@rightkit/release 0.2.67 → 0.2.69

package/build-release.mjs

@@ -322,6 +322,7 @@ try {
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
           path.join(stateRoot, "stall-build.log"),
+          { livenessOwnerTimeoutMs: target.package.livenessOwnerTimeoutMs ?? null },
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -464,8 +465,8 @@ function collectToolVersions(packageManager) {
   }
 }
 
-async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
-  const { inactivityMs, absoluteMs } = releaseProgressLimits(process.env);
+async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null, { livenessOwnerTimeoutMs = null } = {}) {
+  const { inactivityMs, absoluteMs } = releaseProgressLimits(env, { livenessOwnerTimeoutMs });
   let lastProgress = Date.now();
   const watchDirs = Array.isArray(watchDir) ? watchDir : [watchDir];
   let lastMtime = Math.max(...watchDirs.map(newestMtime));
@@ -476,7 +477,8 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
     let managedRequestId = null;
     const settleResolve = () => { if (!settled) { settled = true; resolve(); } };
     const settleReject = (error) => { if (!settled) { settled = true; reject(error); } };
-    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32", detached: process.platform !== "win32" });
+    const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
+    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: useShell, detached: process.platform !== "win32" });
     try {
       if (child.pid && heavySlot) heavySlot.trackChild(child.pid, cmd);
     } catch (error) {

package/build-release.test.mjs

@@ -54,6 +54,12 @@ test("production builds package from the real primary app checkout", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
 });
 
+test("Windows native executables preserve arguments containing spaces", () => {
+  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
+  assert.match(source, /shell: useShell/);
+  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
+});
+
 test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
   assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
@@ -157,6 +163,11 @@ test("CPU sampling degrades to the old behaviour rather than inventing a verdict
   assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
 });
 
+test("package liveness owner timeout floors outer watchdog through shared release limits", () => {
+  assert.match(source, /livenessOwnerTimeoutMs: target\.package\.livenessOwnerTimeoutMs \?\? null/);
+  assert.match(source, /releaseProgressLimits\(env, \{ livenessOwnerTimeoutMs \}\)/);
+});
+
 // Regression: the managed-host gate must not depend on RIGHTKIT_BUILD_BROKER_SOCKET
 // alone. That variable is exported by login shells only, while the managed cargo
 // shim is on PATH in every shell — so an agent shell took the Cache V2 branch,

package/cargo-target.mjs

@@ -13,11 +13,12 @@ import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-export function resolveTargetRoot(manifestPath) {
+export function resolveTargetRoot(manifestPath, options = {}) {
   if (!manifestPath) throw new Error("resolveTargetRoot requires a Cargo.toml manifest path");
+  const execute = options.execFileSync ?? execFileSync;
   let output;
   try {
-    output = execFileSync(
+    output = execute(
       "cargo",
       ["metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifestPath],
       { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 },

package/cargo-target.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { chmodSync, mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -11,91 +11,42 @@ import { resolveTargetRoot } from "./cargo-target.mjs";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(here, "cargo-target.mjs");
 
-// A fake `cargo` on PATH, ahead of the real one, so metadata success/failure
-// shapes are deterministic and don't depend on the host's actual crate graph.
-// It branches on a marker embedded in the manifest path so each test controls
-// its own outcome independently.
-function fakeCargoBin() {
+function fakeCargo() {
   const bin = mkdtempSync(path.join(os.tmpdir(), "rightkit-fake-cargo-"));
-  const script = path.join(bin, process.platform === "win32" ? "cargo.cmd" : "cargo");
-  const body = process.platform === "win32"
-    ? [
-      "@echo off",
-      "setlocal enabledelayedexpansion",
-      "set ARGS=%*",
-      "echo %ARGS% | findstr /C:\"fail-manifest\" >nul && (echo boom 1>&2 & exit /b 1)",
-      "echo %ARGS% | findstr /C:\"bad-target-manifest\" >nul && (echo {\"target_directory\":\"relative/target\"} & exit /b 0)",
-      "echo {\"target_directory\":\"" + path.join(bin, "target").replaceAll("\\", "\\\\") + "\"}",
-    ].join("\r\n")
-    : [
-      "#!/bin/sh",
-      'case "$*" in',
-      '  *fail-manifest*) echo boom 1>&2; exit 1 ;;',
-      '  *bad-target-manifest*) echo \'{"target_directory":"relative/target"}\'; exit 0 ;;',
-      `  *) echo '{"target_directory":"${path.join(bin, "target")}"}'; exit 0 ;;`,
-      "esac",
-    ].join("\n");
-  writeFileSync(script, body);
-  if (process.platform !== "win32") chmodSync(script, 0o755);
-  return bin;
-}
-
-function withFakeCargo(fn) {
-  const bin = fakeCargoBin();
-  const env = { ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH ?? ""}` };
-  return fn({ bin, env });
+  return {
+    bin,
+    execFileSync(_command, args) {
+      const manifest = args.at(-1);
+      if (manifest.includes("fail-manifest")) throw new Error("boom");
+      if (manifest.includes("bad-target-manifest")) return '{"target_directory":"relative/target"}';
+      return JSON.stringify({ target_directory: path.join(bin, "target") });
+    },
+  };
 }
 
