
+      tokenizer: "sentencepiece-2026-07-14",
+      preprocessing: "rightkit-asr-0.1.0",
+      license: "cc-by-4.0",
+      provenance: "heardright-approved-2026-07-14",
+    },
+    provenance: {
+      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
+      sourceRevision: "0123456789abcdef",
+      licenseId: "CC-BY-4.0",
+      noticeSha256: "c".repeat(64),
+    },
+    promotion: {
+      authorityAppKey: "heardright",
+      promotionId: "hr-asr-2026-07-14-001",
+      promotedAt: "2026-07-14T12:00:00.000Z",
+      evidenceSha256: evidenceDigest,
+    },
+    ...overrides,
+  });
+}
+
+test("builds exact stable-pointer and immutable content-addressed object keys", () => {
+  const manifest = validManifest();
+  assert.equal(
+    manifest.pointerKey,
+    "scraperight/runtime-artifacts/asr-model/windows/x86_64/current/manifest.json",
+  );
+  assert.equal(
+    manifest.object.r2Key,
+    `scraperight/runtime-artifacts/objects/sha256/${digest}/parakeet-tdt-v3.onnx`,
+  );
+  assert.equal(runtimeArtifactManifestPointerKey(manifest), manifest.pointerKey);
+  assert.equal(runtimeArtifactObjectKey(manifest), manifest.object.r2Key);
+  assert.equal(validateRuntimeArtifactManifest(manifest), manifest);
+});
+
+test("signs and verifies the canonical manifest with Ed25519", () => {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const envelope = signRuntimeArtifactManifest(validManifest(), privateKey, "rightapps-runtime-2026-01");
+  assert.equal(envelope.signature.algorithm, "Ed25519");
+  assert.equal(verifyRuntimeArtifactEnvelope(envelope, publicKey).artifactKind, "asr-model");
+
+  const tampered = structuredClone(envelope);
+  tampered.manifest.object.sizeBytes += 1;
+  assert.throws(() => verifyRuntimeArtifactEnvelope(tampered, publicKey), /signature verification failed/);
+});
+
+test("fails closed on missing or contradictory digest, provenance, version, scope, and promotion metadata", () => {
+  const mutations = [
+    (m) => delete m.versions.tokenizer,
+    (m) => { m.versions.license = ""; },
+    (m) => delete m.provenance.sourceRevision,
+    (m) => { m.provenance.licenseId = "MIT"; },
+    (m) => { m.entitlement.tier = "free"; },
+    (m) => { m.object.sha256 = "d".repeat(64); },
+    (m) => { m.object.sizeBytes = 0; },
+    (m) => { m.pointerKey = "scraperight/runtime-artifacts/asr-model/windows/x86_64/v1/manifest.json"; },
+    (m) => { m.promotion.authorityAppKey = "unknown"; },
+    (m) => { m.promotion.evidenceSha256 = "not-a-digest"; },
+  ];
+  for (const mutate of mutations) {
+    const manifest = structuredClone(validManifest());
+    mutate(manifest);
+    assert.throws(() => validateRuntimeArtifactManifest(manifest));
+  }
+});
+
+test("rejects unknown fields and path traversal instead of guessing", () => {
+  const extra = structuredClone(validManifest());
+  extra.secretUrl = "https://example.invalid/token";
+  assert.throws(() => validateRuntimeArtifactManifest(extra), /unknown field/);
+  assert.throws(() => validManifest({ filename: "../model.onnx" }), /filename/);
+});
+
+test("requires an explicit compatible entitlement and delivery lane per artifact", () => {
+  const publicMedia = validManifest({
+    artifactKind: "media-runtime",
+    entitlement: { appKey: "scraperight", tier: "public" },
+    distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
+  });
+  assert.equal(publicMedia.distribution.delivery, "public-r2");
+
+  const bundledOrt = validManifest({
+    artifactKind: "ort-runtime",
+    entitlement: { appKey: "viewright", tier: "bundled" },
+    distribution: { delivery: "bundled", bucket: null },
+  });
+  assert.equal(bundledOrt.pointerKey, null);
+  assert.equal(bundledOrt.object.r2Key, null);
+
+  assert.throws(() => validManifest({
+    entitlement: { appKey: "scraperight", tier: "public" },
+    distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
+  }), /model.*private-r2.*pro/i);
+  assert.throws(() => validManifest({
+    artifactKind: "media-runtime",
+    entitlement: { appKey: "scraperight", tier: "public" },
+    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+  }), /contradict/);
+});

package/standalone-clone-verify.mjs

@@ -0,0 +1,131 @@
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+export const DEFAULT_APPS = Object.freeze([
+  { key: "viewright", remote: "https://github.com/bogusyogi/viewright.git", appDir: "." },
+  { key: "scraperight", remote: "https://github.com/bogusyogi/scraperight.git", appDir: "." },
+  { key: "heardright", remote: "https://github.com/bogusyogi/heardright.git", appDir: "tauri-app-next" },
+  { key: "mailright", remote: "https://github.com/bogusyogi/mailright.git", appDir: "." },
+  { key: "coderight", remote: "https://github.com/bogusyogi/coderight.git", appDir: "apps/coderight-tauri" },
+]);
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 16 * 1024 * 1024,
+    env: { ...process.env, CI: "1", GIT_TERMINAL_PROMPT: "0" },
+  });
+  return {
+    command: [command, ...args].join(" "),
+    status: result.status,
