@rightkit/release 0.4.0 → 0.5.0

package/binary-license-notices.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// `right-release license-notices binaries [--config <file>] [--output <file>] [--product-name <name>] [--receipt <path>] [--check]`:
+// writes the notice appendix (one HTML file) for the binaries an app ships that no RightKit catalog row covers (a downloaded yt-dlp, a
+// vendored tool, a command-built helper). Catalog-backed sidecars (ffmpeg, onnxruntime, pdfium, whisper) write their own notices when
+// they are staged; everything else must be declared here, with its licence text, or the build has no right to ship it.
+//
+//   legal: { binaryNotices: { output: "legal/THIRD_PARTY_BINARIES.html", productName: "ScrapeRight", receipt: "src-tauri/binaries/stage-sidecar.json",
+//            binaries: [{ name: "yt-dlp", version: "2026.03.17" | "self-updating", license: "Unlicense", sourceUrl: "https://github.com/yt-dlp/yt-dlp",
+//                         files: ["legal/texts/yt-dlp-UNLICENSE.txt"], covers?: ["yt-dlp-helper"] }] } }
+//
+// Every `files` entry is an app-relative text file that must exist; no licence text is ever invented. With a `receipt` (the
+// stage-sidecar receipt, also settable with `--receipt`) every staged file of kind remote, command, cmake or prebuilt must belong to a
+// declared binary - by its entry name, or a name listed in `covers` - or the run fails naming the uncovered ones. The page records the
+// receipt-independent inputs only (declared fields and the sha256 of each text), so the same declaration always produces the same bytes.
+// `--check` writes nothing and exits 1 when the file on disk differs.
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { escapeHtml } from "./npm-license-notices.mjs";
+
+const fail = (message) => { throw new CommandSpecError(message); };
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const KEYS = ["output", "productName", "receipt", "binaries"];
+const BINARY_KEYS = ["name", "version", "license", "sourceUrl", "files", "covers"];
+/** Receipt kinds with no catalog row behind them. */
+export const NON_CATALOG_KINDS = Object.freeze(["remote", "command", "cmake", "prebuilt"]);
+
+/** Resolve and validate `legal.binaryNotices` plus flags. */
+export function resolveBinaryNoticeOptions(config, flags = {}) {
+  const declared = config?.legal?.binaryNotices;
+  if (!isObject(declared)) fail("legal.binaryNotices must be an object");
+  const unknown = Object.keys(declared).filter((key) => !KEYS.includes(key));
+  if (unknown.length) fail(`legal.binaryNotices has unknown key(s): ${unknown.join(", ")} (allowed: ${KEYS.join(", ")})`);
+  const output = flags.output ?? declared.output;
+  if (output === undefined) fail("no output file: set legal.binaryNotices.output or pass --output");
+  relativeInside(output, "legal.binaryNotices.output");
+  const productName = flags.productName ?? declared.productName;
+  if (typeof productName !== "string" || !productName.trim()) fail("no product name: set legal.binaryNotices.productName or pass --product-name");
+  const receipt = flags.receipt ?? declared.receipt;
+  if (receipt !== undefined) relativeInside(receipt, "legal.binaryNotices.receipt");
+  if (!Array.isArray(declared.binaries) || !declared.binaries.length) fail("legal.binaryNotices.binaries must be a non-empty list");
+  const names = new Set();
+  const binaries = declared.binaries.map((item, index) => {
+    const label = `legal.binaryNotices.binaries[${index}]`;
+    if (!isObject(item)) fail(`${label} must be an object`);
+    const extra = Object.keys(item).filter((key) => !BINARY_KEYS.includes(key));
+    if (extra.length) fail(`${label} has unknown key(s): ${extra.join(", ")} (allowed: ${BINARY_KEYS.join(", ")})`);
+    for (const key of ["name", "version", "license"]) if (typeof item[key] !== "string" || !item[key].trim()) fail(`${label}.${key} must be a non-empty string`);
+    if (typeof item.sourceUrl !== "string" || !/^https:\/\/[^\s/]+\/\S*$/.test(item.sourceUrl)) fail(`${label}.sourceUrl must be an https:// URL of the source or release`);
