@rightkit/release 0.2.69 → 0.2.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.69",
+  "version": "0.2.70",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -12,7 +12,9 @@
     "*.mjs",
     "*.json",
     "*.sh",
-    "*.py"
+    "*.py",
+    "!*.test.mjs",
+    "!standalone-clone-evidence.json"
   ],
   "sideEffects": false,
   "scripts": {

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.69",
+    "@rightkit/release": "0.2.70",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -64,7 +64,8 @@
       "0.2.65",
       "0.2.66",
       "0.2.67",
-      "0.2.68"
+      "0.2.68",
+      "0.2.69"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/addon-command.test.mjs

@@ -1,54 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import test from "node:test";
-import { createAddonManifest, addonManifestSha256, canonicalAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl } from "./addon-contract.mjs";
-
-const command = fileURLToPath(new URL("./addon-command.mjs", import.meta.url));
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-command-"));
-  mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
-  for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
-  writeFileSync(path.join(root, "assets", "tab.png"), "icon");
-  const files = [["command", "membrane", "out/membrane", true], ["service", "membrane-service", "out/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
-  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
-  return root;
-}
-test("add-on dry-run creates no release state and never executes build", () => {
-  const root = fixture(); const result = spawnSync(process.execPath, [command, "build", "--config", "right-addon.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr); assert.match(result.stdout, /would run: false/); assert.equal(existsSync(path.join(root, ".right-release")), false);
-});
-
-test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
-  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const sealed = path.join(root, "sealed"); mkdirSync(sealed);
-  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
-  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
-  const digest = addonManifestSha256(manifest); const lock = path.join(root, "membrane.lock.json"); writeFileSync(lock, JSON.stringify({ targets: { mac: { manifestUrl: `https://example.test/membrane/addons/mac/sha256/${digest}/addon-manifest.json`, manifestSha256: digest } } }));
-  const output = path.join(root, "addons"); const unsigned = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", `${output}-unsigned`, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "" } });
-  assert.notEqual(unsigned.status, 0); assert.match(unsigned.stderr, /unexpected mac signing contract/);
-  const result = spawnSync(process.execPath, [command, "adopt", "--platform", "mac", "--lock", lock, "--output", output, "--source", sealed], { cwd: root, encoding: "utf8", env: { ...process.env, RIGHT_RELEASE_TEST_FIXTURE: "1" } });
-  assert.equal(result.status, 0, result.stderr);
-  assert.equal(readFileSync(path.join(output, "membrane", "bin", "membrane-aarch64-apple-darwin"), "utf8"), "command");
-  assert.equal(readFileSync(path.join(output, "membrane", "resources", "LICENSE"), "utf8"), "LICENSE");
-  const receipt = JSON.parse(readFileSync(path.join(root, ".right-release", "addons", "adoptions", "membrane-mac.json"), "utf8"));
-  assert.equal(receipt.manifestSha256, digest);
-  assert.deepEqual(receipt.files.map((file) => [file.role, file.sealedSha256, file.adoptedSha256]), [["command", manifest.files.find((file) => file.role === "command").sha256, manifest.files.find((file) => file.role === "command").sha256], ["service", manifest.files.find((file) => file.role === "service").sha256, manifest.files.find((file) => file.role === "service").sha256]]);
-});
-
-test("remote downloader accepts only immutable manifest plus file routes", async () => {
-  const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
-  const destination = path.join(root, "remote"); mkdirSync(destination);
-  await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
-  assert.equal(readFileSync(path.join(destination, "membrane-service"), "utf8"), "service");
-  assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
-});

package/addon-contract.test.mjs

@@ -1,48 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
-  mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
