@rightkit/release 0.2.21 → 0.2.23

package/asr-artifact-adoption.mjs

@@ -0,0 +1,68 @@
+import { isDeepStrictEqual } from "node:util";
+
+import { verifyRuntimeArtifactEnvelope } from "./runtime-artifact-manifest.mjs";
+
+const ASR_AUTHORITY = "heardright";
+const ASR_CONSUMER = "scraperight";
+const ASR_KIND = "asr-model";
+
+export function assertAsrArtifactAdoption({ authorityEnvelope, consumerEnvelope, publicKey, trustedKeyId }) {
+  const authority = verifyTrusted(authorityEnvelope, publicKey, trustedKeyId);
+  const consumer = verifyTrusted(consumerEnvelope, publicKey, trustedKeyId);
+
+  assertManifestRole(authority, ASR_AUTHORITY, "authority");
+  assertManifestRole(consumer, ASR_CONSUMER, "consumer");
+  for (const manifest of [authority, consumer]) {
+    if (manifest.artifactKind !== ASR_KIND) throw new Error("ASR adoption manifest must be an asr-model");
+    if (manifest.promotion.authorityAppKey !== ASR_AUTHORITY) throw new Error("ASR promotion authority must be heardright");
+  }
+
+  assertSame(authority.target, consumer.target, "target");
+  assertSame(authority.object.filename, consumer.object.filename, "object.filename");
+  assertSame(authority.object.sha256, consumer.object.sha256, "object.sha256");
+  assertSame(authority.object.sizeBytes, consumer.object.sizeBytes, "object.sizeBytes");
+  for (const field of ["runtime", "model", "tokenizer", "preprocessing", "license", "provenance"]) {
+    assertSame(authority.versions[field], consumer.versions[field], `versions.${field}`);
+  }
+  assertSame(authority.provenance, consumer.provenance, "provenance");
+  assertSame(authority.promotion, consumer.promotion, "promotion");
+  return {
+    sha256: authority.object.sha256,
+    promotionId: authority.promotion.promotionId,
+    target: authority.target,
+  };
+}
+
+export function assertAsrAdapterPair(authority, consumer) {
+  assertAdapter(authority, ASR_AUTHORITY, "authority");
+  assertAdapter(consumer, ASR_CONSUMER, "consumer");
+  for (const [field, expected] of [
+    ["authorityAppKey", ASR_AUTHORITY],
+    ["artifactKind", ASR_KIND],
+    ["delivery", "private-r2"],
+    ["entitlementTier", "pro"],
+  ]) {
+    assertSame(authority[field], expected, `authority adapter ${field}`);
+    assertSame(consumer[field], expected, `consumer adapter ${field}`);
+  }
+  return true;
+}
+
+function verifyTrusted(envelope, publicKey, trustedKeyId) {
+  if (envelope?.signature?.keyId !== trustedKeyId) throw new Error("untrusted runtime artifact key id");
+  return verifyRuntimeArtifactEnvelope(envelope, publicKey);
+}
+
+function assertManifestRole(manifest, appKey, role) {
+  if (manifest.entitlement.appKey !== appKey) throw new Error(`${role} manifest must belong to ${appKey}`);
+}
+
+function assertAdapter(value, appKey, role) {
+  if (!value || value.schema !== 1 || value.appKey !== appKey || value.role !== role) {
+    throw new Error(`invalid ${role} ASR adapter`);
+  }
+}
+
+function assertSame(left, right, field) {
+  if (!isDeepStrictEqual(left, right)) throw new Error(`ASR drift: ${field}`);
+}

