@rightkit/release 0.4.0 → 0.5.0

package/runtime-budget-classes.json

@@ -21,6 +21,10 @@
       "ceilings": null,
       "requiredScale": null
     },
+    "rightkit-crash": {
+      "ceilings": null,
+      "requiredScale": null
+    },
     "rightkit-embed": {
       "ceilings": null,
       "requiredScale": null
@@ -41,6 +45,10 @@
       "ceilings": null,
       "requiredScale": null
     },
+    "rightkit-overlay-win": {
+      "ceilings": null,
+      "requiredScale": null
+    },
     "rightkit-record": {
       "ceilings": null,
       "requiredScale": null

package/runtime-budget-crates.mjs

@@ -0,0 +1,14 @@
+// The continuous owners that must carry a runtime budget (docs/RUNTIME-BUDGETS.md). Kept free of
+// dependencies so the secretless publish plan job can check the runtime proof table against it.
+export const RUNTIME_BUDGET_CRATES = Object.freeze([
+  "rightkit-fsindex",
+  "rightkit-file-watch",
+  "rightkit-job-queue",
+  "rightkit-daemon",
+  "rightkit-cache",
+  "rightkit-sync",
+  "rightkit-logs",
+  "rightkit-tauri-shell",
+  "rightkit-qa",
+  "rightkit-send",
+]);

package/runtime-budgets.mjs

@@ -59,6 +59,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { parse } from "smol-toml";
+import { RUNTIME_BUDGET_CRATES } from "./runtime-budget-crates.mjs";
 import { singleHostOfPolicy } from "./publication-gate.mjs";
 import { findWorkspaceRoot, lockClosure, pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
 
@@ -68,18 +69,7 @@ export const RUNTIME_BUDGET_FILE = "runtime-budget.json";
 export const RUNTIME_BUDGET_EVIDENCE_DIR = "runtime-budget.evidence";
 export const RUNTIME_BUDGET_SCHEMA = 1;
 
-export const RUNTIME_BUDGET_CRATES = Object.freeze([
-  "rightkit-fsindex",
-  "rightkit-file-watch",
-  "rightkit-job-queue",
-  "rightkit-daemon",
-  "rightkit-cache",
-  "rightkit-sync",
-  "rightkit-logs",
-  "rightkit-tauri-shell",
-  "rightkit-qa",
-  "rightkit-send",
-]);
+export { RUNTIME_BUDGET_CRATES };
 