+    if (!Array.isArray(item.files) || !item.files.length) fail(`${label}.files must list at least one licence/notice text file`);
+    const files = item.files.map((file, fileIndex) => relativeInside(file, `${label}.files[${fileIndex}]`));
+    const covers = item.covers ?? [];
+    if (!Array.isArray(covers) || covers.some((name) => typeof name !== "string" || !name.trim())) fail(`${label}.covers must be a list of staged entry names`);
+    for (const name of [item.name, ...covers]) {
+      if (names.has(name)) fail(`${label}: ${name} is declared twice`);
+      names.add(name);
+    }
+    return { name: item.name, version: item.version, license: item.license, sourceUrl: item.sourceUrl, files, covers: [...covers] };
+  });
+  return { output, productName, receipt, binaries };
+}
+
+/** The names of staged non-catalog entries that no declared binary covers. */
+export function uncoveredBinaries(receipt, binaries) {
+  const covered = new Set(binaries.flatMap((binary) => [binary.name, ...(binary.covers ?? [])]));
+  const missing = new Set();
+  for (const file of receipt?.files ?? []) {
+    if (!NON_CATALOG_KINDS.includes(file.kind)) continue;
+    const name = file.entryName ?? file.command ?? file.name;
+    if (!covered.has(name)) missing.add(name);
+  }
+  return [...missing].sort();
+}
+
+/** Render the appendix. `texts` maps an app-relative file to its text. Returns the HTML. */
+export function renderBinaryNotices({ productName, binaries, texts }) {
+  const sections = binaries.map((binary) => {
+    const bodies = binary.files.map((file) => `<h3>${escapeHtml(path.posix.basename(file))}</h3><pre>${escapeHtml(texts.get(file))}</pre>`).join("\n");
+    const digests = binary.files.map((file) => `${escapeHtml(path.posix.basename(file))} sha256=${createHash("sha256").update(texts.get(file)).digest("hex")}`).join("; ");
+    return `<section><h2>${escapeHtml(binary.name)} ${escapeHtml(binary.version)}</h2><p>License: ${escapeHtml(binary.license)}</p><p>Source: ${escapeHtml(binary.sourceUrl)}</p><p>Texts: ${digests}</p>\n${bodies}</section>`;
+  });
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>${escapeHtml(productName)} bundled program licenses</title></head><body>
+<h1>${escapeHtml(productName)} bundled program licenses</h1>
+<p>Programs shipped with ${escapeHtml(productName)} that are not Cargo or npm dependencies; generated-by=right-release license-notices binaries</p>
+${sections.join("\n")}
+</body></html>
+`;
+}
+
+/** Generate (or check) the appendix for the app at `appRoot`. File access is injectable. */
+export function generateBinaryNotices({ appRoot, config, flags = {}, check = false, exists = existsSync, readText = (file) => readFileSync(file, "utf8"), writeText = (file, text) => { mkdirSync(path.dirname(file), { recursive: true }); writeFileSync(file, text); } }) {
+  const { output, productName, receipt, binaries } = resolveBinaryNoticeOptions(config, flags);
+  const texts = new Map();
+  for (const binary of binaries) {
+    for (const file of binary.files) {
+      const absolute = path.join(appRoot, file);
+      if (!exists(absolute)) fail(`${binary.name}: licence text ${file} does not exist; no text is invented, add the file`);
+      const text = String(readText(absolute)).replace(/\r\n/g, "\n");
+      if (!text.trim()) fail(`${binary.name}: licence text ${file} is empty`);
+      texts.set(file, text);
+    }
+  }
+  let uncovered = [];
+  if (receipt !== undefined) {
+    const receiptFile = path.join(appRoot, receipt);
+    if (!exists(receiptFile)) fail(`the stage-sidecar receipt ${receipt} does not exist; run right-release stage-sidecar first`);
+    let parsed;
+    try { parsed = JSON.parse(readText(receiptFile)); } catch (error) { fail(`the stage-sidecar receipt ${receipt} is not JSON (${error.message})`); }
+    uncovered = uncoveredBinaries(parsed, binaries);
+    if (uncovered.length) fail(`staged program(s) with no declared licence notice: ${uncovered.join(", ")}; declare them in legal.binaryNotices.binaries (name or covers)`);
+  }
+  const html = renderBinaryNotices({ productName, binaries, texts });