-  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/membrane-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
-  const files = [
-    ["command", "membrane", "bin/membrane", true], ["service", "membrane-service", "bin/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
-    ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
-  ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
-}
-
-test("add-on manifest has portable immutable identity and routes", () => {
-  const { root, config } = fixture();
-  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "a".repeat(40), signedAt: "2026-08-11T00:00:00.000Z", signing });
-  assert.deepEqual(Object.keys(manifest), ["schema", "kind", "addon", "version", "commit", "platform", "targetTriple", "consumer", "files", "signedAt"]);
-  const digest = addonManifestSha256(manifest); const routes = addonRoutes(manifest);
-  assert.equal(routes.at(-1).manifest, true);
-  assert.match(routes[0].key, new RegExp(`^membrane/addons/mac/sha256/${digest}/`));
-  assert.ok(routes.slice(0, -1).every((route) => !route.manifest));
-});
-
-test("add-on contract rejects unsafe, incomplete, duplicate, and unsigned inputs", () => {
-  const { root, config } = fixture();
-  const broken = structuredClone(config); broken.targets.mac.files[0].source = "../escape";
-  assert.throws(() => validateAddonConfig(broken, { root, platform: "mac" }), /unsafe add-on source/);
-  const duplicate = structuredClone(config); duplicate.targets.mac.files[1].role = "command";
-  assert.throws(() => validateAddonConfig(duplicate, { root, platform: "mac" }), /duplicate/);
-  const signing = { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } };
-  const manifest = createAddonManifest({ config, root, platform: "mac", commit: "b".repeat(40), signing });
-  manifest.files.find((file) => file.role === "command").signing = null;
-  assert.throws(() => validateAddonManifest(manifest), /unsigned executable/);
-});
-
-test("manifest excludes source and mutable transport fields", () => {
-  const { root, config } = fixture();
-  const manifest = createAddonManifest({ config, root, platform: "win", commit: "c".repeat(40), signing: { command: { contract: "test", status: "verified" }, service: { contract: "test", status: "verified" } } });
-  const text = JSON.stringify(manifest);
-  assert.doesNotMatch(text, /source|path|url|token/i);
-  assert.equal(readFileSync(path.join(root, "bin", "membrane"), "utf8"), "membrane");
-});

package/asr-artifact-adoption.test.mjs

@@ -1,122 +0,0 @@
-import assert from "node:assert/strict";
-import { generateKeyPairSync } from "node:crypto";
-import test from "node:test";
-
-import { assertAsrAdapterPair, assertAsrArtifactAdoption } from "./asr-artifact-adoption.mjs";
-import { buildRuntimeArtifactManifest, signRuntimeArtifactManifest } from "./runtime-artifact-manifest.mjs";
-
-const digest = "a".repeat(64);
-const notice = "b".repeat(64);
-const evidence = "c".repeat(64);
-const { privateKey, publicKey } = generateKeyPairSync("ed25519");
-
-function envelope(appKey, overrides = {}) {
-  const manifest = buildRuntimeArtifactManifest({
-    artifactKind: "asr-model",
-    entitlement: { appKey, tier: "pro" },
-    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
-    target: { os: "windows", arch: "x86_64" },
-    filename: "parakeet-unified-en-0.6b.tar.zst",
-    sha256: digest,
-    sizeBytes: 1234,
-    versions: {
-      runtime: "rightkit-asr@0.1.0",
-      model: "parakeet-unified-en-0.6b",
-      tokenizer: "sha256:tokenizer-v1",
-      preprocessing: "heardright-frontend-v1",
-      license: "CC-BY-4.0",
-      provenance: "nvidia/parakeet-tdt-0.6b-v3",
-    },
-    provenance: {
-      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
-      sourceRevision: "revision-1",
-      licenseId: "CC-BY-4.0",
-      noticeSha256: notice,
-    },
-    promotion: {
-      authorityAppKey: "heardright",
-      promotionId: "hr-asr-2026-07-14",
-      promotedAt: "2026-07-14T00:00:00.000Z",
-      evidenceSha256: evidence,
-    },
-    ...overrides,
-  });
-  return signRuntimeArtifactManifest(manifest, privateKey, "rightkit-runtime-artifacts-2026-07");
-}
-
-test("accepts app-scoped pointers with one exact HeardRight-certified ASR identity", () => {
-  const result = assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: envelope("scraperight"),
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  });
-
