@rightkit/release 0.2.68 → 0.2.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.68",
+  "version": "0.2.70",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -12,9 +12,18 @@
     "*.mjs",
     "*.json",
     "*.sh",
-    "*.py"
+    "*.py",
+    "!*.test.mjs",
+    "!standalone-clone-evidence.json"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "prepublishOnly": "pnpm test && pnpm test:registry-parity",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -24,10 +33,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/release.mjs

@@ -29,7 +29,8 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
 );
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
-const WINDOWS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const WINDOWS_NSIS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const WINDOWS_PORTABLE_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-portable-v1";
 const DEFAULT_NOTARIZATION_TIMEOUT_MS = 30 * 60 * 1000;
 
 const args = process.argv.slice(2);
@@ -91,7 +92,7 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
-await validateRightKitPackageContract(root, config.app);
+await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
@@ -101,14 +102,16 @@ const legalContract = config.legal
 if (target.signed !== true) {
   fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
 }
-if (opts.platform === "win" && !target.sign?.files?.length) {
-  fail(`${config.app ?? "app"} win must declare sign.files for the signed release pipeline`);
-}
 if (opts.platform === "win") {
-  if (target.signingContract !== WINDOWS_SIGNING_CONTRACT) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_SIGNING_CONTRACT}`);
+  const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
+  const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
+  if (!isNsis && !isPortable) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT} or ${WINDOWS_PORTABLE_SIGNING_CONTRACT}`);
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
-  if (target.sign?.prePackageFiles?.length !== 1) fail(`${config.app ?? "app"} win must declare exactly one sign.prePackageFiles raw EXE`);
-  if (target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+  if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
+  if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
+  if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
+  if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+  if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
@@ -206,7 +209,8 @@ if (opts.platform === "win") {
   // bundling, and doing that to signed bytes invalidates Authenticode — the exact
   // defect that shipped invalid binaries. Idempotent, so an app that still patches
   // in its own prePackage script simply reports alreadyPatched here.
-  bundleMarkerReceipts = opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
+  const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
+  bundleMarkerReceipts = !isNsis || opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
   for (const receipt of bundleMarkerReceipts) {
     console.log(`right-release: bundle marker ${receipt.bundle} ${receipt.alreadyPatched ? "already applied" : "applied"} at offset ${receipt.offset} in ${path.basename(receipt.file)}`);
   }
@@ -219,7 +223,7 @@ for (const rel of target.artifacts ?? []) {
   await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
 }
 
-if (opts.platform === "win" && target.sign?.files?.length) {
+if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
   // Before the installer earns its own signature, prove it carries the bytes we
@@ -360,16 +364,16 @@ function commandTimeoutMs(command) {
     : undefined;
 }
 
-async function validateRightKitPackageContract(root, appName) {
+async function validateRightKitPackageContract(root, appName, hostedWorkflows) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
   assertQaBackdoorContract(root, scripts);
   const workflowDir = path.join(root, ".github", "workflows");
   if (existsSync(workflowDir)) {
-    const workflows = await readdir(workflowDir);
+    const workflows = (await readdir(workflowDir)).sort();
     if (workflows.length) {
-      fail(`${appName ?? pkg.name ?? "app"} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+      await validateHostedWorkflows(root, appName ?? pkg.name ?? "app", workflows, hostedWorkflows);
     }
   }
   if (pkg.packageManager !== RIGHTKIT_VERSIONS.packageManager) {
@@ -394,6 +398,33 @@ async function validateRightKitPackageContract(root, appName) {
   }
 }
 
+async function validateHostedWorkflows(root, appName, workflows, policy) {
+  if (policy !== "right-git-ci-only") {
+    fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+  }
+  if (workflows.length !== 1 || workflows[0] !== "ci.yml") {
+    fail(`${appName} right-git-ci-only policy permits only ci.yml, got: ${workflows.join(", ")}`);
+  }
+  const manifestPath = path.join(root, ".rightgit.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  } catch {
+    fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
+  }
+  if (manifest?.schemaVersion !== 1 || JSON.stringify(manifest?.lanes) !== JSON.stringify(["ci"])) {
+    fail(`${appName} right-git-ci-only policy requires .rightgit.json lanes=["ci"]`);
+  }
+  const source = await readFile(path.join(root, ".github", "workflows", "ci.yml"), "utf8");
+  if (!source.startsWith("# Managed by right-git")) {
+    fail(`${appName} ci.yml is not marked as right-git managed`);
+  }
+  if (/^\s*(?:actions|attestations|contents|id-token|packages|security-events):\s*write\s*$/mi.test(source)
+    || /\bsecrets\s*\./i.test(source)) {
+    fail(`${appName} right-git managed ci.yml requests release-capable permissions or secrets`);
+  }
+}
+
 function buildAllowedVersions(published = {}, staged = {}, legacy = {}) {
   const allowed = new Map();
   for (const [name, value] of [
@@ -423,7 +454,7 @@ function expandEnv(value) {
 
