@rightkit/release 0.3.0 → 0.4.0

package/ownership-key-command.mjs

@@ -8,6 +8,8 @@ import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "
 import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, TRUST_SYNC_RETIRED, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { buildMacInvocation, hasTerminal } from "./ownership-key-elevation.mjs";
+import { mergeRepositoriesFromInstalledRelease, prepareTrustUpdate, REPOSITORY_REGISTRY_MALFORMED_CODE } from "./ownership-key-trust.mjs";
+import { summarizeTrustChange } from "./ownership-trust-summary.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const LOG = ".rightkit/ownership-keys.json";
@@ -355,14 +357,24 @@ export async function main(args, deps = {}) {
   if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
   try {
     if (!platform) throw new Error(`ownership key management unsupported platform: ${process.platform}`);
+    const refresh = args[0] === "trust-refresh";
     // Delegate BEFORE taking the command lock: the desktop-session child needs that same lock.
-    const helper = deps.helper ?? helperFor(run);
+    // trust-refresh signs nothing, so it never touches the native key helper.
+    const helper = deps.helper ?? (refresh ? null : helperFor(run));
     const lockPath = deps.lockPath ?? path.join(os.tmpdir(), "rightkit-key-command.lock");
     let lockFd;
     lockFd = acquireCommandLock(lockPath);
     try {
       commandTemp = mkdtempSync(path.join(os.tmpdir(), "rightkit-key-command-"));
       const authority = resolveAuthority(root, run, deps.authority);
+      if (refresh) {
+        // Key-neutral: no key log event, no metadata commit, so no minimize hook. A dry run changes nothing at all,
+        // so it also skips the fetch and fast-forward that the real ceremony performs.
+        const dryRun = args.includes("--dry-run");
+        const transport = dryRun ? null : syncBeforeCeremony(root, run);
+        const headSnapshot = dryRun ? null : git(run, root, ["rev-parse", "HEAD"]);
+        return await trustRefresh(args, { ...deps, run, print, root, authority, transport, headSnapshot });
+      }
       const hook = detectMinimizeHook(root, run, deps);
       const transport = syncBeforeCeremony(root, run);
       const headSnapshot = git(run, root, ["rev-parse", "HEAD"]);
@@ -370,7 +382,7 @@ export async function main(args, deps = {}) {
       if (verb === "enroll") return await enroll(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "approve-key") return await approve(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "revoke-key") return await revoke(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
-      throw new Error("expected enroll, approve-key, or revoke-key (trust-sync is retired)");
+      throw new Error("expected enroll, approve-key, revoke-key, or trust-refresh (trust-sync is retired)");
     } finally {
       closeSync(lockFd);
       rmSync(lockPath, { force: true });
@@ -571,6 +583,61 @@ async function revoke(args, d) {
   print(`Ownership key revoked: ${keyId}; active keys: ${verifyKeyLog(next, { rootFingerprint: pin }).keys.length}`);
   return 0;
 }
+const repositoryNames = (list) => list.map((identity) => String(identity).replace(/^https:\/\/github\.com\//i, "")).join(", ");
+
+/**
+ * Key-neutral elevated trust update. Builds the same request an approve-key checkpoint update sends (current committed
+ * key log, the host's pinned root fingerprint, the protected authority) so performProtectedTrustUpdate runs its
+ * additions-only registration merge and floor raise from the INSTALLED release. It adds no key event, writes nothing
+ * under .rightkit/ and creates no commit. Elevation, the pinned request digest and the installed-sibling-script rule
+ * are the unchanged elevate() path.
+ */
+async function trustRefresh(args, d) {
+  const { print, root } = d;
+  const dryRun = args.includes("--dry-run");
+  const rest = args.slice(1);
+  const unexpected = rest.filter((arg, i) => !(arg === "--dry-run" || arg === "--app" || rest[i - 1] === "--app"));
+  if (unexpected.length) throw new Error(`trust-refresh accepts only --dry-run and --app <dir>; unexpected: ${unexpected.join(" ")}`);
+  assertSafeMetadataParents(root, LOG);
+  const hostTrust = (d.trustLoader ?? trustState)();
+  const existing = hostTrust?.trust;
+  if (!existing?.rootFingerprint) throw new Error("this host is not enrolled: protected ownership trust has no pinned root. trust-refresh never creates trust; run `right-release ownership enroll` first");
+  const log = readLog(root);
+  if (!log.events.length) throw new Error("no root key log exists in this checkout");
+  // Verifies the local log against the pinned root, the protected authority, and (unless injected) the committed HEAD blob.
+  currentLogTrust(root, log, hostTrust, d.authority, Boolean(d.resolveTrust));
+  const pin = existing.rootFingerprint;
+  const requestBytes = Buffer.from(json({ schema: 1, log, rootFingerprint: pin, baseline: null, authority: d.authority }));
+  const registry = d.installedRegistry ? { registry: d.installedRegistry } : {};
+  const merge = mergeRepositoriesFromInstalledRelease(prepareTrustUpdate(existing, JSON.parse(requestBytes.toString("utf8"))), registry);
+  const unusable = merge.warnings.find((item) => item.code === REPOSITORY_REGISTRY_MALFORMED_CODE);
+  if (unusable) throw new Error(`the installed release's repository registry is missing or malformed (${unusable.message}); refusing to refresh trust from it`);
+  const summary = summarizeTrustChange({ existing, requestBytes, ...registry });
+  const before = new Set((existing.repositories ?? []).map((entry) => entry.repositoryIdentity));
+  const added = merge.trust.repositories.map((entry) => entry.repositoryIdentity).filter((identity) => !before.has(identity));
+  print(added.length
+    ? `trust-refresh would add ${added.length} repositor${added.length === 1 ? "y" : "ies"} to protected trust: ${repositoryNames(added)}`
+    : "trust-refresh would add no repository registrations");
+  for (const line of summary.lines) print(`  ${line}`);
+  if (!summary.changed) { print("Protected ownership trust is already current; nothing to elevate."); return 0; }
+  if (dryRun) { print("Dry run: nothing was elevated or written."); return 0; }
+  if (git(d.run, root, ["rev-parse", "HEAD"]) !== d.headSnapshot) throw new Error("repository HEAD changed during ownership ceremony");
+  const request = makeTrustRequest(log, pin, null, d.authority);
+  try {
+    if (request.digest !== summary.payloadDigest) throw new Error("trust request bytes differ from the summarized request; refusing to elevate");
+    try { await (d.elevate ?? elevate)(d.run, request.file, request.digest); }
+    catch (error) {
+      if (platform === "macos" && !hasTerminal()) error.message += ". macOS elevation needs a human: run `right-release ownership trust-refresh` at a terminal for the sudo prompt, or approve the administrator dialog on the desktop; an unattended agent session without a tty cannot pass it";
+      throw error;
+    }
+  } finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
+  postVerify(root, log, d);
+  const present = ((d.trustLoader ?? trustState)().trust?.repositories ?? []).map((entry) => entry.repositoryIdentity);
+  const missing = added.filter((identity) => !present.includes(identity));
+  if (missing.length) throw new Error(`elevated update finished but protected trust still lacks: ${repositoryNames(missing)}`);
+  print(`Protected trust now registers ${present.length} repositories: ${repositoryNames(present)}`);
+  return 0;
+}
 async function signWithHelper(run, helper, log, operation, subject, signer) {
   const draft = createKeyEvent(log, { operation, subject, signerKeyId: signer.keyId });
   const input = temp("draft"), output = temp("draft-signed");

