@rightkit/release 0.2.21 → 0.2.22

package/asr-artifact-adoption.mjs

@@ -0,0 +1,68 @@
+import { isDeepStrictEqual } from "node:util";
+
+import { verifyRuntimeArtifactEnvelope } from "./runtime-artifact-manifest.mjs";
+
+const ASR_AUTHORITY = "heardright";
+const ASR_CONSUMER = "scraperight";
+const ASR_KIND = "asr-model";
+
+export function assertAsrArtifactAdoption({ authorityEnvelope, consumerEnvelope, publicKey, trustedKeyId }) {
+  const authority = verifyTrusted(authorityEnvelope, publicKey, trustedKeyId);
+  const consumer = verifyTrusted(consumerEnvelope, publicKey, trustedKeyId);
+
+  assertManifestRole(authority, ASR_AUTHORITY, "authority");
+  assertManifestRole(consumer, ASR_CONSUMER, "consumer");
+  for (const manifest of [authority, consumer]) {
+    if (manifest.artifactKind !== ASR_KIND) throw new Error("ASR adoption manifest must be an asr-model");
+    if (manifest.promotion.authorityAppKey !== ASR_AUTHORITY) throw new Error("ASR promotion authority must be heardright");
+  }
+
+  assertSame(authority.target, consumer.target, "target");
+  assertSame(authority.object.filename, consumer.object.filename, "object.filename");
+  assertSame(authority.object.sha256, consumer.object.sha256, "object.sha256");
+  assertSame(authority.object.sizeBytes, consumer.object.sizeBytes, "object.sizeBytes");
+  for (const field of ["runtime", "model", "tokenizer", "preprocessing", "license", "provenance"]) {
+    assertSame(authority.versions[field], consumer.versions[field], `versions.${field}`);
+  }
+  assertSame(authority.provenance, consumer.provenance, "provenance");
+  assertSame(authority.promotion, consumer.promotion, "promotion");
+  return {
+    sha256: authority.object.sha256,
+    promotionId: authority.promotion.promotionId,
+    target: authority.target,
+  };
+}
+
+export function assertAsrAdapterPair(authority, consumer) {
+  assertAdapter(authority, ASR_AUTHORITY, "authority");
+  assertAdapter(consumer, ASR_CONSUMER, "consumer");
+  for (const [field, expected] of [
+    ["authorityAppKey", ASR_AUTHORITY],
+    ["artifactKind", ASR_KIND],
+    ["delivery", "private-r2"],
+    ["entitlementTier", "pro"],
+  ]) {
+    assertSame(authority[field], expected, `authority adapter ${field}`);
+    assertSame(consumer[field], expected, `consumer adapter ${field}`);
+  }
+  return true;
+}
+
+function verifyTrusted(envelope, publicKey, trustedKeyId) {
+  if (envelope?.signature?.keyId !== trustedKeyId) throw new Error("untrusted runtime artifact key id");
+  return verifyRuntimeArtifactEnvelope(envelope, publicKey);
+}
+
+function assertManifestRole(manifest, appKey, role) {
+  if (manifest.entitlement.appKey !== appKey) throw new Error(`${role} manifest must belong to ${appKey}`);
+}
+
+function assertAdapter(value, appKey, role) {
+  if (!value || value.schema !== 1 || value.appKey !== appKey || value.role !== role) {
+    throw new Error(`invalid ${role} ASR adapter`);
+  }
+}
+
+function assertSame(left, right, field) {
+  if (!isDeepStrictEqual(left, right)) throw new Error(`ASR drift: ${field}`);
+}

