@rightkit/release 0.6.10 → 0.6.11

package/README.md

@@ -213,14 +213,14 @@ Adrian, 2026-10-26: the apps lost every build route on 2026-10-25 and build agai
 
 | Tier | Rules | Owed by |
 |---|---|---|
-| `compile` (default) | the 13 rules @rightkit/release 0.6.6 published (`COMPILE_TIER_IDS`) | compile admission: the RustRight broker, the pre-push hook, `rightkit-gate check`, `--to compile\|package`, `right-release build\|dev\|test\|doctor` |
+| `compile` (default) | the 13 rules @rightkit/release 0.6.6 published (`COMPILE_TIER_IDS`) | compile admission: the RustRight broker, `rightkit-gate check`, `--to compile\|package`, `right-release build\|dev\|test\|doctor` |
 | `release` | every rule, the ones added since 0.6.6 included (C3, SC, CA, LG, SF-01, OW-05, OW-06), plus the `shellcheck` scan and actionlint's shellcheck requirement | `rightkit-gate --to qualify` (it runs `check --rule-tier release` before installed QA and records `ruleTier` in the receipt) and `right-release release\|qa\|upload\|publish\|publish-update\|github\|sign-*\|create-mac-updater\|sign-candidate` (`RELEASE_TIER_COMMANDS`) |
 
 `rightkit-gate check --rule-tier compile|release` selects the tier (`--tier patch|update` is the upload tier); `--list` names each rule's tier; `--only` is a view over the whole set. A rule is promoted to the compile tier by moving its id into `COMPILE_TIER_IDS` in RightKit, never per app and never through a baseline. RightKit's own preflight runs every rule.
 
-## The pre-push gate on a host without the broker: the Rust gate is deferred, the HOST RECEIPT gates the merge
+## The gate on a host without the broker, and tests that reach it
 
-The gate chooses its executor itself (`gate-executor.mjs` `resolveExecutor`), never the caller: the RustRight broker on a managed Mac or Dell (chosen by host identity, not by `rustright` on PATH), a refusal on a broker-managed machine whose broker cannot be reached, and direct `cargo` on every Linux host and any other host (a cloud session, a CI runner). Every host runs the same gates in the same order (app rules, class A, then the compile scans); an unmanaged host is never sent to a broker and nothing is deferred to one.
+The gate chooses its executor itself (`gate-executor.mjs` `resolveExecutor`), never the caller: the RustRight broker on a managed Mac or Dell (chosen by host identity, not by `rustright` on PATH), a refusal on a broker-managed machine whose broker cannot be reached, and direct `cargo` on every Linux host and any other host (a cloud session, a CI runner). Every host runs the same gates in the same order (app rules, class A, then the compile scans); an unmanaged host is never sent to a broker and nothing is deferred to one. Commit and push run no gate and no local hook check, and `install-hook` writes no git hook (below); when git's ref lines are nevertheless given on stdin (the form a pre-push hook receives), every ref is judged in any position (split on single ASCII spaces, so a Unicode space in a ref name cannot hide one), and a line that is not four fields is refused, never dropped, so the pushed commit is always compared with HEAD.
 
 `scriptBrokerCall` reads `package.json` scripts only: it follows `pnpm <script>`, `pnpm run`, `npm run`, `yarn` and the wrapper words, not `node -e`, a node script, `sh -c`, or a run in another package (`pnpm --dir`, `--filter`, `-r`). A unit whose test reaches the broker that way says so in the app's own `ci/gate.config.json`, in the `npm` entry the unit's `quietTests` already uses (the key is the unit name: the package name, or the directory with `/` as `-` for a unit of a pnpm root below the repository root):
 
@@ -231,9 +231,11 @@ The gate chooses its executor itself (`gate-executor.mjs` `resolveExecutor`), ne
 
 The `reason` is required and is printed. The file is read from the gated commit, so the declaration is a reviewed change in the diff that adds it. Where the Rust gate is deferred, the unit's `test:npm:<unit>` scan is deferred with it and named `declared in ci/gate.config.json npm.<unit>.requiresBroker: <reason>`, never reported as passed; on a host with the broker, in CI, on a protected ref and with the opt-out it runs as it did. A declaration of any other shape (`true`, a string, an empty or blank `reason`, an array) is ignored with a note and the test runs where it can: a malformed entry never skips a test. `false` or `null` is no declaration, and a call the scripts do show is reported from the scripts. The gate does not read node scripts for a literal `rustright` or `cargo`: a literal cannot tell a spawn from a command table, a mention or a test fixture, so the declaration is the way.
 
