@rightkit/release 0.6.10 → 0.6.11

package/release.mjs

@@ -14,6 +14,8 @@ import { assertQaAdoption, assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
 import { DECLARED_UNRELATED_POLICY, declaredUnrelatedRefusal, releaseArtifactPaths } from "./hosted-workflow-policy.mjs";
 import { assertNativeIosPrepareHasManifest, assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
+import { ArtifactPathError, assertSplitCommandPaths, releaseCommandSteps, resolveArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
 import { declaredCargoManifest, hasDefaultTauriManifest, resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import {
   canonicalPackageIdentity,
@@ -275,10 +277,17 @@ const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
 // state root and admission record; a snapshot from anywhere else is refused. The standalone doctor resolves live.
 const rightKitSnapshotFile = process.env[SNAPSHOT_ENV] || null;
 let rightKitResolution = null; // null when the registry resolution failed (recorded as the `rightkit-registry` finding)
+// The worker of a door split (row 7.04): its cwd is the snapshot, which has no git directory. Its commit and source root are the selected
+// commit's and the snapshot's (release-source-identity.mjs); the checkout route reads them from git as before.
+let workerSource = null;
+let artifactPathContext = null; // the declared-artifact resolver's context (artifactContext, row 7.04c)
+if (!opts.doctor && process.env.RK_GATE_CHECKOUT) {
+  try { workerSource = resolveReleaseSource({ cwd: process.cwd() }); } catch (error) { fail(`${error.code ?? "RK_SOURCE_IDENTITY"}: ${error.message}`); }
+}
 try {
   const lockInventory = () => {
     try {
-      const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+      const repoRoot = workerSource ? sourceRootOf(workerSource) : git(root, ["rev-parse", "--show-toplevel"]);
       let canonicalTarget = config.targets?.[opts.platform];
       try { canonicalTarget = expandPackageRecipeTarget(canonicalTarget, { platform: opts.platform, appRoot: root, config }); } catch { /* reported later */ }
       const inputs = resolveReleaseBuildInputs({ repoRoot, appRoot: root, configPath, config, target: canonicalTarget });
@@ -292,7 +301,7 @@ try {
     if (!rightKitSnapshotFile) throw new RightKitRegistryError("no-admission", "no admitted RightKit registry snapshot was handed to the release worker; run it through `right-release build`, which admits the release");
     const stateRoot = process.env.RIGHT_RELEASE_STATE_ROOT;
     if (!stateRoot) throw new RightKitRegistryError("no-admission", "RIGHT_RELEASE_STATE_ROOT is not set; the admitted RightKit registry snapshot cannot be located");
-    const commit = git(root, ["rev-parse", "HEAD"]);
+    const commit = workerSource ? workerSource.commit : git(root, ["rev-parse", "HEAD"]);
     boundSnapshot = loadAdmittedSnapshot(stateRoot, { releaseId: `${config.app}-${config.version}-${commit.slice(0, 8)}`, commit, platform: opts.platform, snapshotFile: rightKitSnapshotFile });
   }
   rightKitResolution = await prepareRightKitResolution({
@@ -348,6 +357,12 @@ await check("target", [], () => {
   if (!expanded) throw new Error(`${config.app ?? "app"} has no ${opts.platform} release target`);
   target = expanded;
 });
+// Row 7.04c (R-T1, R-T4): in a door split each Cargo manifest's target is bound now, once, before any step runs, and no step the app owns may name
+// a target-relative path (the snapshot has no target directory). Checkout mode checks nothing here.
+await check("split-artifact-paths", ["target"], () => {
+  if (!workerSource) return;
+  assertSplitCommandPaths(releaseCommandSteps({ target, config, root }), artifactContext());
+});
 const legalCheck = await check("legal-contract", [], () => (config.legal
   ? assertLegalReleaseContract(root, config.legal, config.app ?? path.basename(root), opts.platform)
   : null));
@@ -636,7 +651,7 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   // writes the App Installer route and the seal record. Never a second signer.
   await runCommand(target.prePackage, root);
   // Raw payload scan BEFORE the package is packed (a packed MSIX is only readable through its ZIP directory).
-  assertNoQaControlBinaries("msix staged payload", [path.resolve(root, target.msix.stageDir)], { requireBinary: true, prePack: true });
+  assertNoQaControlBinaries("msix staged payload", [resolveDeclaredPath(root, target.msix.stageDir)], { requireBinary: true, prePack: true });
   const options = msixBuildOptions({ root, target, app: config.app, dryRun: opts.dryRun, receipts: {
     pe: windowsReceiptPath(root, "raw-exe"), msix: windowsReceiptPath(root, "installer"),
     dir: path.dirname(windowsReceiptPath(root, "raw-exe")) } });
@@ -645,7 +660,7 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   // Second layer: read the finished package through its ZIP central directory (stored and deflate entries).
   if (!built.dryRun) assertNoQaControlBinaries("msix package", [options.out], { requireBinary: true });
 } else if (opts.platform === "win") {
-  const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
+  const rawFiles = target.sign.prePackageFiles.map((p) => resolveDeclaredPath(root, p));
   const sidecarPlan = await prepareMediaSidecar(root);
   const externalPlan = await prepareExternalBin(root);
   await runCommand(target.prePackage, root);
@@ -894,15 +909,25 @@ function assertNoWebBundleMocksInFrontend(phase, { required }) {
   } catch (error) { fail(error.message); }
 }
 