 test("resolveTargetRoot returns the absolute target_directory Cargo metadata reports", () => {
-  withFakeCargo(({ bin, env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      const result = resolveTargetRoot(manifest);
-      assert.equal(result, path.resolve(path.join(bin, "target")));
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { bin, execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "Cargo.toml");
+  const result = resolveTargetRoot(manifest, { execFileSync });
+  assert.equal(result, path.resolve(path.join(bin, "target")));
 });
 
 test("resolveTargetRoot fails closed, naming the manifest, when target_directory is not absolute", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "bad-target-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      assert.throws(
-        () => resolveTargetRoot(manifest),
-        new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
-      );
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "bad-target-manifest-Cargo.toml");
+  assert.throws(
+    () => resolveTargetRoot(manifest, { execFileSync }),
+    new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
+  );
 });
 
 test("resolveTargetRoot fails closed, naming the manifest, when the metadata command exits non-zero", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      assert.throws(
-        () => resolveTargetRoot(manifest),
-        new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
-      );
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "fail-manifest-Cargo.toml");
+  assert.throws(
+    () => resolveTargetRoot(manifest, { execFileSync }),
+    new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
+  );
 });
 
 test("resolveTargetRoot throws when no manifest path is given", () => {
@@ -104,26 +55,24 @@ test("resolveTargetRoot throws when no manifest path is given", () => {
 });
 
 test("CLI mode writes only the resolved path to stdout on success", () => {
-  withFakeCargo(({ bin, env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout.trim(), path.resolve(path.join(bin, "target")));
-  });
+  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+  const manifest = path.join(manifestDir, "Cargo.toml");
+  mkdirSync(path.join(manifestDir, "src"));
+  writeFileSync(path.join(manifestDir, "src", "lib.rs"), "");
+  writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(path.isAbsolute(result.stdout.trim()), true);
 });
 
 test("CLI mode writes a message to stderr and exits 1 on failure", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
-    assert.equal(result.status, 1);
-    assert.equal(result.stdout, "");
-    assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
-  });
+  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+  const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
+  writeFileSync(manifest, "not valid toml");
+  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
+  assert.equal(result.status, 1);
+  assert.equal(result.stdout, "");
+  assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
 });
 
 test("CLI mode requires a manifest argument", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.67",
+  "version": "0.2.69",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,6 +15,13 @@
     "*.py"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "prepublishOnly": "pnpm test && pnpm test:registry-parity",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -24,10 +31,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "scripts": {
-    "test": "node --test *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/pipeline-normalization-contract.test.mjs

