@rightkit/release 0.2.65 → 0.2.67

package/addon-command.test.mjs

@@ -13,8 +13,8 @@ function fixture() {
   mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
   for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
   writeFileSync(path.join(root, "assets", "tab.png"), "icon");
-  const files = [["command", "membrane", "out/membrane", true], ["service", "crypt-service", "out/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
+  const files = [["command", "membrane", "out/membrane", true], ["service", "membrane-service", "out/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
+  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
   execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
   return root;
 }
@@ -25,7 +25,7 @@ test("add-on dry-run creates no release state and never executes build", () => {
 
 test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
   const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
   const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const sealed = path.join(root, "sealed"); mkdirSync(sealed);
   for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
@@ -44,11 +44,11 @@ test("local adoption verifies lock and stages portable plus Tauri-qualified bina
 
 test("remote downloader accepts only immutable manifest plus file routes", async () => {
   const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
   const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
   const destination = path.join(root, "remote"); mkdirSync(destination);
   await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
-  assert.equal(readFileSync(path.join(destination, "crypt-service"), "utf8"), "service");
+  assert.equal(readFileSync(path.join(destination, "membrane-service"), "utf8"), "service");
   assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
 });

package/addon-contract.test.mjs

@@ -8,12 +8,12 @@ import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonCon
 function fixture() {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
   mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
-  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/crypt-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
+  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/membrane-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
   const files = [
-    ["command", "membrane", "bin/membrane", true], ["service", "crypt-service", "bin/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
+    ["command", "membrane", "bin/membrane", true], ["service", "membrane-service", "bin/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
     ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
   ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
+  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
 }
 
 test("add-on manifest has portable immutable identity and routes", () => {

package/build-release.mjs

@@ -26,12 +26,14 @@ import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInpu
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
-import { managedCargoShimOnPath } from "./cargo-contract.mjs";
+import { brokerManagedHost } from "./cargo-contract.mjs";
+import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
 import { processGroupCpuSeconds } from "./process-liveness.mjs";
+import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimits } from "./progress-control.mjs";
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
@@ -103,6 +105,7 @@ let suiteSlot;
 let cacheLease;
 let heavySlot;
 let interrupted;
+let requestActiveRunStop = null;
 
 // A dry-run is an inspection contract, not a partial build. It must finish
 // before locks, cache directories, receipts, dependency installation, or any
@@ -123,9 +126,10 @@ if (dryRun) {
 
 for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
   process.once(signal, () => {
-    if (child?.pid) killTree(child.pid);
     interrupted = new Error(`release interrupted by ${signal}`);
     process.exitCode = signal === "SIGINT" ? 130 : 143;
+    if (requestActiveRunStop) void requestActiveRunStop(interrupted.message);
+    else if (child?.pid) killTree(child.pid);
   });
 }
 