 async function signWindows(files, phase, root) {
   const args = [SIGN_WINDOWS];
-  const receipt = path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
+  const receipt = windowsReceiptPath(root, phase);
   if (opts.dryRun) args.push("--dry-run");
   else {
     if (existsSync(receipt)) unlinkSync(receipt);
@@ -435,6 +466,8 @@ async function signWindows(files, phase, root) {
 }
 
 function windowsReceiptPath(root, phase) {
+  const configured = phase === "raw-exe" ? target.sign?.receipt : target.sign?.installerReceipt;
+  if (configured) return path.resolve(root, configured);
   return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
 }
 

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.68",
+    "@rightkit/release": "0.2.70",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -63,7 +63,9 @@
       "0.2.64",
       "0.2.65",
       "0.2.66",
-      "0.2.67"
+      "0.2.67",
+      "0.2.68",
+      "0.2.69"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/addon-command.test.mjs

@@ -1,54 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import test from "node:test";
-import { createAddonManifest, addonManifestSha256, canonicalAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl } from "./addon-contract.mjs";
-
-const command = fileURLToPath(new URL("./addon-command.mjs", import.meta.url));
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-command-"));
-  mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
-  for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
-  writeFileSync(path.join(root, "assets", "tab.png"), "icon");
-  const files = [["command", "membrane", "out/membrane", true], ["service", "membrane-service", "out/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
-  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
-  return root;
-}
-test("add-on dry-run creates no release state and never executes build", () => {
-  const root = fixture(); const result = spawnSync(process.execPath, [command, "build", "--config", "right-addon.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr); assert.match(result.stdout, /would run: false/); assert.equal(existsSync(path.join(root, ".right-release")), false);
-});
-
-test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
-  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const sealed = path.join(root, "sealed"); mkdirSync(sealed);
-  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
-  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
-  const digest = addonManifestSha256(manifest); const lock = path.join(root, "membrane.lock.json"); writeFileSync(lock, JSON.stringify({ targets: { mac: { manifestUrl: `https://example.test/membrane/addons/mac/sha256/${digest}/addon-manifest.json`, manifestSha256: digest } } }));
-  const output = path.join(root, "addons"); const unsigned = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", `${output}-unsigned`, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "" } });
-  assert.notEqual(unsigned.status, 0); assert.match(unsigned.stderr, /unexpected mac signing contract/);
-  const result = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", output, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "1" } });
-  assert.equal(result.status, 0, result.stderr);
-  assert.equal(readFileSync(path.join(output, "membrane", "bin", "membrane-aarch64-apple-darwin"), "utf8"), "command");
-  assert.equal(readFileSync(path.join(output, "membrane", "resources", "LICENSE"), "utf8"), "LICENSE");
-  const receipt = JSON.parse(readFileSync(path.join(root, ".right-release", "addons", "adoptions", "membrane-mac.json"), "utf8"));
-  assert.equal(receipt.manifestSha256, digest);
-  assert.deepEqual(receipt.files.map((file) => [file.role, file.sealedSha256, file.adoptedSha256]), [["command", manifest.files.find((file) => file.role === "command").sha256, manifest.files.find((file) => file.role === "command").sha256], ["service", manifest.files.find((file) => file.role === "service").sha256, manifest.files.find((file) => file.role === "service").sha256]]);
-});
-
-test("remote downloader accepts only immutable manifest plus file routes", async () => {
-  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
-  const destination = path.join(root, "remote"); mkdirSync(destination);
-  await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
-  assert.equal(readFileSync(path.join(destination, "membrane-service"), "utf8"), "service");
-  assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
-});