@@ -0,0 +1,140 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import test from "node:test";
+
+const workspace = path.resolve(
+  process.env.RIGHT_SUITE_CONTRACT_WORKSPACE
+    ?? new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"),
+);
+
+const packageRoots = [
+  "coderight/apps/coderight-tauri",
+  "cutright/apps/studio",
+  "genright",
+  "heardright/tauri-app-next",
+  "mailright",
+  "membrane/apps/membrane-hub",
+  "scraperight",
+  "viewright",
+  "voiceright",
+];
+
+const releaseConfigRoots = [
+  ...packageRoots,
+  "tools/screenright",
+];
+
+const rightGitRepos = ["cutright", "legion", "membrane"];
+const privateRepos = ["rightsites", "sellright", "workright"];
+
+function executableSource(source) {
+  return source
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
+    .join("\n");
+}
+
+function pipelineScripts(root) {
+  const repo = execFileSync("git", ["-C", root, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true }).trim();
+  const prefix = path.relative(repo, root).replaceAll(path.sep, "/");
+  const tracked = execFileSync("git", ["-C", repo, "ls-files", "-z"], { encoding: "utf8", windowsHide: true })
+    .split("\0")
+    .filter(Boolean);
+  return tracked
+    .filter((entry) => {
+      const local = prefix ? entry.slice(prefix.length + 1) : entry;
+      if (prefix && !entry.startsWith(`${prefix}/`)) return false;
+      return (
+        local.startsWith("scripts/")
+        || local === "package.ps1"
+        || local === "package.sh"
+      ) && /\.(?:mjs|cjs|js|ts|ps1|sh|py)$/i.test(local)
+        && !/(?:^|[.-])test(?:[.-]|$)/i.test(path.basename(local));
+    })
+    .map((entry) => path.join(repo, entry))
+    .filter((entry) => existsSync(entry));
+}
+
+test("product package pipelines use installed RightKit commands", () => {
+  const violations = [];
+  for (const root of packageRoots) {
+    const manifestPath = path.join(workspace, root, "package.json");
+    if (!existsSync(manifestPath)) continue;
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
+      if (!/^(?:build|package|publish|release|deps|verify:rust|test:rust|lint:rust)/.test(name)) continue;
+      if (/(?:\.\.\/[\w./-]*)?tools\/right-release|tools\\right-release/i.test(command)) violations.push(`${root} ${name}: retired workspace-local right-release source`);
+      if (/(?:^|&&|\|\||;)\s*cargo\s+/i.test(command)) violations.push(`${root} ${name}: bare cargo`);
+      if (/(?:^|&&|\|\||;)\s*npx\s+/i.test(command)) violations.push(`${root} ${name}: npx`);
+      if (/(?:^|&&|\|\||;)\s*npm\s+(?:ci|install)\b/i.test(command)) violations.push(`${root} ${name}: npm install`);
+    }
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("release configs resolve Cargo output through RightKit", () => {
+  const violations = [];
+  for (const root of releaseConfigRoots) {
+    const configPath = path.join(workspace, root, "right-release.config.mjs");
+    if (!existsSync(configPath)) continue;
+    const source = executableSource(readFileSync(configPath, "utf8"));
+    const hardcodedTargetRoot = /(?:const|let|var)\s+\w+\s*=\s*["'`]src-tauri[\\/]target/i.test(source);
+    const hardcodedTargetArtifact = /(?:file|signature)\s*:\s*["'`]src-tauri[\\/]target/i.test(source);
+    if (!hardcodedTargetRoot && !hardcodedTargetArtifact) continue;
+    if (!/@rightkit\/release\/cargo-target\.mjs|\.\/scripts\/lib\/target-root\.mjs/.test(source)) violations.push(`${root}: no RightKit target resolver`);
+    if (!/resolve(?:TargetRoot|WindowsReleaseDir)\s*\(/.test(source)) violations.push(`${root}: resolver not invoked`);
+    if (hardcodedTargetRoot) violations.push(`${root}: hardcoded target root`);
+    if (hardcodedTargetArtifact) violations.push(`${root}: hardcoded target artifact`);
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("product pipeline children use managed Rust commands", () => {
+  const violations = [];
+  for (const root of packageRoots) {
+    for (const file of pipelineScripts(path.join(workspace, root))) {
+      const source = executableSource(readFileSync(file, "utf8"));
+      const label = path.relative(workspace, file);
+      if (/(?:spawnSync|spawn|execFileSync|execFile)\s*\(\s*["'`](?:cargo|rustc|rustdoc)["'`]/.test(source)) violations.push(`${label}: unmanaged JS child`);
+      if (/subprocess\.(?:run|Popen)\s*\(\s*\[\s*["'](?:cargo|rustc|rustdoc)["']/.test(source)) violations.push(`${label}: unmanaged Python child`);
+      if (/(?:^|\n)\s*(?:&\s*)?(?:cargo|rustc|rustdoc)\s+(?:build|check|clippy|metadata|test|-vV)\b/m.test(source)) violations.push(`${label}: unmanaged shell command`);
+    }
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("hosted workflows are generated by right-git", () => {
+  const violations = [];
+  for (const root of rightGitRepos) {
+    const workflowRoot = path.join(workspace, root, ".github", "workflows");
+    if (!existsSync(workflowRoot)) continue;
+    for (const entry of readdirSync(workflowRoot, { withFileTypes: true })) {
+      if (!entry.isFile() || !/\.ya?ml$/i.test(entry.name)) continue;
+      const source = readFileSync(path.join(workflowRoot, entry.name), "utf8");
+      if (!/^# Managed by right-git\b/.test(source)) violations.push(`${root}/.github/workflows/${entry.name}: not right-git managed`);
+    }
+  }
+  for (const root of privateRepos) {
+    const workflowRoot = path.join(workspace, root, ".github", "workflows");
+    const workflows = existsSync(workflowRoot)
+      ? readdirSync(workflowRoot).filter((entry) => /\.ya?ml$/i.test(entry))
+      : [];
+    if (workflows.length) violations.push(`${root}: private repo has ${workflows.join(", ")}`);
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("workspace memory pipelines route Rust through RightKit", () => {
+  for (const relative of [
+    "tools/pipelines/memory/dispatch/gate.py",
+    "tools/pipelines/memory/install-cortex.py",
+    "tools/pipelines/memory/verify-source-owner.py",
+  ]) {
+    const source = executableSource(readFileSync(path.join(workspace, relative), "utf8"));
+    assert.doesNotMatch(source, /(?:^|&&|\|\||;)\s*cargo\s+(?:metadata|build|check|clippy|test)\b/m, `${relative} invokes bare Cargo shell command`);
+    assert.doesNotMatch(source, /subprocess\.run\(\s*\[\s*["']cargo["']/m, `${relative} invokes bare Cargo subprocess`);
+  }
+});

package/progress-control.mjs

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 
 const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
+export const RELEASE_LIVENESS_OWNER_MARGIN_MS = 5 * 60 * 1000;
 
 export function latestManagedRequestId(value, fallback = null) {
   let latest = fallback;
@@ -13,11 +14,17 @@ export function firstManagedRequestId(value) {
   return MANAGED_REQUEST_PATTERN.exec(String(value ?? ""))?.[1]?.toLowerCase() ?? null;
 }
 
