@rightkit/release 0.3.0 → 0.4.0

package/local-publish.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac under
-// Adrian's local-build grant (2026-10-14, committed .rightkit-local-build.json). It does not weaken the
-// publication gate: it runs the unit's own CI tests (ci/gate.config.json, ci/asset-gated.json,
-// scripts/ci/gate.mjs semantics), packs the artifact, writes a schema-1 evidence file with one darwin receipt
-// (hostPolicy "darwin-only"), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
+// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac (npm and
+// crates) or from Windows (crates only) under Adrian's local-build grant (2026-10-14, committed
+// .rightkit-local-build.json). It does not weaken the publication gate: it runs the unit's own CI tests
+// (ci/gate.config.json, ci/asset-gated.json, scripts/ci/gate.mjs semantics), packs the artifact, writes a
+// schema-1 evidence file with one receipt for the publishing host (hostPolicy "darwin-only" on the Mac,
+// "win32-only" on Windows), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
 // (publishGatedTarball for npm, runCargoPublish for cargo). There is no way to skip a test or the evidence.
 //
 // Batch mode (`cargo --crates a,b,c | --crates-file f --local`): fmt, the secret scan and clippy run ONCE for
@@ -20,8 +21,8 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { runCargoAsync, runCargoSync, spawnCollect } from "./managed-cargo.mjs";
 import { localBuildGranted, LOCAL_BUILD_FILE } from "./execution-policy.mjs";
-import { GATE_SCHEMA, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
-import { runCargoPublish, scanCrateForSecrets } from "./publish-cargo.mjs";
+import { GATE_SCHEMA, MAX_CARGO_JOBS, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
+import { runCargoPublish, runCargoReadOnly, scanCrateForSecrets } from "./publish-cargo.mjs";
 import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
 import { pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
 import { recordPublished, stageSourceVersions } from "./rightkit-sync.mjs";
@@ -29,6 +30,10 @@ import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
 export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
+export const LOCAL_WIN32_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); published from the Windows host, the macOS run is not part of this receipt";
+// The hosts `--local` accepts and the host policy each records in the evidence.
+export const LOCAL_HOST_POLICIES = Object.freeze({ darwin: "darwin-only", win32: "win32-only" });
+const localHostPolicyReason = (platform) => (platform === "win32" ? LOCAL_WIN32_HOST_POLICY_REASON : LOCAL_HOST_POLICY_REASON);
 const STEP_TIMEOUT_MS = 30 * 60 * 1000;
 
 export class LocalPublishError extends Error {
@@ -39,6 +44,11 @@ const refuse = (message) => { throw new LocalPublishError(message); };
 export const DEFAULT_CONCURRENCY = 4;
 const MAX_CONCURRENCY = 8;
 const CRATE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const JOBS_SUBCOMMANDS = new Set(["test", "clippy", "check", "package"]);
+export function withCargoJobs(args, jobs) {
+  return jobs !== undefined && JOBS_SUBCOMMANDS.has(args[0])
+    ? [args[0], "--jobs", String(jobs), ...args.slice(1)] : args;
+}
 