package/addon-contract.test.mjs

@@ -1,48 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
-  mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
-  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/membrane-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
-  const files = [
-    ["command", "membrane", "bin/membrane", true], ["service", "membrane-service", "bin/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
-    ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
-  ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
-}
-
-test("add-on manifest has portable immutable identity and routes", () => {
-  const { root, config } = fixture();
-  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "a".repeat(40), signedAt: "2026-08-11T00:00:00.000Z", signing });
-  assert.deepEqual(Object.keys(manifest), ["schema", "kind", "addon", "version", "commit", "platform", "targetTriple", "consumer", "files", "signedAt"]);
-  const digest = addonManifestSha256(manifest); const routes = addonRoutes(manifest);
-  assert.equal(routes.at(-1).manifest, true);
-  assert.match(routes[0].key, new RegExp(`^membrane/addons/mac/sha256/${digest}/`));
-  assert.ok(routes.slice(0, -1).every((route) => !route.manifest));
-});
-
-test("add-on contract rejects unsafe, incomplete, duplicate, and unsigned inputs", () => {
-  const { root, config } = fixture();
-  const broken = structuredClone(config); broken.targets.mac.files[0].source = "../escape";
-  assert.throws(() => validateAddonConfig(broken, { root, platform: "mac" }), /unsafe add-on source/);
-  const duplicate = structuredClone(config); duplicate.targets.mac.files[1].role = "command";
-  assert.throws(() => validateAddonConfig(duplicate, { root, platform: "mac" }), /duplicate/);
-  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "b".repeat(40), signing });
-  manifest.files.find((file) => file.role === "command").signing = null;
-  assert.throws(() => validateAddonManifest(manifest), /unsigned executable/);
-});
-
-test("manifest excludes source and mutable transport fields", () => {
-  const { root, config } = fixture();
-  const manifest = createAddonManifest({ config, root, platform: "win", commit: "c".repeat(40), signing: { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } } });
-  const text = JSON.stringify(manifest);
-  assert.doesNotMatch(text, /source|path|url|token/i);
-  assert.equal(readFileSync(path.join(root, "bin", "membrane"), "utf8"), "membrane");
-});

package/asr-artifact-adoption.test.mjs

@@ -1,122 +0,0 @@
-import assert from "node:assert/strict";
-import { generateKeyPairSync } from "node:crypto";
-import test from "node:test";
-
-import { assertAsrAdapterPair, assertAsrArtifactAdoption } from "./asr-artifact-adoption.mjs";
-import { buildRuntimeArtifactManifest, signRuntimeArtifactManifest } from "./runtime-artifact-manifest.mjs";
-
-const digest = "a".repeat(64);
-const notice = "b".repeat(64);
-const evidence = "c".repeat(64);
-const { privateKey, publicKey } = generateKeyPairSync("ed25519");
-
-function envelope(appKey, overrides = {}) {
-  const manifest = buildRuntimeArtifactManifest({
-    artifactKind: "asr-model",
-    entitlement: { appKey, tier: "pro" },
-    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
-    target: { os: "windows", arch: "x86_64" },
-    filename: "parakeet-unified-en-0.6b.tar.zst",
-    sha256: digest,
-    sizeBytes: 1234,
-    versions: {
-      runtime: "rightkit-asr@0.1.0",
-      model: "parakeet-unified-en-0.6b",
-      tokenizer: "sha256:tokenizer-v1",
-      preprocessing: "heardright-frontend-v1",
-      license: "CC-BY-4.0",
-      provenance: "nvidia/parakeet-tdt-0.6b-v3",
-    },
-    provenance: {
-      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
-      sourceRevision: "revision-1",
-      licenseId: "CC-BY-4.0",
-      noticeSha256: notice,
-    },
-    promotion: {
-      authorityAppKey: "heardright",
-      promotionId: "hr-asr-2026-07-14",
-      promotedAt: "2026-07-14T00:00:00.000Z",
-      evidenceSha256: evidence,
-    },
-    ...overrides,
-  });
-  return signRuntimeArtifactManifest(manifest, privateKey, "rightkit-runtime-artifacts-2026-07");
-}
-
-test("accepts app-scoped pointers with one exact HeardRight-certified ASR identity", () => {
-  const result = assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: envelope("scraperight"),
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  });
-
-  assert.equal(result.sha256, digest);
-  assert.equal(result.promotionId, "hr-asr-2026-07-14");
-});
-
-test("rejects a validly signed ScrapeRight manifest with ASR drift", () => {
-  const drifted = envelope("scraperight", {
-    versions: {
-      runtime: "rightkit-asr@0.1.1",
-      model: "parakeet-unified-en-0.6b",
-      tokenizer: "sha256:tokenizer-v1",
-      preprocessing: "heardright-frontend-v1",
-      license: "CC-BY-4.0",
-      provenance: "nvidia/parakeet-tdt-0.6b-v3",
-    },
-  });
-
-  assert.throws(() => assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: drifted,
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  }), /ASR drift: versions\.runtime/);
-});
-
-test("rejects wrong roles, authority, target, signature key, and artifact kind", () => {
-  const base = {
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: envelope("scraperight"),
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  };
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, authorityEnvelope: envelope("scraperight") }), /authority manifest must belong to heardright/);
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, consumerEnvelope: envelope("heardright") }), /consumer manifest must belong to scraperight/);
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, trustedKeyId: "rotated-without-app-update" }), /untrusted runtime artifact key id/);
-  assert.throws(() => assertAsrArtifactAdoption({
-    ...base,
-    consumerEnvelope: envelope("scraperight", { target: { os: "darwin", arch: "aarch64" } }),
-  }), /ASR drift: target/);
-  assert.throws(() => assertAsrArtifactAdoption({
-    ...base,
-    consumerEnvelope: envelope("scraperight", { artifactKind: "ocr-model" }),
-  }), /must be an asr-model/);
-});
-
-test("rejects a consumer signed by a different key", () => {
-  const other = generateKeyPairSync("ed25519");
-  const consumer = signRuntimeArtifactManifest(
-    envelope("scraperight").manifest,
-    other.privateKey,
-    "rightkit-runtime-artifacts-2026-07",
-  );
-  assert.throws(() => assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: consumer,
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  }), /signature verification failed/);
-});
-
-test("locks the thin app adapters to HeardRight authority and private Pro delivery", () => {
-  const authority = {
-    schema: 1, appKey: "heardright", role: "authority", authorityAppKey: "heardright",
-    artifactKind: "asr-model", delivery: "private-r2", entitlementTier: "pro",
-  };
-  const consumer = { ...authority, appKey: "scraperight", role: "consumer" };
-  assert.equal(assertAsrAdapterPair(authority, consumer), true);
-  assert.throws(() => assertAsrAdapterPair(authority, { ...consumer, authorityAppKey: "scraperight" }), /ASR drift/);
-});