-## The pre-push hook finds the gate in a repository whose root installs nothing
+## `install-hook` writes no git hook, and retires the ones an earlier release wrote
 
-`rightkit-gate install-hook` writes `.githooks/pre-push` (and sets `core.hooksPath`). The hook runs the repository's own `.git/hooks/pre-push`, then `rightkit-gate check --commit HEAD`, then the gate, and finds the gate binary in `node_modules/.bin/rightkit-gate` of the repository root, else of any workspace package up to three levels down, else through `pnpm exec`, else with `node` at a path written into the hook. That path is always relative to the repository, the same for every version and a plain name, never absolute, never `../` out of the repository, never a `node_modules/.pnpm/@rightkit+release@x.y.z/` store path, and it is decided by what the tracked `package.json` files declare, never by what is installed: the same repository gets the same hook on a fresh clone, from an exports checkout, after `pnpm install` and after a version bump, so `install-hook` as a `prepare` script never meets a hook it wrote earlier as one that "already exists and differs". When the root `package.json` declares `@rightkit/release` (alone, or together with packages: Pulse declares it at the root and in `hub/`), the path is the root's `node_modules/@rightkit/release/bin/rightkit-gate.mjs` and the hook is the single-root form. When only packages declare it (CutRight's `apps/cutright`, HeardRight's `tauri-app-next`), the path is the same link in the first of them in sorted order, whichever is installed, the hook also tries each declaring package's `node_modules/.bin/rightkit-gate` directly (deeper than the glob reaches) and it runs the `pnpm` fallback as `pnpm --dir <package> exec rightkit-gate`, because `pnpm exec` at a root that does not declare the package has no `rightkit-gate` to run. When no `package.json` declares it, the gate's own path inside the repository if it runs from there and not from a `node_modules` (a checkout of the package itself), else the root's link. A declaring package whose directory is not made of letters, digits and `_ - . @ +` is named in a warning and left out. A root-install repository gets, byte for byte, the hook that 0.6.4 and 0.6.5 wrote (`fixtures/published-gate-hooks.json`); a multi-root repository whose committed hook still has a baked path regenerates it once with `rightkit-gate install-hook --force`, and the result no longer changes with the version or the install.
+Commit and push run no gate and no local hook check (`docs/GATE-CONTRACT.md`: the gate is for building; CI runs preflight and the full check on every push). `rightkit-gate install-hook` (a `prepare` script; `right-release hooks install` is an alias) registers the one-door agent hook in `.claude/settings.json` and writes no git hook: no `.githooks/pre-push`, no forwarder for the hooks in `.git/hooks`, no pre-commit ownership step, and it no longer sets `core.hooksPath`.
+
+It removes what an earlier release wrote, each file matched by its own text only: `.githooks/pre-push` by its header (line 2: `# Mandatory local [check and] gate before every push (rightkit-gate install-hook). Never bypass with --no-verify.`), a `.githooks/<name>` forwarder by its header naming that same hook, and the ownership pre-commit hook by the marker `rightkit-ownership-precommit v1` in its first three lines (in `.githooks`, in `.git/hooks`, or in the directory `core.hooksPath` names); the foreign pre-commit the ownership step kept as `pre-commit.rightkit-foreign` goes back to `pre-commit`. A foreign hook, a symbolic link, a directory and any file whose header differs are never read for change, moved or deleted. It unsets the repository's own `core.hooksPath` only when its value is exactly `.githooks` and nothing foreign remains in that directory (an emptied `.githooks` is removed, and the hooks in `.git/hooks` run again); otherwise it leaves the setting and says so. The global and system git configuration is never written. `--force` is accepted and ignored: there is nothing to overwrite. `right-release ownership --staged` stays as a manual command; broker admission and the release gate remain the authoritative ownership checks. An app deletes its committed `.githooks/pre-push` after the release carrying this change is published.
 