 const crateList = (text, what) => {
   const names = String(text ?? "").split(",").map((name) => name.trim()).filter(Boolean);
@@ -103,23 +113,37 @@ export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   const flag = kind === "npm" ? "--package" : "--crate";
   const batchFlags = kind === "cargo" ? ", --crates <a,b,c>, --crates-file <file>, --concurrency <n>, --allow-ignored-units <a,b>" : "";
   let unit; let workspace; let local = false; let allowIgnored = false;
+  let qualifyOnly = false; let bundle; let jobsText;
   let crates; let cratesFile; let concurrency = DEFAULT_CONCURRENCY; let allowIgnoredUnits = [];
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--local") local = true;
     else if (arg === flag) unit = argv[++i];
     else if (arg === "--workspace") workspace = argv[++i];
+    else if (kind === "cargo" && arg === "--qualify-only") qualifyOnly = true;
+    else if (kind === "cargo" && arg === "--bundle") bundle = argv[++i];
     // Same meaning as publish.yml's allow_ignored: this unit may have ignored tests; the count is recorded.
     else if (arg === "--allow-ignored") allowIgnored = true;
     else if (kind === "cargo" && arg === "--crates") crates = crateList(argv[++i], "--crates");
     else if (kind === "cargo" && arg === "--crates-file") cratesFile = argv[++i];
     else if (kind === "cargo" && arg === "--concurrency") concurrency = Number(argv[++i]);
     else if (kind === "cargo" && arg === "--allow-ignored-units") allowIgnoredUnits = crateList(argv[++i], "--allow-ignored-units");
+    else if (kind === "cargo" && arg === "--jobs") jobsText = argv[++i] ?? "";
     else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>${batchFlags}, --workspace <dir>, --allow-ignored, --local)`);
   }
   if (!local) refuse("--local is required");
   if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_CONCURRENCY) refuse(`--concurrency must be an integer from 1 to ${MAX_CONCURRENCY}`);
   const workspaceRoot = path.resolve(workspace ?? cwd);
+  if (qualifyOnly && (crates !== undefined || cratesFile !== undefined)) refuse("--qualify-only currently requires one --crate");
+  if (qualifyOnly && !String(bundle ?? "").trim()) refuse("--qualify-only requires --bundle <new-directory>");
+  if (bundle !== undefined && !qualifyOnly) refuse("--bundle requires --qualify-only");
+  const bundleDir = bundle === undefined ? undefined : path.resolve(cwd, bundle);
+  let jobs;
+  if (jobsText !== undefined) {
+    if (!/^[0-9]+$/.test(jobsText) || Number(jobsText) < 1 || Number(jobsText) > MAX_CARGO_JOBS) refuse(`--jobs must be an integer from 1 to ${MAX_CARGO_JOBS}`);
+    if (!qualifyOnly) refuse("--jobs requires --qualify-only");
+    jobs = Number(jobsText);
+  }
   if (kind === "cargo" && (crates !== undefined || cratesFile !== undefined)) {
     if (unit !== undefined) refuse("--crate cannot be combined with --crates or --crates-file");
     if (crates !== undefined && cratesFile !== undefined) refuse("use --crates or --crates-file, not both");
@@ -131,7 +155,7 @@ export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   }
   if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
   if (kind === "cargo" && !CRATE_NAME.test(unit ?? "")) refuse("publish cargo --local requires --crate <name> (or --crates / --crates-file)");
-  return { kind, unit, allowIgnored, allowIgnoredUnits, workspaceRoot, concurrency, batch: undefined };
+  return { kind, unit, allowIgnored, allowIgnoredUnits, workspaceRoot, concurrency, batch: undefined, ...(qualifyOnly ? { qualifyOnly, bundleDir } : {}), ...(jobs === undefined ? {} : { jobs }) };
 }
 
 function defaultGit(args, cwd) {
@@ -213,7 +237,7 @@ export function allFeatureCheckSets(entry = {}) {
 }
 
 /** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
-export function localTestPlan({ kind, unit, dir, config, manifest, batch = false }) {
+export function localTestPlan({ kind, unit, dir, config, manifest, batch = false, platform = "darwin" }) {
   if (kind === "npm") {
     if (!manifest?.scripts?.test) refuse(`${unit} has no test script; --local never publishes an untested package`);
     return {
@@ -225,16 +249,19 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
     };
   }
   const entry = config?.rust?.[unit] ?? {};
-  if (entry.os && !entry.os.includes("macos")) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this Mac`);
+  // gate.config.json names hosts "macos" and "windows" (scripts/ci/gate.mjs HOST).
+  const gateHost = platform === "win32" ? "windows" : "macos";
+  if (entry.os && !entry.os.includes(gateHost)) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this ${platform === "win32" ? "Windows host" : "Mac"}`);
   const featureSets = entry.featureSets ?? [[]];
+  // Stream Cargo artifact records to the broker; libtest summaries remain plain text for ResultScanner.
   const steps = [];
   for (const features of featureSets) {
-    steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--show-output"], test: true });
-    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
+    steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--show-output"], test: true });
+    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
   }
   // Batch mode lints the whole batch once (batchClippyInvocations) and records it as a batch receipt.
-  if (!batch) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
-  for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--all-targets", ...features], test: false });
+  if (!batch) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
+  for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--message-format=json-render-diagnostics", "--all-targets", ...features], test: false });
   return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), steps };
 }
 
@@ -258,7 +285,7 @@ export function batchClippyInvocations(layer, { featuresOf = () => [], assetGate
   }
   return [...groups.values()].map(({ crates, features, assetGated }) => ({
     crates, assetGated,
-    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
+    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
   }));
 }
 
@@ -273,10 +300,12 @@ function testEnv(deps, isAssetGated) {
   return { ...inherited, RIGHTKIT_REQUIRE_ASSETS: isAssetGated ? "0" : "1", RIGHTKIT_ISOLATED_CHECKOUT: "1", CARGO_TERM_COLOR: "never" };
 }
 