@@ -174,13 +178,23 @@ try {
   // shells take the Cache V2 branch, bridge src-tauri/target into the release cache,
   // and then lose CARGO_TARGET_DIR to the broker's unconditional override — so the
   // app bundle landed in the broker workspace and packaging failed on an empty cache.
-  const managedCargoTarget = (process.env.RIGHTKIT_BUILD_BROKER_SOCKET || managedCargoShimOnPath(process.env))
-    ? resolveManagedCargoTarget(cargoToml)
-    : null;
+  const managedCargoTarget = brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
-  const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
-  if (cacheMode !== "legacy" && cacheMode !== "shared") fail("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
+  const cacheModeRequested = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
+  if (cacheModeRequested !== "legacy" && cacheModeRequested !== "shared") fail("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
+  // On a broker-managed host, Cache V2's lease/slot/prune/floor/mark chain is not
+  // running against the directory that will actually hold build output — the
+  // broker owns CARGO_TARGET_DIR unconditionally (see managedCargoTarget above).
+  // Leaving cacheMode at "shared" there ran that whole chain against an
+  // essentially unrelated cache root: acquireSuiteBuildSlot/acquireCacheLease
+  // guarded a lock nothing else respects, and assertWriteVolumeFloors could
+  // fail() the build outright on a volume that isn't where the real ~18 GB of
+  // output lives. Force broker so none of that machinery runs.
+  const cacheMode = managedCargoTarget ? "broker" : cacheModeRequested;
+  if (managedCargoTarget && cacheModeRequested === "shared") {
+    console.error("[right-release] broker-managed host: the build broker owns CARGO_TARGET_DIR; Cache V2 shared-cache lease/prune/floor checks skipped");
+  }
   const sharedCacheRoot = cacheMode === "shared" ? resolveSharedCacheRoot({ platform, env: process.env }) : undefined;
   const sharedLayout = cacheMode === "shared"
     ? resolveCacheLayout({ cacheRoot: sharedCacheRoot, platform, architecture: cacheIdentity.architecture, app: config.app, fingerprint: cacheKey, kind: "release" })
@@ -216,9 +230,9 @@ try {
       delete env[name];
     }
   }
-  if (cacheMode === "legacy") delete env.RIGHT_RELEASE_CACHE_OWNER;
+  if (cacheMode !== "shared") delete env.RIGHT_RELEASE_CACHE_OWNER;
   if (cacheMode === "shared" && env.RIGHT_RELEASE_CACHE_OWNER !== "rightkit-v2") fail("shared cache ownership token was not configured");
-  if (cacheMode === "legacy" && !commandExists("sccache")) delete env.RUSTC_WRAPPER;
+  if (cacheMode !== "shared" && !commandExists("sccache")) delete env.RUSTC_WRAPPER;
   if (process.env.RIGHTSUITE_HEAVY_WORK_OWNER !== "1") heavySlot = acquireHeavyWorkSlot();
   if (cacheMode === "shared") {
     suiteSlot = acquireSuiteBuildSlot({ layout: sharedLayout, pid: process.pid, argv: process.argv, waitMs: Number(process.env.BUILD_GUARD_WAIT_SECS ?? 900) * 1000 });
@@ -250,6 +264,7 @@ try {
     link: targetLink,
     target: managedCargoTarget ?? env.CARGO_TARGET_DIR,
     ownedRoot: path.dirname(managedCargoTarget ?? env.CARGO_TARGET_DIR),
+    brokerManaged: Boolean(managedCargoTarget),
   });
 