+  const target = path.join(appRoot, output);
+  if (check) {
+    const current = exists(target) ? String(readText(target)).replace(/\r\n/g, "\n") : null;
+    return { target, binaryCount: binaries.length, uncovered, upToDate: current === html };
+  }
+  writeText(target, html);
+  return { target, binaryCount: binaries.length, uncovered, upToDate: true };
+}
+
+export function parseBinaryNoticeArgs(argv) {
+  const opts = { config: "right-release.config.mjs", output: undefined, productName: undefined, receipt: undefined, check: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--config" || arg === "--output" || arg === "--product-name" || arg === "--receipt") {
+      const value = argv[i + 1];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} needs a value`);
+      opts[arg === "--product-name" ? "productName" : arg.slice(2)] = value;
+      i += 1;
+    } else if (arg === "--check") opts.check = true;
+    else throw new Error(`unknown license-notices argument: ${arg}`);
+  }
+  return opts;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const opts = parseBinaryNoticeArgs(argv);
+  const { config, appRoot } = await loadAppConfig(opts.config);
+  const outcome = generateBinaryNotices({ appRoot, config, flags: { output: opts.output, productName: opts.productName, receipt: opts.receipt }, check: opts.check });
+  if (opts.check) {
+    if (!outcome.upToDate) {
+      console.error(`right-release license-notices: ${outcome.target} is out of date; run right-release license-notices binaries`);
+      return 1;
+    }
+    console.log(`${outcome.target} is up to date (${outcome.binaryCount} program notices)`);
+    return 0;
+  }
+  console.log(`wrote ${outcome.binaryCount} program notices to ${outcome.target}`);
+  return 0;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().then((code) => { process.exitCode = code; }, (error) => {
+    console.error(`right-release license-notices: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/cargo-license-notices.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// `right-release license-notices cargo [--config <file>] [--output <file>] [--check]`: writes the third-party Cargo license appendix
+// (one file) for an app's Rust dependency closure with `cargo about`, run through the managed cargo client (`runCargoSync`: the
+// RightKit broker on a managed host, never a bare-cargo fallback on a managed Mac).
+//
+//   legal: { cargoNotices: { output: "legal/THIRD_PARTY_CARGO_LICENSES.html", template: "legal/about.hbs",
+//                            config?: "legal/about.toml", manifestPath?: "src-tauri/Cargo.toml", features?: ["a"], allFeatures?: true } }
+//
+// `output`, `template`, `config` and `manifestPath` are app-relative and may not leave the app. The run is `cargo about generate --locked
+// --fail [--config <config>] [--manifest-path <path>] [--all-features | --features a,b] <template>`; cargo-about writes the rendered
+// appendix to stdout, which is normalised to LF and one trailing newline so the same lockfile always produces the same bytes. `--fail`
+// makes an unaccepted license or an unresolved clarification an error instead of a warning. `--check` writes nothing and exits 1 when
+// the file on disk differs.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { runCargoSync } from "./managed-cargo.mjs";
+
+const fail = (message) => { throw new CommandSpecError(message); };
+const KEYS = ["output", "template", "config", "manifestPath", "features", "allFeatures"];
+
+/** Resolve and validate `legal.cargoNotices` plus flags. */
+export function resolveCargoNoticeOptions(config, flags = {}) {
+  const declared = config?.legal?.cargoNotices ?? {};
+  if (typeof declared !== "object" || declared === null || Array.isArray(declared)) fail("legal.cargoNotices must be an object");
+  const unknown = Object.keys(declared).filter((key) => !KEYS.includes(key));
+  if (unknown.length) fail(`legal.cargoNotices has unknown key(s): ${unknown.join(", ")} (allowed: ${KEYS.join(", ")})`);
+  const output = flags.output ?? declared.output;
+  if (output === undefined) fail("no output file: set legal.cargoNotices.output or pass --output");