 export const BUDGET_FIGURES = Object.freeze(["residentMemoryBytes", "idleCpuPercent", "wakeupsPerSecond", "diskOpsPerSecond"]);
 const FIGURE_LABEL = Object.freeze({
@@ -260,17 +250,86 @@ const posix = (p) => p.split(path.sep).join("/");
 /**
  * The git pathspecs (relative to the workspace root) whose change makes a measurement stale: the
  * crate's src, benches, Cargo.toml (features) and build.rs, plus src, Cargo.toml and build.rs of every
- * workspace crate it reaches through `path` dependencies (transitively). Returns { root, specs }.
+ * workspace crate it reaches through `path` dependencies (transitively). Returns { root, specs, problems }.
+ * Callers must refuse incomplete metadata rather than using a partial dependency scope.
  */
 export function measuredPathspecs(crateDir, deps = {}) {
-  const root = findWorkspaceRoot(crateDir, deps) ?? path.resolve(crateDir);
+  const { exists = existsSync, readFile = readFileSync } = deps;
+  const problems = [];
+  // Workspace discovery deliberately tolerates bad ancestor manifests elsewhere. Freshness cannot:
+  // a swallowed read/parse failure could hide inherited dependencies and shrink the measured graph.
+  const checkedRead = (file, encoding) => {
+    try {
+      const contents = readFile(file, encoding);
+      if (path.basename(file) === "Cargo.toml") parse(contents);
+      return contents;
+    } catch (error) {
+      problems.push(`cannot read dependency metadata ${file}: ${error.message}`);
+      throw error;
+    }
+  };
+  const checked = { exists, readFile: checkedRead };
+  let root = path.resolve(crateDir);
   const specs = [];
   const add = (dir, names) => { for (const name of names) specs.push(posix(path.relative(root, path.join(dir, name)))); };
-  add(path.resolve(crateDir), CRATE_PATHS);
-  let dependencies = [];
-  try { dependencies = pathDependencyDirs(crateDir, deps); } catch { /* unreadable manifest: the crate paths alone */ }
-  for (const dir of dependencies) add(dir, DEPENDENCY_PATHS);
-  return { root, specs: [...new Set(specs)] };
+  try {
+    root = findWorkspaceRoot(crateDir, checked) ?? root;
+    add(path.resolve(crateDir), CRATE_PATHS);
+    const dependencies = pathDependencyDirs(crateDir, checked);
+    const workspace = exists(path.join(root, "Cargo.toml")) ? parse(checkedRead(path.join(root, "Cargo.toml"), "utf8")).workspace : undefined;
+    for (const dir of [path.resolve(crateDir), ...dependencies]) {
+      const manifestPath = path.join(dir, "Cargo.toml");
+      if (!exists(manifestPath)) {
+        // A manifest-free standalone path has no Cargo graph. A declared path dependency must exist.
+        if (dir !== path.resolve(crateDir)) problems.push(`dependency manifest is missing: ${manifestPath}`);
+        continue;
+      }
+      const manifest = parse(checkedRead(manifestPath, "utf8"));
+      if (!nonEmpty(manifest.package?.name)) problems.push(`dependency manifest has no package.name: ${manifestPath}`);
+      const holders = [manifest, ...Object.values(manifest.target ?? {})];
+      for (const holder of holders) {
+        for (const key of ["dependencies", "build-dependencies", ...(dir === path.resolve(crateDir) ? ["dev-dependencies"] : [])]) {
+          for (const [name, spec] of Object.entries(holder?.[key] ?? {})) {
+            if (spec && typeof spec === "object" && spec.workspace === true && workspace?.dependencies?.[name] === undefined) {
+              problems.push(`workspace dependency ${name} cannot be resolved for ${manifestPath}`);
+            }
+          }
+        }
+      }
+    }
+    for (const dir of dependencies) add(dir, DEPENDENCY_PATHS);
+  } catch (error) {
+    if (!problems.length) problems.push(`cannot resolve measured dependency paths for ${crateDir}: ${error.message}`);
+  }
+  return { root, specs: [...new Set(specs)], problems: [...new Set(problems)] };
+}
+
+// lockClosure compares reachable entries, but its permissive parser can return an empty/partial graph.
+// Require the root and every reachable edge before allowing equality to establish freshness.
+function completeLockClosure(contents, name) {
+  const packages = parse(contents).package;
+  if (!Array.isArray(packages)) throw new Error("missing [[package]] entries");
+  const roots = packages.filter((entry) => entry.name === name);
+  if (!roots.length) throw new Error(`missing package ${name}`);
+  const seen = new Set();
+  const pending = [...roots];
+  while (pending.length) {
+    const entry = pending.pop();
+    if (seen.has(entry)) continue;
+    seen.add(entry);
+    if (!nonEmpty(entry.name) || !nonEmpty(entry.version)) throw new Error(`incomplete package identity for ${entry.name ?? name}`);
+    if (entry.dependencies !== undefined && !Array.isArray(entry.dependencies)) throw new Error(`invalid dependencies for ${entry.name}`);
+    for (const edge of entry.dependencies ?? []) {
+      if (!nonEmpty(edge)) throw new Error(`invalid dependency edge for ${entry.name}`);
+      const match = /^(\S+)(?: (\S+))?(?: \(([^)]+)\))?$/.exec(edge);
+      if (!match) throw new Error(`invalid dependency ${edge} of ${entry.name}`);
+      const candidates = packages.filter((candidate) => candidate.name === match[1]
+        && (!match[2] || candidate.version === match[2]) && (!match[3] || candidate.source === match[3]));
+      if (!candidates.length) throw new Error(`unresolved dependency ${edge} of ${entry.name}`);
+      pending.push(...candidates);
+    }
+  }
+  return lockClosure(contents, name);
 }
 
