@rightkit/release 0.4.1 → 0.5.1

package/local-runtime.mjs

@@ -0,0 +1,319 @@
+// Local runtime-budget proof of ONE runtime owner on THIS host (Adrian 2026-10-22: runtime proofs no longer need GitHub CI).
+// Called by local-qualify.mjs after the host's units are qualified, so the machine is not busy with them. For every trusted
+// workload of the crate it runs the pinned Cargo command through the RustRight broker, repeatedly, each time in a quiet window
+// whose evidence it records, and returns the entry that goes into this host's `local-verify` receipt as `runtime.crates[crate]`.
+//
+// Trust and measurement, mirroring the Actions path (scripts/ci/runtime-qualify.mjs):
+//   - WHICH workloads run comes from the trusted table in runtime-qualify.mjs (`workloadsFor`), never from the candidate. The
+//     candidate's crates/<crate>/benches/workloads.json must equal that table exactly (`readSourcePrescription`) or the run
+//     refuses. The harness code is loaded from `root`, a clean checkout whose HEAD is on origin/main (local-qualify.mjs
+//     checkoutState) and equals the candidate commit; admission later requires every helper of the harness to equal the
+//     promotion checkout's (`harness.helpers` below), exactly as CI requires the producer's blobs to.
+//   - WHAT is measured is the candidate's source at `commit`: the checkout is verified clean and at `commit` before and
+//     after every run, so the bench cannot have built anything else. Every file the measurement depends on is hashed from
+//     the git blobs of `commit` into `bindings`, as CI does (bindSource).
+//   - HOW it is measured: the same `RESULT budget` line the bench prints, parsed and recorded by the owner's own
+//     `recordMeasurement`, checked by the owner's own `measurementProblems` against the frozen budget (profile, ceilings,
+//     required scale). The submitted record is the WORST of `repeats` runs, every run must pass, and each run holds a window
+//     that local-runtime-proof.mjs `windowProblems` calls quiet. A disturbed window refuses; it is never retried silently.
+// The broker has no client-held exclusive lease (docs/CI.md), so quiet is DETECTED: health snapshots before, during and after,
+// the broker's job listing for overlapping root jobs, and host CPU idle before and after.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { spawnCollect } from "./managed-cargo.mjs";
+import { discoverBrokerSocket, managedControlCandidates } from "./managed-roots.mjs";
+
+const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
+const sleepFor = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const round3 = (value) => Math.round(value * 1000) / 1000;
+const tail = (text, lines = 30) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
+const loadFromRoot = (root, ...segments) => import(pathToFileURL(path.join(root, ...segments)).href);
+const CREDENTIAL_LIKE = /TOKEN|PASSWORD|SECRET|CREDENTIAL|^ACTIONS_ID_TOKEN/i;
+const BROKER_ENV = ["RIGHTKIT_BUILD_BROKER_SOCKET", "RIGHTKIT_CONTROL_ROOT", "RIGHTKIT_DATA_ROOT", "RIGHTKIT_MANAGED_ROOT"];
+const BENCH_TIMEOUT_MS = 40 * 60 * 1000;
+
+// ---- host evidence -------------------------------------------------------------------------------
+
+/** Candidate locations of the broker's health.json on this host, most specific first. */
+export function brokerHealthFiles({ env = process.env, platform = process.platform, home = os.homedir() } = {}) {
+  const join = platform === "win32" ? path.win32.join : path.posix.join;
+  const files = [env.RK_BROKER_HEALTH_FILE, ...managedControlCandidates({ env, platform }).map((root) => join(root, "health.json"))];
+  if (platform === "darwin") files.push(path.posix.join(home, "Library", "Application Support", "RustRight", "health.json"));
+  return [...new Set(files.filter(Boolean))];
+}
+
+/** The newest readable broker snapshot, stamped with the time it was read; null when none is readable. */
+export function readBrokerHealth({ files, readFile = fs.readFileSync, now = Date.now } = {}) {
+  let best = null;
+  for (const file of files) {
+    let doc;
+    try { doc = JSON.parse(readFile(file, "utf8")); } catch { continue; }
+    if (doc?.schemaVersion !== 1 || !Number.isInteger(doc.writtenAtMs)) continue;
+    if (!best || doc.writtenAtMs > best.writtenAtMs) best = { writtenAtMs: doc.writtenAtMs, sampledAtMs: now(), state: doc.state, admissionPaused: doc.admissionPaused, inFlight: doc.inFlight, queued: doc.queued, admitting: doc.admitting, pid: doc.pid ?? null };
+  }
+  return best;
+}
+
+const cpuTotals = (cpus) => cpus.reduce((sum, cpu) => { const t = cpu.times; sum.idle += t.idle; sum.total += t.user + t.nice + t.sys + t.idle + t.irq; return sum; }, { idle: 0, total: 0 });
+/** Host-wide CPU idle share over `ms`, from the OS tick counters (every process, not only ours). */