   const result = await targetBridge.run(async () => runBuildStateMachine({
@@ -285,7 +300,13 @@ try {
         throwIfInterrupted();
         const cacheTarget = managedCargoTarget ?? env.CARGO_TARGET_DIR;
         mkdirSync(cacheTarget, { recursive: true });
-        if (cacheMode === "shared") targetBridge.ensure();
+        // Broker-managed hosts route through the same target bridge as shared
+        // mode even though cacheMode is forced to "broker" above: the naive
+        // else-branch below fail()s outright when targetLink is a real
+        // directory, which is exactly the "corruption" misreading that nearly
+        // cost ~5.9 GB of warm broker intermediates. The bridge's brokerManaged
+        // flag already knows to leave a real directory untouched instead.
+        if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
         else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
@@ -307,7 +328,7 @@ try {
         checkpoint(stateRoot, "hardened");
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -347,17 +368,32 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
+function sealRelease({ configRoot, managedCargoTarget, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
+  // Every app's right-release.config.mjs names installer/updater artifacts
+  // relative to the local `src-tauri/target`. On a broker-managed host that
+  // directory is never populated (the broker owns CARGO_TARGET_DIR and
+  // targetBridge.ensure() deliberately leaves a real local directory alone,
+  // see target-bridge.mjs) so those paths must resolve against the broker's
+  // own target root instead, or every managed build fails at seal after a
+  // full compile, sign, and notarize.
+  const targetPrefix = "src-tauri/target/";
+  const resolveArtifactPath = (file) => {
+    const normalized = file.replaceAll(path.win32.sep, "/");
+    if (managedCargoTarget && normalized.startsWith(targetPrefix)) {
+      return path.join(managedCargoTarget, normalized.slice(targetPrefix.length));
+    }
+    return path.resolve(configRoot, file);
+  };
   const sources = new Map();
   const addSource = (source, role) => {
     const current = sources.get(source) ?? new Set();
     current.add(role);
     sources.set(source, current);
   };
-  for (const artifact of target.installer?.artifacts ?? []) addSource(path.resolve(configRoot, artifact.file), "installer");
+  for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
-    addSource(path.resolve(configRoot, artifact.file), "updater");
-    addSource(path.resolve(configRoot, artifact.signature), "updater-signature");
+    addSource(resolveArtifactPath(artifact.file), "updater");
+    addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
@@ -374,14 +410,15 @@ function sealRelease({ configRoot, sealedDir, releaseId, config, target, platfor
   }
   const routes = { patch: [], update: [] };
   for (const artifact of target.installer?.artifacts ?? []) {
-    const source = path.resolve(configRoot, artifact.file);
+    const source = resolveArtifactPath(artifact.file);
     routes.patch.push({ role: "installer", name: sourceNames.get(source), bucket: "public", key: artifact.key });
   }
   for (const artifact of target.updater?.artifacts ?? []) {
-    const source = path.resolve(configRoot, artifact.file);
+    const source = resolveArtifactPath(artifact.file);
+    const signatureSource = resolveArtifactPath(artifact.signature);
     const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
-    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "public", key: patchKey, platform: artifact.platform });
-    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "private", key: artifact.key, platform: artifact.platform });
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "private", key: artifact.key, platform: artifact.platform });
   }
   writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
   const manifest = {
@@ -427,26 +464,18 @@ function collectToolVersions(packageManager) {
   }
 }
 
