@rightkit/release 0.4.0 → 0.5.0

package/development-signing.mjs

@@ -3,6 +3,7 @@ import { closeSync, copyFileSync, existsSync, mkdtempSync, openSync, readFileSyn
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
+import { adhocSafeEntitlements } from "./adhoc-entitlements.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
 import { bundleRelativePath, compileBundlePathMap, globToRegExp, isGlobPattern, lookupBundlePath, resolveBundleIdentifier, validateBundleRelativeKey, validateIdentifierTemplate, validateSigningIdentifier } from "./mac-bundle-signing.mjs";
 
@@ -308,7 +309,7 @@ export function signMacosDevelopmentBundle(options) {
     const entitlementFile = (file) => {
       if (!signing.adhoc) return file;
       if (!safeFiles.has(file)) {
-        const safe = Object.fromEntries(Object.entries(readPlist(file, context)).filter(([key]) => key.startsWith("com.apple.security.cs.") || key === "com.apple.security.device.audio-input"));
+        const safe = adhocSafeEntitlements(readPlist(file, context));
         const out = path.join(scratch, `adhoc-${safeFiles.size}.plist`);
         writeFileSync(out, JSON.stringify(safe));
         checked("plutil", ["-convert", "xml1", out], context, "DEV_MAC_SIGNING_CONFIG_INVALID", identity);

package/host-upload-refusal.mjs

@@ -0,0 +1,90 @@
+// Dependency-free (no imports) refusal shared by every module that can put bytes in a registry. RightKit crates and @rightkit
+// packages reach a registry from CI only (publish.yml qualification, the approval commit in ci/approved-artifacts.json,
+// publish-reviewed.yml). No environment variable, flag or caller-set GITHUB_ACTIONS lifts this: CI uploads go through
+// scripts/ci/publish.mjs and scripts/ci/reviewed-candidate.mjs, never through right-release.
+export const HOST_UPLOAD_REFUSED = "RK_HOST_UPLOAD_REFUSED";
+export function hostUploadRefusalMessage(what) {
+  return `${what}: host uploads are retired; RightKit publishes only through CI's approved-hash path (publish.yml, approval in ci/approved-artifacts.json, publish-reviewed.yml). Use --dry-run, preflight or --local --qualify-only to qualify locally.`;
+}
+export function refuseHostUpload(what) {
+  throw Object.assign(new Error(hostUploadRefusalMessage(what)), { code: HOST_UPLOAD_REFUSED });
+}
+
+// ---- publish capability -------------------------------------------------------------------------------------------------
+// The publisher internals (publishGatedTarball in publication-gate.mjs, runCargoPublish in publish-cargo.mjs) are exported and read
+// registry credentials, so being importable must not mean being able to publish. Each of them refuses (refuseHostUpload) unless
+// it is handed a CAPABILITY, and a capability exists only when createPublishCapability accepted a validated admission:
+//   - the hashed admission record the credentialed job builds (schema 1, "semantic-admission" or "local-admission": original
+//     binding, source tree, verifier SHA, run and attempt, one passing verdict per archive);
+//   - an approval commit entry (ci/approved-artifacts.json: registry, name, version, sha256, reviewer) for every archive in it;
+//   - the CI run it names: GITHUB_ACTIONS=true on refs/heads/main of the repository, GITHUB_SHA equal to the admission's verifier
+//     SHA, GITHUB_RUN_ID and GITHUB_RUN_ATTEMPT equal to its run.
+// The capability is an object registered in a module-private WeakMap at creation: an object literal, a copy or a mutated clone is
+// not registered and is refused. It is bound to the units of the admission (name, version, archive sha256, registry), so one
+// capability publishes nothing else, and the publisher also compares the sha256 of the bytes it is about to send. Nothing here
+// reads an environment variable to LIFT a refusal: the environment is one of the conditions the admission must match.
