@rightkit/release 0.3.0 → 0.4.0

package/protected-credentials.mjs

@@ -7,7 +7,8 @@ import { isManagedHost, refuseManagedEnvSecrets } from "./managed-host-secrets.m
 // Protected credential loaders for release sites that previously read only
 // ambient environment variables. The storage pattern matches release-token.mjs:
 // macOS Keychain generic passwords (account $USER) and, on Windows, a protected
-// token file under %APPDATA%\RightKit. Values are returned to the caller only;
+// token file under %APPDATA%\RightKit for legacy non-updater sites. Updater
+// signing uses M11's native OS-store child-exec boundary. Other values return to the caller only;
 // they are never logged, and diagnostics name the secret, never its value.
 export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 
@@ -16,6 +17,7 @@ export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 export const PROTECTED_SECRETS = Object.freeze({
   "cloudflare-api-token": { label: "Cloudflare API token", keychain: "rightkit-cloudflare-api-token", file: "cloudflare-api-token.token" },
   "qa-receipt-key": { label: "RightKit QA receipt key", keychain: null, file: "qa-receipt-key.token", darwinFile: true },
+  "updater-signing-key": { label: "RightKit updater signing key", keychain: "rightsuite-updater-key", providerExec: true },
 });
 
 export class ProtectedSecretMissingError extends Error {
@@ -39,6 +41,7 @@ export function protectedSecretStoreCommand(name, platform = process.platform) {
   if (platform === "darwin" && spec.darwinFile) return null;
   if (platform === "darwin") return `security add-generic-password -a "$USER" -s ${spec.keychain} -U -w`;
   if (platform === "win32") {
+    if (spec.providerExec) return `$rightkitSecure = Read-Host -AsSecureString '${spec.label}'; $rightkitPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($rightkitSecure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rightkitPointer) | & rightkit-credentials.exe set --namespace '${spec.keychain}' --account ([Environment]::UserName) --replace } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rightkitPointer) }`;
     return `powershell -NoProfile -Command "$s = Read-Host -AsSecureString '${spec.label}'; $d = Join-Path $env:APPDATA 'RightKit'; New-Item -ItemType Directory -Force -Path $d | Out-Null; [IO.File]::WriteAllText((Join-Path $d '${spec.file}'), [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($s)))"`;
   }
   return null;
@@ -78,6 +81,9 @@ export function createCredentialStore({
     read(name) {
       if (!PROTECTED_SECRETS[name]) throw new Error(`unknown protected secret: ${name}`);
       const spec = PROTECTED_SECRETS[name];
+      // Signing keys stay inside the native provider's child-exec boundary.
+      // No JavaScript/file/environment fallback can export this credential.
+      if (spec.providerExec) throw new ProtectedSecretMissingError(name, protectedSecretStoreCommand(name, platform));
       let value;
       if (platform === "darwin") {
         // Receipt MAC keys are provisioned by right-release itself as a 0600 file, never from the Keychain.
@@ -98,6 +104,7 @@ export function createCredentialStore({
 // when the store has no value. A missing store entry on a managed host never
 // permits the environment fallback.
 export function resolveEnvBackedSecret({ name, envName, env = process.env, credentialStore, required = true }) {
+  if (PROTECTED_SECRETS[name]?.providerExec) throw new Error("updater signing requires the OS credential provider execution boundary");
   refuseManagedEnvSecrets(env, [envName]);
   if (!required) return undefined;
   const store = credentialStore ?? createCredentialStore({ env });
@@ -111,6 +118,26 @@ export function resolveEnvBackedSecret({ name, envName, env = process.env, crede
   }
 }
 
+// M11 owns OS acquisition & secret lifetime. The release adapter supplies only
+// non-secret identity plus an absolute native child executable and literal argv.
+export function execWithUpdaterCredential(command, args, {
+  env = process.env, cwd = process.cwd(), run = spawnSync,
+  provider = process.platform === "win32" ? "rightkit-credentials.exe" : "rightkit-credentials",
+  account = os.userInfo().username,
+} = {}) {
+  for (const key of Object.keys(env)) {
+    if (["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"].includes(key.toUpperCase()) && env[key]) {
+      throw new Error("updater signing key/password must come from the OS credential provider");
+    }
+  }
+  if (!path.isAbsolute(command)) throw new Error("credential provider child must be an absolute native executable");
+  const result = run(provider, ["exec", "--namespace", PROTECTED_SECRETS["updater-signing-key"].keychain,
+    "--account", account, "--env", "TAURI_SIGNING_PRIVATE_KEY", "--", command, ...args],
+  { cwd, env: { ...env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" }, stdio: "inherit", shell: false, windowsHide: true });
+  if (result.error?.code === "ENOENT") throw new Error("OS credential provider unavailable: install rightkit-credentials >=0.2.2 on PATH before updater signing");
+  return result;
+}
+
 export function resolveCloudflareApiToken({ env = process.env, credentialStore, required = true } = {}) {
   return resolveEnvBackedSecret({ name: "cloudflare-api-token", envName: "CLOUDFLARE_API_TOKEN", env, credentialStore, required });
 }

package/publication-artifacts.mjs

@@ -41,7 +41,9 @@ export function assertArtifactUnchanged(artifact) {
   return artifact.bytes;
 }
 