-function resolveManagedCargoTarget(manifestPath) {
-  if (!manifestPath) fail("managed release requires a Cargo.toml build input");
-  const output = commandOutputAt(
-    "cargo",
-    ["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath],
-    path.dirname(manifestPath),
-  );
-  const target = JSON.parse(output).target_directory;
-  if (!target || !path.isAbsolute(target)) fail("managed Cargo metadata returned no absolute target directory");
-  return target;
-}
-
 async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
-  const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
-  const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
+  const { inactivityMs, absoluteMs } = releaseProgressLimits(process.env);
   let lastProgress = Date.now();
   const watchDirs = Array.isArray(watchDir) ? watchDir : [watchDir];
   let lastMtime = Math.max(...watchDirs.map(newestMtime));
   const started = Date.now();
   await new Promise((resolve, reject) => {
+    let settled = false;
+    let stopping = false;
+    let managedRequestId = null;
+    const settleResolve = () => { if (!settled) { settled = true; resolve(); } };
+    const settleReject = (error) => { if (!settled) { settled = true; reject(error); } };
     child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32", detached: process.platform !== "win32" });
     try {
       if (child.pid && heavySlot) heavySlot.trackChild(child.pid, cmd);
@@ -465,6 +494,7 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
       stream.on("data", (chunk) => {
         lastProgress = Date.now();
         tail = `${tail}${chunk}`.slice(-64 * 1024);
+        if (!managedRequestId) managedRequestId = firstManagedRequestId(tail);
         output.write(chunk);
       });
     }
@@ -475,12 +505,24 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
       const cpu = processGroupCpuSeconds(child.pid);
       if (cpu !== null && lastCpu !== null && cpu > lastCpu) lastProgress = Date.now();
       if (cpu !== null) lastCpu = cpu;
-      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
-      else if (Date.now() - lastProgress > inactivityMs) stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
+      if (Date.now() - started > absoluteMs) void stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
+      else if (Date.now() - lastProgress > inactivityMs) void stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
     }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
-    const cleanup = () => { clearInterval(monitor); closeWatchers(); };
-    const stop = (reason, cpu = null) => {
+    const cleanup = () => {
+      clearInterval(monitor);
+      closeWatchers();
+      if (requestActiveRunStop === stop) requestActiveRunStop = null;
+    };
+    const stop = async (reason, cpu = null) => {
+      if (stopping || settled) return;
+      stopping = true;
       cleanup();
+      let cancellation = { status: "NO_MANAGED_REQUEST" };
+      try {
+        cancellation = await cancelAndReapManagedRequest(managedRequestId, { cwd, env });
+      } catch (error) {
+        cancellation = { status: "CANCEL_REAP_FAILED", error: error.message };
+      }
       if (diagnosticPath) {
         try {
           mkdirSync(path.dirname(diagnosticPath), { recursive: true });
@@ -491,6 +533,8 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
             `watched: ${watchDirs.join(path.delimiter)}`,
             `elapsedMs: ${Date.now() - started}`,
             `cpuSeconds: ${cpu ?? "unavailable"}`,
+            `managedRequestId: ${managedRequestId ?? "none"}`,
+            `managedCancellation: ${JSON.stringify(cancellation)}`,
             `killedAt: ${new Date().toISOString()}`,
             "",
             "--- last output ---",
@@ -500,11 +544,13 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
           console.error(`right-release: stall diagnostic written to ${diagnosticPath}`);
         } catch { /* diagnostics are best effort; never mask the stall itself */ }
       }
-      killTree(child.pid);
-      reject(new Error(`release step stalled: ${reason}`));
+      if (child?.pid) killTree(child.pid);
+      child = null;
+      settleReject(new Error(`release step stalled: ${reason}`));
     };
-    child.once("error", (error) => { cleanup(); reject(error); });
-    child.once("exit", (code) => { cleanup(); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
+    requestActiveRunStop = stop;
+    child.once("error", (error) => { cleanup(); child = null; if (!stopping) settleReject(error); });
+    child.once("exit", (code) => { cleanup(); child = null; if (!stopping) code === 0 ? settleResolve() : settleReject(new Error(`${cmd} exited ${code}`)); });
   });
 }
 

package/build-release.test.mjs

@@ -6,7 +6,7 @@ import { execFileSync, spawnSync } from "node:child_process";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
 import { parseCpuSeconds, processGroupCpuSeconds } from "./process-liveness.mjs";
-import { managedCargoShimOnPath } from "./cargo-contract.mjs";
+import { brokerManagedHost } from "./cargo-contract.mjs";
 
 const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
 const build = path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs");
@@ -27,7 +27,7 @@ test("macOS and Windows builds default to Cache V2 while explicit legacy mode re
   assert.match(source, /right-release build/);
   assert.match(source, /RIGHT_RELEASE_CACHE_MODE/);
   assert.match(source, /platform === "mac" \|\| platform === "win" \? "shared" : "legacy"/);
-  assert.match(source, /cacheMode !== "legacy" && cacheMode !== "shared"/);
+  assert.match(source, /cacheModeRequested !== "legacy" && cacheModeRequested !== "shared"/);
   assert.match(source, /resolveSharedCacheRoot/);
   assert.match(source, /acquireSuiteBuildSlot/);
   assert.match(source, /acquireHeavyWorkSlot/);
@@ -54,6 +54,24 @@ test("production builds package from the real primary app checkout", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
 });
 