package/ownership-mandatory-set.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // right-release ownership-mandatory: Table 1 mandatory-owner-set check (plan task 5.1).
 //
+// This evaluates declarations only; it does not establish active target/features, lock resolution or production adoption.
 // A registered app must declare every Table 1 owner (rows M1-M23) at or above the required version,
 // from the registry. Report mode (default) prints per-app findings and exits 0; --enforce exits 1
 // on any missing owner, below-required version, or path/git/patch override ("not-on-registry").
@@ -25,14 +26,51 @@ const SKIP_DIRS = new Set(["node_modules", "target", ".git", "rk-snapshot", "ven
 const MAX_MANIFESTS = 2000;
 
 // ---- versions -------------------------------------------------------------------------------
-/** Lower bound of the first comparator in a Cargo/npm requirement, or null when none can be proven. */
+/**
+ * Proven minimum of a Cargo/npm requirement: a version every satisfying version is guaranteed >=, or null when
+ * none can be proven (upper-only `<9`, `*`, `latest`, malformed, or a `||` branch with no proven minimum).
+ * Space/comma comparators AND (proven minimum = max of lower contributions; `<`/`<=` contribute none); `||`
+ * branches union (proven minimum = min of branch minima, null if any branch is unprovable). Hyphen ranges
+ * contribute their lower end. `>`, `>=`, `=`, `^`, `~`, bare & wildcard partials contribute their version
+ * (missing/`x`/`*` components read as 0), so `>1.2.3` proves 1.2.3 (sound, never above the true floor).
+ */
 export function lowerBound(spec) {
   if (typeof spec !== "string") return null;
-  let s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "");
-  const m = /(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?/.exec(s);
-  if (!m || /^(\*|latest|x|)$/i.test(s)) return null;
-  const n = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
-  return { major: Number(m[1]), minor: n(m[2]), patch: n(m[3]), pre: m[4] ?? null };
+  const s = spec.trim().replace(/^npm:(?:@[^@/]+\/)?[^@]+@/, "").trim();
+  if (!s || /^(\*|latest|x)$/i.test(s)) return null;
+  const part = (v) => (v === undefined || /[xX*]/.test(v) ? 0 : Number(v));
+  const versionOf = (text) => {
+    const m = /^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(text);
+    if (m?.[4] && m[4].split(".").some((id) => !id || (/^\d+$/.test(id) && id.length > 1 && id.startsWith("0")))) return null;
+    return m ? { major: Number(m[1]), minor: part(m[2]), patch: part(m[3]), pre: m[4] ?? null } : null;
+  };
+  const branchBound = (branch) => {
+    const raw = branch.split(/[\s,]+/).filter(Boolean);
+    const tokens = [];
+    for (let i = 0; i < raw.length; i += 1) {
+      if (/^(>=|<=|>|<|=|\^|~)$/.test(raw[i]) && i + 1 < raw.length) { tokens.push(raw[i] + raw[i + 1]); i += 1; }
+      else tokens.push(raw[i]);
+    }
+    if (!tokens.length) return null;
+    const lowers = [];
+    let skipUpperEnd = false;
+    for (const token of tokens) {
+      if (token === "-") { skipUpperEnd = true; continue; }
+      if (skipUpperEnd) { skipUpperEnd = false; continue; }
+      if (/^(\*|x|latest)$/i.test(token)) continue;
+      const m = /^(>=|<=|>|<|=|\^|~)?(.+)$/.exec(token);
+      const version = m && versionOf(m[2]);
+      if (!version) return null;
+      if (m[1] === "<" || m[1] === "<=") continue;
+      lowers.push(version);
+    }
+    return lowers.length ? lowers.reduce((best, v) => (compareVersions(v, best) > 0 ? v : best)) : null;
+  };
+  const branches = s.split("||").map((b) => b.trim());
+  if (branches.some((b) => !b)) return null;
+  const bounds = branches.map(branchBound);
+  if (bounds.some((b) => b === null)) return null;
+  return bounds.reduce((best, v) => (compareVersions(v, best) < 0 ? v : best));
 }
 export const parseVersion = lowerBound;
 export function compareVersions(a, b) {
@@ -40,7 +78,19 @@ export function compareVersions(a, b) {
   if (a.pre === b.pre) return 0;
   if (a.pre === null) return 1;
   if (b.pre === null) return -1;
-  return a.pre < b.pre ? -1 : 1;
+  const left = a.pre.split("."), right = b.pre.split(".");
+  for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+    if (left[i] === undefined) return -1;
+    if (right[i] === undefined) return 1;
+    if (left[i] === right[i]) continue;
+    const an = /^\d+$/.test(left[i]), bn = /^\d+$/.test(right[i]);
+    if (an && bn) {
+      const av = BigInt(left[i]), bv = BigInt(right[i]);
+      if (av !== bv) return av < bv ? -1 : 1;
+    } else if (an !== bn) return an ? -1 : 1;
+    else return left[i] < right[i] ? -1 : 1;
+  }
+  return 0;
 }
 const show = (v) => `${v.major}.${v.minor}.${v.patch}${v.pre ? `-${v.pre}` : ""}`;
 
@@ -75,21 +125,21 @@ export function readManifest(file, root) {
     try { doc = parseToml(text); } catch (error) { return { rel, facts, error: `unparseable Cargo.toml: ${error.message}` }; }