 ## The rustfmt scan reads each file's edition from its crate
 

package/admission-files.mjs

@@ -69,6 +69,9 @@ export const FILES_ROWS = Object.freeze([
     run(ctx) {
       const inputs = ctx.buildInputs();
       if (!inputs.ok) return { skipped: "build-inputs is reported on its own" };
+      // A door source split (row 7.04): `repoRoot` is then the snapshot, the commit's bytes verified by the door at the start and end of the
+      // stage, and there is no checkout cleanliness to ask. Every input resolved under it by construction.
+      if (ctx.releaseSource?.mode === "snapshot") return undefined;
       const dirty = dirtyBuildInputs(ctx.repoRoot, inputs.value.buildInputs, ctx.commit());
       return dirty.length > 0 ? [`dirty files can change the packaged app; resolve them before release:\n${dirty.map((file) => `- ${file}`).join("\n")}`] : undefined;
     },

package/admission.mjs

@@ -60,7 +60,7 @@ function gitHead(repoRoot, spawn) {
 export async function runAdmission({
   root, repoRoot = root, configPath, config, platform, target, tiers = TIERS, env = process.env, spawn = spawnSync, registry,
   log = () => {}, hostPlatform = process.platform, mode = "build", skipChecks = false, skipDoctorOwned = false, commit,
-  fs = { existsSync, readdirSync, readFileSync, statSync }, feed, rows = ADMISSION_ROWS, resolveInputs = resolveBuildInputs,
+  fs = { existsSync, readdirSync, readFileSync, statSync }, feed, rows = ADMISSION_ROWS, resolveInputs = resolveBuildInputs, releaseSource = null,
 } = {}) {
   const findings = [];
   const results = [];
@@ -78,7 +78,7 @@ export async function runAdmission({
   const exists = fs.existsSync;
   const projectType = memo(() => resolveProjectType({ appRoot: root, config, target }));
   const ctx = {
-    root, repoRoot, configPath, config, platform, target, env, spawn, registry, log, hostPlatform, mode, skipChecks, fs, exists, feed, out,
+    root, repoRoot, releaseSource, configPath, config, platform, target, env, spawn, registry, log, hostPlatform, mode, skipChecks, fs, exists, feed, out,
     // The target as the config declares it: the build controller judges a few rules on it, the worker on the expanded one.
     rawTarget: config?.targets?.[platform],
     projectType,

package/advisory-exceptions.mjs

@@ -1,9 +1,11 @@
-// Advisory exception gate. ci/advisory-exceptions.json is the single source; deny.toml
+// Advisory exception gate. Every crate is its own Cargo workspace (rightkit#1285), and a crate that ignores an advisory keeps its
+// own single source, crates/<crate>/.rightkit/advisory-exceptions.json (CRATE_EXCEPTIONS_FILE): the crate's deny.toml
 // [advisories].ignore and .cargo/audit.toml must match it exactly, every entry needs an owner,
 // evidence and an unexpired absolute reviewBy date, and the entry's versions must match what
-// Cargo.lock actually holds, `dependents` must equal the exact set of direct reverse
-// dependencies of the affected versions in Cargo.lock, and every hop of `path` must be a real
-// dependency edge (scope drift fails in both directions). Policy: Astra 2026-10-22.
+// the crate's Cargo.lock actually holds, `dependents` must equal the exact set of direct reverse
+// dependencies of the affected versions in that Cargo.lock, and every hop of `path` must be a real
+// dependency edge (scope drift fails in both directions). A crate with no ignore needs no ledger.
+// There is no repository-level ledger. Policy: Astra 2026-10-22.
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -12,6 +14,8 @@ export const EXCEPTIONS_FILE = 'ci/advisory-exceptions.json';
 export const DENY_FILE = 'deny.toml';
 export const AUDIT_FILE = '.cargo/audit.toml';
 export const LOCK_FILE = 'Cargo.lock';
+/** The per-workspace ledger, relative to the workspace root (a crate directory). */
+export const CRATE_EXCEPTIONS_FILE = '.rightkit/advisory-exceptions.json';
 
 const REQUIRED = ['id', 'crate', 'path', 'owner', 'rationale', 'evidence', 'reviewBy', 'approvedBy'];
 const ID_RE = /^RUSTSEC-\d{4}-\d{4}$/;
@@ -359,12 +363,44 @@ export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date()
   return problems;
 }
 