-function assertLocalHost(deps, workspaceRoot) {
+function assertLocalHost(deps, workspaceRoot, kind) {
   const platform = deps.platform ?? process.platform;
   if (!(deps.localBuildGranted ?? localBuildGranted)(workspaceRoot)) refuse(`--local needs the local-build grant: a committed ${LOCAL_BUILD_FILE} (allow "build-test-publish") naming this repository at ${workspaceRoot}`);
-  if (platform !== "darwin") refuse(`--local publishes from the Mac only (host policy: darwin-only); this host is ${platform}`);
+  if (!Object.hasOwn(LOCAL_HOST_POLICIES, platform)) refuse(`--local publishes from the Mac only (host policy: darwin-only) or from Windows (host policy: win32-only); this host is ${platform}`);
+  // The npm path reads the registry token from the macOS Keychain and ships a Developer-ID-signed helper: Mac only.
+  if (kind === "npm" && platform !== "darwin") refuse(`publish npm --local needs the macOS Keychain npm token and runs on the Mac only; Windows publishes crates (publish cargo --local); this host is ${platform}`);
   return platform;
 }
 
@@ -300,7 +329,8 @@ async function publishUnit(parsed, deps, batch) {
   const run = deps.run ?? (batch ? defaultRunAsync : defaultRun);
 