     workspaceDeps = doc.workspace?.dependencies;
     const wsTable = workspaceDeps ?? {};
-    const sections = (table, dev) => {
+    const sections = (table, dev, target = null) => {
       for (const [section, isDev] of [["dependencies", dev], ["build-dependencies", dev], ["dev-dependencies", true]]) {
-        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev);
+        for (const [key, raw] of Object.entries(table?.[section] ?? {})) add(key, raw, isDev, target);
       }
     };
-    const add = (key, raw, dev) => {
+    const add = (key, raw, dev, target) => {
       let value = raw;
       if (value && typeof value === "object" && value.workspace === true && wsTable[key] !== undefined) value = { ...(typeof wsTable[key] === "object" ? wsTable[key] : { version: wsTable[key] }), ...value };
       const name = typeof value === "object" && typeof value.package === "string" ? value.package : key;
       const spec = typeof value === "string" ? value : value?.version;
       const unresolved = raw && typeof raw === "object" && raw.workspace === true && wsTable[key] === undefined;
-      facts.push({ owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
+      facts.push({ target, optional: Boolean(value?.optional), owner: name, ecosystem: "cargo", kind: isNonRegistry(value) ? "override" : "registry", dev, spec: spec ?? null, via: isNonRegistry(value) ? ("path" in value ? "path dependency" : "git dependency") : "dependency", file: rel, ...(unresolved ? { inheritsWorkspace: key } : {}) });
     };
     sections(doc, false);
-    for (const target of Object.values(doc.target ?? {})) sections(target, false);
+    for (const [target, table] of Object.entries(doc.target ?? {})) sections(table, false, target);
     for (const [key, raw] of Object.entries(wsTable)) {
       // workspace.dependencies only counts through members that opt in (above); record path/git overrides here.
       if (isNonRegistry(raw)) facts.push({ owner: typeof raw.package === "string" ? raw.package : key, ecosystem: "cargo", kind: "override", dev: false, spec: raw.version ?? null, via: "workspace.dependencies path/git", file: rel, declarationOnly: true });
@@ -107,7 +157,7 @@ export function readManifest(file, root) {
         const alias = typeof spec === "string" ? /^npm:((?:@[^@/]+\/)?[^@]+)@/.exec(spec) : null;
         const owner = alias ? alias[1] : name;
         const local = typeof spec === "string" && /^(workspace:|file:|link:|portal:|git\+|git:|github:|https?:)/.test(spec);
-        facts.push({ owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
+        facts.push({ declarationSection: section, optional: section === "optionalDependencies", peer: section === "peerDependencies", owner, ecosystem: "npm", kind: local ? "override" : "registry", dev, spec: typeof spec === "string" ? spec : null, via: local ? `${spec.split(":")[0]}: specifier` : "dependency", file: rel });
       }
     }
     for (const table of [doc.pnpm?.overrides, doc.overrides, doc.resolutions]) {
@@ -164,7 +214,7 @@ function judge(req, facts) {
   const counted = mine.filter((f) => f.kind === "registry" && (req.allowDev || !f.dev));
   const devOnly = !counted.length && mine.some((f) => f.kind === "registry" && f.dev);
   const min = lowerBound(req.min);
-  const base = { owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
+  const base = { evidenceKind: "declaration", qualification: "unverified", activeTarget: null, lockResolution: null, productionUse: null, declarations: mine.map((f) => ({ file: f.file, spec: f.spec, dev: f.dev, target: f.target ?? null, optional: f.optional ?? false, peer: f.peer ?? false })), owner: req.name, ecosystem: req.ecosystem, rows: [...new Set(req.rows)], required: req.min };
   const bounds = counted.map((f) => ({ f, v: lowerBound(f.spec) }));
   const best = bounds.filter((b) => b.v).sort((a, b) => compareVersions(b.v, a.v))[0];
   const declaredAt = best ? show(best.v) : null;
@@ -218,7 +268,7 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
   resolveWorkspaceInheritance(manifests);
   for (const m of manifests) if (m.error) problems.push(`${m.rel}: ${m.error}`);
   const facts = manifests.flatMap((m) => m.facts);
-  const owners = [...requirements(applicable).values()].map((req) => judge(req, facts));
+  const owners = [...requirements(applicable).values()].map((req) => { const result = judge(req, facts); return { ...result, declarationStatus: result.status }; });
   // A profile that is unknown, marked unratified, or has no rows checks nothing; an app may not select it, so it fails rather than passing empty.
   const profileStatus = !data.profiles[active] ? "unknown-profile" : (data.profiles[active].ratified === false || !data.rows.some((r) => r.profile === active)) ? "unratified" : null;
   if (profileStatus) {
@@ -236,7 +286,7 @@ export function checkApps(roots, options = {}) {
 }
 