-  assert.equal(result.sha256, digest);
-  assert.equal(result.promotionId, "hr-asr-2026-07-14");
-});
-
-test("rejects a validly signed ScrapeRight manifest with ASR drift", () => {
-  const drifted = envelope("scraperight", {
-    versions: {
-      runtime: "rightkit-asr@0.1.1",
-      model: "parakeet-unified-en-0.6b",
-      tokenizer: "sha256:tokenizer-v1",
-      preprocessing: "heardright-frontend-v1",
-      license: "CC-BY-4.0",
-      provenance: "nvidia/parakeet-tdt-0.6b-v3",
-    },
-  });
-
-  assert.throws(() => assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: drifted,
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  }), /ASR drift: versions\.runtime/);
-});
-
-test("rejects wrong roles, authority, target, signature key, and artifact kind", () => {
-  const base = {
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: envelope("scraperight"),
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  };
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, authorityEnvelope: envelope("scraperight") }), /authority manifest must belong to heardright/);
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, consumerEnvelope: envelope("heardright") }), /consumer manifest must belong to scraperight/);
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, trustedKeyId: "rotated-without-app-update" }), /untrusted runtime artifact key id/);
-  assert.throws(() => assertAsrArtifactAdoption({
-    ...base,
-    consumerEnvelope: envelope("scraperight", { target: { os: "darwin", arch: "aarch64" } }),
-  }), /ASR drift: target/);
-  assert.throws(() => assertAsrArtifactAdoption({
-    ...base,
-    consumerEnvelope: envelope("scraperight", { artifactKind: "ocr-model" }),
-  }), /must be an asr-model/);
-});
-
-test("rejects a consumer signed by a different key", () => {
-  const other = generateKeyPairSync("ed25519");
-  const consumer = signRuntimeArtifactManifest(
-    envelope("scraperight").manifest,
-    other.privateKey,
-    "rightkit-runtime-artifacts-2026-07",
-  );
-  assert.throws(() => assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: consumer,
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  }), /signature verification failed/);
-});
-
-test("locks the thin app adapters to HeardRight authority and private Pro delivery", () => {
-  const authority = {
-    schema: 1, appKey: "heardright", role: "authority", authorityAppKey: "heardright",
-    artifactKind: "asr-model", delivery: "private-r2", entitlementTier: "pro",
-  };
-  const consumer = { ...authority, appKey: "scraperight", role: "consumer" };
-  assert.equal(assertAsrAdapterPair(authority, consumer), true);
-  assert.throws(() => assertAsrAdapterPair(authority, { ...consumer, authorityAppKey: "scraperight" }), /ASR drift/);
-});

package/build-invocation-contract.test.mjs

@@ -1,124 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
-
-function git(cwd, ...args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-}
-
-function makeRepo() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-invocation-"));
-  git(root, "init", "--initial-branch", "main");
-  git(root, "config", "user.email", "release-test@example.com");
-  git(root, "config", "user.name", "Release Test");
-  mkdirSync(path.join(root, "src"));
-  mkdirSync(path.join(root, "tests"));
-  mkdirSync(path.join(root, "docs"));
-  writeFileSync(path.join(root, "package.json"), "{}\n");
-  writeFileSync(path.join(root, "src", "app.js"), "export const app = true;\n");
-  writeFileSync(path.join(root, "tests", "app.test.js"), "// test\n");
-  writeFileSync(path.join(root, "docs", "notes.md"), "notes\n");
-  git(root, "add", ".");
-  git(root, "commit", "-m", "initial");
-  return root;
-}
-
-const buildInputs = {
-  include: ["package.json", "src/**"],
-  exclude: ["**/*.test.*", "**/tests/**"],
-  json: {
-    "package.json": [["dependencies"], ["scripts", "build"]],
-  },
-};
-
-test("rejects release invocation from a linked Git worktree", () => {
-  const primary = makeRepo();
-  const linked = path.join(path.dirname(primary), `${path.basename(primary)}-linked`);
-  git(primary, "worktree", "add", "--detach", linked);
-
-  assert.throws(
-    () => assertPrimaryReleaseCheckout(linked),
-    /must be invoked from the primary Git worktree/i,
-  );
-});
-
-test("allows release invocation from the primary Git checkout", () => {
-  const primary = makeRepo();
-
-  assert.doesNotThrow(() => assertPrimaryReleaseCheckout(primary));