+export async function sampleCpu(ms, { cpus = os.cpus, loadavg = os.loadavg, sleep = sleepFor, now = Date.now, platform = process.platform } = {}) {
+  const startedAtMs = now();
+  const first = cpuTotals(cpus());
+  await sleep(ms);
+  const second = cpuTotals(cpus());
+  const total = second.total - first.total;
+  return { startedAtMs, durationMs: now() - startedAtMs, idlePercent: total > 0 ? round3((100 * (second.idle - first.idle)) / total) : null, cores: cpus().length, loadavg1: platform === "win32" ? null : round3(loadavg()[0]) };
+}
+
+/** Root jobs of the broker's listing (`rustright list`): live ones from `inFlight`, finished ones from `recent`. Tolerant of wrapping. */
+export function parseBrokerJobs(text) {
+  const jobs = []; let found = false;
+  const take = (rows, live) => {
+    if (!Array.isArray(rows)) return;
+    found = true;
+    for (const row of rows) {
+      const submittedAtMs = Date.parse(row?.submittedAt);
+      if (!row || typeof row !== "object" || !Number.isFinite(submittedAtMs)) continue;
+      const startedAtMs = row.startedAt ? Date.parse(row.startedAt) : null;
+      jobs.push({ id: String(row.id), workspace: row.workspace ?? null, live, submittedAtMs, startedAtMs: Number.isFinite(startedAtMs) ? startedAtMs : null, endedAtMs: live ? null : (Number.isFinite(row.elapsedMs) ? submittedAtMs + row.elapsedMs : null) });
+    }
+  };
+  for (const line of String(text ?? "").split(/\r?\n/)) {
+    let doc; try { doc = JSON.parse(line); } catch { continue; }
+    for (const holder of [doc, doc?.event, doc?.result]) if (holder && typeof holder === "object") { take(holder.inFlight, true); take(holder.recent, false); }
+  }
+  if (!found) throw new Error("the broker job listing has no inFlight or recent list");
+  return jobs;
+}
+
+const samePath = (a, b) => String(a ?? "").replaceAll("\\", "/").replace(/\/+$/, "").toLowerCase() === String(b ?? "").replaceAll("\\", "/").replace(/\/+$/, "").toLowerCase();
+/**
+ * Which root jobs touched the span [fromMs, toMs]. `ours` counts the root jobs in the measured checkout that were submitted
+ * at the run start; anything else that overlaps the span, in any workspace, is foreign. A finished job whose end is unknown
+ * is treated as still running (it overlaps).
+ */
+export function analyzeJobs({ jobs, root, fromMs, toMs, runStartMs, checkedAtMs, slackMs = 1000 }) {
+  const mine = jobs.filter((job) => samePath(job.workspace, root) && job.submittedAtMs >= runStartMs - 5000 && job.submittedAtMs <= runStartMs + 60_000);
+  const overlaps = (job) => (job.startedAtMs ?? job.submittedAtMs) <= toMs + slackMs && (job.live || job.endedAtMs === null || job.endedAtMs >= fromMs - slackMs);
+  const foreign = jobs.filter((job) => overlaps(job) && !(mine.length === 1 && job.id === mine[0].id));
+  return { checked: true, fromMs, toMs, checkedAtMs, ours: mine.length, foreign: foreign.map(({ id, workspace, live, startedAtMs, endedAtMs }) => ({ id, workspace, live, startedAtMs, endedAtMs })) };
+}
+
+/** The broker listing at one moment, reduced to what the window proof needs: when it was read, which root jobs it names, which are live. */
+export const listingRecord = (jobs, checkedAtMs) => ({ checked: true, checkedAtMs, ids: jobs.map((job) => job.id), live: jobs.filter((job) => job.live).map((job) => job.id) });
+
+async function listBrokerJobs({ client, env, run }) {
+  const result = await run(client, ["list"], { env, timeout: 30_000, windowsHide: true });
+  if (result.error || result.status !== 0) throw new Error(`rustright list failed: ${result.error?.message ?? `exit ${result.status}`}`);
+  return parseBrokerJobs(result.stdout);
+}
+
+// ---- the proof -----------------------------------------------------------------------------------
+
+async function defaultHarness(root) {
+  const [owner, proof, budgets, supplement, workloadEnv] = await Promise.all([
+    loadFromRoot(root, "scripts", "ci", "runtime-qualify.mjs"), loadFromRoot(root, "scripts", "ci", "local-runtime-proof.mjs"), loadFromRoot(root, "packages", "release", "runtime-budgets.mjs"),
+    loadFromRoot(root, "scripts", "ci", "runtime-supplement.mjs"), loadFromRoot(root, "scripts", "ci", "runtime-workload-env.mjs"),
+  ]);
+  return { owner, proof, budgets, workloadEnv, helperPaths: supplement.trustedRuntimeHelperPaths };
+}
+
+/** `args` of a pinned bench command with `--no-run` before the bench's own `--` arguments: a warm build, never a measurement. */
+export const warmArgs = (args) => { const at = args.indexOf("--"); return at < 0 ? [...args, "--no-run"] : [...args.slice(0, at), "--no-run", ...args.slice(at)]; };
+
+/**
+ * Measures `crate` on this host and returns its runtime entry (see scripts/ci/runtime-supplement.mjs verifyLocalRuntimeProof
+ * for what admission checks). Throws with every reason on the first refusal; nothing partial is returned.