+test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
+  assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
+  assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
+  assert.match(source, /const targetPrefix = "src-tauri\/target\/";/);
+  assert.match(source, /if \(managedCargoTarget && normalized\.startsWith\(targetPrefix\)\) \{/);
+  // Every configRoot-relative artifact lookup inside sealRelease must route
+  // through the resolver, or a managed build fails at seal after a full
+  // compile, sign, and notarize because src-tauri/target is never populated
+  // locally on a broker-managed host (target-bridge.mjs leaves it alone).
+  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.file\)/);
+  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.signature\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "installer"\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "updater"\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.signature\), "updater-signature"\)/);
+  assert.match(source, /const source = resolveArtifactPath\(artifact\.file\);/);
+  assert.match(source, /const signatureSource = resolveArtifactPath\(artifact\.signature\);/);
+});
+
 test("production builds never create or use an internal Git worktree", () => {
   assert.doesNotMatch(source, /git", \["worktree", "add"/);
   assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);
@@ -74,7 +92,30 @@ test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", ()
   // next build until someone deletes the link by hand.
   assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\)/);
   assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
-  assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
+  // A broker-managed host also routes through the bridge even though cacheMode
+  // is forced to "broker" there — its brokerManaged flag is what keeps a real
+  // (non-symlink) target directory from being treated as corruption.
+  assert.match(source, /if \(cacheMode === "shared" \|\| managedCargoTarget\) targetBridge\.ensure\(\)/);
+});
+
+test("a broker-managed host forces broker cacheMode so Cache V2's lease/prune/floor chain never runs against an unrelated volume", () => {
+  assert.match(
+    source,
+    /const cacheMode = managedCargoTarget \? "broker" : cacheModeRequested;/,
+  );
+  // Every Cache V2 lease/slot/prune/floor/mark call stays gated on cacheMode,
+  // never on cacheModeRequested directly, so forcing cacheMode to "broker" on a
+  // broker host is sufficient to skip all of them without a second gate.
+  for (const guarded of [
+    /acquireSuiteBuildSlot\(\{ layout: sharedLayout/,
+    /cacheLease = acquireCacheLease\(\{ layout: sharedLayout/,
+    /planCachePrune\(\{ snapshot, policy, protectedEntryIds: new Set\(\[sharedLayout\.id\]\) \}\)/,
+    /assertWriteVolumeFloors\(\{ volumes, policy,/,
+    /markCacheEntrySuccessful\(\{ layout: sharedLayout \}\)/,
+  ]) {
+    assert.match(source, guarded);
+  }
+  assert.doesNotMatch(source, /if \(cacheModeRequested === "shared"\) \{\s*\n\s*suiteSlot/);
 });
 
 test("Windows seal and cache identity bind the signing contract, config, and receipts", () => {
@@ -122,16 +163,17 @@ test("CPU sampling degrades to the old behaviour rather than inventing a verdict
 // bridged src-tauri/target into the release cache, and then lost CARGO_TARGET_DIR
 // to the broker's unconditional override. The app built into the broker workspace
 // and packaging failed on an empty cache before notarize/staple.
-const managedHostDetected = (env, platform, exists) =>
-  Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET || managedCargoShimOnPath(env, platform, exists));
+const managedHostDetected = (env, platform, exists) => brokerManagedHost(env, platform, exists);
 
 test("managed-host gate fires from the managed shim on PATH when no broker socket is exported", () => {
-  // The build gate is exactly the dual detection cargo-contract.mjs already uses.
+  // The build gate is exactly the shared brokerManagedHost predicate cargo-contract.mjs exports,
+  // so there is exactly one definition of "is this a broker-managed host" in the codebase.
   assert.match(
     source,
-    /const managedCargoTarget = \(process\.env\.RIGHTKIT_BUILD_BROKER_SOCKET \|\| managedCargoShimOnPath\(process\.env\)\)\n\s*\? resolveManagedCargoTarget\(cargoToml\)\n\s*: null;/,
+    /const managedCargoTarget = brokerManagedHost\(process\.env\) \? resolveTargetRoot\(cargoToml\) : null;/,
   );
-  assert.match(source, /import \{ managedCargoShimOnPath \} from "\.\/cargo-contract\.mjs";/);
+  assert.match(source, /import \{ brokerManagedHost \} from "\.\/cargo-contract\.mjs";/);
+  assert.match(source, /import \{ resolveTargetRoot \} from "\.\/cargo-target\.mjs";/);
 
   const shim = "/Volumes/D/.rightkit-managed/agent-bin/cargo";
   const exists = (candidate) => candidate === shim;
@@ -151,6 +193,23 @@ test("managed-host gate fires from the managed shim on PATH when no broker socke
   assert.equal(managedHostDetected({ PATH: `/usr/local/bin:${path.dirname(shim)}` }, "darwin", (c) => both.has(c)), false);
 });
 