-});
-
-test("rejects a detached HEAD even in the primary Git checkout", () => {
-  const primary = makeRepo();
-  git(primary, "checkout", "--detach");
-
-  assert.throws(
-    () => assertPrimaryReleaseCheckout(primary),
-    /detached HEAD is forbidden/i,
-  );
-});
-
-test("reports a dirty tracked file declared as a build input", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/app.js"]);
-});
-
-test("reports an untracked file declared as a build input", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "src", "new-runtime.js"), "export {};\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/new-runtime.js"]);
-});
-
-test("ignores dirty files outside the packaged app input set", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "docs", "notes.md"), "changed notes\n");
-  writeFileSync(path.join(primary, "tests", "app.test.js"), "// changed test\n");
-  writeFileSync(path.join(primary, "scratch.txt"), "evaluation output\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
-});
-
-test("required release metadata cannot be hidden by build-input exclusions", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "package.json"), "{\"version\":\"2.0.0\"}\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, {
-    ...buildInputs,
-    exclude: [...buildInputs.exclude, "package.json"],
-    required: ["package.json"],
-  }), ["package.json"]);
-  assert.deepEqual(dirtyBuildInputs(primary, {
-    include: ["package.json"],
-    required: ["package.json"],
-  }), ["package.json"]);
-});
-
-test("checks only build-relevant fields in mixed-purpose JSON manifests", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ scripts: { bakeoff: "node eval.mjs" } })}\n`);
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
-
-  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ dependencies: { tauri: "2.0.0" } })}\n`);
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["package.json"]);
-});
-
-test("does not report a locally dirty file whose bytes already equal the release commit", () => {
-  const primary = makeRepo();
-  const localHead = git(primary, "rev-parse", "HEAD");
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-  git(primary, "add", "src/app.js");
-  git(primary, "commit", "-m", "release change");
-  const releaseCommit = git(primary, "rev-parse", "HEAD");
-  git(primary, "checkout", localHead);
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs, releaseCommit), []);
-});

package/build-release.test.mjs

@@ -1,242 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { parseCpuSeconds, processGroupCpuSeconds } from "./process-liveness.mjs";
-import { brokerManagedHost } from "./cargo-contract.mjs";
-
-const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
-const build = path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs");
-
-test("general build dry-run is filesystem-pure and never starts its package command", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-build-dry-run-"));
-  writeFileSync(path.join(root, "right-release.config.mjs"), "export default { app: 'fixture', version: '1.0.0', targets: { mac: { package: { cmd: 'false' } } } };\n");
-  for (const args of [["init", "--initial-branch", "main"], ["config", "user.email", "test@example.com"], ["config", "user.name", "Test"], ["add", "."], ["commit", "-m", "init"]]) execFileSync("git", args, { cwd: root });
-  const before = readdirSync(root).sort();
-  const result = spawnSync(process.execPath, [build, "--config", "right-release.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /build dry-run/);
-  assert.deepEqual(readdirSync(root).sort(), before);
-});
-
-test("macOS and Windows builds default to Cache V2 while explicit legacy mode remains available", () => {
-  assert.match(source, /assertCleanSource/);
-  assert.match(source, /right-release build/);
-  assert.match(source, /RIGHT_RELEASE_CACHE_MODE/);
-  assert.match(source, /platform === "mac" \|\| platform === "win" \? "shared" : "legacy"/);
-  assert.match(source, /cacheModeRequested !== "legacy" && cacheModeRequested !== "shared"/);
-  assert.match(source, /resolveSharedCacheRoot/);
-  assert.match(source, /acquireSuiteBuildSlot/);
-  assert.match(source, /acquireHeavyWorkSlot/);
-  assert.match(source, /heavyCommandEnvironment/);
-  assert.match(source, /heavySlot\.trackChild/);
-  assert.match(source, /detached: process\.platform !== "win32"/);
-  assert.match(source, /acquireCacheLease/);
