@rightkit/release 0.3.0 → 0.4.1

package/release-invocation.mjs

@@ -2,7 +2,7 @@ import { spawnSync } from "./background-process.mjs";
 import { resolveProjectType } from "./project-type.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import { declaredCargoManifest, hasDefaultTauriManifest, resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 
 function git(cwd, args) {
   const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
@@ -129,20 +129,128 @@ export function resolveConfiguredBuildInputs(config, target, label = "release co
   return configured;
 }
 
+/** The validated or raw iOS package spec of a target (`targets.ios.iosPackage`, or the recipe the build expands it to). */
+export function iosPackageSpecOf(target) {
+  if (target?.recipe?.kind === "iosPackage") return target.recipe.spec ?? {};
+  if (target?.iosPackage && typeof target.iosPackage === "object") return target.iosPackage;
+  return null;
+}
+
+/**
+ * Native iOS mode: an iOS target with iosPackage and no src-tauri/Cargo.toml (a declared nativeAssembly.cargoManifest does not
+ * leave it). The app is an xcodegen project built by xcodebuild, not a Tauri host: no broker target, no target bridge, no
+ * Tauri layout. A declared manifest only pins its Cargo.toml and Cargo.lock as inputs; iosPackage.prepare runs the cargo build.
+ * An iOS app that has src-tauri/Cargo.toml (Pulse) keeps the Cargo-backed behaviour exactly.
+ */
+export function isNativeIosTarget({ appRoot, target, exists } = {}) {
+  return iosPackageSpecOf(target) !== null && !hasDefaultTauriManifest({ appRoot, exists });
+}
+
+/**
+ * prepare commands exist to build the app's Rust static library. Without a declared nativeAssembly.cargoManifest the release
+ * would hash and seal none of that Rust source graph, so a native iOS target may not carry them.
+ */
+export function assertNativeIosPrepareHasManifest(iosSpec, config, appRoot) {
+  if (declaredCargoManifest(config)) {
+    const problems = nativeIosPrepareProblems({ appRoot, config, prepare: iosSpec?.prepare ?? [] });
+    if (problems.length) throw new Error(`iosPackage.prepare must be only bare cargo commands when a Rust manifest is declared; express the Rust build as cargo commands in prepare (no node, scripts, pnpm, python, rustup run, +toolchain or other manifest-path), so the features it enables can be checked and the release pins exactly the manifest it builds:\n- ${problems.join("\n- ")}`);
+    return;
+  }
+  if (Array.isArray(iosSpec?.prepare) && iosSpec.prepare.length > 0) {
+    throw new Error("targets.ios.iosPackage.prepare builds a Rust library but no Cargo manifest is declared; declare nativeAssembly.cargoManifest (and keep its Cargo.lock beside it, or name it with nativeAssembly.cargoLockPath) so the Rust manifest and lock are pinned as required release inputs");
+  }
+}
+
+const FEATURE_FLAGS = new Set(["--features", "-F", "--feature"]);
+// The only cargo subcommands a native iOS prepare may run: each takes --features and builds exactly one manifest. xtask, aliases
+// (which .cargo/config.toml can point anywhere) and cargo-<custom> subcommands are opaque to the feature scan.
+const PREPARE_SUBCOMMANDS = new Set(["build", "rustc", "check"]);
+
+/**
+ * With a declared Rust manifest, every prepare command is a bare `cargo`: nothing else can be scanned for the features it enables
+ * or be trusted to build only the manifest the release pins. Returns the reasons a command is refused (empty when all are fine).
+ */
+export function nativeIosPrepareProblems({ appRoot, config, prepare = [] }) {
+  const declared = declaredCargoManifest(config);
+  if (!declared) return [];
+  const manifest = path.resolve(appRoot, declared);
+  const problems = [];
+  prepare.forEach((command, index) => {
+    const where = `targets.ios.iosPackage.prepare[${index}] (${command?.cmd})`;
+    if (command?.cmd !== "cargo") { problems.push(`${where} is not a bare cargo command`); return; }
+    const args = (command.args ?? []).map(String);
+    if (args[0]?.startsWith("+")) problems.push(`${where} selects a toolchain with ${args[0]}`);
+    else if (!PREPARE_SUBCOMMANDS.has(args[0])) problems.push(`${where} runs cargo ${args[0] ?? "(no subcommand)"}; only cargo build, rustc and check are allowed (no xtask, alias or cargo-<custom> subcommand)`);
+    const cwd = path.resolve(appRoot, command.cwd ?? ".");
+    let manifestPathSeen = false;
+    args.forEach((arg, position) => {
+      if (arg === "--config" || arg.startsWith("--config=")) problems.push(`${where} passes ${arg.split("=")[0]}, which can change what cargo builds`);
+      if (arg === "-Z" || /^-Z.+/.test(arg)) problems.push(`${where} passes the unstable flag ${arg.split("=")[0]}`);
+      if (arg === "--target-dir" || arg.startsWith("--target-dir=")) problems.push(`${where} passes --target-dir; build output goes where the release expects it`);
+      const pathValue = arg === "--manifest-path" ? args[position + 1] : arg.startsWith("--manifest-path=") ? arg.slice("--manifest-path=".length) : undefined;
+      if (pathValue !== undefined) manifestPathSeen = true;
+      if (pathValue !== undefined && path.relative(path.resolve(cwd, pathValue), manifest) !== "") problems.push(`${where} builds ${pathValue}, not the declared manifest ${declared}`);
+      const featureValue = FEATURE_FLAGS.has(arg) ? args[position + 1] : arg.startsWith("--features=") ? arg.slice("--features=".length) : /^-F.+/.test(arg) ? arg.slice(2) : undefined;
+      if (featureValue !== undefined && /[$%`]/.test(featureValue)) problems.push(`${where} selects features from a variable (${arg}); the Cargo features it enables cannot be determined`);
+    });
