@rightkit/release 0.2.69 → 0.2.71

package/model-promote.test.mjs

@@ -1,284 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash, generateKeyPairSync, sign } from "node:crypto";
-import { spawnSync } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-import {
-  RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
-  defaultWindowsRuntimeArtifactSigningKeyFile,
-  loadRuntimeArtifactSigningKey,
-  promoteRuntimeArtifact,
-  runtimeArtifactUploadEnv,
-} from "./model-promote.mjs";
-const { privateKey } = generateKeyPairSync("ed25519");
-const artifactDigest = "a".repeat(64);
-const evidenceDigest = "b".repeat(64);
-const packageRoot = path.dirname(fileURLToPath(import.meta.url));
-const candidateCommit = "a".repeat(40);
-
-// Source identity as build/upload/promote read it: the exact commit, plus the
-// porcelain status that must be empty for the promotion to run.
-function verificationFixture(commit = candidateCommit, status = "") {
-  return { candidateCommit: commit, status };
-}
-
-function request(overrides = {}) {
-  return {
-    authority: "heardright",
-    privateKey,
-    keyId: RUNTIME_ARTIFACT_TRUSTED_KEY_ID,
-    artifactFile: "C:/fixtures/parakeet.onnx",
-    evidenceFile: "C:/fixtures/eval.json",
-    config: {
-      artifact: {
-        filename: "parakeet.onnx",
-        sha256: artifactDigest,
-        sizeBytes: 42,
-      },
-      evidence: { sha256: evidenceDigest },
-      manifest: {
-        artifactKind: "asr-model",
-        entitlement: { appKey: "scraperight", tier: "pro" },
-        distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
-        target: { os: "windows", arch: "x86_64" },
-        versions: {
-          runtime: "rightkit-asr-0.1.0",
-          model: "parakeet-tdt-0.6b-v3",
-          tokenizer: "sentencepiece-2026-07-14",
-          preprocessing: "rightkit-asr-0.1.0",
-          license: "cc-by-4.0",
-          provenance: "heardright-approved-2026-07-14",
-        },
-        provenance: {
-          source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
-          sourceRevision: "0123456789abcdef",
-          licenseId: "CC-BY-4.0",
-          noticeSha256: "c".repeat(64),
-        },
-        promotion: {
-          promotionId: "hr-asr-2026-07-14-001",
-          promotedAt: "2026-07-14T12:00:00.000Z",
-        },
-      },
-    },
-    verification: verificationFixture(),
-    ...overrides,
-  };
-}
-
-function boundaries(events) {
-  return {
-    metadata: async (file) => file.endsWith("eval.json")
-      ? { sha256: evidenceDigest, sizeBytes: 10 }
-      : { sha256: artifactDigest, sizeBytes: 42 },
-    upload: async ({ purpose }) => { events.push(`upload:${purpose}`); },
-    register: async () => { events.push("register"); },
-  };
-}
-
-test("uploads immutable object, registers signed envelope, then replaces stable pointer", async () => {
-  const events = [];
-  const result = await promoteRuntimeArtifact(request(), boundaries(events));
-
-  assert.deepEqual(events, ["upload:object", "register", "upload:pointer"]);
-  assert.equal(result.envelope.signature.keyId, RUNTIME_ARTIFACT_TRUSTED_KEY_ID);
-  assert.equal(result.envelope.manifest.object.sha256, artifactDigest);
-  assert.equal(result.envelope.manifest.promotion.evidenceSha256, evidenceDigest);
-  assert.match(result.envelope.manifest.pointerKey, /\/current\/manifest\.json$/);
-});
-
-test("dry-run validates and signs without invoking process or network boundaries", async () => {
-  const events = [];
-  const result = await promoteRuntimeArtifact(request({ dryRun: true }), boundaries(events));
-  assert.deepEqual(events, []);
-  assert.deepEqual(result.steps, ["upload immutable object", "register signed envelope", "replace stable pointer"]);