-export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId }, deps = {}) {
+// `streamRoles`: sealed entries of these roles are hash-verified by a streamed read and returned WITHOUT their bytes (the caller reads
+// byte ranges of `file`), so a large IPA is never held in memory.
+export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId, streamRoles = [], ownershipScope = null }, deps = {}) {
   let sealed;
   try { sealed = verifySealedRelease(sealedDir); }
   catch (error) {
@@ -52,7 +54,7 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!/^[a-f0-9]{40}$/.test(commit ?? "") || manifest.commit !== commit
     || (app && manifest.app !== app) || (version && manifest.version !== version)
     || manifest.platform !== platform || (releaseId && manifest.releaseId !== releaseId)) throw new PublicationError("PUBLICATION_SOURCE_MISMATCH", "sealed release source or product identity mismatch");
-  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot);
+  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot, ownershipScope);
   if (!ownership.ok || manifest.ownershipEvidence?.commit !== commit) throw new PublicationError("PUBLICATION_OWNERSHIP_INVALID", `sealed ownership evidence rejected: ${ownership.reason ?? "commit mismatch"}`);
   if (!manifest.checkpoints?.includes("signed") || !manifest.checkpoints?.includes("hardened")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "signed & hardened seal checkpoints are required");
   if (configPath && digestBytes(readFileSync(configPath)) !== manifest.signing?.configSha256) throw new PublicationError("PUBLICATION_POLICY_MISMATCH", "release config differs from sealed signing policy");
@@ -65,14 +67,16 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   let notarized = false;
   let signed = false;
   let androidVerified = false;
+  let iosVerified = false;
   for (const receipt of receipts) {
     const artifact = readVerifiedArtifact(path.resolve(appRoot, receipt.file), receipt);
     let value;
     try { value = JSON.parse(artifact.bytes); } catch { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "invalid sealed signing receipt"); }
     if (value.schema !== 1) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "malformed sealed signing receipt");
     if (value.contract !== undefined) {
-      verifyAndroidPublicationReceipt(value, manifest, platform);
-      androidVerified = true; signed = true;
+      if (value.contract === IOS_RECEIPT_CONTRACT) { verifyIosPublicationReceipt(value, manifest, platform); iosVerified = true; }
+      else { verifyAndroidPublicationReceipt(value, manifest, platform); androidVerified = true; }
+      signed = true;
       continue;
     }
     if (Array.isArray(value.files)) {
@@ -93,10 +97,11 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!signed) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed native signing evidence is required");
   if (platform === "mac" && !notarized) throw new PublicationError("PUBLICATION_NOTARIZATION_MISSING", "sealed notarization evidence is required");
   if (platform === "android" && !androidVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed android AAB upload-key receipt is required");
+  if (platform === "ios" && !iosVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed iOS IPA build receipt is required");
   const artifacts = new Map();
   for (const entry of manifest.files ?? []) {
     if (typeof entry.name !== "string" || path.basename(entry.name) !== entry.name || artifacts.has(entry.name)) throw new PublicationError("PUBLICATION_SEAL_INVALID", "unsafe or duplicate sealed artifact name");
-    artifacts.set(entry.name, readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
+    artifacts.set(entry.name, streamRoles.includes(entry.role) ? verifyArtifactFile(path.join(sealedDir, entry.name), entry) : readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
   }
   if (!artifacts.size) throw new PublicationError("PUBLICATION_SEAL_INVALID", "sealed release has no artifacts");
   return { ...sealed, artifacts };
@@ -124,6 +129,26 @@ function verifyAndroidPublicationReceipt(value, manifest, platform) {
   if (value.file.name !== aab.name) invalid("android AAB receipt names a different file than the sealed aab entry");
 }
 