+    // No cwd fallback: cargo would otherwise build whatever Cargo.toml the working directory holds.
+    if (!manifestPathSeen) problems.push(`${where} has no --manifest-path; pass --manifest-path ${declared} so it builds exactly the declared manifest`);
+    // The lock is hashed before prepare runs; without --locked cargo may rewrite it and build different dependencies.
+    if (!args.some((arg) => arg === "--locked" || arg === "--frozen")) problems.push(`${where} has no --locked; pass --locked so cargo builds exactly the pinned Cargo.lock`);
+  });
+  return problems;
+}
+
+/** The repo-relative-to-app Package.resolved an iosPackage with trusted Swift macros/plugins pins, or null when it trusts none. */
+export function iosTrustPackageResolved(iosSpec) {
+  const listed = (value) => Array.isArray(value) && value.length > 0;
+  if (!listed(iosSpec?.trustedSwiftMacros) && !listed(iosSpec?.trustedSwiftPlugins)) return null;
+  if (typeof iosSpec.packageResolved === "string" && iosSpec.packageResolved) return iosSpec.packageResolved;
+  if (typeof iosSpec.project !== "string" || !iosSpec.project) return null;
+  return path.posix.join(iosSpec.project.replaceAll("\\", "/"), "project.xcworkspace", "xcshareddata", "swiftpm", "Package.resolved");
+}
+
+const outside = (root, file) => { const relative = path.relative(root, file); return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative); };
+
 export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
   const swift = resolveProjectType({ appRoot, config, target }) === "swiftpm";
-  const nativeLayout = resolveNativeCargoLayout({
-    appRoot,
-    config,
-    requireManifest: !swift,
-    requireLock: !swift,
-  });
+  const iosSpec = iosPackageSpecOf(target);
+  const nativeIos = !swift && isNativeIosTarget({ appRoot, target });
+  if (nativeIos) assertNativeIosPrepareHasManifest(iosSpec, config, appRoot);
+  // Native iOS: a declared manifest is resolved only to pin its Cargo.toml and lock (refused when there is no lock, or when
+  // either lies outside the repository). The returned layout is null, so no consumer links a broker target or bridges a cargo target.
+  const declaredManifest = nativeIos ? declaredCargoManifest(config) : undefined;
+  if (declaredManifest && outside(repoRoot, path.resolve(appRoot, declaredManifest))) throw new Error(`declared Cargo manifest ${declaredManifest} is outside the repository ${repoRoot}; a release pins only sources it can seal`);
+  const pinnedLayout = nativeIos
+    ? (declaredManifest ? resolveNativeCargoLayout({ appRoot, config, requireManifest: true, requireLock: true, repoRoot }) : null)
+    : resolveNativeCargoLayout({
+      appRoot,
+      config,
+      requireManifest: !swift,
+      requireLock: !swift,
+    });
+  if (nativeIos && pinnedLayout && outside(repoRoot, pinnedLayout.lockPath)) throw new Error(`Cargo.lock ${pinnedLayout.lockPath} is outside the repository ${repoRoot}; a release pins only sources it can seal`);
+  const nativeLayout = nativeIos ? null : pinnedLayout;
+  const optionalIfPresent = (names) => names.map((f) => path.join(appRoot, f)).filter((f) => existsSync(f));
+  // The xcodegen spec is an input whenever iosPackage names one (a declared-but-missing spec is refused below).
+  // Only native iOS mode: an iOS app with src-tauri keeps exactly its pre-existing input set.
+  const iosProjectSpec = nativeIos && typeof iosSpec?.projectSpec === "string" && iosSpec.projectSpec ? [path.resolve(appRoot, iosSpec.projectSpec)] : [];
+  // Reviewed Swift macro/plugin trust (iosPackage.trustedSwiftMacros / trustedSwiftPlugins): the Package.resolved holding the pins is a
+  // required, hashed, git-tracked release input on both iOS paths (native and src-tauri). Without a list nothing is added.
+  const packageResolvedInput = iosTrustPackageResolved(iosSpec);
+  if (packageResolvedInput && outside(repoRoot, path.resolve(appRoot, packageResolvedInput))) throw new Error(`Package.resolved ${packageResolvedInput} is outside the repository ${repoRoot}; a release pins only sources it can seal`);
+  const iosPackageResolved = packageResolvedInput ? [path.resolve(appRoot, packageResolvedInput)] : [];
   const requiredInputs = [
     configPath,
     ...(swift
       // SwiftPM: Package.swift is required; Package.resolved and the Node manifests only when they exist.
-      ? [path.join(appRoot, "Package.swift"), ...["Package.resolved", "package.json", "pnpm-lock.yaml"].map((f) => path.join(appRoot, f)).filter((f) => existsSync(f))]
+      ? [path.join(appRoot, "Package.swift"), ...optionalIfPresent(["Package.resolved", "package.json", "pnpm-lock.yaml"])]
+      : nativeIos
+      // Native iOS: package.json and pnpm-lock.yaml only when the app has them, plus the declared Cargo manifest and its lock.
+      ? [...optionalIfPresent(["package.json", "pnpm-lock.yaml"]), ...(pinnedLayout ? [pinnedLayout.manifestPath, pinnedLayout.lockPath] : [])]
       : [path.join(appRoot, "package.json"), path.join(appRoot, "pnpm-lock.yaml"), nativeLayout.manifestPath, nativeLayout.lockPath]),
+    ...iosProjectSpec,
+    ...iosPackageResolved,
     ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
   ].filter((file, index, files) => files.indexOf(file) === index);
   for (const file of requiredInputs) {
@@ -162,6 +270,8 @@ export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, confi
   return {
     requiredInputs,
     nativeLayout,
+    // The Cargo.lock a native iOS app pins (its layout is null by design); preflight checks it like any other lock.
+    cargoLockPaths: nativeIos && pinnedLayout ? [pinnedLayout.lockPath] : [],
     buildInputs: {
       include: configured.include.map(qualify),
       exclude: (configured.exclude ?? []).map(qualify),

