@rightkit/release 0.2.66 → 0.2.68

package/addon-command.test.mjs

@@ -13,8 +13,8 @@ function fixture() {
   mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
   for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
   writeFileSync(path.join(root, "assets", "tab.png"), "icon");
-  const files = [["command", "membrane", "out/membrane", true], ["service", "crypt-service", "out/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
+  const files = [["command", "membrane", "out/membrane", true], ["service", "membrane-service", "out/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
+  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
   execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
   return root;
 }
@@ -25,7 +25,7 @@ test("add-on dry-run creates no release state and never executes build", () => {
 
 test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
   const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
   const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const sealed = path.join(root, "sealed"); mkdirSync(sealed);
   for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
@@ -44,11 +44,11 @@ test("local adoption verifies lock and stages portable plus Tauri-qualified bina
 
 test("remote downloader accepts only immutable manifest plus file routes", async () => {
   const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
   const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
   const destination = path.join(root, "remote"); mkdirSync(destination);
   await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
-  assert.equal(readFileSync(path.join(destination, "crypt-service"), "utf8"), "service");
+  assert.equal(readFileSync(path.join(destination, "membrane-service"), "utf8"), "service");
   assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
 });

package/addon-contract.test.mjs

@@ -8,12 +8,12 @@ import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonCon
 function fixture() {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
   mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
-  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/crypt-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
+  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/membrane-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
   const files = [
-    ["command", "membrane", "bin/membrane", true], ["service", "crypt-service", "bin/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
+    ["command", "membrane", "bin/membrane", true], ["service", "membrane-service", "bin/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
     ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
   ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
+  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
 }
 
 test("add-on manifest has portable immutable identity and routes", () => {

package/build-release.mjs

@@ -33,6 +33,7 @@ import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures }
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
 import { processGroupCpuSeconds } from "./process-liveness.mjs";
+import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimits } from "./progress-control.mjs";
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
@@ -104,6 +105,7 @@ let suiteSlot;
 let cacheLease;
 let heavySlot;
 let interrupted;
+let requestActiveRunStop = null;
 
 // A dry-run is an inspection contract, not a partial build. It must finish
 // before locks, cache directories, receipts, dependency installation, or any
@@ -124,9 +126,10 @@ if (dryRun) {
 
 for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
   process.once(signal, () => {
-    if (child?.pid) killTree(child.pid);
     interrupted = new Error(`release interrupted by ${signal}`);
     process.exitCode = signal === "SIGINT" ? 130 : 143;
+    if (requestActiveRunStop) void requestActiveRunStop(interrupted.message);
+    else if (child?.pid) killTree(child.pid);
   });
 }
 
@@ -319,13 +322,14 @@ try {
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
           path.join(stateRoot, "stall-build.log"),
+          { livenessOwnerTimeoutMs: target.package.livenessOwnerTimeoutMs ?? null },
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
         checkpoint(stateRoot, "hardened");
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -365,17 +369,32 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
+function sealRelease({ configRoot, managedCargoTarget, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
+  // Every app's right-release.config.mjs names installer/updater artifacts
+  // relative to the local `src-tauri/target`. On a broker-managed host that
+  // directory is never populated (the broker owns CARGO_TARGET_DIR and
+  // targetBridge.ensure() deliberately leaves a real local directory alone,
+  // see target-bridge.mjs) so those paths must resolve against the broker's
+  // own target root instead, or every managed build fails at seal after a
+  // full compile, sign, and notarize.
+  const targetPrefix = "src-tauri/target/";
+  const resolveArtifactPath = (file) => {
+    const normalized = file.replaceAll(path.win32.sep, "/");
+    if (managedCargoTarget && normalized.startsWith(targetPrefix)) {
+      return path.join(managedCargoTarget, normalized.slice(targetPrefix.length));
+    }
+    return path.resolve(configRoot, file);
+  };
   const sources = new Map();
   const addSource = (source, role) => {
     const current = sources.get(source) ?? new Set();
     current.add(role);
     sources.set(source, current);
   };
-  for (const artifact of target.installer?.artifacts ?? []) addSource(path.resolve(configRoot, artifact.file), "installer");
+  for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
-    addSource(path.resolve(configRoot, artifact.file), "updater");
-    addSource(path.resolve(configRoot, artifact.signature), "updater-signature");
+    addSource(resolveArtifactPath(artifact.file), "updater");
+    addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
@@ -392,14 +411,15 @@ function sealRelease({ configRoot, sealedDir, releaseId, config, target, platfor
   }
   const routes = { patch: [], update: [] };
   for (const artifact of target.installer?.artifacts ?? []) {
-    const source = path.resolve(configRoot, artifact.file);
+    const source = resolveArtifactPath(artifact.file);
     routes.patch.push({ role: "installer", name: sourceNames.get(source), bucket: "public", key: artifact.key });
   }
   for (const artifact of target.updater?.artifacts ?? []) {
-    const source = path.resolve(configRoot, artifact.file);
+    const source = resolveArtifactPath(artifact.file);
+    const signatureSource = resolveArtifactPath(artifact.signature);
     const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
-    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "public", key: patchKey, platform: artifact.platform });
-    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "private", key: artifact.key, platform: artifact.platform });
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "private", key: artifact.key, platform: artifact.platform });
   }
   writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
   const manifest = {
@@ -445,15 +465,20 @@ function collectToolVersions(packageManager) {
   }
 }
 