-  assert.equal(result.envelope.signature.algorithm, "Ed25519");
-});
-
-test("model promotion refuses a dirty working tree", async () => {
-  const events = [];
-  const verification = verificationFixture(candidateCommit, " M packages/release/model-promote.mjs\0");
-  await assert.rejects(
-    promoteRuntimeArtifact(request({ verification, dryRun: true }), boundaries(events)),
-    /clean working tree/,
-  );
-  assert.deepEqual(events, []);
-});
-
-test("model promotion requires source identity", async () => {
-  const events = [];
-  await assert.rejects(
-    promoteRuntimeArtifact(request({ verification: undefined, dryRun: true }), boundaries(events)),
-    /source identity is required/,
-  );
-  assert.deepEqual(events, []);
-});
-
-test("never registers or publishes a pointer after immutable upload failure", async () => {
-  const events = [];
-  const deps = boundaries(events);
-  deps.upload = async ({ purpose }) => {
-    events.push(`upload:${purpose}`);
-    throw new Error("R2 failed");
-  };
-  await assert.rejects(promoteRuntimeArtifact(request(), deps), /R2 failed/);
-  assert.deepEqual(events, ["upload:object"]);
-});
-
-test("never publishes a pointer when RightApps registration fails", async () => {
-  const events = [];
-  const deps = boundaries(events);
-  deps.register = async () => {
-    events.push("register");
-    throw new Error("registration failed");
-  };
-  await assert.rejects(promoteRuntimeArtifact(request(), deps), /registration failed/);
-  assert.deepEqual(events, ["upload:object", "register"]);
-});
-
-test("fails before mutation on digest, authority, key-id, or lane contradiction", async () => {
-  const badRequests = [
-    request({ authority: "scraperight" }),
-    request({ keyId: "untrusted-key" }),
-    request({ config: { ...request().config, artifact: { ...request().config.artifact, sha256: "d".repeat(64) } } }),
-    request({ config: {
-      ...request().config,
-      manifest: {
-        ...request().config.manifest,
-        entitlement: { appKey: "scraperight", tier: "public" },
-        distribution: { delivery: "public-r2", bucket: "rightapps-downloads" },
-      },
-    } }),
-    request({ config: {
-      ...request().config,
-      manifest: {
-        ...request().config.manifest,
-        promotion: {
-          ...request().config.manifest.promotion,
-          authorityAppKey: "scraperight",
-        },
-      },
-    } }),
-  ];
-  for (const input of badRequests) {
-    const events = [];
-    await assert.rejects(promoteRuntimeArtifact(input, boundaries(events)));
-    assert.deepEqual(events, []);
-  }
-});
-
-test("right-release routes model promote to the portable promotion lane", () => {
-  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--authority", "heardright"], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  assert.equal(result.status, 1);
-  assert.match(result.stderr, /model promote requires --config/);
-  assert.doesNotMatch(result.stderr, /unknown command/);
-});
-
-test("model promote help documents the portable config and secure key inputs", () => {
-  const result = spawnSync(process.execPath, [path.join(packageRoot, "cli/right-release.mjs"), "model", "promote", "--help"], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /artifact\.file/);
-  assert.match(result.stdout, /evidence\.sha256/);
-  assert.match(result.stdout, /RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE/);
-  assert.match(result.stdout, /RIGHTAPPS_RELEASE_TOKEN/);
-});
-
-test("portable CLI promotes from a clean checkout, refuses a dirty one, and rejects injected trust flags", async () => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "rightkit-model-promote-test-"));
-  try {
-    const artifact = Buffer.from("tiny model fixture");