package/asr-artifact-adoption.test.mjs

@@ -0,0 +1,122 @@
+import assert from "node:assert/strict";
+import { generateKeyPairSync } from "node:crypto";
+import test from "node:test";
+
+import { assertAsrAdapterPair, assertAsrArtifactAdoption } from "./asr-artifact-adoption.mjs";
+import { buildRuntimeArtifactManifest, signRuntimeArtifactManifest } from "./runtime-artifact-manifest.mjs";
+
+const digest = "a".repeat(64);
+const notice = "b".repeat(64);
+const evidence = "c".repeat(64);
+const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+
+function envelope(appKey, overrides = {}) {
+  const manifest = buildRuntimeArtifactManifest({
+    artifactKind: "asr-model",
+    entitlement: { appKey, tier: "pro" },
+    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+    target: { os: "windows", arch: "x86_64" },
+    filename: "parakeet-unified-en-0.6b.tar.zst",
+    sha256: digest,
+    sizeBytes: 1234,
+    versions: {
+      runtime: "rightkit-asr@0.1.0",
+      model: "parakeet-unified-en-0.6b",
+      tokenizer: "sha256:tokenizer-v1",
+      preprocessing: "heardright-frontend-v1",
+      license: "CC-BY-4.0",
+      provenance: "nvidia/parakeet-tdt-0.6b-v3",
+    },
+    provenance: {
+      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
+      sourceRevision: "revision-1",
+      licenseId: "CC-BY-4.0",
+      noticeSha256: notice,
+    },
+    promotion: {
+      authorityAppKey: "heardright",
+      promotionId: "hr-asr-2026-07-14",
+      promotedAt: "2026-07-14T00:00:00.000Z",
+      evidenceSha256: evidence,
+    },
+    ...overrides,
+  });
+  return signRuntimeArtifactManifest(manifest, privateKey, "rightkit-runtime-artifacts-2026-07");
+}
+
+test("accepts app-scoped pointers with one exact HeardRight-certified ASR identity", () => {
+  const result = assertAsrArtifactAdoption({
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: envelope("scraperight"),
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  });
+
+  assert.equal(result.sha256, digest);
+  assert.equal(result.promotionId, "hr-asr-2026-07-14");
+});
+
+test("rejects a validly signed ScrapeRight manifest with ASR drift", () => {
+  const drifted = envelope("scraperight", {
+    versions: {
+      runtime: "rightkit-asr@0.1.1",
+      model: "parakeet-unified-en-0.6b",
+      tokenizer: "sha256:tokenizer-v1",
+      preprocessing: "heardright-frontend-v1",
+      license: "CC-BY-4.0",
+      provenance: "nvidia/parakeet-tdt-0.6b-v3",
+    },
+  });
+
+  assert.throws(() => assertAsrArtifactAdoption({
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: drifted,
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  }), /ASR drift: versions\.runtime/);
+});
+
+test("rejects wrong roles, authority, target, signature key, and artifact kind", () => {
+  const base = {
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: envelope("scraperight"),
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  };
+  assert.throws(() => assertAsrArtifactAdoption({ ...base, authorityEnvelope: envelope("scraperight") }), /authority manifest must belong to heardright/);
+  assert.throws(() => assertAsrArtifactAdoption({ ...base, consumerEnvelope: envelope("heardright") }), /consumer manifest must belong to scraperight/);
+  assert.throws(() => assertAsrArtifactAdoption({ ...base, trustedKeyId: "rotated-without-app-update" }), /untrusted runtime artifact key id/);
+  assert.throws(() => assertAsrArtifactAdoption({
+    ...base,
+    consumerEnvelope: envelope("scraperight", { target: { os: "darwin", arch: "aarch64" } }),
+  }), /ASR drift: target/);
+  assert.throws(() => assertAsrArtifactAdoption({
+    ...base,
+    consumerEnvelope: envelope("scraperight", { artifactKind: "ocr-model" }),
+  }), /must be an asr-model/);
+});
+
+test("rejects a consumer signed by a different key", () => {
+  const other = generateKeyPairSync("ed25519");
+  const consumer = signRuntimeArtifactManifest(
+    envelope("scraperight").manifest,
+    other.privateKey,
+    "rightkit-runtime-artifacts-2026-07",
+  );
+  assert.throws(() => assertAsrArtifactAdoption({
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: consumer,
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  }), /signature verification failed/);
+});
+
+test("locks the thin app adapters to HeardRight authority and private Pro delivery", () => {
+  const authority = {
+    schema: 1, appKey: "heardright", role: "authority", authorityAppKey: "heardright",
+    artifactKind: "asr-model", delivery: "private-r2", entitlementTier: "pro",
+  };
+  const consumer = { ...authority, appKey: "scraperight", role: "consumer" };
+  assert.equal(assertAsrAdapterPair(authority, consumer), true);
+  assert.throws(() => assertAsrAdapterPair(authority, { ...consumer, authorityAppKey: "scraperight" }), /ASR drift/);
+});

package/cargo-contract.mjs

@@ -101,11 +101,34 @@ function assertNoRightKitOverrides(parsed, label, source) {
   }
 }
 