-async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
-  const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
-  const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
+async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null, { livenessOwnerTimeoutMs = null } = {}) {
+  const { inactivityMs, absoluteMs } = releaseProgressLimits(env, { livenessOwnerTimeoutMs });
   let lastProgress = Date.now();
   const watchDirs = Array.isArray(watchDir) ? watchDir : [watchDir];
   let lastMtime = Math.max(...watchDirs.map(newestMtime));
   const started = Date.now();
   await new Promise((resolve, reject) => {
-    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32", detached: process.platform !== "win32" });
+    let settled = false;
+    let stopping = false;
+    let managedRequestId = null;
+    const settleResolve = () => { if (!settled) { settled = true; resolve(); } };
+    const settleReject = (error) => { if (!settled) { settled = true; reject(error); } };
+    const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
+    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: useShell, detached: process.platform !== "win32" });
     try {
       if (child.pid && heavySlot) heavySlot.trackChild(child.pid, cmd);
     } catch (error) {
@@ -471,6 +496,7 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
       stream.on("data", (chunk) => {
         lastProgress = Date.now();
         tail = `${tail}${chunk}`.slice(-64 * 1024);
+        if (!managedRequestId) managedRequestId = firstManagedRequestId(tail);
         output.write(chunk);
       });
     }
@@ -481,12 +507,24 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
       const cpu = processGroupCpuSeconds(child.pid);
       if (cpu !== null && lastCpu !== null && cpu > lastCpu) lastProgress = Date.now();
       if (cpu !== null) lastCpu = cpu;
-      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
-      else if (Date.now() - lastProgress > inactivityMs) stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
+      if (Date.now() - started > absoluteMs) void stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
+      else if (Date.now() - lastProgress > inactivityMs) void stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
     }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
-    const cleanup = () => { clearInterval(monitor); closeWatchers(); };
-    const stop = (reason, cpu = null) => {
+    const cleanup = () => {
+      clearInterval(monitor);
+      closeWatchers();
+      if (requestActiveRunStop === stop) requestActiveRunStop = null;
+    };
+    const stop = async (reason, cpu = null) => {
+      if (stopping || settled) return;
+      stopping = true;
       cleanup();
+      let cancellation = { status: "NO_MANAGED_REQUEST" };
+      try {
+        cancellation = await cancelAndReapManagedRequest(managedRequestId, { cwd, env });
+      } catch (error) {
+        cancellation = { status: "CANCEL_REAP_FAILED", error: error.message };
+      }
       if (diagnosticPath) {
         try {
           mkdirSync(path.dirname(diagnosticPath), { recursive: true });
@@ -497,6 +535,8 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
             `watched: ${watchDirs.join(path.delimiter)}`,
             `elapsedMs: ${Date.now() - started}`,
             `cpuSeconds: ${cpu ?? "unavailable"}`,
+            `managedRequestId: ${managedRequestId ?? "none"}`,
+            `managedCancellation: ${JSON.stringify(cancellation)}`,
             `killedAt: ${new Date().toISOString()}`,
             "",
             "--- last output ---",
@@ -506,11 +546,13 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
           console.error(`right-release: stall diagnostic written to ${diagnosticPath}`);
         } catch { /* diagnostics are best effort; never mask the stall itself */ }
       }
-      killTree(child.pid);
-      reject(new Error(`release step stalled: ${reason}`));
+      if (child?.pid) killTree(child.pid);
+      child = null;
+      settleReject(new Error(`release step stalled: ${reason}`));
     };
-    child.once("error", (error) => { cleanup(); reject(error); });
-    child.once("exit", (code) => { cleanup(); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
+    requestActiveRunStop = stop;
+    child.once("error", (error) => { cleanup(); child = null; if (!stopping) settleReject(error); });
+    child.once("exit", (code) => { cleanup(); child = null; if (!stopping) code === 0 ? settleResolve() : settleReject(new Error(`${cmd} exited ${code}`)); });
   });
 }
 

package/build-release.test.mjs

@@ -54,6 +54,30 @@ test("production builds package from the real primary app checkout", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
 });
 
+test("Windows native executables preserve arguments containing spaces", () => {
+  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
+  assert.match(source, /shell: useShell/);
+  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
+});
+
+test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
+  assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
+  assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
+  assert.match(source, /const targetPrefix = "src-tauri\/target\/";/);
+  assert.match(source, /if \(managedCargoTarget && normalized\.startsWith\(targetPrefix\)\) \{/);
+  // Every configRoot-relative artifact lookup inside sealRelease must route
+  // through the resolver, or a managed build fails at seal after a full
+  // compile, sign, and notarize because src-tauri/target is never populated
+  // locally on a broker-managed host (target-bridge.mjs leaves it alone).
+  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.file\)/);
+  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.signature\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "installer"\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "updater"\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.signature\), "updater-signature"\)/);
+  assert.match(source, /const source = resolveArtifactPath\(artifact\.file\);/);
+  assert.match(source, /const signatureSource = resolveArtifactPath\(artifact\.signature\);/);
+});
+
 test("production builds never create or use an internal Git worktree", () => {
   assert.doesNotMatch(source, /git", \["worktree", "add"/);
   assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);
@@ -139,6 +163,11 @@ test("CPU sampling degrades to the old behaviour rather than inventing a verdict
   assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
 });
 
