@rightkit/release 0.4.0 → 0.4.1

package/ownership-mandatory-set.json

@@ -2,8 +2,8 @@
   "schema": 1,
   "source": {
     "table": "private-audits/TABLE1-MANDATORY.md:56-78 (M1-M23 requirement catalog)",
-    "versions": "private-audits/inventory/REQUIRED-VERSIONS.md (source versions at rightkit HEAD a15e62fd, registry readback 2026-10-13)",
-    "note": "min = required version (source version at P1.7 HEAD). registryMax = highest registry version at readback; where registryMax < min the required version is not yet published, so every consumer fails until it ships."
+    "versions": "registry readback 2026-10-19 after the mandatory-set publish (#790): min = registryMax = the live version",
+    "note": "min = registryMax = the required version: the live registry version of the published mandatory set (#790). Raise both with each mandatory-set publish."
   },
   "defaultProfile": "desktop",
   "defaultApps": [
@@ -37,18 +37,20 @@
         {
           "name": "rightkit-tauri-shell",
           "ecosystem": "cargo",
-          "min": "0.3.0"
+          "min": "0.4.0",
+          "registryMax": "0.4.0"
         },
         {
           "name": "rightkit-device",
           "ecosystem": "cargo",
-          "min": "0.1.3"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         },
         {
           "name": "@rightkit/tauri",
           "ecosystem": "npm",
-          "min": "0.2.0",
-          "registryMax": "0.2.0"
+          "min": "0.2.3",
+          "registryMax": "0.2.3"
         }
       ]
     },
@@ -60,19 +62,20 @@
         {
           "name": "@rightkit/react-shell",
           "ecosystem": "npm",
-          "min": "0.6.4"
+          "min": "0.7.1",
+          "registryMax": "0.7.1"
         },
         {
           "name": "@rightkit/platform-ui",
           "ecosystem": "npm",
-          "min": "0.2.8",
-          "registryMax": "0.2.8"
+          "min": "0.4.0",
+          "registryMax": "0.4.0"
         },
         {
           "name": "@rightkit/theme",
           "ecosystem": "npm",
-          "min": "0.2.3",
-          "registryMax": "0.2.3"
+          "min": "0.3.1",
+          "registryMax": "0.3.1"
         }
       ]
     },
@@ -84,12 +87,14 @@
         {
           "name": "rightkit-job-queue",
           "ecosystem": "cargo",
-          "min": "0.3.0"
+          "min": "0.4.0",
+          "registryMax": "0.4.0"
         },
         {
           "name": "rightkit-child-process",
           "ecosystem": "cargo",
-          "min": "0.4.0"
+          "min": "0.5.2",
+          "registryMax": "0.5.2"
         }
       ]
     },
@@ -101,12 +106,14 @@
         {
           "name": "rightkit-job-queue",
           "ecosystem": "cargo",
-          "min": "0.3.0"
+          "min": "0.4.0",
+          "registryMax": "0.4.0"
         },
         {
           "name": "rightkit-sidecar",
           "ecosystem": "cargo",
-          "min": "0.2.0"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         }
       ]
     },
@@ -118,7 +125,8 @@
         {
           "name": "rightkit-child-process",
           "ecosystem": "cargo",
-          "min": "0.4.0"
+          "min": "0.5.2",
+          "registryMax": "0.5.2"
         }
       ]
     },
@@ -130,7 +138,8 @@
         {
           "name": "rightkit-daemon",
           "ecosystem": "cargo",
-          "min": "0.2.0"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         }
       ]
     },
@@ -142,7 +151,8 @@
         {
           "name": "rightkit-daemon",
           "ecosystem": "cargo",
-          "min": "0.2.0"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         }
       ]
     },
@@ -154,8 +164,8 @@
         {
           "name": "rightkit-fs",
           "ecosystem": "cargo",
-          "min": "0.4.0",
-          "registryMax": "0.4.1"
+          "min": "0.4.4",
+          "registryMax": "0.4.4"
         }
       ]
     },
@@ -167,8 +177,8 @@
         {
           "name": "rightkit-db",
           "ecosystem": "cargo",
-          "min": "0.4.0",
-          "registryMax": "0.4.0"
+          "min": "0.5.0",
+          "registryMax": "0.5.0"
         }
       ]
     },
@@ -180,13 +190,14 @@
         {
           "name": "rightkit-app-settings",
           "ecosystem": "cargo",
-          "min": "0.2.0"
+          "min": "0.2.4",
+          "registryMax": "0.2.4"
         },
         {
           "name": "@rightkit/settings-ui",
           "ecosystem": "npm",
-          "min": "0.4.4",
-          "registryMax": "0.4.4"
+          "min": "0.6.1",
+          "registryMax": "0.6.1"
         }
       ]
     },
@@ -198,7 +209,8 @@
         {
           "name": "rightkit-credentials",