package/asr-artifact-adoption.test.mjs

@@ -0,0 +1,122 @@
+import assert from "node:assert/strict";
+import { generateKeyPairSync } from "node:crypto";
+import test from "node:test";
+
+import { assertAsrAdapterPair, assertAsrArtifactAdoption } from "./asr-artifact-adoption.mjs";
+import { buildRuntimeArtifactManifest, signRuntimeArtifactManifest } from "./runtime-artifact-manifest.mjs";
+
+const digest = "a".repeat(64);
+const notice = "b".repeat(64);
+const evidence = "c".repeat(64);
+const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+
+function envelope(appKey, overrides = {}) {
+  const manifest = buildRuntimeArtifactManifest({
+    artifactKind: "asr-model",
+    entitlement: { appKey, tier: "pro" },
+    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
+    target: { os: "windows", arch: "x86_64" },
+    filename: "parakeet-unified-en-0.6b.tar.zst",
+    sha256: digest,
+    sizeBytes: 1234,
+    versions: {
+      runtime: "rightkit-asr@0.1.0",
+      model: "parakeet-unified-en-0.6b",
+      tokenizer: "sha256:tokenizer-v1",
+      preprocessing: "heardright-frontend-v1",
+      license: "CC-BY-4.0",
+      provenance: "nvidia/parakeet-tdt-0.6b-v3",
+    },
+    provenance: {
+      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
+      sourceRevision: "revision-1",
+      licenseId: "CC-BY-4.0",
+      noticeSha256: notice,
+    },
+    promotion: {
+      authorityAppKey: "heardright",
+      promotionId: "hr-asr-2026-07-14",
+      promotedAt: "2026-07-14T00:00:00.000Z",
+      evidenceSha256: evidence,
+    },
+    ...overrides,
+  });
+  return signRuntimeArtifactManifest(manifest, privateKey, "rightkit-runtime-artifacts-2026-07");
+}
+
+test("accepts app-scoped pointers with one exact HeardRight-certified ASR identity", () => {
+  const result = assertAsrArtifactAdoption({
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: envelope("scraperight"),
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  });
+
+  assert.equal(result.sha256, digest);
+  assert.equal(result.promotionId, "hr-asr-2026-07-14");
+});
+
+test("rejects a validly signed ScrapeRight manifest with ASR drift", () => {
+  const drifted = envelope("scraperight", {
+    versions: {
+      runtime: "rightkit-asr@0.1.1",
+      model: "parakeet-unified-en-0.6b",
+      tokenizer: "sha256:tokenizer-v1",
+      preprocessing: "heardright-frontend-v1",
+      license: "CC-BY-4.0",
+      provenance: "nvidia/parakeet-tdt-0.6b-v3",
+    },
+  });
+
+  assert.throws(() => assertAsrArtifactAdoption({
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: drifted,
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  }), /ASR drift: versions\.runtime/);
+});
+
+test("rejects wrong roles, authority, target, signature key, and artifact kind", () => {
+  const base = {
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: envelope("scraperight"),
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  };
+  assert.throws(() => assertAsrArtifactAdoption({ ...base, authorityEnvelope: envelope("scraperight") }), /authority manifest must belong to heardright/);
+  assert.throws(() => assertAsrArtifactAdoption({ ...base, consumerEnvelope: envelope("heardright") }), /consumer manifest must belong to scraperight/);
+  assert.throws(() => assertAsrArtifactAdoption({ ...base, trustedKeyId: "rotated-without-app-update" }), /untrusted runtime artifact key id/);
+  assert.throws(() => assertAsrArtifactAdoption({
+    ...base,
+    consumerEnvelope: envelope("scraperight", { target: { os: "darwin", arch: "aarch64" } }),
+  }), /ASR drift: target/);
+  assert.throws(() => assertAsrArtifactAdoption({
+    ...base,
+    consumerEnvelope: envelope("scraperight", { artifactKind: "ocr-model" }),
+  }), /must be an asr-model/);
+});
+
+test("rejects a consumer signed by a different key", () => {
+  const other = generateKeyPairSync("ed25519");
+  const consumer = signRuntimeArtifactManifest(
+    envelope("scraperight").manifest,
+    other.privateKey,
+    "rightkit-runtime-artifacts-2026-07",
+  );
+  assert.throws(() => assertAsrArtifactAdoption({
+    authorityEnvelope: envelope("heardright"),
+    consumerEnvelope: consumer,
+    publicKey,
+    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
+  }), /signature verification failed/);
+});
+
+test("locks the thin app adapters to HeardRight authority and private Pro delivery", () => {
+  const authority = {
+    schema: 1, appKey: "heardright", role: "authority", authorityAppKey: "heardright",
+    artifactKind: "asr-model", delivery: "private-r2", entitlementTier: "pro",
+  };
+  const consumer = { ...authority, appKey: "scraperight", role: "consumer" };
+  assert.equal(assertAsrAdapterPair(authority, consumer), true);
+  assert.throws(() => assertAsrAdapterPair(authority, { ...consumer, authorityAppKey: "scraperight" }), /ASR drift/);
+});

package/cargo-contract.mjs

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const SKIP_DIRECTORIES = new Set([".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
+const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
 const CRATES_IO_SOURCES = new Set([
   "registry+https://github.com/rust-lang/crates.io-index",
   "registry+https://index.crates.io/",
@@ -101,11 +101,34 @@ function assertNoRightKitOverrides(parsed, label, source) {
   }
 }
 
+// `tomllib` is Python 3.11+. Windows pins `py -3.11`, but a bare `python3` on macOS is the system
+// 3.9, which has no tomllib — so every app's release:doctor died on a stock Mac, and reported the
+// manifest as invalid TOML when the real problem was the interpreter. Probe for one that can.
+let tomlRunner;
+function resolveTomlRunner() {
+  if (tomlRunner) return tomlRunner;
+  const probe = "import sys,tomllib";
+  const candidates =
+    process.platform === "win32"
+      ? [["py", ["-3.11"]], ["py", ["-3"]], ["python", []]]
+      : [["python3.13", []], ["python3.12", []], ["python3.11", []], ["python3", []]];
+  for (const [command, prefix] of candidates) {
+    const check = spawnSync(command, [...prefix, "-c", probe], { encoding: "utf8", windowsHide: true });
+    if (check.status === 0) {
+      tomlRunner = { command, prefix };
+      return tomlRunner;
+    }
+  }
+  throw new Error(
+    "no Python with tomllib found (needs 3.11+). Install one, or put it on PATH: the release " +
+      "contract reads Cargo manifests through it.",
+  );
+}
+
 function readToml(file, label) {
   const script = "import json,pathlib,sys,tomllib; json.dump(tomllib.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')),sys.stdout,default=str)";
-  const command = process.platform === "win32" ? "py" : "python3";
-  const args = process.platform === "win32" ? ["-3.11", "-c", script, file] : ["-c", script, file];
-  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+  const { command, prefix } = resolveTomlRunner();
+  const result = spawnSync(command, [...prefix, "-c", script, file], { encoding: "utf8", windowsHide: true });
   if (result.status !== 0) throw new Error(`${label} is not valid TOML: ${String(result.stderr ?? "").trim()}`);
   return JSON.parse(result.stdout);
 }

package/cli/right-release.mjs

@@ -44,6 +44,8 @@ if (first === "--version" || first === "-v") {
   const rest = args.slice(1);
   if (rest[0] === "cargo") {
     run("publish-cargo.mjs", rest.slice(1));
+  } else if (rest[0] === "swift") {
+    run("publish-swift.mjs", rest.slice(1));
   } else {
     run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
   }
@@ -120,6 +122,7 @@ Commands:
   release [--platform mac|win] --tier patch|update   Build/package through the signed release lane
   publish [--platform mac|win] --tier patch|update   Release plus R2 upload + RightApps registration
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
+  publish swift [--scope <s>] [--url <u>] [--dry-run] Test, archive, scan, and publish RightKitSwift to a Swift registry
   model promote --authority heardright --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
   doctor [--platform mac|win]                        Inspect one app's release config