+// iOS IPA receipt (ios-package-recipe.mjs: contract "ios-xcodebuild-archive-automatic-v1"). The receipt was already read from the
+// manifest's signing.receipts and hash-verified by the caller; here it must describe exactly the sealed "ipa" file, for the team
+// and bundle id pinned in the sealed signing policy. Fails closed with a specific message on any mismatch.
+const IOS_RECEIPT_CONTRACT = "ios-xcodebuild-archive-automatic-v1";
+function verifyIosPublicationReceipt(value, manifest, platform) {
+  const invalid = (message) => { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", message); };
+  if (platform !== "ios" || manifest.platform !== "ios") invalid("iOS IPA receipt in a non-iOS release");
+  const pinnedTeam = manifest.signing?.teamId;
+  if (!/^[A-Z0-9]{10}$/.test(pinnedTeam ?? "")) invalid("sealed signing policy has no pinned iOS team id");
+  if (value.teamId !== pinnedTeam) invalid("iOS IPA receipt team id is not the pinned team");
+  if (!manifest.signing?.bundleId || value.bundleId !== manifest.signing.bundleId) invalid("iOS IPA receipt bundle id is not the pinned bundle id");
+  if (!value.marketingVersion || !value.buildNumber) invalid("iOS IPA receipt has no version identity");
+  const ipas = (manifest.files ?? []).filter((entry) => entry.role === "ipa");
+  if (ipas.length !== 1) invalid(ipas.length ? "sealed release has more than one ipa entry" : "sealed release has no ipa entry");
+  const [ipa] = ipas;
+  if (!/^[a-f0-9]{64}$/.test(value.file?.sha256 ?? "") || value.file.sha256 !== ipa.sha256) invalid("iOS IPA receipt sha256 differs from the sealed ipa entry");
+  if (!Number.isInteger(value.file.sizeBytes) || value.file.sizeBytes !== ipa.sizeBytes) invalid("iOS IPA receipt size differs from the sealed ipa entry");
+  if (value.file.name !== ipa.name) invalid("iOS IPA receipt names a different file than the sealed ipa entry");
+}
+
 // Bounded memory for large artifacts. Transport must read back against this digest.
 export function verifyArtifactFile(file, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "")) throw new PublicationError("PUBLICATION_SEAL_INVALID", "publication hash evidence is required");

package/publication-gate.mjs

@@ -13,6 +13,7 @@ import { fileURLToPath } from "node:url";
 import { digestBytes, readVerifiedArtifact } from "./publication-artifacts.mjs";
 
 export const GATE_SCHEMA = 1;
+export const MAX_CARGO_JOBS = 64;
 export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
 // Swift packages (RightKitSwift) are Apple-only; Windows cannot run them.
 export const requiredHosts = (kind) => (kind === "swift" ? Object.freeze(["darwin"]) : REQUIRED_HOSTS);
@@ -20,6 +21,11 @@ const SHA = /^[0-9a-f]{40}$/;
 // The one definition of a recorded darwin-only host policy (release evidence and the runtime budget gate share it).
 export const isDarwinOnlyPolicy = (source) => source?.hostPolicy === "darwin-only"
   && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
+// The symmetric recorded win32-only host policy: a crate published from the Windows host under the local-build grant.
+export const isWin32OnlyPolicy = (source) => source?.hostPolicy === "win32-only"
+  && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
+/** The one host a recorded single-host policy names ("darwin" or "win32"), or null when none is recorded. */
+export const singleHostOfPolicy = (source) => (isDarwinOnlyPolicy(source) ? "darwin" : isWin32OnlyPolicy(source) ? "win32" : null);
 
 export function defaultEvidencePath(workspaceRoot, kind, name) {
   return path.join(workspaceRoot, "release-evidence", "gate", `${kind}-${name.replace(/^@/, "").replace("/", "-")}.json`);
@@ -91,13 +97,15 @@ export function batchReceiptProblems(batch, evidence, tree) {
  * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
  * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
  * `cargo clippy -p <name> ... -D warnings` step, or a valid batch receipt covering the crate), and `fmt` and
- * `secretScan` (a valid batch receipt covering the crate). Every darwin run at the evidence commit must prove a
+ * `secretScan` (a valid batch receipt covering the crate). Every run on the proving host (darwin, or win32 under a win32-only policy) at the evidence commit must prove a
  * step for it to count. Call after the gate accepted the evidence (the gate binds commit, tree and artifact).
  */
 export function provenGateSteps(evidence) {
   const none = { tests: false, clippy: false, fmt: false, secretScan: false };
   if (!evidence || !SHA.test(String(evidence.commit ?? "")) || !text(evidence.name)) return none;
-  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === "darwin");
+  // The proving host is the one a recorded win32-only policy names; every other evidence is proved on darwin.
+  const proofHost = isWin32OnlyPolicy(evidence) ? "win32" : "darwin";
+  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === proofHost);
   if (!runs.length || runs.some((run) => run.commit !== evidence.commit)) return none;
   const name = escapeRegExp(evidence.name);
   const stepProves = (run, pattern, needTests) => (Array.isArray(run.steps) ? run.steps : []).some((step) => step?.ok === true
@@ -124,6 +132,7 @@ function invalidRunFields(run, evidence, tree) {
   if (!text(run.timestamp)) bad.push("timestamp");
   if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
   if (run.failed !== 0) bad.push("failed (must be 0)");
+  if (run.jobs !== undefined && !(Number.isInteger(run.jobs) && run.jobs >= 1 && run.jobs <= MAX_CARGO_JOBS)) bad.push(`jobs (must be an integer from 1 to ${MAX_CARGO_JOBS})`);
   if (run.batch !== undefined) bad.push(...batchReceiptProblems(run.batch, evidence, tree ?? null).map((problem) => `batch: ${problem}`));
   return bad;
 }
@@ -158,8 +167,10 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
     // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
     // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
     // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    const darwinOnly = (kind === "npm" || kind === "cargo") && isDarwinOnlyPolicy(evidence);
-    for (const host of darwinOnly ? ["darwin"] : requiredHosts(kind)) {
+    // A crate published from the Windows host under the local-build grant records the symmetric
+    // hostPolicy "win32-only" + reason, and then the one required receipt is the Windows run.
+    const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
+    for (const host of singleHost ? [singleHost] : requiredHosts(kind)) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }

package/publish-cargo.mjs

@@ -2,8 +2,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath, provenGateSteps } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
+import { spawnSync } from "./background-process.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
 import { recordPublished } from "./rightkit-sync.mjs";
@@ -23,7 +24,7 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const crate = valueAfter(argv, "--crate");
   if (!crate) throw new Error("publish cargo requires --crate <name>");
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(crate)) throw new Error(`invalid crate name: ${crate}`);
-  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence"]);
+  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence", "--from-evidence"]);
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!arg.startsWith("--")) continue;
@@ -33,12 +34,45 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const dryRun = argv.includes("--dry-run");
   const allowDirty = argv.includes("--allow-dirty");
   if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  const fromEvidence = valueAfter(argv, "--from-evidence");
+  if (argv.includes("--from-evidence") && (!fromEvidence || fromEvidence.startsWith("--"))) throw new Error("--from-evidence requires a gate evidence file");
+  if (fromEvidence && (dryRun || allowDirty || argv.includes("--evidence"))) throw new Error("--from-evidence cannot be combined with --dry-run, --allow-dirty or --evidence");
   return {
     crate,
     dryRun,
     allowDirty,
     workspaceRoot: path.resolve(valueAfter(argv, "--workspace") ?? cwd),
-    evidence: valueAfter(argv, "--evidence"),
+    evidence: fromEvidence ?? valueAfter(argv, "--evidence"),
+    ...(fromEvidence ? { fromEvidence: true } : {}),
+  };
+}
+
+const OFFLINE_CACHE_MISS = /(?:attempting to make an HTTP request, but --offline was specified|as a reminder, you're using offline mode(?: \(--offline\))?)/i;
+const OFFLINE_READ_ONLY_COMMANDS = new Set(["metadata", "package"]);
+
+/** Retry only a Cargo offline cache miss for metadata/package inspection, once with normal network access. */
+export async function runCargoReadOnly(args, settings, execute, onOfflineFailure = () => {}) {
+  const subcommand = args[0];
+  if (!OFFLINE_READ_ONLY_COMMANDS.has(subcommand) || !args.includes("--offline")) {
+    return execute("cargo", args, settings);
+  }
+  const first = await execute("cargo", args, settings);
+  if (!first.error && first.status === 0) return first;
+  const diagnostic = `${first.stdout ?? ""}\n${first.stderr ?? ""}`;
+  if (!OFFLINE_CACHE_MISS.test(diagnostic)) return first;
+  onOfflineFailure(first);
+  const retryArgs = args.filter((arg) => arg !== "--offline");
+  const retry = await execute("cargo", retryArgs, settings);
+  if (!retry.error && retry.status === 0) return { ...retry, usedOfflineFallback: true };
+  const labeled = (result) => String(result ?? "");
+  const stdout = `[offline attempt]\n${labeled(first.stdout)}\n[online retry]\n${labeled(retry.stdout)}`;
+  const stderr = `[offline attempt]\n${labeled(first.stderr)}\n[online retry]\n${labeled(retry.stderr)}`;
+  return {
+    ...retry,
+    stdout,
+    stderr,
+    ...(retry.error ? { error: new Error(`${retry.error.message}\n${stdout}\n${stderr}`) } : {}),
+    offlineFallbackFailed: true,
   };
 }
 