+test("package liveness owner timeout floors outer watchdog through shared release limits", () => {
+  assert.match(source, /livenessOwnerTimeoutMs: target\.package\.livenessOwnerTimeoutMs \?\? null/);
+  assert.match(source, /releaseProgressLimits\(env, \{ livenessOwnerTimeoutMs \}\)/);
+});
+
 // Regression: the managed-host gate must not depend on RIGHTKIT_BUILD_BROKER_SOCKET
 // alone. That variable is exported by login shells only, while the managed cargo
 // shim is on PATH in every shell — so an agent shell took the Cache V2 branch,

package/cargo-guard.mjs

@@ -129,6 +129,24 @@ export function resolveRealRustc({ env = process.env, run = spawnSync } = {}) {
   return path.resolve(rustc);
 }
 
+// Locate the broker's own managed cargo shim on PATH (the agent-bin launcher
+// that routes into the build broker). Used to hand a whole invocation to the
+// broker on a managed host instead of resolving & running the real toolchain
+// ourselves — which would bypass managed build control entirely.
+export function resolveManagedCargoShim({ env = process.env, platform = process.platform, exists = existsSync } = {}) {
+  const win = platform === "win32" || platform === "win";
+  const delimiter = win ? ";" : ":";
+  const agentBin = /(?:^|[\\/])(?:\.rightkit-managed|rightkitmanagedagent)[\\/]agent-bin[\\/]?$/i;
+  for (const directory of String(env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    if (!agentBin.test(directory)) continue;
+    for (const name of win ? ["cargo.exe", "cargo.cmd"] : ["cargo"]) {
+      const candidate = path.join(directory, name);
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
 function pathApi(platform) {
   return platform === "win32" || platform === "win" ? path.win32 : path.posix;
 }
@@ -209,8 +227,20 @@ function spawnCargo(command, args, env) {
   });
 }
 
-export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo } = {}) {
+export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo, resolveShim = resolveManagedCargoShim, isBrokerHost = brokerManagedHost } = {}) {
   assertComputePolicyAllowsCargo(args, { ...policyOptions, env });
+  // On a broker-managed host the build broker owns the toolchain, cache, and
+  // quotas. Resolving the real Cargo here and running it via runHeavy would
+  // bypass the broker (and, on Windows, resolveReal* itself fails: `rustup
+  // which` routes through the managed shim into the broker's isolated
+  // RUSTUP_HOME, which has no default toolchain). Hand the whole invocation to
+  // the broker's own cargo shim instead — everything through the broker.
+  if (isBrokerHost(env)) {
+    const shim = resolveShim({ env });
+    if (shim) return runLight(shim, args, env);
+    // No shim found despite a broker signal: fall through to legacy resolution
+    // rather than silently dropping the guard.
+  }
   const cargo = resolveCargo({ env });
   if (shouldGuardCargo(args)) {
     const guarded = cargoCacheEnvironment(args, { env });

package/cargo-guard.test.mjs

@@ -86,6 +86,37 @@ test("Cargo guard rejects cache escapes and alternate compiler wrappers", async
   await assert.rejects(run(["build"], { RUSTC_WRAPPER: "rustc-wrapper" }), /RUSTC_WRAPPER/);
 });
 
+test("Cargo guard hands the whole invocation to the broker on a managed host", async () => {
+  const calls = [];
+  let resolvedReal = false;
+  const options = {
+    env: { TEST: "1" },
+    policyOptions: { exists: () => false },
+    isBrokerHost: () => true,
+    resolveShim: () => "/managed/agent-bin/cargo",
+    resolveCargo: () => { resolvedReal = true; return "/real/cargo"; },
+    resolveRustc: () => { resolvedReal = true; return "/real/rustc"; },
+    runHeavy: async () => { throw new Error("must not run heavy on a broker host"); },
+    runLight: async (command, args) => { calls.push([command, args]); return 0; },
+  };
+  // A guarded command (build) and a light command (--version) both delegate to
+  // the broker shim verbatim, and the real-toolchain resolver is never touched.
+  assert.equal(await runCargoGuard(["build", "--release"], options), 0);
+  assert.equal(await runCargoGuard(["--version"], options), 0);
+  assert.deepEqual(calls, [["/managed/agent-bin/cargo", ["build", "--release"]], ["/managed/agent-bin/cargo", ["--version"]]]);
+  assert.equal(resolvedReal, false);
+});
+
+test("Cargo guard falls back to real resolution when a broker signal has no shim", async () => {
+  const calls = [];
+  await runCargoGuard(["build"], {
+    env: cacheEnv(), isBrokerHost: () => true, resolveShim: () => null,
+    resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
+    runHeavy: async (args) => { calls.push(args); return 0; },
+  });
+  assert.deepEqual(calls[0].slice(0, 2), ["--", "/real/cargo"]);
+});
+
 test("Cargo guard routes heavy and light commands without recursion", async () => {
   const calls = [];
   const options = {

package/cargo-target.mjs

@@ -13,11 +13,12 @@ import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-export function resolveTargetRoot(manifestPath) {
+export function resolveTargetRoot(manifestPath, options = {}) {
   if (!manifestPath) throw new Error("resolveTargetRoot requires a Cargo.toml manifest path");
+  const execute = options.execFileSync ?? execFileSync;
   let output;
   try {
-    output = execFileSync(
+    output = execute(
       "cargo",
       ["metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifestPath],
       { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 },

package/cargo-target.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { chmodSync, mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -11,91 +11,42 @@ import { resolveTargetRoot } from "./cargo-target.mjs";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(here, "cargo-target.mjs");
 
