@rightkit/release 0.3.0 → 0.4.1

package/protected-credentials.mjs

@@ -7,7 +7,8 @@ import { isManagedHost, refuseManagedEnvSecrets } from "./managed-host-secrets.m
 // Protected credential loaders for release sites that previously read only
 // ambient environment variables. The storage pattern matches release-token.mjs:
 // macOS Keychain generic passwords (account $USER) and, on Windows, a protected
-// token file under %APPDATA%\RightKit. Values are returned to the caller only;
+// token file under %APPDATA%\RightKit for legacy non-updater sites. Updater
+// signing uses M11's native OS-store child-exec boundary. Other values return to the caller only;
 // they are never logged, and diagnostics name the secret, never its value.
 export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 
@@ -16,6 +17,7 @@ export const PROTECTED_SECRET_MISSING = "PROTECTED_SECRET_MISSING";
 export const PROTECTED_SECRETS = Object.freeze({
   "cloudflare-api-token": { label: "Cloudflare API token", keychain: "rightkit-cloudflare-api-token", file: "cloudflare-api-token.token" },
   "qa-receipt-key": { label: "RightKit QA receipt key", keychain: null, file: "qa-receipt-key.token", darwinFile: true },
+  "updater-signing-key": { label: "RightKit updater signing key", keychain: "rightsuite-updater-key", providerExec: true },
 });
 
 export class ProtectedSecretMissingError extends Error {
@@ -39,6 +41,7 @@ export function protectedSecretStoreCommand(name, platform = process.platform) {
   if (platform === "darwin" && spec.darwinFile) return null;
   if (platform === "darwin") return `security add-generic-password -a "$USER" -s ${spec.keychain} -U -w`;
   if (platform === "win32") {
+    if (spec.providerExec) return `$rightkitSecure = Read-Host -AsSecureString '${spec.label}'; $rightkitPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($rightkitSecure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rightkitPointer) | & rightkit-credentials.exe set --namespace '${spec.keychain}' --account ([Environment]::UserName) --replace } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rightkitPointer) }`;
     return `powershell -NoProfile -Command "$s = Read-Host -AsSecureString '${spec.label}'; $d = Join-Path $env:APPDATA 'RightKit'; New-Item -ItemType Directory -Force -Path $d | Out-Null; [IO.File]::WriteAllText((Join-Path $d '${spec.file}'), [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($s)))"`;
   }
   return null;
@@ -78,6 +81,9 @@ export function createCredentialStore({
     read(name) {
       if (!PROTECTED_SECRETS[name]) throw new Error(`unknown protected secret: ${name}`);
       const spec = PROTECTED_SECRETS[name];
+      // Signing keys stay inside the native provider's child-exec boundary.
+      // No JavaScript/file/environment fallback can export this credential.
+      if (spec.providerExec) throw new ProtectedSecretMissingError(name, protectedSecretStoreCommand(name, platform));
       let value;
       if (platform === "darwin") {
         // Receipt MAC keys are provisioned by right-release itself as a 0600 file, never from the Keychain.
@@ -98,6 +104,7 @@ export function createCredentialStore({
 // when the store has no value. A missing store entry on a managed host never
 // permits the environment fallback.
 export function resolveEnvBackedSecret({ name, envName, env = process.env, credentialStore, required = true }) {
+  if (PROTECTED_SECRETS[name]?.providerExec) throw new Error("updater signing requires the OS credential provider execution boundary");
   refuseManagedEnvSecrets(env, [envName]);
   if (!required) return undefined;
   const store = credentialStore ?? createCredentialStore({ env });
@@ -111,6 +118,26 @@ export function resolveEnvBackedSecret({ name, envName, env = process.env, crede
   }
 }
 
+// M11 owns OS acquisition & secret lifetime. The release adapter supplies only
+// non-secret identity plus an absolute native child executable and literal argv.
+export function execWithUpdaterCredential(command, args, {
+  env = process.env, cwd = process.cwd(), run = spawnSync,
+  provider = process.platform === "win32" ? "rightkit-credentials.exe" : "rightkit-credentials",
+  account = os.userInfo().username,
+} = {}) {
+  for (const key of Object.keys(env)) {
+    if (["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"].includes(key.toUpperCase()) && env[key]) {
+      throw new Error("updater signing key/password must come from the OS credential provider");
+    }
+  }
+  if (!path.isAbsolute(command)) throw new Error("credential provider child must be an absolute native executable");
+  const result = run(provider, ["exec", "--namespace", PROTECTED_SECRETS["updater-signing-key"].keychain,
+    "--account", account, "--env", "TAURI_SIGNING_PRIVATE_KEY", "--", command, ...args],
+  { cwd, env: { ...env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" }, stdio: "inherit", shell: false, windowsHide: true });
+  if (result.error?.code === "ENOENT") throw new Error("OS credential provider unavailable: install rightkit-credentials >=0.2.2 on PATH before updater signing");
+  return result;
+}
+
 export function resolveCloudflareApiToken({ env = process.env, credentialStore, required = true } = {}) {
   return resolveEnvBackedSecret({ name: "cloudflare-api-token", envName: "CLOUDFLARE_API_TOKEN", env, credentialStore, required });
 }