 /**
@@ -289,7 +348,8 @@ export function measurementStaleness(commit, crateDir, git = defaultGit, deps =
   const known = git(["cat-file", "-t", commit], crateDir);
   if (known.status !== 0 || known.stdout !== "commit") return `commit ${commit.slice(0, 12)} is not a commit in this repository (shallow clone?)`;
   if (git(["merge-base", "--is-ancestor", commit, "HEAD"], crateDir).status !== 0) return `commit ${commit.slice(0, 12)} is not an ancestor of HEAD`;
-  const { root, specs } = measuredPathspecs(crateDir, { exists, readFile });
+  const { root, specs, problems } = measuredPathspecs(crateDir, { exists, readFile });
+  if (problems.length) return `cannot resolve measured dependency graph: ${problems.join("; ")}`;
   // `git diff <commit>` (no second revision) compares the working tree to the commit.
   const changed = git(["diff", "--name-only", commit, "--", ...specs], root);
   if (changed.status !== 0) return "cannot diff the crate against the measured commit";
@@ -298,17 +358,29 @@ export function measurementStaleness(commit, crateDir, git = defaultGit, deps =
   if (untracked.status !== 0) return "cannot list untracked crate files";
   if (untracked.stdout !== "") return `untracked files since the measurement: ${untracked.stdout.split("\n").slice(0, 5).join(", ")}`;
   let name = null;
-  try { name = readCargoPackage(crateDir, { exists, readFile }).name; } catch { /* no manifest: nothing to resolve in the lock */ }
+  try {
+    if (exists(path.join(crateDir, "Cargo.toml"))) {
+      name = readCargoPackage(crateDir, { exists, readFile }).name;
+      if (!nonEmpty(name)) return `cannot resolve Cargo.lock: ${path.join(crateDir, "Cargo.toml")} has no package.name`;
+    }
+  } catch (error) { return `cannot resolve Cargo.lock package identity: ${error.message}`; }
   if (name) {
     const lockPath = path.join(root, "Cargo.lock");
-    const now = exists(lockPath) ? readFile(lockPath, "utf8") : null;
+    let now;
+    try { now = exists(lockPath) ? readFile(lockPath, "utf8") : null; }
+    catch (error) { return `cannot read Cargo.lock ${lockPath}: ${error.message}`; }
     const then = git(["show", `${commit}:./Cargo.lock`], root);
     const had = then.status === 0;
     if (now === null && had) return "Cargo.lock was removed since the measurement";
     if (now !== null && !had) return "Cargo.lock did not exist at the measured commit";
+    if (now === null && !had) {
+      // A failed show alone cannot distinguish an absent lock from an unreadable Git object.
+      const listed = git(["ls-tree", commit, "--", "Cargo.lock"], root);
+      if (listed.status !== 0 || listed.stdout !== "") return "cannot establish that Cargo.lock was absent at the measured commit";
+    }
     if (now !== null) {
       try {
-        if (JSON.stringify(lockClosure(now, name)) !== JSON.stringify(lockClosure(then.stdout, name))) {
+        if (JSON.stringify(completeLockClosure(now, name)) !== JSON.stringify(completeLockClosure(then.stdout, name))) {
           return `Cargo.lock changed in the dependency graph of ${name} since commit ${commit.slice(0, 12)}`;
         }
       } catch (error) { return `cannot compare Cargo.lock: ${error.message}`; }
@@ -500,7 +572,14 @@ export function statusApiDeclared(api, source) {
  * `evidence` is the release gate evidence for it (the host-policy authority). `requireInstalled`
  * (adoption) additionally needs a fresh in-ceiling installed-app measurement, optionally for `app`.
  */
-export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requireInstalled = false, app, heldResource = false }, { readFile = readFileSync, exists = existsSync, git = defaultGit } = {}) {
+export function evaluateRuntimeBudget(options, deps = {}) {
+  return evaluateRuntimeBudgetOwned(options, deps);
+}
+
+// Private owner mode: no caller-supplied boolean can weaken publication or adoption.
+const STRUCTURE_ONLY = Symbol("runtime-budget-structure-only");
+function evaluateRuntimeBudgetOwned({ crate, crateDir, version, evidence, requireInstalled = false, app, heldResource = false }, { readFile = readFileSync, exists = existsSync, git = defaultGit } = {}, mode) {
+  const structural = mode === STRUCTURE_ONLY;
   const file = path.join(crateDir, RUNTIME_BUDGET_FILE);
   if (!exists(file)) return { ok: false, problems: [`${RUNTIME_BUDGET_FILE} is missing (docs/RUNTIME-BUDGETS.md)`] };
   let budget;
@@ -574,7 +653,7 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
 
   // Measurements.
   const records = Array.isArray(budget.measurements) ? budget.measurements : [];
-  if (records.length === 0) problems.push("no measurements recorded (a declared ceiling is not evidence)");
+  if (!structural && records.length === 0) problems.push("no measurements recorded (a declared ceiling is not evidence)");
   const valid = [];
   records.forEach((m, index) => {
     const bad = validateMeasurement(m, index);
@@ -583,7 +662,7 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
     if (evidenceProblems.length) problems.push(...evidenceProblems); else valid.push({ m, index });
   });
   const counted = valid.filter(({ m }) => m.crateVersion === version);
-  if (valid.length && nonEmpty(version) && counted.length === 0) {
+  if (!structural && valid.length && nonEmpty(version) && counted.length === 0) {
     problems.push(`no measurement for version ${version} (recorded: ${[...new Set(valid.map(({ m }) => m.crateVersion))].join(", ")})`);
   }
   // Why a measurement fails one figure, or null. A delta-basis figure of a synthetic measurement is gated on
@@ -608,7 +687,7 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
     }
     return null;
   };
-  for (const { m, index } of counted) {
+  for (const { m, index } of (structural ? valid : counted)) {
     for (const key of BUDGET_FIGURES) {
       const failure = figureFailure(m, key);
       if (failure) problems.push(`measurement[${index}] on ${m.host.os}/${m.host.arch} ${failure}`);
@@ -616,6 +695,14 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
   }
   const withinCeilings = (m) => BUDGET_FIGURES.every((key) => ceilings[key] !== undefined && (usesDelta(m, key) ? deltaCeilings[key] !== undefined && figureFailure(m, key) === null : m.observed[key] === null ? figureUnavailableOn(m.host?.os, key) : m.observed[key] <= ceilings[key]));
   const atScale = (m) => requiredScale !== null && m.dataScale.unit === requiredScale.unit && m.dataScale.count >= requiredScale.minCount;
+  if (structural) {
+    if (!Array.isArray(budget.measurements)) problems.push("measurements must be an array");
+    const scope = measuredPathspecs(crateDir, { exists, readFile });
+    problems.push(...scope.problems);
+    for (const key of deltaFigures) if (!nonEmpty(budget.deltaSources?.[key])) problems.push(`deltaSources.${key} must name its ceiling source`);
+    if (budget.deltaSources !== undefined && (!budget.deltaSources || typeof budget.deltaSources !== "object" || Array.isArray(budget.deltaSources) || Object.keys(budget.deltaSources).some((key) => !deltaFigures.includes(key)))) problems.push("deltaSources must name only declared delta figures");
+    for (const { m, index } of valid) if (!atScale(m)) problems.push(`measurement[${index}] is below required scale`);
+  }
   const staleness = new Map();
   const stale = (m) => {
     if (!staleness.has(m.commit)) staleness.set(m.commit, measurementStaleness(m.commit, crateDir, git, { exists, readFile }));
@@ -624,7 +711,7 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
 