-// A fake `cargo` on PATH, ahead of the real one, so metadata success/failure
-// shapes are deterministic and don't depend on the host's actual crate graph.
-// It branches on a marker embedded in the manifest path so each test controls
-// its own outcome independently.
-function fakeCargoBin() {
+function fakeCargo() {
   const bin = mkdtempSync(path.join(os.tmpdir(), "rightkit-fake-cargo-"));
-  const script = path.join(bin, process.platform === "win32" ? "cargo.cmd" : "cargo");
-  const body = process.platform === "win32"
-    ? [
-      "@echo off",
-      "setlocal enabledelayedexpansion",
-      "set ARGS=%*",
-      "echo %ARGS% | findstr /C:\"fail-manifest\" >nul && (echo boom 1>&2 & exit /b 1)",
-      "echo %ARGS% | findstr /C:\"bad-target-manifest\" >nul && (echo {\"target_directory\":\"relative/target\"} & exit /b 0)",
-      "echo {\"target_directory\":\"" + path.join(bin, "target").replaceAll("\\", "\\\\") + "\"}",
-    ].join("\r\n")
-    : [
-      "#!/bin/sh",
-      'case "$*" in',
-      '  *fail-manifest*) echo boom 1>&2; exit 1 ;;',
-      '  *bad-target-manifest*) echo \'{"target_directory":"relative/target"}\'; exit 0 ;;',
-      `  *) echo '{"target_directory":"${path.join(bin, "target")}"}'; exit 0 ;;`,
-      "esac",
-    ].join("\n");
-  writeFileSync(script, body);
-  if (process.platform !== "win32") chmodSync(script, 0o755);
-  return bin;
-}
-
-function withFakeCargo(fn) {
-  const bin = fakeCargoBin();
-  const env = { ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH ?? ""}` };
-  return fn({ bin, env });
+  return {
+    bin,
+    execFileSync(_command, args) {
+      const manifest = args.at(-1);
+      if (manifest.includes("fail-manifest")) throw new Error("boom");
+      if (manifest.includes("bad-target-manifest")) return '{"target_directory":"relative/target"}';
+      return JSON.stringify({ target_directory: path.join(bin, "target") });
+    },
+  };
 }
 
 test("resolveTargetRoot returns the absolute target_directory Cargo metadata reports", () => {
-  withFakeCargo(({ bin, env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      const result = resolveTargetRoot(manifest);
-      assert.equal(result, path.resolve(path.join(bin, "target")));
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { bin, execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "Cargo.toml");
+  const result = resolveTargetRoot(manifest, { execFileSync });
+  assert.equal(result, path.resolve(path.join(bin, "target")));
 });
 
 test("resolveTargetRoot fails closed, naming the manifest, when target_directory is not absolute", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "bad-target-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      assert.throws(
-        () => resolveTargetRoot(manifest),
-        new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
-      );
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "bad-target-manifest-Cargo.toml");
+  assert.throws(
+    () => resolveTargetRoot(manifest, { execFileSync }),
+    new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
+  );
 });
 
 test("resolveTargetRoot fails closed, naming the manifest, when the metadata command exits non-zero", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      assert.throws(
-        () => resolveTargetRoot(manifest),
-        new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
-      );
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "fail-manifest-Cargo.toml");
+  assert.throws(
+    () => resolveTargetRoot(manifest, { execFileSync }),
+    new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
+  );
 });
 
 test("resolveTargetRoot throws when no manifest path is given", () => {
@@ -104,26 +55,24 @@ test("resolveTargetRoot throws when no manifest path is given", () => {
 });
 
 test("CLI mode writes only the resolved path to stdout on success", () => {
-  withFakeCargo(({ bin, env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout.trim(), path.resolve(path.join(bin, "target")));
-  });
+  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+  const manifest = path.join(manifestDir, "Cargo.toml");
+  mkdirSync(path.join(manifestDir, "src"));
+  writeFileSync(path.join(manifestDir, "src", "lib.rs"), "");
+  writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(path.isAbsolute(result.stdout.trim()), true);
 });
 
 test("CLI mode writes a message to stderr and exits 1 on failure", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
-    assert.equal(result.status, 1);
-    assert.equal(result.stdout, "");
-    assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
-  });
+  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+  const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
+  writeFileSync(manifest, "not valid toml");
+  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
+  assert.equal(result.status, 1);
+  assert.equal(result.stdout, "");
+  assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
 });
 
 test("CLI mode requires a manifest argument", () => {

package/github-release.test.mjs

@@ -27,13 +27,13 @@ function fixture() {
 function addonFixture() {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
   mkdirSync(path.join(root, "out"));
-  for (const [name, bytes] of [["membrane", "command"], ["crypt-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
+  for (const [name, bytes] of [["membrane", "command"], ["membrane-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
   execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
   execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
   execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
   writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
-  const files = [["command", "membrane", true], ["service", "crypt-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
-  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "orthic-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
+  const files = [["command", "membrane", true], ["service", "membrane-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
+  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "membrane-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
   const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
   const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.66",
+  "version": "0.2.68",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -25,7 +25,8 @@
     "directory": "tools/rightkit/packages/release"
   },
   "scripts": {
-    "test": "node --test *.test.mjs",
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }

package/progress-control.mjs

@@ -0,0 +1,75 @@
+import { spawn } from "node:child_process";
+
+const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
+export const RELEASE_LIVENESS_OWNER_MARGIN_MS = 5 * 60 * 1000;
+
+export function latestManagedRequestId(value, fallback = null) {
+  let latest = fallback;
+  for (const match of String(value ?? "").matchAll(MANAGED_REQUEST_PATTERN)) latest = match[1].toLowerCase();
+  return latest;
+}
+
+export function firstManagedRequestId(value) {
+  MANAGED_REQUEST_PATTERN.lastIndex = 0;
+  return MANAGED_REQUEST_PATTERN.exec(String(value ?? ""))?.[1]?.toLowerCase() ?? null;
+}
+
+export function releaseProgressLimits(env = process.env, { livenessOwnerTimeoutMs = null } = {}) {
+  const configuredInactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+  const absoluteMs = Number(env.RIGHT_RELEASE_ABSOLUTE_MS ?? 4 * 60 * 60 * 1000);
+  const ownerTimeoutMs = livenessOwnerTimeoutMs === null ? null : Number(livenessOwnerTimeoutMs);
+  if (![configuredInactivityMs, absoluteMs, ...(ownerTimeoutMs === null ? [] : [ownerTimeoutMs])].every((value) => Number.isFinite(value) && value > 0)) {
+    throw new Error("release progress limits must be positive finite milliseconds");
+  }
+  const inactivityMs = ownerTimeoutMs === null
+    ? configuredInactivityMs
+    : Math.max(configuredInactivityMs, ownerTimeoutMs + RELEASE_LIVENESS_OWNER_MARGIN_MS);
+  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed effective release inactivity limit");
+  return Object.freeze({ inactivityMs, absoluteMs });
+}
+
+function runRightkitControl(args, { cwd, env, timeoutMs = 30_000 } = {}) {
+  return new Promise((resolve) => {
+    const control = spawn("rightkit", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    let output = "";
+    let timedOut = false;
+    const append = (chunk) => { output = `${output}${chunk}`.slice(-64 * 1024); };
+    control.stdout.on("data", append);
+    control.stderr.on("data", append);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      control.kill("SIGTERM");
+      setTimeout(() => control.kill("SIGKILL"), 1_000).unref();
+    }, timeoutMs);
+    timer.unref();
+    control.once("error", (error) => {
+      clearTimeout(timer);
+      resolve(Object.freeze({ code: 125, output, timedOut, error: error.message }));
+    });
+    control.once("exit", (code, signal) => {
+      clearTimeout(timer);
+      resolve(Object.freeze({ code: code ?? 125, signal, output, timedOut }));
+    });
+  });
+}
+
+export function terminalResultFromOutput(output) {
+  for (const line of String(output ?? "").split(/\r?\n/).reverse()) {
+    try {
+      const candidate = JSON.parse(line);
+      if (candidate?.type === "RESULT" && typeof candidate.status === "string") return candidate;
+    } catch { /* streamed build output is not JSON */ }
+  }
+  return null;
+}
+
+export async function cancelAndReapManagedRequest(id, { cwd = process.cwd(), env = process.env, run = runRightkitControl } = {}) {
+  if (!id) return Object.freeze({ status: "NO_MANAGED_REQUEST" });
+  const cancel = await run(["cancel", id], { cwd, env });
+  const attach = await run(["attach", id], { cwd, env });
+  const terminal = terminalResultFromOutput(attach.output);
+  if (!terminal) {
+    throw new Error(`broker cancellation for ${id} lacked terminal RESULT (cancel=${cancel.code}, attach=${attach.code}${attach.timedOut ? ", attach-timeout" : ""})`);
+  }
+  return Object.freeze({ status: terminal.status, id, exitCode: terminal.exitCode, receipt: terminal.receipt ?? null, cancelExitCode: cancel.code, attachExitCode: attach.code });
+}

package/progress-control.test.mjs

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { cancelAndReapManagedRequest, firstManagedRequestId, latestManagedRequestId, releaseProgressLimits, terminalResultFromOutput } from "./progress-control.mjs";
+
+test("release progress stays bounded without killing a healthy long native build at 90 minutes", () => {
+  assert.deepEqual(releaseProgressLimits({}), { inactivityMs: 600_000, absoluteMs: 14_400_000 });
+  assert.deepEqual(releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "5000" }), { inactivityMs: 1_000, absoluteMs: 5_000 });
+  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "1000" }), /must exceed/);
+  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
+});
+
+test("declared inner liveness owner always exits before the outer watchdog", () => {
+  const ownerTimeoutMs = 45 * 60 * 1000;
+  assert.deepEqual(
+    releaseProgressLimits({}, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    { inactivityMs: 50 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
+  );
+  assert.deepEqual(
+    releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: String(60 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    { inactivityMs: 60 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
+  );
+  assert.throws(
+    () => releaseProgressLimits({ RIGHT_RELEASE_ABSOLUTE_MS: String(49 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    /must exceed effective release inactivity limit/,
+  );
+  assert.throws(() => releaseProgressLimits({}, { livenessOwnerTimeoutMs: 0 }), /positive finite/);
+});
+
+test("latest managed request id follows streamed root Cargo requests", () => {
+  const first = "11111111-1111-4111-8111-111111111111";
+  const second = "22222222-2222-4222-8222-222222222222";
+  assert.equal(latestManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), second);
+  assert.equal(firstManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), first);
+  assert.equal(latestManagedRequestId("ordinary output", first), first);
+});
+
+test("managed cancellation issues CANCEL, waits for terminal RESULT, & returns reap receipt", async () => {
+  const id = "33333333-3333-4333-8333-333333333333";
+  const calls = [];
+  const run = async (args) => {
+    calls.push(args);
+    if (args[0] === "cancel") return { code: 0, output: JSON.stringify({ type: "CANCEL_REQUESTED", id }) };
+    return { code: 130, output: `compiler tail\n${JSON.stringify({ type: "RESULT", id, status: "CANCELLED", exitCode: 130, receipt: { reap: { reaped: true } } })}\n` };
+  };
+  assert.deepEqual(await cancelAndReapManagedRequest(id, { run }), {
+    status: "CANCELLED", id, exitCode: 130, receipt: { reap: { reaped: true } }, cancelExitCode: 0, attachExitCode: 130,
+  });
+  assert.deepEqual(calls, [["cancel", id], ["attach", id]]);
+});
+
+test("missing terminal broker result fails closed", async () => {
+  const run = async () => ({ code: 125, output: "broker closed", timedOut: false });
+  await assert.rejects(cancelAndReapManagedRequest("44444444-4444-4444-8444-444444444444", { run }), /lacked terminal RESULT/);
+  assert.equal(terminalResultFromOutput("noise\n"), null);
+});