+ * options: root, commit, crate, version, archiveSha256, candidateId, broker, cargoCommand, repository, scratch,
+ *          repeats (policy range), waitIdleMs (how long to wait for a quiet host before refusing).
+ */
+export async function measureRuntimeCrate(options, deps = {}) {
+  const { root, commit, crate, version, archiveSha256, candidateId, broker, cargoCommand, repository, scratch, repeats, waitIdleMs = 0 } = options;
+  const log = deps.log ?? (() => {});
+  const platform = deps.platform ?? process.platform;
+  const arch = deps.arch ?? process.arch;
+  const now = deps.now ?? Date.now;
+  const sleep = deps.sleep ?? sleepFor;
+  const H = await (deps.loadHarness ?? defaultHarness)(root);
+  const { owner, proof } = H;
+  const policy = proof.WINDOW_POLICY;
+  if (!Number.isInteger(repeats) || repeats < policy.minRepeats || repeats > policy.maxRepeats) throw new Error(`repeats must be an integer from ${policy.minRepeats} to ${policy.maxRepeats}`);
+  const gitText = deps.git ?? ((args) => { const r = spawnSync("git", args, { cwd: root, encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024 }); return r.error || r.status !== 0 ? null : (r.stdout ?? "").trim(); });
+  const blob = deps.gitBlob ?? ((full) => { const r = spawnSync("git", ["cat-file", "blob", `${commit}:${full}`], { cwd: root, encoding: "buffer", windowsHide: true, maxBuffer: 64 * 1024 * 1024 }); if (r.error || r.status !== 0) throw new Error(`candidate blob missing: ${full}`); return Buffer.from(r.stdout); });
+  const lsTree = (paths) => { const text = gitText(["ls-tree", "-r", "--name-only", commit, ...paths]); if (text === null) throw new Error("cannot list the candidate tree"); return text.split(/\r?\n/).filter(Boolean); };
+  const assertCheckout = (when) => {
+    const head = gitText(["rev-parse", "HEAD"]); const dirty = gitText(["status", "--porcelain"]);
+    if (head !== commit) throw new Error(`${when}: HEAD is ${String(head).slice(0, 12)}, not the candidate commit ${commit.slice(0, 12)}; the measured source changed`);
+    if (dirty !== "") throw new Error(`${when}: the checkout is not clean, so the measured source is not the candidate:\n${dirty}`);
+  };
+  assertCheckout("start");
+
+  // Trusted coverage first: a crate without it has nothing to run, and the candidate cannot supply its own list.
+  const trusted = owner.workloadsFor(crate);
+  const { prescription, workloads } = owner.readSourcePrescription(crate, blob);
+  if (JSON.stringify(workloads.map((w) => w.id)) !== JSON.stringify(trusted.map((w) => w.id))) throw new Error("candidate workloads differ from the trusted table");
+  const crateDir = path.join(root, "crates", crate);
+  let budget;
+  try { budget = JSON.parse(blob(`crates/${crate}/runtime-budget.json`)); } catch { throw new Error("candidate runtime-budget.json is missing or not JSON"); }
+
+  const bindings = {};
+  for (const full of [...lsTree([`crates/${crate}/src`]), `crates/${crate}/Cargo.toml`]) bindings[full] = sha256(blob(full));
+  Object.assign(bindings, owner.bindHarnessMetadata(crate, prescription, blob));
+  for (const full of lsTree(["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo", `crates/${crate}/benches`, "crates/rightkit-child-process/src", "crates/rightkit-child-process/Cargo.toml"])) bindings[full] = sha256(blob(full));
+  const { specs, problems: scopeProblems = [] } = (deps.measuredPathspecs ?? H.budgets.measuredPathspecs)(crateDir);
+  if (scopeProblems.length) throw new Error(`cannot bind the measured dependency scope: ${scopeProblems.join("; ")}`);
+  for (const full of lsTree(specs)) bindings[full] = sha256(blob(full));
+  const helpers = Object.fromEntries(H.helperPaths().map((name) => [name, sha256(blob(name))]));
+
+  const baseEnv = Object.fromEntries(Object.entries(deps.env ?? process.env).filter(([name]) => !CREDENTIAL_LIKE.test(name)));
+  const brokerEnv = Object.fromEntries(BROKER_ENV.filter((name) => baseEnv[name]).map((name) => [name, baseEnv[name]]));
+  const socket = discoverBrokerSocket(deps.env ?? process.env, { platform });
+  if (socket) brokerEnv.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
+  const run = deps.run ?? ((command, args, settings) => spawnCollect(command, args, { maxBuffer: 64 * 1024 * 1024, ...settings }));
+  const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: root, windowsHide: true, ...settings });
+  const toolchainOf = async () => {
+    const rustc = await run(cargoCommand[0] === "rightkit" ? "rightkit" : "rustc", cargoCommand[0] === "rightkit" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
+    const cargo = await invoke(["-V"], { env: { ...baseEnv, ...brokerEnv }, timeout: 60_000 });
+    if (rustc.error || rustc.status !== 0 || cargo.error || cargo.status !== 0) throw new Error("cannot read the toolchain through the broker");
+    return { rustc: String(rustc.stdout).trim(), cargo: String(cargo.stdout).trim() };