   // Required hosts: one fresh, in-ceiling, at-scale measurement of this version on each.
   // A held-resource crate defers measurement to adoption: no per-host publish measurement is required.
-  const required = heldResource ? [] : requiredBudgetHosts(budget, evidence);
+  const required = heldResource || structural ? [] : requiredBudgetHosts(budget, evidence);
   for (const host of required) {
     const onHost = counted.filter(({ m }) => m.host.os === host);
     if (onHost.length === 0) { problems.push(`no ${HOSTS[host]} measurement for version ${version} (required hosts: ${required.map((h) => HOSTS[h]).join(" and ")}${required.length > 1 ? "; apps ship on both and the release gate requires both unless a darwin-only policy with a reason is recorded" : `; ${required[0]}-only policy: ${String((evidence ?? budget).hostPolicyReason).trim()}`})`); continue; }
@@ -728,7 +815,17 @@ export function heldResourceProblems({ crate, crateDir, meta }, { readFile = rea
  * naming every matched pattern), "held-resource" (resources table, adoption-time proof) or always-on
  * (runtime-budget.json, fully checked). `readFile`, `exists` and `git` are injectable.
  */
-export function runtimeBudgetCheck({ crate, crateDir, version, evidence, requireInstalled = false, app }, deps = {}) {
+export function runtimeBudgetCheck(options, deps = {}) {
+  return runtimeBudgetCheckOwned(options, deps);
+}
+
+/** Source structure only; grants no runtime qualification or semantic admission. */
+export function runtimeBudgetStructureCheck(options, deps = {}) {
+  const result = runtimeBudgetCheckOwned({ ...options, requireInstalled: false }, deps, STRUCTURE_ONLY);
+  return { ...result, name: "runtime-budget-structure" };
+}
+
+function runtimeBudgetCheckOwned({ crate, crateDir, version, evidence, requireInstalled = false, app }, deps = {}, mode) {
   const { readFile = readFileSync, exists = existsSync } = deps;
   let pkg;
   try { pkg = readCargoPackage(crateDir, { exists, readFile }); } catch (error) {
@@ -775,9 +872,9 @@ export function runtimeBudgetCheck({ crate, crateDir, version, evidence, require
     return fail(crate, crateDir, [`undeclared: none of ${RUNTIME_BUDGET_FILE}, continuous = false with a continuous_reason, or continuous = "held-resource" with resources`],
       `declare the crate (docs/RUNTIME-BUDGETS.md)`);
   }
-  const result = evaluateRuntimeBudget({ crate, crateDir, version: version ?? pkg.version, evidence, requireInstalled, app }, deps);
+  const result = evaluateRuntimeBudgetOwned({ crate, crateDir, version: version ?? pkg.version, evidence, requireInstalled, app }, deps, mode);
   if (result.ok) {
-    return { name: RUNTIME_BUDGET_CHECK, status: "ok", detail: `${crate} ${version ?? pkg.version} has measured runtime budgets on every required host` };
+    return { name: RUNTIME_BUDGET_CHECK, status: "ok", detail: mode === STRUCTURE_ONLY ? `${crate} ${version ?? pkg.version} runtime budget structure is valid; qualification is separate` : `${crate} ${version ?? pkg.version} has measured runtime budgets on every required host` };
   }
   return fail(crate, crateDir, result.problems);
 }