 export function renderText(report) {
-  const out = [`ownership-mandatory (${report.mode}) — Table 1 mandatory owner set`];
+  const out = [`ownership-mandatory (${report.mode}) — Table 1 owner declarations (active-target, lock & production qualification unverified)`];
   for (const app of report.apps) {
     const count = (s) => app.owners.filter((o) => o.status === s).length;
     out.push("", `${app.app} [${app.profile}] ${app.scanned ? `ok=${count("ok")} missing=${count("missing")} below-required=${count("below-required")} not-on-registry=${count("not-on-registry")}` : "UNSCANNED"}`

package/ownership-repositories.json

@@ -15,7 +15,7 @@
     { "repositoryIdentity": "https://github.com/orthic-labs/legion", "roots": ["."], "visibility": "public" },
     { "repositoryIdentity": "https://github.com/bogusyogi/workright", "roots": ["."], "visibility": "private" },
     { "repositoryIdentity": "https://github.com/orthic-labs/sellright", "roots": ["."], "visibility": "public" },
-    { "repositoryIdentity": "https://github.com/orthic-labs/pulse", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/pulse", "roots": ["."], "visibility": "private" },
     { "repositoryIdentity": "https://github.com/bogusyogi/swiftright", "roots": ["."], "visibility": "private" }
   ]
 }