           "ecosystem": "cargo",
-          "min": "0.2.0"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         }
       ]
     },
@@ -210,19 +222,20 @@
         {
           "name": "rightkit-license",
           "ecosystem": "cargo",
-          "min": "0.2.0",
-          "registryMax": "0.2.0"
+          "min": "0.2.3",
+          "registryMax": "0.2.3"
         },
         {
           "name": "rightkit-device",
           "ecosystem": "cargo",
-          "min": "0.1.3"
+          "min": "0.3.0",
+          "registryMax": "0.3.0"
         },
         {
           "name": "@rightkit/license",
           "ecosystem": "npm",
-          "min": "0.2.0",
-          "registryMax": "0.2.0"
+          "min": "0.2.1",
+          "registryMax": "0.2.1"
         }
       ]
     },
@@ -234,8 +247,8 @@
         {
           "name": "rightkit-license",
           "ecosystem": "cargo",
-          "min": "0.2.0",
-          "registryMax": "0.2.0"
+          "min": "0.2.3",
+          "registryMax": "0.2.3"
         }
       ]
     },
@@ -247,20 +260,20 @@
         {
           "name": "@rightkit/legal",
           "ecosystem": "npm",
-          "min": "0.3.1",
-          "registryMax": "0.3.1"
+          "min": "0.6.1",
+          "registryMax": "0.6.1"
         },
         {
           "name": "@rightkit/legal-ui",
           "ecosystem": "npm",
-          "min": "0.2.2",
-          "registryMax": "0.2.2"
+          "min": "0.4.0",
+          "registryMax": "0.4.0"
         },
         {
           "name": "@rightkit/onboarding",
           "ecosystem": "npm",
-          "min": "0.3.3",
-          "registryMax": "0.3.3"
+          "min": "0.6.1",
+          "registryMax": "0.6.1"
         }
       ]
     },
@@ -272,14 +285,14 @@
         {
           "name": "rightkit-logs",
           "ecosystem": "cargo",
-          "min": "0.3.0",
-          "registryMax": "0.3.0"
+          "min": "0.3.3",
+          "registryMax": "0.3.3"
         },
         {
           "name": "@rightkit/logs",
           "ecosystem": "npm",
-          "min": "0.1.4",
-          "registryMax": "0.1.4"
+          "min": "0.1.5",
+          "registryMax": "0.1.5"
         }
       ]
     },
@@ -291,8 +304,8 @@
         {
           "name": "rightkit-crash",
           "ecosystem": "cargo",
-          "min": "0.2.2",
-          "registryMax": "0.3.0"
+          "min": "0.3.3",
+          "registryMax": "0.3.3"
         }
       ]
     },
@@ -304,8 +317,8 @@
         {
           "name": "rightkit-http",
           "ecosystem": "cargo",
-          "min": "0.3.0",
-          "registryMax": "0.3.0"
+          "min": "0.3.6",
+          "registryMax": "0.3.6"
         }
       ]
     },
@@ -317,7 +330,8 @@
         {
           "name": "@rightkit/app-update",
           "ecosystem": "npm",
-          "min": "0.2.5"
+          "min": "0.4.0",
+          "registryMax": "0.4.0"
         }
       ]
     },
@@ -329,8 +343,8 @@
         {
           "name": "@rightkit/release",
           "ecosystem": "npm",
-          "min": "0.2.153",
-          "registryMax": "0.2.165",
+          "min": "0.4.0",
+          "registryMax": "0.4.0",
           "allowDev": true
         }
       ]
@@ -343,29 +357,22 @@
         {
           "name": "rightkit-qa",
           "ecosystem": "cargo",
-          "min": "0.2.16",
-          "registryMax": "0.6.1",
-          "allowDev": true
-        },
-        {
-          "name": "rightkit-qa-driver",
-          "ecosystem": "cargo",
-          "min": "0.3.0",
-          "note": "deprecated shim; the QA owner is rightkit-qa with the `control` feature (Ember #280)",
+          "min": "0.7.0",
+          "registryMax": "0.7.0",
           "allowDev": true
         },
         {
           "name": "@rightkit/qa",
           "ecosystem": "npm",
-          "min": "0.4.8",
-          "registryMax": "0.4.8",
+          "min": "0.5.1",
+          "registryMax": "0.5.1",
           "allowDev": true
         },
         {
           "name": "@rightkit/qa-chrome",
           "ecosystem": "npm",
-          "min": "0.1.6",
-          "registryMax": "0.1.6",
+          "min": "0.1.8",
+          "registryMax": "0.1.8",
           "allowDev": true
         }
       ]
@@ -378,8 +385,8 @@
         {
           "name": "rightkit-agent-tools",
           "ecosystem": "cargo",
-          "min": "0.1.2",
-          "registryMax": "0.1.4"
+          "min": "0.2.0",
+          "registryMax": "0.2.0"
         }
       ]
     }
@@ -390,16 +397,59 @@
       "name": "Test mode",
       "profile": "desktop",
       "owners": [],
-      "ownerPending": "No selected owner (D4 unratified); never fails."