package/scan-digest.mjs

@@ -0,0 +1,107 @@
+// Canonical JSON and the scan-set digest, shared by the scanner (deterministic-scans.mjs) and the credentialed
+// receipt verifiers (scripts/ci/scan-receipt.mjs). No imports beyond node:crypto, by design.
+import crypto from "node:crypto";
+
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+
+/** Deterministic JSON: object keys sorted, no undefined, no non-finite numbers. */
+export function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("canonicalJson: non-finite number");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    for (const key of keys) if (value[key] === undefined) throw new TypeError(`canonicalJson: undefined at ${key}`);
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: unsupported ${typeof value}`);
+}
+
+/** Digest of a scan set: the sorted (id, class, command) of every entry. Plan items and result rows agree. */
+export function digestScanSet(entries) {
+  const rows = entries.map((e) => [String(e.id), String(e.class), String(e.command)]).sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+  return sha256(canonicalJson(rows));
+}
+
+// ---- required scan ids ---------------------------------------------------------------------------------
+// The one place the scan ids that belong to a crate are spelled, shared by planScans (deterministic-scans.mjs) and by the
+// credentialed verifiers (scripts/ci/scan-receipt.mjs), so a verifier recomputes what a receipt must contain from the
+// authenticated source and never trusts the plan the producer recorded. Dependency-free by design (see the header).
+
+export const rustScanId = Object.freeze({
+  check: (name) => `check:${name}`,
+  checkFeatures: (name, index) => `check-features:${name}:${index}`,
+  clippy: (name, count, index) => (count === 1 ? `clippy:${name}` : `clippy:${name}:${index}`),
+  doc: (name) => `doc:${name}`,
+  testRust: (name, count, index) => `test:rust:${name}${count === 1 ? "" : `:${index}`}`,
+  testRustSerial: (name, count, index) => `test:rust-serial:${name}${count === 1 ? "" : `:${index}`}`,
+  packageList: (name) => `cargo-package-list:${name}`,
+  changelog: (name) => `changelog-version:${name}`,
+});
+
+/**
+ * A crate's compile feature plan exactly as CI's gate runs it (ci/gate.config.json rust.<crate>): `lintSets` (clippy; default
+ * features when none), whether a default `check` is needed (no lint set covers default features), and the `checkSets` that
+ * remain (none when a lint set already uses --all-features).
+ */
+export function rustCratePlan(own = {}) {
+  const lintSets = Array.isArray(own?.featureSets) && own.featureSets.length ? own.featureSets : [[]];
+  const defaultCheck = !lintSets.some((set) => set.length === 0);
+  const checkSets = (lintSets.some((set) => set.includes("--all-features")) ? [] : (Array.isArray(own?.checkFeatureSets) ? own.checkFeatureSets : [["--all-features"]])).filter((set) => set.length);
+  return { lintSets, defaultCheck, checkSets };
+}
+
+/** Scan ids every scan of the whole repository always has when it holds Rust units (cargo.toml, workflows, YAML, JSON and licences). */
+export const WORKSPACE_SCAN_IDS = Object.freeze(["cargo-metadata", "cargo-deny", "cargo-audit", "actionlint", "yaml-parse", "toml-parse", "json-parse", "license", "secret-scan"]);
+/** Prefixes at least one scan id must carry (rustfmt groups by edition, so its exact ids depend on the files). */
+export const REQUIRED_SCAN_PREFIXES = Object.freeze(["rustfmt:"]);
+
+/**
+ * The scan ids a LOCAL scan record must contain, each with status pass, for these publishable Rust `units` ([names], crates/<name>).
+ * `exists(repoPath)` answers from the AUTHENTICATED source (never from the record): src/lib.rs decides `doc`, CHANGELOG.md decides
+ * `changelog-version`, and the repository's own ci/advisory-exceptions.json, ownership catalog and docs generator decide theirs.
+ * `crateFeatures` is ci/gate.config.json `rust`. `includeTests` adds the per-feature-set test scans. Extra scans in a record are
+ * allowed; a missing one is not. planScans builds its ids from the same helpers, and a test holds the two in agreement.
+ */
+export function requiredScanIds({ units, crateFeatures = {}, exists, includeTests = false }) {
+  if (!Array.isArray(units) || units.length === 0 || !units.every((n) => typeof n === "string" && n)) throw new TypeError("requiredScanIds: units must be a non-empty array of names");
+  if (typeof exists !== "function") throw new TypeError("requiredScanIds: exists(repoPath) is required");
+  const ids = new Set(WORKSPACE_SCAN_IDS);
+  if (exists("ci/advisory-exceptions.json")) ids.add("advisory-exceptions");
+  if (exists("packages/release/rightkit-ownership.json") && exists("crates/rightkit-ownership/catalog/ownership-catalog.json")) ids.add("ownership-catalog");
+  if (exists("scripts/generate-index.mjs")) ids.add("generated-docs");
+  for (const name of units) {
+    const own = crateFeatures?.[name] ?? {};
+    const { lintSets, defaultCheck, checkSets } = rustCratePlan(own);
+    ids.add(rustScanId.packageList(name));
+    if (exists(`crates/${name}/CHANGELOG.md`)) ids.add(rustScanId.changelog(name));
+    if (defaultCheck) ids.add(rustScanId.check(name));
+    checkSets.forEach((_set, i) => ids.add(rustScanId.checkFeatures(name, i)));
+    lintSets.forEach((_set, i) => ids.add(rustScanId.clippy(name, lintSets.length, i)));
+    if (exists(`crates/${name}/src/lib.rs`)) ids.add(rustScanId.doc(name));
+    if (includeTests) {
+      lintSets.forEach((_set, i) => {
+        ids.add(rustScanId.testRust(name, lintSets.length, i));
+        if (own.alsoSerial) ids.add(rustScanId.testRustSerial(name, lintSets.length, i));
+      });
+    }
+  }
+  return [...ids].sort();
+}
+
+/** Why `rows` (a record's scans) do not contain every required id with status pass; empty when they do. */
+export function requiredScanProblems(rows, required, prefixes = REQUIRED_SCAN_PREFIXES) {
+  const byId = new Map();
+  for (const row of Array.isArray(rows) ? rows : []) if (row && typeof row.id === "string") byId.set(row.id, row);
+  const problems = [];
+  for (const id of required) {
+    const row = byId.get(id);
+    if (!row) problems.push(`required scan ${id} is missing`);
+    else if (row.status !== "pass") problems.push(`required scan ${id} is ${row.status}`);
+  }
+  for (const prefix of prefixes) if (![...byId.values()].some((row) => row.id.startsWith(prefix) && row.status === "pass")) problems.push(`no passing ${prefix}* scan`);
+  return problems;
+}