+// Row 7.04c (R-T2): one resolver for every declared artifact path. Checkout mode is the historical rule, byte for byte (the app root, then
+// RIGHT_RELEASE_ARTIFACT_DIR); a door split maps a target-prefixed path to its bound Cargo target and never reads the checkout.
+function artifactContext() {
+  artifactPathContext ??= splitArtifactContext({
+    cwd: root, env: process.env, nativeLayout, config, target: config.targets?.[opts.platform],
+    ...(workerSource?.mode === "snapshot" ? { snapshotRoot: workerSource.snapshot } : {}),
+  });
+  return artifactPathContext;
+}
+
 function resolveReleaseArtifactPath(root, declared) {
-  const local = path.resolve(root, declared);
-  if (existsSync(local)) return local;
-  const managed = process.env.RIGHT_RELEASE_ARTIFACT_DIR;
-  if (managed) {
-    const candidate = path.join(path.resolve(managed), path.basename(declared));
-    if (existsSync(candidate)) return candidate;
-  }
-  return local;
+  try { return resolveArtifactPath(declared, artifactContext()); }
+  catch (error) { if (error instanceof ArtifactPathError) fail(error.message); throw error; }
+}
+
+/** A declared path that never fell back to the managed artifact directory (a staged payload, a raw EXE): the app root, or in a split the same resolver. */
+function resolveDeclaredPath(root, declared) {
+  const context = artifactContext();
+  return context.mode === "split" ? resolveReleaseArtifactPath(root, declared) : path.resolve(root, declared);
 }
 
 function fail(message) {
@@ -1042,11 +1067,13 @@ function nativeSignedArtifacts(files, root) {
   return values.map((value) => {
     const declared = typeof value === "string" ? value : value?.path ?? value?.file;
     if (!declared) fail("native finalizer signed artifact path is missing");
-    const absolute = path.resolve(root, declared);
-    if (opts.dryRun) return { path: path.relative(root, absolute).replaceAll("\\", "/") };
+    const absolute = resolveDeclaredPath(root, declared);
+    // A split's bound target lies outside the app: its absolute path is the evidence there.
+    const evidencePath = () => { const relative = path.relative(root, absolute).replaceAll("\\", "/"); return relative.startsWith("..") ? absolute.replaceAll("\\", "/") : relative; };
+    if (opts.dryRun) return { path: evidencePath() };
     if (!existsSync(absolute)) fail(`native finalizer signed artifact missing: ${absolute}`);
     return {
-      path: path.relative(root, absolute).replaceAll("\\", "/"),
+      path: evidencePath(),
       sha256: createHash("sha256").update(readFileSync(absolute)).digest("hex"),
       sizeBytes: readFileSync(absolute).length,
     };
@@ -1080,7 +1107,7 @@ function nativeArchiveCandidates({ root, target, nativeAssembly }) {
     ...(target.installer?.artifacts ?? []).map((artifact) => artifact.file),
     ...(target.updater?.artifacts ?? []).map((artifact) => artifact.file),
   ].filter((value) => typeof value === "string" && value.trim());
-  return [...new Set(declared.map((value) => path.resolve(root, value)))];
+  return [...new Set(declared.map((value) => resolveDeclaredPath(root, value)))];
 }
 