@@ -61,11 +95,13 @@ const PROVEN_STEP = Object.freeze({ "secret scan": "secretScan", format: "fmt",
  * already proves for this exact commit; the runtime budget, package contents, archive hash and registry steps
  * are never skippable. `verifyOnPublish` (real publish only) drops the separate registry dry-run and lets the
  * real `cargo publish` run Cargo's own verify build (no `--no-verify`), so the package compiles once, before
- * the upload, instead of in a dry-run and not at all in the publish.
+ * the upload, instead of in a dry-run and not at all in the publish. `packageVerified` is set only after
+ * explicit evidence reuse proves a successful standalone package verification; hash checking stays mandatory.
  */
-export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false }) {
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false, packageVerified = false, offlineReadOnly = false }) {
+  const offline = offlineReadOnly ? ["--offline"] : [];
   const dryRunArgs = ["publish", "--dry-run", "-p", crate];
-  const packageArgs = ["package", "--list", "-p", crate];
+  const packageArgs = ["package", "--list", ...offline, "-p", crate];
   if (allowDirty) dryRunArgs.push("--allow-dirty");
   if (allowDirty) packageArgs.push("--allow-dirty");
   const verifyHere = verifyOnPublish && !dryRun;
@@ -78,15 +114,18 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
-    ...(verifyHere ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
+    ...((verifyHere || packageVerified) ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
   ].filter((step) => !(PROVEN_STEP[step.label] && proven[PROVEN_STEP[step.label]] === true));
   if (!dryRun) plan.push(
     // `publish --dry-run` leaves its archive under target/package/tmp-crate on current Cargo; package
-    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads.
-    { label: "package archive", command: "cargo", args: ["package", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
-    { label: "package location", command: "cargo", args: ["metadata", "--format-version", "1", "--no-deps"], capture: true },
+    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads. Always
+    // online and --locked, like qualification: offline packaging resolves the archive's Cargo.lock from
+    // only the .crate files already downloaded, so a sibling published since then silently resolves to an
+    // older version and the archive no longer matches its evidence hash.
+    { label: "package archive", command: "cargo", args: ["package", "--locked", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
+    { label: "package location", command: "cargo", args: ["metadata", ...offline, "--format-version", "1", "--no-deps"], capture: true },
     { label: "archive hash check", internal: "verify-archive" },
-    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", "--no-verify", "-p", crate] },
+    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", ...(packageVerified ? ["--locked"] : []), "--no-verify", "-p", crate] },
     { label: "registry readback", internal: "registry-readback" },
   );
   return plan;
@@ -130,11 +169,42 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   };
   const gate = (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { dryRun: options.dryRun });
   const expectedSha256 = gate.evidence?.artifactSha256;
-  // Only the local publisher (local-publish.mjs) sets `trustEvidenceSteps`: it ran the tests and clippy for this
-  // exact commit itself and wrote them into the evidence the gate above just validated. A plain publish proves
-  // nothing in advance, so `proven` stays empty and every step runs.
-  const proven = options.trustEvidenceSteps === true && !options.dryRun ? provenGateSteps(gate.evidence) : {};
-  const plan = buildCargoPublishPlan({ ...options, crateDir, proven, verifyOnPublish: options.verifyOnPublish === true });
+  // Explicit evidence reuse enters through the same gate: current commit, version, clean source, host runs
+  // and artifact digest must match. Windows evidence keeps its actual win32 host policy on the Mac.
+  const reuseEvidence = options.fromEvidence === true;
+  if (reuseEvidence && (options.dryRun || options.allowDirty || !options.evidence)) throw new Error("--from-evidence requires a real publish, clean source and explicit evidence");
+  const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
+  if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
+  if (reuseEvidence) {
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml and Cargo.lock");
+    const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
+    const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
+    const command = `cargo package --locked -p ${options.crate}`;
+    if (!runs.length || !runs.every((run) => run.steps?.some((step) => step.ok === true && step.command === command))) {
+      throw new Error("--from-evidence requires a verified cargo package --locked receipt for this artifact");
+    }
+    // Load the shared planner after module initialization: local-publish itself imports this publisher.
+    // Validate the complete current qualification matrix, not merely one passing test and lint command.
+    const { localTestPlan } = await import("./local-publish.mjs");
+    let config;
+    try { config = JSON.parse(fs.readFileSync(path.join(options.workspaceRoot, "ci", "gate.config.json"), "utf8")); }
+    catch { throw new Error("--from-evidence cannot read current ci/gate.config.json"); }
+    for (const run of runs) {
+      if (!Array.isArray(run.steps) || run.steps.some((step) => step?.ok !== true || (step.failed ?? 0) !== 0)) {
+        throw new Error("--from-evidence refuses an unsuccessful qualification step");
+      }
+      const expected = localTestPlan({ kind: "cargo", unit: options.crate, dir: `crates/${options.crate}`, config, batch: Boolean(run.batch), platform: proofHost });
+      for (const step of expected.steps) {
+        const text = `${step.command} ${step.args.join(" ")}`;
+        if (!run.steps.some((row) => row.command === text && row.ok === true && (!step.test || (row.executed > 0 && row.failed === 0)))) {
+          throw new Error(`--from-evidence missing configured qualification step: ${text}`);
+        }
+      }
+    }
+  }
+  const plan = buildCargoPublishPlan({ ...options, crateDir, proven,
+    verifyOnPublish: !reuseEvidence && options.verifyOnPublish === true, packageVerified: reuseEvidence, offlineReadOnly: options.offlineReadOnly === true });
   for (const [label, key] of Object.entries(PROVEN_STEP)) {
     if (proven[key] === true) process.stdout.write(`[right-release] cargo ${label}: proven by the gate evidence for this commit, not repeated\n`);
   }
@@ -178,21 +248,38 @@ export async function runCargoPublish(options, execute = (_command, args, settin
     }
     if (step.label === "registry publish") assertArtifactUnchanged(artifact);
     // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
-    const result = await execute(step.command, step.args, {
+    const isReadOnlyInspection = ["package contents", "package location"].includes(step.label);
+    const settings = {
       cwd: options.workspaceRoot,
       encoding: "utf8",
       windowsHide: true,
-      stdio: step.capture ? "pipe" : "inherit",
-    });
-    if (result.error) throw result.error;
+      stdio: step.capture || (options.offlineReadOnly === true && isReadOnlyInspection) ? "pipe" : "inherit",
+    };
+    const result = options.offlineReadOnly === true && isReadOnlyInspection
+      ? await runCargoReadOnly(step.args, settings, execute, (failed) => {
+        process.stderr.write(`[right-release] offline Cargo inspection missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`);
+      })
+      : await execute(step.command, step.args, settings);
+    if (result.error) {
+      if (result.offlineFallbackFailed) throw new Error(`${step.label} failed: ${result.error.message}`);
+      throw result.error;
+    }
     if (result.status !== 0) {
-      if (step.capture && result.stderr) process.stderr.write(result.stderr);
-      throw new Error(`${step.label} failed with exit code ${result.status}`);
+      if (result.offlineFallbackFailed || step.label === "package archive") {
+        if (result.stdout) process.stdout.write(result.stdout);
+        if (result.stderr) process.stderr.write(result.stderr);
+      } else if (step.capture && result.stderr) process.stderr.write(result.stderr);
+      const fallback = result.offlineFallbackFailed ? `\n${result.stdout ?? ""}\n${result.stderr ?? ""}` : "";
+      throw new Error(`${step.label} failed with exit code ${result.status}${fallback}`);
     }
     if (step.label === "package location") {
+      if (result.stderr) process.stderr.write(result.stderr);
       const metadata = JSON.parse(result.stdout);
       if (typeof metadata.target_directory !== "string" || !path.isAbsolute(metadata.target_directory)) throw new Error("invalid Cargo package target directory");
       targetDir = metadata.target_directory;
+    } else if (step.label === "package archive") {
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
     } else if (step.capture) {
       if (result.stderr) process.stderr.write(result.stderr);
       const files = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);

