@rightkit/release 0.4.0 → 0.5.0

package/pipeline-tools.mjs

@@ -0,0 +1,171 @@
+// M24 R3: the build, sign, notarize, package and upload tool inventory, and the text scanner that finds those tools in a pipeline
+// context (an app script, a package hook, a workflow step, a framework hook, a build.rs). Pure functions: no file access.
+//
+// Scope (Astra, M24 R3): the tools below are tracked when a pipeline context or a helper reachable from one runs them. Read-only
+// forms (`gh release view`, `codesign --verify`, `signtool verify`, `stapler validate`, `aws s3 ls`, ...) are not an upload or a
+// signature and are never reported. This is a static text scan: it proves nothing about what a native tool does, and ordinary
+// product runtime code (src/, crates) is never scanned by it, so there is no blanket ban on a product that happens to sign
+// or package something at runtime.
+
+/** The tool ids R3 inventories, with the pipeline stage each one acts in. */
+export const PIPELINE_TOOL_IDS = Object.freeze([
+  "codesign", "notarytool", "altool", "stapler", "signtool", "azuresigntool", "productbuild", "pkgbuild", "hdiutil", "create-dmg",
+  "makensis", "iscc", "wix", "wrangler", "rclone", "aws-s3", "gh-release", "cargo-publish", "npm-publish", "pnpm-publish",
+  "tauri-build", "xcode-archive",
+]);
+
+const READ_ONLY = (list) => (rest) => list.includes(String(rest[0] ?? "").toLowerCase());
+
+/** name (lowercased basename without a script or exe extension) -> classifier of the remaining argument tokens. */
+const RULES = [
+  { id: "codesign", stage: "sign", names: ["codesign"], flagged: (rest) => {
+    const flags = rest.filter((arg) => arg.startsWith("-"));
+    const signs = flags.some((arg) => /^(?:-s|--sign|-f|--force|--remove-signature)$/.test(arg));
+    const readsOnly = flags.some((arg) => /^(?:--verify|-v+|-d+v*|--display|--test-requirement|-r+-?|-h|--help)$/.test(arg));
+    return signs || !readsOnly;
+  } },
+  { id: "notarytool", stage: "notarize", names: ["notarytool"], flagged: (rest) => !READ_ONLY(["info", "log", "history", "--help", "--version", "help"])(rest) },
+  { id: "altool", stage: "notarize", names: ["altool"], flagged: () => true },
+  { id: "stapler", stage: "notarize", names: ["stapler"], flagged: (rest) => !READ_ONLY(["validate", "--help", "help"])(rest) },
+  { id: "signtool", stage: "sign", names: ["signtool"], flagged: (rest) => !READ_ONLY(["verify", "/?", "-?", "--help"])(rest) },
+  { id: "azuresigntool", stage: "sign", names: ["azuresigntool", "trusted-signing-cli"], flagged: () => true },
+  { id: "productbuild", stage: "package", names: ["productbuild", "productsign"], flagged: () => true },
+  { id: "pkgbuild", stage: "package", names: ["pkgbuild"], flagged: () => true },
+  { id: "hdiutil", stage: "package", names: ["hdiutil"], flagged: (rest) => READ_ONLY(["create", "convert", "makehybrid", "resize", "compact", "burn"])(rest) },
+  { id: "create-dmg", stage: "package", names: ["create-dmg"], flagged: () => true },
+  { id: "makensis", stage: "package", names: ["makensis"], flagged: () => true },
+  { id: "iscc", stage: "package", names: ["iscc"], flagged: () => true },
+  { id: "wix", stage: "package", names: ["candle"], flagged: () => true },
+  { id: "wix", stage: "package", names: ["wix"], flagged: (rest) => READ_ONLY(["build", "msi", "burn", "convert", "extension"])(rest) },
+  { id: "wix", stage: "package", names: ["light"], flagged: (rest) => rest.some((arg) => /\.(?:wixobj|wxs|wixlib)$/i.test(arg) || /^-out$/i.test(arg)) },
+  { id: "wrangler", stage: "upload", names: ["wrangler"], flagged: (rest) => !READ_ONLY(["--version", "-v", "whoami", "--help", "-h"])(rest) },
+  { id: "rclone", stage: "upload", names: ["rclone"], flagged: (rest) => !READ_ONLY(["ls", "lsf", "lsd", "lsl", "lsjson", "size", "check", "version", "listremotes", "about", "cat", "--version", "--help"])(rest) },
+  { id: "aws-s3", stage: "upload", names: ["aws"], flagged: (rest) => (rest[0] === "s3" && !["ls", "help"].includes(String(rest[1] ?? "")))
+    || (rest[0] === "s3api" && /^(?:put-|create-multipart-upload|upload-part|complete-multipart-upload|copy-object|delete-)/.test(String(rest[1] ?? ""))) },