+const HEX64 = /^[0-9a-f]{64}$/;
+const HEX40 = /^[0-9a-f]{40}$/;
+const POSITIVE = /^[1-9][0-9]*$/;
+export const PUBLISH_REPOSITORY = "bogusyogi/rightkit";
+const CAPABILITY_REGISTRIES = ["npm", "crates"];
+const ADMISSION_KINDS = ["semantic-admission", "local-admission"];
+const minted = new WeakMap();
+const plain = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+/** Every reason `admission` is not a valid, passing admission record for `registry` in this CI run (empty means valid). */
+export function admissionProblems(admission, { registry, env = process.env, approved = [] } = {}) {
+  const problems = [];
+  const bad = (text) => problems.push(text);
+  if (!CAPABILITY_REGISTRIES.includes(registry)) bad(`registry ${JSON.stringify(registry)} is not npm or crates`);
+  if (!plain(admission)) return [...problems, "the admission is not an object"];
+  if (admission.schema !== 1 || !ADMISSION_KINDS.includes(admission.kind)) bad("the admission schema or kind is not a reviewed admission");
+  const original = admission.original;
+  if (!plain(original) || typeof original.candidateId !== "string" || !original.candidateId || !HEX64.test(original.candidateSha256 ?? "") || !HEX40.test(original.sourceSha ?? "") || !HEX64.test(original.manifestSha256 ?? "") || !Array.isArray(original.archives) || original.archives.length === 0) bad("the admission does not bind an original candidate, manifest and archives");
+  if (!HEX40.test(admission.sourceTree ?? "") || !HEX40.test(admission.verifierSha ?? "") || !POSITIVE.test(String(admission.runId ?? "")) || !POSITIVE.test(String(admission.runAttempt ?? ""))) bad("the admission does not name its source tree, verifier commit and run");
+  const archives = Array.isArray(original?.archives) ? original.archives : [];
+  const units = Array.isArray(admission.units) ? admission.units : [];
+  if (units.length !== archives.length) bad("the admission holds no verdict for exactly its archives");
+  const names = new Set();
+  for (const archive of archives) {
+    const label = `${archive?.name}@${archive?.version}`;
+    if (!plain(archive) || typeof archive.name !== "string" || !archive.name || typeof archive.version !== "string" || !archive.version || !HEX64.test(archive.sha256 ?? "")) { bad(`archive ${label} is malformed`); continue; }
+    if (names.has(archive.name)) bad(`archive ${label} is listed twice`);
+    names.add(archive.name);
+    const verdict = units.find((row) => row?.name === archive.name);
+    if (!verdict || verdict.version !== archive.version || verdict.archiveSha256 !== archive.sha256 || verdict.ok !== true || !Array.isArray(verdict.failures) || verdict.failures.length !== 0 || !HEX64.test(verdict.evidenceSha256 ?? "")) bad(`${label} has no passing verdict for its archive`);
+    const entries = (Array.isArray(approved) ? approved : []).filter((entry) => entry?.registry === registry && entry.name === archive.name && entry.version === archive.version);
+    if (entries.length === 0 || entries.some((entry) => entry.sha256 !== archive.sha256)) bad(`${label} is not approved in ci/approved-artifacts.json with this archive hash`);
+  }
+  if (env.GITHUB_ACTIONS !== "true" || env.GITHUB_REF !== "refs/heads/main" || env.GITHUB_REPOSITORY !== PUBLISH_REPOSITORY) bad("not running in GitHub Actions on refs/heads/main of the RightKit repository");
+  if (!HEX40.test(env.GITHUB_SHA ?? "") || env.GITHUB_SHA !== admission.verifierSha || env.GITHUB_RUN_ID !== String(admission.runId) || env.GITHUB_RUN_ATTEMPT !== String(admission.runAttempt)) bad("the admission was built by another commit, run or attempt");
+  return problems;
+}
+
+/**
+ * The capability to publish exactly the archives of one validated admission to `registry`. Throws (HOST_UPLOAD_REFUSED) unless
+ * `admission` passes admissionProblems against the current CI environment and the approval entries in `approved`
+ * (ci/approved-artifacts.json `artifacts`, as scripts/ci/upload.mjs loadApprovedArtifacts returns them).