-    const evidence = Buffer.from('{"certified":true}');
-    const testKeys = generateKeyPairSync("ed25519");
-    const keyPem = testKeys.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
-    await Promise.all([
-      writeFile(path.join(root, "model.onnx"), artifact),
-      writeFile(path.join(root, "evidence.json"), evidence),
-      writeFile(path.join(root, "key.pem"), keyPem, { mode: 0o600 }),
-    ]);
-    spawnSync("git", ["init"], { cwd: root, encoding: "utf8" });
-    spawnSync("git", ["add", "."], { cwd: root, encoding: "utf8" });
-    const committed = spawnSync("git", ["-c", "user.name=fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "fixture"], { cwd: root, encoding: "utf8" });
-    assert.equal(committed.status, 0, committed.stderr);
-    const config = {
-      artifact: {
-        file: "model.onnx",
-        filename: "model.onnx",
-        sha256: createHash("sha256").update(artifact).digest("hex"),
-        sizeBytes: artifact.length,
-      },
-      evidence: {
-        file: "evidence.json",
-        sha256: createHash("sha256").update(evidence).digest("hex"),
-      },
-      manifest: request().config.manifest,
-    };
-    await writeFile(path.join(root, "promotion.json"), JSON.stringify(config));
-    spawnSync("git", ["add", "."], { cwd: root, encoding: "utf8" });
-    spawnSync("git", ["-c", "user.name=fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "config"], { cwd: root, encoding: "utf8" });
-
-    const promoteArgs = [
-      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
-      "--authority", "heardright",
-      "--config", path.join(root, "promotion.json"),
-      "--signing-key-file", path.join(root, "key.pem"),
-      "--dry-run",
-    ];
-    const result = spawnSync(process.execPath, promoteArgs, { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(result.status, 0, result.stderr);
-
-    await writeFile(path.join(root, "untracked.txt"), "dirty");
-    const dirty = spawnSync(process.execPath, promoteArgs, { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(dirty.status, 1);
-    assert.match(dirty.stderr, /clean working tree/);
-
-    const attacker = spawnSync(process.execPath, [
-      path.join(packageRoot, "cli/right-release.mjs"), "model", "promote",
-      "--authority", "heardright", "--config", path.join(root, "promotion.json"),
-      "--verification-public-key", path.join(root, "verification-public.pem"),
-    ], { cwd: root, encoding: "utf8", windowsHide: true });
-    assert.equal(attacker.status, 1);
-    assert.match(attacker.stderr, /unknown model promote argument: --verification-public-key/);
-    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /BEGIN PRIVATE KEY/);
-    assert.doesNotMatch(`${result.stdout}${result.stderr}`, /Uploading|POST https:/);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test("uses the canonical Windows signing-key path and supports a Keychain-fed PEM environment value", async () => {
-  assert.equal(
-    defaultWindowsRuntimeArtifactSigningKeyFile({ APPDATA: "C:/Users/test/AppData/Roaming" }),
-    path.join("C:/Users/test/AppData/Roaming", "RightKit", "runtime-artifact-signing-key.pem"),
-  );
-  assert.equal(
-    await loadRuntimeArtifactSigningKey({ env: { RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "line1\\nline2" }, platform: "darwin" }),
-    "line1\nline2",
-  );
-});
-
-test("does not forward signing or RightApps credentials into the Wrangler uploader process", () => {
-  const env = runtimeArtifactUploadEnv({
-    CLOUDFLARE_API_TOKEN: "cloudflare-token",
-    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY: "private-pem",
-    RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE: "key.pem",
-    RIGHTAPPS_RELEASE_TOKEN: "release-token",
-    RIGHTAPPS_RELEASE_TOKEN_FILE: "release.token",