+      "ownerPending": "No selected owner (D4 unratified); never fails.",
+      "pendingOwners": [
+        {
+          "name": "rightkit-fs",
+          "ecosystem": "cargo",
+          "min": "0.4.4"
+        },
+        {
+          "name": "rightkit-daemon",
+          "ecosystem": "cargo",
+          "min": "0.3.0"
+        },
+        {
+          "name": "rightkit-qa",
+          "ecosystem": "cargo",
+          "min": "0.7.0",
+          "allowDev": true
+        }
+      ]
     },
     {
       "id": "M23",
       "name": "Release-time switches",
       "profile": "desktop",
       "owners": [],
-      "ownerPending": "No selected owner (D4 unratified); never fails."
+      "ownerPending": "No selected owner (D4 unratified); never fails.",
+      "pendingOwners": [
+        {
+          "name": "@rightkit/release",
+          "ecosystem": "npm",
+          "min": "0.4.0",
+          "allowDev": true
+        },
+        {
+          "name": "rightkit-daemon",
+          "ecosystem": "cargo",
+          "min": "0.3.0"
+        }
+      ]
     }
   ],
+  "applicabilityRecords": {
+    "M22": {
+      "name": "Agent surface",
+      "roles": [
+        "client",
+        "host",
+        "both",
+        "absent"
+      ],
+      "note": "Declared in <app>/rightkit-mandatory.json as M22: { role, entrypoints }. Report-only: a record never removes or adds a violation; only notApplicable (with a reason) removes a row."
+    }
+  },
   "appAmendments": {
     "ember": {
       "issue": "Orthic-Labs/rightkit#280",

package/ownership-mandatory-set.mjs

@@ -12,7 +12,14 @@
 //                                     [--amendment v2.1] [--enforce] [--json]
 //
 // App-side declaration (optional): <app>/rightkit-mandatory.json
-//   { "profile": "desktop", "notApplicable": { "M16": "reason text" } }
+//   { "profile": "desktop", "notApplicable": { "M16": "reason text" },
+//     "M22": { "role": "client|host|both|absent", "entrypoints": ["src-tauri/src/agent.rs#register_tools"] } }
+//
+// PK17.scanner (report only, never enforcement): rows M21 and M23 stay `ownerPending` and never fail, but each lists its
+// `pendingOwners` (M21: rightkit-fs, rightkit-daemon, rightkit-qa; M23: @rightkit/release, rightkit-daemon) and the report shows
+// how each app's declarations measure up (`pending[].candidateOwners`, `enforced: false`). Moving those owners into `rows` and
+// raising minimums is the separate activation step (PK17.activation). The M22 applicability record (PK15-2) is validated and
+// reported under `applicability.M22`; an invalid or contradictory record is a `problem`, which never changes the exit code.
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -231,9 +238,50 @@ function judge(req, facts) {
   return { ...base, status: "ok", declared: declaredAt, evidence: [] };
 }
 
+// An entrypoint is `<relative file>`, optionally `#<symbol>` or `::<symbol>`; a bare token with no path separator or extension
+// is a symbol or command name and is recorded unverified. A file part must stay inside the app root and exist.