+ */
+export function createPublishCapability({ admission, approved, registry }) {
+  const problems = admissionProblems(admission, { registry, env: process.env, approved });
+  if (problems.length) refuseHostUpload(`a publish capability needs a validated admission (${problems.join("; ")})`);
+  const record = Object.freeze({ kind: "rightkit-publish-capability", registry });
+  minted.set(record, { registry, units: new Map(admission.original.archives.map((archive) => [archive.name, { version: archive.version, sha256: archive.sha256 }])), admissionVerifier: admission.verifierSha });
+  return record;
+}
+
+/**
+ * Refuses (HOST_UPLOAD_REFUSED) unless `capability` was created by createPublishCapability for this `registry` and names the
+ * unit. When `version` and `sha256` are given they must equal the admitted archive's: the publisher passes the version and the
+ * sha256 of the bytes it is about to send.
+ */
+export function assertPublishCapability(capability, { what, registry, name, version, sha256 }) {
+  const grant = typeof capability === "object" && capability !== null ? minted.get(capability) : undefined;
+  if (!grant) refuseHostUpload(`${what}: no publish capability (a validated admission is required)`);
+  if (grant.registry !== registry) refuseHostUpload(`${what}: the publish capability is for ${grant.registry}, not ${registry}`);
+  const unit = grant.units.get(name);
+  if (!unit) refuseHostUpload(`${what}: ${name} is not an archive of the admission behind the publish capability`);
+  if (version !== undefined && unit.version !== version) refuseHostUpload(`${what}: ${name}@${version} is not the admitted ${unit.version}`);
+  if (sha256 !== undefined && unit.sha256 !== sha256) refuseHostUpload(`${what}: the bytes of ${name} (${String(sha256).slice(0, 12)}) are not the admitted archive (${unit.sha256.slice(0, 12)})`);
+}

package/local-publish.mjs

@@ -24,8 +24,9 @@ import { localBuildGranted, LOCAL_BUILD_FILE } from "./execution-policy.mjs";
 import { GATE_SCHEMA, MAX_CARGO_JOBS, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
 import { runCargoPublish, runCargoReadOnly, scanCrateForSecrets } from "./publish-cargo.mjs";
 import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
+import { refuseHostUpload } from "./host-upload-refusal.mjs";
 import { pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
-import { recordPublished, stageSourceVersions } from "./rightkit-sync.mjs";
+import { recordPublished, stageSourceVersions, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
@@ -236,6 +237,99 @@ export function allFeatureCheckSets(entry = {}) {
   return entry.checkFeatureSets ?? [["--all-features"]];
 }
 
+const CONSUMER_ROW_KEYS = new Set(["manifestPath", "args", "kind", "targets", "locked"]);
+const CONSUMER_KINDS = new Set(["check"]);
+const CONSUMER_MANIFEST = /^ci\/consumers\/(?:[A-Za-z0-9._-]+\/)+Cargo\.toml$/;
+const CONSUMER_TARGET = /^[A-Za-z0-9_]+(?:-[A-Za-z0-9_.]+){2,3}$/;
+// The row owns manifest, lock, target and output format; arguments may only choose features and target kinds.
+// An ALLOWLIST (0.4.1 review A1): any token not listed is refused, so --help/-h/--version (a "passing" no-op),
+// --target-dir, -C/--directory, --color, --timings, -Z and every other Cargo option stay out of a row.
+// Keep in step with scripts/ci/gate.mjs.
+const CONSUMER_ARG_FLAGS = new Set(["--no-default-features", "--all-features", "--lib", "--bins", "--tests", "--examples", "--benches", "--all-targets"]);
+const CONSUMER_FEATURE_FLAGS = new Set(["--features", "-F"]);
+const CONSUMER_FEATURE_LIST = /^[A-Za-z0-9_][A-Za-z0-9_.+/?:,-]*$/;
+const CONSUMER_ARGS_ALLOWED = `--features <list> (or --features=<list>, -F <list>), ${[...CONSUMER_ARG_FLAGS].join(", ")}`;
+
+/**
+ * Validate the `consumerRows` of one crate's ci/gate.config.json entry and return them normalised. A consumer row
+ * checks the owning crate through a SEPARATE Cargo workspace (its own Cargo.lock), run as
+ * `cargo check --manifest-path <manifestPath> --locked [--target <t>] <args>`. Unknown fields are refused.