package/legal-contract.mjs

@@ -0,0 +1,165 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+const REQUIRED_ROLES = new Set([
+  "license",
+  "eula",
+  "acceptable_use",
+  "product_schedule",
+  "privacy_notice",
+  "third_party_notices",
+]);
+const AGREEMENT_ROLES = new Set(["license", "eula", "acceptable_use", "product_schedule"]);
+const SHA256 = /^[a-f0-9]{64}$/i;
+const APP_KEY = /^[a-z][a-z0-9-]{1,63}$/;
+const PLACEHOLDER = /\[(?:COUNSEL|TODO|TBD)(?::|\])|\b(?:TODO|TBD|PLACEHOLDER|NOT READY|RELEASE BLOCKER)\b|⚠\s*verify|^- \[ \]/im;
+
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+function fail(appName, message) {
+  throw new Error(`${appName ?? "app"} legal contract: ${message}`);
+}
+
+function within(parent, candidate) {
+  const relative = path.relative(parent, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function resolveContained(parent, relative, appName, label) {
+  if (typeof relative !== "string" || !relative.trim() || path.isAbsolute(relative)) {
+    fail(appName, `${label} must be a non-empty relative path`);
+  }
+  const candidate = path.resolve(parent, relative);
+  if (!within(parent, candidate)) fail(appName, `${label} path escapes the legal snapshot (path traversal)`);
+  return candidate;
+}
+
+function readJson(file, appName, label) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) {
+    fail(appName, `${label} is missing or invalid JSON: ${error.message}`);
+  }
+  return value;
+}
+
+export function assertLegalReleaseContract(root, legal, appName, platform) {
+  const appRoot = realpathSync(root);
+  if (!legal || typeof legal !== "object" || typeof legal.manifest !== "string") {
+    fail(appName, "release config must declare legal.manifest");
+  }
+  const manifestPath = path.resolve(appRoot, legal.manifest);
+  if (!within(appRoot, manifestPath) || !existsSync(manifestPath)) {
+    fail(appName, `legal.manifest must exist inside the app root: ${legal.manifest}`);
+  }
+  const manifestBytes = readFileSync(manifestPath);
+  const manifest = readJson(manifestPath, appName, "legal manifest");
+  const snapshotRoot = realpathSync(path.dirname(manifestPath));
+
+  if (manifest.schema !== 1 || manifest.suite !== "right-suite-desktop") {
+    fail(appName, "manifest must use Right Suite legal schema 1");
+  }
+  if (!APP_KEY.test(manifest.appKey ?? "") || (appName && manifest.appKey !== appName)) {
+    fail(appName, `manifest appKey must match release app (${manifest.appKey ?? "missing"})`);
+  }
+  if (manifest.freeWorkerMaximum !== 9 || manifest.paidWorkerMinimum !== 10) {
+    fail(appName, "manifest Worker threshold must be free through 9 and paid from 10");
+  }
+  if (typeof manifest.acceptanceVersion !== "string" || !manifest.acceptanceVersion.trim()) {
+    fail(appName, "manifest acceptanceVersion is required");
+  }
+  if (!Array.isArray(manifest.documents)) fail(appName, "manifest documents must be an array");
+
+  const seen = new Set();
+  const resolvedDocuments = [];
+  for (const document of manifest.documents) {
+    if (!REQUIRED_ROLES.has(document.role)) fail(appName, `unsupported document role: ${document.role ?? "missing"}`);
+    if (seen.has(document.role)) fail(appName, `duplicate document role: ${document.role}`);
+    seen.add(document.role);
+    if (!SHA256.test(document.sha256 ?? "")) fail(appName, `${document.role} sha256 must be 64 hexadecimal characters`);
+    if (AGREEMENT_ROLES.has(document.role) && (document.treatment !== "agree" || document.material !== true)) {
+      fail(appName, `${document.role} must be a material agreement`);
+    }
+    if (document.role === "privacy_notice" && document.treatment !== "acknowledge") {
+      fail(appName, "privacy_notice must be acknowledged, not treated as consent/agreement");
+    }
+    if (document.role === "third_party_notices" && document.treatment !== "notice") {
+      fail(appName, "third_party_notices must use notice treatment");
+    }
+    const file = resolveContained(snapshotRoot, document.path, appName, `${document.role} document`);
+    if (!existsSync(file)) fail(appName, `missing ${document.role} document: ${document.path}`);
+    const realFile = realpathSync(file);
+    if (!within(snapshotRoot, realFile) || !within(appRoot, realFile)) {
+      fail(appName, `${document.role} document resolves outside the legal snapshot`);
+    }
+    const bytes = readFileSync(realFile);
+    if (sha256(bytes) !== document.sha256.toLowerCase()) {
+      fail(appName, `${document.path} sha256 does not match legal-manifest.json`);
+    }
+    const text = bytes.toString("utf8");
+    if (PLACEHOLDER.test(text)) {
+      fail(appName, `${document.path} contains a placeholder or unchecked release blocker`);
+    }
+    if (document.role === "third_party_notices") {
+      if (!/build provenance\s*:/i.test(text) || !/inputs\s*:/i.test(text) || !/generated-by\s*=/i.test(text)) {
+        fail(appName, "third-party notices must contain Build provenance, inputs, and generated-by evidence");
+      }
+    }
+    resolvedDocuments.push({ ...document, absolutePath: realFile });
+  }
+  for (const role of REQUIRED_ROLES) {
+    if (!seen.has(role)) fail(appName, `missing required document role: ${role}`);
+  }
+
+  const appendixIds = new Set();
+  const appendices = [];
+  if (manifest.appendices != null && !Array.isArray(manifest.appendices)) {
+    fail(appName, "manifest appendices must be an array");
+  }
+  for (const appendix of manifest.appendices ?? []) {
+    if (typeof appendix.id !== "string" || !appendix.id.trim()) fail(appName, "appendix id is required");
+    if (appendixIds.has(appendix.id)) fail(appName, `duplicate appendix id: ${appendix.id}`);
+    appendixIds.add(appendix.id);
+    if (typeof appendix.title !== "string" || !appendix.title.trim()) fail(appName, `${appendix.id} appendix title is required`);
+    if (!SHA256.test(appendix.sha256 ?? "")) fail(appName, `${appendix.id} appendix sha256 is invalid`);
+    const file = resolveContained(snapshotRoot, appendix.path, appName, `${appendix.id} appendix`);
+    if (!existsSync(file)) fail(appName, `${appendix.id} appendix is missing: ${appendix.path}`);
+    const realFile = realpathSync(file);
+    if (!within(snapshotRoot, realFile) || !within(appRoot, realFile)) {
+      fail(appName, `${appendix.id} appendix resolves outside the legal snapshot`);
+    }
+    const bytes = readFileSync(realFile);
+    if (sha256(bytes) !== appendix.sha256.toLowerCase()) fail(appName, `${appendix.id} appendix sha256 does not match`);
+    if (PLACEHOLDER.test(bytes.toString("utf8"))) fail(appName, `${appendix.id} appendix contains a release blocker`);
+    appendices.push({ ...appendix, absolutePath: realFile });
+  }
+
+  if (platform === "win") {
+    if (typeof legal.tauriConfig !== "string") fail(appName, "Windows legal gate requires legal.tauriConfig");
+    const tauriPath = path.resolve(appRoot, legal.tauriConfig);
+    if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);
+    const tauri = readJson(tauriPath, appName, "Tauri config");
+    const configured = tauri.bundle?.licenseFile;
+    if (typeof configured !== "string" || !configured.trim()) {
+      fail(appName, "Windows Tauri bundle.licenseFile must point to the snapshot EULA");
+    }
+    const configuredPath = path.resolve(path.dirname(tauriPath), configured);
+    const eula = resolvedDocuments.find((document) => document.role === "eula");
+    if (!eula || path.normalize(configuredPath).toLowerCase() !== path.normalize(eula.absolutePath).toLowerCase()) {
+      fail(appName, "Windows Tauri bundle.licenseFile must point to the exact EULA snapshot");
+    }
+  }
+
+  return {
+    appKey: manifest.appKey,
+    acceptanceVersion: manifest.acceptanceVersion,
+    manifestPath,
+    manifestSha256: sha256(manifestBytes),
+    documents: resolvedDocuments,
+    appendices,
+  };
+}