+test("brokerManagedHost is the single shared predicate: env var alone, shim alone, both, or neither", () => {
+  const shim = "/Volumes/D/.rightkit-managed/agent-bin/cargo";
+  const exists = (candidate) => candidate === shim;
+
+  // Broker socket alone (login shell), no shim resolvable.
+  assert.equal(brokerManagedHost({ RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", PATH: "/usr/bin" }, "darwin", () => false), true);
+  // Shim on PATH alone (agent/non-login shell), no socket exported.
+  assert.equal(brokerManagedHost({ PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists), true);
+  // Both signals present.
+  assert.equal(
+    brokerManagedHost({ RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists),
+    true,
+  );
+  // Neither signal: unmanaged host.
+  assert.equal(brokerManagedHost({ PATH: "/usr/bin:/usr/local/bin" }, "darwin", () => false), false);
+});
+
 test("the managed branch hands the Rust target directory to the broker while the unmanaged branch keeps Cache V2", () => {
   // Managed: CARGO_TARGET_DIR (and the rest of the Cache V2 environment) is deleted
   // from the child environment, so the broker's own override is the only one.
@@ -164,7 +223,9 @@ test("the managed branch hands the Rust target directory to the broker while the
   assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\),/);
   // The managed target is read from crate metadata through the shim, which is what
   // makes the bridge target equal to the directory the broker actually builds into.
-  assert.match(source, /function resolveManagedCargoTarget\(manifestPath\)[\s\S]*?JSON\.parse\(output\)\.target_directory/);
+  // resolveTargetRoot (cargo-target.mjs) is the single shared implementation —
+  // build-release.mjs no longer defines its own copy.
+  assert.doesNotMatch(source, /function resolveManagedCargoTarget/);
   // Unmanaged (managedCargoTarget === null): Cache V2 still supplies CARGO_TARGET_DIR.
   assert.match(source, /\.\.\.releaseEnvironment\(\{ root: vaultRoot, cacheRoot: sharedCacheRoot,/);
 });

package/cache-command.mjs

@@ -13,12 +13,28 @@ import {
   resolveSharedCacheRoot,
 } from "./cache-policy.mjs";
 import { resolveReleaseLayout } from "./release-state.mjs";
+import { brokerManagedHost } from "./cargo-contract.mjs";
+
+// On a broker-managed host, CARGO_TARGET_DIR is not Cache V2's to own: the build
+// broker unconditionally overrides it to its own per-namespace workspace, so the
+// Cache V2 target layout under cacheRoot is legitimately empty (marker files only)
+// while the real ~18 GB of build output lives in the broker's workspace. Inspecting,
+// migrating, or pruning against that layout on a broker host reads real output as
+// missing/corrupt and can recommend destroying it — never phrase this as a problem.
+const BROKER_MANAGED_MESSAGE = "broker-managed host: the build broker owns CARGO_TARGET_DIR; Cache V2 target checks skipped";
+const BROKER_GATED_COMMANDS = new Set(["status", "prune", "migrate"]);
 