package/release-switch-registry.json

@@ -1,33 +1,132 @@
 {
   "schema": 1,
   "owner": "rightkit-daemon::mode (D4, ratified)",
-  "forbiddenFeatures": ["test-mode", "qa-native", "dev-native", "qa-control", "dev-inspect"],
+  "forbiddenFeatures": [
+    "test-mode",
+    "qa-native",
+    "dev-native",
+    "qa-control",
+    "dev-inspect",
+    "testing",
+    "test-seams",
+    "isolated-test-keychain",
+    "demo",
+    "dev-overrides",
+    "qa-probes",
+    "dev-worker-override",
+    "qa-shot",
+    "qa-tools",
+    "dev-control",
+    "bench-native",
+    "rightkit-qa/control"
+  ],
   "testModeMarker": "RIGHTKIT-TEST-MODE-COMPILED",
   "denyNames": [
-    { "name": "RIGHTKIT_QA_NATIVE", "class": "S1" },
-    { "name": "RIGHTKIT_QA_HIDDEN", "class": "S1" },
-    { "name": "RIGHTKIT_QA_DATA_DIR", "class": "S4" },
-    { "name": "RIGHTKIT_QA_BACKGROUND", "class": "S1" },
-    { "name": "RIGHTKIT_UNDER_TEST", "class": "S1" },
-    { "name": "RIGHTKIT_SUITE_ROOT", "class": "S4" },
-    { "name": "RIGHT_SUITE_DIR", "class": "S4" },
-    { "name": "ORTHIC_SHARED_DIR", "class": "S4" },
-    { "name": "RIGHTKIT_CONTROL_SERVICE", "class": "S3" },
-    { "name": "HEARDRIGHT_ENGINE_TEST_MODE", "class": "S1" },
-    { "name": "HR_APP_DATA_DIR", "class": "S4" },
-    { "name": "MAILRIGHT_DATA_DIR", "class": "S4" },
-    { "name": "MAILRIGHT_EMBED_MODEL_DIR", "class": "S3" },
-    { "name": "MAILRIGHT_ONNXRUNTIME_DYLIB", "class": "S3" },
-    { "name": "CUTRIGHT_DATA_DIR", "class": "S4" },
-    { "name": "GENRIGHT_QA", "class": "S1" },
-    { "name": "GENRIGHT_APP_DATA", "class": "S4" },
-    { "name": "GENRIGHT_SD_SERVER", "class": "S3" },
-    { "name": "CODERIGHT_HOME", "class": "S4" },
-    { "name": "POSTRIGHT_ROLE=daemon-dev", "class": "S1" },
-    { "name": "RIGHTAPP_ENGINE_BIN", "class": "S3" },
-    { "name": "LIGHTCRAFT_SAM3_DIR", "class": "S3" },
-    { "name": "LIGHTCRAFT_DEVICE_ROOTS", "class": "S3" },
-    { "name": "--qa", "class": "S1" },
-    { "name": "--demo", "class": "S1" }
-  ]
+    {
+      "name": "RIGHTKIT_QA_NATIVE",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_QA_HIDDEN",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_QA_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "RIGHTKIT_QA_BACKGROUND",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_UNDER_TEST",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTKIT_SUITE_ROOT",
+      "class": "S4"
+    },
+    {
+      "name": "RIGHT_SUITE_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "ORTHIC_SHARED_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "RIGHTKIT_CONTROL_SERVICE",
+      "class": "S3"
+    },
+    {
+      "name": "HEARDRIGHT_ENGINE_TEST_MODE",
+      "class": "S1"
+    },
+    {
+      "name": "HR_APP_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "MAILRIGHT_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "MAILRIGHT_EMBED_MODEL_DIR",