+// `tomllib` is Python 3.11+. Windows pins `py -3.11`, but a bare `python3` on macOS is the system
+// 3.9, which has no tomllib — so every app's release:doctor died on a stock Mac, and reported the
+// manifest as invalid TOML when the real problem was the interpreter. Probe for one that can.
+let tomlRunner;
+function resolveTomlRunner() {
+  if (tomlRunner) return tomlRunner;
+  const probe = "import sys,tomllib";
+  const candidates =
+    process.platform === "win32"
+      ? [["py", ["-3.11"]], ["py", ["-3"]], ["python", []]]
+      : [["python3.13", []], ["python3.12", []], ["python3.11", []], ["python3", []]];
+  for (const [command, prefix] of candidates) {
+    const check = spawnSync(command, [...prefix, "-c", probe], { encoding: "utf8", windowsHide: true });
+    if (check.status === 0) {
+      tomlRunner = { command, prefix };
+      return tomlRunner;
+    }
+  }
+  throw new Error(
+    "no Python with tomllib found (needs 3.11+). Install one, or put it on PATH: the release " +
+      "contract reads Cargo manifests through it.",
+  );
+}
+
 function readToml(file, label) {
   const script = "import json,pathlib,sys,tomllib; json.dump(tomllib.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')),sys.stdout,default=str)";
-  const command = process.platform === "win32" ? "py" : "python3";
-  const args = process.platform === "win32" ? ["-3.11", "-c", script, file] : ["-c", script, file];
-  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+  const { command, prefix } = resolveTomlRunner();
+  const result = spawnSync(command, [...prefix, "-c", script, file], { encoding: "utf8", windowsHide: true });
   if (result.status !== 0) throw new Error(`${label} is not valid TOML: ${String(result.stderr ?? "").trim()}`);
   return JSON.parse(result.stdout);
 }