+const entrypointFile = (entry) => entry.split(/#|::/)[0];
+const looksLikePath = (text) => /[\\/]/.test(text) || /\.[A-Za-z0-9]+$/.test(text);
+
+/** Validate one applicability record (`M22: { role, entrypoints }`); report-only, never throws. */
+export function validateApplicabilityRecord(id, raw, { spec, root }) {
+  const result = { row: id, status: "unrecorded", role: null, entrypoints: [], unverifiedEntrypoints: 0, problems: [] };
+  if (raw === undefined) return result;
+  const bad = (reason) => result.problems.push(`${id}: ${reason}`);
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) { bad("applicability record must be an object { role, entrypoints }"); result.status = "invalid"; return result; }
+  const extra = Object.keys(raw).filter((key) => key !== "role" && key !== "entrypoints");
+  if (extra.length) bad(`unknown applicability record key(s): ${extra.join(", ")}`);
+  const roles = spec?.roles ?? [];
+  if (!roles.includes(raw.role)) bad(`role must be one of ${roles.join("|")}, got ${JSON.stringify(raw.role)}`);
+  else result.role = raw.role;
+  if (!Array.isArray(raw.entrypoints)) bad("entrypoints must be an array");
+  else {
+    const seen = new Set();
+    for (const entry of raw.entrypoints) {
+      if (typeof entry !== "string" || !entry.trim()) { bad("every entrypoint must be a non-empty string"); continue; }
+      const text = entry.trim();
+      if (seen.has(text)) { bad(`entrypoint ${JSON.stringify(text)} is listed twice`); continue; }
+      seen.add(text);
+      result.entrypoints.push(text);
+      const file = entrypointFile(text);
+      if (!file) { bad(`entrypoint ${JSON.stringify(text)} names no file or symbol`); continue; }
+      if (!looksLikePath(file)) { result.unverifiedEntrypoints += 1; continue; }
+      const normalized = file.replace(/\\/g, "/");
+      if (path.isAbsolute(file) || /^[A-Za-z]:/.test(file) || normalized.split("/").includes("..")) { bad(`entrypoint ${JSON.stringify(text)} must be a relative path inside the app`); continue; }
+      let isFile = false;
+      try { isFile = statSync(path.join(root, normalized)).isFile(); } catch { /* missing */ }
+      if (!isFile) bad(`entrypoint ${JSON.stringify(text)}: file not found under the app root`);
+    }
+    if (result.role === "absent" && raw.entrypoints.length) bad("role absent must list no entrypoints");
+    if (result.role && result.role !== "absent" && !raw.entrypoints.length) bad(`role ${result.role} needs at least one real entrypoint`);
+  }
+  result.status = result.problems.length ? "invalid" : "recorded";
+  return result;
+}
+
 export function loadAppDeclaration(root, data) {
   const file = path.join(root, data.appDeclarationFile);
-  if (!existsSync(file)) return { profile: data.defaultProfile, notApplicable: {}, problems: [] };
+  if (!existsSync(file)) return { profile: data.defaultProfile, notApplicable: {}, records: {}, problems: [] };
   const problems = [];
   let doc = {};
   try { doc = JSON.parse(readFileSync(file, "utf8")); } catch (error) { problems.push(`${data.appDeclarationFile} unparseable: ${error.message}`); }
@@ -242,7 +290,9 @@ export function loadAppDeclaration(root, data) {
     if (typeof reason === "string" && reason.trim().length >= 10) notApplicable[id] = reason.trim();
     else problems.push(`${id}: N/A declaration needs a reason (>= 10 chars); ignored`);
   }
-  return { profile: doc.profile ?? data.defaultProfile, notApplicable, problems };
+  const records = {};
+  for (const id of Object.keys(data.applicabilityRecords ?? {})) if (doc && typeof doc === "object" && Object.hasOwn(doc, id)) records[id] = doc[id];
+  return { profile: doc.profile ?? data.defaultProfile, notApplicable, records, problems };
 }
 
 export function checkApp(root, { data = loadData(), profile, amendments = [] } = {}) {
@@ -263,11 +313,29 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
   }
   const notApplicable = Object.entries(declaration.notApplicable).map(([id, reason]) => ({ row: id, reason }));
   const applicable = rows.filter((r) => !(r.id in declaration.notApplicable));
-  const pending = data.pendingRows.filter((r) => r.profile === active).map((r) => ({ row: r.id, name: r.name, status: "owner-pending", note: r.ownerPending }));
   const manifests = findManifests(root).map((f) => readManifest(f, root));
   resolveWorkspaceInheritance(manifests);
   for (const m of manifests) if (m.error) problems.push(`${m.rel}: ${m.error}`);
   const facts = manifests.flatMap((m) => m.facts);
+  // Pending rows never fail. Their `pendingOwners` are judged like any owner and listed as `candidateOwners` (`enforced: false`)
+  // so the report shows what activation would find; the result is never counted in `violations`.