+      "class": "S3"
+    },
+    {
+      "name": "MAILRIGHT_ONNXRUNTIME_DYLIB",
+      "class": "S3"
+    },
+    {
+      "name": "CUTRIGHT_DATA_DIR",
+      "class": "S4"
+    },
+    {
+      "name": "GENRIGHT_QA",
+      "class": "S1"
+    },
+    {
+      "name": "GENRIGHT_APP_DATA",
+      "class": "S4"
+    },
+    {
+      "name": "GENRIGHT_SD_SERVER",
+      "class": "S3"
+    },
+    {
+      "name": "CODERIGHT_HOME",
+      "class": "S4"
+    },
+    {
+      "name": "POSTRIGHT_ROLE=daemon-dev",
+      "class": "S1"
+    },
+    {
+      "name": "RIGHTAPP_ENGINE_BIN",
+      "class": "S3"
+    },
+    {
+      "name": "LIGHTCRAFT_SAM3_DIR",
+      "class": "S3"
+    },
+    {
+      "name": "LIGHTCRAFT_DEVICE_ROOTS",
+      "class": "S3"
+    },
+    {
+      "name": "--qa",
+      "class": "S1"
+    },
+    {
+      "name": "--demo",
+      "class": "S1"
+    }
+  ],
+  "conditionalForbiddenFeatures": {
+    "content-only": [
+      "devtools",
+      "content-devtools"
+    ]
+  }
 }

package/release-switch-scan.mjs

@@ -36,7 +36,7 @@
 //         "channel": "env",                               // env | argv | settings | preference | frontend
 //         "anchor": "src/test_mode.rs:97",                // where it is read (informational)
 //         "compiledOut": "feature:test-mode",             // required for S1-S4: feature:<name> | cfg:test |
-//                                                         // cfg:debug_assertions (read exists only there)
+//                                                         // cfg:debug_assertions | swift:DEBUG (read exists only there)
 //         "valueType": "bool",                            // required for S6: bool | int | enum
 //         "userGesture": true,                            // required for S5: chosen by a user gesture
 //         "note": "free text" } ],
@@ -54,7 +54,8 @@ const CHUNK = 4 * 1024 * 1024;
 const FORBIDDEN_CLASSES = new Set(["S1", "S2", "S3", "S4"]);
 const CLASSES = new Set(["S1", "S2", "S3", "S4", "S5", "S6"]);
 const CHANNELS = new Set(["env", "argv", "settings", "preference", "frontend"]);
-const COMPILED_OUT = /^(feature:[A-Za-z0-9_-]+|cfg:test|cfg:debug_assertions)$/;
+// `swift:DEBUG`: the read sits inside `#if DEBUG`, which an Xcode Release configuration compiles out.
+const COMPILED_OUT = /^(feature:[A-Za-z0-9_-]+|cfg:test|cfg:debug_assertions|swift:DEBUG)$/;
 
 export const REGISTRY = JSON.parse(readFileSync(new URL("./release-switch-registry.json", import.meta.url), "utf8"));
 
@@ -64,12 +65,13 @@ export const REGISTRY = JSON.parse(readFileSync(new URL("./release-switch-regist
 // `cargo tree -e features` lines look like: `├── rightkit-daemon feature "test-mode"` (possibly `(*)` suffixed).
 const FEATURE_LINE = /^[\s│├└─|`+\\-]*([A-Za-z0-9_][A-Za-z0-9_-]*)(?: v[^\s]+)? feature "([^"]+)"/;
 