+  { id: "gh-release", stage: "upload", names: ["gh"], flagged: (rest) => rest[0] === "release" && ["create", "upload", "edit", "delete", "delete-asset"].includes(String(rest[1] ?? "")) },
+  { id: "cargo-publish", stage: "upload", names: ["cargo"], flagged: (rest) => rest[0] === "publish" || (rest[0] === "tauri" && ["build", "bundle", "signer"].includes(String(rest[1] ?? ""))) },
+  { id: "tauri-build", stage: "build", names: ["cargo-tauri"], flagged: (rest) => ["build", "bundle", "signer"].includes(String(rest[0] ?? "")) },
+  { id: "npm-publish", stage: "upload", names: ["npm"], flagged: (rest) => rest[0] === "publish" },
+  { id: "pnpm-publish", stage: "upload", names: ["pnpm"], flagged: (rest) => rest[0] === "publish" },
+  { id: "npm-publish", stage: "upload", names: ["yarn"], flagged: (rest) => rest[0] === "publish" || (rest[0] === "npm" && rest[1] === "publish") },
+  { id: "tauri-build", stage: "build", names: ["tauri"], flagged: (rest) => ["build", "bundle", "signer"].includes(String(rest[0] ?? "")) },
+  { id: "xcode-archive", stage: "package", names: ["xcodebuild"], flagged: (rest) => rest.some((arg) => /^(?:archive|-exportArchive|-archivePath|-exportOptionsPlist)$/.test(arg)) },
+];
+
+/** `rightkit cargo publish` reaches the same crates.io upload through the managed client. */
+const MANAGED_CLIENT_RULE = { id: "cargo-publish", stage: "upload" };
+
+/** Wrapper words that run another command: skipped so the tool behind them is the one classified. */
+const WRAPPERS = new Set(["sudo", "env", "time", "command", "exec", "call", "start", "nohup", "xcrun", "npx", "corepack", "pwsh", "powershell", "bash", "sh", "zsh", "cmd", "node", "python", "python3", "py"]);
+
+const stripQuotes = (token) => String(token).replace(/^[\s"'`@&]+|[\s"'`,;]+$/g, "");
+export const commandBaseName = (token) => stripQuotes(token).split(/[\\/]/).pop().toLowerCase().replace(/\.(?:exe|cmd|bat|ps1|sh|com|command)$/i, "");
+
+/** Split one script line into command segments at the shell operators. */
+export function splitSegments(line) {
+  return String(line).split(/&&|\|\||\$\(|[;|&`()]/).map((part) => part.trim()).filter(Boolean);
+}
+
+/** Tokens of one segment after the leading VAR=value assignments and wrapper words. */
+export function segmentTokens(segment) {
+  let tokens = segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  tokens = tokens.map((token) => token.replace(/^["']|["']$/g, ""));
+  while (tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) tokens = tokens.slice(1);
+  for (let guard = 0; guard < 8 && tokens.length; guard += 1) {
+    const name = commandBaseName(tokens[0]);
+    if (name === "pnpm" && (tokens[1] === "exec" || tokens[1] === "dlx")) { tokens = tokens.slice(2); continue; }
+    if (name === "npm" && tokens[1] === "exec") { const dash = tokens.indexOf("--"); tokens = dash >= 0 ? tokens.slice(dash + 1) : tokens.slice(2); continue; }
+    if (WRAPPERS.has(name) && tokens.length > 1) {
+      // Interpreters and shells run a script, not another tool, unless they take -c/-Command text: keep scanning the rest.
+      tokens = tokens.slice(1).filter((token, index) => !(index === 0 && /^-+(?:c|command|noprofile|nologo|noninteractive|executionpolicy|file|f|e|s)$/i.test(token)));
+      // `bash -c "tool args"` and `powershell -Command "tool args"`: the quoted text is the command line.
+      if (tokens.length && /\s/.test(tokens[0])) tokens = [...tokens[0].trim().split(/\s+/), ...tokens.slice(1)];
+      continue;
+    }
+    break;
+  }
+  return tokens;
+}
+
+/** Classify one command's tokens against the R3 inventory: `{ id, stage, tool }` for a pipeline tool run in a write form, else null. */
+export function classifyTokens(tokens) {
+  if (!tokens.length) return null;
+  const name = commandBaseName(tokens[0]);
+  const rest = tokens.slice(1);
+  if (name === "rightkit" && rest[0] === "cargo" && rest[1] === "publish") return { ...MANAGED_CLIENT_RULE, tool: "rightkit cargo publish" };
+  for (const rule of RULES) {
+    if (rule.names.includes(name) && rule.flagged(rest)) return { id: rule.id, stage: rule.stage, tool: [name, ...rest.slice(0, 2)].join(" ").trim() };