package/publication-artifacts.mjs

@@ -41,7 +41,9 @@ export function assertArtifactUnchanged(artifact) {
   return artifact.bytes;
 }
 
-export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId }, deps = {}) {
+// `streamRoles`: sealed entries of these roles are hash-verified by a streamed read and returned WITHOUT their bytes (the caller reads
+// byte ranges of `file`), so a large IPA is never held in memory.
+export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app, version, platform, configPath, releaseId, streamRoles = [], ownershipScope = null }, deps = {}) {
   let sealed;
   try { sealed = verifySealedRelease(sealedDir); }
   catch (error) {
@@ -52,7 +54,7 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!/^[a-f0-9]{40}$/.test(commit ?? "") || manifest.commit !== commit
     || (app && manifest.app !== app) || (version && manifest.version !== version)
     || manifest.platform !== platform || (releaseId && manifest.releaseId !== releaseId)) throw new PublicationError("PUBLICATION_SOURCE_MISMATCH", "sealed release source or product identity mismatch");
-  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot);
+  const ownership = (deps.verifyOwnership ?? verifyOwnershipEvidence)(manifest.ownershipEvidence, repoRoot, appRoot, ownershipScope);
   if (!ownership.ok || manifest.ownershipEvidence?.commit !== commit) throw new PublicationError("PUBLICATION_OWNERSHIP_INVALID", `sealed ownership evidence rejected: ${ownership.reason ?? "commit mismatch"}`);
   if (!manifest.checkpoints?.includes("signed") || !manifest.checkpoints?.includes("hardened")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "signed & hardened seal checkpoints are required");
   if (configPath && digestBytes(readFileSync(configPath)) !== manifest.signing?.configSha256) throw new PublicationError("PUBLICATION_POLICY_MISMATCH", "release config differs from sealed signing policy");
@@ -65,14 +67,16 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   let notarized = false;
   let signed = false;
   let androidVerified = false;
+  let iosVerified = false;
   for (const receipt of receipts) {
     const artifact = readVerifiedArtifact(path.resolve(appRoot, receipt.file), receipt);
     let value;
     try { value = JSON.parse(artifact.bytes); } catch { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "invalid sealed signing receipt"); }
     if (value.schema !== 1) throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", "malformed sealed signing receipt");
     if (value.contract !== undefined) {
-      verifyAndroidPublicationReceipt(value, manifest, platform);
-      androidVerified = true; signed = true;
+      if (value.contract === IOS_RECEIPT_CONTRACT) { verifyIosPublicationReceipt(value, manifest, platform); iosVerified = true; }
+      else { verifyAndroidPublicationReceipt(value, manifest, platform); androidVerified = true; }
+      signed = true;
       continue;
     }
     if (Array.isArray(value.files)) {
@@ -93,10 +97,11 @@ export function verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit,
   if (!signed) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed native signing evidence is required");
   if (platform === "mac" && !notarized) throw new PublicationError("PUBLICATION_NOTARIZATION_MISSING", "sealed notarization evidence is required");
   if (platform === "android" && !androidVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed android AAB upload-key receipt is required");
+  if (platform === "ios" && !iosVerified) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", "sealed iOS IPA build receipt is required");
   const artifacts = new Map();
   for (const entry of manifest.files ?? []) {
     if (typeof entry.name !== "string" || path.basename(entry.name) !== entry.name || artifacts.has(entry.name)) throw new PublicationError("PUBLICATION_SEAL_INVALID", "unsafe or duplicate sealed artifact name");
-    artifacts.set(entry.name, readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
+    artifacts.set(entry.name, streamRoles.includes(entry.role) ? verifyArtifactFile(path.join(sealedDir, entry.name), entry) : readVerifiedArtifact(path.join(sealedDir, entry.name), entry));
   }
   if (!artifacts.size) throw new PublicationError("PUBLICATION_SEAL_INVALID", "sealed release has no artifacts");
   return { ...sealed, artifacts };
@@ -124,6 +129,26 @@ function verifyAndroidPublicationReceipt(value, manifest, platform) {
   if (value.file.name !== aab.name) invalid("android AAB receipt names a different file than the sealed aab entry");
 }
 