   // 1. Preconditions, fail closed.
-  const platform = assertLocalHost(deps, workspaceRoot);
+  const platform = assertLocalHost(deps, workspaceRoot, kind);
+  if (parsed.qualifyOnly && fs.existsSync(parsed.bundleDir)) refuse(`qualification bundle already exists: ${parsed.bundleDir}`);
   const dir = kind === "npm" ? `packages/${unit.slice("@rightkit/".length)}` : `crates/${unit}`;
   const unitPath = path.join(workspaceRoot, dir);
   if (!fs.existsSync(unitPath)) refuse(`unit directory not found: ${unitPath}`);
@@ -324,18 +354,23 @@ async function publishUnit(parsed, deps, batch) {
     const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
     if (tree !== batch.tree) refuse(`${unit}: HEAD tree ${tree} differs from the batch tree ${batch.tree}`);
   }
-  const dirty = git(["status", "--porcelain", "--", dir], workspaceRoot);
+  const dirty = git(["status", "--porcelain", "--", dir, ...(parsed.qualifyOnly ? ["Cargo.toml", "Cargo.lock"] : [])], workspaceRoot);
   if (dirty === null) refuse(`cannot read git status for ${dir}`);
   if (dirty !== "") refuse(`tree is not clean for ${dir}; commit first:\n${dirty}`);
   if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
-  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, darwin-only policy)`);
+  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
   // 2. The unit's own tests, exactly as the CI gate defines them.
   const gateConfig = readJson(path.join(workspaceRoot, "ci", "gate.config.json")) ?? {};
   const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
   const gatedSection = assetGated[kind === "npm" ? "npm" : "crates"] ?? {};
   const isAssetGated = Object.hasOwn(gatedSection, unit);
-  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest, batch: Boolean(batch) });
+  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest, batch: Boolean(batch), platform });
+  if (parsed.qualifyOnly) {
+    const violations = (deps.scanSecrets ?? scanCrateForSecrets)(unitPath);
+    if (violations.length) refuse(`qualification secret scan rejected: ${violations.join(", ")}`);
+    plan.steps.unshift({ command: "cargo", args: ["fmt", "-p", unit, "--check"], test: false });
+  }
   const modules = await (deps.loadWorkspaceModules ?? defaultLoadWorkspaceModules)(workspaceRoot);
   const { ResultScanner, TEST_COMMAND, judgeUnit } = modules.results;
   const env = testEnv(deps, isAssetGated);
@@ -343,15 +378,15 @@ async function publishUnit(parsed, deps, batch) {
   // written reason in ci/gate.config.json (rust.<crate>.allowIgnored). The count stays in the evidence.
   const configReason = kind === "cargo" && typeof gateConfig?.rust?.[unit]?.allowIgnored === "string" ? gateConfig.rust[unit].allowIgnored.trim() : "";
   const ignoredAllowed = Boolean(allowIgnored || parsed.allowIgnoredUnits?.includes(unit) || configReason);
-  const steps = [];
+  const steps = parsed.qualifyOnly ? [{ command: `scanCrateForSecrets ${dir}`, ok: true }] : [];
   for (const step of plan.steps) {
     const commandText = `${step.command} ${step.args.join(" ")}`;
     log(`[right-release] ${plan.id}: ${commandText}`);
-    const result = await run(step.command, step.args, { cwd: workspaceRoot, env });
+    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: workspaceRoot, env });
     const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
     if (result.error || result.status !== 0) {
       steps.push(row);
-      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\nstdout:\n${result.stdout ?? ""}\nstderr:\n${result.stderr ?? ""}`);
     }
     row.ok = true;
     if (row.isTest) {
@@ -391,16 +426,23 @@ async function publishUnit(parsed, deps, batch) {
       const checked = modules.checkNpmTarball({ file: artifactFile, name: unit, version, dir, spawn: deps.spawnSync ?? spawnSync });
       if (checked.problems.length) refuse(`${unit}: packed tarball refused:\n  - ${checked.problems.join("\n  - ")}`);
     } else {
-      // The archive is hashed here; Cargo's verify build runs once, in the real `cargo publish` (before any
-      // upload), instead of here and again in a registry dry-run (see runCargoPublish verifyOnPublish).
-      packCommands.push(`cargo package --locked --no-verify -p ${unit}`);
-      const packed = await run("cargo", ["package", "--locked", "--no-verify", "-p", unit], { cwd: workspaceRoot, env });
+      // A combined publish verifies once in `cargo publish`; detached qualification verifies here before
+      // its evidence leaves this host, so the publishing host can reuse that exact archive's proof.
+      const packageArgs = ["package", "--locked", ...(parsed.qualifyOnly ? [] : ["--no-verify"]), "-p", unit];
+      packCommands.push(`cargo ${packageArgs.join(" ")}`);
+      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: workspaceRoot, env });
       if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
-      packCommands.push("cargo metadata --format-version 1 --no-deps");
-      const meta = await run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
+      if (parsed.qualifyOnly) steps.push({ command: `cargo ${packageArgs.join(" ")}`, ok: true });
+      const metadataArgs = ["metadata", "--offline", "--format-version", "1", "--no-deps"];
+      const meta = await runCargoReadOnly(metadataArgs, { cwd: workspaceRoot, env }, (_command, args, settings) => run("cargo", args, settings),
+        (failed) => log(`[right-release] offline Cargo metadata missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`));
+      const actualMetadataArgs = meta.usedOfflineFallback ? metadataArgs.filter((arg) => arg !== "--offline") : metadataArgs;
+      packCommands.push(`cargo ${actualMetadataArgs.join(" ")}`);
       let targetDir;
       try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
-      if (meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) refuse("cannot read the Cargo target directory");
+      if (meta.error || meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) {
+        refuse(`cannot read the Cargo target directory\n${tail(`${meta.error?.message ?? ""}\n${meta.stdout ?? ""}\n${meta.stderr ?? ""}`)}`);
+      }
       artifactFile = path.join(targetDir, "package", `${unit}-${version}.crate`);
       if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
     }
@@ -411,13 +453,14 @@ async function publishUnit(parsed, deps, batch) {
     const timestamp = (deps.now ?? (() => new Date().toISOString()))();
     const evidence = {
       schema: GATE_SCHEMA, kind, name: unit, version, commit: head, artifactSha256,
-      hostPolicy: "darwin-only", hostPolicyReason: LOCAL_HOST_POLICY_REASON,
+      hostPolicy: LOCAL_HOST_POLICIES[platform], hostPolicyReason: localHostPolicyReason(platform),
       runs: [{
-        host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
+        host: { os: platform, arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
         command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
         passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored, allowIgnored: ignoredAllowed,
         ...(configReason ? { allowIgnoredReason: configReason } : {}),
         requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
+        ...(parsed.jobs === undefined ? {} : { jobs: parsed.jobs }),
         ...(batch ? { batch: structuredClone(batch.receipt) } : {}),
         steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
       }],
@@ -429,6 +472,18 @@ async function publishUnit(parsed, deps, batch) {
     const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath };
     (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { write: (line) => log(line.replace(/\n$/, "")) });
 