package/publish-update.mjs

@@ -14,7 +14,7 @@ import { verifyPublicationRelease, PublicationError, assertArtifactUnchanged, di
 import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
 import { verifyPlatformTrust } from "./github-release.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
-import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease } from "./github-updater-release.mjs";
+import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, assertUpdaterSignature, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease } from "./github-updater-release.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
@@ -116,7 +116,20 @@ function git(args) {
 if (!githubLane && tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if ((githubLane || tier === "update") && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
-if (sealed) for (const artifact of artifacts) signatureFor(artifact);
+// Cryptographic gate before any upload: every sealed minisign signature must verify over the
+// exact final artifact bytes against the declared public key. No declared key means the
+// signature cannot be verified, so a sealed (real) publish fails closed; key-id pinning is
+// supplementary only. Integrator owns declaring distribution.updaterPublicKey in app configs
+// (suite key already pinned per-app as tauri plugins.updater.pubkey).
+const updaterPublicKey = config.distribution?.updaterPublicKey ?? config.distribution?.updaterPubkey ?? target?.updater?.pubkey ?? target?.updater?.publicKey;
+if (sealed) for (const artifact of artifacts) {
+  const signature = signatureFor(artifact);
+  if (!appInstallerKind) {
+    if (!updaterPublicKey) throw new PublicationError("PUBLICATION_SIGNATURE_UNVERIFIABLE", `no updater public key declared (distribution.updaterPublicKey); refusing to upload ${path.basename(artifact.file)} with an unverified signature`);
+    assertUpdaterSignature(assertArtifactUnchanged(verifiedArtifact(artifact.file)), signature, updaterPublicKey, `signature of ${path.basename(artifact.file)}`);
+    assertUpdaterKeyId(signature, config.distribution.updaterKeyId, `signature of ${path.basename(artifact.file)}`);
+  }
+}
 let releaseToken = null;
 if (!githubLane && !dryRun && (tier === "update" || artifacts.length > 0)) {
   try {