+  }
+  return null;
+}
+
+/** True when the tokens run RightKit's own pipeline CLI or managed client (a generator must never dispatch another pipeline). */
+export function dispatchesRightKit(tokens) {
+  if (!tokens.length) return false;
+  const name = commandBaseName(tokens[0]);
+  if (name === "rightkit" || name === "right-release") return true;
+  return tokens.some((token) => /(?:^|[\\/])(?:@rightkit[\\/]release[\\/]cli[\\/]right-release|right-release)(?:\.mjs)?$/i.test(token));
+}
+
+const YAML_RUN_PREFIX = /^\s*(?:-\s+)?(?:run|script|command)\s*:\s*[|>]?[-+]?\s*/;
+const COMMENT_LINE = /^\s*(?:#|\/\/|::|rem\s|@rem\s)/i;
+
+/**
+ * Pipeline tool matches in the text of a shell-like source (a script, a hook, a workflow). `kind`:
+ *  - "shell": every line is read as a command line (sh, ps1, bat, cmd, command, yml run steps, a package.json script value);
+ *  - "code": quoted tool names in a js/mjs/py/rs source (`spawnSync("codesign", ...)`), qualified by the next literals.
+ * Returns `[{ line, id, stage, tool, text }]` (1-based lines).
+ */
+export function scanTextForPipelineTools(text, { kind = "shell" } = {}) {
+  const found = [];
+  const lines = String(text).split(/\r?\n/);
+  if (kind === "code") {
+    const names = new Map();
+    for (const rule of RULES) for (const name of rule.names) names.set(name, rule);
+    lines.forEach((line, index) => {
+      if (COMMENT_LINE.test(line)) return;
+      for (const literal of line.matchAll(/["'`]([^"'`\n]{1,200})["'`]/g)) {
+        const tokens = literal[1].trim().split(/\s+/);
+        const first = commandBaseName(tokens[0]);
+        const rule = names.get(first) ?? (first === "rightkit" ? MANAGED_CLIENT_RULE : null);
+        if (!rule) continue;
+        // The arguments are the rest of this literal, then the next few literals of the same call (an argv array).
+        const tail = line.slice(literal.index + literal[0].length, literal.index + literal[0].length + 240);
+        const following = [...tail.matchAll(/["'`]([^"'`\n]{0,120})["'`]/g)].map((match) => match[1]);
+        const rest = [...tokens.slice(1), ...following].map((arg) => arg.trim()).filter(Boolean);
+        const hit = first === "rightkit" ? classifyTokens([first, ...rest]) : rule.flagged(rest) ? { id: rule.id, stage: rule.stage, tool: first } : null;
+        if (hit) found.push({ line: index + 1, ...hit, text: line.trim().slice(0, 160) });
+      }
+    });
+    return found;
+  }
+  lines.forEach((line, index) => {
+    if (COMMENT_LINE.test(line)) return;
+    const body = line.replace(YAML_RUN_PREFIX, "");
+    for (const segment of splitSegments(body)) {
+      const hit = classifyTokens(segmentTokens(segment));
+      if (hit) found.push({ line: index + 1, ...hit, text: line.trim().slice(0, 160) });
+    }
+  });
+  return found;
+}
+
+/** GitHub Actions that build, sign or upload on their own (R3: the same tools behind an action). */
+export const PIPELINE_ACTIONS = Object.freeze([
+  { pattern: /^tauri-apps\/tauri-action(?:@|$)/i, id: "tauri-build", stage: "build" },
+  { pattern: /^apple-actions\//i, id: "codesign", stage: "sign" },
+  { pattern: /^azure\/(?:trusted-signing-action|artifact-signing-action)(?:@|$)/i, id: "azuresigntool", stage: "sign" },
+  { pattern: /^cloudflare\/wrangler-action(?:@|$)/i, id: "wrangler", stage: "upload" },
+  { pattern: /^softprops\/action-gh-release(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^ncipollo\/release-action(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^svenstaro\/upload-release-action(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^actions\/upload-release-asset(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^shogo82148\/actions-upload-release-asset(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^jakejarvis\/s3-sync-action(?:@|$)/i, id: "aws-s3", stage: "upload" },
+]);
+
+export function classifyAction(uses) {
+  const value = String(uses).trim().replace(/^["']|["']$/g, "");
+  for (const entry of PIPELINE_ACTIONS) if (entry.pattern.test(value)) return { id: entry.id, stage: entry.stage, tool: value };
+  return null;
+}