+// ---- per crate ----
+
+// A non-empty `ignore = [...]` list (an empty list followed by a later `]` is not one).
+const IGNORE_LIST_RE = /\bignore\s*=\s*\[[^\]]*[^\]\s][^\]]*\]/s;
+
+/**
+ * Every crate workspace of the repository (crates/<x> holding a Cargo.toml) checked against its own ledger. A crate whose deny.toml or
+ * .cargo/audit.toml ignores an advisory must have its ledger; a crate with the ledger is checked in full against its own deny.toml,
+ * .cargo/audit.toml and Cargo.lock; a crate with neither is fine. Problems are prefixed with the crate directory.
+ * `io` = { readFile(absPath), readdir(absDir), exists(absPath) }, for tests.
+ */
+export function checkCrateAdvisoryExceptions({ root = process.cwd(), now = new Date(), allowPending = false, io = {} } = {}) {
+  const readFile = io.readFile ?? (p => fs.readFileSync(p, 'utf8'));
+  const readdir = io.readdir ?? (d => fs.readdirSync(d));
+  const exists = io.exists ?? fs.existsSync;
+  const cratesDir = path.join(root, 'crates');
+  if (!exists(cratesDir)) return [];
+  const problems = [];
+  for (const entry of [...readdir(cratesDir)].map(String).sort()) {
+    const dir = `crates/${entry}`;
+    if (entry.startsWith('.') || !exists(path.join(root, dir, 'Cargo.toml'))) continue;
+    const here = path.join(root, dir);
+    const ignores = [DENY_FILE, AUDIT_FILE].some(f => { try { return IGNORE_LIST_RE.test(readFile(path.join(here, f))); } catch { return false; } });
+    if (!exists(path.join(here, CRATE_EXCEPTIONS_FILE))) {
+      if (ignores) problems.push(`${dir}: ${DENY_FILE} or ${AUDIT_FILE} ignores an advisory but ${CRATE_EXCEPTIONS_FILE} does not exist`);
+      continue;
+    }
+    for (const p of checkAdvisoryExceptions({ root: here, now, allowPending, exceptionsFile: CRATE_EXCEPTIONS_FILE, readFile: f => readFile(path.join(here, f)) })) problems.push(`${dir}: ${p}`);
+  }
+  return problems;
+}
+
 // ---- CLI ----
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   const args = process.argv.slice(2);
   const root = path.resolve(import.meta.dirname, '..', '..');
-  const problems = checkAdvisoryExceptions({ root, allowPending: args.includes('--allow-pending') });
+  const problems = checkCrateAdvisoryExceptions({ root, allowPending: args.includes('--allow-pending') });
   if (problems.length) {
     for (const p of problems) console.error(`advisory-exceptions: ${p}`);
     console.error(`advisory-exceptions: ${problems.length} problem(s)`);

package/android-play-upload.mjs

@@ -23,15 +23,14 @@
 import { createSign } from "node:crypto";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
 import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { describeAabProblems, scanAabBuffer } from "./android-aab-scan.mjs";
 import { sealedManifestAllowsContentDevtools } from "./devtools-policy.mjs";
 import { targetDistribution } from "./target-distribution.mjs";
 import { AndroidReleaseError, createAndroidCredentialStore, resolveAndroidSecret, validateSecretSource } from "./android-release.mjs";
 import { assertArtifactUnchanged, digestBytes, verifyPublicationRelease } from "./publication-artifacts.mjs";
-import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
-import { assertCleanSource } from "./source-gate.mjs";
+import { assertBindsSource, assertInsideSource, assertReleaseSource, gitRootOf, isSnapshotSource, resolveReleaseSource } from "./release-source-identity.mjs";
+import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
 
 export const PLAY_PROVIDER = "google-play";
 export const PLAY_TRACK = "internal";
@@ -183,26 +182,28 @@ export async function uploadToPlay({ distribution, aabBytes, accessToken, fetchI
 }
 