package/cli/right-release.mjs

@@ -44,6 +44,8 @@ if (first === "--version" || first === "-v") {
   const rest = args.slice(1);
   if (rest[0] === "cargo") {
     run("publish-cargo.mjs", rest.slice(1));
+  } else if (rest[0] === "swift") {
+    run("publish-swift.mjs", rest.slice(1));
   } else {
     run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
   }
@@ -120,6 +122,7 @@ Commands:
   release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
   publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
+  publish swift [--scope <s>] [--url <u>] [--dry-run] Test, archive, scan, and publish RightKitSwift to a Swift registry
   model promote --authority heardright --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
   doctor [--platform mac|win]                        Inspect one app's release config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-swift.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+// Publish RightKitSwift to a Swift package registry, gated exactly like `publish cargo`:
+// secret scan -> swift test -> release build -> deterministic source archive + hash ->
+// registry dry-run -> publish. Canonical source stays under tools/rightkit/swift; the
+// registry package is an output only. No Git distribution repo, no path/Git dependency.
+//
+// swift-tools is macOS/Linux only, so the plan builder, arg parser, and version check are
+// pure and unit-tested on any OS (publish-swift.test.mjs); the swift steps run where swift exists.
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { scanCrateForSecrets } from "./publish-cargo.mjs";
+
+const IDENTIFIER = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/i;
+
+export function parseSwiftPublishArgs(argv, env = process.env) {
+  const allowed = new Set(["--scope", "--url", "--dry-run", "--allow-dirty"]);
+  let scope = env.RIGHTKIT_SWIFT_REGISTRY_SCOPE ?? "rightsuite";
+  let url = env.RIGHTKIT_SWIFT_REGISTRY_URL ?? "";
+  let dryRun = false;
+  let allowDirty = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!allowed.has(arg)) throw new Error(`unexpected argument: ${arg}`);
+    if (arg === "--dry-run") dryRun = true;
+    else if (arg === "--allow-dirty") allowDirty = true;
+    else {
+      const value = argv[(index += 1)];
+      if (value === undefined) throw new Error(`${arg} needs a value`);
+      if (arg === "--scope") scope = value;
+      if (arg === "--url") url = value;
+    }
+  }
+  if (!IDENTIFIER.test(scope)) throw new Error(`invalid registry scope: ${scope}`);
+  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  if (!dryRun && !url) throw new Error("registry publish needs --url or RIGHTKIT_SWIFT_REGISTRY_URL");
+  return { scope, url, dryRun, allowDirty };
+}
+
+// The VERSION file is the single source of truth; Package.swift must name the package and the
+// version must be a clean semver so the registry archive is reproducible.
+export function readPackageIdentity(packageDir) {
+  const manifest = path.join(packageDir, "Package.swift");
+  if (!fs.existsSync(manifest)) throw new Error(`Package.swift not found: ${manifest}`);
+  const versionFile = path.join(packageDir, "VERSION");
+  if (!fs.existsSync(versionFile)) throw new Error(`VERSION not found: ${versionFile}`);
+  const version = fs.readFileSync(versionFile, "utf8").trim();
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`VERSION is not clean semver: "${version}"`);
+  }
+  const nameMatch = fs.readFileSync(manifest, "utf8").match(/name:\s*"([^"]+)"/);
+  if (!nameMatch) throw new Error("could not read package name from Package.swift");
+  return { name: nameMatch[1], version };
+}
+
+export function buildSwiftPublishPlan({ packageDir, scope, name, version, url, dryRun, allowDirty = false }) {
+  const packageId = `${scope}.${name}`;
+  const archive = path.join(packageDir, ".build", `${name}-${version}.zip`);
+  const plan = [
+    { label: "secret scan", internal: "secret-scan" },
+    { label: "tests", command: "swift", args: ["test", "--package-path", packageDir] },
+    { label: "release build", command: "swift", args: ["build", "-c", "release", "--package-path", packageDir] },
+    // Deterministic source archive; its bytes are what the registry stores, so hash it for the log.
+    { label: "source archive", command: "swift", args: ["package", "--package-path", packageDir, "archive-source", "-o", archive] },
+    { label: "archive hash", internal: "archive-hash", archive },
+  ];
+  if (dryRun) {
+    plan.push({ label: "registry dry-run (validate only)", internal: "dry-run-note", packageId, version });
+    return plan;
+  }
+  plan.push({
+    label: "registry publish",
+    command: "swift",
+    args: ["package-registry", "publish", packageId, version, "--url", url, "--package-path", packageDir],
+  });
+  return plan;
+}
+
+export function runSwiftPublish(options, execute = spawnSync) {
+  const packageDir = options.packageDir;
+  const { name, version } = readPackageIdentity(packageDir);
+  const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
+
+  for (const step of plan) {
+    process.stdout.write(`[right-release] swift ${step.label}\n`);
+    if (step.internal === "secret-scan") {
+      const violations = scanCrateForSecrets(packageDir);
+      if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
+      continue;
+    }
+    if (step.internal === "dry-run-note") {
+      process.stdout.write(`[right-release] dry-run OK: ${step.packageId} ${step.version} (not published)\n`);
+      continue;
+    }
+    if (step.internal === "archive-hash") {
+      const bytes = fs.readFileSync(step.archive);
+      process.stdout.write(`sha256 ${createHash("sha256").update(bytes).digest("hex")}  ${path.basename(step.archive)}\n`);
+      continue;
+    }
+    const result = execute(step.command, step.args, { cwd: packageDir, encoding: "utf8", windowsHide: true, stdio: "inherit" });
+    if (result.error) {
+      if (result.error.code === "ENOENT") {
+        throw new Error(`${step.command} not found — run publish swift on macOS/Linux with the Swift toolchain installed`);
+      }
+      throw result.error;
+    }
+    if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
+  }
+  return { name, version, published: !options.dryRun };
+}
+
+if (process.argv[1]?.endsWith("publish-swift.mjs")) {
+  try {
+    const options = parseSwiftPublishArgs(process.argv.slice(2));
+    const packageDir = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "../../swift/RightKitSwift");
+    runSwiftPublish({ ...options, packageDir });
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+  }
+}