+// iOS IPA receipt (ios-package-recipe.mjs: contract "ios-xcodebuild-archive-automatic-v1"). The receipt was already read from the
+// manifest's signing.receipts and hash-verified by the caller; here it must describe exactly the sealed "ipa" file, for the team
+// and bundle id pinned in the sealed signing policy. Fails closed with a specific message on any mismatch.
+const IOS_RECEIPT_CONTRACT = "ios-xcodebuild-archive-automatic-v1";
+function verifyIosPublicationReceipt(value, manifest, platform) {
+  const invalid = (message) => { throw new PublicationError("PUBLICATION_SIGNATURE_INVALID", message); };
+  if (platform !== "ios" || manifest.platform !== "ios") invalid("iOS IPA receipt in a non-iOS release");
+  const pinnedTeam = manifest.signing?.teamId;
+  if (!/^[A-Z0-9]{10}$/.test(pinnedTeam ?? "")) invalid("sealed signing policy has no pinned iOS team id");
+  if (value.teamId !== pinnedTeam) invalid("iOS IPA receipt team id is not the pinned team");
+  if (!manifest.signing?.bundleId || value.bundleId !== manifest.signing.bundleId) invalid("iOS IPA receipt bundle id is not the pinned bundle id");
+  if (!value.marketingVersion || !value.buildNumber) invalid("iOS IPA receipt has no version identity");
+  const ipas = (manifest.files ?? []).filter((entry) => entry.role === "ipa");
+  if (ipas.length !== 1) invalid(ipas.length ? "sealed release has more than one ipa entry" : "sealed release has no ipa entry");
+  const [ipa] = ipas;
+  if (!/^[a-f0-9]{64}$/.test(value.file?.sha256 ?? "") || value.file.sha256 !== ipa.sha256) invalid("iOS IPA receipt sha256 differs from the sealed ipa entry");
+  if (!Number.isInteger(value.file.sizeBytes) || value.file.sizeBytes !== ipa.sizeBytes) invalid("iOS IPA receipt size differs from the sealed ipa entry");
+  if (value.file.name !== ipa.name) invalid("iOS IPA receipt names a different file than the sealed ipa entry");
+}
+
 // Bounded memory for large artifacts. Transport must read back against this digest.
 export function verifyArtifactFile(file, evidence) {
   if (!/^[a-f0-9]{64}$/.test(evidence?.sha256 ?? "")) throw new PublicationError("PUBLICATION_SEAL_INVALID", "publication hash evidence is required");

package/publication-gate.mjs

@@ -8,11 +8,12 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { recordPublished, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { fileURLToPath } from "node:url";
 import { digestBytes, readVerifiedArtifact } from "./publication-artifacts.mjs";
 
 export const GATE_SCHEMA = 1;
+export const MAX_CARGO_JOBS = 64;
 export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
 // Swift packages (RightKitSwift) are Apple-only; Windows cannot run them.
 export const requiredHosts = (kind) => (kind === "swift" ? Object.freeze(["darwin"]) : REQUIRED_HOSTS);
@@ -20,6 +21,11 @@ const SHA = /^[0-9a-f]{40}$/;
 // The one definition of a recorded darwin-only host policy (release evidence and the runtime budget gate share it).
 export const isDarwinOnlyPolicy = (source) => source?.hostPolicy === "darwin-only"
   && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
+// The symmetric recorded win32-only host policy: a crate published from the Windows host under the local-build grant.
+export const isWin32OnlyPolicy = (source) => source?.hostPolicy === "win32-only"
+  && typeof source.hostPolicyReason === "string" && source.hostPolicyReason.trim() !== "";
+/** The one host a recorded single-host policy names ("darwin" or "win32"), or null when none is recorded. */
+export const singleHostOfPolicy = (source) => (isDarwinOnlyPolicy(source) ? "darwin" : isWin32OnlyPolicy(source) ? "win32" : null);
 
 export function defaultEvidencePath(workspaceRoot, kind, name) {
   return path.join(workspaceRoot, "release-evidence", "gate", `${kind}-${name.replace(/^@/, "").replace("/", "-")}.json`);
@@ -87,17 +93,40 @@ export function batchReceiptProblems(batch, evidence, tree) {
   return problems;
 }
 