+  };
+  const toolchain = await toolchainOf();
+
+  const healthFiles = deps.healthFiles ?? brokerHealthFiles({ env: deps.env ?? process.env, platform });
+  const readHealth = deps.readHealth ?? (() => readBrokerHealth({ files: healthFiles, now }));
+  const cpuSample = deps.sampleCpu ?? ((ms) => sampleCpu(ms, { sleep, now, platform }));
+  const listJobs = deps.listJobs ?? (() => listBrokerJobs({ client: broker.client, env: { ...baseEnv, ...brokerEnv }, run }));
+
+  async function awaitQuiet(label) {
+    const deadline = now() + waitIdleMs;
+    for (;;) {
+      let problems;
+      const first = readHealth();
+      problems = first ? proof.brokerIdleProblems(first, "before", policy) : ["before: no broker health snapshot is readable"];
+      if (!problems.length) {
+        const cpu = await cpuSample(policy.before.minCpuSampleMs + 500);
+        const confirm = readHealth();
+        problems = [...proof.cpuIdleProblems(cpu, "before", policy.before), ...(confirm ? proof.brokerIdleProblems(confirm, "before", policy) : ["before: no broker health snapshot is readable"])];
+        if (!problems.length) return { health: confirm, cpu };
+      }
+      if (now() >= deadline) throw new Error(`${label}: the host is not quiet${waitIdleMs ? ` after waiting ${Math.round(waitIdleMs / 60_000)} min` : ""}; no measurement was taken: ${problems.join("; ")}`);
+      await sleep(5000);
+    }
+  }
+
+  // The owner recorder rewrites runtime-budget.json and writes an evidence alias inside the checkout, as in CI; it is restored
+  // in `finally` and the checkout is verified clean again.
+  function recordRun({ workload, raw, index, command }) {
+    const budgetFile = path.join(crateDir, "runtime-budget.json");
+    const before = fs.readFileSync(budgetFile);
+    const alias = path.join(crateDir, "runtime-budget.evidence", `${platform}-${arch}-${version}-synthetic.txt`);
+    const prior = fs.existsSync(alias) ? fs.readFileSync(alias) : null;
+    const resultFile = path.join(scratch, `${workload.id}-run-${index}.txt`);
+    fs.mkdirSync(scratch, { recursive: true });
+    fs.writeFileSync(resultFile, raw);
+    try {
+      const record = (deps.recordMeasurement ?? H.budgets.recordMeasurement)({ crateDir, resultFile, scope: "synthetic", command, description: workload.description });
+      return owner.preserveWorkloadRecord(structuredClone(record), workload.id, crate);
+    } finally {
+      fs.writeFileSync(budgetFile, before);
+      if (prior !== null) fs.writeFileSync(alias, prior); else if (fs.existsSync(alias)) fs.unlinkSync(alias);
+      fs.rmSync(resultFile, { force: true });
+    }
+  }
+
+  const entryWorkloads = [];
+  for (const workload of trusted) {
+    const gate = owner.budgetForWorkload(budget, workload);
+    const command = `cargo ${workload.args.join(" ")}`;
+    // Warm build first: compilation is never part of a quiet window and never overlaps a measurement.
+    log(`[local-runtime] ${crate}/${workload.id}: warm build`);
+    const warm = await invoke(warmArgs(workload.args), { env: { ...baseEnv, ...brokerEnv }, timeout: BENCH_TIMEOUT_MS });
+    if (warm.error || warm.status !== 0) throw new Error(`${workload.id}: the warm build failed (${warm.error?.message ?? `exit ${warm.status}`})\n${tail(`${warm.stdout}\n${warm.stderr}`)}`);
+    const runs = [];
+    for (let index = 0; index < repeats; index += 1) {
+      assertCheckout(`${workload.id}#${index} before`);
+      const label = `${workload.id} run ${index + 1}/${repeats}`;
+      log(`[local-runtime] ${crate}/${label}: waiting for a quiet host`);
+      const quiet = await awaitQuiet(label);
+      // The broker's job listing at grant: read once the host is quiet and before the run starts. Nothing may be live.
+      let grantJobs;
+      try { grantJobs = listingRecord(await listJobs(), now()); } catch (error) { grantJobs = { checked: false, error: error.message }; }
+      let provisioned; let cleanup = null; let result; const during = [];
+      const startedAtMs = now();
+      try {
+        provisioned = H.workloadEnv.provisionWorkloadEnv(workload.env);
+        const env = { ...H.workloadEnv.workloadEnvironment(baseEnv, workload.env, provisioned.values), ...brokerEnv, CARGO_INCREMENTAL: "1" };
+        const running = invoke(workload.args, { env, timeout: BENCH_TIMEOUT_MS });
+        let finished = false;
+        running.then(() => { finished = true; }, () => { finished = true; });
+        while (!finished) {
+          // Only a snapshot the broker WROTE during the run is evidence of it, and each distinct write is kept once.
+          const sample = readHealth(); if (sample && sample.writtenAtMs >= startedAtMs && (!during.length || sample.writtenAtMs > during[during.length - 1].writtenAtMs)) during.push(sample);
+          await Promise.race([running.catch(() => {}), sleep(1000)]);