+    if (parsed.qualifyOnly) {
+      // Keep bytes and their normal gate evidence together outside the checkout. Never overwrite a bundle.
+      fs.mkdirSync(parsed.bundleDir, { recursive: false });
+      const bundledArtifact = path.join(parsed.bundleDir, path.basename(artifactFile));
+      const bundledEvidence = path.join(parsed.bundleDir, "gate.json");
+      fs.copyFileSync(artifactFile, bundledArtifact, fs.constants.COPYFILE_EXCL);
+      if (sha256(fs.readFileSync(bundledArtifact)) !== artifactSha256) refuse("qualification archive changed while copying");
+      fs.copyFileSync(evidencePath, bundledEvidence, fs.constants.COPYFILE_EXCL);
+      log(`[right-release] qualified ${unit}@${version}; bundle ${parsed.bundleDir}; publish cargo --crate ${unit} --from-evidence ${bundledEvidence}`);
+      return { kind, name: unit, version, commit: head, artifactSha256, evidencePath: bundledEvidence, artifactFile: bundledArtifact, qualifiedOnly: true };
+    }
+
     // 5. The EXISTING publish path.
     if (kind === "npm") {
       (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath }, deps.publishDeps ?? {});
@@ -437,7 +492,7 @@ async function publishUnit(parsed, deps, batch) {
       // and clippy, so the publisher does not repeat them; verifyOnPublish: Cargo's verify build runs in the
       // publish itself. Package contents, the runtime budget, the archive hash and the readback always run.
       const execute = deps.cargoExecute ?? (batch ? batchCargoExecute(unit) : undefined);
-      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath, trustEvidenceSteps: true, verifyOnPublish: true }, execute, deps.cargoDeps ?? {});
+      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath, trustEvidenceSteps: true, verifyOnPublish: true, offlineReadOnly: true }, execute, deps.cargoDeps ?? {});
       await withVersionsLock(() => (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version }));
     }
     log(`[right-release] published ${unit}@${version}`);
@@ -460,7 +515,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const git = deps.git ?? defaultGit;
   const readJson = deps.readJson ?? defaultReadJson;
   const run = deps.run ?? defaultRunAsync;
-  assertLocalHost(deps, workspaceRoot);
+  const platform = assertLocalHost(deps, workspaceRoot, "cargo");
 
   // 1. The crate list and its dependency layers.
   const requested = parsed.batch.file ? parseCrateLayers((deps.readText ?? ((file) => fs.readFileSync(file, "utf8")))(parsed.batch.file)) : [parsed.batch.crates];
@@ -483,7 +538,7 @@ async function runLocalPublishBatch(parsed, deps) {
     if (pkg.name !== unit) refuse(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crates entry ${unit}`);
     if (typeof pkg.version !== "string" || !pkg.version.trim()) refuse(`${unit} has no literal version`);
     versions.set(unit, pkg.version);
-    localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true }); // refuses an OS-restricted crate now, not mid-batch
+    localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true, platform }); // refuses an OS-restricted crate now, not mid-batch
   }
   const head = git(["rev-parse", "HEAD"], workspaceRoot);
   if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
@@ -496,7 +551,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const registryHas = deps.registryHas ?? defaultRegistryHas;
   const published = (await Promise.all(crates.map(async (unit) => ((await registryHas({ kind: "cargo", name: unit, version: versions.get(unit) })) ? `${unit}@${versions.get(unit)}` : null)))).filter(Boolean);
   if (published.length) refuse(`already on the crates.io registry: ${published.join(", ")}; bump the version or remove them from the batch`);
-  log(`[right-release] local publish cargo batch: ${crates.length} crate(s) in ${layers.length} layer(s) at ${head.slice(0, 12)}, concurrency ${concurrency} (local-build grant, darwin-only policy)`);
+  log(`[right-release] local publish cargo batch: ${crates.length} crate(s) in ${layers.length} layer(s) at ${head.slice(0, 12)}, concurrency ${concurrency} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
   // 3. Batch-level checks, once, at the batch commit. Each is recorded in every crate's evidence.
   const env = testEnv(deps, false);

package/managed-cargo.mjs

@@ -18,6 +18,14 @@ export function managedRuntimeClient(env = process.env, platform = process.platf
     const client = path.posix.join(env.HOME || homedir(), 'Library', 'Application Support', 'RustRight', 'runtime', 'rustright');
     if (exists(client)) return client;
   }
+  // RustRight's own install on Windows (2026-10-18 cutover): the runtime moved out of the control root to
+  // <drive>\.rustright\runtime, beside the control root's drive, and runtime-current was retired.
+  if (platform === 'win32') {
+    for (const root of roots) {
+      const client = path.win32.join(path.win32.parse(root).root, '.rustright', 'runtime', 'rustright.exe');
+      if (exists(client)) return client;
+    }
+  }
   return undefined;
 }
 