+/**
+ * Feature sets of this crate that a batch receipt did NOT lint (0.4.1 review A2). Batch mode lints each crate's tested
+ * feature sets in shared `-p a -p b` runs, so a receipt from before every set was linted (0.4.0: first set only)
+ * still satisfies `batchReceiptProblems`, which accepts any ONE clippy row covering the crate. Replay therefore
+ * needs one passing row per feature set: bound to the evidence commit and the batch tree, naming the crate (`-p <crate>`
+ * and `crates`), and ending `--no-deps --all-targets <features> -- -D warnings`. `featureSets` is the crate's
+ * `ci/gate.config.json` list (`[[]]` when unset). Returns the missing sets as argument arrays.
+ */
+export function batchClippyMissingFeatureSets(batch, evidence, featureSets) {
+  const rows = (Array.isArray(batch?.checks) ? batch.checks : []).filter((row) => row?.name === "clippy" && row.ok === true
+    && row.commit === evidence.commit && row.tree === batch.tree && Array.isArray(row.crates) && row.crates.includes(evidence.name) && text(row.command));
+  const sets = (Array.isArray(featureSets) && featureSets.length ? featureSets : [[]]).map((set) => (Array.isArray(set) ? set : []));
+  return sets.filter((features) => {
+    const tail = ` --no-deps --all-targets${features.length ? ` ${features.join(" ")}` : ""} -- -D warnings`;
+    return !rows.some((row) => {
+      const words = row.command.split(" ");
+      return row.command.endsWith(tail) && words.some((word, index) => word === "-p" && words[index + 1] === evidence.name);
+    });
+  });
+}
+
 /**
  * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
  * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
  * `cargo clippy -p <name> ... -D warnings` step, or a valid batch receipt covering the crate), and `fmt` and
- * `secretScan` (a valid batch receipt covering the crate). Every darwin run at the evidence commit must prove a
+ * `secretScan` (a valid batch receipt covering the crate). Every run on the proving host (darwin, or win32 under a win32-only policy) at the evidence commit must prove a
  * step for it to count. Call after the gate accepted the evidence (the gate binds commit, tree and artifact).
  */
 export function provenGateSteps(evidence) {
   const none = { tests: false, clippy: false, fmt: false, secretScan: false };
   if (!evidence || !SHA.test(String(evidence.commit ?? "")) || !text(evidence.name)) return none;
-  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === "darwin");
+  // The proving host is the one a recorded win32-only policy names; every other evidence is proved on darwin.
+  const proofHost = isWin32OnlyPolicy(evidence) ? "win32" : "darwin";
+  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === proofHost);
   if (!runs.length || runs.some((run) => run.commit !== evidence.commit)) return none;
   const name = escapeRegExp(evidence.name);
   const stepProves = (run, pattern, needTests) => (Array.isArray(run.steps) ? run.steps : []).some((step) => step?.ok === true
@@ -124,42 +153,49 @@ function invalidRunFields(run, evidence, tree) {
   if (!text(run.timestamp)) bad.push("timestamp");
   if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
   if (run.failed !== 0) bad.push("failed (must be 0)");
+  if (run.jobs !== undefined && !(Number.isInteger(run.jobs) && run.jobs >= 1 && run.jobs <= MAX_CARGO_JOBS)) bad.push(`jobs (must be an integer from 1 to ${MAX_CARGO_JOBS})`);
   if (run.batch !== undefined) bad.push(...batchReceiptProblems(run.batch, evidence, tree ?? null).map((problem) => `batch: ${problem}`));
   return bad;
 }
 