-  assert.match(source, /markCacheEntrySuccessful/);
-  assert.match(source, /RIGHT_RELEASE_CACHE_OWNER/);
-  assert.match(source, /suiteSlot\?\.release\(\)/);
-  assert.match(source, /heavySlot\?\.release\(\)/);
-  assert.match(source, /cacheLease\?\.release\(\)/);
-  assert.doesNotMatch(source, /process\.exit\(signal/);
-  assert.match(source, /throwIfInterrupted/);
-  assert.match(source, /delete env\.RIGHT_RELEASE_CACHE_OWNER/);
-  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
-  assert.match(source, /dirtyBuildInputs\(repoRoot/);
-});
-
-test("production builds package from the real primary app checkout", () => {
-  assert.match(source, /const configPath = path\.resolve\(configName\)/);
-  assert.match(source, /const appRoot = path\.dirname\(configPath\)/);
-  assert.match(source, /\[WORKER, "--config", configPath, "--platform", platform, "--no-upload"\]/);
-  assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
-});
-
-test("Windows native executables preserve arguments containing spaces", () => {
-  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
-  assert.match(source, /shell: useShell/);
-  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
-});
-
-test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
-  assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
-  assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
-  assert.match(source, /const targetPrefix = "src-tauri\/target\/";/);
-  assert.match(source, /if \(managedCargoTarget && normalized\.startsWith\(targetPrefix\)\) \{/);
-  // Every configRoot-relative artifact lookup inside sealRelease must route
-  // through the resolver, or a managed build fails at seal after a full
-  // compile, sign, and notarize because src-tauri/target is never populated
-  // locally on a broker-managed host (target-bridge.mjs leaves it alone).
-  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.file\)/);
-  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.signature\)/);
-  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "installer"\)/);
-  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "updater"\)/);
-  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.signature\), "updater-signature"\)/);
-  assert.match(source, /const source = resolveArtifactPath\(artifact\.file\);/);
-  assert.match(source, /const signatureSource = resolveArtifactPath\(artifact\.signature\);/);
-});
-
-test("production builds never create or use an internal Git worktree", () => {
-  assert.doesNotMatch(source, /git", \["worktree", "add"/);
-  assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);
-  assert.doesNotMatch(source, /worktreeConfigPath/);
-});
-
-test("dirty release config is rejected before the config module is imported", () => {
-  const guard = source.indexOf("dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit)");
-  const imported = source.indexOf("await import(");
-  assert.ok(guard >= 0, "config cleanliness guard must exist");
-  assert.ok(guard < imported, "config cleanliness guard must run before module import");
-});
-
-test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
-  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: managedCargoTarget \?\? env\.CARGO_TARGET_DIR,/);
-  // ownedRoot must stay wired: without it the bridge refuses every link left by
-  // an earlier fingerprint, so any Cargo.lock or version bump hard-stops the
-  // next build until someone deletes the link by hand.
-  assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\)/);
-  assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
-  // A broker-managed host also routes through the bridge even though cacheMode
-  // is forced to "broker" there — its brokerManaged flag is what keeps a real
-  // (non-symlink) target directory from being treated as corruption.
-  assert.match(source, /if \(cacheMode === "shared" \|\| managedCargoTarget\) targetBridge\.ensure\(\)/);
-});
-
-test("a broker-managed host forces broker cacheMode so Cache V2's lease/prune/floor chain never runs against an unrelated volume", () => {
-  assert.match(
-    source,
-    /const cacheMode = managedCargoTarget \? "broker" : cacheModeRequested;/,
-  );
-  // Every Cache V2 lease/slot/prune/floor/mark call stays gated on cacheMode,
-  // never on cacheModeRequested directly, so forcing cacheMode to "broker" on a
-  // broker host is sufficient to skip all of them without a second gate.