package/sign-qa-bundle.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+// right-release sign-qa-bundle: QA-ONLY ad hoc signing of an already-assembled .app that lives inside a QA scratch root.
+// Why it exists: an assembled QA bundle (for example an Accessibility QA copy) needs a coherent ad hoc signature, but
+// `codesign --force --deep --sign -` routed through the signing agent (SSH or non-Aqua session) is refused by design
+// (macos-signing-session.mjs codesignAgentItems; rightkit-signing-agent.mjs). Those refusals stay. This module never calls the
+// agent: it spawns /usr/bin/codesign itself, signs nested code one item at a time, deepest first, the outer bundle last, with
+// identity "-" and never `--deep`. Ad hoc output is not a release artifact: it is never notarized, sealed, published or installed
+// under /Applications, and the receipt says so (signature "adhoc", releaseArtifact false, qaOnly true).
+import { existsSync, lstatSync, mkdtempSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { adhocSafeEntitlements } from "./adhoc-entitlements.mjs";
+
+export const QA_BUNDLE_SIGNING_SCHEMA = 1;
+export const CODESIGN = "/usr/bin/codesign";
+const PLUTIL = "/usr/bin/plutil";
+// macOS paths only: posix semantics keep the checks identical on every host that unit-tests this module.
+const px = path.posix;
+
+export class QaBundleSigningError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "QaBundleSigningError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+const fail = (code, message, details) => { throw new QaBundleSigningError(code, message, details); };
+
+const defaultIo = { lstatSync, readdirSync, realpathSync, existsSync, mkdtempSync, writeFileSync, rmSync };
+const captureOptions = { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false };
+const outputOf = (result) => `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+const inside = (parent, child) => child !== parent && child.startsWith(parent === "/" ? "/" : `${parent}/`);
+
+function checked(run, args, code, command = CODESIGN) {
+  const result = run(command, args, captureOptions);
+  if (!result || result.error || result.status !== 0) {
+    fail(code, `${command} ${args[0]} failed (${result?.status ?? "unavailable"}): ${result?.error?.message || outputOf(result ?? {})}`, { status: result?.status });
+  }
+  return result;
+}
+
+function lstatOrNull(io, file) { try { return io.lstatSync(file); } catch { return null; } }
+
+function requireAbsolute(label, value) {
+  if (typeof value !== "string" || !value.startsWith("/")) fail("QA_SIGN_PATH_NOT_ABSOLUTE", `${label} must be an absolute macOS path: ${JSON.stringify(value)}`);
+  if (value.split("/").includes("..") || value.includes("\0")) fail("QA_SIGN_PATH_NOT_NORMAL", `${label} must not contain ".." segments: ${JSON.stringify(value)}`);
+  return value.length > 1 ? value.replace(/\/+$/, "") : value;
+}
+
+/** Validate the target and return its real paths. Refusals are typed and happen before any codesign call. */
+export function resolveQaBundleTarget({ app, qaScratchRoot, platform = process.platform, home = os.homedir(), io = defaultIo }) {
+  if (platform !== "darwin") fail("QA_SIGN_DARWIN_ONLY", `sign-qa-bundle runs on macOS only (platform ${platform})`);
+  const lexicalApp = requireAbsolute("--app", app);
+  const lexicalRoot = requireAbsolute("--qa-root", qaScratchRoot);
+  const lexicalHome = requireAbsolute("home", home);
+  const applications = ["/Applications", px.join(lexicalHome, "Applications")];
+  const real = (label, file) => { try { return io.realpathSync(file); } catch { return fail("QA_SIGN_PATH_MISSING", `${label} does not exist: ${file}`); } };
+  const realApplications = applications.flatMap((dir) => { const out = [dir]; try { out.push(io.realpathSync(dir)); } catch { /* absent */ } return out; });
+  const inApplications = (file) => realApplications.some((dir) => file === dir || inside(dir, file));
+  if (inApplications(lexicalApp)) fail("QA_SIGN_APPLICATIONS_REFUSED", `QA signing refuses installed apps (/Applications, ~/Applications): ${lexicalApp}`);