-export function featureClosureFindings(treeText, { forbidden = REGISTRY.forbiddenFeatures } = {}) {
+export function featureClosureFindings(treeText, { forbidden = [...REGISTRY.forbiddenFeatures, ...REGISTRY.conditionalForbiddenFeatures["content-only"]], allowDevtools = false } = {}) {
   const deny = new Set(forbidden);
   const findings = []; const seen = new Set();
   for (const line of String(treeText).split(/\r?\n/)) {
     const m = FEATURE_LINE.exec(line);
-    if (!m || !deny.has(m[2])) continue;
+    if (!m || (!deny.has(m[2]) && !deny.has(`${m[1]}/${m[2]}`))) continue;
+    if (allowDevtools && REGISTRY.conditionalForbiddenFeatures["content-only"].includes(m[2])) continue;
     const id = `forbidden-feature ${m[2]}`;
     const key = `${m[1]}/${m[2]}`;
     if (seen.has(key)) continue;
@@ -82,22 +84,60 @@ export function featureClosureFindings(treeText, { forbidden = REGISTRY.forbidde
 // M7 lane E: rightkit-daemon `remote` (the HTTPS host with tokio, axum and hyper) may enter a release graph only for an app
 // that declares `releaseSwitches.remoteHost: true` (the Hetzner Pulse and PostRight server builds). `testing` implies `remote`,
 // so it is caught by the same line. Fail-closed: a value other than a boolean throws, and `false` or an absent key refuses.
+// PK17-2: a `remote` that appears ONLY beneath the daemon `remote-loopback` feature (the loopback feature enables the shared
+// router and auth internals) is not a host declaration; that case is judged by `remoteLoopbackFindings`, not here. Any other
+// path to `remote` (a direct request, `testing`, another crate's feature) is still refused exactly as before.
 export const REMOTE_SERVICE_CRATE = "rightkit-daemon";
 export const REMOTE_SERVICE_FEATURE = "remote";
+export const REMOTE_LOOPBACK_FEATURE = "remote-loopback";
+
+// Feature lines of a `cargo tree -e features` text with their parent. Default `--prefix indent` output indents each level by
+// four columns (`├── `, `│   `, `    `; `--charset ascii` keeps the width), so depth is the prefix width / 4 and the parent is
+// the nearest earlier line one level up. A flat tree (`--prefix none`) has depth 0 everywhere, so no feature has a parent and
+// every parent-dependent rule treats it as the direct (stricter) case: this fails closed.
+const TREE_PREFIX = /^[\s│├└─|`+\\-]*/;
+function featureTreeEntries(treeText) {
+  const entries = []; const stack = [];
+  for (const line of String(treeText).split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    const depth = Math.floor(TREE_PREFIX.exec(line)[0].length / 4);
+    const m = FEATURE_LINE.exec(line);
+    const entry = { crate: m ? m[1] : null, feature: m ? m[2] : null, parent: depth > 0 ? (stack[depth - 1] ?? null) : null };
+    stack[depth] = entry; stack.length = depth + 1;
+    if (m) entries.push(entry);
+  }
+  return entries;
+}
+const impliedByLoopback = (entry) => entry.parent?.crate === REMOTE_SERVICE_CRATE && entry.parent?.feature === REMOTE_LOOPBACK_FEATURE;
+
 export function remoteServiceFindings(treeText, { remoteHost = false } = {}) {
   if (typeof remoteHost !== "boolean") throw new Error(`releaseSwitches.remoteHost must be true or false, got ${JSON.stringify(remoteHost)}`);
   if (remoteHost) return [];
   const findings = []; const seen = new Set();
-  for (const line of String(treeText).split(/\r?\n/)) {
-    const m = FEATURE_LINE.exec(line);
-    if (!m || m[1] !== REMOTE_SERVICE_CRATE || m[2] !== REMOTE_SERVICE_FEATURE || seen.has(m[1])) continue;
-    seen.add(m[1]);
+  for (const entry of featureTreeEntries(treeText)) {
+    if (entry.crate !== REMOTE_SERVICE_CRATE || entry.feature !== REMOTE_SERVICE_FEATURE || seen.has(entry.crate) || impliedByLoopback(entry)) continue;
+    seen.add(entry.crate);
     const id = "remote-feature-undeclared";
     findings.push({ layer: "feature-closure", rule: id, file: "<cargo tree>", reason: `${id}: crate \`${REMOTE_SERVICE_CRATE}\` has feature \`${REMOTE_SERVICE_FEATURE}\` enabled in the resolved graph, but the app does not declare releaseSwitches.remoteHost: true (only Pulse and PostRight server builds may enable it)` });
   }
   return findings;
 }
 