 // ---- authorisation and the command --------------------------------------------------------------------------------
-const git = (cwd, args) => {
-  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
-  if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${result.stderr}`);
-  return result.stdout.trim();
-};
 
 // Local checks only; no network, no secret. The sealed release is the only input: build-free by construction.
-export async function authorizePlayUpload({ releaseId, cwd = process.cwd(), configName = defaultReleaseConfigFile(cwd) }) {
+export async function authorizePlayUpload({ releaseId, cwd = process.cwd(), configName = defaultReleaseConfigFile(cwd), env = process.env }) {
   if (!RELEASE_ID.test(releaseId ?? "")) refuse("PLAY_RELEASE_REQUIRED", "--release <sealed-id> is required");
-  const repoRoot = git(cwd, ["rev-parse", "--show-toplevel"]);
-  assertPrimaryReleaseCheckout(repoRoot);
-  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
-  assertCleanSource({ status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release upload" });
+  // Source identity (release-source-identity.mjs, item 7 row 7.04): the checkout's clean HEAD outside a door run, the selected commit and
+  // its verified snapshot inside one (HEAD, status and branch of the checkout are then never read).
+  const release = resolveReleaseSource({ cwd, env });
+  assertReleaseSource(release, { commandId: "right-release upload", env });
+  const split = isSnapshotSource(release);
+  const repoRoot = gitRootOf(release);
+  const commit = release.commit;
   const configPath = path.resolve(cwd, configName);
+  assertInsideSource(release, configPath, "the release config");
   if (!existsSync(configPath)) refuse("PLAY_CONFIG_INVALID", `release config is required: ${configName}`);
   // A legacy config is a module that runs on import (a JSON config is data): loaded only after the tree is proven clean.
   const config = await importReleaseConfig(configPath, { query: `upload=${Date.now()}` });
   const distribution = validatePlayDistribution(targetDistribution(config, "android"));
   const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, "android");
-  const sealed = verifyPublicationRelease({ sealedDir, repoRoot, appRoot: path.dirname(configPath), commit, app: config.app, version: config.version, platform: "android", configPath, releaseId });
+  // The sealed release and its signing receipts are where the build wrote them (the checkout's `.right-release`).
+  const sealed = verifyPublicationRelease({ sealedDir, repoRoot, appRoot: split ? release.checkoutAppRoot : path.dirname(configPath), commit, app: config.app, version: config.version, platform: "android", configPath, releaseId },
+    split ? { verifyOwnership: (expected, root, scanRoot, scope) => verifyOwnershipEvidence(expected, root, scanRoot, scope, release) } : {});
+  if (split) assertBindsSource(release, sealed.manifest, "the sealed release");
   const entries = sealed.manifest.files.filter((entry) => entry.role === "aab");
   if (entries.length !== 1) refuse("PLAY_AAB_MISSING", "the sealed release must hold exactly one aab entry");
   const aab = sealed.artifacts.get(entries[0].name);
@@ -226,7 +227,7 @@ export async function runPlayUpload({
   fetchImpl = fetch, credentialStore, sign, nowSeconds, authorize = authorizePlayUpload,
 }) {
   refusePlayEnvSecrets(env);
-  const auth = await authorize({ releaseId, configName, cwd });
+  const auth = await authorize({ releaseId, configName, cwd, env });
   const aabEvidence = { name: auth.entry.name, sha256: auth.entry.sha256, sizeBytes: auth.entry.sizeBytes };
   const plan = playUploadPlan({ distribution: auth.distribution, aab: aabEvidence });
   const stateRoot = path.join(auth.repoRoot, ".right-release", "state", releaseId, "android");