-export function releaseProgressLimits(env = process.env) {
-  const inactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+export function releaseProgressLimits(env = process.env, { livenessOwnerTimeoutMs = null } = {}) {
+  const configuredInactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
   const absoluteMs = Number(env.RIGHT_RELEASE_ABSOLUTE_MS ?? 4 * 60 * 60 * 1000);
-  if (![inactivityMs, absoluteMs].every((value) => Number.isFinite(value) && value > 0)) throw new Error("release progress limits must be positive finite milliseconds");
-  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed RIGHT_RELEASE_STALL_MS");
+  const ownerTimeoutMs = livenessOwnerTimeoutMs === null ? null : Number(livenessOwnerTimeoutMs);
+  if (![configuredInactivityMs, absoluteMs, ...(ownerTimeoutMs === null ? [] : [ownerTimeoutMs])].every((value) => Number.isFinite(value) && value > 0)) {
+    throw new Error("release progress limits must be positive finite milliseconds");
+  }
+  const inactivityMs = ownerTimeoutMs === null
+    ? configuredInactivityMs
+    : Math.max(configuredInactivityMs, ownerTimeoutMs + RELEASE_LIVENESS_OWNER_MARGIN_MS);
+  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed effective release inactivity limit");
   return Object.freeze({ inactivityMs, absoluteMs });
 }
 

package/progress-control.test.mjs

@@ -10,6 +10,23 @@ test("release progress stays bounded without killing a healthy long native build
   assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
 });
 
+test("declared inner liveness owner always exits before the outer watchdog", () => {
+  const ownerTimeoutMs = 45 * 60 * 1000;
+  assert.deepEqual(
+    releaseProgressLimits({}, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    { inactivityMs: 50 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
+  );
+  assert.deepEqual(
+    releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: String(60 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    { inactivityMs: 60 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
+  );
+  assert.throws(
+    () => releaseProgressLimits({ RIGHT_RELEASE_ABSOLUTE_MS: String(49 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    /must exceed effective release inactivity limit/,
+  );
+  assert.throws(() => releaseProgressLimits({}, { livenessOwnerTimeoutMs: 0 }), /positive finite/);
+});
+
 test("latest managed request id follows streamed root Cargo requests", () => {
   const first = "11111111-1111-4111-8111-111111111111";
   const second = "22222222-2222-4222-8222-222222222222";

package/registry-parity.test.mjs

@@ -21,7 +21,7 @@ test('registry parity distinguishes an unpublished version from registry failure
   assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
     status: 'UNPUBLISHED',
     name: '@rightkit/release',
-    version: '0.2.67',
+    version: '0.2.69',
   });
   await assert.rejects(
     verifyRegistryParity({ fetchImpl: notFound }),

package/release.mjs

@@ -29,7 +29,8 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
 );
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
-const WINDOWS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const WINDOWS_NSIS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const WINDOWS_PORTABLE_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-portable-v1";
 const DEFAULT_NOTARIZATION_TIMEOUT_MS = 30 * 60 * 1000;
 
 const args = process.argv.slice(2);
@@ -91,7 +92,7 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
-await validateRightKitPackageContract(root, config.app);
+await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
@@ -101,14 +102,16 @@ const legalContract = config.legal
 if (target.signed !== true) {
   fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
 }
-if (opts.platform === "win" && !target.sign?.files?.length) {
-  fail(`${config.app ?? "app"} win must declare sign.files for the signed release pipeline`);
-}
 if (opts.platform === "win") {
-  if (target.signingContract !== WINDOWS_SIGNING_CONTRACT) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_SIGNING_CONTRACT}`);
+  const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
+  const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
+  if (!isNsis && !isPortable) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT} or ${WINDOWS_PORTABLE_SIGNING_CONTRACT}`);
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
-  if (target.sign?.prePackageFiles?.length !== 1) fail(`${config.app ?? "app"} win must declare exactly one sign.prePackageFiles raw EXE`);
-  if (target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+  if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
+  if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
+  if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
+  if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+  if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
@@ -206,7 +209,8 @@ if (opts.platform === "win") {
   // bundling, and doing that to signed bytes invalidates Authenticode — the exact
   // defect that shipped invalid binaries. Idempotent, so an app that still patches
   // in its own prePackage script simply reports alreadyPatched here.
-  bundleMarkerReceipts = opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
+  const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
+  bundleMarkerReceipts = !isNsis || opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
   for (const receipt of bundleMarkerReceipts) {
     console.log(`right-release: bundle marker ${receipt.bundle} ${receipt.alreadyPatched ? "already applied" : "applied"} at offset ${receipt.offset} in ${path.basename(receipt.file)}`);
   }
@@ -219,7 +223,7 @@ for (const rel of target.artifacts ?? []) {
   await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
 }
 