+        }
+        result = await running;
+      } catch (error) { result = { error, status: null, signal: null, stdout: "", stderr: `workload environment failed: ${error.message}` }; }
+      finally { try { provisioned?.dispose(); } catch (error) { cleanup = error.message; } }
+      const endedAtMs = now();
+      // Broker idle again, from a snapshot written after the run ended (the broker rewrites health every 5 s).
+      let afterHealth = null; const settleBy = now() + 20_000;
+      for (;;) {
+        const sample = readHealth(); if (sample) afterHealth = sample;
+        if (afterHealth && afterHealth.writtenAtMs >= endedAtMs && !proof.brokerIdleProblems(afterHealth, "after", policy).length) break;
+        if (now() >= settleBy) break;
+        await sleep(1000);
+      }
+      const afterCpu = await cpuSample(policy.after.minCpuSampleMs + 500);
+      const checkedAtMs = now();
+      let jobs;
+      try {
+        const listing = await listJobs();
+        jobs = { ...analyzeJobs({ jobs: listing, root, fromMs: quiet.cpu.startedAtMs, toMs: afterCpu.startedAtMs + afterCpu.durationMs, runStartMs: startedAtMs, checkedAtMs }), atGrant: grantJobs, atRelease: listingRecord(listing, checkedAtMs) };
+      } catch (error) { jobs = { checked: false, error: error.message }; }
+      const window = { policy: policy.id, startedAtMs, endedAtMs, before: { health: quiet.health, cpu: quiet.cpu }, during: { health: during }, after: { health: afterHealth, cpu: afterCpu }, jobs };
+      const windowIssues = proof.windowProblems(window, policy, { minWindowMs: proof.minWindowMsFor(crate, workload.id, policy), runStartedAtMs: startedAtMs, runEndedAtMs: endedAtMs });
+      window.quiet = windowIssues.length === 0;
+      assertCheckout(`${label} after`);
+      if (!window.quiet) throw new Error(`${label}: the window was not quiet (disturbed by something on this host; rerun when idle): ${windowIssues.join("; ")}`);
+      const raw = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+      if (cleanup) throw new Error(`${label}: ${cleanup}`);
+      if (result.error || result.status !== 0) throw new Error(`${label}: the bench failed (${result.error?.message ?? `exit ${result.status}`})\n${tail(raw)}`);
+      let record;
+      try { record = recordRun({ workload, raw, index, command }); } catch (error) { throw new Error(`${label}: the owner recorder rejected the run: ${error.message}`); }
+      assertCheckout(`${label} recorded`);
+      const issues = owner.measurementProblems(record, gate, commit, platform);
+      if (issues.length) throw new Error(`${label}: over budget or unproven: ${issues.join("; ")}`);
+      runs.push({ index, startedAt: new Date(startedAtMs).toISOString(), endedAt: new Date(endedAtMs).toISOString(), exitCode: result.status, signal: result.signal ?? null, rawSha256: sha256(Buffer.from(raw)), raw, record, window });
+      log(`[local-runtime] ${crate}/${label}: ok (${JSON.stringify(record.observed)})`);
+    }
+    const selected = proof.worstIndex(runs.map((run) => run.record), gate);
+    const picked = runs[selected];
+    entryWorkloads.push({
+      schema: 2, source: "local", workload: workload.id, intervalMs: workload.intervalMs ?? null, crate, version, repository, runId: candidateId, runAttempt: "local", sourceSha: commit,
+      artifactId: "local", artifactDigest: null, harnessSha: commit, qualificationRunId: candidateId, qualificationRunAttempt: "local", manifestSha256: null, bindings, toolchain,
+      host: { os: platform, arch, release: (deps.release ?? os.release)(), runner: "local" }, command, invocation: [...cargoCommand, ...workload.args].join(" "), envNames: [...workload.env],
+      rawFile: `${workload.id}-bench.txt`, rawSha256: picked.rawSha256, exitCode: picked.exitCode, signal: null, problems: [], record: picked.record, selected, repeats: runs,
+    });
+  }
+  assertCheckout("end");
+  const cpus = (deps.cpus ?? os.cpus)();
+  return {
+    schema: 1, kind: "local-runtime-crate", source: "local", policy: policy.id, crate, version, sourceSha: commit, candidateId, manifestSha256: null, archiveSha256,
+    host: { os: platform, arch, release: (deps.release ?? os.release)(), model: cpus[0]?.model ?? null, cores: cpus.length }, broker: structuredClone(broker),
+    harness: { sourceSha: commit, helpers }, workloads: entryWorkloads,
+  };
+}
+
+/** Fills in what is only known once the packed manifest is sealed (the host measured before the driver sealed it). */
+export function bindRuntimeManifest(runtime, manifestSha256) {
+  const bound = structuredClone(runtime);
+  for (const entry of Object.values(bound.crates)) {
+    entry.manifestSha256 = manifestSha256;
+    for (const item of entry.workloads) { item.manifestSha256 = manifestSha256; item.artifactDigest = `local:${manifestSha256}`; }
+  }
+  return bound;
+}