+  relativeInside(output, "legal.cargoNotices.output");
+  if (declared.template === undefined) fail("legal.cargoNotices.template (the cargo-about handlebars template) is required");
+  relativeInside(declared.template, "legal.cargoNotices.template");
+  for (const key of ["config", "manifestPath"]) if (declared[key] !== undefined) relativeInside(declared[key], `legal.cargoNotices.${key}`);
+  const features = declared.features ?? [];
+  if (!Array.isArray(features) || features.some((feature) => typeof feature !== "string" || !/^[A-Za-z0-9_/-]+$/.test(feature))) fail("legal.cargoNotices.features must be a list of feature names");
+  if (declared.allFeatures !== undefined && typeof declared.allFeatures !== "boolean") fail("legal.cargoNotices.allFeatures must be a boolean");
+  if (declared.allFeatures === true && features.length) fail("legal.cargoNotices: give allFeatures or features, not both");
+  return { output, template: declared.template, config: declared.config, manifestPath: declared.manifestPath, features, allFeatures: declared.allFeatures === true };
+}
+
+/** The `cargo about` argument list (after the managed client adds `cargo`). */
+export function cargoAboutArgs(options) {
+  return [
+    "about", "generate", "--locked", "--fail",
+    ...(options.config ? ["--config", options.config] : []),
+    ...(options.manifestPath ? ["--manifest-path", options.manifestPath] : []),
+    ...(options.allFeatures ? ["--all-features"] : options.features.length ? ["--features", options.features.join(",")] : []),
+    options.template,
+  ];
+}
+
+const normalise = (text) => `${String(text).replace(/\r\n/g, "\n").replace(/\s+$/, "")}\n`;
+
+/** Generate (or check) the Cargo appendix for the app at `appRoot`. `run` is the managed cargo runner (injectable). */
+export function generateCargoNotices({ appRoot, config, flags = {}, check = false, run = runCargoSync, env = process.env, exists = existsSync, readText = (file) => readFileSync(file, "utf8"), writeText = (file, text) => { mkdirSync(path.dirname(file), { recursive: true }); writeFileSync(file, text); } }) {
+  const options = resolveCargoNoticeOptions(config, flags);
+  for (const key of ["template", "config", "manifestPath"]) {
+    if (options[key] !== undefined && !exists(path.join(appRoot, options[key]))) fail(`legal.cargoNotices.${key} ${options[key]} does not exist`);
+  }
+  const result = run(cargoAboutArgs(options), { cwd: appRoot, env, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  if (result?.error) fail(`cargo about could not start (${result.error.message}); install cargo-about on the build host`);
+  if (result?.status !== 0) fail(`cargo about exited ${result?.status ?? "without status"}${result?.stderr ? `:\n${String(result.stderr).trim()}` : ""}`);
+  const text = normalise(result.stdout ?? "");
+  if (text.trim() === "") fail("cargo about produced no output");
+  const target = path.join(appRoot, options.output);
+  if (check) {
+    const current = exists(target) ? normalise(readText(target)) : null;
+    return { target, bytes: Buffer.byteLength(text), upToDate: current === text };
+  }
+  writeText(target, text);
+  return { target, bytes: Buffer.byteLength(text), upToDate: true };
+}
+
+export function parseCargoNoticeArgs(argv) {
+  const opts = { config: "right-release.config.mjs", output: undefined, check: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--config" || arg === "--output") {
+      const value = argv[i + 1];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} needs a value`);
+      opts[arg.slice(2)] = value;
+      i += 1;
+    } else if (arg === "--check") opts.check = true;
+    else throw new Error(`unknown license-notices argument: ${arg}`);
+  }
+  return opts;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const opts = parseCargoNoticeArgs(argv);
+  const { config, appRoot } = await loadAppConfig(opts.config);
+  const outcome = generateCargoNotices({ appRoot, config, flags: { output: opts.output }, check: opts.check });
+  if (opts.check) {
+    if (!outcome.upToDate) {