package/legal-contract.test.mjs

@@ -0,0 +1,136 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { assertLegalReleaseContract } from "./legal-contract.mjs";
+
+function digest(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-legal-contract-"));
+  const legalDir = path.join(root, "legal");
+  const tauriDir = path.join(root, "src-tauri");
+  mkdirSync(legalDir, { recursive: true });
+  mkdirSync(tauriDir, { recursive: true });
+  const definitions = [
+    ["license", "LICENSE.md", "Ownership notice\n"],
+    ["eula", "EULA.md", "End user license agreement\n"],
+    ["acceptable_use", "ACCEPTABLE_USE.md", "Acceptable use\n"],
+    ["product_schedule", "PRODUCT_SCHEDULE.md", "Product schedule\n"],
+    ["privacy_notice", "PRIVACY.md", "Privacy notice\n"],
+    ["third_party_notices", "THIRD_PARTY_NOTICES.md", "Build provenance: fixture 1.0 windows-x86_64; inputs: pnpm-lock=abc Cargo.lock=def; generated-by=fixture\n"],
+  ];
+  for (const [, file, content] of definitions) writeFileSync(path.join(legalDir, file), content);
+  const manifest = {
+    schema: 1,
+    suite: "right-suite-desktop",
+    appKey: "fixture",
+    productName: "Fixture",
+    licensor: "Damned Ventures LLC",
+    effectiveDate: "2026-07-16",
+    acceptanceVersion: "fixture-2026-07-16-v1",
+    freeWorkerMaximum: 9,
+    paidWorkerMinimum: 10,
+    documents: definitions.map(([role, file, content]) => ({
+      id: `fixture-${role}`,
+      role,
+      title: role,
+      version: "1.0",
+      sha256: digest(content),
+      path: file,
+      publicUrl: `https://example.test/legal/${role}`,
+      treatment: ["privacy_notice"].includes(role) ? "acknowledge" : role === "third_party_notices" ? "notice" : "agree",
+      material: !["privacy_notice", "third_party_notices"].includes(role),
+    })),
+  };
+  writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  writeFileSync(
+    path.join(tauriDir, "tauri.conf.json"),
+    `${JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }, null, 2)}\n`,
+  );
+  return {
+    root,
+    legal: { manifest: "legal/legal-manifest.json", tauriConfig: "src-tauri/tauri.conf.json" },
+    manifest,
+  };
+}
+
+test("accepts a complete, hash-bound legal snapshot", () => {
+  const { root, legal } = fixture();
+  const result = assertLegalReleaseContract(root, legal, "fixture", "win");
+  assert.equal(result.appKey, "fixture");
+  assert.equal(result.documents.length, 6);
+});
+
+test("rejects a missing legal config", () => {
+  const { root } = fixture();
+  assert.throws(() => assertLegalReleaseContract(root, null, "fixture", "win"), /must declare legal\.manifest/i);
+});
+
+test("rejects changed bytes and unsafe manifest paths", () => {
+  const changed = fixture();
+  writeFileSync(path.join(changed.root, "legal", "EULA.md"), "changed without a new manifest\n");
+  assert.throws(() => assertLegalReleaseContract(changed.root, changed.legal, "fixture", "win"), /EULA\.md.*sha-?256/i);
+
+  const traversal = fixture();
+  traversal.manifest.documents[0].path = "../outside.md";
+  writeFileSync(path.join(traversal.root, "legal", "legal-manifest.json"), `${JSON.stringify(traversal.manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(traversal.root, traversal.legal, "fixture", "win"), /path.*snapshot|traversal/i);
+});
+
+test("rejects placeholders and unresolved checklist markers", () => {
+  const { root, legal, manifest } = fixture();
+  const eula = "Terms [COUNSEL: decide later]\n- [ ] fill this in\n";
+  writeFileSync(path.join(root, "legal", "EULA.md"), eula);
+  manifest.documents.find((document) => document.role === "eula").sha256 = digest(eula);
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /placeholder|unchecked|release blocker/i);
+});
+
+test("rejects an explicitly unresolved release blocker even without a checkbox", () => {
+  const { root, legal, manifest } = fixture();
+  const notice = "Build provenance: fixture; inputs: lock=abc; generated-by=fixture\nRELEASE BLOCKER: exact model notice is unresolved.\n";
+  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
+  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /release blocker/i);
+});
+
+test("requires Windows installer clickthrough to use the exact EULA snapshot", () => {
+  const { root, legal } = fixture();
+  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/LICENSE.md" } }));
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile.*EULA/i);
+});
+
+test("requires third-party build provenance", () => {
+  const { root, legal, manifest } = fixture();
+  const notice = "Third-party software is included.\n";
+  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
+  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /third-party.*provenance/i);
+});
+
+test("manifest hash evidence is the hash of the manifest bytes", () => {
+  const { root, legal } = fixture();
+  const result = assertLegalReleaseContract(root, legal, "fixture", "mac");
+  const bytes = readFileSync(path.join(root, legal.manifest));
+  assert.equal(result.manifestSha256, createHash("sha256").update(bytes).digest("hex"));
+});
+
+test("hash-binds declared third-party appendices and rejects missing files", () => {
+  const { root, legal, manifest } = fixture();
+  const appendix = "full dependency license text\n";
+  writeFileSync(path.join(root, "legal", "RUST_LICENSES.txt"), appendix);
+  manifest.appendices = [{ id: "rust-licenses", title: "Rust licenses", path: "RUST_LICENSES.txt", sha256: digest(appendix) }];
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.equal(assertLegalReleaseContract(root, legal, "fixture", "mac").appendices.length, 1);
+
+  manifest.appendices[0].path = "missing.txt";
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /appendix.*missing/i);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -14,11 +14,6 @@
     "*.py"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -28,5 +23,9 @@
     "url": "git+https://github.com/adrdsouza/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "packageManager": "pnpm@11.12.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  }
+}