 export async function runCacheCommand(args = process.argv.slice(2), { env = process.env, stdout = console.log, stderr = console.error } = {}) {
   const [command, ...rest] = args;
   const json = rest.includes("--json");
   const platform = platformFrom(env);
   const cacheRoot = resolveSharedCacheRoot({ platform, env });
+  if (BROKER_GATED_COMMANDS.has(command) && brokerManagedHost(env)) {
+    const result = { schema: 1, command, cacheRoot, brokerManaged: true, skipped: true, message: BROKER_MANAGED_MESSAGE };
+    if (json) stdout(JSON.stringify(result));
+    else stdout(BROKER_MANAGED_MESSAGE);
+    return result;
+  }
   if (command === "status") {
     rejectUnknown(rest, new Set(["--json"]));
     const snapshot = inspectCache({ cacheRoot });

package/cache-command.test.mjs

@@ -9,8 +9,24 @@ import { fileURLToPath } from "node:url";
 const root = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(root, "cli", "right-release.mjs");
 
+// This suite must exercise the non-broker cache-command path deterministically,
+// regardless of whether the machine running the tests is itself broker-managed
+// (this workspace's own agent shells are: the managed cargo shim sits on PATH).
+// Strip both broker signals from the inherited environment so "unmanaged host"
+// tests stay unmanaged; individual tests opt back into broker signals explicitly.
+function unmanagedEnv(base = process.env) {
+  const sanitized = { ...base };
+  delete sanitized.RIGHTKIT_BUILD_BROKER_SOCKET;
+  const delimiter = process.platform === "win32" ? ";" : ":";
+  sanitized.PATH = String(base.PATH ?? "")
+    .split(delimiter)
+    .filter((entry) => !/(?:^|[/\\])(?:\.rightkit-managed|rightkitmanagedagent)[/\\]agent-bin$/i.test(entry))
+    .join(delimiter);
+  return sanitized;
+}
+
 function run(args, cacheRoot, env = {}) {
-  return spawnSync(process.execPath, [cli, "cache", ...args], { encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_CACHE_ROOT: cacheRoot, ...env } });
+  return spawnSync(process.execPath, [cli, "cache", ...args], { encoding: "utf8", env: { ...unmanagedEnv(), RIGHT_RELEASE_CACHE_ROOT: cacheRoot, ...env } });
 }
 
 test("cache status has human and schema-stable JSON output", () => {
@@ -73,3 +89,30 @@ test("cache migrate uses the repository vault Cargo home, not an app-local looka
   assert.equal(readFileSync(path.join(cacheRoot, "cargo-home", "registry"), "utf8"), "vault");
   assert.equal(readFileSync(path.join(appCargoHome, "registry"), "utf8"), "app-local");
 });
+
+test("status, prune, and migrate short-circuit cleanly on a broker-managed host without proposing a repair", () => {
+  const cacheRoot = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
+  const brokerEnv = { RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" };
+
+  const status = run(["status", "--json"], cacheRoot, brokerEnv);
+  assert.equal(status.status, 0, status.stderr);
+  const statusBody = JSON.parse(status.stdout);
+  assert.equal(statusBody.brokerManaged, true);
+  assert.match(statusBody.message, /broker-managed host/);
+  assert.doesNotMatch(status.stdout + status.stderr, /warn|repair|corrupt/i);
+
+  const prune = run(["prune", "--dry-run", "--json"], cacheRoot, brokerEnv);
+  assert.equal(prune.status, 0, prune.stderr);
+  assert.equal(JSON.parse(prune.stdout).brokerManaged, true);
+
+  // migrate short-circuits before even requiring --config, since a broker host has
+  // nothing under Cache V2's target layout for it to migrate into.
+  const migrate = run(["migrate", "--json"], cacheRoot, brokerEnv);
+  assert.equal(migrate.status, 0, migrate.stderr);
+  assert.equal(JSON.parse(migrate.stdout).brokerManaged, true);
+
+  // Non-broker host: unchanged behaviour.
+  const unmanaged = run(["status", "--json"], cacheRoot);
+  assert.equal(unmanaged.status, 0, unmanaged.stderr);
+  assert.equal(JSON.parse(unmanaged.stdout).brokerManaged, undefined);
+});

package/cache-policy.mjs

@@ -30,21 +30,59 @@ export const CACHE_LOCK_ORDER = ["release", "suite-build-slot", "gc", "entry-lea
 
 const MARKER = ".rightkit-cache-entry.json";
 