package/ownership-scope.mjs

@@ -0,0 +1,94 @@
+// Ownership scan scope for a target that builds from only part of its repository (iOS).
+// A scope is a sorted, de-duplicated list of repository-relative directory roots. Only committed files under those roots
+// are inventoried; the exceptions file under `.rightkit` is always read. Sealed ownership evidence records the scope and
+// upload-time verification re-derives it from the config, so the scope cannot be narrowed after the build.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+export const OWNERSHIP_SCOPE_ALWAYS = ".rightkit";
+
+/** Normalize and validate repository-relative scope roots; throws a clear error for absolute, escaping, or missing roots. */
+export function normalizeScopeRoots(roots, { repoRoot, label = "ownershipScope" } = {}) {
+  if (!Array.isArray(roots)) throw new Error(`${label} must be an array of repository-relative directories`);
+  const out = new Set();
+  for (const raw of roots) {
+    if (typeof raw !== "string" || !raw.trim()) throw new Error(`${label} entries must be non-empty strings`);
+    const slashed = raw.replaceAll("\\", "/");
+    if (path.posix.isAbsolute(slashed) || path.win32.isAbsolute(raw) || /^[A-Za-z]:/.test(slashed)) throw new Error(`${label} entry ${raw} must be repository-relative, not absolute`);
+    const normal = path.posix.normalize(slashed).replace(/\/+$/, "");
+    if (normal === ".." || normal.startsWith("../")) throw new Error(`${label} entry ${raw} escapes the repository`);
+    if (normal === "." || normal === "") throw new Error(`${label} entry ${raw} is the whole repository; omit the scope instead`);
+    if (repoRoot) {
+      const absolute = path.join(repoRoot, ...normal.split("/"));
+      let directory = false;
+      try { directory = existsSync(absolute) && statSync(absolute).isDirectory(); } catch { directory = false; }
+      if (!directory) throw new Error(`${label} entry ${raw} is not an existing directory in the repository`);
+    }
+    out.add(normal);
+  }
+  return [...out];
+}
+
+/** Local SwiftPM package directories named by `path:` inside the `packages:` section of an XcodeGen project.yml. */
+export function projectYmlLocalPackagePaths(text) {
+  const lines = String(text).split(/\r?\n/);
+  const paths = [];
+  let inPackages = false;
+  for (const line of lines) {
+    if (/^\s*(#.*)?$/.test(line)) continue;
+    if (/^\S/.test(line)) { inPackages = /^packages:\s*(#.*)?$/.test(line); continue; }
+    if (!inPackages) continue;
+    const match = /(?:^|[\s{,])path:\s*(?:"([^"]*)"|'([^']*)'|([^\s,}#]+))/.exec(line);
+    if (match) paths.push(match[1] ?? match[2] ?? match[3]);
+  }
+  return paths;
+}
+
+/**
+ * Scan scope of an iOS target: the Xcode project directory, each local SwiftPM package its project.yml references,
+ * `.rightkit` (exceptions), the native Rust assembly (`nativeAssembly.workspaceRoot` and the directory of its cargo manifest,
+ * which is compiled into the IPA), and `targets.ios.ownershipScope` additions. Accepts the raw or the expanded target.
+ * The scan itself closes this scope under local path dependencies of the in-scope manifests (see ownership.mjs).
+ * A native assembly rooted at the repository root is ignored (it would make the scope the whole repository).
+ * Returns null when the target has no iosPackage (nothing to scope from).
+ */
+export function iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly }) {
+  const spec = target?.recipe?.kind === "iosPackage" ? target.recipe.spec : target?.iosPackage;
+  if (!spec || typeof spec !== "object") return null;
+  const toRepo = (absolute) => {
+    const relative = path.relative(repoRoot, absolute).split(path.sep).join("/");
+    if (relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) throw new Error(`ios ownership scope: ${absolute} is outside the repository`);
+    return relative || ".";
+  };
+  const specFile = spec.projectSpec ?? spec.project;
+  if (typeof specFile !== "string") throw new Error("ios ownership scope: iosPackage.project or projectSpec is required");
+  const specDir = path.resolve(appRoot, path.posix.dirname(specFile.replaceAll("\\", "/")));
+  const roots = [];
+  const projectDir = toRepo(specDir);
+  if (projectDir === ".") throw new Error("ios ownership scope: the Xcode project sits at the repository root, so there is no narrower scope; declare the project in a subdirectory");
+  roots.push(projectDir);
+  if (spec.projectSpec) {
+    const ymlPath = path.resolve(appRoot, spec.projectSpec);
+    if (existsSync(ymlPath)) {
+      for (const local of projectYmlLocalPackagePaths(readFileSync(ymlPath, "utf8"))) roots.push(toRepo(path.resolve(specDir, local)));
+    }
+  }
+  const native = nativeAssembly && typeof nativeAssembly === "object" ? nativeAssembly : null;
+  const nativeDirs = [native?.workspaceRoot ?? native?.cargoWorkspaceRoot, (native?.cargoManifest ?? native?.manifest) ? path.dirname(native.cargoManifest ?? native.manifest) : undefined].filter((value) => typeof value === "string" && value);
+  for (const dir of nativeDirs) {
+    const nativeRoot = toRepo(path.resolve(appRoot, dir));
+    // A native assembly at the repository root is the app's own (usually desktop) workspace; folding it in would widen the
+    // scope to the whole repository, so it adds nothing. The scan's path-dependency closure still follows the in-scope manifests.
+    if (nativeRoot !== ".") roots.push(nativeRoot);
+  }
+  const extra = target.ownershipScope;
+  if (extra !== undefined) roots.push(...normalizeScopeRoots(extra, { repoRoot, label: "targets.ios.ownershipScope" }));
+  const checked = normalizeScopeRoots(roots.filter((root) => root !== OWNERSHIP_SCOPE_ALWAYS), { repoRoot, label: "ios ownership scope" });
+  return [...new Set([...checked, OWNERSHIP_SCOPE_ALWAYS])].sort();
+}
+
+/** Repository-relative file or directory under any scope root (null scope = everything). */
+export function inOwnershipScope(scope, rel) {
+  if (!scope) return true;
+  return scope.some((root) => rel === root || rel.startsWith(`${root}/`));
+}

package/ownership.mjs

@@ -12,6 +12,7 @@ import { createHash } from "node:crypto";
 import { acquireCommittedSource, committedSourceDataForInternalUse } from "./committed-source.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { gitListedInventory } from "./ownership-git-inventory.mjs";
+import { inOwnershipScope } from "./ownership-scope.mjs";
 import os from "node:os";
 import path from "node:path";
 
@@ -240,14 +241,40 @@ function fileInventory(appRoot, trust, pathPrefix = "", repositoryRoot = appRoot
   return listedCoverage(inventory);
 }
 