package/lock-graph.mjs

@@ -0,0 +1,51 @@
+// Pure Cargo.lock graph functions shipped with @rightkit/release for rightkit-gate (the local gate).
+// KEEP IDENTICAL to parseLock, changedLockNames and reach in scripts/ci/select.mjs (RightKit CI, not shipped);
+// rightkit-gate.test.mjs compares the two sources and fails on any difference. No process, no filesystem.
+
+/**
+ * Parse Cargo.lock into name -> { signatures: string[], deps: Set<name> }.
+ * A package's signature covers version, source, checksum and its dependency list, so any change
+ * to what gets compiled changes it. Dependency edges are by name: over-approximate, never under.
+ */
+export function parseLock(text) {
+  const packages = new Map();
+  for (const block of String(text ?? "").split(/^\[\[package\]\]\s*$/m).slice(1)) {
+    const name = /^name = "([^"]+)"/m.exec(block)?.[1];
+    if (!name) continue;
+    const field = (key) => new RegExp(`^${key} = "([^"]*)"`, "m").exec(block)?.[1] ?? "";
+    const depsRaw = /^dependencies = \[([^\]]*)\]/m.exec(block)?.[1] ?? "";
+    const deps = [...depsRaw.matchAll(/"([^"\s]+)[^"]*"/g)].map((m) => m[1]);
+    const entry = packages.get(name) ?? { signatures: [], deps: new Set() };
+    entry.signatures.push([field("version"), field("source"), field("checksum"), deps.join(",")].join("|"));
+    for (const dep of deps) entry.deps.add(dep);
+    packages.set(name, entry);
+  }
+  for (const entry of packages.values()) entry.signatures.sort();
+  return packages;
+}
+
+/** Names whose lock entry is new or different in `next`. */
+export function changedLockNames(previous, next) {
+  const changed = new Set();
+  for (const [name, entry] of next) {
+    const before = previous.get(name);
+    if (!before || before.signatures.join("\n") !== entry.signatures.join("\n")) changed.add(name);
+  }
+  return changed;
+}
+
+/** Every package name reachable from `name` through the lock graph, `name` excluded. */
+export function reach(lock, name, memo = new Map()) {
+  if (memo.has(name)) return memo.get(name);
+  const seen = new Set();
+  const stack = [...(lock.get(name)?.deps ?? [])];
+  while (stack.length) {
+    const next = stack.pop();
+    if (seen.has(next)) continue;
+    seen.add(next);
+    for (const dep of lock.get(next)?.deps ?? []) stack.push(dep);
+  }
+  seen.delete(name);
+  memo.set(name, seen);
+  return seen;
+}

package/managed-cargo.mjs

@@ -1,6 +1,6 @@
 import { discoverBrokerSocket, managedControlCandidates, resolveManagedRoots } from './managed-roots.mjs';
 import { randomUUID } from "node:crypto";
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawn as spawnProcess, spawnSync } from "./background-process.mjs";
@@ -17,6 +17,9 @@ export function managedRuntimeClient(env = process.env, platform = process.platf
   if (platform === 'darwin') {
     const client = path.posix.join(env.HOME || homedir(), 'Library', 'Application Support', 'RustRight', 'runtime', 'rustright');
     if (exists(client)) return client;
+    // Broker-managed HOME may point at a build home; the installed native client belongs to the OS account.
+    const accountClient = path.posix.join(userInfo().homedir, 'Library', 'Application Support', 'RustRight', 'runtime', 'rustright');
+    if (exists(accountClient)) return accountClient;
   }
   // RustRight's own install on Windows (2026-10-18 cutover): the runtime moved out of the control root to
   // <drive>\.rustright\runtime, beside the control root's drive, and runtime-current was retired.

package/ownership-approval.mjs

@@ -302,22 +302,39 @@ export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion,
   if (trust.policyBundle?.digest && policyBundleDigest !== undefined && trust.policyBundle.digest !== policyBundleDigest) warnings.push(POLICY_BUNDLE_DRIFT_WARNING);
   return { ok: problems.length === 0, problems, warnings };
 }
-function protectedLocation(file, platform, { runner = spawnSync, inspect = lstatSync, stat = statSync, requireNonElevated = true } = {}) {
+// Windows ACL answers, per runner, for a short window: every trust check walks the same ancestor directories (C:\, C:\Users, ...)
+// and each answer costs a Windows PowerShell start (~2 s), so a scan of many files repeated the same lookups hundreds of times
+// (the fingerprint-samples test: 187 scanner runs, ~8 ancestors each). An ACL that changes within the window is caught on the
+// next check after it; a failed lookup is never cached.
+const WINDOWS_ACL_MEMO = new WeakMap();
+export const WINDOWS_ACL_MEMO_TTL_MS = 30_000;
+function windowsAclLookup(runner, target, script, now) {
+  let memo = WINDOWS_ACL_MEMO.get(runner);
+  if (!memo) { memo = new Map(); WINDOWS_ACL_MEMO.set(runner, memo); }
+  const hit = memo.get(target);
+  if (hit && now - hit.at < WINDOWS_ACL_MEMO_TTL_MS) return hit.r;
+  const r = runner("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment({ RK_TRUST_CHECK_TARGET: target }) });
+  if (r && r.status === 0) memo.set(target, { at: now, r }); else memo.delete(target);
+  return r;
+}
+
+function protectedLocation(file, platform, { runner = spawnSync, inspect = lstatSync, stat = statSync, requireNonElevated = true, now = Date.now } = {}) {
   const problems = [];
   if (platform === "win32") {
     const dirs = [];
-    let current = path.dirname(file);
+    // Audit the requested platform's ancestors even when fixtures run on another host.
+    let current = path.win32.dirname(file);
     while (true) {
       dirs.push(current);
-      if (path.dirname(current) === current) break;
-      current = path.dirname(current);
+      if (path.win32.dirname(current) === current) break;
+      current = path.win32.dirname(current);
     }
     dirs.push(file);
     for (const target of dirs) {
       try { if (inspect(target).isSymbolicLink()) problems.push(`trust path contains a reparse/symlink: ${target}`); } catch { problems.push(`cannot inspect trust path: ${target}`); continue; }
       const script = "$ErrorActionPreference='Stop'; $a=Get-Acl -LiteralPath $env:RK_TRUST_CHECK_TARGET; $item=Get-Item -Force -LiteralPath $env:RK_TRUST_CHECK_TARGET; $id=[Security.Principal.WindowsIdentity]::GetCurrent(); $p=New-Object Security.Principal.WindowsPrincipal($id); $ownerSid=$a.GetOwner([Security.Principal.SecurityIdentifier]).Value; $ownerName=$a.Owner; $out=[ordered]@{ownerSID=$ownerSid;ownerName=$ownerName;attributes=$item.Attributes.ToString();directory=[bool]$item.PSIsContainer;nonempty=(!$item.PSIsContainer -or [System.IO.Directory]::EnumerateFileSystemEntries($item.FullName).GetEnumerator().MoveNext());elevated=$p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator);access=@($a.Access | ForEach-Object { [ordered]@{identitySID=$_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value;type=$_.AccessControlType.ToString();mask=[int64]$_.FileSystemRights.value__;propagationFlags=[int]$_.PropagationFlags} })}; $out | ConvertTo-Json -Compress -Depth 5";
-      const r = runner("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment({ RK_TRUST_CHECK_TARGET: target }) });
-      if (r.status !== 0) { problems.push(`cannot inspect trust ACL: ${target}`); continue; }
+      const r = windowsAclLookup(runner, target, script, now());
+      if (!r || r.status !== 0) { problems.push(`cannot inspect trust ACL: ${target}`); continue; }
       try {
         const acl = JSON.parse(r.stdout.trim());
         const result = evaluateWindowsAcl(acl, { target, requireNonElevated });