package/publish-swift.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+// Publish RightKitSwift to a Swift package registry, gated exactly like `publish cargo`:
+// secret scan -> swift test -> release build -> deterministic source archive + hash ->
+// registry dry-run -> publish. Canonical source stays under tools/rightkit/swift; the
+// registry package is an output only. No Git distribution repo, no path/Git dependency.
+//
+// swift-tools is macOS/Linux only, so the plan builder, arg parser, and version check are
+// pure and unit-tested on any OS (publish-swift.test.mjs); the swift steps run where swift exists.
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { scanCrateForSecrets } from "./publish-cargo.mjs";
+
+const IDENTIFIER = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/i;
+
+export function parseSwiftPublishArgs(argv, env = process.env) {
+  const allowed = new Set(["--scope", "--url", "--dry-run", "--allow-dirty"]);
+  let scope = env.RIGHTKIT_SWIFT_REGISTRY_SCOPE ?? "rightsuite";
+  let url = env.RIGHTKIT_SWIFT_REGISTRY_URL ?? "";
+  let dryRun = false;
+  let allowDirty = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!allowed.has(arg)) throw new Error(`unexpected argument: ${arg}`);
+    if (arg === "--dry-run") dryRun = true;
+    else if (arg === "--allow-dirty") allowDirty = true;
+    else {
+      const value = argv[(index += 1)];
+      if (value === undefined) throw new Error(`${arg} needs a value`);
+      if (arg === "--scope") scope = value;
+      if (arg === "--url") url = value;
+    }
+  }
+  if (!IDENTIFIER.test(scope)) throw new Error(`invalid registry scope: ${scope}`);
+  if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  if (!dryRun && !url) throw new Error("registry publish needs --url or RIGHTKIT_SWIFT_REGISTRY_URL");
+  return { scope, url, dryRun, allowDirty };
+}
+
+// The VERSION file is the single source of truth; Package.swift must name the package and the
+// version must be a clean semver so the registry archive is reproducible.
+export function readPackageIdentity(packageDir) {
+  const manifest = path.join(packageDir, "Package.swift");
+  if (!fs.existsSync(manifest)) throw new Error(`Package.swift not found: ${manifest}`);
+  const versionFile = path.join(packageDir, "VERSION");
+  if (!fs.existsSync(versionFile)) throw new Error(`VERSION not found: ${versionFile}`);
+  const version = fs.readFileSync(versionFile, "utf8").trim();
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`VERSION is not clean semver: "${version}"`);
+  }
+  const nameMatch = fs.readFileSync(manifest, "utf8").match(/name:\s*"([^"]+)"/);
+  if (!nameMatch) throw new Error("could not read package name from Package.swift");
+  return { name: nameMatch[1], version };
+}
+
+export function buildSwiftPublishPlan({ packageDir, scope, name, version, url, dryRun, allowDirty = false }) {
+  const packageId = `${scope}.${name}`;
+  const archive = path.join(packageDir, ".build", `${name}-${version}.zip`);
+  const plan = [
+    { label: "secret scan", internal: "secret-scan" },
+    { label: "tests", command: "swift", args: ["test", "--package-path", packageDir] },
+    { label: "release build", command: "swift", args: ["build", "-c", "release", "--package-path", packageDir] },
+    // Deterministic source archive; its bytes are what the registry stores, so hash it for the log.
+    { label: "source archive", command: "swift", args: ["package", "--package-path", packageDir, "archive-source", "-o", archive] },
+    { label: "archive hash", internal: "archive-hash", archive },
+  ];
+  if (dryRun) {
+    plan.push({ label: "registry dry-run (validate only)", internal: "dry-run-note", packageId, version });
+    return plan;
+  }
+  plan.push({
+    label: "registry publish",
+    command: "swift",
+    args: ["package-registry", "publish", packageId, version, "--url", url, "--package-path", packageDir],
+  });
+  return plan;
+}
+
+export function runSwiftPublish(options, execute = spawnSync) {
+  const packageDir = options.packageDir;
+  const { name, version } = readPackageIdentity(packageDir);
+  const plan = buildSwiftPublishPlan({ ...options, packageDir, name, version });
+
+  for (const step of plan) {
+    process.stdout.write(`[right-release] swift ${step.label}\n`);
+    if (step.internal === "secret-scan") {
+      const violations = scanCrateForSecrets(packageDir);
+      if (violations.length) throw new Error(`secret scan rejected: ${violations.join(", ")}`);
+      continue;
+    }
+    if (step.internal === "dry-run-note") {
+      process.stdout.write(`[right-release] dry-run OK: ${step.packageId} ${step.version} (not published)\n`);
+      continue;
+    }
+    if (step.internal === "archive-hash") {
+      const bytes = fs.readFileSync(step.archive);
+      process.stdout.write(`sha256 ${createHash("sha256").update(bytes).digest("hex")}  ${path.basename(step.archive)}\n`);
+      continue;
+    }
+    const result = execute(step.command, step.args, { cwd: packageDir, encoding: "utf8", windowsHide: true, stdio: "inherit" });
+    if (result.error) {
+      if (result.error.code === "ENOENT") {
+        throw new Error(`${step.command} not found — run publish swift on macOS/Linux with the Swift toolchain installed`);
+      }
+      throw result.error;
+    }
+    if (result.status !== 0) throw new Error(`${step.label} failed with exit code ${result.status}`);
+  }
+  return { name, version, published: !options.dryRun };
+}
+
+if (process.argv[1]?.endsWith("publish-swift.mjs")) {
+  try {
+    const options = parseSwiftPublishArgs(process.argv.slice(2));
+    const packageDir = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "../../swift/RightKitSwift");
+    runSwiftPublish({ ...options, packageDir });
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+  }
+}