package/mirror-root-artifact.mjs

@@ -6,6 +6,7 @@
 // `{ file, name?, pruneSuffix? }`. `pruneSuffix` (for example "-setup.exe") then removes the other files with that suffix
 // from the managed directory, so it holds exactly the current artifact. Run it as `targets.<platform>.postSign`.
 // Output goes only to RIGHT_RELEASE_ARTIFACT_DIR (outside the repository); it never writes into the repository root.
+import { configuredManagedRootSpellings } from "./artifact-storage.mjs";
 import { copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import { execFileSync } from "./background-process.mjs";
 import path from "node:path";
@@ -113,11 +114,14 @@ function atomicCopy(from, to) {
 function assertSafePath(target) {
   const absolute = path.resolve(target);
   const root = path.parse(absolute).root;
+  // Only the configured managed root itself may be a symlink (same rule as artifact-storage assertSafeMutation).
+  const managedRoots = configuredManagedRootSpellings();
+  const configured = (candidate) => managedRoots.has(process.platform === "win32" ? path.resolve(candidate).toLowerCase() : path.resolve(candidate));
   let cursor = root;
   for (const segment of path.relative(root, absolute).split(path.sep).filter(Boolean)) {
     cursor = path.join(cursor, segment);
     try {
-      if (lstatSync(cursor).isSymbolicLink()) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
+      if (lstatSync(cursor).isSymbolicLink() && !configured(cursor)) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }

package/native-cargo-layout.mjs

@@ -18,6 +18,8 @@ export function resolveNativeCargoLayout({
   read = (file) => readFileSync(file, "utf8"),
   requireManifest = false,
   requireLock = false,
+  // The repository the app lives in. A manifest outside the app searches for its workspace only up to this directory.
+  repoRoot,
 } = {}) {
   if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
   const resolvedAppRoot = path.resolve(appRoot);
@@ -31,7 +33,7 @@ export function resolveNativeCargoLayout({
   const explicitWorkspace = nativeAssembly?.workspaceRoot ?? nativeAssembly?.cargoWorkspaceRoot;
   const workspaceRoot = explicitWorkspace
     ? normalizeWorkspaceRoot(resolveDeclaredPath(resolvedAppRoot, explicitWorkspace), exists)
-    : discoverWorkspaceRoot({ appRoot: resolvedAppRoot, manifestPath, manifestDir, manifestText, exists, read });
+    : discoverWorkspaceRoot({ appRoot: resolvedAppRoot, manifestPath, manifestDir, manifestText, exists, read, repoRoot: repoRoot ? path.resolve(repoRoot) : undefined });
 
   const lock = resolveCargoLock({
     appRoot: resolvedAppRoot,
@@ -84,6 +86,28 @@ export function resolveNativeCargoLayout({
   return layout;
 }
 
+/**
+ * True when the app has a native Cargo manifest the release must hash and build against: the config declares one
+ * (nativeAssembly.cargoManifest / manifest) or the historical src-tauri/Cargo.toml exists. A native iOS app (xcodegen
+ * project, Rust static library built by iosPackage.prepare) has neither, and then owns no Cargo layout at all.
+ */
+export function nativeCargoDeclared({ appRoot, config, nativeAssembly = config?.nativeAssembly, exists = existsSync } = {}) {
+  if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
+  if (nativeAssembly?.cargoManifest ?? nativeAssembly?.manifest) return true;
+  return exists(path.resolve(appRoot, DEFAULT_MANIFEST));
+}
+
+/** The manifest nativeAssembly names, if any (a path relative to the app root, or absolute). */
+export function declaredCargoManifest(config, nativeAssembly = config?.nativeAssembly) {
+  return nativeAssembly?.cargoManifest ?? nativeAssembly?.manifest;
+}
+
+/** True when the historical Tauri host manifest exists. */
+export function hasDefaultTauriManifest({ appRoot, exists = existsSync } = {}) {
+  if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
+  return exists(path.resolve(appRoot, DEFAULT_MANIFEST));
+}
+
 export const resolveCargoLayout = resolveNativeCargoLayout;
 export const resolveNativeCargoManifest = resolveNativeCargoLayout;
 export const resolveCargoManifest = resolveNativeCargoLayout;
@@ -160,20 +184,29 @@ function resolveCargoLock({ appRoot, manifestPath, manifestDir, workspaceRoot, n
   return { path: found, source: found ? orderedSources[candidates.indexOf(found)] : undefined, candidates };
 }
 