-  });
-  assert.equal(env.CLOUDFLARE_API_TOKEN, "cloudflare-token");
-  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY, undefined);
-  assert.equal(env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE, undefined);
-  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN, undefined);
-  assert.equal(env.RIGHTAPPS_RELEASE_TOKEN_FILE, undefined);
-});

package/notary-auth.test.mjs

@@ -1,31 +0,0 @@
-import assert from "node:assert/strict";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { notarytoolAuthArgs } from "./notary-auth.mjs";
-
-test("prefers a complete App Store Connect API credential set", () => {
-  const before = { ...process.env };
-  try {
-    process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
-    process.env.APPLE_API_KEY = "KEY123";
-    process.env.APPLE_API_ISSUER = "ISSUER123";
-    assert.deepEqual(notarytoolAuthArgs(), ["--key", path.join(os.homedir(), "AuthKey.p8"), "--key-id", "KEY123", "--issuer", "ISSUER123"]);
-  } finally {
-    process.env = before;
-  }
-});
-
-test("falls back to the device keychain profile and rejects partial API auth", () => {
-  const before = { ...process.env };
-  try {
-    delete process.env.APPLE_API_KEY_PATH;
-    delete process.env.APPLE_API_KEY;
-    delete process.env.APPLE_API_ISSUER;
-    assert.deepEqual(notarytoolAuthArgs(), ["--keychain-profile", "apple-dev-notary"]);
-    process.env.APPLE_API_KEY = "KEY123";
-    assert.throws(() => notarytoolAuthArgs(), /requires APPLE_API_KEY_PATH.*APPLE_API_ISSUER/);
-  } finally {
-    process.env = before;
-  }
-});

package/nsis-payload.test.mjs

@@ -1,139 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import test, { after } from "node:test";
-import { listNsisPayload, parseSevenZipListing, resolveSevenZip, verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
-
-const workspace = mkdtempSync(path.join(tmpdir(), "rightkit-nsis-"));
-after(() => rmSync(workspace, { recursive: true, force: true }));
-
-// 7-Zip's technical listing: an archive record, a rule, then one record per member.
-// The blank `Attributes` and absent timestamps are what the column-aligned listing
-// gets wrong, so they are reproduced here deliberately.
-const LISTING = [
-  "Path = D:\\out\\App_1.2.3_x64-setup.exe",
-  "Type = Nsis",
-  "",
-  "----------",
-  "Path = $PLUGINSDIR\\System.dll",
-  "Size = 12288",
-  "Attributes = ",
-  "",
-  "Path = app with spaces.exe",
-  "Size = 13750736",
-  "Attributes = ",
-  "",
-  "Path = legal",
-  "Size = 0",
-  "Folder = +",
-  "Attributes = D",
-  "",
-  "Path = legal\\EULA.md",
-  "Size = 16723",
-  "Attributes = A",
-  "",
-].join("\n");
-
-test("parses 7-Zip technical listings, including blank dates and spaced names", () => {
-  const entries = parseSevenZipListing(LISTING);
-  assert.deepEqual(entries.map((entry) => entry.name), [
-    "$PLUGINSDIR/System.dll",
-    "app with spaces.exe",
-    "legal/EULA.md",
-  ]);
-  assert.equal(entries[1].sizeBytes, 13_750_736);
-});
-
-test("ignores the archive's own record above the rule", () => {
-  const entries = parseSevenZipListing(LISTING);
-  assert.equal(entries.some((entry) => entry.name.endsWith("setup.exe")), false);
-});
-
-test("listNsisPayload surfaces the 7-Zip failure instead of reporting an empty payload", () => {
-  assert.throws(
-    () => listNsisPayload("installer.exe", {
-      sevenZip: "7z",
-      run: () => ({ status: 2, stdout: "", stderr: "Cannot open the file as archive" }),
-    }),
-    /could not read the NSIS payload.*Cannot open the file as archive/s,
-  );
-});
-
-test("verifyNsisEmbeddedBinary accepts a payload whose bytes match the signed EXE", () => {
-  const installer = path.join(workspace, "setup.exe");
-  writeFileSync(installer, "installer-container");