package/publish-swift.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import { parseSwiftPublishArgs, buildSwiftPublishPlan, readPackageIdentity } from "./publish-swift.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(here, "../../swift/RightKitSwift");
+
+test("dry-run needs no url; publish requires one", () => {
+  assert.deepEqual(parseSwiftPublishArgs(["--dry-run"], {}), {
+    scope: "rightsuite", url: "", dryRun: true, allowDirty: false,
+  });
+  assert.throws(() => parseSwiftPublishArgs([], {}), /needs --url/);
+  assert.equal(parseSwiftPublishArgs(["--url", "https://reg.local"], {}).url, "https://reg.local");
+});
+
+test("env supplies scope and url; --allow-dirty is dry-run only", () => {
+  const parsed = parseSwiftPublishArgs([], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e", RIGHTKIT_SWIFT_REGISTRY_SCOPE: "acme" });
+  assert.deepEqual(parsed, { scope: "acme", url: "https://e", dryRun: false, allowDirty: false });
+  assert.throws(() => parseSwiftPublishArgs(["--allow-dirty"], { RIGHTKIT_SWIFT_REGISTRY_URL: "https://e" }), /only valid with --dry-run/);
+  assert.throws(() => parseSwiftPublishArgs(["--bogus"], {}), /unexpected argument/);
+});
+
+test("reads the real package identity from VERSION + Package.swift", () => {
+  const { name, version } = readPackageIdentity(packageDir);
+  assert.equal(name, "RightKitSwift");
+  assert.match(version, /^\d+\.\d+\.\d+/);
+});
+
+test("dry-run plan stops before publish; real plan ends with publish", () => {
+  const base = { packageDir, scope: "rightsuite", name: "RightKitSwift", version: "0.1.0", url: "https://reg.local" };
+  const dry = buildSwiftPublishPlan({ ...base, dryRun: true });
+  assert.equal(dry[0].internal, "secret-scan");
+  assert.ok(dry.some((s) => s.label === "tests" && s.command === "swift"));
+  assert.ok(!dry.some((s) => s.label === "registry publish"), "dry-run must not publish");
+
+  const real = buildSwiftPublishPlan({ ...base, dryRun: false });
+  const publish = real.at(-1);
+  assert.equal(publish.label, "registry publish");
+  assert.deepEqual(publish.args, [
+    "package-registry", "publish", "rightsuite.RightKitSwift", "0.1.0", "--url", "https://reg.local", "--package-path", packageDir,
+  ]);
+});

package/qa-contract.mjs

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+
+export function validateQaBackdoorContract(root, packageScripts = {}) {
+  if (!existsSync(path.join(root, "right-qa.config.mjs"))) return [];
+
+  const issues = [];
+  const cargoPath = path.join(root, "src-tauri", "Cargo.toml");
+  if (!existsSync(cargoPath)) return ["right-qa.config.mjs requires src-tauri/Cargo.toml"];
+
+  const cargoToml = readFileSync(cargoPath, "utf8");
+  const dependency = cargoToml.match(/tauri-plugin-wdio-webdriver\s*=\s*\{([^}]*)\}/s)?.[1] ?? "";
+  if (!dependency) issues.push("Cargo.toml must declare tauri-plugin-wdio-webdriver");
+  else if (!/optional\s*=\s*true/.test(dependency)) issues.push("tauri-plugin-wdio-webdriver must be optional");
+
+  const qaFeature = cargoToml.match(/qa-native\s*=\s*\[([^\]]*)\]/s)?.[1] ?? "";
+  if (!/dep:tauri-plugin-wdio-webdriver/.test(qaFeature)) {
+    issues.push("qa-native must enable dep:tauri-plugin-wdio-webdriver");
+  }
+
+  const rustSource = readRustSources(path.join(root, "src-tauri", "src")).replace(/\s+/g, " ");
+  if (!/cfg\s*\(\s*all\s*\(\s*not\s*\(\s*debug_assertions\s*\)\s*,\s*feature\s*=\s*"qa-native"\s*\)\s*\)/.test(rustSource)
+      || !/compile_error!/.test(rustSource)) {
+    issues.push("Rust must compile_error when qa-native is enabled outside debug builds");
+  }
+  if (!/cfg\s*\(\s*all\s*\(\s*debug_assertions\s*,\s*feature\s*=\s*"qa-native"\s*\)\s*\)/.test(rustSource)
+      || !/tauri_plugin_wdio_webdriver::init/.test(rustSource)) {
+    issues.push("WebDriver registration must require debug_assertions and qa-native");
+  }
+  if (!/RIGHTKIT_QA_NATIVE/.test(rustSource)) {
+    issues.push("WebDriver registration must also require RIGHTKIT_QA_NATIVE");
+  }
+
+  for (const [name, command] of Object.entries(packageScripts)) {
+    if (!/qa-native|RIGHTKIT_QA_NATIVE/.test(command)) continue;
+    if (/^(qa|test|dev)(:|$)/.test(name)) continue;
+    if (/(release|publish|build|dmg|installer|package)/i.test(name) || /\btauri\s+build\b/.test(command)) {
+      issues.push(`package script ${name} must not enable native QA`);
+    }
+  }
+  return issues;
+}
+
+export function assertQaBackdoorContract(root, packageScripts = {}) {
+  const issues = validateQaBackdoorContract(root, packageScripts);
+  if (issues.length) throw new Error(`production QA backdoor contract failed:\n- ${issues.join("\n- ")}`);
+}
+
+function readRustSources(root) {
+  if (!existsSync(root)) return "";
+  const files = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const absolute = path.join(dir, entry.name);
+      if (entry.isDirectory()) visit(absolute);
+      else if (entry.isFile() && entry.name.endsWith(".rs")) files.push(absolute);
+    }
+  };
+  visit(root);
+  return files.sort().map((file) => readFileSync(file, "utf8")).join("\n");
+}