-if (opts.platform === "win" && target.sign?.files?.length) {
+if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
   // Before the installer earns its own signature, prove it carries the bytes we
@@ -360,16 +364,16 @@ function commandTimeoutMs(command) {
     : undefined;
 }
 
-async function validateRightKitPackageContract(root, appName) {
+async function validateRightKitPackageContract(root, appName, hostedWorkflows) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
   assertQaBackdoorContract(root, scripts);
   const workflowDir = path.join(root, ".github", "workflows");
   if (existsSync(workflowDir)) {
-    const workflows = await readdir(workflowDir);
+    const workflows = (await readdir(workflowDir)).sort();
     if (workflows.length) {
-      fail(`${appName ?? pkg.name ?? "app"} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+      await validateHostedWorkflows(root, appName ?? pkg.name ?? "app", workflows, hostedWorkflows);
     }
   }
   if (pkg.packageManager !== RIGHTKIT_VERSIONS.packageManager) {
@@ -394,6 +398,33 @@ async function validateRightKitPackageContract(root, appName) {
   }
 }
 
+async function validateHostedWorkflows(root, appName, workflows, policy) {
+  if (policy !== "right-git-ci-only") {
+    fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+  }
+  if (workflows.length !== 1 || workflows[0] !== "ci.yml") {
+    fail(`${appName} right-git-ci-only policy permits only ci.yml, got: ${workflows.join(", ")}`);
+  }
+  const manifestPath = path.join(root, ".rightgit.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  } catch {
+    fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
+  }
+  if (manifest?.schemaVersion !== 1 || JSON.stringify(manifest?.lanes) !== JSON.stringify(["ci"])) {
+    fail(`${appName} right-git-ci-only policy requires .rightgit.json lanes=["ci"]`);
+  }
+  const source = await readFile(path.join(root, ".github", "workflows", "ci.yml"), "utf8");
+  if (!source.startsWith("# Managed by right-git")) {
+    fail(`${appName} ci.yml is not marked as right-git managed`);
+  }
+  if (/^\s*(?:actions|attestations|contents|id-token|packages|security-events):\s*write\s*$/mi.test(source)
+    || /\bsecrets\s*\./i.test(source)) {
+    fail(`${appName} right-git managed ci.yml requests release-capable permissions or secrets`);
+  }
+}
+
 function buildAllowedVersions(published = {}, staged = {}, legacy = {}) {
   const allowed = new Map();
   for (const [name, value] of [
@@ -423,7 +454,7 @@ function expandEnv(value) {
 
 async function signWindows(files, phase, root) {
   const args = [SIGN_WINDOWS];
-  const receipt = path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
+  const receipt = windowsReceiptPath(root, phase);
   if (opts.dryRun) args.push("--dry-run");
   else {
     if (existsSync(receipt)) unlinkSync(receipt);
@@ -435,6 +466,8 @@ async function signWindows(files, phase, root) {
 }
 
 function windowsReceiptPath(root, phase) {
+  const configured = phase === "raw-exe" ? target.sign?.receipt : target.sign?.installerReceipt;
+  if (configured) return path.resolve(root, configured);
   return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
 }
 
@@ -521,11 +554,12 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
   }
   const started = Date.now();
   return new Promise((resolve) => {
+    const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
     const child = spawn(cmd, runArgs, {
       cwd,
       env: { ...process.env, ...releaseEnv, ...env },
       stdio: "inherit",
-      shell: process.platform === "win32",
+      shell: useShell,
       windowsHide: true,
     });
     const timer = options.timeoutMs

package/release.test.mjs

@@ -16,7 +16,7 @@ function git(cwd, ...args) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 
-function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], packageJson, packageCommand, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
+function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], signFiles = ["fixture.exe"], packageJson, packageCommand, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win", hostedWorkflows } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -45,6 +45,7 @@ function fixture({ signed = true, publish = false, signingContract = "windows-ra
       app: "fixture",
       packageManager: "pnpm",
       checks: [],
+      ...(hostedWorkflows ? { hostedWorkflows } : {}),
       targets: {
         [platform]: {
           ...(buildInputs ? { buildInputs } : {}),
@@ -52,7 +53,7 @@ function fixture({ signed = true, publish = false, signingContract = "windows-ra
           package: packageCommand ?? { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
           artifacts: [],
-          ...(platform === "win" ? { signingContract, prePackage: { cmd: "node", args: ["-e", "process.exit(0)"] }, sign: { prePackageFiles, files: ["fixture.exe"] } } : {}),
+          ...(platform === "win" ? { signingContract, prePackage: { cmd: "node", args: ["-e", "process.exit(0)"] }, sign: { prePackageFiles, files: signFiles } } : {}),
           updater: { artifacts: [{ file: "fixture.exe", signature: "fixture.exe.sig", platform: "windows-x86_64", key: "fixture/fixture.exe" }] },
           hardening: [],
         },
@@ -199,6 +200,13 @@ test("release worker reuses owned process-tree termination for Windows and remot
   assert.match(source, /function killProcessTree\(pid\) \{\s*terminateProcessTree\(pid\);\s*\}/s);
 });
 