package/publish-swift.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import { parseSwiftPublishArgs, buildSwiftPublishPlan, readPackageIdentity } from "./publish-swift.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(here, "../../swift/RightKitSwift");
+
+test("dry-run needs no url; publish requires one", () => {
+  assert.deepEqual(parseSwiftPublishArgs(["--dry-run"], {}), {
+    scope: "rightsuite", url: "", dryRun: true, allowDirty: false,
+  });
+  assert.throws(() => parseSwiftPublishArgs([], {}), /needs --url/);
+  assert.equal(parseSwiftPublishArgs(["--url", "https://reg.local"], {}).url, "https://reg.local");
+});
+
+test("env supplies scope and url; --allow-dirty is dry-run only", () => {
+  const parsed = parseSwiftPublishArgs([], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e", RIGHTKIT_SWIFT_REGISTRY_SCOPE: "acme" });
+  assert.deepEqual(parsed, { scope: "acme", url: "https://e", dryRun: false, allowDirty: false });
+  assert.throws(() => parseSwiftPublishArgs(["--allow-dirty"], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e" }), /only valid with --dry-run/);
+  assert.throws(() => parseSwiftPublishArgs(["--bogus"], {}), /unexpected argument/);
+});
+
+test("reads the real package identity from VERSION + Package.swift", () => {
+  const { name, version } = readPackageIdentity(packageDir);
+  assert.equal(name, "RightKitSwift");
+  assert.match(version, /^\d+\.\d+\.\d+/);
+});
+
+test("dry-run plan stops before publish; real plan ends with publish", () => {
+  const base = { packageDir, scope: "rightsuite", name: "RightKitSwift", version: "0.1.0", url: "https://reg.local" };
+  const dry = buildSwiftPublishPlan({ ...base, dryRun: true });
+  assert.equal(dry[0].internal, "secret-scan");
+  assert.ok(dry.some((s) => s.label === "tests" && s.command === "swift"));
+  assert.ok(!dry.some((s) => s.label === "registry publish"), "dry-run must not publish");
+
+  const real = buildSwiftPublishPlan({ ...base, dryRun: false });
+  const publish = real.at(-1);
+  assert.equal(publish.label, "registry publish");
+  assert.deepEqual(publish.args, [
+    "package-registry", "publish", "rightsuite.RightKitSwift", "0.1.0", "--url", "https://reg.local", "--package-path", packageDir,
+  ]);
+});

package/qa-contract.mjs

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+
+export function validateQaBackdoorContract(root, packageScripts = {}) {
+  if (!existsSync(path.join(root, "right-qa.config.mjs"))) return [];
+
+  const issues = [];
+  const cargoPath = path.join(root, "src-tauri", "Cargo.toml");
+  if (!existsSync(cargoPath)) return ["right-qa.config.mjs requires src-tauri/Cargo.toml"];
+
+  const cargoToml = readFileSync(cargoPath, "utf8");
+  const dependency = cargoToml.match(/tauri-plugin-wdio-webdriver\s*=\s*\{([^}]*)\}/s)?.[1] ?? "";
+  if (!dependency) issues.push("Cargo.toml must declare tauri-plugin-wdio-webdriver");
+  else if (!/optional\s*=\s*true/.test(dependency)) issues.push("tauri-plugin-wdio-webdriver must be optional");
+
+  const qaFeature = cargoToml.match(/qa-native\s*=\s*\[([^\]]*)\]/s)?.[1] ?? "";
+  if (!/dep:tauri-plugin-wdio-webdriver/.test(qaFeature)) {
+    issues.push("qa-native must enable dep:tauri-plugin-wdio-webdriver");
+  }
+
+  const rustSource = readRustSources(path.join(root, "src-tauri", "src")).replace(/\s+/g, " ");
+  if (!/cfg\s*\(\s*all\s*\(\s*not\s*\(\s*debug_assertions\s*\)\s*,\s*feature\s*=\s*"qa-native"\s*\)\s*\)/.test(rustSource)
+      || !/compile_error!/.test(rustSource)) {
+    issues.push("Rust must compile_error when qa-native is enabled outside debug builds");
+  }
+  if (!/cfg\s*\(\s*all\s*\(\s*debug_assertions\s*,\s*feature\s*=\s*"qa-native"\s*\)\s*\)/.test(rustSource)
+      || !/tauri_plugin_wdio_webdriver::init/.test(rustSource)) {
+    issues.push("WebDriver registration must require debug_assertions and qa-native");
+  }
+  if (!/RIGHTKIT_QA_NATIVE/.test(rustSource)) {
+    issues.push("WebDriver registration must also require RIGHTKIT_QA_NATIVE");
+  }
+
+  for (const [name, command] of Object.entries(packageScripts)) {
+    if (!/qa-native|RIGHTKIT_QA_NATIVE/.test(command)) continue;
+    if (/^(qa|test|dev)(:|$)/.test(name)) continue;
+    if (/(release|publish|build|dmg|installer|package)/i.test(name) || /\btauri\s+build\b/.test(command)) {
+      issues.push(`package script ${name} must not enable native QA`);
+    }
+  }
+  return issues;
+}
+
+export function assertQaBackdoorContract(root, packageScripts = {}) {
+  const issues = validateQaBackdoorContract(root, packageScripts);
+  if (issues.length) throw new Error(`production QA backdoor contract failed:\n- ${issues.join("\n- ")}`);
+}
+
+function readRustSources(root) {
+  if (!existsSync(root)) return "";
+  const files = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const absolute = path.join(dir, entry.name);
+      if (entry.isDirectory()) visit(absolute);
+      else if (entry.isFile() && entry.name.endsWith(".rs")) files.push(absolute);
+    }
+  };
+  visit(root);
+  return files.sort().map((file) => readFileSync(file, "utf8")).join("\n");
+}