+ */
+export function consumerRows(unit, entry = {}) {
+  const rows = entry.consumerRows;
+  if (rows === undefined) return [];
+  const where = (index) => `${unit} consumerRows[${index}]`;
+  if (!Array.isArray(rows)) refuse(`${unit}: consumerRows must be an array`);
+  const seen = new Set();
+  return rows.map((row, index) => {
+    if (row === null || typeof row !== "object" || Array.isArray(row)) refuse(`${where(index)} must be an object`);
+    for (const key of Object.keys(row)) if (!CONSUMER_ROW_KEYS.has(key)) refuse(`${where(index)}: unknown field ${JSON.stringify(key)} (allowed: ${[...CONSUMER_ROW_KEYS].join(", ")})`);
+    const manifestPath = row.manifestPath;
+    if (typeof manifestPath !== "string" || !CONSUMER_MANIFEST.test(manifestPath) || manifestPath.split("/").some((part) => part === "." || part === "..")) {
+      refuse(`${where(index)}: manifestPath must be a relative ci/consumers/<name>/Cargo.toml path with forward slashes, got ${JSON.stringify(manifestPath)}`);
+    }
+    const kind = row.kind ?? "check";
+    if (!CONSUMER_KINDS.has(kind)) refuse(`${where(index)}: kind must be one of ${[...CONSUMER_KINDS].join(", ")}, got ${JSON.stringify(kind)}`);
+    if (row.locked !== undefined && row.locked !== true) refuse(`${where(index)}: locked must be true; a consumer row never runs without its lock file`);
+    const args = row.args ?? [];
+    if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string" || arg === "")) refuse(`${where(index)}: args must be an array of non-empty strings`);
+    for (let position = 0; position < args.length; position += 1) {
+      const arg = args[position];
+      if (CONSUMER_ARG_FLAGS.has(arg)) continue;
+      if (CONSUMER_FEATURE_FLAGS.has(arg)) {
+        const list = args[position + 1];
+        if (typeof list !== "string" || !CONSUMER_FEATURE_LIST.test(list)) refuse(`${where(index)}: ${arg} needs a feature list (names separated by commas, not starting with "-"), got ${JSON.stringify(list)}`);
+        position += 1;
+        continue;
+      }
+      if (arg.startsWith("--features=") && CONSUMER_FEATURE_LIST.test(arg.slice("--features=".length))) continue;
+      refuse(`${where(index)}: args may not contain ${JSON.stringify(arg)}; the row sets manifest path, lock, target and output itself, and allows only ${CONSUMER_ARGS_ALLOWED}`);
+    }
+    const targets = row.targets ?? [];
+    if (!Array.isArray(targets) || targets.some((target) => typeof target !== "string" || !CONSUMER_TARGET.test(target))) refuse(`${where(index)}: targets must be an array of target triples`);
+    if (new Set(targets).size !== targets.length) refuse(`${where(index)}: targets lists a triple twice`);
+    const key = JSON.stringify([manifestPath, args, targets]);
+    if (seen.has(key)) refuse(`${where(index)} repeats an earlier row`);
+    seen.add(key);
+    return { manifestPath, kind, args: [...args], targets: [...targets], locked: true };
+  });
+}
+
+/** One Cargo step per target (or one host step when no target is named) for one consumer row. */
+export function consumerRowInvocations(row) {
+  const targets = row.targets.length ? row.targets : [null];
+  return targets.map((target) => ({ command: "cargo", args: [row.kind, "--manifest-path", row.manifestPath, "--locked", ...(target ? ["--target", target] : []), ...row.args], test: false }));
+}
+
+/**
+ * Refuse a consumer row whose manifest or lock is missing from the workspace, is not tracked by git, or resolves
+ * (through a symlink) to anywhere but its own path inside the workspace (fail closed before any command;
+ * 0.4.1 review A5). The clean-tree check covers only the files git sees under the consumer directory, so a
+ * symlinked or ignored file would otherwise be a checked file nobody reviewed.