-function committedFileInventory(appRoot, trust, pathPrefix, committed) {
+// A scoped scan also reads the workspace/lockfile authorities that sit in an ancestor directory of a scope root
+// (a root Cargo.toml / Cargo.lock / lockfile resolves a member crate's inherited fields and lock graph), so a member
+// of a larger workspace is judged against the same lockfile as in a whole-repository scan.
+function inScopeOrAuthority(scope, rel) {
+  if (inOwnershipScope(scope, rel)) return true;
+  const dir = path.posix.dirname(rel);
+  return ["Cargo.toml", "Cargo.lock", "package.json", "pnpm-workspace.yaml", ...OWNERSHIP_LOCKFILES].includes(path.posix.basename(rel))
+    && scope.some((root) => dir === "." || root === dir || root.startsWith(`${dir}/`));
+}
+
+// Directories named by local path dependencies of in-scope manifests that are not yet in scope. A target that is not a
+// directory of the committed tree is left to resolveLocalPath, which records a blocking coverage gap for it.
+function localDependencyRoots(deps, scope, entries) {
+  const roots = new Set();
+  for (const dep of deps) {
+    if (!dep.local || typeof dep.source !== "string" || !dep.source.startsWith("path:")) continue;
+    const value = dep.source.slice(5);
+    if (!value || value.startsWith("workspace:") || path.posix.isAbsolute(value) || path.win32.isAbsolute(value) || value.includes("\\")) continue;
+    const relative = path.posix.normalize(path.posix.join(path.posix.dirname(dep.file), value)).replace(/\/$/, "");
+    if (relative === "." || relative === ".." || relative.startsWith("../") || inOwnershipScope(scope, relative)) continue;
+    if (entries.some((entry) => entry.rel.startsWith(`${relative}/`))) roots.add(relative);
+  }
+  return [...roots];
+}
+
+function committedFileInventory(appRoot, trust, pathPrefix, committed, scope = null) {
   const prefix = pathPrefix ? `${pathPrefix.replace(/\/$/, "")}/` : "";
   const repositoryFiles = committed.entries.filter((entry) => entry.type === "blob").map((entry) => ({ rel: entry.rel, size: entry.size, bytes: entry.bytes, mode: entry.mode }));
-  const files = [], coverage = committed.coverage.filter((entry) => !prefix || entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: prefix ? entry.path.slice(prefix.length) : entry.path }));
+  const files = [], coverage = committed.coverage.filter((entry) => (!prefix || entry.path.startsWith(prefix)) && inScopeOrAuthority(scope, entry.path)).map((entry) => ({ ...entry, path: prefix ? entry.path.slice(prefix.length) : entry.path }));
   const protectedPaths = new Set((trust?.provenance ?? []).flatMap((record) => record.paths ?? []));
   const reportedOpaque = new Set(), reportedNodeModules = new Set();
   for (const entry of committed.entries) {
     if (prefix && !entry.rel.startsWith(prefix)) continue;
+    if (!inScopeOrAuthority(scope, entry.rel)) continue;
     const rel = prefix ? entry.rel.slice(prefix.length) : entry.rel;
     if (!rel) continue;
     if (entry.mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "committed-symlink" }); continue; }
@@ -834,14 +861,28 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     keyCheckpoint = resolved.checkpoint;
   }
   const location = { root: committed.repositoryRoot, prefix: pathPrefix, pathBase: "repository" };
-  const inventory = committedFileInventory(appRoot, trust, location.prefix, committed);
-  if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
-    inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
-  }
+  const declaredScope = options.scope ?? null;
   const committedEnrollment = trust?.rootFingerprint
     ? { enrolled: trust.enrollmentComplete === true, pending: trust.enrollmentComplete !== true }
     : trustState?.pending !== undefined || trustState?.enrolled !== undefined ? trustState : undefined;
-  const scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
+  // The scope is closed under local path dependencies: a path dependency of an in-scope manifest that lands in an
+  // out-of-scope directory adds that directory to the scope and the scan repeats, so compiled-in code is never skipped.
+  let scope = declaredScope ? [...declaredScope] : null;
+  let inventory, scanned;
+  for (let round = 0; ; round += 1) {
+    inventory = committedFileInventory(appRoot, trust, location.prefix, committed, scope);
+    if (location.prefix && !committed.entries.some((entry) => entry.rel.startsWith(location.prefix))) {
+      inventory.coverage.push({ path: ".", status: "unscanned", reason: "registered-root-missing-from-committed-tree" });
+    }
+    scanned = scanInternal(appRoot, manifest, { inventory, trust, repositoryIdentity, repositoryRoot: location.root, pathPrefix: location.prefix, allowlistPolicy: dependencyAllowlistPolicy(trust, repositoryIdentity, { pending: enrollmentPending(trust, committedEnrollment), shipped: options.shippedAllowlist }) });
+    if (!scope) break;
+    const added = localDependencyRoots(scanned.deps, scope, committed.entries);
+    if (!added.length) break;
+    if (round >= 64) throw new Error("committed ownership: scan scope did not converge under local path dependencies");
+    scope = [...new Set([...scope, ...added])].sort();
+  }
+  // Provenance and lockfile diagnostics are computed beside the inventory; a scoped scan reports only gaps under its scope.
+  if (scope) scanned.coverage = scanned.coverage.filter((entry) => typeof entry.path !== "string" || entry.path === "." || inScopeOrAuthority(scope, entry.path));
   const exceptionPath = [location.prefix.replace(/\/$/, ""), EXCEPTIONS_FILE.split(path.sep).join("/")].filter(Boolean).join("/");
   const exceptionObject = committed.entries.find((entry) => entry.rel === exceptionPath);
   const exceptionEntry = exceptionObject?.bytes;
@@ -856,6 +897,7 @@ function checkCommitted(appRoot, manifest, options, acquire, readAuthority = rea
     scannedAt: new Date().toISOString(), catalogDigest: catalogDigest(manifest), catalogVersion: manifest.version ?? String(manifest.schema ?? "1"),
     scannerVersion: SCANNER_VERSION, contentDigests: scanned.contentDigests, coverage: scanned.coverage,
     pathBase: location.pathBase, pathPrefix: location.prefix, provenance: scanned.provenance, exceptionDigest,
+    ...(scope ? { ownershipScopeClosed: scope } : {}),
     source: "committed-git-tree", ...(keyLogDigest ? { keyLogDigest, keyCheckpoint, rootFingerprint: trust.rootFingerprint, ...(keyAuthorityBinding ? { keyAuthority: keyAuthorityBinding } : {}) } : {}),
   };
   const result = evaluate(scanned.findings, exceptions, { ...options, manifest, trust, trustEnrollment: trust?.rootFingerprint