-  for (const guarded of [
-    /acquireSuiteBuildSlot\(\{ layout: sharedLayout/,
-    /cacheLease = acquireCacheLease\(\{ layout: sharedLayout/,
-    /planCachePrune\(\{ snapshot, policy, protectedEntryIds: new Set\(\[sharedLayout\.id\]\) \}\)/,
-    /assertWriteVolumeFloors\(\{ volumes, policy,/,
-    /markCacheEntrySuccessful\(\{ layout: sharedLayout \}\)/,
-  ]) {
-    assert.match(source, guarded);
-  }
-  assert.doesNotMatch(source, /if \(cacheModeRequested === "shared"\) \{\s*\n\s*suiteSlot/);
-});
-
-test("Windows seal and cache identity bind the signing contract, config, and receipts", () => {
-  assert.match(source, /signingIdentity = platform === "win"/);
-  assert.match(source, /contract: target\.signingContract/);
-  assert.match(source, /configSha256: hashFile\(configPath\)/);
-  assert.match(source, /windows-\$\{phase\}\.json/);
-  assert.match(source, /inputHashes\["\.right-release\/signing-identity\.json"\]/);
-  assert.match(source, /cache: cacheIdentity\.fingerprint, signingIdentity/);
-  assert.match(source, /receipts: signingIdentity\.receiptInputs\.map/);
-  assert.match(readFileSync(new URL("./release.mjs", import.meta.url), "utf8"), /item\.after\?\.sha256 !== currentHashes/);
-});
-
-test("CPU sampling separates a silent working step from a hang", () => {
-  // Real `ps -o cputime=` shapes, including a multi-process group.
-  assert.equal(parseCpuSeconds("        0:03.21\n"), 3.21);
-  assert.equal(parseCpuSeconds("  1:02:03\n"), 3723);
-  assert.equal(parseCpuSeconds("  2-01:00:00\n"), 176400);
-  // A process group sums every member, which is how a linker under cargo shows up.
-  assert.equal(parseCpuSeconds("  0:10.00\n  0:05.00\n"), 15);
-  // A vanished process yields no rows: null, not zero, so the caller falls back
-  // to output and mtime rather than treating it as "no CPU used".
-  assert.equal(parseCpuSeconds(""), null);
-  assert.equal(parseCpuSeconds("   \n"), null);
-  assert.equal(parseCpuSeconds("garbage"), null);
-  assert.equal(parseCpuSeconds(undefined), null);
-});
-
-test("CPU sampling degrades to the old behaviour rather than inventing a verdict", () => {
-  const ok = (stdout) => () => ({ status: 0, stdout });
-  // A working process group reports advancing CPU.
-  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("  0:42.50\n") }), 42.5);
-  // Windows has no `ps`; sampling is skipped, not guessed.
-  assert.equal(processGroupCpuSeconds(123, { platform: "win32", run: ok("  0:42.50\n") }), null);
-  // No pid, a failed probe, or an empty result must all be "cannot measure",
-  // never 0 — 0 would look like a hang and kill a healthy build.
-  assert.equal(processGroupCpuSeconds(0, { platform: "darwin", run: ok("  0:42.50\n") }), null);
-  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: () => ({ status: 1, stdout: "" }) }), null);
-  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
-});
-
-test("package liveness owner timeout floors outer watchdog through shared release limits", () => {
-  assert.match(source, /livenessOwnerTimeoutMs: target\.package\.livenessOwnerTimeoutMs \?\? null/);
-  assert.match(source, /releaseProgressLimits\(env, \{ livenessOwnerTimeoutMs \}\)/);
-});
-
-// Regression: the managed-host gate must not depend on RIGHTKIT_BUILD_BROKER_SOCKET
-// alone. That variable is exported by login shells only, while the managed cargo
-// shim is on PATH in every shell — so an agent shell took the Cache V2 branch,
-// bridged src-tauri/target into the release cache, and then lost CARGO_TARGET_DIR
-// to the broker's unconditional override. The app built into the broker workspace
-// and packaging failed on an empty cache before notarize/staple.