+ */
+function assertConsumerFiles(workspaceRoot, unit, rows, git = defaultGit) {
+  let realRoot;
+  try { realRoot = fs.realpathSync(workspaceRoot); } catch { refuse(`${unit}: cannot resolve the workspace ${workspaceRoot}`); }
+  for (const row of rows) {
+    for (const file of [row.manifestPath, row.manifestPath.replace(/Cargo\.toml$/, "Cargo.lock")]) {
+      const absolute = path.join(workspaceRoot, file);
+      if (!fs.existsSync(absolute)) refuse(`${unit}: consumer row needs ${file}, which is not in the workspace`);
+      let real;
+      try { real = fs.realpathSync(absolute); } catch { refuse(`${unit}: consumer row file ${file} cannot be resolved`); }
+      if (path.relative(realRoot, real) !== path.normalize(file)) refuse(`${unit}: consumer row file ${file} resolves outside its own path in the workspace (${real}); a symlink is not allowed`);
+      if (git(["ls-files", "--error-unmatch", "--", file], workspaceRoot) === null) refuse(`${unit}: consumer row file ${file} is not tracked by git; commit it first`);
+    }
+  }
+}
+
+/** The directories whose cleanliness a set of consumer rows depends on. */
+const consumerDirs = (rows) => [...new Set(rows.map((row) => path.posix.dirname(row.manifestPath)))];
+
+// The files that decide WHICH steps a publish runs: an uncommitted edit would change the plan the evidence is bound to
+// (0.4.1 review A3). Chosen over reading the HEAD blob so the publisher, the replay and the batch apply one rule:
+// the file on disk must be the committed file, or the publish is refused.
+export const GATE_CONFIG_FILES = Object.freeze(["ci/gate.config.json", "ci/asset-gated.json"]);
+
 /** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
 export function localTestPlan({ kind, unit, dir, config, manifest, batch = false, platform = "darwin" }) {
   if (kind === "npm") {
@@ -260,9 +354,13 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
     if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
   }
   // Batch mode lints the whole batch once (batchClippyInvocations) and records it as a batch receipt.
-  if (!batch) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
+  // Every tested feature set is linted (-D warnings), not only the first.
+  if (!batch) for (const features of featureSets) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"], test: false });
   for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--message-format=json-render-diagnostics", "--all-targets", ...features], test: false });
-  return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), steps };
+  // Consumer rows (separate Cargo workspaces) gate only this crate: they come from this crate's own entry.
+  const consumers = consumerRows(unit, entry);
+  for (const row of consumers) steps.push(...consumerRowInvocations(row));
+  return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), consumerRows: consumers, steps };
 }
 
 /**
@@ -274,14 +372,19 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
  * unify extra features into a selected crate and each is linted with exactly the features it was before.
  * Crates with a different RIGHTKIT_REQUIRE_ASSETS (asset-gated) stay apart so the environment is unchanged.
  */
-export function batchClippyInvocations(layer, { featuresOf = () => [], assetGatedOf = () => false } = {}) {
+export function batchClippyInvocations(layer, { featuresOf = () => [], featureSetsOf = (unit) => [featuresOf(unit)], assetGatedOf = () => false } = {}) {
   const groups = new Map();
   for (const unit of layer) {
-    const features = featuresOf(unit) ?? [];
-    const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
-    const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}`;
-    if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
-    groups.get(key).crates.push(unit);
+    // Every tested feature set of a crate is linted, in order; identical sets of one crate collapse to one run.