package/production-mode.mjs

@@ -0,0 +1,42 @@
+// The release frontend build always resolves in production mode (M12: `@rightkit/license/testing` and
+// other development-only conditional exports must not resolve into a release bundle). Release build
+// children get NODE_ENV=production, which Vite's build honours ahead of a `.env` NODE_ENV and of any
+// custom `--mode` (vite.dev/guide/env-and-mode, "NODE_ENV and Modes"). What the pin cannot override is
+// a config that lists the `development` resolve condition explicitly, so the preflight refuses that.
+// Package installs keep the caller's NODE_ENV (production would drop devDependencies).
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+const SKIP_DIRS = new Set(["node_modules", "target", "dist", ".git", "src-tauri", "build", "out"]);
+const VITE_CONFIG = /^vite\.config\.(?:[cm]?[jt]s)$/;
+
+export function productionBuildEnv(env) {
+  return { ...env, NODE_ENV: "production" };
+}
+
+function walk(dir, depth, visit) {
+  let names;
+  try { names = readdirSync(dir); } catch { return; }
+  for (const name of names) {
+    const full = path.join(dir, name);
+    let stat;
+    try { stat = statSync(full); } catch { continue; }
+    if (stat.isDirectory()) {
+      if (depth > 0 && !SKIP_DIRS.has(name) && !name.startsWith(".")) walk(full, depth - 1, visit);
+    } else visit(name, full);
+  }
+}
+
+/** Vite configs that would resolve development-only exports even in a production build. A text scan:
+ * a computed conditions array is not seen (the post-build web-bundle marker scan is the backstop). */
+export function productionModeProblems({ appRoot, depth = 3 }) {
+  const problems = [];
+  if (!appRoot || !existsSync(appRoot)) return problems;
+  walk(appRoot, depth, (name, full) => {
+    if (!VITE_CONFIG.test(name)) return;
+    if (/conditions\s*:\s*\[[^\]]*["'`]development["'`]/.test(readFileSync(full, "utf8"))) {
+      problems.push(`${path.relative(appRoot, full)} lists a "development" resolve condition; a release build must not resolve development-only exports`);
+    }
+  });
+  return problems;
+}

package/publication-gate.mjs

@@ -8,7 +8,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { assertPublishCapability, refuseHostUpload } from "./host-upload-refusal.mjs";
+import { recordPublished, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { fileURLToPath } from "node:url";
 import { digestBytes, readVerifiedArtifact } from "./publication-artifacts.mjs";
 
@@ -93,6 +94,27 @@ export function batchReceiptProblems(batch, evidence, tree) {
   return problems;
 }
 