-// Returns { ok, missing[] }. Pure apart from the injected git/readFile.
-export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+function gateResult(missing, evidence) {
+  const result = { ok: missing.length === 0, missing };
+  Object.defineProperty(result, "evidence", { value: evidence });
+  return Object.freeze(result);
+}
+
+/** Validate supplied evidence against caller-authenticated source identity, without reading Git or files.
+ * The caller owns authentication of expected.commit/tree and requiredHosts (for example, committed CI policy).
+ * Evidence cannot relax host requirements: only an explicit, nonempty subset supplied by the caller can.
+ * This proves receipt contents only; it makes no claim about working-tree cleanliness or receipt provenance. */
+export function validatePublicationEvidence({ expected = {}, evidence, artifactBytes }) {
+  const { kind, name, version, commit, tree } = expected;
   const missing = [];
-  const head = git(["rev-parse", "HEAD"], packagePath);
-  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
-  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
-  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
-  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
-  let evidence = null;
-  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
-    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  if (!["npm", "cargo", "swift"].includes(kind)) missing.push("expected kind must be npm, cargo or swift");
+  if (!text(name)) missing.push("expected name must be nonempty");
+  if (!SHA.test(String(commit ?? ""))) missing.push("expected commit is not a full 40-character SHA");
+  const defaults = requiredHosts(kind);
+  let hosts = defaults;
+  if (expected.requiredHosts !== undefined) {
+    const requested = expected.requiredHosts;
+    if (!(Array.isArray(requested) && requested.length > 0 && new Set(requested).size === requested.length
+      && Array.from(requested).every((host) => defaults.includes(host)))) {
+      missing.push(`expected requiredHosts must be a nonempty unique subset of ${defaults.join(", ")}`);
+    } else hosts = requested;
   }
-  if (evidence) {
+  if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) {
+    missing.push("gate evidence must be an object");
+  } else {
     if (evidence.schema !== GATE_SCHEMA) missing.push(`evidence schema must be ${GATE_SCHEMA}`);
     if (evidence.kind !== kind || evidence.name !== name) missing.push(`evidence is for ${evidence.kind}:${evidence.name}, expected ${kind}:${name}`);
     // A missing publishing version must refuse: a skipped comparison would qualify any evidence version.
     if (typeof version !== "string" || version.trim() === "") missing.push("publishing version is unknown (manifest has no literal version), cannot bind the receipt to it");
     else if (evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
     if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
-    else if (head && evidence.commit !== head) {
-      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
-    }
+    else if (SHA.test(String(commit ?? "")) && evidence.commit !== commit) missing.push(`evidence commit ${evidence.commit} != expected commit ${commit}`);
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
-    // A batch receipt is bound to the HEAD tree as well as the commit; read it only when a run carries one.
-    // `tree ?? null` below makes an unreadable tree fail the comparison (null never equals a 40-hex tree).
-    const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
-    if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
-    // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
-    // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
-    // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    const darwinOnly = (kind === "npm" || kind === "cargo") && isDarwinOnlyPolicy(evidence);
-    for (const host of darwinOnly ? ["darwin"] : requiredHosts(kind)) {
+    if (runs.some((run) => run?.batch !== undefined) && !SHA.test(String(tree ?? ""))) missing.push("expected tree is not a full 40-character SHA for batch evidence");
+    for (const host of hosts) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
@@ -172,9 +208,34 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
     if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
   }
   if (artifactBytes !== undefined && evidence && digestBytes(artifactBytes) !== evidence.artifactSha256) missing.push("artifact sha256 does not match evidence artifactSha256");
-  const result = { ok: missing.length === 0, missing };
-  Object.defineProperty(result, "evidence", { value: evidence });
-  return Object.freeze(result);
+  return gateResult(missing, evidence);
+}
+
+// Acquire local source identity and cleanliness, then use the same content validator as CI.
+export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+  const missing = [];
+  const head = git(["rev-parse", "HEAD"], packagePath);
+  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
+  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
+  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
+  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
+  let evidence = null;
+  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
+    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  }
+  const runs = Array.isArray(evidence?.runs) ? evidence.runs : [];
+  const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
+  if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
+  // Local publication retains its recorded single-host grant. CI callers own their policy separately.
+  const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
+  const result = validatePublicationEvidence({ expected: { kind, name, version, commit: head, tree,
+    ...(singleHost ? { requiredHosts: [singleHost] } : {}) }, evidence, artifactBytes });
+  for (const problem of result.missing) {
+    if (problem === `evidence commit ${evidence?.commit} != expected commit ${head}`) {
+      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
+    } else missing.push(problem);
+  }
+  return gateResult(missing, evidence);
 }
 
 // Enforce: throws on missing evidence unless dryRun (then reports and continues).
@@ -242,10 +303,10 @@ export function runNpmPreflight(argv, workspaceRoot = process.cwd(), deps = {})
   if (dryRun) throw new Error("--publish and --dry-run are mutually exclusive");
   if (!tarball) throw new Error("--publish requires --tarball <gated .tgz>");
   enforcePublicationGate(options);
-  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath }, deps);
+  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath, workspaceRoot }, deps);
 }
 