-  const payload = Buffer.from("signed-executable-bytes");
-  const sha256 = createHash("sha256").update(payload).digest("hex");
-
-  const receipt = verifyNsisEmbeddedBinary({
-    installer,
-    entryName: "app.exe",
-    expectedSha256: sha256,
-    sevenZip: "7z",
-    run: (_command, args) => {
-      const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
-      writeFileSync(path.join(destination, "app.exe"), payload);
-      return { status: 0, stdout: "Everything is Ok", stderr: "" };
-    },
-  });
-
-  assert.equal(receipt.sha256, sha256);
-  assert.equal(receipt.entry, "app.exe");
-  assert.equal(receipt.sizeBytes, payload.length);
-  assert.equal(receipt.installerSha256, createHash("sha256").update(readFileSync(installer)).digest("hex"));
-});
-
-test("verifyNsisEmbeddedBinary rejects a payload that drifted from the signed EXE", () => {
-  const installer = path.join(workspace, "setup-drifted.exe");
-  writeFileSync(installer, "installer-container");
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({
-      installer,
-      entryName: "app.exe",
-      expectedSha256: createHash("sha256").update("signed-executable-bytes").digest("hex"),
-      sevenZip: "7z",
-      run: (_command, args) => {
-        const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
-        writeFileSync(path.join(destination, "app.exe"), "rewritten-after-signing");
-        return { status: 0, stdout: "Everything is Ok", stderr: "" };
-      },
-    }),
-    /does not embed the signed app\.exe.*Authenticode signature is invalid/s,
-  );
-});
-
-test("verifyNsisEmbeddedBinary fails when the entry is absent rather than passing vacuously", () => {
-  const installer = path.join(workspace, "setup-missing.exe");
-  writeFileSync(installer, "installer-container");
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({
-      installer,
-      entryName: "app.exe",
-      expectedSha256: "a".repeat(64),
-      sevenZip: "7z",
-      run: () => ({ status: 2, stdout: "", stderr: "No files to process" }),
-    }),
-    /could not extract app\.exe/,
-  );
-});
-
-test("verifyNsisEmbeddedBinary refuses a caller that has no digest to compare against", () => {
-  assert.throws(
-    () => verifyNsisEmbeddedBinary({ installer: "setup.exe", entryName: "app.exe", expectedSha256: undefined, sevenZip: "7z", run: () => ({ status: 0 }) }),
-    /expected a sha256 digest/,
-  );
-});
-
-test("resolveSevenZip names the fix when 7-Zip is absent", () => {
-  assert.throws(
-    () => resolveSevenZip({ env: {}, exists: () => false, which: () => null }),
-    /install 7-Zip.*RIGHT_RELEASE_SEVENZIP/s,
-  );
-});
-
-test("resolveSevenZip honours an explicit override and rejects a bad one", () => {
-  assert.equal(resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\tools\\7z.exe" }, exists: () => true }), "C:\\tools\\7z.exe");
-  assert.throws(() => resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\gone\\7z.exe" }, exists: () => false }), /does not exist/);
-});

package/nsis-upgrade-contract.test.mjs

@@ -1,57 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
-
-function fixture(template) {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-nsis-upgrade-"));
-  const tauriDir = path.join(root, "src-tauri");
-  const windowsDir = path.join(tauriDir, "windows");
-  mkdirSync(windowsDir, { recursive: true });
-  writeFileSync(
-    path.join(tauriDir, "tauri.conf.json"),
-    `${JSON.stringify({ bundle: { windows: { nsis: { template: "windows/installer.nsi" } } } })}\n`,
-  );
-  writeFileSync(path.join(windowsDir, "installer.nsi"), template);
-  return root;
-}
-
-test("rejects an NSIS template that exposes uninstall-or-reinstall maintenance choices", () => {
-  const root = fixture(`
-    Page custom PageReinstall PageLeaveReinstall