+/**
+ * Feature sets of this crate that a batch receipt did NOT lint (0.4.1 review A2). Batch mode lints each crate's tested
+ * feature sets in shared `-p a -p b` runs, so a receipt from before every set was linted (0.4.0: first set only)
+ * still satisfies `batchReceiptProblems`, which accepts any ONE clippy row covering the crate. Replay therefore
+ * needs one passing row per feature set: bound to the evidence commit and the batch tree, naming the crate (`-p <crate>`
+ * and `crates`), and ending `--no-deps --all-targets <features> -- -D warnings`. `featureSets` is the crate's
+ * `ci/gate.config.json` list (`[[]]` when unset). Returns the missing sets as argument arrays.
+ */
+export function batchClippyMissingFeatureSets(batch, evidence, featureSets) {
+  const rows = (Array.isArray(batch?.checks) ? batch.checks : []).filter((row) => row?.name === "clippy" && row.ok === true
+    && row.commit === evidence.commit && row.tree === batch.tree && Array.isArray(row.crates) && row.crates.includes(evidence.name) && text(row.command));
+  const sets = (Array.isArray(featureSets) && featureSets.length ? featureSets : [[]]).map((set) => (Array.isArray(set) ? set : []));
+  return sets.filter((features) => {
+    const tail = ` --no-deps --all-targets${features.length ? ` ${features.join(" ")}` : ""} -- -D warnings`;
+    return !rows.some((row) => {
+      const words = row.command.split(" ");
+      return row.command.endsWith(tail) && words.some((word, index) => word === "-p" && words[index + 1] === evidence.name);
+    });
+  });
+}
+
 /**
  * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
  * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
@@ -137,40 +159,44 @@ function invalidRunFields(run, evidence, tree) {
   return bad;
 }
 
-// Returns { ok, missing[] }. Pure apart from the injected git/readFile.
-export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+function gateResult(missing, evidence) {
+  const result = { ok: missing.length === 0, missing };
+  Object.defineProperty(result, "evidence", { value: evidence });
+  return Object.freeze(result);
+}
+
+/** Validate supplied evidence against caller-authenticated source identity, without reading Git or files.
+ * The caller owns authentication of expected.commit/tree and requiredHosts (for example, committed CI policy).
+ * Evidence cannot relax host requirements: only an explicit, nonempty subset supplied by the caller can.
+ * This proves receipt contents only; it makes no claim about working-tree cleanliness or receipt provenance. */
+export function validatePublicationEvidence({ expected = {}, evidence, artifactBytes }) {
+  const { kind, name, version, commit, tree } = expected;
   const missing = [];
-  const head = git(["rev-parse", "HEAD"], packagePath);
-  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
-  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
-  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
-  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
-  let evidence = null;
-  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
-    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  if (!["npm", "cargo", "swift"].includes(kind)) missing.push("expected kind must be npm, cargo or swift");
+  if (!text(name)) missing.push("expected name must be nonempty");
+  if (!SHA.test(String(commit ?? ""))) missing.push("expected commit is not a full 40-character SHA");
+  const defaults = requiredHosts(kind);
+  let hosts = defaults;
+  if (expected.requiredHosts !== undefined) {
+    const requested = expected.requiredHosts;
+    if (!(Array.isArray(requested) && requested.length > 0 && new Set(requested).size === requested.length
+      && Array.from(requested).every((host) => defaults.includes(host)))) {
+      missing.push(`expected requiredHosts must be a nonempty unique subset of ${defaults.join(", ")}`);
+    } else hosts = requested;
   }
-  if (evidence) {
+  if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) {
+    missing.push("gate evidence must be an object");
+  } else {
     if (evidence.schema !== GATE_SCHEMA) missing.push(`evidence schema must be ${GATE_SCHEMA}`);
     if (evidence.kind !== kind || evidence.name !== name) missing.push(`evidence is for ${evidence.kind}:${evidence.name}, expected ${kind}:${name}`);
     // A missing publishing version must refuse: a skipped comparison would qualify any evidence version.
     if (typeof version !== "string" || version.trim() === "") missing.push("publishing version is unknown (manifest has no literal version), cannot bind the receipt to it");
     else if (evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
     if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
-    else if (head && evidence.commit !== head) {
-      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
-    }
+    else if (SHA.test(String(commit ?? "")) && evidence.commit !== commit) missing.push(`evidence commit ${evidence.commit} != expected commit ${commit}`);
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
-    // A batch receipt is bound to the HEAD tree as well as the commit; read it only when a run carries one.
-    // `tree ?? null` below makes an unreadable tree fail the comparison (null never equals a 40-hex tree).
-    const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
-    if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
-    // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
-    // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
-    // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
-    // A crate published from the Windows host under the local-build grant records the symmetric
-    // hostPolicy "win32-only" + reason, and then the one required receipt is the Windows run.
-    const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
-    for (const host of singleHost ? [singleHost] : requiredHosts(kind)) {
+    if (runs.some((run) => run?.batch !== undefined) && !SHA.test(String(tree ?? ""))) missing.push("expected tree is not a full 40-character SHA for batch evidence");
+    for (const host of hosts) {
       const label = host === "darwin" ? "macOS" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
@@ -183,9 +209,34 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
     if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
   }
   if (artifactBytes !== undefined && evidence && digestBytes(artifactBytes) !== evidence.artifactSha256) missing.push("artifact sha256 does not match evidence artifactSha256");
-  const result = { ok: missing.length === 0, missing };
-  Object.defineProperty(result, "evidence", { value: evidence });
-  return Object.freeze(result);
+  return gateResult(missing, evidence);
+}
+
+// Acquire local source identity and cleanliness, then use the same content validator as CI.
+export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+  const missing = [];
+  const head = git(["rev-parse", "HEAD"], packagePath);
+  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
+  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
+  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
+  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
+  let evidence = null;
+  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
+    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  }
+  const runs = Array.isArray(evidence?.runs) ? evidence.runs : [];
+  const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
+  if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
+  // Local publication retains its recorded single-host grant. CI callers own their policy separately.
+  const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
+  const result = validatePublicationEvidence({ expected: { kind, name, version, commit: head, tree,
+    ...(singleHost ? { requiredHosts: [singleHost] } : {}) }, evidence, artifactBytes });
+  for (const problem of result.missing) {
+    if (problem === `evidence commit ${evidence?.commit} != expected commit ${head}`) {
+      missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
+    } else missing.push(problem);
+  }
+  return gateResult(missing, evidence);
 }
 