package/registry-parity.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = fileURLToPath(new URL('.', import.meta.url));
+
+async function files(root, relative = '') {
+  const entries = await readdir(join(root, relative), { withFileTypes: true });
+  const result = [];
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const path = relative ? `${relative}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) result.push(...await files(root, path));
+    else if (entry.isFile()) result.push(path);
+  }
+  return result;
+}
+
+export async function packedTree(root) {
+  const paths = await files(root);
+  const values = [];
+  for (const path of paths) {
+    const bytes = await readFile(join(root, path));
+    values.push([path, createHash('sha256').update(bytes).digest('hex')]);
+  }
+  return values;
+}
+
+export function comparePackedTrees(local, published) {
+  const left = JSON.stringify(local); const right = JSON.stringify(published);
+  if (left === right) return Object.freeze({ equal: true, differences: [] });
+  const localMap = new Map(local); const publishedMap = new Map(published);
+  const differences = [...new Set([...localMap.keys(), ...publishedMap.keys()])]
+    .sort()
+    .filter((path) => localMap.get(path) !== publishedMap.get(path));
+  return Object.freeze({ equal: false, differences: Object.freeze(differences) });
+}
+
+async function extract(archive, destination) {
+  await mkdir(destination, { recursive: true });
+  execFileSync('tar', ['-xzf', archive, '-C', destination], { stdio: 'pipe' });
+  return join(destination, 'package');
+}
+
+export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl = fetch } = {}) {
+  const manifest = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
+  const encodedName = encodeURIComponent(manifest.name);
+  const metadata = await fetchImpl(`https://registry.npmjs.org/${encodedName}/${manifest.version}`);
+  if (metadata.status === 404 && allowUnpublished) return Object.freeze({ status: 'UNPUBLISHED', name: manifest.name, version: manifest.version });
+  if (!metadata.ok) throw new Error(`registry metadata failed: HTTP ${metadata.status}`);
+  const record = await metadata.json();
+  if (typeof record?.dist?.tarball !== 'string') throw new Error('registry metadata omitted dist.tarball');
+  const root = await mkdtemp(join(tmpdir(), 'rightkit-release-parity-'));
+  try {
+    const localDir = join(root, 'local'); const publishedArchive = join(root, 'published.tgz');
+    await mkdir(localDir, { recursive: true });
+    const packed = JSON.parse(execFileSync('pnpm', ['pack', '--pack-destination', localDir, '--json'], { cwd: packageRoot, encoding: 'utf8' }));
+    const localArchive = join(localDir, basename(packed[0]?.filename ?? ''));
+    const response = await fetchImpl(record.dist.tarball);
+    if (!response.ok) throw new Error(`registry tarball failed: HTTP ${response.status}`);
+    await writeFile(publishedArchive, Buffer.from(await response.arrayBuffer()));
+    const localTree = await packedTree(await extract(localArchive, join(root, 'local-tree')));
+    const publishedTree = await packedTree(await extract(publishedArchive, join(root, 'published-tree')));
+    const comparison = comparePackedTrees(localTree, publishedTree);
+    if (!comparison.equal) throw new Error(`published ${manifest.name}@${manifest.version} differs from source pack: ${comparison.differences.join(', ')}`);
+    return Object.freeze({ status: 'MATCH', name: manifest.name, version: manifest.version, files: localTree.length });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  verifyRegistryParity({ allowUnpublished: process.argv.includes('--allow-unpublished') })
+    .then((result) => process.stdout.write(`${JSON.stringify(result)}\n`))
+    .catch((error) => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });
+}

package/registry-parity.test.mjs

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { comparePackedTrees, verifyRegistryParity } from './registry-parity.mjs';
+
+test('registry parity rejects same-version packed-byte drift', () => {
+  assert.deepEqual(comparePackedTrees([['build-release.mjs', 'new']], [['build-release.mjs', 'old']]), {
+    equal: false,
+    differences: ['build-release.mjs'],
+  });
+});
+
+test('registry parity accepts identical packed trees', () => {
+  assert.deepEqual(comparePackedTrees([['a.mjs', 'one'], ['package.json', 'two']], [['a.mjs', 'one'], ['package.json', 'two']]), {
+    equal: true,
+    differences: [],
+  });
+});
+
+test('registry parity distinguishes an unpublished version from registry failure', async () => {
+  const notFound = async () => ({ status: 404, ok: false });
+  assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
+    status: 'UNPUBLISHED',
+    name: '@rightkit/release',
+    version: '0.2.68',
+  });
+  await assert.rejects(
+    verifyRegistryParity({ fetchImpl: notFound }),
+    /registry metadata failed: HTTP 404/,
+  );
+});

package/release.mjs

@@ -521,11 +521,12 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
   }
   const started = Date.now();
   return new Promise((resolve) => {
+    const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
     const child = spawn(cmd, runArgs, {
       cwd,
       env: { ...process.env, ...releaseEnv, ...env },
       stdio: "inherit",
-      shell: process.platform === "win32",
+      shell: useShell,
       windowsHide: true,
     });
     const timer = options.timeoutMs

package/release.test.mjs

@@ -199,6 +199,13 @@ test("release worker reuses owned process-tree termination for Windows and remot
   assert.match(source, /function killProcessTree\(pid\) \{\s*terminateProcessTree\(pid\);\s*\}/s);
 });
 