-export function resolveSharedCacheRoot({ platform = process.platform, env = process.env, home = os.homedir(), xdgCacheHome } = {}) {
-  const override = env.RIGHT_RELEASE_CACHE_ROOT;
-  if (override) {
-    if (!isAbsoluteForPlatform(override, platform)) throw new Error("RIGHT_RELEASE_CACHE_ROOT must be an absolute path");
-    return resolveForPlatform(override, platform);
-  }
+export function resolveSharedCacheRoot({ platform = process.platform, env = process.env, home = os.homedir() } = {}) {
   if (platform === "darwin" || platform === "mac") {
+    const override = env.RIGHT_RELEASE_CACHE_ROOT;
+    if (override) {
+      if (!isAbsoluteForPlatform(override, platform)) throw new Error("RIGHT_RELEASE_CACHE_ROOT must be an absolute path");
+      return resolveForPlatform(override, platform);
+    }
     throw new Error("RIGHT_RELEASE_CACHE_ROOT is required on macOS; set it to external storage");
   }
+  return resolveStableRoot({
+    platform,
+    env,
+    home,
+    explicitOverride: env.RIGHT_RELEASE_CACHE_ROOT,
+    overrideName: "RIGHT_RELEASE_CACHE_ROOT",
+    win32EnvVar: "LOCALAPPDATA",
+    win32Segments: ["RightSuite", "Cache", "release"],
+    otherSegments: ["rightsuite", "release"],
+  });
+}
+
+// resolveStableRoot centralizes platform-native root derivation for both cache roots
+// (waste-tolerant, may split) and lock roots (must never split, or mutual exclusion
+// silently breaks). Route every such root through this one primitive.
+export function resolveStableRoot({
+  platform = process.platform,
+  env = process.env,
+  home = os.homedir(),
+  explicitOverride,
+  overrideName,
+  darwinSegments,
+  win32EnvVar = "LOCALAPPDATA",
+  win32Segments,
+  otherSegments,
+  otherBaseSegments = [".cache"],
+} = {}) {
+  if (explicitOverride) {
+    if (!isAbsoluteForPlatform(explicitOverride, platform)) throw new Error(`${overrideName} must be an absolute path`);
+    return resolveForPlatform(explicitOverride, platform);
+  }
   if (platform === "win32" || platform === "win") {
-    const local = env.LOCALAPPDATA;
-    if (!local || !isAbsoluteForPlatform(local, platform)) throw new Error("LOCALAPPDATA must be an absolute path for the RightSuite cache");
-    return path.win32.resolve(local, "RightSuite", "Cache", "release");
+    const local = env[win32EnvVar];
+    if (!local || !isAbsoluteForPlatform(local, platform)) throw new Error(`${win32EnvVar} must be an absolute path for RightSuite`);
+    return path.win32.resolve(local, ...win32Segments);
+  }
+  if (platform === "darwin" || platform === "mac") {
+    return path.posix.join(home, ...darwinSegments);
   }
-  return path.posix.resolve(xdgCacheHome || env.XDG_CACHE_HOME || path.posix.join(home, ".cache"), "rightsuite", "release");
+  // Never read a shell-profile-scoped variable (XDG_CACHE_HOME, XDG_CONFIG_HOME,
+  // npm_config_cache, etc.) as an implicit default here: those differ between login
+  // and non-login shells, so the same process can resolve to two different roots
+  // depending on how it was launched. Always derive from the OS home directory instead.
+  return path.posix.resolve(path.posix.join(home, ...otherBaseSegments), ...otherSegments);
 }
 
 export function resolveCacheLayout({ cacheRoot, platform, architecture, app, fingerprint, kind = "release" } = {}) {