package/qa-contract.test.mjs

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { validateQaBackdoorContract } from "./qa-contract.mjs";
+
+function fixture({ optional = true, releaseScript = "right-release release --tier patch" } = {}) {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-qa-"));
+  mkdirSync(path.join(root, "src-tauri", "src"), { recursive: true });
+  writeFileSync(path.join(root, "right-qa.config.mjs"), "export default {};\n");
+  writeFileSync(path.join(root, "src-tauri", "Cargo.toml"), `
+[features]
+qa-native = ["dep:tauri-plugin-wdio-webdriver"]
+[dependencies]
+tauri-plugin-wdio-webdriver = { version = "1.2.0", optional = ${optional} }
+`);
+  writeFileSync(path.join(root, "src-tauri", "src", "lib.rs"), `
+#[cfg(all(not(debug_assertions), feature = "qa-native"))]
+compile_error!("qa-native must never be enabled in release builds");
+#[cfg(all(debug_assertions, feature = "qa-native"))]
+fn qa_enabled() -> bool { std::env::var("RIGHTKIT_QA_NATIVE").as_deref() == Ok("1") }
+#[cfg(all(debug_assertions, feature = "qa-native"))]
+fn add_plugin() { tauri_plugin_wdio_webdriver::init(); }
+`);
+  return { root, scripts: { "qa:native": "tauri dev --features qa-native", "release:patch:win": releaseScript } };
+}
+
+test("accepts a debug-only, runtime-gated native QA surface", () => {
+  const value = fixture();
+  assert.deepEqual(validateQaBackdoorContract(value.root, value.scripts), []);
+});
+
+test("rejects a non-optional WebDriver plugin", () => {
+  const value = fixture({ optional: false });
+  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /must be optional/);
+});
+
+test("rejects release scripts that enable native QA", () => {
+  const value = fixture({ releaseScript: "tauri build --features qa-native" });
+  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /release:patch:win/);
+});
+
+test("does not impose native QA on an app before its config lands", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-no-qa-"));
+  assert.deepEqual(validateQaBackdoorContract(root, {}), []);
+});

package/release.mjs

@@ -5,6 +5,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
+import { assertQaBackdoorContract } from "./qa-contract.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -141,6 +142,8 @@ if (opts.upload && !target.publish) {
   }
 }
 
+sweepStaleRustArtifacts();
+
 console.log(`right-release: done (${Date.now() - started}ms)`);
 releaseLock.release();
 
@@ -160,6 +163,32 @@ async function mustExist(file, message) {
   await access(file).catch(() => fail(message));
 }
 
+// Post-release target/ hygiene: `cargo sweep --installed` deletes artifacts left
+// by toolchains rustup no longer has (each update orphans a multi-GB pile per
+// app) and never touches anything the current toolchains produced. Runs after
+// publish so it cannot race an artifact, and is best-effort: a missing
+// cargo-sweep or a sweep failure must never fail a release.
+function sweepStaleRustArtifacts() {
+  const candidates = [...new Set([root, workdir].flatMap((base) => [base, path.join(base, "src-tauri")]))];
+  const projects = candidates.filter((dir) => existsSync(path.join(dir, "target")));
+  for (const dir of projects) {
+    if (opts.dryRun) {
+      console.log(`dry-run: cargo sweep --installed ${dir}`);
+      continue;
+    }
+    try {
+      const result = spawnSync("cargo", ["sweep", "--installed", dir], { stdio: "inherit" });
+      if (result.status !== 0) {
+        console.log("right-release: stale-artifact sweep skipped (install with: cargo install cargo-sweep)");
+        return;
+      }
+    } catch {
+      console.log("right-release: stale-artifact sweep skipped (install with: cargo install cargo-sweep)");
+      return;
+    }
+  }
+}
+
 async function runInstall(pm, cwd) {
   if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd);
   else if (pm === "npm") await run("npm", ["ci"], cwd);
@@ -180,6 +209,7 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
+  assertQaBackdoorContract(root, scripts);
   const workflowDir = path.join(root, ".github", "workflows");
   if (existsSync(workflowDir)) {
     const workflows = await readdir(workflowDir);

package/release.test.mjs

@@ -264,6 +264,21 @@ test("Windows update re-signs the updater artifact after Azure code signing", ()
   assert.ok(publishAt > updaterAt, result.stdout);
 });
 