-    Function PageReinstall
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  assert.throws(
-    () => assertNsisInPlaceUpgradeContract(root),
-    /automatic in-place upgrade|maintenance choice/i,
-  );
-});
-
-test("accepts a template that skips maintenance UI for same-version repair and upgrades", () => {
-  const root = fixture(`
-    !define RIGHTKIT_AUTOMATIC_IN_PLACE_UPGRADE
-    Function PageReinstall
-      $\{If\} $WixMode = 0
-      $\{AndIf\} $R0 >= 0
-        Abort
-      $\{EndIf\}
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  const result = assertNsisInPlaceUpgradeContract(root);
-  assert.match(result.templatePath, /installer\.nsi$/);
-});
-
-test("rejects a marker without executable skip-page logic", () => {
-  const root = fixture(`
-    !define RIGHTKIT_AUTOMATIC_IN_PLACE_UPGRADE
-    Function PageReinstall
-      nsDialogs::Show
-    FunctionEnd
-  `);
-  assert.throws(() => assertNsisInPlaceUpgradeContract(root), /skip.*logic/i);
-});

package/pipeline-normalization-contract.test.mjs

@@ -1,140 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import path from "node:path";
-import test from "node:test";
-
-const workspace = path.resolve(
-  process.env.RIGHT_SUITE_CONTRACT_WORKSPACE
-    ?? new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"),
-);
-
-const packageRoots = [
-  "coderight/apps/coderight-tauri",
-  "cutright/apps/studio",
-  "genright",
-  "heardright/tauri-app-next",
-  "mailright",
-  "membrane/apps/membrane-hub",
-  "scraperight",
-  "viewright",
-  "voiceright",
-];
-
-const releaseConfigRoots = [
-  ...packageRoots,
-  "tools/screenright",
-];
-
-const rightGitRepos = ["cutright", "legion", "membrane"];
-const privateRepos = ["rightsites", "sellright", "workright"];
-
-function executableSource(source) {
-  return source
-    .replace(/\/\*[\s\S]*?\*\//g, "")
-    .split("\n")
-    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
-    .join("\n");
-}
-
-function pipelineScripts(root) {
-  const repo = execFileSync("git", ["-C", root, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true }).trim();
-  const prefix = path.relative(repo, root).replaceAll(path.sep, "/");
-  const tracked = execFileSync("git", ["-C", repo, "ls-files", "-z"], { encoding: "utf8", windowsHide: true })
-    .split("\0")
-    .filter(Boolean);
-  return tracked
-    .filter((entry) => {
-      const local = prefix ? entry.slice(prefix.length + 1) : entry;
-      if (prefix && !entry.startsWith(`${prefix}/`)) return false;
-      return (
-        local.startsWith("scripts/")
-        || local === "package.ps1"
-        || local === "package.sh"
-      ) && /\.(?:mjs|cjs|js|ts|ps1|sh|py)$/i.test(local)
-        && !/(?:^|[.-])test(?:[.-]|$)/i.test(path.basename(local));
-    })
-    .map((entry) => path.join(repo, entry))
-    .filter((entry) => existsSync(entry));
-}
-
-test("product package pipelines use installed RightKit commands", () => {
-  const violations = [];
-  for (const root of packageRoots) {
-    const manifestPath = path.join(workspace, root, "package.json");
-    if (!existsSync(manifestPath)) continue;
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-    for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
-      if (!/^(?:build|package|publish|release|deps|verify:rust|test:rust|lint:rust)/.test(name)) continue;
-      if (/(?:\.\.\/[\w./-]*)?tools\/right-release|tools\\right-release/i.test(command)) violations.push(`${root} ${name}: retired workspace-local right-release source`);
-      if (/(?:^|&&|\|\||;)\s*cargo\s+/i.test(command)) violations.push(`${root} ${name}: bare cargo`);
-      if (/(?:^|&&|\|\||;)\s*npx\s+/i.test(command)) violations.push(`${root} ${name}: npx`);