package/qa-contract.test.mjs

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { validateQaBackdoorContract } from "./qa-contract.mjs";
+
+function fixture({ optional = true, releaseScript = "right-release release --tier patch" } = {}) {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-qa-"));
+  mkdirSync(path.join(root, "src-tauri", "src"), { recursive: true });
+  writeFileSync(path.join(root, "right-qa.config.mjs"), "export default {};\n");
+  writeFileSync(path.join(root, "src-tauri", "Cargo.toml"), `
+[features]
+qa-native = ["dep:tauri-plugin-wdio-webdriver"]
+[dependencies]
+tauri-plugin-wdio-webdriver = { version = "1.2.0", optional = ${optional} }
+`);
+  writeFileSync(path.join(root, "src-tauri", "src", "lib.rs"), `
+#[cfg(all(not(debug_assertions), feature = "qa-native"))]
+compile_error!("qa-native must never be enabled in release builds");
+#[cfg(all(debug_assertions, feature = "qa-native"))]
+fn qa_enabled() -> bool { std::env::var("RIGHTKIT_QA_NATIVE").as_deref() == Ok("1") }
+#[cfg(all(debug_assertions, feature = "qa-native"))]
+fn add_plugin() { tauri_plugin_wdio_webdriver::init(); }
+`);
+  return { root, scripts: { "qa:native": "tauri dev --features qa-native", "release:patch:win": releaseScript } };
+}
+
+test("accepts a debug-only, runtime-gated native QA surface", () => {
+  const value = fixture();
+  assert.deepEqual(validateQaBackdoorContract(value.root, value.scripts), []);
+});
+
+test("rejects a non-optional WebDriver plugin", () => {
+  const value = fixture({ optional: false });
+  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /must be optional/);
+});
+
+test("rejects release scripts that enable native QA", () => {
+  const value = fixture({ releaseScript: "tauri build --features qa-native" });
+  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /release:patch:win/);
+});
+
+test("does not impose native QA on an app before its config lands", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-no-qa-"));
+  assert.deepEqual(validateQaBackdoorContract(root, {}), []);
+});

package/release.mjs

@@ -5,6 +5,8 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
+import { assertQaBackdoorContract } from "./qa-contract.mjs";
+import { assertLegalReleaseContract } from "./legal-contract.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -66,6 +68,9 @@ await validateRightKitPackageContract(root, config.app);
 validateRightKitCargoContract(root, RIGHTKIT_VERSIONS.cargo, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
+const legalContract = config.legal
+  ? assertLegalReleaseContract(root, config.legal, config.app ?? path.basename(root), opts.platform)
+  : null;
 if (target.signed !== true) {
   fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
 }
@@ -82,6 +87,11 @@ if (opts.doctor) {
   console.log(`packageManager: ${config.packageManager}`);
   console.log(`workdir: ${workdir}`);
   console.log(`hardeningscan: ${HARDENING_SCAN}`);
+  if (legalContract) {
+    console.log(`legal: ${legalContract.manifestPath}`);
+    console.log(`legalAcceptance: ${legalContract.acceptanceVersion}`);
+    console.log(`legalManifestSha256: ${legalContract.manifestSha256}`);
+  }
   if (target.sign?.files?.length) console.log(`sign: ${target.sign.files.join(", ")}`);
   if (target.publishBlocked) console.log(`publishBlocked: ${target.publishBlocked}`);
   process.exit(0);
@@ -141,6 +151,8 @@ if (opts.upload && !target.publish) {
   }
 }
 
+sweepStaleRustArtifacts();
+
 console.log(`right-release: done (${Date.now() - started}ms)`);
 releaseLock.release();
 
@@ -160,6 +172,32 @@ async function mustExist(file, message) {
   await access(file).catch(() => fail(message));
 }
 
+// Post-release target/ hygiene: `cargo sweep --installed` deletes artifacts left
+// by toolchains rustup no longer has (each update orphans a multi-GB pile per
+// app) and never touches anything the current toolchains produced. Runs after
+// publish so it cannot race an artifact, and is best-effort: a missing
+// cargo-sweep or a sweep failure must never fail a release.
+function sweepStaleRustArtifacts() {
+  const candidates = [...new Set([root, workdir].flatMap((base) => [base, path.join(base, "src-tauri")]))];
+  const projects = candidates.filter((dir) => existsSync(path.join(dir, "target")));
+  for (const dir of projects) {
+    if (opts.dryRun) {
+      console.log(`dry-run: cargo sweep --installed ${dir}`);
+      continue;
+    }
+    try {
+      const result = spawnSync("cargo", ["sweep", "--installed", dir], { stdio: "inherit" });
+      if (result.status !== 0) {
+        console.log("right-release: stale-artifact sweep skipped (install with: cargo install cargo-sweep)");
+        return;
+      }
+    } catch {
+      console.log("right-release: stale-artifact sweep skipped (install with: cargo install cargo-sweep)");
+      return;
+    }
+  }
+}
+
 async function runInstall(pm, cwd) {
   if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd);
   else if (pm === "npm") await run("npm", ["ci"], cwd);
@@ -180,6 +218,7 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
+  assertQaBackdoorContract(root, scripts);
   const workflowDir = path.join(root, ".github", "workflows");
   if (existsSync(workflowDir)) {
     const workflows = await readdir(workflowDir);

package/release.test.mjs

@@ -264,6 +264,21 @@ test("Windows update re-signs the updater artifact after Azure code signing", ()
   assert.ok(publishAt > updaterAt, result.stdout);
 });
 