 function nativeFinalizerOutputPath({ finalizer, target, root }) {
@@ -1906,7 +1933,7 @@ async function verifyWindowsEmbedding({ root, target, files, markers }) {
     console.log("dry-run: verify installer embeds the signed raw EXE");
     return;
   }
-  const rawFile = path.resolve(root, target.sign.prePackageFiles[0]);
+  const rawFile = resolveDeclaredPath(root, target.sign.prePackageFiles[0]);
   const rawReceiptPath = windowsReceiptPath(root, "raw-exe");
   let rawReceipt;
   try { rawReceipt = JSON.parse(readFileSync(rawReceiptPath, "utf8")); } catch { fail(`missing raw EXE signing receipt: ${rawReceiptPath}`); }

package/rightkit-versions.json

@@ -29,10 +29,10 @@
     "@rightkit/outdated": "0.3.0",
     "@rightkit/pdf-ui": "0.2.0",
     "@rightkit/platform-ui": "0.4.0",
-    "@rightkit/qa": "0.6.1",
+    "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.10",
+    "@rightkit/release": "0.6.11",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.3",
@@ -236,7 +236,8 @@
       "0.4.9",
       "0.5.0",
       "0.5.1",
-      "0.5.2"
+      "0.5.2",
+      "0.6.1"
     ],
     "@rightkit/qa-chrome": [
       "0.1.0",
@@ -376,7 +377,8 @@
       "0.6.5",
       "0.6.6",
       "0.6.7",
-      "0.6.8"
+      "0.6.8",
+      "0.6.10"
     ],
     "@rightkit/settings-ui": [
       "0.1.0",
@@ -457,56 +459,57 @@
     "rightkit-asr": "0.3.1",
     "rightkit-audio": "0.3.1",
     "rightkit-automation": "0.6.1",
-    "rightkit-browser": "0.3.6",
+    "rightkit-browser": "0.3.7",
     "rightkit-cache": "0.2.3",
-    "rightkit-channel-memory": "0.2.1",
+    "rightkit-channel-memory": "0.2.2",
     "rightkit-child-process": "0.5.7",
     "rightkit-compose": "0.2.0",
-    "rightkit-contracts": "0.1.7",
+    "rightkit-contracts": "0.1.8",
     "rightkit-crash": "0.3.6",
     "rightkit-credentials": "0.4.2",
     "rightkit-crypto": "0.1.0",
     "rightkit-daemon": "0.4.0",
-    "rightkit-db": "0.5.2",
+    "rightkit-db": "0.5.3",
     "rightkit-device": "0.4.0",
-    "rightkit-docs": "0.1.2",
-    "rightkit-embed": "0.6.1",
+    "rightkit-docs": "0.1.3",
+    "rightkit-embed": "0.6.2",
     "rightkit-ffmpeg": "0.2.11",
-    "rightkit-file-watch": "0.4.1",
+    "rightkit-file-watch": "0.4.2",
     "rightkit-fs": "0.4.7",
-    "rightkit-fsindex": "0.5.0",
+    "rightkit-fsindex": "0.6.0",
     "rightkit-google-identity": "0.2.0",
     "rightkit-hooks": "0.2.0",
     "rightkit-hotkeys": "0.1.2",
-    "rightkit-http": "0.3.8",
+    "rightkit-http": "0.3.9",
     "rightkit-identity": "0.1.0",
     "rightkit-job-queue": "0.5.1",
     "rightkit-license": "0.2.5",
     "rightkit-llm": "0.3.1",
-    "rightkit-logs": "0.3.5",
-    "rightkit-mcp": "0.7.0",
-    "rightkit-models": "0.5.1",
+    "rightkit-logs": "0.3.6",
+    "rightkit-mcp": "0.7.1",
+    "rightkit-models": "0.5.2",
     "rightkit-motion": "0.2.0",
     "rightkit-oauth": "0.10.0",
     "rightkit-ocr": "0.2.3",
     "rightkit-onnx": "0.2.8",
     "rightkit-overlay": "0.2.0",
     "rightkit-overlay-win": "0.1.0",
-    "rightkit-ownership": "0.4.2",
-    "rightkit-pdf": "0.3.3",
+    "rightkit-ownership": "0.4.3",
+    "rightkit-pdf": "0.3.4",
     "rightkit-platform-rules": "0.1.0",
     "rightkit-playback": "0.3.0",
+    "rightkit-qa": "0.9.2",
     "rightkit-qa-driver": "0.7.0",
     "rightkit-record": "0.3.3",
     "rightkit-review": "0.4.0",
     "rightkit-sandbox": "0.6.1",
-    "rightkit-search": "0.4.0",
-    "rightkit-send": "0.2.0",
+    "rightkit-search": "0.4.1",
+    "rightkit-send": "0.3.0",
     "rightkit-sidecar": "0.3.0",
     "rightkit-speech-client": "0.4.0",
     "rightkit-spend": "0.2.0",
     "rightkit-sync": "0.2.2",
-    "rightkit-tauri-shell": "0.6.0",