+// PK17-2 / PK06-5: the daemon loopback feature (CodeRight's loopback HTTP + bearer host, loopback-only bind) is its own release
+// declaration, `releaseSwitches.remoteLoopback: true`, distinct from `remoteHost`. Neither declaration implies the other: a server
+// build with `remoteHost: true` still needs `remoteLoopback: true` to ship the loopback feature, and a loopback app that also
+// enables `remote` on its own still needs `remoteHost: true`. Same fail-closed boolean rule as `remoteHost`.
+export function remoteLoopbackFindings(treeText, { remoteLoopback = false } = {}) {
+  if (typeof remoteLoopback !== "boolean") throw new Error(`releaseSwitches.remoteLoopback must be true or false, got ${JSON.stringify(remoteLoopback)}`);
+  if (remoteLoopback) return [];
+  for (const entry of featureTreeEntries(treeText)) {
+    if (entry.crate !== REMOTE_SERVICE_CRATE || entry.feature !== REMOTE_LOOPBACK_FEATURE) continue;
+    const id = "remote-loopback-undeclared";
+    return [{ layer: "feature-closure", rule: id, file: "<cargo tree>", reason: `${id}: crate \`${REMOTE_SERVICE_CRATE}\` has feature \`${REMOTE_LOOPBACK_FEATURE}\` enabled in the resolved graph, but the app does not declare releaseSwitches.remoteLoopback: true (only a headless engine build that serves its own loopback API may enable it; releaseSwitches.remoteHost does not cover it)` }];
+  }
+  return [];
+}
+
 // A build command (shell string or { cmd, args }) as one flat token list, whole arguments plus their shell re-tokenisation.
 export function commandTokens(command) {
   const parts = typeof command === "string" ? [command] : [command?.cmd, ...(command?.args ?? [])].filter((v) => v !== undefined).map(String);
@@ -191,7 +231,7 @@ export function inventoryDenyNames(inventoryText) {
 }
 
 // Findings for a build command (`--features test-mode`, `-F`, `--all-features`, ...). Uses the existing tokenizer.
-export function commandSwitchFindings(argv, { forbidden = REGISTRY.forbiddenFeatures } = {}) {
+export function commandSwitchFindings(argv, { forbidden = [...REGISTRY.forbiddenFeatures, ...REGISTRY.conditionalForbiddenFeatures["content-only"]], allowDevtools = false } = {}) {
   const deny = new Set(forbidden);
   const tokens = argv;
   const enabled = []; let all = false;
@@ -206,7 +246,8 @@ export function commandSwitchFindings(argv, { forbidden = REGISTRY.forbiddenFeat
   const findings = [];
   for (const item of enabled) {
     const name = item.includes("/") ? item.slice(item.lastIndexOf("/") + 1) : item;
-    if (deny.has(name)) findings.push({ layer: "feature-closure", rule: `forbidden-feature ${name}`, file: "<command>", reason: `forbidden-feature ${name}: build command enables \`${item}\`` });
+    if (allowDevtools && REGISTRY.conditionalForbiddenFeatures["content-only"].includes(name)) continue;
+    if (deny.has(name) || deny.has(item.replace("?/", "/"))) findings.push({ layer: "feature-closure", rule: `forbidden-feature ${name}`, file: "<command>", reason: `forbidden-feature ${name}: build command enables \`${item}\`` });
   }
   if (all) findings.push({ layer: "feature-closure", rule: "forbidden-feature all-features", file: "<command>", reason: "forbidden-feature all-features: build command enables every feature, including test-mode" });
   return findings;
@@ -218,7 +259,7 @@ export function commandSwitchFindings(argv, { forbidden = REGISTRY.forbiddenFeat
 export function parseInventory(text, label = "switches.json") {
   const issues = [];
   let doc;
-  try { doc = JSON.parse(text); } catch (error) { return { doc: null, issues: [{ rule: "inventory-invalid", file: label, reason: `inventory-invalid: ${label} is not valid JSON (${error.message})` }] }; }
+  try { doc = JSON.parse(text); } catch (error) { return { doc: null, issues: [{ layer: "inventory", rule: "inventory-invalid", file: label, reason: `inventory-invalid: ${label} is not valid JSON (${error.message})` }] }; }
   const bad = (reason) => issues.push({ layer: "inventory", rule: "inventory-invalid", file: label, reason: `inventory-invalid: ${reason}` });
   if (doc?.schema !== 1) bad("`schema` must be 1");
   if (typeof doc?.app !== "string" || !doc.app) bad("`app` must be a non-empty string");
@@ -233,7 +274,7 @@ export function parseInventory(text, label = "switches.json") {
     if (!CHANNELS.has(entry.channel)) bad(`${where}: \`channel\` must be one of ${[...CHANNELS].join(", ")}`);
     if (FORBIDDEN_CLASSES.has(entry.class)) {
       if (typeof entry.compiledOut !== "string" || !COMPILED_OUT.test(entry.compiledOut)) {
-        issues.push({ layer: "inventory", rule: "not-compiled-out", file: label, reason: `not-compiled-out: ${where} is class ${entry.class} and must declare \`compiledOut\` as feature:<name>, cfg:test or cfg:debug_assertions (release builds may not contain it)` });
+        issues.push({ layer: "inventory", rule: "not-compiled-out", file: label, reason: `not-compiled-out: ${where} is class ${entry.class} and must declare \`compiledOut\` as feature:<name>, cfg:test, cfg:debug_assertions or swift:DEBUG (release builds may not contain it)` });
       }
     } else if (entry.class === "S6") {
       if (!["bool", "int", "enum"].includes(entry.valueType)) bad(`${where}: class S6 needs a bounded \`valueType\` (bool, int or enum)`);
@@ -245,13 +286,20 @@ export function parseInventory(text, label = "switches.json") {
 }
 