-export function publishGatedTarball({ name, version, tarball, evidencePath }, deps = {}) {
+export function publishGatedTarball({ name, version, tarball, evidencePath, workspaceRoot }, deps = {}) {
   const run = deps.spawnSync ?? spawnSync;
   const bytes = fs.readFileSync(tarball);
   const evidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
@@ -267,7 +328,8 @@ export function publishGatedTarball({ name, version, tarball, evidencePath }, de
   }
   const sha1 = crypto.createHash("sha1").update(bytes).digest("hex");
   verifyNpmRegistryBytes({ name, version, sha1 }, deps);
-  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version });
+  // Feed and consumer copies belong to the requested workspace, never to this module's own (possibly installed) location.
+  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version }, workspaceRoot ? workspaceFeedOptions(workspaceRoot) : undefined);
 }
 
 // CI and the authenticated helper share mandatory, fail-closed registry equality.

package/publish-cargo.mjs

@@ -2,11 +2,12 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath, provenGateSteps } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy, batchClippyMissingFeatureSets } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
+import { spawnSync } from "./background-process.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { recordPublished, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { readCargoPackage } from "./crate-graph.mjs";
 import { runtimeBudgetCheck, RUNTIME_BUDGET_CODE } from "./runtime-budgets.mjs";
 import { formatPreflight, PREFLIGHT_FAIL } from "./preflight.mjs";
@@ -23,7 +24,7 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const crate = valueAfter(argv, "--crate");
   if (!crate) throw new Error("publish cargo requires --crate <name>");
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(crate)) throw new Error(`invalid crate name: ${crate}`);
-  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence"]);
+  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence", "--from-evidence"]);
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!arg.startsWith("--")) continue;
@@ -33,12 +34,45 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const dryRun = argv.includes("--dry-run");
   const allowDirty = argv.includes("--allow-dirty");
   if (allowDirty && !dryRun) throw new Error("--allow-dirty is only valid with --dry-run");
+  const fromEvidence = valueAfter(argv, "--from-evidence");
+  if (argv.includes("--from-evidence") && (!fromEvidence || fromEvidence.startsWith("--"))) throw new Error("--from-evidence requires a gate evidence file");
+  if (fromEvidence && (dryRun || allowDirty || argv.includes("--evidence"))) throw new Error("--from-evidence cannot be combined with --dry-run, --allow-dirty or --evidence");
   return {
     crate,
     dryRun,
     allowDirty,
     workspaceRoot: path.resolve(valueAfter(argv, "--workspace") ?? cwd),
-    evidence: valueAfter(argv, "--evidence"),
+    evidence: fromEvidence ?? valueAfter(argv, "--evidence"),
+    ...(fromEvidence ? { fromEvidence: true } : {}),
+  };
+}
+
+const OFFLINE_CACHE_MISS = /(?:attempting to make an HTTP request, but --offline was specified|as a reminder, you're using offline mode(?: \(--offline\))?)/i;
+const OFFLINE_READ_ONLY_COMMANDS = new Set(["metadata", "package"]);
+
+/** Retry only a Cargo offline cache miss for metadata/package inspection, once with normal network access. */
+export async function runCargoReadOnly(args, settings, execute, onOfflineFailure = () => {}) {
+  const subcommand = args[0];
+  if (!OFFLINE_READ_ONLY_COMMANDS.has(subcommand) || !args.includes("--offline")) {
+    return execute("cargo", args, settings);
+  }
+  const first = await execute("cargo", args, settings);
+  if (!first.error && first.status === 0) return first;
+  const diagnostic = `${first.stdout ?? ""}\n${first.stderr ?? ""}`;
+  if (!OFFLINE_CACHE_MISS.test(diagnostic)) return first;
+  onOfflineFailure(first);
+  const retryArgs = args.filter((arg) => arg !== "--offline");
+  const retry = await execute("cargo", retryArgs, settings);
+  if (!retry.error && retry.status === 0) return { ...retry, usedOfflineFallback: true };
+  const labeled = (result) => String(result ?? "");
+  const stdout = `[offline attempt]\n${labeled(first.stdout)}\n[online retry]\n${labeled(retry.stdout)}`;
+  const stderr = `[offline attempt]\n${labeled(first.stderr)}\n[online retry]\n${labeled(retry.stderr)}`;
+  return {
+    ...retry,
+    stdout,
+    stderr,
+    ...(retry.error ? { error: new Error(`${retry.error.message}\n${stdout}\n${stderr}`) } : {}),
+    offlineFallbackFailed: true,
   };
 }
 