+    "rightkit-tauri-shell": "0.7.0",
     "rightkit-time": "0.1.0",
     "rightkit-transcript": "0.4.0",
     "rightkit-tts": "0.2.3",
@@ -542,7 +545,7 @@
       "rightkit-browser": "0.3.6",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
-      "rightkit-child-process": "0.5.6",
+      "rightkit-child-process": "0.5.7",
       "rightkit-compose": "0.2.0",
       "rightkit-contracts": "0.1.7",
       "rightkit-control": "0.3.0",
@@ -631,13 +634,13 @@
       "@rightkit/logs": "0.1.6",
       "@rightkit/media-ui": "0.3.4",
       "@rightkit/onboarding": "0.6.3",
-      "@rightkit/outdated": "0.2.0",
+      "@rightkit/outdated": "0.3.0",
       "@rightkit/pdf-ui": "0.2.0",
       "@rightkit/platform-ui": "0.4.0",
       "@rightkit/qa": "0.6.1",
-      "@rightkit/qa-chrome": "0.1.11",
+      "@rightkit/qa-chrome": "0.1.12",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.6.6",
+      "@rightkit/release": "0.6.10",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
@@ -652,7 +655,8 @@
       "0.2.1",
       "0.3.1",
       "0.4.0",
-      "0.4.1"
+      "0.4.1",
+      "0.4.2"
     ],
     "rightkit-browser": [
       "0.2.0",
@@ -661,7 +665,8 @@
       "0.3.0",
       "0.3.1",
       "0.3.4",
-      "0.3.5"
+      "0.3.5",
+      "0.3.6"
     ],
     "rightkit-models": [
       "0.2.1",
@@ -674,7 +679,8 @@
       "0.3.0",
       "0.3.1",
       "0.3.2",
-      "0.4.4"
+      "0.4.4",
+      "0.5.1"
     ],
     "rightkit-audio": [
       "0.1.0",
@@ -690,7 +696,8 @@
       "0.3.1",
       "0.4.0",
       "0.4.3",
-      "0.5.1"
+      "0.5.1",
+      "0.5.2"
     ],
     "rightkit-embed": [
       "0.2.1",
@@ -700,7 +707,8 @@
       "0.3.2",
       "0.4.0",
       "0.5.0",
-      "0.6.0"
+      "0.6.0",
+      "0.6.1"
     ],
     "rightkit-jobs": [
       "0.2.1",
@@ -720,7 +728,8 @@
       "0.5.1",
       "0.5.2",
       "0.5.3",
-      "0.6.0"
+      "0.6.0",
+      "0.7.0"
     ],
     "rightkit-media": [
       "0.2.2",
@@ -772,7 +781,8 @@
       "0.7.0",
       "0.7.1",
       "0.8.0",
-      "0.9.0"
+      "0.9.0",
+      "0.9.1"
     ],
     "rightkit-sandbox": [
       "0.1.0",
@@ -833,7 +843,8 @@
       "0.3.0",
       "0.3.5",
       "0.3.6",
-      "0.3.7"
+      "0.3.7",
+      "0.3.8"
     ],
     "rightkit-fs": [
       "0.1.0",
@@ -869,7 +880,8 @@
     "rightkit-pdf": [
       "0.1.0",
       "0.3.0",
-      "0.3.2"
+      "0.3.2",
+      "0.3.3"
     ],
     "rightkit-speech-client": [
       "0.3.0",
@@ -898,7 +910,8 @@
       "0.2.0",
       "0.2.1",
       "0.3.0",
-      "0.4.1"
+      "0.4.1",
+      "0.5.0"
     ],
     "rightkit-asr": [
       "0.0.2",
@@ -912,7 +925,8 @@
       "0.2.2",
       "0.3.0",
       "0.3.2",
-      "0.3.3"
+      "0.3.3",
+      "0.3.5"
     ],
     "rightkit-ocr": [
       "0.1.2",
@@ -998,13 +1012,15 @@
       "0.1.1"
     ],
     "rightkit-channel-memory": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.1"
     ],
     "rightkit-compose": [
       "0.1.0"
     ],
     "rightkit-contracts": [
-      "0.1.5"
+      "0.1.5",
+      "0.1.7"
     ],
     "rightkit-hooks": [
       "0.1.0",
@@ -1068,7 +1084,8 @@
     ],
     "rightkit-docs": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "rightkit-tts-qwen": [
       "0.2.6"
@@ -1078,10 +1095,12 @@
       "0.2.2"
     ],
     "rightkit-send": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ],
     "rightkit-file-watch": [
-      "0.4.0"
+      "0.4.0",
+      "0.4.1"
     ],
     "rightkit-sync": [
       "0.1.1"
@@ -1092,7 +1111,8 @@
       "0.3.3",
       "0.4.0",
       "0.5.0",
-      "0.5.1"
+      "0.5.1",
+      "0.6.0"
     ],
     "rightkit-android": [
       "0.2.0"