+    stdout: String(result.stdout ?? "").trim().slice(-8000),
+    stderr: String(result.stderr ?? "").trim().slice(-8000),
+    error: result.error?.message,
+  };
+}
+
+function runPnpm(args, cwd, command) {
+  if (process.platform !== "win32" || command !== "pnpm") return run(command, args, cwd);
+  for (const entry of String(process.env.PATH ?? "").split(path.delimiter)) {
+    const cli = path.join(entry.replace(/^"|"$/g, ""), "node_modules", "pnpm", "bin", "pnpm.mjs");
+    if (existsSync(cli)) return run(process.execPath, [cli, ...args], cwd);
+  }
+  throw new Error("pnpm installation could not be resolved from PATH");
+}
+
+function requireSuccess(result, label) {
+  if (result.status !== 0) {
+    throw new Error(`${label} failed (${result.status ?? "spawn error"})\n${result.stderr || result.stdout || result.error || "no output"}`);
+  }
+}
+
+function assertGeneratedWorkRoot(workRoot, tempParent) {
+  const parent = path.resolve(tempParent);
+  const candidate = path.resolve(workRoot);
+  if (path.dirname(candidate) !== parent || !path.basename(candidate).startsWith("rightkit-standalone-")) {
+    throw new Error(`refusing cleanup outside generated standalone directory: ${candidate}`);
+  }
+}
+
+export async function verifyStandaloneClones({
+  apps = DEFAULT_APPS,
+  evidencePath = path.resolve("standalone-clone-evidence.json"),
+  tempParent = tmpdir(),
+  pnpmCommand = "pnpm",
+} = {}) {
+  mkdirSync(tempParent, { recursive: true });
+  const workRoot = mkdtempSync(path.join(path.resolve(tempParent), "rightkit-standalone-"));
+  const evidence = { schemaVersion: 1, generatedAt: new Date().toISOString(), workRoot, apps: [] };
+
+  try {
+    for (const app of apps) {
+      const cloneRoot = path.join(workRoot, app.key);
+      const clone = run("git", ["clone", "--depth", "1", "--single-branch", app.remote, cloneRoot], workRoot);
+      requireSuccess(clone, `${app.key} clone`);
+      const appRoot = path.resolve(cloneRoot, app.appDir);
+      if (!appRoot.startsWith(`${path.resolve(cloneRoot)}${path.sep}`) && appRoot !== path.resolve(cloneRoot)) {
+        throw new Error(`${app.key} package root escapes its clone`);
+      }
+      if (!existsSync(path.join(appRoot, "package.json"))) throw new Error(`${app.key} package root does not exist: ${app.appDir}`);
+      const pkg = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8"));
+      const expectedPnpm = String(pkg.packageManager ?? "").match(/^pnpm@(\d+\.\d+\.\d+)$/)?.[1];
+      if (!expectedPnpm) throw new Error(`${app.key} must pin an exact pnpm packageManager`);
+      const pnpmVersion = runPnpm(["--version"], appRoot, pnpmCommand);
+      requireSuccess(pnpmVersion, `${app.key} pnpm version`);
+      if (pnpmVersion.stdout !== expectedPnpm) {
+        throw new Error(`${app.key} requires pnpm ${expectedPnpm}, found ${pnpmVersion.stdout}`);
+      }
+      const install = runPnpm(["install", "--frozen-lockfile"], appRoot, pnpmCommand);
+      requireSuccess(install, `${app.key} pnpm install`);
+      const doctor = runPnpm(["release:doctor"], appRoot, pnpmCommand);
+      requireSuccess(doctor, `${app.key} release:doctor`);
+      const revision = run("git", ["rev-parse", "HEAD"], cloneRoot);
+      requireSuccess(revision, `${app.key} revision`);
+      evidence.apps.push({
+        key: app.key,
+        remote: app.remote,
+        appDir: app.appDir,
+        revision: revision.stdout,
+        packageManager: pkg.packageManager,
+        clone,
+        install,
+        doctor,
+      });
+      mkdirSync(path.dirname(path.resolve(evidencePath)), { recursive: true });
+      writeFileSync(path.resolve(evidencePath), `${JSON.stringify(evidence, null, 2)}\n`, "utf8");
+    }
+    return evidence;
+  } finally {
+    assertGeneratedWorkRoot(workRoot, tempParent);
+    rmSync(workRoot, { recursive: true, force: true });
+  }
+}
+
+function parseArgs(argv) {
+  let evidencePath = path.resolve("standalone-clone-evidence.json");
+  let selectedKeys = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] === "--evidence") evidencePath = path.resolve(argv[++index]);
+    else if (argv[index] === "--app") selectedKeys.push(argv[++index]);
+    else throw new Error(`unknown argument: ${argv[index]}`);
+  }
+  const apps = selectedKeys.length ? DEFAULT_APPS.filter(({ key }) => selectedKeys.includes(key)) : DEFAULT_APPS;
+  if (apps.length !== (selectedKeys.length || DEFAULT_APPS.length)) throw new Error("unknown or duplicate --app value");
+  return { apps, evidencePath };
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try {
+    const evidence = await verifyStandaloneClones(parseArgs(process.argv.slice(2)));
+    for (const app of evidence.apps) process.stdout.write(`[standalone] ${app.key} ${app.revision.slice(0, 12)} install+doctor passed\n`);
+    process.stdout.write(`[standalone] evidence ${path.resolve(parseArgs(process.argv.slice(2)).evidencePath)}\n`);
+  } catch (error) {
+    process.stderr.write(`[standalone] ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}