+test("Windows native release tools preserve artifact arguments containing spaces", () => {
+  const source = readFileSync(release, "utf8");
+  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
+  assert.match(source, /shell: useShell/);
+  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
+});
+
 test("accepts patch and exposes it to the signed package command", () => {
   const result = run(fixture(), "--tier=patch");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -481,18 +481,25 @@ test("RightKit exposes one current version manifest", () => {
   assert.equal(versions.npm["@rightkit/updates"], "0.2.3");
   assert.deepEqual(versions.stagedNpm, {
     "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/hooks": "0.1.0",
-    "@rightkit/legal": "0.3.0",
+    "@rightkit/git": "0.2.1",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.66",
-    "@rightkit/qa": "0.2.0",
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.68",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65"],
-    "@rightkit/qa": ["0.1.0"],
+    "@rightkit/hooks": ["0.1.0"],
+    "@rightkit/legal": ["0.3.0"],
+    "@rightkit/license": ["0.1.6"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66", "0.2.67"],
+    "@rightkit/qa": ["0.1.0", "0.2.0"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
@@ -853,32 +860,26 @@ test("consuming suite apps resolve Cargo build output from cargo metadata, never
 const cargoTargetRootHelpers = [
   "coderight/apps/coderight-tauri/scripts/lib/target-root.mjs",
   "heardright/tauri-app-next/scripts/lib/target-root.mjs",
+  "genright/scripts/lib/target-root.mjs",
   "mailright/scripts/lib/target-root.mjs",
   "orthic/scripts/lib/target-root.mjs",
   "viewright/scripts/lib/target-root.mjs",
   "membrane/apps/membrane-hub/scripts/lib/target-root.mjs",
 ];
 
-test("shared target-root helpers still resolve build output via cargo metadata's target_directory", () => {
+test("consumer target-root helpers delegate to RightKit's canonical resolver", () => {
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
-    if (!existsSync(appRoot)) continue;
+    if (!existsSync(path.join(appRoot, "package.json"))) continue;
     const fullPath = path.join(workspace, helperPath);
     assert.ok(existsSync(fullPath), `${helperPath} is missing; the app must keep its shared cargo-metadata target resolver`);
     const source = readFileSync(fullPath, "utf8");
-    assert.match(source, /cargo/, `${helperPath} must invoke cargo`);
-    assert.match(source, /metadata/, `${helperPath} must call cargo metadata`);
-    assert.match(source, /target_directory/, `${helperPath} must read target_directory from cargo metadata's output`);
+    assert.match(source, /@rightkit\/release\/cargo-target\.mjs/, `${helperPath} must import RightKit's resolver`);
+    assert.match(source, /resolveTargetRoot/, `${helperPath} must delegate target resolution to RightKit`);
   }
 });
 
-// After the app migration lands, every consuming app's target-root helper must
-// become a thin re-export of the shared tools/rightkit resolveTargetRoot
-// (cargo-target.mjs) rather than its own copy of the cargo-metadata call. Until
-// that migration lands, cargoTargetRootHelpers above still point at full local
-// implementations, so this stays skipped to avoid failing the still-unmigrated
-// app repos. Enable it once every app's target-root.mjs is a re-export shim.
-test("consuming app target-root helpers are thin re-export shims, not local resolver re-implementations", { skip: true }, () => {
+test("consuming app target-root helpers do not reimplement Cargo metadata", () => {
   const LOCAL_RESOLVER_PATTERN = /function\s+(?:cargoTargetRoot|resolveManagedCargoTarget)\s*\([^)]*\)\s*\{[^}]*cargo[^}]*metadata/s;
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
@@ -894,6 +895,96 @@ test("consuming app target-root helpers are thin re-export shims, not local reso
   }
 });
 