package/runtime-budgets.mjs

@@ -251,10 +251,13 @@ const posix = (p) => p.split(path.sep).join("/");
  * The git pathspecs (relative to the workspace root) whose change makes a measurement stale: the
  * crate's src, benches, Cargo.toml (features) and build.rs, plus src, Cargo.toml and build.rs of every
  * workspace crate it reaches through `path` dependencies (transitively). Returns { root, specs, problems }.
+ * Every crate is its own Cargo workspace (rightkit#1285), so `root` is the crate directory (its own Cargo.toml and Cargo.lock)
+ * and a sibling crate's paths are `../<x>/...`. `deps.base` names the directory the specs are relative to (default: the
+ * workspace root); a caller that runs git at the repository root passes it so the specs read crates/<x>/....
  * Callers must refuse incomplete metadata rather than using a partial dependency scope.
  */
 export function measuredPathspecs(crateDir, deps = {}) {
-  const { exists = existsSync, readFile = readFileSync } = deps;
+  const { exists = existsSync, readFile = readFileSync, base } = deps;
   const problems = [];
   // Workspace discovery deliberately tolerates bad ancestor manifests elsewhere. Freshness cannot:
   // a swallowed read/parse failure could hide inherited dependencies and shrink the measured graph.
@@ -271,7 +274,7 @@ export function measuredPathspecs(crateDir, deps = {}) {
   const checked = { exists, readFile: checkedRead };
   let root = path.resolve(crateDir);
   const specs = [];
-  const add = (dir, names) => { for (const name of names) specs.push(posix(path.relative(root, path.join(dir, name)))); };
+  const add = (dir, names) => { for (const name of names) specs.push(posix(path.relative(base ? path.resolve(base) : root, path.join(dir, name)))); };
   try {
     root = findWorkspaceRoot(crateDir, checked) ?? root;
     add(path.resolve(crateDir), CRATE_PATHS);
@@ -365,6 +368,7 @@ export function measurementStaleness(commit, crateDir, git = defaultGit, deps =
     }
   } catch (error) { return `cannot resolve Cargo.lock package identity: ${error.message}`; }
   if (name) {
+    // The crate's own workspace lock: root is the crate directory when the crate is its own workspace (#1285).
     const lockPath = path.join(root, "Cargo.lock");
     let now;
     try { now = exists(lockPath) ? readFile(lockPath, "utf8") : null; }

package/scan-digest.mjs

@@ -54,6 +54,60 @@ export function rustCratePlan(own = {}) {
   return { lintSets, defaultCheck, checkSets };
 }
 