package/ownership-mandatory-set.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "source": {
-    "table": "private-audits/TABLE1-MANDATORY.md:56-78 (M1-M23 requirement catalog)",
+    "table": "private-audits/TABLE1-MANDATORY.md:56-78 (M1-M23 requirement catalog; M24-M25 added 2026-10-21, pending)",
     "versions": "registry readback 2026-10-19 after the mandatory-set publish (#790): min = registryMax = the live version",
     "note": "min = registryMax = the required version: the live registry version of the published mandatory set (#790). Raise both with each mandatory-set publish."
   },
@@ -196,8 +196,8 @@
         {
           "name": "@rightkit/settings-ui",
           "ecosystem": "npm",
-          "min": "0.6.1",
-          "registryMax": "0.6.1"
+          "min": "0.7.0",
+          "registryMax": "0.7.0"
         }
       ]
     },
@@ -209,8 +209,8 @@
         {
           "name": "rightkit-credentials",
           "ecosystem": "cargo",
-          "min": "0.3.0",
-          "registryMax": "0.3.0"
+          "min": "0.4.2",
+          "registryMax": "0.4.2"
         }
       ]
     },
@@ -291,8 +291,8 @@
         {
           "name": "@rightkit/logs",
           "ecosystem": "npm",
-          "min": "0.1.5",
-          "registryMax": "0.1.5"
+          "min": "0.1.6",
+          "registryMax": "0.1.6"
         }
       ]
     },
@@ -330,8 +330,8 @@
         {
           "name": "@rightkit/app-update",
           "ecosystem": "npm",
-          "min": "0.4.0",
-          "registryMax": "0.4.0"
+          "min": "0.4.1",
+          "registryMax": "0.4.1"
         }
       ]
     },
@@ -343,8 +343,8 @@
         {
           "name": "@rightkit/release",
           "ecosystem": "npm",
-          "min": "0.4.0",
-          "registryMax": "0.4.0",
+          "min": "0.4.1",
+          "registryMax": "0.4.1",
           "allowDev": true
         }
       ]
@@ -427,8 +427,9 @@
         {
           "name": "@rightkit/release",
           "ecosystem": "npm",
-          "min": "0.4.0",
-          "allowDev": true
+          "min": "0.4.1",
+          "allowDev": true,
+          "registryMax": "0.4.1"
         },
         {
           "name": "rightkit-daemon",
@@ -436,6 +437,45 @@
           "min": "0.3.0"
         }
       ]
+    },
+    {
+      "id": "M24",
+      "name": "Issue tracker",
+      "profile": "all",
+      "owners": [],
+      "ownerPending": "@rightkit/issues-tracker 0.1.0 is not yet published (rightkit#875); never fails.",
+      "pendingOwners": [
+        {
+          "name": "@rightkit/issues-tracker",
+          "ecosystem": "npm",
+          "min": "0.1.0",
+          "allowDev": true
+        }
+      ]
+    },
+    {
+      "id": "M25",
+      "name": "End-to-end journeys",
+      "profile": [
+        "desktop",
+        "apple"
+      ],
+      "owners": [],
+      "ownerPending": "Journeys capability (E2E-TESTING-STANDARD, rightkit#878) is not built or published in rightkit-qa / @rightkit/qa; never fails.",
+      "pendingOwners": [
+        {
+          "name": "rightkit-qa",
+          "ecosystem": "cargo",
+          "min": "0.7.0",
+          "allowDev": true
+        },
+        {
+          "name": "@rightkit/qa",
+          "ecosystem": "npm",
+          "min": "0.5.1",
+          "allowDev": true
+        }
+      ]
     }
   ],
   "applicabilityRecords": {