+const cargoAuthorityRoots = [
+  ...cargoTargetDirGuardApps,
+  "citadel",
+  "heardright",
+  "legion",
+  "rightsites",
+  "rightsuite",
+  "sellright",
+  "tools/screenright",
+  "voiceright",
+  "workright",
+];
+const cargoAuthorityNames = [
+  "CARGO_HOME",
+  "CARGO_TARGET_DIR",
+  "CARGO_BUILD_TARGET_DIR",
+  "CARGO_BUILD_BUILD_DIR",
+  "CARGO_BUILD_JOBS",
+  "CARGO_ENCODED_RUSTFLAGS",
+  "RUSTFLAGS",
+  "RUSTC_WRAPPER",
+  "RUSTC_WORKSPACE_WRAPPER",
+  "SCCACHE_DIR",
+  "SCCACHE_BASEDIRS",
+  "SCCACHE_CACHE_SIZE",
+];
+const cargoAuthorityExtensions = new Set([".mjs", ".js", ".cjs", ".ts", ".sh", ".ps1", ".py", ".json"]);
+
+function findFirstPartyBuildScripts(root) {
+  const found = [];
+  const visit = (dir) => {
+    if (!existsSync(dir)) return;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && [
+        ".agent", ".audit", ".cache", ".git", ".right-release", "bakeoff", "dist", "docs",
+        "node_modules", "reference", "target", "tests", "vendor",
+      ].includes(entry.name)) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        visit(full);
+        continue;
+      }
+      if (!entry.isFile() || !cargoAuthorityExtensions.has(path.extname(entry.name))) continue;
+      const relative = path.relative(root, full).replaceAll(path.sep, "/");
+      if (/(?:^|\/)(?:test-|[^/]+\.test\.)/.test(relative)) continue;
+      if (
+        relative.includes("/scripts/")
+        || relative.startsWith("scripts/")
+        || /(?:^|\/)(?:package\.json|package\.(?:sh|ps1)|right-release\.config\.mjs)$/.test(relative)
+        || (!relative.includes("/") && /\.(?:sh|ps1)$/.test(relative))
+      ) found.push(full);
+    }
+  };
+  visit(root);
+  return found;
+}
+
+function executableScriptSource(source) {
+  return source
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
+    .join("\n");
+}
+
+test("product scripts never override or destroy RightKit-owned Cargo cache state", () => {
+  const authorityName = cargoAuthorityNames.join("|");
+  const jsMutation = new RegExp(`(?:delete\\s+process\\.env\\.(?:${authorityName})|process\\.env\\.(?:${authorityName})\\s*=|\\b(?:${authorityName})\\s*:)`);
+  const shellMutation = new RegExp(`(?:^|\\n)\\s*(?:export\\s+|unset\\s+|env\\s+(?:-[^\\n ]+\\s+)*-u\\s+)?(?:${authorityName})(?:\\s*=|\\b)`);
+  const powershellMutation = new RegExp(`\\$env:(?:${authorityName})\\s*=`, "i");
+  const cargoClean = /\bcargo\s+clean\b|["']cargo["'][\s\S]{0,400}?["']clean["']/;
+
+  for (const appRoot of cargoAuthorityRoots) {
+    const root = path.join(workspace, appRoot);
+    if (!existsSync(root)) continue;
+    for (const filePath of findFirstPartyBuildScripts(root)) {
+      const source = executableScriptSource(readFileSync(filePath, "utf8"));
+      const relative = path.relative(workspace, filePath);
+      assert.doesNotMatch(source, jsMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, shellMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, powershellMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, cargoClean, `${relative} destroys reusable Cargo output with cargo clean`);
+      assert.doesNotMatch(source, /--target-dir\b/, `${relative} bypasses RightKit target ownership`);
+      assert.doesNotMatch(source, /(?:^|[\\/])\.cargo[\\/]bin(?:[\\/]|\b)/i, `${relative} bypasses managed Cargo by injecting a toolchain directory`);
+      assert.doesNotMatch(source, /build-guard\.mjs/, `${relative} depends on obsolete product-local build/cache control`);
+    }
+    assert.equal(existsSync(path.join(root, "scripts", "build-guard.mjs")), false, `${appRoot} must not carry a product-local build guard`);
+  }
+});
+
 test("Right Suite has no hosted workflow files", () => {
   for (const root of ["viewright", "scraperight", "heardright", "mailright", "coderight", "genright", "voiceright", "tools/rightkit"]) {
     const workflowDir = path.join(workspace, root, ".github", "workflows");

package/rightkit-versions.json

@@ -1,6 +1,6 @@
 {
   "schema": 2,
-  "packageManager": "pnpm@11.18.0",
+  "packageManager": "pnpm@11.24.0",
   "npm": {
     "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.2.0",
@@ -14,18 +14,31 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/hooks": "0.1.0",
-    "@rightkit/legal": "0.3.0",
+    "@rightkit/git": "0.2.1",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.66",
-    "@rightkit/qa": "0.2.0"
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.68",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4"
   },
   "legacyNpm": {
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
+    "@rightkit/hooks": [
+      "0.1.0"
+    ],
+    "@rightkit/legal": [
+      "0.3.0"
+    ],
+    "@rightkit/license": [
+      "0.1.6"
+    ],
     "@rightkit/release": [
       "0.2.22",
       "0.2.29",
@@ -48,10 +61,13 @@
       "0.2.62",
       "0.2.63",
       "0.2.64",
-      "0.2.65"
+      "0.2.65",
+      "0.2.66",
+      "0.2.67"
     ],
     "@rightkit/qa": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ]
   },
   "cargo": {

package/standalone-clone-evidence.json

@@ -8,7 +8,7 @@
       "remote": "https://github.com/bogusyogi/viewright.git",
       "appDir": ".",
       "revision": "21a4171fa8add2d8114bc5f07498b60d7e8eafe5",
-      "packageManager": "pnpm@11.18.0",
+    "packageManager": "pnpm@11.24.0",
       "clone": {
         "command": "git clone --depth 1 --single-branch https://github.com/bogusyogi/viewright.git C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright",
         "status": 0,

package/standalone-clone-verify.test.mjs

@@ -22,7 +22,7 @@ test("standalone verifier clones, installs, doctors from a nested app root, and
   writeFileSync(path.join(source, "apps", "desktop", "package.json"), JSON.stringify({
     name: "standalone-fixture",
     private: true,
-    packageManager: "pnpm@11.17.0",
+    packageManager: "pnpm@11.24.0",
     scripts: { "release:doctor": "node doctor.mjs" },
   }), "utf8");
   writeFileSync(path.join(source, "apps", "desktop", "pnpm-lock.yaml"), "lockfileVersion: '9.0'\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\nimporters:\n  .: {}\n", "utf8");