@@ -61,11 +95,13 @@ const PROVEN_STEP = Object.freeze({ "secret scan": "secretScan", format: "fmt",
  * already proves for this exact commit; the runtime budget, package contents, archive hash and registry steps
  * are never skippable. `verifyOnPublish` (real publish only) drops the separate registry dry-run and lets the
  * real `cargo publish` run Cargo's own verify build (no `--no-verify`), so the package compiles once, before
- * the upload, instead of in a dry-run and not at all in the publish.
+ * the upload, instead of in a dry-run and not at all in the publish. `packageVerified` is set only after
+ * explicit evidence reuse proves a successful standalone package verification; hash checking stays mandatory.
  */
-export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false }) {
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false, packageVerified = false, offlineReadOnly = false }) {
+  const offline = offlineReadOnly ? ["--offline"] : [];
   const dryRunArgs = ["publish", "--dry-run", "-p", crate];
-  const packageArgs = ["package", "--list", "-p", crate];
+  const packageArgs = ["package", "--list", ...offline, "-p", crate];
   if (allowDirty) dryRunArgs.push("--allow-dirty");
   if (allowDirty) packageArgs.push("--allow-dirty");
   const verifyHere = verifyOnPublish && !dryRun;
@@ -78,15 +114,18 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
-    ...(verifyHere ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
+    ...((verifyHere || packageVerified) ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
   ].filter((step) => !(PROVEN_STEP[step.label] && proven[PROVEN_STEP[step.label]] === true));
   if (!dryRun) plan.push(
     // `publish --dry-run` leaves its archive under target/package/tmp-crate on current Cargo; package
-    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads.
-    { label: "package archive", command: "cargo", args: ["package", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
-    { label: "package location", command: "cargo", args: ["metadata", "--format-version", "1", "--no-deps"], capture: true },
+    // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads. Always
+    // online and --locked, like qualification: offline packaging resolves the archive's Cargo.lock from
+    // only the .crate files already downloaded, so a sibling published since then silently resolves to an
+    // older version and the archive no longer matches its evidence hash.
+    { label: "package archive", command: "cargo", args: ["package", "--locked", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
+    { label: "package location", command: "cargo", args: ["metadata", ...offline, "--format-version", "1", "--no-deps"], capture: true },
     { label: "archive hash check", internal: "verify-archive" },
-    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", "--no-verify", "-p", crate] },
+    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", ...(packageVerified ? ["--locked"] : []), "--no-verify", "-p", crate] },
     { label: "registry readback", internal: "registry-readback" },
   );
   return plan;
@@ -108,7 +147,6 @@ export function scanCrateForSecrets(crateDir) {
       continue;
     }
     const bytes = fs.readFileSync(file);
-    if (bytes.includes(0)) continue;
     const text = bytes.toString("utf8");
     if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) violations.push(relative);
   }
@@ -130,11 +168,48 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   };
   const gate = (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { dryRun: options.dryRun });
   const expectedSha256 = gate.evidence?.artifactSha256;
-  // Only the local publisher (local-publish.mjs) sets `trustEvidenceSteps`: it ran the tests and clippy for this
-  // exact commit itself and wrote them into the evidence the gate above just validated. A plain publish proves
-  // nothing in advance, so `proven` stays empty and every step runs.
-  const proven = options.trustEvidenceSteps === true && !options.dryRun ? provenGateSteps(gate.evidence) : {};
-  const plan = buildCargoPublishPlan({ ...options, crateDir, proven, verifyOnPublish: options.verifyOnPublish === true });
+  // Explicit evidence reuse enters through the same gate: current commit, version, clean source, host runs
+  // and artifact digest must match. Windows evidence keeps its actual win32 host policy on the Mac.
+  const reuseEvidence = options.fromEvidence === true;
+  if (reuseEvidence && (options.dryRun || options.allowDirty || !options.evidence)) throw new Error("--from-evidence requires a real publish, clean source and explicit evidence");
+  const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
+  if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
+  if (reuseEvidence) {
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock", "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    // The gate config decides the steps replayed below, so an uncommitted edit would change what is demanded (0.4.1 review A3).
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
+    const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
+    const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
+    const command = `cargo package --locked -p ${options.crate}`;
+    if (!runs.length || !runs.every((run) => run.steps?.some((step) => step.ok === true && step.command === command))) {