+  const pending = data.pendingRows.filter((r) => r.profile === active).map((r) => ({
+    row: r.id, name: r.name, status: "owner-pending", note: r.ownerPending,
+    candidateOwners: r.id in declaration.notApplicable ? [] : (r.pendingOwners ?? []).map((o) => {
+      const judged = judge({ ...o, rows: [r.id] }, facts);
+      return { owner: judged.owner, ecosystem: judged.ecosystem, rows: judged.rows, required: judged.required, declared: judged.declared, declarationStatus: judged.status, evidence: judged.evidence, enforced: false };
+    }),
+  }));
+  // Applicability records (PK15-2): validated and reported, never enforced.
+  const applicability = {};
+  for (const [id, spec] of Object.entries(data.applicabilityRecords ?? {})) {
+    const record = validateApplicabilityRecord(id, declaration.records[id], { spec, root });
+    applicability[id] = record;
+    problems.push(...record.problems);
+    const declaredNa = id in declaration.notApplicable;
+    if (record.role === "absent" && !declaredNa) problems.push(`${id}: applicability role is absent but notApplicable.${id} is not declared; the ${id} row still applies until the app declares it not applicable with a reason`);
+    if (record.role && record.role !== "absent" && declaredNa) problems.push(`${id}: notApplicable.${id} is declared but the applicability record says role ${record.role}`);
+  }
   const owners = [...requirements(applicable).values()].map((req) => { const result = judge(req, facts); return { ...result, declarationStatus: result.status }; });
   // A profile that is unknown, marked unratified, or has no rows checks nothing; an app may not select it, so it fails rather than passing empty.
   const profileStatus = !data.profiles[active] ? "unknown-profile" : (data.profiles[active].ratified === false || !data.rows.some((r) => r.profile === active)) ? "unratified" : null;
@@ -276,7 +344,7 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
     owners.push({ owner: `profile:${active}`, ecosystem: "profile", rows: [], required: "ratified profile", status: profileStatus, declared: null, evidence: ["an app may not select a profile that is not ratified"] });
   }
   const violations = owners.filter((o) => o.status !== "ok").length;
-  return { app: name, root, scanned: true, profile: active, manifests: manifests.length, owners, pending, notApplicable, problems, violations };
+  return { app: name, root, scanned: true, profile: active, manifests: manifests.length, owners, pending, applicability, notApplicable, problems, violations };
 }
 
 export function checkApps(roots, options = {}) {
@@ -292,6 +360,8 @@ export function renderText(report) {
     out.push("", `${app.app} [${app.profile}] ${app.scanned ? `ok=${count("ok")} missing=${count("missing")} below-required=${count("below-required")} not-on-registry=${count("not-on-registry")}` : "UNSCANNED"}`
       + (app.pending.length ? ` pending=${app.pending.map((p) => p.row).join(",")}` : "") + (app.notApplicable.length ? ` n/a=${app.notApplicable.map((n) => n.row).join(",")}` : ""));
     for (const o of app.owners.filter((x) => x.status !== "ok")) out.push(`  ${o.status.padEnd(15)} ${o.owner} (${o.rows.join(",")}) requires ${o.required}${o.declared ? `, declared ${o.declared}` : ""}${o.evidence.length ? ` — ${o.evidence.join("; ")}` : ""}`);
+    for (const p of app.pending) for (const c of p.candidateOwners ?? []) if (c.declarationStatus !== "ok") out.push(`  not-enforced    ${p.row} ${c.declarationStatus} ${c.owner} requires ${c.required}${c.declared ? `, declared ${c.declared}` : ""} (owner-pending: report only)`);
+    for (const record of Object.values(app.applicability ?? {})) if (record.status !== "unrecorded") out.push(`  applicability   ${record.row} ${record.status}${record.role ? ` role=${record.role}` : ""} entrypoints=${record.entrypoints.length}${record.unverifiedEntrypoints ? ` (${record.unverifiedEntrypoints} unverified symbol)` : ""}`);
     for (const n of app.notApplicable) out.push(`  n/a             ${n.row}: ${n.reason}`);
     for (const p of app.problems) out.push(`  problem         ${p}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",