-const managedHostDetected = (env, platform, exists) => brokerManagedHost(env, platform, exists);
-
-test("managed-host gate fires from the managed shim on PATH when no broker socket is exported", () => {
-  // The build gate is exactly the shared brokerManagedHost predicate cargo-contract.mjs exports,
-  // so there is exactly one definition of "is this a broker-managed host" in the codebase.
-  assert.match(
-    source,
-    /const managedCargoTarget = brokerManagedHost\(process\.env\) \? resolveTargetRoot\(cargoToml\) : null;/,
-  );
-  assert.match(source, /import \{ brokerManagedHost \} from "\.\/cargo-contract\.mjs";/);
-  assert.match(source, /import \{ resolveTargetRoot \} from "\.\/cargo-target\.mjs";/);
-
-  const shim = "/Volumes/D/.rightkit-managed/agent-bin/cargo";
-  const exists = (candidate) => candidate === shim;
-
-  // Agent (non-login) shell: no socket variable, managed shim first on PATH.
-  assert.equal(managedHostDetected({ PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists), true);
-  // Login shell: unchanged behaviour, with or without the shim resolvable.
-  assert.equal(
-    managedHostDetected({ PATH: `${path.dirname(shim)}:/usr/bin`, RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" }, "darwin", exists),
-    true,
-  );
-  assert.equal(managedHostDetected({ PATH: "/usr/bin", RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" }, "darwin", () => false), true);
-  // Unmanaged host: neither signal, so the Cache V2 branch still owns the build.
-  assert.equal(managedHostDetected({ PATH: "/usr/bin:/usr/local/bin" }, "darwin", () => false), false);
-  // PATH precedence still decides: an unmanaged toolchain ahead of the shim is unmanaged.
-  const both = new Set(["/usr/local/bin/cargo", shim]);
-  assert.equal(managedHostDetected({ PATH: `/usr/local/bin:${path.dirname(shim)}` }, "darwin", (c) => both.has(c)), false);
-});
-
-test("brokerManagedHost is the single shared predicate: env var alone, shim alone, both, or neither", () => {
-  const shim = "/Volumes/D/.rightkit-managed/agent-bin/cargo";
-  const exists = (candidate) => candidate === shim;
-
-  // Broker socket alone (login shell), no shim resolvable.
-  assert.equal(brokerManagedHost({ RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", PATH: "/usr/bin" }, "darwin", () => false), true);
-  // Shim on PATH alone (agent/non-login shell), no socket exported.
-  assert.equal(brokerManagedHost({ PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists), true);
-  // Both signals present.
-  assert.equal(
-    brokerManagedHost({ RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists),
-    true,
-  );
-  // Neither signal: unmanaged host.
-  assert.equal(brokerManagedHost({ PATH: "/usr/bin:/usr/local/bin" }, "darwin", () => false), false);
-});
-
-test("the managed branch hands the Rust target directory to the broker while the unmanaged branch keeps Cache V2", () => {
-  // Managed: CARGO_TARGET_DIR (and the rest of the Cache V2 environment) is deleted
-  // from the child environment, so the broker's own override is the only one.
-  assert.match(
-    source,
-    /if \(managedCargoTarget\) \{\n\s*for \(const name of \["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"\]\) \{\n\s*delete env\[name\];/,
-  );
-  // Managed: no vault build root, and the bridge points at the metadata-reported target.
-  assert.match(source, /const buildRoot = managedCargoTarget \? null :/);
-  assert.match(source, /target: managedCargoTarget \?\? env\.CARGO_TARGET_DIR,/);
-  assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\),/);
-  // The managed target is read from crate metadata through the shim, which is what
-  // makes the bridge target equal to the directory the broker actually builds into.
-  // resolveTargetRoot (cargo-target.mjs) is the single shared implementation —
-  // build-release.mjs no longer defines its own copy.
-  assert.doesNotMatch(source, /function resolveManagedCargoTarget/);
-  // Unmanaged (managedCargoTarget === null): Cache V2 still supplies CARGO_TARGET_DIR.
-  assert.match(source, /\.\.\.releaseEnvironment\(\{ root: vaultRoot, cacheRoot: sharedCacheRoot,/);
-});