package/package-recipe-targets.mjs

@@ -9,6 +9,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
+import { IOS_SIGNING_CONTRACT, IosPackageError, validateIosPackageConfig } from "./ios-package-recipe.mjs";
+import { IosUploadError, validateIosDistribution } from "./ios-upload.mjs";
 
 export class PackageRecipeTargetError extends Error {
   constructor(message) { super(message); this.name = "PackageRecipeTargetError"; this.code = "RK_PACKAGE_RECIPE_TARGET"; }
@@ -249,11 +251,49 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   };
 }
 
+const IOS_TARGET_KEYS = new Set(["signed", "signingContract", "iosPackage", "artifacts", "hardening", "hardeningAllowances", "qaControlScan", "publishBlocked", "distribution", "ownershipScope", "cargoManifest", "cargoTarget", "recipe"]);
+
+/**
+ * `targets.ios.iosPackage` (bogusyogi/rightkit#349) is validated strictly and kept as `recipe: { kind: "iosPackage", spec }`.
+ * Unlike macPackage there is no hook to expand into: xcodebuild archive and export run in ios-package-recipe.mjs (macOS only),
+ * which release.mjs calls like the Android lane. The target may carry only the keys in IOS_TARGET_KEYS: a hand-written
+ * prePackage / package / sign / notarize / gradle script, or an App Store Connect credential, is refused.
+ * `artifacts` must list the .ipa so the IPA is checked and sealed. `distribution` (the App Store Connect target of an app that
+ * also ships desktop) is validated here exactly as the upload validates it, so a credential in it fails the build.
+ */
+export function expandIosPackageTarget(target, { appRoot: _appRoot } = {}) {
+  if (!isObject(target) || target.iosPackage === undefined) return withoutRecipe(target);
+  const unknown = Object.keys(target).filter((key) => !IOS_TARGET_KEYS.has(key));
+  if (unknown.length) fail(`targets.ios has unknown key(s): ${unknown.join(", ")} (allowed: ${[...IOS_TARGET_KEYS].filter((key) => key !== "recipe").join(", ")}); the iOS recipe replaces prePackage, package, sign and notarize scripts, and App Store Connect credentials never belong in a target`);
+  if (target.distribution !== undefined) {
+    try { validateIosDistribution(target.distribution); } catch (error) {
+      if (error instanceof IosUploadError) fail(`targets.ios.${error.message.replace(/^\[[A-Z0-9_]+\] /, "")}`);
+      throw error;
+    }
+  }
+  if (target.ownershipScope !== undefined && (!Array.isArray(target.ownershipScope) || target.ownershipScope.some((entry) => typeof entry !== "string" || !entry.trim()))) fail("targets.ios.ownershipScope must be an array of repository-relative directory strings");
+  // The Rust the app links (for the feature-closure scan): an app-relative Cargo.toml and its iPhone triple.
+  if (target.cargoManifest !== undefined && (typeof target.cargoManifest !== "string" || !target.cargoManifest.endsWith("Cargo.toml"))) fail("targets.ios.cargoManifest must be an app-relative path to a Cargo.toml");
+  if (target.cargoTarget !== undefined && !/^aarch64-apple-ios(-sim)?$/.test(target.cargoTarget)) fail("targets.ios.cargoTarget must be aarch64-apple-ios or aarch64-apple-ios-sim");
+  if (target.signed !== true) fail("targets.ios must declare signed: true");
+  if (target.signingContract !== undefined && target.signingContract !== IOS_SIGNING_CONTRACT) fail(`targets.ios.iosPackage signs with Xcode automatic signing; signingContract must be ${IOS_SIGNING_CONTRACT}, got ${target.signingContract}`);
+  let spec;
+  try { spec = validateIosPackageConfig(target.iosPackage); } catch (error) {
+    if (error instanceof IosPackageError) fail(`targets.ios.${error.message}`);
+    throw error;
+  }
+  const declared = (target.artifacts ?? []).map((artifact) => String(typeof artifact === "string" ? artifact : artifact?.file).replaceAll("\\", "/").replace(/^\.\//, ""));
+  if (!declared.includes(spec.ipa)) fail("targets.ios.artifacts must list iosPackage.ipa so the IPA is checked and sealed");
+  const { iosPackage, recipe: _ignored, ...rest } = target;
+  return { ...rest, signingContract: IOS_SIGNING_CONTRACT, recipe: { kind: "iosPackage", spec } };
+}
+
 /** Expand whichever declarative package key the target carries. */
 export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot }) {
   const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}) };
   if (platform === "win") return expandWinPackageTarget(target, { appRoot, config, ...injected });
   if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config, ...injected });
-  if (target?.winPackage || target?.macPackage) fail(`winPackage / macPackage are not valid on ${platform}`);
+  if (platform === "ios") return expandIosPackageTarget(target, { appRoot });
+  if (target?.winPackage || target?.macPackage || target?.iosPackage) fail(`winPackage / macPackage / iosPackage are not valid on ${platform}`);
   return target;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/preflight.mjs