+      throw new Error("--from-evidence requires a verified cargo package --locked receipt for this artifact");
+    }
+    // Load the shared planner after module initialization: local-publish itself imports this publisher.
+    // Validate the complete current qualification matrix, not merely one passing test and lint command.
+    const { localTestPlan } = await import("./local-publish.mjs");
+    let config;
+    try { config = JSON.parse(fs.readFileSync(path.join(options.workspaceRoot, "ci", "gate.config.json"), "utf8")); }
+    catch { throw new Error("--from-evidence cannot read current ci/gate.config.json"); }
+    for (const run of runs) {
+      if (!Array.isArray(run.steps) || run.steps.some((step) => step?.ok !== true || (step.failed ?? 0) !== 0)) {
+        throw new Error("--from-evidence refuses an unsuccessful qualification step");
+      }
+      const expected = localTestPlan({ kind: "cargo", unit: options.crate, dir: `crates/${options.crate}`, config, batch: Boolean(run.batch), platform: proofHost });
+      for (const step of expected.steps) {
+        const text = `${step.command} ${step.args.join(" ")}`;
+        if (!run.steps.some((row) => row.command === text && row.ok === true && (!step.test || (row.executed > 0 && row.failed === 0)))) {
+          throw new Error(`--from-evidence missing configured qualification step: ${text}`);
+        }
+      }
+      // A batch run's clippy lives in its batch receipt, which `expected` leaves out: demand one row per feature set (0.4.1 review A2).
+      if (run.batch) {
+        const missing = batchClippyMissingFeatureSets(run.batch, gate.evidence, config?.rust?.[options.crate]?.featureSets ?? [[]]);
+        if (missing.length) throw new Error(`--from-evidence missing batch clippy for feature set${missing.length === 1 ? "" : "s"}: ${missing.map((features) => features.join(" ") || "default").join("; ")}`);
+      }
+    }
+  }
+  const plan = buildCargoPublishPlan({ ...options, crateDir, proven,
+    verifyOnPublish: !reuseEvidence && options.verifyOnPublish === true, packageVerified: reuseEvidence, offlineReadOnly: options.offlineReadOnly === true });
   for (const [label, key] of Object.entries(PROVEN_STEP)) {
     if (proven[key] === true) process.stdout.write(`[right-release] cargo ${label}: proven by the gate evidence for this commit, not repeated\n`);
   }
@@ -178,21 +253,38 @@ export async function runCargoPublish(options, execute = (_command, args, settin
     }
     if (step.label === "registry publish") assertArtifactUnchanged(artifact);
     // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
-    const result = await execute(step.command, step.args, {
+    const isReadOnlyInspection = ["package contents", "package location"].includes(step.label);
+    const settings = {
       cwd: options.workspaceRoot,
       encoding: "utf8",
       windowsHide: true,
-      stdio: step.capture ? "pipe" : "inherit",
-    });
-    if (result.error) throw result.error;
+      stdio: step.capture || (options.offlineReadOnly === true && isReadOnlyInspection) ? "pipe" : "inherit",
+    };
+    const result = options.offlineReadOnly === true && isReadOnlyInspection
+      ? await runCargoReadOnly(step.args, settings, execute, (failed) => {
+        process.stderr.write(`[right-release] offline Cargo inspection missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`);
+      })
+      : await execute(step.command, step.args, settings);
+    if (result.error) {
+      if (result.offlineFallbackFailed) throw new Error(`${step.label} failed: ${result.error.message}`);
+      throw result.error;
+    }
     if (result.status !== 0) {
-      if (step.capture && result.stderr) process.stderr.write(result.stderr);
-      throw new Error(`${step.label} failed with exit code ${result.status}`);
+      if (result.offlineFallbackFailed || step.label === "package archive") {
+        if (result.stdout) process.stdout.write(result.stdout);
+        if (result.stderr) process.stderr.write(result.stderr);
+      } else if (step.capture && result.stderr) process.stderr.write(result.stderr);
+      const fallback = result.offlineFallbackFailed ? `\n${result.stdout ?? ""}\n${result.stderr ?? ""}` : "";
+      throw new Error(`${step.label} failed with exit code ${result.status}${fallback}`);
     }
     if (step.label === "package location") {
+      if (result.stderr) process.stderr.write(result.stderr);
       const metadata = JSON.parse(result.stdout);
       if (typeof metadata.target_directory !== "string" || !path.isAbsolute(metadata.target_directory)) throw new Error("invalid Cargo package target directory");
       targetDir = metadata.target_directory;
+    } else if (step.label === "package archive") {
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
     } else if (step.capture) {
       if (result.stderr) process.stderr.write(result.stderr);
       const files = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);
@@ -229,7 +321,7 @@ async function main() {
   const result = await runCargoPublish(options);
   process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
   if (!options.dryRun) {
-    recordPublished({ registry: "cargo", name: result.name, version: result.version });
+    recordPublished({ registry: "cargo", name: result.name, version: result.version }, workspaceFeedOptions(options.workspaceRoot));
   }
 }