 const SOURCE_EXT = new Set([".rs", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".jsx", ".vue", ".svelte", ".swift", ".c", ".cc", ".cpp", ".h", ".m", ".mm"]);
-const SKIP_DIRS = new Set(["node_modules", "target", "dist", "build", ".git", "tests", "__tests__", "benches", "examples", "fixtures", "test", "coverage", ".vite"]);
+// Build output and fetched dependencies, never app source: the release recipe's own .right-release/ (Xcode DerivedData, whose
+// SourcePackages/checkouts holds whole dependency repositories), SwiftPM's .build and .swiftpm, and Xcode DerivedData anywhere.
+const SKIP_DIRS = new Set(["node_modules", "target", "dist", "build", ".git", "tests", "__tests__", "benches", "examples", "fixtures", "test", "coverage", ".vite", ".right-release", "deriveddata", "sourcepackages", ".build", ".swiftpm"]);
+// Swift/Xcode test bundles are capitalised (`Tests`, `UITests`, `<App>Tests`, `<App>UITests`): they are test code too.
+const skipDir = (name) => SKIP_DIRS.has(name.toLowerCase()) || /(?:^|[a-z0-9])(?:UI)?Tests$/.test(name);
 const TEST_FILE = /(\.test\.|\.spec\.|_tests?\.rs$|^tests?\.rs$)/;
 
+const CARGO_COMPILE_TIME = /\b(?:option_)?env!\(\s*"([^"]+)"/g;
+// Variables Cargo sets for every build script and crate compilation (the Cargo book, "Environment variables Cargo sets for crates").
+const CARGO_SET = /^(CARGO|CARGO_(PKG_[A-Z_]+|MANIFEST_DIR|MANIFEST_PATH|CRATE_NAME|BIN_NAME|BIN_EXE_[A-Za-z0-9_-]+|PRIMARY_PACKAGE|TARGET_TMPDIR|RUSTC_CURRENT_DIR)|OUT_DIR)$/;
 // Reads of a literal name; group 1 is the name.
 const LITERAL_READS = [
   /\b(?:std::)?env::var(?:_os)?\(\s*"([^"]+)"\s*\)/g,
-  /\b(?:option_)?env!\(\s*"([^"]+)"/g,
+  CARGO_COMPILE_TIME,
   /\bgetenv\(\s*"([^"]+)"\s*\)/g,
   /process\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
   /process\.env\[\s*["']([^"']+)["']\s*\]/g,
@@ -287,7 +335,7 @@ function* walkSource(root) {
     for (const entry of entries) {
       const full = path.join(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
-      if (entry.isDirectory()) { if (!SKIP_DIRS.has(entry.name)) stack.push(full); continue; }
+      if (entry.isDirectory()) { if (!skipDir(entry.name)) stack.push(full); continue; }
       if (entry.isFile() && SOURCE_EXT.has(path.extname(entry.name)) && !TEST_FILE.test(entry.name)) yield full;
     }
   }
@@ -296,7 +344,7 @@ function* walkSource(root) {
 function lineOf(text, index) { let n = 1; for (let i = 0; i < index; i += 1) if (text.charCodeAt(i) === 10) n += 1; return n; }
 