 // Enforce: throws on missing evidence unless dryRun (then reports and continues).
@@ -251,17 +302,27 @@ export function runNpmPreflight(argv, workspaceRoot = process.cwd(), deps = {})
     return;
   }
   if (dryRun) throw new Error("--publish and --dry-run are mutually exclusive");
+  // Host uploads are retired on every host with no environment override; publishGatedTarball stays for direct calls only.
+  refuseHostUpload("right-release publish npm --publish");
   if (!tarball) throw new Error("--publish requires --tarball <gated .tgz>");
   enforcePublicationGate(options);
-  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath }, deps);
+  publishGatedTarball({ name: pkg, version: manifest.version, tarball, evidencePath, workspaceRoot }, deps);
 }
 
-export function publishGatedTarball({ name, version, tarball, evidencePath }, deps = {}) {
+/**
+ * Publish one gated tarball. Exported for the reviewed publisher and its tests only: it reads registry credentials, so it refuses
+ * (HOST_UPLOAD_REFUSED) before reading anything unless `capability` is a publish capability (host-upload-refusal.mjs
+ * createPublishCapability) created from a validated admission that names this npm archive, and the bytes about to be sent must
+ * be the admitted archive's.
+ */
+export function publishGatedTarball({ name, version, tarball, evidencePath, workspaceRoot, capability }, deps = {}) {
+  assertPublishCapability(capability, { what: "publishGatedTarball", registry: "npm", name, version });
   const run = deps.spawnSync ?? spawnSync;
   const bytes = fs.readFileSync(tarball);
   const evidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
   const sha256 = crypto.createHash("sha256").update(bytes).digest("hex");
   if (sha256 !== evidence.artifactSha256) throw new Error(`tarball sha256 ${sha256} != evidence artifactSha256 ${evidence.artifactSha256}`);
+  assertPublishCapability(capability, { what: "publishGatedTarball", registry: "npm", name, version, sha256 });
   const token = deps.readToken ? deps.readToken() : readKeychainToken(run);
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-npm-publish-"));
   const userconfig = path.join(dir, "npmrc");
@@ -278,7 +339,8 @@ export function publishGatedTarball({ name, version, tarball, evidencePath }, de
   }
   const sha1 = crypto.createHash("sha1").update(bytes).digest("hex");
   verifyNpmRegistryBytes({ name, version, sha1 }, deps);
-  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version });
+  // Feed and consumer copies belong to the requested workspace, never to this module's own (possibly installed) location.
+  (deps.recordPublished ?? recordPublished)({ registry: "npm", name, version }, workspaceRoot ? workspaceFeedOptions(workspaceRoot) : undefined);
 }
 