+    const sets = featureSetsOf(unit) ?? [[]];
+    const unique = sets.filter((set, index) => sets.findIndex((other) => JSON.stringify(other ?? []) === JSON.stringify(set ?? [])) === index);
+    for (const set of unique) {
+      const features = set ?? [];
+      const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
+      const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}:${JSON.stringify(features)}`;
+      if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
+      groups.get(key).crates.push(unit);
+    }
   }
   return [...groups.values()].map(({ crates, features, assetGated }) => ({
     crates, assetGated,
@@ -309,7 +412,15 @@ function assertLocalHost(deps, workspaceRoot, kind) {
   return platform;
 }
 
+// Host uploads are retired: only --qualify-only (no upload) runs. The upload engine below is kept for direct calls in
+// tests; no CLI path reaches it (see host-upload-refusal.mjs).
 export async function runLocalPublish(kind, argv, deps = {}) {
+  const parsed = parseLocalPublishArgs(kind, argv, deps.cwd);
+  if (!parsed.qualifyOnly) refuseHostUpload(`right-release publish ${kind} --local`);
+  return runLocalPublishUploadEngine(kind, argv, deps);
+}
+
+export async function runLocalPublishUploadEngine(kind, argv, deps = {}) {
   const parsed = parseLocalPublishArgs(kind, argv, deps.cwd);
   if (parsed.batch) return runLocalPublishBatch(parsed, deps);
   return publishUnit(parsed, deps, null);
@@ -354,9 +465,9 @@ async function publishUnit(parsed, deps, batch) {
     const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
     if (tree !== batch.tree) refuse(`${unit}: HEAD tree ${tree} differs from the batch tree ${batch.tree}`);
   }
-  const dirty = git(["status", "--porcelain", "--", dir, ...(parsed.qualifyOnly ? ["Cargo.toml", "Cargo.lock"] : [])], workspaceRoot);
+  const dirty = git(["status", "--porcelain", "--", dir, ...GATE_CONFIG_FILES, ...(parsed.qualifyOnly ? ["Cargo.toml", "Cargo.lock"] : [])], workspaceRoot);
   if (dirty === null) refuse(`cannot read git status for ${dir}`);
-  if (dirty !== "") refuse(`tree is not clean for ${dir}; commit first:\n${dirty}`);
+  if (dirty !== "") refuse(`tree is not clean for ${dir} or the gate config (${GATE_CONFIG_FILES.join(", ")}); commit first:\n${dirty}`);
   if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
   log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
@@ -366,6 +477,13 @@ async function publishUnit(parsed, deps, batch) {
   const gatedSection = assetGated[kind === "npm" ? "npm" : "crates"] ?? {};
   const isAssetGated = Object.hasOwn(gatedSection, unit);
   const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest, batch: Boolean(batch), platform });
+  if (plan.consumerRows?.length) {
+    // The consumer workspaces are part of the qualified commit: present, and unmodified like the unit itself.
+    assertConsumerFiles(workspaceRoot, unit, plan.consumerRows, git);
+    const consumerDirty = git(["status", "--porcelain", "--", ...consumerDirs(plan.consumerRows)], workspaceRoot);
+    if (consumerDirty === null) refuse(`cannot read git status for the consumer rows of ${unit}`);
+    if (consumerDirty !== "") refuse(`tree is not clean for the consumer rows of ${unit}; commit first:\n${consumerDirty}`);
+  }
   if (parsed.qualifyOnly) {
     const violations = (deps.scanSecrets ?? scanCrateForSecrets)(unitPath);
     if (violations.length) refuse(`qualification secret scan rejected: ${violations.join(", ")}`);
@@ -486,14 +604,14 @@ async function publishUnit(parsed, deps, batch) {
 
     // 5. The EXISTING publish path.
     if (kind === "npm") {
-      (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath }, deps.publishDeps ?? {});
+      (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath, workspaceRoot }, deps.publishDeps ?? {});
     } else {
       // trustEvidenceSteps: the evidence just written (and validated by the gate above) proves this commit's tests
       // and clippy, so the publisher does not repeat them; verifyOnPublish: Cargo's verify build runs in the
       // publish itself. Package contents, the runtime budget, the archive hash and the readback always run.