 // inventoryText: contents of switches.json. Returns findings only.
-export function sourceSwitchFindings({ sourceRoot, inventoryText, inventoryLabel = "switches.json", extraDeny = [] }) {
+export function sourceSwitchFindings({ sourceRoot, sourceRoots, inventoryText, inventoryLabel = "switches.json", extraDeny = [] }) {
   const { doc, issues } = parseInventory(inventoryText, inventoryLabel);
   const findings = [...issues];
   if (!doc || !Array.isArray(doc.switches)) return findings;
@@ -304,7 +352,9 @@ export function sourceSwitchFindings({ sourceRoot, inventoryText, inventoryLabel
   const dynamicAllowed = new Set((doc.dynamicReads ?? []).map((d) => path.normalize(d.file)));
   const reads = new Set();
   const denyFlags = [...REGISTRY.denyNames, ...extraDeny.map((n) => ({ name: typeof n === "string" ? n : n.name }))].map((d) => d.name).filter((n) => n.startsWith("-"));
-  for (const file of walkSource(sourceRoot)) {
+  // `sourceRoots` (absolute directories) narrows the walk to what a target compiles; paths stay relative to `sourceRoot`.
+  const walkRoots = Array.isArray(sourceRoots) && sourceRoots.length ? sourceRoots : [sourceRoot];
+  for (const file of walkRoots.flatMap((walkRoot) => [...walkSource(walkRoot)])) {
     let text;
     try { text = readFileSync(file, "utf8"); } catch { continue; }
     const rel = path.relative(sourceRoot, file);
@@ -314,6 +364,9 @@ export function sourceSwitchFindings({ sourceRoot, inventoryText, inventoryLabel
       for (let m = pattern.exec(text); m; m = pattern.exec(text)) {
         const name = m[1];
         if (JS_BUILTINS.has(name) && /\.(ts|tsx|js|mjs|cjs|jsx|vue|svelte)$/.test(file)) continue;
+        // `env!`/`option_env!` of a name Cargo itself sets at compile time (CARGO_PKG_VERSION, CARGO_MANIFEST_DIR, ...) is
+        // not a switch: no caller can choose it. Any other compile-time name is still a read the builder could set.
+        if (pattern === CARGO_COMPILE_TIME && CARGO_SET.test(name)) continue;
         reads.add(name);
         if (!registered.has(name)) findings.push({ layer: "inventory", rule: "unregistered-read", file: `${rel}:${lineOf(text, m.index)}`, reason: `unregistered-read: \`${name}\` is read here but is not listed in ${inventoryLabel}` });
       }
@@ -430,18 +483,19 @@ export function scanSwitchPaths(paths, { denyMap = denyNamesFor() } = {}) {
 // Every layer is optional input; a layer given no input is skipped, except that `requireBinary` fails a scan that
 // found no native binary. `bypass: ["feature-closure"]` exists only for the negative fixtures that prove the binary
 // layer independently; release.mjs never passes it.
-export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, inventoryText, binaryPaths = [], appForbid = [], requireBinary = true, bypass = [], remoteHost } = {}) {
+export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, sourceRoots, inventoryText, binaryPaths = [], appForbid = [], requireBinary = true, bypass = [], remoteHost, remoteLoopback, devtools } = {}) {
   const findings = [];
   const bypassed = new Set(bypass);
   const denyMap = denyNamesFor({ appForbid: [...appForbid, ...(inventoryText != null ? inventoryDenyNames(inventoryText) : [])] });
   if (!bypassed.has("feature-closure")) {
     if (treeText != null) {
-      findings.push(...featureClosureFindings(treeText));
+      findings.push(...featureClosureFindings(treeText, { allowDevtools: devtools?.mode === "content-only" }));
       findings.push(...remoteServiceFindings(treeText, { remoteHost }));
+      findings.push(...remoteLoopbackFindings(treeText, { remoteLoopback }));
     }
-    for (const argv of commands) findings.push(...commandSwitchFindings(argv));
+    for (const argv of commands) findings.push(...commandSwitchFindings(argv, { allowDevtools: devtools?.mode === "content-only" }));
   }
-  if (sourceRoot && inventoryText != null) findings.push(...sourceSwitchFindings({ sourceRoot, inventoryText, extraDeny: appForbid }));
+  if (sourceRoot && inventoryText != null) findings.push(...sourceSwitchFindings({ sourceRoot, sourceRoots, inventoryText, extraDeny: appForbid }));
   let receipt = { files: [], binaries: 0 };
   if (binaryPaths.length) {
     const scanned = scanSwitchPaths(binaryPaths, { denyMap });
@@ -460,3 +514,16 @@ export function assertNoReleaseSwitches(input, label = "release") {
     + "Build release and update tiers without the `test-mode` feature, and register every environment read in the app's switches.json.",
   );
 }
+
+/** Local (path) packages in a `cargo tree` text under `root`: the directories of crates a target actually compiles. */
+export function localCrateDirsFromTree(treeText, root) {
+  const dirs = new Set();
+  const base = path.resolve(root);
+  // `name v1 (/abs/path)` and `name v1 (proc-macro) (/abs/path)`; a bare `(*)` or `(proc-macro)` is a marker, not a path.
+  for (const m of String(treeText ?? "").matchAll(/ v\S+(?: \(proc-macro\))? \(([^)]+)\)/g)) {
+    if (!path.isAbsolute(m[1])) continue;
+    const dir = path.resolve(m[1]);
+    if (dir === base || dir.startsWith(base + path.sep)) dirs.add(dir);
+  }
+  return [...dirs].sort();
+}