 // CI and the authenticated helper share mandatory, fail-closed registry equality.

package/publish-cargo.mjs

@@ -2,12 +2,13 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps, singleHostOfPolicy, batchClippyMissingFeatureSets } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
+import { assertPublishCapability, refuseHostUpload } from "./host-upload-refusal.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { recordPublished, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { readCargoPackage } from "./crate-graph.mjs";
 import { runtimeBudgetCheck, RUNTIME_BUDGET_CODE } from "./runtime-budgets.mjs";
 import { formatPreflight, PREFLIGHT_FAIL } from "./preflight.mjs";
@@ -147,14 +148,19 @@ export function scanCrateForSecrets(crateDir) {
       continue;
     }
     const bytes = fs.readFileSync(file);
-    if (bytes.includes(0)) continue;
     const text = bytes.toString("utf8");
     if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) violations.push(relative);
   }
   return [...new Set(violations)].sort();
 }
 
+/**
+ * Package, qualify and (unless `options.dryRun`) publish one crate. A real publish is refused (HOST_UPLOAD_REFUSED) before anything
+ * runs unless `options.capability` is a publish capability (host-upload-refusal.mjs createPublishCapability) created from a
+ * validated admission that names this crate, and again before the registry upload unless the verified archive is the admitted one.
+ */
 export async function runCargoPublish(options, execute = (_command, args, settings) => runCargoSync(args, settings), deps = {}) {
+  if (!options.dryRun) assertPublishCapability(options.capability, { what: "runCargoPublish", registry: "crates", name: options.crate });
   const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
   const manifest = path.join(crateDir, "Cargo.toml");
   if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
@@ -176,8 +182,9 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
   if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
   if (reuseEvidence) {
-    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
-    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml and Cargo.lock");
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock", "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    // The gate config decides the steps replayed below, so an uncommitted edit would change what is demanded (0.4.1 review A3).
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
     const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
     const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
     const command = `cargo package --locked -p ${options.crate}`;
@@ -201,6 +208,11 @@ export async function runCargoPublish(options, execute = (_command, args, settin
           throw new Error(`--from-evidence missing configured qualification step: ${text}`);
         }
       }
+      // A batch run's clippy lives in its batch receipt, which `expected` leaves out: demand one row per feature set (0.4.1 review A2).
+      if (run.batch) {
+        const missing = batchClippyMissingFeatureSets(run.batch, gate.evidence, config?.rust?.[options.crate]?.featureSets ?? [[]]);
+        if (missing.length) throw new Error(`--from-evidence missing batch clippy for feature set${missing.length === 1 ? "" : "s"}: ${missing.map((features) => features.join(" ") || "default").join("; ")}`);
+      }
     }
   }
   const plan = buildCargoPublishPlan({ ...options, crateDir, proven,
@@ -246,7 +258,10 @@ export async function runCargoPublish(options, execute = (_command, args, settin
       publication = await verifyCargoRegistry({ name: options.crate, version: cargoVersion, sha256: artifact.sha256 }, deps);
       continue;
     }
-    if (step.label === "registry publish") assertArtifactUnchanged(artifact);
+    if (step.label === "registry publish") {
+      assertArtifactUnchanged(artifact);
+      assertPublishCapability(options.capability, { what: "runCargoPublish", registry: "crates", name: options.crate, version: cargoVersion, sha256: artifact.sha256 });
+    }
     // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
     const isReadOnlyInspection = ["package contents", "package location"].includes(step.label);
     const settings = {
@@ -313,10 +328,12 @@ function valueAfter(argv, flag) {
 