+test("Windows native release tools preserve artifact arguments containing spaces", () => {
+  const source = readFileSync(release, "utf8");
+  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
+  assert.match(source, /shell: useShell/);
+  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
+});
+
 test("accepts patch and exposes it to the signed package command", () => {
   const result = run(fixture(), "--tier=patch");
   assert.equal(result.status, 0, result.stderr);
@@ -233,6 +241,32 @@ test("rejects Windows targets with missing or ambiguous signing configuration",
   }
 });
 
+test("accepts portable Windows releases with multiple pre-package executables and no installer", () => {
+  const result = run(fixture({
+    signingContract: "windows-raw-exe-authenticode-before-portable-v1",
+    prePackageFiles: ["legion.exe", "legion-hook.exe", "legion-mcp.exe"],
+    signFiles: [],
+  }), "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /raw-exe/);
+  assert.doesNotMatch(result.stdout, /bundle marker/);
+});
+
+test("uses a configured signing receipt path for portable architecture isolation", () => {
+  const source = readFileSync(release, "utf8");
+  assert.match(source, /phase === "raw-exe" \? target\.sign\?\.receipt : target\.sign\?\.installerReceipt/);
+  assert.match(source, /if \(configured\) return path\.resolve\(root, configured\)/);
+});
+
+test("rejects portable Windows releases that declare a second installer signing phase", () => {
+  const result = run(fixture({
+    signingContract: "windows-raw-exe-authenticode-before-portable-v1",
+    prePackageFiles: ["legion.exe"],
+  }), "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /portable.*omit sign\.files/i);
+});
+
 test("rejects Git, path, or link RightKit app dependencies before release work starts", () => {
   const result = run(
     fixture({
@@ -266,6 +300,35 @@ test("rejects hosted workflow files before release work starts", () => {
   assert.match(result.stderr, /hosted workflow.*forbidden/i);
 });
 
+test("accepts one right-git managed CI workflow without granting hosted release authority", () => {
+  const config = fixture({ hostedWorkflows: "right-git-ci-only" });
+  const root = path.dirname(config);
+  const workflowDir = path.join(root, ".github", "workflows");
+  mkdirSync(workflowDir, { recursive: true });
+  writeFileSync(path.join(root, ".rightgit.json"), JSON.stringify({ schemaVersion: 1, lanes: ["ci"] }));
+  writeFileSync(path.join(workflowDir, "ci.yml"), "# Managed by right-git — do not hand-edit.\npermissions:\n  contents: read\njobs: {}\n");
+  git(root, "add", ".");
+  git(root, "commit", "-m", "add managed ci");
+
+  const result = run(config, "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test("rejects a self-labeled right-git workflow with release-capable authority", () => {
+  const config = fixture({ hostedWorkflows: "right-git-ci-only" });
+  const root = path.dirname(config);
+  const workflowDir = path.join(root, ".github", "workflows");
+  mkdirSync(workflowDir, { recursive: true });
+  writeFileSync(path.join(root, ".rightgit.json"), JSON.stringify({ schemaVersion: 1, lanes: ["ci"] }));
+  writeFileSync(path.join(workflowDir, "ci.yml"), "# Managed by right-git\npermissions:\n  id-token: write\njobs: {}\n");
+  git(root, "add", ".");
+  git(root, "commit", "-m", "add unsafe ci");
+
+  const result = run(config, "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /release-capable permissions or secrets/i);
+});
+
 test("doctor accepts an exact crates.io RightKit pin with benign Cargo config", () => {
   const config = fixture({
     platform: hostPlatform,

package/right-suite-contract.test.mjs

@@ -481,18 +481,25 @@ test("RightKit exposes one current version manifest", () => {
   assert.equal(versions.npm["@rightkit/updates"], "0.2.3");
   assert.deepEqual(versions.stagedNpm, {
     "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/hooks": "0.1.0",
-    "@rightkit/legal": "0.3.0",
+    "@rightkit/git": "0.2.1",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.67",
-    "@rightkit/qa": "0.2.0",
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.69",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66"],
-    "@rightkit/qa": ["0.1.0"],
+    "@rightkit/hooks": ["0.1.0"],
+    "@rightkit/legal": ["0.3.0"],
+    "@rightkit/license": ["0.1.6"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66", "0.2.67", "0.2.68"],
+    "@rightkit/qa": ["0.1.0", "0.2.0"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
@@ -710,8 +717,12 @@ for (const app of apps) {
 }
 