package/build-invocation-contract.test.mjs

@@ -1,124 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
-
-function git(cwd, ...args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-}
-
-function makeRepo() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-invocation-"));
-  git(root, "init", "--initial-branch", "main");
-  git(root, "config", "user.email", "release-test@example.com");
-  git(root, "config", "user.name", "Release Test");
-  mkdirSync(path.join(root, "src"));
-  mkdirSync(path.join(root, "tests"));
-  mkdirSync(path.join(root, "docs"));
-  writeFileSync(path.join(root, "package.json"), "{}\n");
-  writeFileSync(path.join(root, "src", "app.js"), "export const app = true;\n");
-  writeFileSync(path.join(root, "tests", "app.test.js"), "// test\n");
-  writeFileSync(path.join(root, "docs", "notes.md"), "notes\n");
-  git(root, "add", ".");
-  git(root, "commit", "-m", "initial");
-  return root;
-}
-
-const buildInputs = {
-  include: ["package.json", "src/**"],
-  exclude: ["**/*.test.*", "**/tests/**"],
-  json: {
-    "package.json": [["dependencies"], ["scripts", "build"]],
-  },
-};
-
-test("rejects release invocation from a linked Git worktree", () => {
-  const primary = makeRepo();
-  const linked = path.join(path.dirname(primary), `${path.basename(primary)}-linked`);
-  git(primary, "worktree", "add", "--detach", linked);
-
-  assert.throws(
-    () => assertPrimaryReleaseCheckout(linked),
-    /must be invoked from the primary Git worktree/i,
-  );
-});
-
-test("allows release invocation from the primary Git checkout", () => {
-  const primary = makeRepo();
-
-  assert.doesNotThrow(() => assertPrimaryReleaseCheckout(primary));
-});
-
-test("rejects a detached HEAD even in the primary Git checkout", () => {
-  const primary = makeRepo();
-  git(primary, "checkout", "--detach");
-
-  assert.throws(
-    () => assertPrimaryReleaseCheckout(primary),
-    /detached HEAD is forbidden/i,
-  );
-});
-
-test("reports a dirty tracked file declared as a build input", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/app.js"]);
-});
-
-test("reports an untracked file declared as a build input", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "src", "new-runtime.js"), "export {};\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/new-runtime.js"]);
-});
-
-test("ignores dirty files outside the packaged app input set", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "docs", "notes.md"), "changed notes\n");
-  writeFileSync(path.join(primary, "tests", "app.test.js"), "// changed test\n");
-  writeFileSync(path.join(primary, "scratch.txt"), "evaluation output\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
-});
-
-test("required release metadata cannot be hidden by build-input exclusions", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "package.json"), "{\"version\":\"2.0.0\"}\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, {
-    ...buildInputs,
-    exclude: [...buildInputs.exclude, "package.json"],
-    required: ["package.json"],
-  }), ["package.json"]);
-  assert.deepEqual(dirtyBuildInputs(primary, {
-    include: ["package.json"],
-    required: ["package.json"],
-  }), ["package.json"]);
-});
-
-test("checks only build-relevant fields in mixed-purpose JSON manifests", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ scripts: { bakeoff: "node eval.mjs" } })}\n`);
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
-
-  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ dependencies: { tauri: "2.0.0" } })}\n`);
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["package.json"]);
-});
-
-test("does not report a locally dirty file whose bytes already equal the release commit", () => {
-  const primary = makeRepo();
-  const localHead = git(primary, "rev-parse", "HEAD");
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-  git(primary, "add", "src/app.js");
-  git(primary, "commit", "-m", "release change");
-  const releaseCommit = git(primary, "rev-parse", "HEAD");
-  git(primary, "checkout", localHead);
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs, releaseCommit), []);
-});