 async function main() {
   const options = parseCargoPublishArgs(process.argv.slice(2));
+  // Every non---dry-run call (including --from-evidence) is an upload: refused on every host, with no environment override.
+  if (!options.dryRun) refuseHostUpload("right-release publish cargo");
   const result = await runCargoPublish(options);
   process.stdout.write(`[right-release] ${options.dryRun ? "validated" : "published"} ${options.crate}\n`);
   if (!options.dryRun) {
-    recordPublished({ registry: "cargo", name: result.name, version: result.version });
+    recordPublished({ registry: "cargo", name: result.name, version: result.version }, workspaceFeedOptions(options.workspaceRoot));
   }
 }
 

package/publish-swift.mjs

@@ -1,5 +1,5 @@
 // Publish RightKitSwift by the ONE Swift distribution contract: a plain semver git tag on this
-// repository (github.com/Orthic-Labs/rightkit), resolved by apps through the root Package.swift
+// repository (the checkout's own origin, github.com/bogusyogi/rightkit), resolved by apps through the root Package.swift
 // (docs/RIGHTKIT-SHARED-PACKAGES.md, Swift section). There is no mirror and no second repository.
 //
 // `right-release publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]` verifies, in order:
@@ -19,7 +19,14 @@ import { spawnSync } from "./background-process.mjs";
 import { digestBytes } from "./publication-artifacts.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
-export const SWIFT_DISTRIBUTION_URL = "https://github.com/Orthic-Labs/rightkit";
+// The distribution URL is whatever repository this checkout's origin names (GITHUB_REPOSITORY when origin does not
+// parse); it is never a constant, so a repository move cannot leave a stale name in the success message.
+export function swiftDistributionUrl(origin, environment = process.env) {
+  const fromOrigin = /github\.com[:/]([\w.-]+\/[\w.-]+?)(?:\.git)?\/?$/i.exec(String(origin ?? "").trim())?.[1];
+  const fromEnvironment = /^[\w.-]+\/[\w.-]+$/.test(environment?.GITHUB_REPOSITORY ?? "") ? environment.GITHUB_REPOSITORY : null;
+  const repository = fromOrigin ?? fromEnvironment;
+  return repository ? `https://github.com/${repository}` : String(origin ?? "").trim();
+}
 const DRIFT_TEST = path.join("scripts", "swift-root-manifest.test.mjs");
 
 export function parseSwiftPublishArgs(argv) {
@@ -125,7 +132,9 @@ export function runSwiftPublish(options, execute = spawnSync) {
   catch (error) { git(["tag", "-d", version], toplevel, execute); throw error; }
   const remote = git(["ls-remote", "--tags", "origin", `refs/tags/${version}`], toplevel, execute);
   if (!remote.startsWith(sha)) throw new Error(`origin does not show tag ${version} at ${sha}`);
-  out(`tagged ${version} at ${sha} on ${SWIFT_DISTRIBUTION_URL}`);
+  let origin = "";
+  try { origin = git(["config", "--get", "remote.origin.url"], toplevel, execute); } catch { /* the tag is already verified on origin; the name is cosmetic */ }
+  out(`tagged ${version} at ${sha} on ${swiftDistributionUrl(origin, options.environment)}`);
   return { name, version, commit: sha, published: true };
 }
 

package/qa-control-scan.mjs

@@ -391,6 +391,10 @@ export const WEB_MOCK_MARKERS = Object.freeze([
   { id: "isBrowserQaMode", pattern: /isBrowserQaMode/ },
   { id: "MockDataSource", pattern: /MockDataSource/ },
   { id: "qa-build-flag", pattern: /\bVITE_[A-Z0-9_]*_QA\b/ },
+
+  // @rightkit/license/testing (M12): its sentinel value, and the subpath a bundle that kept the import still names.
+  { id: "license-testing-sentinel", pattern: /\bRIGHTKIT_LICENSE_TESTING_DO_NOT_SHIP\b/ },
+  { id: "license-testing-entry", pattern: /@rightkit\/license\/testing/ },
 ]);
 const WEB_EXTENSIONS = /\.(?:m?js|cjs|html?|css|map)$/i;