+// ---- Clippy batching (GATE-CONTRACT §1 "Clippy route & batching"; item 8 rows 8.6, 8.8, 8.15) -----------------------------------------
+// Lives here, beside the scan ids, so the credentialed verifiers (requiredScanIds) and the planner (planScans) spell a batch's id from
+// one function. Pure: no file reads.
+
+/** The feature flags that mean the same thing on every package they are applied to: any other set names features of one crate. */
+export const CLIPPY_UNIVERSAL_FEATURE_FLAGS = Object.freeze(["--all-features", "--no-default-features"]);
+const optionValue = (set, names) => {
+  for (let i = 0; i < set.length; i += 1) for (const n of names) { if (set[i] === n) return set[i + 1] ?? null; if (set[i].startsWith(`${n}=`)) return set[i].slice(n.length + 1); }
+  return null;
+};
+/** The target and profile a feature-set argv selects (null: the toolchain's host target and the dev profile). */
+export const clippySelectionOf = (set) => ({ target: optionValue(set, ["--target"]), profile: set.includes("--release") || set.includes("-r") ? "release" : optionValue(set, ["--profile"]) });
+
+/**
+ * Groups the Clippy configurations of a plan into invocations. `entries`: `[{ name, crate, ws, set, count, env }]`, one per crate
+ * and lint feature set (`count` is how many sets the crate declares). Entries are batched when workspace, feature set, target,
+ * profile, lint policy, toolchain and environment are all equal (they share one `-p` list); an entry is its own invocation, with
+ * the reason recorded, when:
+ *  - its crate is in `solo` (ci/shards.json `solo`: a crate that always gets a job of its own);
+ *  - it is in `separate` (a name to a reason): batching changed what compiles for it (feature unification, item 8 row 8.7);
+ *  - its feature set names crate-specific features (anything but --all-features / --no-default-features): such a set is
+ *    per-configuration by construction, for example rightkit-db's SQLCipher variants or rightkit-qa-driver's wv2 generations
+ *    (ci/gate.config.json featureSets);
+ *  - its crate is sidecar-bound: it is scheduled after every independent batch and never joins one.
+ * A batch never widens a package set: it names exactly its members with `-p`. A batch's id is `clippy:batch:[<ws>:]<8 hex>` over its
+ * workspace, feature set, target, profile, lint policy and member list (never the toolchain or the output directory, which a
+ * verifier does not know), so the planner and requiredScanIds agree and the id names exactly the crates it covers. Returns
+ * `{ batches, notes }`; batches are ordered independent first, then sidecar-bound, each group by workspace then key.
+ */
+export function clippyBatchPlan(entries, { solo = [], separate = new Map(), sidecarBound = new Set(), toolchain = null, lint = ["-D", "warnings"] } = {}) {
+  const soloSet = new Set(solo);
+  const groups = new Map();
+  for (const e of entries) {
+    const set = [...e.set];
+    const crate = e.crate ?? e.name;
+    const sel = clippySelectionOf(set);
+    let reason = null;
+    if (soloSet.has(e.name) || soloSet.has(crate)) reason = "ci/shards.json solo: the crate always gets an invocation of its own";
+    else if (separate instanceof Map && separate.has(e.name)) reason = separate.get(e.name);
+    else if (set.some((w) => !CLIPPY_UNIVERSAL_FEATURE_FLAGS.includes(w))) reason = `ci/gate.config.json featureSets names crate-specific features (${set.join(" ")})${e.count > 1 ? `; ${crate} declares ${e.count} feature configurations that are separate invocations by construction` : ""}`;
+    const bound = sidecarBound.has(e.name) || sidecarBound.has(crate);
+    const identity = { ws: e.ws, set, target: sel.target, profile: sel.profile, lint, ...(reason || bound ? { only: e.name, sidecar: bound } : {}) };
+    const key = canonicalJson({ ...identity, toolchain, env: e.env ?? null });
+    if (!groups.has(key)) groups.set(key, { key, identity: canonicalJson(identity), ws: e.ws, set, target: sel.target, profile: sel.profile, units: [], crates: [], reason: reason ?? (bound ? "sidecar-bound: scheduled after its sidecar prerequisite, never batched with independent crates" : null), order: bound ? "sidecar" : "independent" });
+    const g = groups.get(key);
+    g.units.push(e.name); if (!g.crates.includes(crate)) g.crates.push(crate);
+  }
+  const batches = [...groups.values()].map((g) => ({ ...g, units: g.units.sort(), crates: g.crates.sort() })).map((g) => ({ ...g, id: `clippy:batch:${g.ws === "." ? "" : `${g.ws}:`}${sha256(`${g.identity}\0${g.units.join("\0")}`).slice(0, 8)}` }));
+  batches.sort((a, b) => (a.order === b.order ? (a.ws === b.ws ? (a.key < b.key ? -1 : 1) : a.ws < b.ws ? -1 : 1) : a.order === "independent" ? -1 : 1));
+  const notes = batches.filter((b) => b.reason).map((b) => `clippy batching: ${b.units.join(", ")} (${b.set.join(" ") || "default features"}) stays its own invocation: ${b.reason}`);