+test("release sweeps stale rust artifacts when a target dir exists", () => {
+  const config = fixture();
+  const dir = path.dirname(config);
+  mkdirSync(path.join(dir, "src-tauri", "target"), { recursive: true });
+  const result = run(config, "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /dry-run: cargo sweep --installed .*src-tauri/);
+});
+
+test("release skips the sweep when no target dir exists", () => {
+  const result = run(fixture(), "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /cargo sweep/);
+});
+
 test("release lock is single-flight and is cleaned after success", () => {
   const { dir, config } = lockFixture();
   const lockPath = path.join(dir, ".cache", "right-release", "mac.lock.json");

package/right-suite-contract.test.mjs

@@ -10,8 +10,13 @@ import {
   assertPublishedRightKitCargoDependencies,
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
+import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
 
 const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+// The Right Suite web layer's repo + filesystem path is `rightsites` post the 2026-07-15 naming lock;
+// a not-yet-renamed checkout may still have `rightapps`. Resolve whichever exists so the contract
+// passes on both. (The runtime service namespace stays `rightapps` — that is deliberately untouched.)
+const siteRepoDir = existsSync(path.join(workspace, "rightsites")) ? "rightsites" : "rightapps";
 const versionsPath = path.join(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "rightkit-versions.json");
 const versions = JSON.parse(readFileSync(versionsPath, "utf8"));
 const isolatedCargoHome = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-home-"));
@@ -21,7 +26,9 @@ const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
   { key: "heardright", root: "heardright/tauri-app-next", repoRoot: "heardright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac.sh"] },
+  // mac-dmg.mjs is the release file, as in HeardRight/CodeRight. build-mac.sh only delegates to it,
+  // so asserting the mirror call against the wrapper failed a pipeline that does mirror.
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
@@ -310,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.21");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.22");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
   assert.equal(versions.npm["@rightkit/tauri"], "0.1.0");
@@ -329,7 +336,7 @@ test("license v2 public vector is identical at every portable consumer boundary"
   );
   for (const relativePath of [
     "tools/rightkit/packages/license/test-vectors/license-v2.json",
-    "rightapps/packages/api/src/licensing/test-vectors/license-v2.json",
+    `${siteRepoDir}/packages/api/src/licensing/test-vectors/license-v2.json`,
     "scraperight/tests/fixtures/license-v2.json",
   ]) {
     assert.equal(
@@ -450,11 +457,17 @@ for (const app of apps) {
   });
 }
 
+test("HeardRight and ScrapeRight expose one locked ASR promotion adapter contract", async () => {
+  const heard = (await import(`${pathToFileURL(path.join(workspace, "heardright/tauri-app-next/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
+  const scrape = (await import(`${pathToFileURL(path.join(workspace, "scraperight/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
+  assert.equal(assertAsrAdapterPair(heard.runtimeArtifacts?.asr, scrape.runtimeArtifacts?.asr), true);
+});
+
 function findFiles(root, filename) {
   const found = [];
   const visit = (dir) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && [".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"].includes(entry.name)) continue;
+      if (entry.isDirectory() && [".audit", ".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"].includes(entry.name)) continue;
       const full = path.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name === filename) found.push(full);
@@ -488,7 +501,7 @@ test("Right Suite has no hosted workflow files", () => {
 
 test("RightApps brand hosts expose app-keyed update manifest proxies", () => {
   for (const app of apps) {
-    const siteRoot = path.join(workspace, "rightapps", app.key);
+    const siteRoot = path.join(workspace, siteRepoDir, app.key);
     for (const route of ["patches", "latest"]) {
       const routeFile = path.join(siteRoot, "src", "routes", "releases", `${route}.json`, "index.ts");
       const source = readFileSync(routeFile, "utf8");

package/rightkit-versions.json

@@ -4,14 +4,23 @@
   "npm": {
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
-    "@rightkit/release": "0.2.21",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.22",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
   "cargo": {
     "rightkit-license": "0.1.2",
     "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
-  "stagedCargo": {}
+  "stagedCargo": {},
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.0"
+    }
+  }
 }

package/standalone-clone-verify.mjs

@@ -32,8 +32,14 @@ function run(command, args, cwd) {
 function runPnpm(args, cwd, command) {
   if (process.platform !== "win32" || command !== "pnpm") return run(command, args, cwd);
   for (const entry of String(process.env.PATH ?? "").split(path.delimiter)) {
-    const cli = path.join(entry.replace(/^"|"$/g, ""), "node_modules", "pnpm", "bin", "pnpm.mjs");
+    const directory = entry.replace(/^"|"$/g, "");
+    const cli = path.join(directory, "node_modules", "pnpm", "bin", "pnpm.mjs");
     if (existsSync(cli)) return run(process.execPath, [cli, ...args], cwd);
+    const cmdShim = path.join(directory, "pnpm.cmd");
+    if (existsSync(cmdShim)) {
+      const target = readFileSync(cmdShim, "utf8").match(/@node\s+"([^"]+pnpm\.(?:c|m)?js)"/i)?.[1];
+      if (target && existsSync(target)) return run(process.execPath, [target, ...args], cwd);
+    }
   }
   throw new Error("pnpm installation could not be resolved from PATH");
 }