package/qa-build-features.mjs

@@ -12,17 +12,10 @@ import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 
-export const FORBIDDEN_FEATURES = Object.freeze(["devtools", "content-devtools", "qa-native", "qa-control", "dev-native", "dev-inspect",
-  // Per-app test-automation features (M20 owner gap): HeardRight `qa-shot`/`qa-tools`, ViewRight `dev-control`/`bench-native`.
-  "qa-shot", "qa-tools", "dev-control", "bench-native",
-  // D4 (M21/M23): rightkit-daemon `test-mode` compiles the override selectors; never in a release build.
-  "test-mode"]);
-// rightkit-qa 0.6.0 moved the embedded control server (the former rightkit-qa-driver `qa-control`) behind its `control`
-// feature. It emits the same QA_CONTROL_MARKER, so the binary layer refuses it unchanged; this is the source layer.
-export const QUALIFIED_FORBIDDEN_FEATURES = Object.freeze(["rightkit-qa/control", "rightkit-qa?/control"]);
-// The only forbidden features an allow-listed app may enable: rightkit-tauri-shell's `content-devtools` (and the Tauri
-// `devtools` it switches on). See devtools-policy.mjs; every other app is refused them.
-const DEVTOOLS_FEATURES = Object.freeze(["devtools", "content-devtools"]);
+const featureRegistry = JSON.parse(readFileSync(new URL("./release-switch-registry.json", import.meta.url), "utf8"));
+const DEVTOOLS_FEATURES = Object.freeze(featureRegistry.conditionalForbiddenFeatures["content-only"]);
+export const FORBIDDEN_FEATURES = Object.freeze([...featureRegistry.forbiddenFeatures.filter((name) => !name.includes("/")), ...DEVTOOLS_FEATURES]);
+export const QUALIFIED_FORBIDDEN_FEATURES = Object.freeze(featureRegistry.forbiddenFeatures.filter((name) => name.includes("/")));
 const FORBIDDEN_DEPENDENCY = "tauri-plugin-wdio-webdriver";
 const MANAGERS = new Set(["pnpm", "npm", "yarn", "bun", "npx"]);
 
@@ -36,7 +29,7 @@ export function isForbiddenFeature(item, { allowDevtools = false } = {}) {
   const name = featureName(text);
   if (allowDevtools && DEVTOOLS_FEATURES.includes(name)) return false;
   // `control` is too generic to forbid by bare name; rightkit-qa's dev-only server feature is refused when qualified.
-  if (QUALIFIED_FORBIDDEN_FEATURES.includes(text.replace(/\s+/g, ""))) return true;
+  if (QUALIFIED_FORBIDDEN_FEATURES.includes(text.replace(/\s+/g, "").replace("?/", "/"))) return true;
   return text === `dep:${FORBIDDEN_DEPENDENCY}` || FORBIDDEN_FEATURES.includes(name);
 }
 
@@ -154,6 +147,7 @@ export function parseCargoFeaturesAndDependencies(manifestText) {
 function dependencyInfo(spec) {
   const list = spec.match(/features\s*=\s*(\[)/);
   return {
+    package: spec.match(/package\s*=\s*["']([^"']+)["']/)?.[1],
     optional: /optional\s*=\s*true/.test(spec),
     features: list ? strings(balanced(spec, list.index + list[0].length - 1, "[", "]")) : [],
   };
@@ -162,6 +156,15 @@ function dependencyInfo(spec) {
 export function cargoManifestIssues(manifestText, label = "Cargo.toml", { allowDevtools = false } = {}) {
   const { features, dependencies } = parseCargoFeaturesAndDependencies(manifestText);
   const issues = [];
+  const canonicalFeature = (item) => {
+    const match = /^([^/]+?)(\?)?\/(.+)$/.exec(item);
+    return match ? `${dependencies.get(match[1])?.package ?? match[1]}/${match[3]}` : item;
+  };
+  for (const [alias, dep] of dependencies) {
+    if (dep.package && dep.package !== alias && !dep.optional) for (const feature of dep.features) {
+      if (isForbiddenFeature(`${dep.package ?? alias}/${feature}`, { allowDevtools })) issues.push(`${label}: dependency \`${alias}\` enables forbidden feature \`${dep.package ?? alias}/${feature}\``);
+    }
+  }
   const tauri = dependencies.get("tauri");
   if (!allowDevtools && tauri?.features.includes("devtools")) issues.push(`${label}: dependency \`tauri\` lists feature \`devtools\` unconditionally (inspector ships in release builds)`);
   // The crate was renamed from rightkit-control; apps still on the old published name must stay covered.
@@ -185,7 +188,7 @@ export function cargoManifestIssues(manifestText, label = "Cargo.toml", { allowD
     const item = stack.pop();
     if (reached.has(item)) continue;
     reached.add(item);
-    if (isForbiddenFeature(item, { allowDevtools })) issues.push(`${label}: default feature set reaches \`${item}\``);
+    if (isForbiddenFeature(canonicalFeature(item), { allowDevtools })) issues.push(`${label}: default feature set reaches \`${item}\``);
     if (features.has(item)) stack.push(...features.get(item));
   }
   return issues;

package/qa-contract.mjs

@@ -106,6 +106,33 @@ export function qaManifests(appRoot, { readdir = readdirSync } = {}) {
   return found.sort();
 }
 