package/app-check.mjs

@@ -1,5 +1,5 @@
 // The app check: step 1 of docs/PIPELINE-ARCHITECTURE.md for any repository that uses RightKit, shipped in @rightkit/release so an
-// app runs it without a RightKit checkout (`rightkit-gate check`, `right-release check`, the pre-push hook, and the start of every
+// app runs it without a RightKit checkout (`rightkit-gate check`, `right-release check`, and the start of every
 // right-release command that builds or ships; see CHECKED_COMMANDS). RightKit's own scripts/preflight.mjs imports these rules and
 // adds the ones that police RightKit itself.
 //
@@ -1131,7 +1131,7 @@ export const RULES = Object.freeze([
 // asked of them. The compile tier is the rule set every app was green on when it last built through the gate: the rules @rightkit/release
 // 0.6.6 published. Every rule added since (consumer, shell, Legion, ownership and source-closure contracts) is release-tier until the
 // synthesis waves make it true in every app, and is promoted here, in RightKit, never per app and never through a baseline.
-//   compile  gates compile admission: the RustRight broker, the pre-push hook, rightkit-gate check, --to compile|package, right-release build|dev|test.
+//   compile  gates compile admission: the RustRight broker, rightkit-gate check, --to compile|package, right-release build|dev|test.
 //   release  the whole set: --to qualify|release and every right-release command that qualifies, signs, ships or uploads.
 export const TIERS = Object.freeze(["compile", "release"]);
 export const COMPILE_TIER_IDS = Object.freeze(new Set([
@@ -1513,7 +1513,7 @@ export const UNCHECKED_COMMANDS = new Map([
   ["identity-scan", "asserts the signature of a path named on the command line"],
   ["apple-profile-create", "provisioning-profile credentials; no app source"],
   ["ios-credentials", "stores or checks App Store Connect credentials; no app source"],
-  ["hooks", "installs the git hooks, and the pre-push hook runs the check"],
+  ["hooks", "retires the git hooks an earlier release wrote (install-hook); writes none"],
   ["suite-doctor", "verifies the Right Suite contract tests; a report"],
   ["cache", "host build-cache maintenance"],
   ["disk", "host disk maintenance"],
@@ -1578,14 +1578,18 @@ export const appDirectory = (args, cwd) => {
  * check is green (nothing is printed then), else { exitCode: 1, lines } for the caller to print: the findings and why nothing
  * was started. A check that cannot run is red too.
  */
-export function guardCommand({ args, cwd = process.cwd(), run = runAppCheck } = {}) {
-  const mode = checkModeFor(args);
-  if (!mode) return null;
+export function guardCommand({ args, cwd = process.cwd(), run = runAppCheck, source = null } = {}) {
+  const checkMode = checkModeFor(args);
+  if (!checkMode) return null;
   const name = args[0].startsWith("-") ? "build" : checkedCommandOf(args) ?? args[0];
-  const dir = appDirectory(args, cwd);
-  const repo = repoRoot(dir);
+  // A source split (source-split.mjs): the process runs in the door's snapshot of `source.commit`, which has no git directory. The
+  // rules read that commit from the checkout `source.repo`, whatever the command's usual mode (the snapshot IS the commit, so a
+  // "worktree" command checks it as a commit; the checkout's own working tree is never what is built).
+  const mode = source ? "commit" : checkMode;
+  const dir = source ? source.repo : appDirectory(args, cwd);
+  const repo = source ? source.repo : repoRoot(dir);
   if (!repo) return { exitCode: 1, lines: [`right-release ${name}: the app check needs a git repository and ${dir} is not inside one; nothing was started`] };
-  const result = run({ repo, mode, tier: tierForCommand(name, args), label: "check", refuse: BUILD_REFUSES });
+  const result = run({ repo, mode, ...(source ? { commit: source.commit } : {}), tier: tierForCommand(name, args), label: "check", refuse: BUILD_REFUSES });
   if (result.exitCode === 0) return null;
   const why = result.exitCode === 2 ? "could not run" : "found problems";
   return { exitCode: 1, lines: [...result.lines, ...result.errLines, `right-release ${name}: the app check ${why} in ${repo}; nothing was started. Fix the above and commit, then run it again.`] };