+  if (px.extname(lexicalApp) !== ".app") fail("QA_SIGN_NOT_APP", `target is not a .app bundle: ${lexicalApp}`);
+  const link = lstatOrNull(io, lexicalApp);
+  if (!link) fail("QA_SIGN_PATH_MISSING", `--app does not exist: ${lexicalApp}`);
+  if (link.isSymbolicLink()) fail("QA_SIGN_LINK_REFUSED", `--app is a symbolic link; pass the real bundle: ${lexicalApp}`);
+  if (!link.isDirectory()) fail("QA_SIGN_NOT_APP", `target is not a directory bundle: ${lexicalApp}`);
+  const realRoot = real("--qa-root", lexicalRoot);
+  const realApp = real("--app", lexicalApp);
+  if (realRoot === "/" || realRoot === lexicalHome || inApplications(realRoot) || realApplications.some((dir) => inside(realRoot, dir))) {
+    fail("QA_SIGN_ROOT_REFUSED", `QA scratch root is too broad or an installed-app location: ${realRoot}`);
+  }
+  if (inApplications(realApp)) fail("QA_SIGN_APPLICATIONS_REFUSED", `QA signing refuses installed apps (resolved to ${realApp})`);
+  if (!inside(realRoot, realApp)) fail("QA_SIGN_OUTSIDE_QA_ROOT", `bundle ${realApp} is not inside the QA scratch root ${realRoot}`);
+  if (px.extname(realApp) !== ".app") fail("QA_SIGN_NOT_APP", `target resolves to a non-.app path: ${realApp}`);
+  return { app: lexicalApp, realApp, realRoot };
+}
+
+/** Bundle kinds that are signed as a unit, and the directory whose files are loose Mach-O candidates. */
+const BUNDLE_EXTENSIONS = new Set([".app", ".xpc", ".framework"]);
+
+function readInfo(run, bundle, cache, io) {
+  if (cache.has(bundle)) return cache.get(bundle);
+  let info = {};
+  for (const location of ["Contents/Info.plist", "Resources/Info.plist", "Info.plist"]) {
+    const file = px.join(bundle, location);
+    if (!io.existsSync(file)) continue;
+    const result = checked(run, ["-convert", "json", "-o", "-", file], "QA_SIGN_PLIST_INVALID", PLUTIL);
+    try { info = JSON.parse(result.stdout); } catch { fail("QA_SIGN_PLIST_INVALID", `Invalid Info.plist JSON: ${file}`); }
+    break;
+  }
+  cache.set(bundle, info);
+  return info;
+}
+
+/**
+ * Nested code inside the bundle, ordered inside-out: deepest path first (stable by path), the outer bundle excluded.
+ * Symbolic links are never entered or signed; a link that resolves outside the bundle is refused.
+ */
+export function enumerateNestedCode({ realApp, run, io = defaultIo }) {
+  const infoCache = new Map();
+  const found = new Map();
+  const add = (file, kind) => { if (!found.has(file)) found.set(file, kind); };
+  const bundleOf = (dir) => px.dirname(px.dirname(dir)); // .../X.app/Contents/MacOS -> .../X.app
+  const walk = (dir) => {
+    for (const entry of io.readdirSync(dir, { withFileTypes: true })) {
+      const file = px.join(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        let target;
+        try { target = io.realpathSync(file); } catch { fail("QA_SIGN_LINK_REFUSED", `dangling symbolic link inside the bundle: ${file}`); }
+        if (target !== realApp && !inside(realApp, target)) fail("QA_SIGN_LINK_REFUSED", `symbolic link escapes the bundle: ${file} -> ${target}`);
+        continue;
+      }
+      const ext = px.extname(entry.name);
+      if (entry.isDirectory()) {
+        if (BUNDLE_EXTENSIONS.has(ext)) add(file, ext === ".framework" ? "framework" : ext === ".xpc" ? "xpc" : "app");
+        else if (px.basename(dir) === "LoginItems" && px.basename(px.dirname(dir)) === "Library") add(file, "login-item");
+        walk(file);
+      } else if (entry.isFile()) {
+        if (ext === ".dylib") add(file, "dylib");
+        else if (px.basename(dir) === "MacOS" && px.basename(px.dirname(dir)) === "Contents") {
+          const main = readInfo(run, bundleOf(dir), infoCache, io).CFBundleExecutable;
+          if (typeof main !== "string" || !main) fail("QA_SIGN_PLIST_INVALID", `no CFBundleExecutable for ${bundleOf(dir)}`);
+          if (entry.name !== main) add(file, "executable");
+        } else if (px.basename(dir) === "Frameworks" && px.basename(px.dirname(dir)) === "Contents") add(file, "executable");
+        else if (px.basename(dir) === "LoginItems" && px.basename(px.dirname(dir)) === "Library") add(file, "login-item");