 for (const app of macOnlyApps) {
-  test(`${app.key} follows the macOS-only AppKit Right Release contract`, async () => {
+  test(`${app.key} follows the macOS-only AppKit Right Release contract`, async (context) => {
     const root = path.join(workspace, app.root);
+    if (!existsSync(path.join(root, "package.json"))) {
+      context.skip(`${app.key} is not present in this checkout`);
+      return;
+    }
     const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
     assert.equal(pkg.scripts["release:build:mac"], "right-release build --platform mac");
@@ -853,32 +864,26 @@ test("consuming suite apps resolve Cargo build output from cargo metadata, never
 const cargoTargetRootHelpers = [
   "coderight/apps/coderight-tauri/scripts/lib/target-root.mjs",
   "heardright/tauri-app-next/scripts/lib/target-root.mjs",
+  "genright/scripts/lib/target-root.mjs",
   "mailright/scripts/lib/target-root.mjs",
   "orthic/scripts/lib/target-root.mjs",
   "viewright/scripts/lib/target-root.mjs",
   "membrane/apps/membrane-hub/scripts/lib/target-root.mjs",
 ];
 
-test("shared target-root helpers still resolve build output via cargo metadata's target_directory", () => {
+test("consumer target-root helpers delegate to RightKit's canonical resolver", () => {
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
     if (!existsSync(path.join(appRoot, "package.json"))) continue;
     const fullPath = path.join(workspace, helperPath);
     assert.ok(existsSync(fullPath), `${helperPath} is missing; the app must keep its shared cargo-metadata target resolver`);
     const source = readFileSync(fullPath, "utf8");
-    assert.match(source, /cargo/, `${helperPath} must invoke cargo`);
-    assert.match(source, /metadata/, `${helperPath} must call cargo metadata`);
-    assert.match(source, /target_directory/, `${helperPath} must read target_directory from cargo metadata's output`);
+    assert.match(source, /@rightkit\/release\/cargo-target\.mjs/, `${helperPath} must import RightKit's resolver`);
+    assert.match(source, /resolveTargetRoot/, `${helperPath} must delegate target resolution to RightKit`);
   }
 });
 
-// After the app migration lands, every consuming app's target-root helper must
-// become a thin re-export of the shared tools/rightkit resolveTargetRoot
-// (cargo-target.mjs) rather than its own copy of the cargo-metadata call. Until
-// that migration lands, cargoTargetRootHelpers above still point at full local
-// implementations, so this stays skipped to avoid failing the still-unmigrated
-// app repos. Enable it once every app's target-root.mjs is a re-export shim.
-test("consuming app target-root helpers are thin re-export shims, not local resolver re-implementations", { skip: true }, () => {
+test("consuming app target-root helpers do not reimplement Cargo metadata", () => {
   const LOCAL_RESOLVER_PATTERN = /function\s+(?:cargoTargetRoot|resolveManagedCargoTarget)\s*\([^)]*\)\s*\{[^}]*cargo[^}]*metadata/s;
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
@@ -894,6 +899,96 @@ test("consuming app target-root helpers are thin re-export shims, not local reso
   }
 });
 