-      if (/(?:^|&&|\|\||;)\s*npm\s+(?:ci|install)\b/i.test(command)) violations.push(`${root} ${name}: npm install`);
-    }
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("release configs resolve Cargo output through RightKit", () => {
-  const violations = [];
-  for (const root of releaseConfigRoots) {
-    const configPath = path.join(workspace, root, "right-release.config.mjs");
-    if (!existsSync(configPath)) continue;
-    const source = executableSource(readFileSync(configPath, "utf8"));
-    const hardcodedTargetRoot = /(?:const|let|var)\s+\w+\s*=\s*["'`]src-tauri[\\/]target/i.test(source);
-    const hardcodedTargetArtifact = /(?:file|signature)\s*:\s*["'`]src-tauri[\\/]target/i.test(source);
-    if (!hardcodedTargetRoot && !hardcodedTargetArtifact) continue;
-    if (!/@rightkit\/release\/cargo-target\.mjs|\.\/scripts\/lib\/target-root\.mjs/.test(source)) violations.push(`${root}: no RightKit target resolver`);
-    if (!/resolve(?:TargetRoot|WindowsReleaseDir)\s*\(/.test(source)) violations.push(`${root}: resolver not invoked`);
-    if (hardcodedTargetRoot) violations.push(`${root}: hardcoded target root`);
-    if (hardcodedTargetArtifact) violations.push(`${root}: hardcoded target artifact`);
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("product pipeline children use managed Rust commands", () => {
-  const violations = [];
-  for (const root of packageRoots) {
-    for (const file of pipelineScripts(path.join(workspace, root))) {
-      const source = executableSource(readFileSync(file, "utf8"));
-      const label = path.relative(workspace, file);
-      if (/(?:spawnSync|spawn|execFileSync|execFile)\s*\(\s*["'`](?:cargo|rustc|rustdoc)["'`]/.test(source)) violations.push(`${label}: unmanaged JS child`);
-      if (/subprocess\.(?:run|Popen)\s*\(\s*\[\s*["'](?:cargo|rustc|rustdoc)["']/.test(source)) violations.push(`${label}: unmanaged Python child`);
-      if (/(?:^|\n)\s*(?:&\s*)?(?:cargo|rustc|rustdoc)\s+(?:build|check|clippy|metadata|test|-vV)\b/m.test(source)) violations.push(`${label}: unmanaged shell command`);
-    }
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("hosted workflows are generated by right-git", () => {
-  const violations = [];
-  for (const root of rightGitRepos) {
-    const workflowRoot = path.join(workspace, root, ".github", "workflows");
-    if (!existsSync(workflowRoot)) continue;
-    for (const entry of readdirSync(workflowRoot, { withFileTypes: true })) {
-      if (!entry.isFile() || !/\.ya?ml$/i.test(entry.name)) continue;
-      const source = readFileSync(path.join(workflowRoot, entry.name), "utf8");
-      if (!/^# Managed by right-git\b/.test(source)) violations.push(`${root}/.github/workflows/${entry.name}: not right-git managed`);
-    }
-  }
-  for (const root of privateRepos) {
-    const workflowRoot = path.join(workspace, root, ".github", "workflows");
-    const workflows = existsSync(workflowRoot)
-      ? readdirSync(workflowRoot).filter((entry) => /\.ya?ml$/i.test(entry))
-      : [];
-    if (workflows.length) violations.push(`${root}: private repo has ${workflows.join(", ")}`);
-  }
-  assert.deepEqual(violations, []);
-});
-
-test("workspace memory pipelines route Rust through RightKit", () => {
-  for (const relative of [
-    "tools/pipelines/memory/dispatch/gate.py",
-    "tools/pipelines/memory/install-cortex.py",
-    "tools/pipelines/memory/verify-source-owner.py",
-  ]) {
-    const source = executableSource(readFileSync(path.join(workspace, relative), "utf8"));
-    assert.doesNotMatch(source, /(?:^|&&|\|\||;)\s*cargo\s+(?:metadata|build|check|clippy|test)\b/m, `${relative} invokes bare Cargo shell command`);
-    assert.doesNotMatch(source, /subprocess\.run\(\s*\[\s*["']cargo["']/m, `${relative} invokes bare Cargo subprocess`);
-  }
-});