+      console.error(`right-release license-notices: ${outcome.target} is out of date; run right-release license-notices cargo`);
+      return 1;
+    }
+    console.log(`${outcome.target} is up to date`);
+    return 0;
+  }
+  console.log(`wrote ${outcome.target} (${outcome.bytes} bytes)`);
+  return 0;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().then((code) => { process.exitCode = code; }, (error) => {
+    console.error(`right-release license-notices: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/cli/right-release.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { spawn } from "../background-process.mjs";
 import { fileURLToPath } from "node:url";
 import { assertReleaseExecutionAllowed } from "../execution-policy.mjs";
+import { hostUploadRefusalMessage } from "../host-upload-refusal.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const commands = new Map([
@@ -19,6 +20,7 @@ const commands = new Map([
   ["sign-windows", "sign-windows.mjs"],
   ["sign-updater", "sign-updater.mjs"],
   ["sign-dev-artifact", "sign-dev-artifact.mjs"],
+  ["sign-qa-bundle", "sign-qa-bundle.mjs"],
   ["sign-candidate", "sign-candidate.mjs"],
   ["engine-locate", "engine-locator.mjs"],
   ["stage-sidecar", "stage-sidecar-command.mjs"],
@@ -40,6 +42,7 @@ const commands = new Map([
   ["ownership-approval", "ownership-approval-command.mjs"],
   ["ownership-report", "ownership-report-command.mjs"],
   ["ownership-mandatory", "ownership-mandatory-set.mjs"],
+  ["adoption-evidence", "adoption-evidence.mjs"],
   ["swift-package", "swift-package-command.mjs"],
   ["bundle-scan", "runtime-bundle-scan.mjs"],
   ["check-release-dependencies", "release-dependencies-command.mjs"],
@@ -64,6 +67,7 @@ try {
     || first?.startsWith("-")
     || (first === "addon" && args[1] === "build")
     || (first === "dmg" && args[1] === "build")
+    || first === "qualify"
     || (first === "publish" && ["cargo", "swift"].includes(args[1]))) {
     assertReleaseExecutionAllowed({ command: `right-release ${args.join(" ")}`.trim() });
   }
@@ -102,8 +106,25 @@ if (first === "--version" || first === "-v") {
   run("dmg-build.mjs", args.slice(1));
 } else if (first === "apple") {
   run("apple-profile-renew.mjs", args.slice(1));
+} else if (first === "qualify") {
+  // Local qualification (default): both native hosts qualify the crates through the RustRight broker and a candidate is cut.
+  // It uploads nothing; the approval commit and publish-reviewed.yml publish the pinned bytes (docs/CI.md "Local qualification").
+  run("local-qualify.mjs", args.slice(1));
 } else if (first === "publish") {
   const rest = args.slice(1);
+  // RightKit crates and @rightkit packages reach a registry from CI only: publish.yml qualification, the approval
+  // commit in ci/approved-artifacts.json, then publish-reviewed.yml uploads exactly the approved bytes (docs/CI.md).
+  // Every host-side upload path is refused on every host; preflight, --dry-run and --qualify-only still run.
+  if (rest[0] === "cargo" || rest[0] === "npm") {
+    const uploads = rest[0] === "npm"
+      ? rest.includes("--publish") || rest.includes("--local")
+      : !rest.includes("--dry-run") && !rest.includes("--qualify-only");
+    // Unconditional: a caller-set GITHUB_ACTIONS=true never lifts it (CI uploads use scripts/ci/publish.mjs and reviewed-candidate.mjs).
+    if (uploads) {
+      console.error(hostUploadRefusalMessage(`right-release publish ${rest[0]}`));
+      process.exit(2);
+    }
+  }
   if ((rest[0] === "cargo" || rest[0] === "npm") && rest.includes("--local")) {
     run("local-publish.mjs", rest);
   } else if (rest[0] === "cargo") {
@@ -136,6 +157,9 @@ if (first === "--version" || first === "-v") {
   runBinary("python3", [path.join(packageRoot, "generate-dmg-background.py"), ...args.slice(1)]);
 } else if (first === "build" && args.includes("--web")) {
   run("web-build.mjs", args.slice(1).filter((arg) => arg !== "--web"));
+} else if (first === "license-notices" && (args[1] === "cargo" || args[1] === "binaries")) {
+  // `license-notices npm` stays on the commands map; the Rust and native-binary appendices have their own modules.