+const cargoAuthorityRoots = [
+  ...cargoTargetDirGuardApps,
+  "citadel",
+  "heardright",
+  "legion",
+  "rightsites",
+  "rightsuite",
+  "sellright",
+  "tools/screenright",
+  "voiceright",
+  "workright",
+];
+const cargoAuthorityNames = [
+  "CARGO_HOME",
+  "CARGO_TARGET_DIR",
+  "CARGO_BUILD_TARGET_DIR",
+  "CARGO_BUILD_BUILD_DIR",
+  "CARGO_BUILD_JOBS",
+  "CARGO_ENCODED_RUSTFLAGS",
+  "RUSTFLAGS",
+  "RUSTC_WRAPPER",
+  "RUSTC_WORKSPACE_WRAPPER",
+  "SCCACHE_DIR",
+  "SCCACHE_BASEDIRS",
+  "SCCACHE_CACHE_SIZE",
+];
+const cargoAuthorityExtensions = new Set([".mjs", ".js", ".cjs", ".ts", ".sh", ".ps1", ".py", ".json"]);
+
+function findFirstPartyBuildScripts(root) {
+  const found = [];
+  const visit = (dir) => {
+    if (!existsSync(dir)) return;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && [
+        ".agent", ".audit", ".cache", ".git", ".right-release", "bakeoff", "dist", "docs",
+        "node_modules", "reference", "target", "tests", "vendor",
+      ].includes(entry.name)) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        visit(full);
+        continue;
+      }
+      if (!entry.isFile() || !cargoAuthorityExtensions.has(path.extname(entry.name))) continue;
+      const relative = path.relative(root, full).replaceAll(path.sep, "/");
+      if (/(?:^|\/)(?:test-|[^/]+\.test\.)/.test(relative)) continue;
+      if (
+        relative.includes("/scripts/")
+        || relative.startsWith("scripts/")
+        || /(?:^|\/)(?:package\.json|package\.(?:sh|ps1)|right-release\.config\.mjs)$/.test(relative)
+        || (!relative.includes("/") && /\.(?:sh|ps1)$/.test(relative))
+      ) found.push(full);
+    }
+  };
+  visit(root);
+  return found;
+}
+
+function executableScriptSource(source) {
+  return source
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
+    .join("\n");
+}
+
+test("product scripts never override or destroy RightKit-owned Cargo cache state", () => {
+  const authorityName = cargoAuthorityNames.join("|");
+  const jsMutation = new RegExp(`(?:delete\\s+process\\.env\\.(?:${authorityName})|process\\.env\\.(?:${authorityName})\\s*=|\\b(?:${authorityName})\\s*:)`);
+  const shellMutation = new RegExp(`(?:^|\\n)\\s*(?:export\\s+|unset\\s+|env\\s+(?:-[^\\n ]+\\s+)*-u\\s+)?(?:${authorityName})(?:\\s*=|\\b)`);
+  const powershellMutation = new RegExp(`\\$env:(?:${authorityName})\\s*=`, "i");
+  const cargoClean = /\bcargo\s+clean\b|["']cargo["'][\s\S]{0,400}?["']clean["']/;
+
+  for (const appRoot of cargoAuthorityRoots) {
+    const root = path.join(workspace, appRoot);
+    if (!existsSync(root)) continue;
+    for (const filePath of findFirstPartyBuildScripts(root)) {
+      const source = executableScriptSource(readFileSync(filePath, "utf8"));
+      const relative = path.relative(workspace, filePath);
+      assert.doesNotMatch(source, jsMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, shellMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, powershellMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, cargoClean, `${relative} destroys reusable Cargo output with cargo clean`);
+      assert.doesNotMatch(source, /--target-dir\b/, `${relative} bypasses RightKit target ownership`);
+      assert.doesNotMatch(source, /(?:^|[\\/])\.cargo[\\/]bin(?:[\\/]|\b)/i, `${relative} bypasses managed Cargo by injecting a toolchain directory`);
+      assert.doesNotMatch(source, /build-guard\.mjs/, `${relative} depends on obsolete product-local build/cache control`);
+    }
+    assert.equal(existsSync(path.join(root, "scripts", "build-guard.mjs")), false, `${appRoot} must not carry a product-local build guard`);
+  }
+});
+
 test("Right Suite has no hosted workflow files", () => {
   for (const root of ["viewright", "scraperight", "heardright", "mailright", "coderight", "genright", "voiceright", "tools/rightkit"]) {
     const workflowDir = path.join(workspace, root, ".github", "workflows");

package/rightkit-versions.json

@@ -1,6 +1,6 @@
 {
   "schema": 2,
-  "packageManager": "pnpm@11.18.0",
+  "packageManager": "pnpm@11.24.0",
   "npm": {
     "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.2.0",
@@ -14,18 +14,31 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/hooks": "0.1.0",
-    "@rightkit/legal": "0.3.0",
+    "@rightkit/git": "0.2.1",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.67",
-    "@rightkit/qa": "0.2.0"
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.69",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4"
   },
   "legacyNpm": {
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
+    "@rightkit/hooks": [
+      "0.1.0"
+    ],
+    "@rightkit/legal": [
+      "0.3.0"
+    ],
+    "@rightkit/license": [
+      "0.1.6"
+    ],
     "@rightkit/release": [
       "0.2.22",
       "0.2.29",
@@ -49,10 +62,13 @@
       "0.2.63",
       "0.2.64",
       "0.2.65",
-      "0.2.66"
+      "0.2.66",
+      "0.2.67",
+      "0.2.68"
     ],
     "@rightkit/qa": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ]
   },
   "cargo": {

package/standalone-clone-evidence.json

@@ -8,7 +8,7 @@
       "remote": "https://github.com/bogusyogi/viewright.git",
       "appDir": ".",
       "revision": "21a4171fa8add2d8114bc5f07498b60d7e8eafe5",
-      "packageManager": "pnpm@11.18.0",
+    "packageManager": "pnpm@11.24.0",
       "clone": {
         "command": "git clone --depth 1 --single-branch https://github.com/bogusyogi/viewright.git C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright",
         "status": 0,

package/standalone-clone-verify.test.mjs

@@ -22,7 +22,7 @@ test("standalone verifier clones, installs, doctors from a nested app root, and
   writeFileSync(path.join(source, "apps", "desktop", "package.json"), JSON.stringify({
     name: "standalone-fixture",
     private: true,
-    packageManager: "pnpm@11.18.0",
+    packageManager: "pnpm@11.24.0",
     scripts: { "release:doctor": "node doctor.mjs" },
   }), "utf8");
   writeFileSync(path.join(source, "apps", "desktop", "pnpm-lock.yaml"), "lockfileVersion: '9.0'\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\nimporters:\n  .: {}\n", "utf8");