+      }
+    }
+  };
+  walk(realApp);
+  const depth = (file) => file.split("/").length;
+  return [...found].map(([file, kind]) => ({ path: file, kind }))
+    .sort((a, b) => depth(b.path) - depth(a.path) || (a.path < b.path ? -1 : 1));
+}
+
+/** The only codesign argv this module emits. `--deep` and any identity other than "-" are structurally impossible. */
+export function adhocCodesignArgs(item, entitlementsFile) {
+  const args = ["--force", "--sign", "-"];
+  if (entitlementsFile) args.push("--entitlements", entitlementsFile);
+  args.push(item);
+  if (args.includes("--deep") || args[args.indexOf("--sign") + 1] !== "-") fail("QA_SIGN_ARGV_REFUSED", "internal: ad hoc argv must never carry --deep or a real identity");
+  return args;
+}
+
+export function signQaBundleAdhoc({ app, qaScratchRoot, run = spawnSync, platform = process.platform, home = os.homedir(), entitlements, io = defaultIo, out } = {}) {
+  const target = resolveQaBundleTarget({ app, qaScratchRoot, platform, home, io });
+  const { realApp, realRoot } = target;
+  let scratch;
+  try {
+    let outerEntitlements;
+    let entitlementKeys = [];
+    if (entitlements !== undefined) {
+      const source = requireAbsolute("entitlements", entitlements);
+      const parsed = checked(run, ["-convert", "json", "-o", "-", source], "QA_SIGN_ENTITLEMENTS_INVALID", PLUTIL);
+      let reduced;
+      try { reduced = adhocSafeEntitlements(JSON.parse(parsed.stdout)); } catch { fail("QA_SIGN_ENTITLEMENTS_INVALID", `Invalid entitlements plist: ${source}`); }
+      entitlementKeys = Object.keys(reduced).sort();
+      if (entitlementKeys.length) {
+        scratch = io.mkdtempSync(px.join(realRoot, ".sign-qa-"));
+        outerEntitlements = px.join(scratch, "adhoc-entitlements.plist");
+        io.writeFileSync(outerEntitlements, JSON.stringify(reduced));
+        checked(run, ["-convert", "xml1", outerEntitlements], "QA_SIGN_ENTITLEMENTS_INVALID", PLUTIL);
+      }
+    }
+    const nested = enumerateNestedCode({ realApp, run, io });
+    const plan = [...nested, { path: realApp, kind: "bundle" }];
+    const signed = [];
+    for (const item of plan) {
+      const withEntitlements = item.kind === "bundle" ? outerEntitlements : undefined;
+      checked(run, adhocCodesignArgs(item.path, withEntitlements), "QA_SIGN_CODESIGN_FAILED");
+      signed.push({ path: item.path, kind: item.kind });
+    }
+    checked(run, ["--verify", "--strict", realApp], "QA_SIGN_VERIFY_FAILED");
+    const receipt = {
+      schema: QA_BUNDLE_SIGNING_SCHEMA, signature: "adhoc", releaseArtifact: false, qaOnly: true,
+      notarized: false, published: false, usedSigningAgent: false,
+      app: realApp, qaScratchRoot: realRoot, entitlementKeys, verified: "codesign --verify --strict", signed,
+    };
+    if (out) {
+      const file = requireAbsolute("--out", out);
+      io.writeFileSync(file, `${JSON.stringify(receipt, null, 2)}\n`);
+    }
+    return receipt;
+  } finally {
+    if (scratch) { try { io.rmSync(scratch, { recursive: true, force: true }); } catch { /* best effort */ } }
+  }
+}
+
+export function main(args = process.argv.slice(2), options = {}) {
+  const take = (flag) => {
+    const index = args.indexOf(flag);
+    if (index < 0) return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) fail("QA_SIGN_USAGE", `${flag} requires a value`);
+    return value;
+  };
+  try {
+    for (const arg of args.filter((a) => a.startsWith("--"))) {
+      if (!["--app", "--qa-root", "--out", "--entitlements"].includes(arg)) fail("QA_SIGN_USAGE", `unknown option ${arg}`);
+    }
+    const receipt = signQaBundleAdhoc({ app: take("--app"), qaScratchRoot: take("--qa-root"), entitlements: take("--entitlements"), out: take("--out"), ...options });
+    console.log(`ad hoc signed (QA only, not a release artifact) ${receipt.signed.length} item(s), outer bundle last: ${receipt.app}`);
+  } catch (error) {
+    console.error(`right-release sign-qa-bundle: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) main();