       const execute = deps.cargoExecute ?? (batch ? batchCargoExecute(unit) : undefined);
       const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath, trustEvidenceSteps: true, verifyOnPublish: true, offlineReadOnly: true }, execute, deps.cargoDeps ?? {});
-      await withVersionsLock(() => (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version }));
+      await withVersionsLock(() => (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version }, workspaceFeedOptions(workspaceRoot)));
     }
     log(`[right-release] published ${unit}@${version}`);
     return { kind, name: unit, version, commit: head, artifactSha256, evidencePath };
@@ -531,6 +649,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
   const isAssetGated = (unit) => Object.hasOwn(assetGated.crates ?? {}, unit);
   const versions = new Map();
+  const batchConsumerDirs = new Set();
   for (const unit of crates) {
     const dir = `crates/${unit}`;
     if (!fs.existsSync(path.join(workspaceRoot, dir))) refuse(`unit directory not found: ${path.join(workspaceRoot, dir)}`);
@@ -538,16 +657,20 @@ async function runLocalPublishBatch(parsed, deps) {
     if (pkg.name !== unit) refuse(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crates entry ${unit}`);
     if (typeof pkg.version !== "string" || !pkg.version.trim()) refuse(`${unit} has no literal version`);
     versions.set(unit, pkg.version);
-    localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true, platform }); // refuses an OS-restricted crate now, not mid-batch
+    // Refuses an OS-restricted crate, a malformed consumer row, or an untracked or symlinked consumer file now, not mid-batch.
+    const rows = localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true, platform }).consumerRows ?? [];
+    assertConsumerFiles(workspaceRoot, unit, rows, git);
+    for (const consumerDir of consumerDirs(rows)) batchConsumerDirs.add(consumerDir);
   }
   const head = git(["rev-parse", "HEAD"], workspaceRoot);
   if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
   const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
   if (!tree || !/^[0-9a-f]{40}$/.test(tree)) refuse("cannot resolve the HEAD tree");
-  // Every batch crate and the workspace manifest and lock must match the commit the batch checks are bound to.
-  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock"], workspaceRoot);
+  // Every batch crate, the workspace manifest and lock, the gate config and EVERY crate's consumer directories must
+  // match the commit the batch checks are bound to, before the first layer publishes (0.4.1 review A3, A4).
+  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock", ...GATE_CONFIG_FILES, ...batchConsumerDirs], workspaceRoot);
   if (dirty === null) refuse("cannot read git status for the batch");
-  if (dirty !== "") refuse(`tree is not clean for the batch crates or the workspace manifest; commit first:\n${dirty}`);
+  if (dirty !== "") refuse(`tree is not clean for the batch crates, the workspace manifest, the gate config or a consumer directory; commit first:\n${dirty}`);
   const registryHas = deps.registryHas ?? defaultRegistryHas;
   const published = (await Promise.all(crates.map(async (unit) => ((await registryHas({ kind: "cargo", name: unit, version: versions.get(unit) })) ? `${unit}@${versions.get(unit)}` : null)))).filter(Boolean);
   if (published.length) refuse(`already on the crates.io registry: ${published.join(", ")}; bump the version or remove them from the batch`);
@@ -573,9 +696,9 @@ async function runLocalPublishBatch(parsed, deps) {
   const scanText = `scanCrateForSecrets ${crates.map((unit) => `crates/${unit}`).join(" ")}`;
   checks.push({ name: "secret-scan", command: scanText, ok: true, ...stamp, crates });
   commands.push(scanText);
-  const featuresOf = (unit) => (gateConfig?.rust?.[unit]?.featureSets ?? [[]])[0];
+  const featureSetsOf = (unit) => gateConfig?.rust?.[unit]?.featureSets ?? [[]];
   for (const layer of layers) {
-    for (const invocation of batchClippyInvocations(layer, { featuresOf, assetGatedOf: isAssetGated })) {
+    for (const invocation of batchClippyInvocations(layer, { featureSetsOf, assetGatedOf: isAssetGated })) {
       await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated));
     }
   }