package/ownership-mandatory-set.mjs

@@ -2,7 +2,7 @@
 // right-release ownership-mandatory: Table 1 mandatory-owner-set check (plan task 5.1).
 //
 // This evaluates declarations only; it does not establish active target/features, lock resolution or production adoption.
-// A registered app must declare every Table 1 owner (rows M1-M23) at or above the required version,
+// A registered app must declare every Table 1 owner (enforced rows M1-M20, M22; pending rows M21, M23-M25 never fail) at or above the required version,
 // from the registry. Report mode (default) prints per-app findings and exits 0; --enforce exits 1
 // on any missing owner, below-required version, or path/git/patch override ("not-on-registry").
 // Mode switching of the ownership gate itself (Report -> Enforce) is a separate step; this check
@@ -15,8 +15,9 @@
 //   { "profile": "desktop", "notApplicable": { "M16": "reason text" },
 //     "M22": { "role": "client|host|both|absent", "entrypoints": ["src-tauri/src/agent.rs#register_tools"] } }
 //
-// PK17.scanner (report only, never enforcement): rows M21 and M23 stay `ownerPending` and never fail, but each lists its
-// `pendingOwners` (M21: rightkit-fs, rightkit-daemon, rightkit-qa; M23: @rightkit/release, rightkit-daemon) and the report shows
+// PK17.scanner (report only, never enforcement): rows M21, M23, M24 and M25 stay `ownerPending` and never fail, but each lists its
+// `pendingOwners` (M21: rightkit-fs, rightkit-daemon, rightkit-qa; M23: @rightkit/release, rightkit-daemon; M24: @rightkit/issues-tracker,
+// unpublished; M25: rightkit-qa, @rightkit/qa, journeys capability unbuilt) and the report shows
 // how each app's declarations measure up (`pending[].candidateOwners`, `enforced: false`). Moving those owners into `rows` and
 // raising minimums is the separate activation step (PK17.activation). The M22 applicability record (PK15-2) is validated and
 // reported under `applicability.M22`; an invalid or contradictory record is a `problem`, which never changes the exit code.
@@ -295,6 +296,11 @@ export function loadAppDeclaration(root, data) {
   return { profile: doc.profile ?? data.defaultProfile, notApplicable, records, problems };
 }
 
+// A pending row's `profile` is one profile name, a list of profile names, or "all" (repository-wide: every profile, including future ones).
+export function pendingAppliesTo(row, active) {
+  return row.profile === "all" || (Array.isArray(row.profile) ? row.profile.includes(active) : row.profile === active);
+}
+
 export function checkApp(root, { data = loadData(), profile, amendments = [] } = {}) {
   const name = path.basename(root);
   if (!existsSync(root) || !statSync(root).isDirectory()) return { app: name, root, scanned: false, profile: profile ?? data.defaultProfile, owners: [], pending: [], notApplicable: [], problems: ["app root missing"], violations: 0 };
@@ -319,7 +325,7 @@ export function checkApp(root, { data = loadData(), profile, amendments = [] } =
   const facts = manifests.flatMap((m) => m.facts);
   // Pending rows never fail. Their `pendingOwners` are judged like any owner and listed as `candidateOwners` (`enforced: false`)
   // so the report shows what activation would find; the result is never counted in `violations`.
-  const pending = data.pendingRows.filter((r) => r.profile === active).map((r) => ({
+  const pending = data.pendingRows.filter((r) => pendingAppliesTo(r, active)).map((r) => ({
     row: r.id, name: r.name, status: "owner-pending", note: r.ownerPending,
     candidateOwners: r.id in declaration.notApplicable ? [] : (r.pendingOwners ?? []).map((o) => {
       const judged = judge({ ...o, rows: [r.id] }, facts);

package/package.json

@@ -1,17 +1,21 @@
 {
   "name": "@rightkit/release",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
-    "right-release": "cli/right-release.mjs"
+    "right-release": "cli/right-release.mjs",
+    "rightkit-gate": "bin/rightkit-gate.mjs"
   },
   "rightkit": {
     "publishCheck": {
       "binSmoke": {
         "right-release": [
           "--version"
+        ],
+        "rightkit-gate": [
+          "--version"
         ]
       }
     }

package/pipeline-admission.mjs

@@ -40,7 +40,7 @@ export const hasShellMeta = (text) => SHELL_META.test(String(text));
 /** right-release subcommands a config may invoke (the CLI's own commands; unknown names are refused). */
 export const OWNER_SUBCOMMANDS = Object.freeze(new Set([
   "release", "build", "package", "publish", "upload", "deps", "publish-update", "hardening", "harden", "hardeningscan", "sign-windows",
-  "sign-updater", "sign-dev-artifact", "sign-candidate", "engine-locate", "stage-sidecar", "init", "pe", "icons", "recipe-build",
+  "sign-updater", "sign-dev-artifact", "sign-qa-bundle", "sign-candidate", "engine-locate", "stage-sidecar", "init", "pe", "icons", "recipe-build",
   "signing-agent", "create-mac-updater", "mirror-root-artifact", "test", "web-build", "license-notices", "toolchain", "github",
   "cargo-target", "qa", "ownership", "ownership-approval", "ownership-report", "ownership-mandatory", "adoption-evidence", "swift-package", "bundle-scan",
   "check-release-dependencies", "dist-scan", "identity-scan", "apple-profile-create", "ios-credentials", "dev", "doctor", "hooks",