+  notes.push(`clippy batching: ${entries.length} crate configuration(s) in ${batches.length} invocation(s), each \`-p\` list exactly its members, \`--locked\` and \`--no-deps\` on every one; no batch is \`--workspace\``);
+  return { batches, notes };
+}
+
 /** Scan ids every scan of the whole repository always has when it holds Rust units (cargo.toml, workflows, YAML, JSON and licences). */
 export const WORKSPACE_SCAN_IDS = Object.freeze(["cargo-metadata", "cargo-deny", "cargo-audit", "actionlint", "yaml-parse", "toml-parse", "json-parse", "license", "secret-scan"]);
 /** Prefixes at least one scan id must carry (rustfmt groups by edition, so its exact ids depend on the files). */
@@ -62,25 +116,35 @@ export const REQUIRED_SCAN_PREFIXES = Object.freeze(["rustfmt:"]);
 /**
  * The scan ids a LOCAL scan record must contain, each with status pass, for these publishable Rust `units` ([names], crates/<name>).
  * `exists(repoPath)` answers from the AUTHENTICATED source (never from the record): src/lib.rs decides `doc`, CHANGELOG.md decides
- * `changelog-version`, and the repository's own ci/advisory-exceptions.json, ownership catalog and docs generator decide theirs.
+ * `changelog-version`, and the repository's own ci/advisory-exceptions.json (or, per crate, crates/<name>/.rightkit/advisory-exceptions.json), ownership catalog and docs generator decide theirs.
  * `crateFeatures` is ci/gate.config.json `rust`. `includeTests` adds the per-feature-set test scans. Extra scans in a record are
  * allowed; a missing one is not. planScans builds its ids from the same helpers, and a test holds the two in agreement.
  */
-export function requiredScanIds({ units, crateFeatures = {}, exists, includeTests = false }) {
+export function requiredScanIds({ units, crateFeatures = {}, exists, includeTests = false, perCrateWorkspaces = undefined, clippyBatching = false, shardSolo = [], clippySeparate = new Map(), sidecarBound = new Set() }) {
   if (!Array.isArray(units) || units.length === 0 || !units.every((n) => typeof n === "string" && n)) throw new TypeError("requiredScanIds: units must be a non-empty array of names");
   if (typeof exists !== "function") throw new TypeError("requiredScanIds: exists(repoPath) is required");
-  const ids = new Set(WORKSPACE_SCAN_IDS);
-  if (exists("ci/advisory-exceptions.json")) ids.add("advisory-exceptions");
+  // One Cargo workspace and lock per crate (rightkit#1285): every unit has its own crates/<name>/Cargo.lock, so the per-workspace scans
+  // (metadata, deny, audit and the advisory ledger where the crate has one) are required per unit and carry the crate name; there is no
+  // repository-level ledger. A repository with one root workspace has no per-crate lock and keeps the unsuffixed ids.
+  const perCrate = perCrateWorkspaces ?? units.every((n) => exists(`crates/${n}/Cargo.lock`));
+  const ids = new Set(WORKSPACE_SCAN_IDS.filter((id) => !(perCrate && /^cargo-(metadata|deny|audit)$/.test(id))));
+  if (!perCrate && exists("ci/advisory-exceptions.json")) ids.add("advisory-exceptions");
   if (exists("packages/release/rightkit-ownership.json") && exists("crates/rightkit-ownership/catalog/ownership-catalog.json")) ids.add("ownership-catalog");
   if (exists("scripts/generate-index.mjs")) ids.add("generated-docs");
+  const clippyEntries = [];
   for (const name of units) {
     const own = crateFeatures?.[name] ?? {};
     const { lintSets, defaultCheck, checkSets } = rustCratePlan(own);
+    if (perCrate) {
+      for (const id of ["cargo-metadata", "cargo-deny", "cargo-audit"]) ids.add(`${id}:${name}`);
+      if (exists(`crates/${name}/.rightkit/advisory-exceptions.json`)) ids.add(`advisory-exceptions:${name}`);
+    }
     ids.add(rustScanId.packageList(name));
     if (exists(`crates/${name}/CHANGELOG.md`)) ids.add(rustScanId.changelog(name));
     if (defaultCheck) ids.add(rustScanId.check(name));
     checkSets.forEach((_set, i) => ids.add(rustScanId.checkFeatures(name, i)));
-    lintSets.forEach((_set, i) => ids.add(rustScanId.clippy(name, lintSets.length, i)));
+    if (clippyBatching) lintSets.forEach((set) => clippyEntries.push({ name, crate: name, ws: ".", set, count: lintSets.length, env: null }));
+    else lintSets.forEach((_set, i) => ids.add(rustScanId.clippy(name, lintSets.length, i)));
     if (exists(`crates/${name}/src/lib.rs`)) ids.add(rustScanId.doc(name));
     if (includeTests) {
       lintSets.forEach((_set, i) => {
@@ -89,6 +153,8 @@ export function requiredScanIds({ units, crateFeatures = {}, exists, includeTest
       });
     }
   }
+  // With batching on, the Clippy ids are the batches' (the same function the planner calls), never the per-crate ones.
+  if (clippyBatching) for (const b of clippyBatchPlan(clippyEntries, { solo: shardSolo, separate: clippySeparate, sidecarBound }).batches) ids.add(b.id);
   return [...ids].sort();
 }
 