+test("release sweeps stale rust artifacts when a target dir exists", () => {
+  const config = fixture();
+  const dir = path.dirname(config);
+  mkdirSync(path.join(dir, "src-tauri", "target"), { recursive: true });
+  const result = run(config, "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /dry-run: cargo sweep --installed .*src-tauri/);
+});
+
+test("release skips the sweep when no target dir exists", () => {
+  const result = run(fixture(), "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /cargo sweep/);
+});
+
 test("release lock is single-flight and is cleaned after success", () => {
   const { dir, config } = lockFixture();
   const lockPath = path.join(dir, ".cache", "right-release", "mac.lock.json");

package/right-suite-contract.test.mjs

@@ -10,8 +10,13 @@ import {
   assertPublishedRightKitCargoDependencies,
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
+import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
 
 const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+// The Right Suite web layer's repo + filesystem path is `rightsites` post the 2026-07-15 naming lock;
+// a not-yet-renamed checkout may still have `rightapps`. Resolve whichever exists so the contract
+// passes on both. (The runtime service namespace stays `rightapps` — that is deliberately untouched.)
+const siteRepoDir = existsSync(path.join(workspace, "rightsites")) ? "rightsites" : "rightapps";
 const versionsPath = path.join(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "rightkit-versions.json");
 const versions = JSON.parse(readFileSync(versionsPath, "utf8"));
 const isolatedCargoHome = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-home-"));
@@ -21,7 +26,9 @@ const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
   { key: "heardright", root: "heardright/tauri-app-next", repoRoot: "heardright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac.sh"] },
+  // mac-dmg.mjs is the release file, as in HeardRight/CodeRight. build-mac.sh only delegates to it,
+  // so asserting the mirror call against the wrapper failed a pipeline that does mirror.
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
@@ -310,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.21");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.22");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
   assert.equal(versions.npm["@rightkit/tauri"], "0.1.0");
@@ -329,7 +336,7 @@ test("license v2 public vector is identical at every portable consumer boundary"
   );
   for (const relativePath of [
     "tools/rightkit/packages/license/test-vectors/license-v2.json",
-    "rightapps/packages/api/src/licensing/test-vectors/license-v2.json",
+    `${siteRepoDir}/packages/api/src/licensing/test-vectors/license-v2.json`,
     "scraperight/tests/fixtures/license-v2.json",
   ]) {
     assert.equal(
@@ -450,6 +457,12 @@ for (const app of apps) {
   });
 }
 
+test("HeardRight and ScrapeRight expose one locked ASR promotion adapter contract", async () => {
+  const heard = (await import(`${pathToFileURL(path.join(workspace, "heardright/tauri-app-next/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
+  const scrape = (await import(`${pathToFileURL(path.join(workspace, "scraperight/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
+  assert.equal(assertAsrAdapterPair(heard.runtimeArtifacts?.asr, scrape.runtimeArtifacts?.asr), true);
+});
+
 function findFiles(root, filename) {
   const found = [];
   const visit = (dir) => {
@@ -488,7 +501,7 @@ test("Right Suite has no hosted workflow files", () => {
 
 test("RightApps brand hosts expose app-keyed update manifest proxies", () => {
   for (const app of apps) {
-    const siteRoot = path.join(workspace, "rightapps", app.key);
+    const siteRoot = path.join(workspace, siteRepoDir, app.key);
     for (const route of ["patches", "latest"]) {
       const routeFile = path.join(siteRoot, "src", "routes", "releases", `${route}.json`, "index.ts");
       const source = readFileSync(routeFile, "utf8");

package/rightkit-versions.json

@@ -4,14 +4,23 @@
   "npm": {
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
-    "@rightkit/release": "0.2.21",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.22",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
   "cargo": {
     "rightkit-license": "0.1.2",
     "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
-  "stagedCargo": {}
+  "stagedCargo": {},
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.0"
+    }
+  }
 }