-function discoverWorkspaceRoot({ appRoot, manifestPath, manifestDir, manifestText, exists, read }) {
+function discoverWorkspaceRoot({ appRoot, manifestPath, manifestDir, manifestText, exists, read, repoRoot }) {
   const parsed = parseCargoManifest(manifestText);
   const declaredWorkspace = parsed.workspacePath ?? parsed.packageWorkspace;
   if (declaredWorkspace) {
     return normalizeWorkspaceRoot(resolveDeclaredPath(manifestDir, declaredWorkspace), exists);
   }
   if (parsed.hasWorkspace) return manifestDir;
+  // A manifest inside the app searches up to the app root (unchanged); one outside it (a shared crates/ tree) searches up to the
+  // nearest directory that contains both, which is where its workspace and Cargo.lock live.
+  // Only a caller that names the repository opts in to the climb above the app (native iOS); every other caller keeps the
+  // exact historical search, which never leaves the app root.
+  let boundary = appRoot;
+  if (repoRoot && !isWithin(appRoot, manifestDir)) {
+    boundary = commonAncestor(appRoot, manifestDir);
+    if (!isWithin(repoRoot, boundary)) boundary = repoRoot;
+  }
   let current = manifestDir;
   for (;;) {
     const candidate = path.join(current, "Cargo.toml");
     if (candidate !== manifestPath && exists(candidate) && parseCargoManifest(readIfPresent(candidate, exists, read)).hasWorkspace) return current;
-    if (current === appRoot) break;
+    if (current === boundary) break;
     const parent = path.dirname(current);
-    if (parent === current || !isWithin(appRoot, parent)) break;
+    if (parent === current || !isWithin(boundary, parent)) break;
     current = parent;
   }
   return manifestDir;
@@ -231,6 +264,16 @@ function readIfPresent(file, exists, read) {
   try { return exists(file) ? read(file) : ""; } catch { return ""; }
 }
 
+function commonAncestor(left, right) {
+  let current = path.resolve(left);
+  while (!isWithin(current, path.resolve(right))) {
+    const parent = path.dirname(current);
+    if (parent === current) return current;
+    current = parent;
+  }
+  return current;
+}
+
 function isWithin(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));

package/ownership-command.mjs

@@ -6,6 +6,7 @@
 //   right-release ownership [--app <dir>] --audit-json   (Legion governance.capability-ownership provider)
 //   right-release ownership trust-compare [--json]   (print this host's protected-trust digest; policy-bundle drift is a warning, never a block)
 //   right-release ownership trust-sync               (retired: prints why and exits 0)
+//   right-release ownership trust-refresh [--dry-run] [--app <dir>]   (elevated, key-neutral: merge new repository registrations and floors from the installed release into protected trust)
 //   right-release ownership --write-manifest [--rightkit <rightkit>] [--approve-new-capabilities]
 // --approve-new-capabilities permits new ids during local generation only.
 // Existing owner changes are always refused; installation needs protected authorization.
@@ -75,7 +76,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   if (args[0] === "trust-compare") return trustCompare(args, { print, trustLoader });
   if (args.includes("--staged")) return stagedMain(args, { print });
   if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
-  if (["enroll", "approve-key", "revoke-key"].includes(args[0])) {
+  if (["enroll", "approve-key", "revoke-key", "trust-refresh"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
     return keyMain(args, { runner: gitRunner, print });
   }

package/ownership-dependency-allowlist.json

@@ -1036,7 +1036,7 @@
       ]
     },
     {
-      "repositoryIdentity": "https://github.com/orthic-labs/pulse",
+      "repositoryIdentity": "https://github.com/bogusyogi/pulse",
       "dependencies": [
         "cargo:chrono",
         "cargo:dirs",

package/ownership-evidence.mjs

@@ -23,6 +23,7 @@ function rootContains(root, candidate) {
 
 function createEvidence(repoRoot, {
   scanRoot = repoRoot,
+  scope: requestedScope = null,
   manifestPath = path.join(path.dirname(fileURLToPath(import.meta.url)), MANIFEST_FILE),
   scan = checkApp,
   trustLoader = loadTrustedExternal,
@@ -33,6 +34,7 @@ function createEvidence(repoRoot, {
   policyBundleProvider = runningPolicyBundle,
 } = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
   const root = path.resolve(repoRoot);
+  const scope = requestedScope ? [...new Set(requestedScope)].sort() : null;
   const manifestBytes = readFileSync(manifestPath);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
   let trustState = trustLoader();
@@ -114,21 +116,27 @@ function createEvidence(repoRoot, {
     }
   }
   const registration = registrationCheck?.registration ?? null;
-  const requestedRootRegistered = registration?.roots.some((registered) => rootContains(registered, requestedRoot)) ?? false;
-  if (registration && !requestedRootRegistered) {
-    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${requestedRoot}`);
-    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${requestedRoot}`);
+  if (scope && !useCommittedSource) throw new Error("a scoped ownership scan requires the committed-source scan; this host's trust enrollment cannot provide it");
+  // A scoped scan covers its scope roots; the unscoped scan covers the requested root.
+  const coverageTargets = scope ?? [requestedRoot];
+  const unregisteredTargets = registration ? coverageTargets.filter((target) => !registration.roots.some((registered) => rootContains(registered, target))) : [];
+  const requestedRootRegistered = unregisteredTargets.length === 0;
+  for (const target of unregisteredTargets) {
+    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${target}`);
+    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${target}`);
   }
 