+/**
+ * Native Apple UI-test targets under `appRoot`: an XcodeGen `project.yml` target of `type: bundle.ui-testing`,
+ * or an `.xcodeproj` whose `project.pbxproj` declares `com.apple.product-type.bundle.ui-testing`. An XCUITest
+ * target is the QA lane of a native iOS or macOS app, which has no package.json or Cargo.toml to pin RightKit QA in.
+ */
+export function nativeAppleUiTestLanes(appRoot, { readdir = readdirSync, readFile = readFileSync } = {}) {
+  const lanes = [];
+  const read = (file) => { try { return readFile(file, "utf8"); } catch { return ""; } };
+  const visit = (dir, depth) => {
+    let entries;
+    try { entries = readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      const relative = path.relative(appRoot, full).split(path.sep).join("/");
+      if (entry.isDirectory()) {
+        if (entry.name.endsWith(".xcodeproj")) {
+          if (read(path.join(full, "project.pbxproj")).includes("com.apple.product-type.bundle.ui-testing")) lanes.push(`native XCUITest lane (${relative})`);
+        } else if (depth < MAX_DEPTH && !SKIP_DIRS.test(entry.name) && relative !== "rightkit" && relative !== "tools/rightkit") visit(full, depth + 1);
+      } else if (entry.name === "project.yml" && /^\s*type:\s*bundle\.ui-testing\s*$/m.test(read(full))) {
+        lanes.push(`native XCUITest lane (${relative})`);
+      }
+    }
+  };
+  visit(appRoot, 0);
+  return [...new Set(lanes)].sort();
+}
+
 /** `[dependencies]`-style section header that holds dependencies (including target-specific ones). */
 const DEPENDENCY_HEADER = /^\[\s*(?:target\.[^\]]+\.)?(?:dev-|build-)?dependencies\s*\]/;
 const DEPENDENCY_TABLE_HEADER = /^\[\s*(?:target\.[^\]]+\.)?(?:dev-|build-)?dependencies\.([A-Za-z0-9_-]+)\s*\]/;
@@ -215,11 +242,12 @@ export function evaluateQaAdoption({ appRoot, repoRoot, app }, deps = {}) {
   }
   const label = app ?? "this app";
   const adopted = [...new Set(pins.filter((pin) => pin.name === NPM_QA || pin.name === CARGO_QA).map((pin) => pin.name))];
-  const lane = exists(path.join(appRoot, "right-qa.config.mjs")) ? ["native wdio lane (right-qa.config.mjs)", ...adopted] : adopted;
+  const nativeApple = deps.nativeAppleLanes ?? nativeAppleUiTestLanes(appRoot, deps);
+  const lane = [...(exists(path.join(appRoot, "right-qa.config.mjs")) ? ["native wdio lane (right-qa.config.mjs)"] : []), ...nativeApple, ...adopted];
   const refusals = [];
   const warnings = [];
   if (lane.length === 0) {
-    refusals.push(`RightKit QA is mandatory for every Orthic Labs app, and ${label} has no QA lane: no right-qa.config.mjs, no ${NPM_QA} in a package.json, no ${CARGO_QA} in a Cargo.toml${unreadable.length ? ` (unreadable: ${unreadable.join("; ")})` : ""}. Adopt it: add ${NPM_QA} to devDependencies (plus ${NPM_QA_CHROME} for a web UI) and/or ${CARGO_QA} to Cargo.toml [dev-dependencies], add the rightkit-qa floor run (smoke.launch, journey), see docs/ADOPTION.md, then run: node rightkit-drift.mjs --apply. Only a repository that is not an app is exempt (${QA_EXEMPTIONS_FILE}); an app cannot opt out`);
+    refusals.push(`RightKit QA is mandatory for every Orthic Labs app, and ${label} has no QA lane: no right-qa.config.mjs, no XCUITest target, no ${NPM_QA} in a package.json, no ${CARGO_QA} in a Cargo.toml${unreadable.length ? ` (unreadable: ${unreadable.join("; ")})` : ""}. Adopt it: add ${NPM_QA} to devDependencies (plus ${NPM_QA_CHROME} for a web UI) and/or ${CARGO_QA} to Cargo.toml [dev-dependencies], add the rightkit-qa floor run (smoke.launch, journey), see docs/ADOPTION.md, then run: node rightkit-drift.mjs --apply. Only a repository that is not an app is exempt (${QA_EXEMPTIONS_FILE}); an app cannot opt out`);
   }
   const lagging = pins
     .map((pin) => ({ ...pin, latest: pin.version && latestFor(versions, pin.ecosystem, pin.name) }))

package/qa-control-scan.mjs

@@ -379,6 +379,10 @@ export function assertNoQaControl(paths, label = "release", { requireBinary = fa
 // string that survives minification (an identifier that is also a string literal, a file/chunk name, a protocol or
 // a build-flag name). Source maps are scanned too: a map that names qaMock.ts proves the module was bundled.
 export const WEB_MOCK_MARKERS = Object.freeze([
+  { id: "platform-qa-selector", pattern: /__RIGHTKIT_QA_PLATFORM__/ },
+  { id: "platform-qa-environment", pattern: /\bRIGHTKIT_QA_PLATFORM\b/ },
+  { id: "platform-qa-entry", pattern: /(?:bootstrapQaPlatform|resolveQaPlatform|configureQaPlatform|@rightkit\/platform-ui\/qa)/ },
+
   { id: "browser-qa-fake", pattern: /browser-qa-fake/ },
   { id: "browser-mock-api", pattern: /browser-mock-api/ },
   { id: "browser-qa-mock-scheme", pattern: /browser-qa-mock:/ },