+  run(args[1] === "cargo" ? "cargo-license-notices.mjs" : "binary-license-notices.mjs", args.slice(2));
 } else if (commands.has(first)) {
   run(commands.get(first), args.slice(1));
 } else if (first.startsWith("-")) {
@@ -217,6 +241,10 @@ Commands:
                                                       Run the app's declared test suites (config tests.suites / tests.runners) in order; stops at the first failure
   license-notices npm [--config <file>] [--output <file>] [--product-name <name>] [--check]
                                                       Write the third-party npm license appendix HTML from pnpm licenses (config legal.npmNotices); --check only compares
+  license-notices cargo [--config <file>] [--output <file>] [--check]
+                                                      Write the third-party Cargo license appendix HTML through cargo about (config legal.cargoNotices); --check only compares
+  license-notices binaries [--config <file>] [--output <file>] [--product-name <name>] [--receipt <path>] [--check]
+                                                      Write the notices for shipped programs that are not Cargo or npm dependencies (config legal.binaryNotices); --check only compares
   toolchain swift --version <x.y.z> --sha256 <pin> [--url <https url>] [--github-env] [--json]
                                                       Windows: install the pinned swift.org Swift toolchain (sha256 verified before it runs), check swift --version, find the runtime bin; --github-env exports what the installer changed to GITHUB_ENV / GITHUB_PATH
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]
@@ -229,6 +257,8 @@ Commands:
                                                       Fail when a built web dist/ carries a forbidden marker string or mock/fixture chunk name (dev, mock or fixture code in release)
   sign-dev-artifact --artifact <dir> --manifest <sign.json> [--metadata <payload.json>] [--evidence <path>] [--dry-run]
                                                       Developer ID sign an existing CI dev artifact per file with fixed identifiers; never builds, notarizes or publishes (macOS)
+  sign-qa-bundle --app <abs .app> --qa-root <abs dir> [--entitlements <abs plist>] [--out <evidence.json>]
+                                                      QA ONLY: ad hoc sign a bundle inside a QA scratch root, nested code first, outer last, never --deep, never the signing agent (macOS); not a release artifact
   sign-candidate --platform win|mac --artifact <dir> --candidate-receipt <receipt.json> --out <binding.json> [--manifest <sign.json>] [--publisher <subject>] [--dry-run]
                                                       Sign the exact unsigned candidate bytes (sha256 checked against the candidate receipt) instead of rebuilding; writes a candidate-sha -> signed-sha binding receipt
   engine-locate --engine cutright|genright [--sha256 <hex>] [--json]
@@ -260,6 +290,13 @@ Commands:
                                                       Verify on source host; export crate bytes & gate evidence without uploading
   publish cargo --crate <name> --from-evidence <gate.json>
                                                       Reuse exact HEAD/artifact proof on upload host; recheck archive hash & registry bytes
+  qualify cargo --crates <a,b> [--hosts win,mac] [--id <id>] [--allow-ignored-units <a,b>] [--jobs <1-64>] [--concurrency <1-8>] [--out <dir>] [--no-release] [--with-ci]
+                                                      Qualify the crates on BOTH native hosts through the RustRight broker (Dell: Windows, Mac: macOS over ssh), seal one packed
+                                                      asset and one receipt per host, attach them to the prerelease candidate-<id> and print the candidate and approval entry.
+                                                      Needs a clean checkout with HEAD on origin/main (the other host at the same HEAD). Never uploads to a registry.
+                                                      --with-ci also dispatches publish.yml for the same commit when the hosts start and pins that run in the candidate as clean-room proof
+                                                      (Linux-required units and runtime owners no local workload covers are planned only with --with-ci, and then need that run to succeed).
+                                                      Any repository: owner/name from its origin remote; hosts, approvals file and promotion workflow from .rightkit-gate.json
   publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]
                                                       Check main, a clean tree, and the publication evidence, then tag RightKitSwift at its VERSION on origin
   inventory check [--json] [--warn-only] [--md <file>] [--no-cache]
@@ -288,6 +325,8 @@ Commands:
                                                       Report cross-app ownership & pending requests
   ownership-mandatory [--workspace <dir>] [--app <name>]... [--amendment v2.1] [--enforce] [--json]
                                                       Check each app declares every Table 1 owner at its required version (report by default)
+  adoption-evidence --manifest <published-release-manifest.json> [--packets <dir>] [--app <dir> [--adoption <file>] [--target <target>]] [--json]
+                                                      Validate the handoff manifest (derived fields, AP set = frozen packets) and, with --app, an app's adoption record (lock pins, closure, receipts)
   cache status [--json]                              Inspect the shared local build cache
   cache prune [--dry-run|--apply] [--json]           Plan or apply safe shared-target pruning
   cache migrate --config <file> [--dry-run|--apply] [--json]