@@ -192,15 +192,22 @@ export function collectPreflight({
   isBrokerManagedHost = brokerManagedHost,
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
+  ownershipScope = null,
   runtimeBudgetAdoption = appRuntimeBudgetAdoptionCheck,
   freeDisk = freeDiskGb,
   projectType,
+  // false for a native iOS app with no Cargo host: no target bridge, Rust compiler cache or Rust budget adoption applies.
+  rust = true,
+  // false skips only the target bridge and the sccache check (a native iOS app that pins a Cargo.lock has no broker target).
+  bridge = true,
   msix = false,
   findSdkTool = findWindowsSdkTool,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
   const swift = isSwiftProject(projectType);
+  const noRust = swift || !rust;
+  const noBridge = noRust || !bridge;
 
   if (swift) {
     const swiftVersion = versionProbe("swift");
@@ -211,7 +218,7 @@ export function collectPreflight({
     );
   }
 
-  if (appRoot && !swift) {
+  if (appRoot && !noBridge) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -273,7 +280,7 @@ export function collectPreflight({
     else if (msix) checks.push(fail("signtool", "msix target configured but no signtool.exe found under any installed Windows SDK", signtoolMissing));
     else checks.push(warn("signtool", "no signtool.exe found under any installed Windows SDK", signtoolMissing));
 
-    const vendorsOpenssl = !swift && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
+    const vendorsOpenssl = !noRust && cargoLockPaths.some((lockPath) => graphVendorsOpenssl(lockPath));
     if (vendorsOpenssl) {
       const perl = resolveWindowsPerl({ env });
       checks.push(
@@ -288,8 +295,8 @@ export function collectPreflight({
     }
   }
 
-  if (swift) {
-    // No Rust compiler cache applies to SwiftPM targets.
+  if (noBridge) {
+    // No Rust compiler cache applies to SwiftPM targets or to a native iOS app without a Cargo host.
   } else if (isBrokerManagedHost(env)) {
     checks.push(ok("compiler-cache", "broker-managed; compiler-cache selection and status are recorded in build receipts"));
   } else {
@@ -321,7 +328,7 @@ export function collectPreflight({
   }
 
   // Held-resource crates are proven at adoption: an app that links one needs its own installed measurement.
-  if (appRoot && !swift) {
+  if (appRoot && !noRust) {
     const adoption = runtimeBudgetAdoption({ appRoot, app, version, cargoLockPaths });
     if (adoption) checks.push(adoption);
   }
@@ -329,7 +336,7 @@ export function collectPreflight({
   if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
     const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
-    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, evidenceFactory: ownershipEvidenceFactory }));
+    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory }));
   }
 
   return checks;
@@ -338,7 +345,7 @@ export function collectPreflight({
 /** Release-blocking: the app keeps no unexcepted copy of a RightKit-owned capability. */
 export function ownershipCheck(repoRoot, options = {}) {
   let checked;
-  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot); }
+  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot, options.scope ?? null); }
   catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
   const { result, evidence, floor } = checked;
   if (checked.ok) {

package/project-type.mjs

@@ -29,7 +29,9 @@ export function resolveProjectType({ appRoot, config = {}, target = {}, exists =
 export const isSwiftProject = (projectType) => projectType === "swiftpm";
 
 /** Executables the build itself needs (the config's own preflight.executables are appended by callers). */
-export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true } = {}) {
+export function requiredBuildExecutables({ projectType, packageManager = "pnpm", usesPackageManager = true, usesCargo = true } = {}) {
+  // A native iOS app with no Cargo host: git, plus the package manager only when the app has a package.json (xcodebuild/xcodegen are the recipe's own preflight).
+  if (!usesCargo && !isSwiftProject(projectType)) return ["git", ...(usesPackageManager && packageManager ? [packageManager] : [])];
   if (isSwiftProject(projectType)) return ["git", "swift", ...(usesPackageManager && packageManager ? [packageManager] : [])];
   return ["git", packageManager, "cargo", "rustc"];
 }