package/sign-updater.mjs

@@ -7,6 +7,7 @@ import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
 import { execWithUpdaterCredential } from "./protected-credentials.mjs";
 import { resolvePnpmCli } from "./development.mjs";
 import { UPDATER_KEY_ID_RE, updaterSignatureKeyId } from "./github-updater-release.mjs";
+import { ArtifactPathError, loadSplitArtifactContext, resolveArtifactPath } from "./release-artifact-path.mjs";
 
 export const UPDATER_SIGNING_SECRET = "updater-signing-key";
 
@@ -14,6 +15,8 @@ export function runSignUpdater(args, {
   env = process.env, platform = process.platform, cwd = process.cwd(),
   execCredential = execWithUpdaterCredential, resolvePnpm = resolvePnpmCli,
   signMac = signMacUpdaterFiles, exists = existsSync, remove = rmSync, read = (file) => readFileSync(file, "utf8"), log = console.log,
+  // The artifact-path context of a door split (release-artifact-path.mjs, row 7.04c): `--file` is then the bound Cargo target's, never the checkout's.
+  artifactPaths = null,
 } = {}) {
   const files = [];
   let dryRun = false;
@@ -21,7 +24,7 @@ export function runSignUpdater(args, {
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--file") {
       if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error("--file requires an artifact path");
-      files.push(path.resolve(cwd, args[++i]));
+      files.push(artifactPaths?.mode === "split" ? resolveArtifactPath(args[++i], artifactPaths) : path.resolve(cwd, args[++i]));
     } else if (args[i] === "--key-id") {
       if (keyId !== undefined) throw new Error("--key-id may be given only once");
       if (!UPDATER_KEY_ID_RE.test(args[i + 1] ?? "")) throw new Error("--key-id requires the 16 upper-case hex digits of the updater key id");
@@ -77,9 +80,9 @@ export function runSignUpdater(args, {
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try { runSignUpdater(process.argv.slice(2)); }
+  try { runSignUpdater(process.argv.slice(2), { artifactPaths: await loadSplitArtifactContext({ cwd: process.cwd() }) }); }
   catch (error) {
-    console.error(`sign-updater: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    console.error(`sign-updater: ${error instanceof ArtifactPathError ? "" : error.code ? `[${error.code}] ` : ""}${error.message}`);
     process.exitCode = error.exitCode ?? 1;
   }
 }