   // The release app's manifest/config can be nested, but the external registry
   // defines repository coverage. Scan every protected root so a nested release
   // cannot omit sibling packages or engine source by narrowing scanRoot.
-  const scanRoots = registration?.roots ? [...registration.roots] : [];
-  if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
-  const scans = (scanRoots.length ? scanRoots : [requestedRoot]).map((registered) => {
+  const overlapsScope = (registered) => !scope || scope.some((target) => rootContains(registered, target) || rootContains(target, registered));
+  const scanRoots = registration?.roots ? registration.roots.filter(overlapsScope) : [];
+  if (scope) { for (const target of unregisteredTargets) if (!scanRoots.includes(target)) scanRoots.push(target); }
+  else if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
+  const scans = (scanRoots.length ? scanRoots : [scope ? "." : requestedRoot]).map((registered) => {
     const absolute = registered === "." ? root : path.resolve(root, ...registered.split("/"));
     const scanned = useCommittedSource
-      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source })
+      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source, ...(scope ? { scope } : {}) })
       : scan(absolute, manifest, { trust: { trust: trustState.trust, enrolled: trustState.enrolled, pending: enrollmentPending }, scannerVersion, catalogVersion, ...(enrollmentPending ? { enrollmentPendingAdvisory: true } : {}) });
     if (repositoryIdentity && canonicalRepositoryIdentity(scanned.metadata?.repositoryIdentity) !== repositoryIdentity) throw new Error(`ownership evidence: scanner observed a different repository identity under ${registered}`);
     if (useCommittedSource && scanned.metadata?.commit !== commit) throw new Error(`ownership evidence: scanner observed a different source commit under ${registered}`);
@@ -181,6 +189,7 @@ function createEvidence(repoRoot, {
     floorOk: floor.ok,
     visibility: registration?.visibility ?? null,
     registrationDigest: registration ? sha256(registration) : null,
+    ...(scope ? { ownershipScope: scope, ownershipScopeClosed: [...new Set(scans.flatMap(({ scanned }) => scanned.metadata?.ownershipScopeClosed ?? scope))].sort() } : {}),
     registeredRoots: registration ? [...registration.roots] : [],
     contentDigest: enrollmentPending ? null : contentDigest,
     checkedAt: new Date().toISOString(),
@@ -190,13 +199,13 @@ function createEvidence(repoRoot, {
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */
-export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
-  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
+export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
 }
 
 /** Alias spelling makes the immutable-source contract explicit at adapter boundaries. */
-export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
-  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true });
+export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true });
 }
 
 // Injection seam is deliberately named for tests and is not used by release commands.
@@ -219,21 +228,24 @@ export function runProtectedLocalOwnershipCheck(repoRoot, scanRoot = repoRoot) {
 }
 
 /** Re-scan exact source and compare every sealed binding before release upload. */
-export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot) {
-  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot));
+export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null) {
+  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope), scope);
 }
 
 export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
-  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options));
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options), options.scope ?? null);
 }
 
-function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent) {
+function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent, scope = null) {
   if (!expected || expected.schema !== 1) return { ok: false, reason: "sealed ownership evidence is missing or malformed" };
+  // The sealed scope must equal what the current config yields; the re-scan below uses that same scope.
+  const wanted = scope ? [...new Set(scope)].sort() : null;
+  if (JSON.stringify(expected.ownershipScope ?? null) !== JSON.stringify(wanted)) return { ok: false, reason: "ownership evidence ownershipScope changed after build" };
   let current;
   try { current = createCurrent(); }
   catch (error) { return { ok: false, reason: error.message }; }
-  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest"]) {
-    const unchanged = key === "registeredRoots" || key === "keyCheckpoint" || key === "keyAuthority"
+  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest", "ownershipScopeClosed"]) {
+    const unchanged = key === "registeredRoots" || key === "ownershipScopeClosed" || key === "keyCheckpoint" || key === "keyAuthority"
       ? JSON.stringify(expected[key]) === JSON.stringify(current.evidence[key])
       : expected[key] === current.evidence[key];
     if (!unchanged) return { ok: false, reason: `ownership evidence ${key} changed after build` };