@rightkit/release 0.6.10 → 0.6.11

package/broker-pins.mjs

@@ -0,0 +1,152 @@
+// The gate's own record of the broker it trusts on this host (Sage decision A, item 7 row 7.21; AR 256-258: pins come from the
+// consumer's own enrollment, "never from the receipt, request or project").
+//
+//   record   `<managed data root>/pins/broker-<platform>.json`, `{schema, platform, host, keyId, publicKey, brokerDigest, enrolledAt}`,
+//            outside every repository and snapshot, written only by `enrollBrokerPins` (an explicit operation; a second enrollment
+//            for the same platform is a rotation and says so).
+//   fallback RightKit's own checkout only: `ci/rk-pipeline.json` `attestation.<platform>`, read from the revision of the RUNNING gate
+//            (`git show <gate repository HEAD>:ci/rk-pipeline.json`), never from the selected commit, the snapshot or the working tree.
+//
+// Never read here: the broker's control root, its runtime manifest, `attestation/key.json` (it holds the SECRET key), an environment
+// variable, a flag, the snapshot or a receipt. A missing record in any repository but RightKit refuses the snapshot compile; nothing
+// is enrolled automatically.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { fileURLToPath } from "node:url";
+
+export const PINS_SCHEMA = "rightkit.broker-pins/1";
+export const PINS_DIR = "pins";
+export const PIPELINE_FILE = "ci/rk-pipeline.json";
+export const PIPELINE_SCHEMA = "rk-pipeline.v1";
+
+export class BrokerPinsError extends Error {
+  constructor(code, message) { super(message); this.name = "BrokerPinsError"; this.code = code; }
+}
+const fail = (code, message) => { throw new BrokerPinsError(code, message); };
+const sha256 = (data) => crypto.createHash("sha256").update(data).digest("hex");
+const HEX = /^(?:[0-9a-f]{2})+$/;
+
+/** The pin record of one platform under the managed data root. */
+export const pinsFile = ({ dataRoot, platform = process.platform }) => {
+  if (!dataRoot || !path.isAbsolute(dataRoot)) fail("RK_BROKER_PINS_ROOT", "the managed data root must be an absolute path");
+  if (!["darwin", "win32"].includes(platform)) fail("RK_BROKER_PINS_PLATFORM", `${platform} is not a broker host (darwin and win32 only)`);
+  return path.join(dataRoot, PINS_DIR, `broker-${platform}.json`);
+};
+
+/** `{host, keyId, publicKey, brokerDigest}` or a throw naming what is wrong. The key must be an uncompressed P-256 point whose sha256 is the key id. */
+export function validatePins(pins, label = "the broker pins") {
+  const bad = (why) => fail("RK_BROKER_PINS_INVALID", `${label}: ${why}`);
+  if (pins === null || typeof pins !== "object" || Array.isArray(pins)) bad("not an object");
+  const { host, keyId, publicKey, brokerDigest } = pins;
+  if (typeof host !== "string" || !host.trim()) bad("host is missing");
+  if (typeof publicKey !== "string" || !HEX.test(publicKey) || publicKey.length !== 130 || !publicKey.startsWith("04")) bad("publicKey is not an uncompressed SEC1 P-256 point in lowercase hex");
+  if (typeof keyId !== "string" || keyId !== sha256(Buffer.from(publicKey, "hex"))) bad("keyId is not the sha256 of the public key");
+  if (typeof brokerDigest !== "string" || !/^[0-9a-f]{64}$/.test(brokerDigest)) bad("brokerDigest is not a sha256 in lowercase hex");
+  return { host, keyId, publicKey, brokerDigest };
+}
+
+const isLink = (meta) => meta.isSymbolicLink();
+
+/** The enrolled record, or null when none exists. A link, a non-file, another platform's record or a malformed one is a refusal, never null. */
+export function readEnrolledPins({ dataRoot, platform = process.platform }) {
+  const file = pinsFile({ dataRoot, platform });
+  let meta;
+  try { meta = fs.lstatSync(file); } catch (e) { if (e.code === "ENOENT") return null; throw e; }
+  if (isLink(meta) || !meta.isFile()) fail("RK_BROKER_PINS_INVALID", `${file} is not a regular file`);
+  const dir = fs.lstatSync(path.dirname(file));
+  if (isLink(dir) || !dir.isDirectory()) fail("RK_BROKER_PINS_INVALID", `${path.dirname(file)} is not a real directory`);
+  if (process.platform !== "win32" && (meta.mode & 0o022 || dir.mode & 0o022)) fail("RK_BROKER_PINS_INVALID", `${file} or its directory is writable by group or others`);
+  let record;
+  try { record = JSON.parse(fs.readFileSync(file, "utf8")); } catch (e) { fail("RK_BROKER_PINS_INVALID", `${file} is not JSON (${e.message})`); }
+  if (record?.schema !== PINS_SCHEMA) fail("RK_BROKER_PINS_INVALID", `${file} is not a ${PINS_SCHEMA} record`);
+  if (record.platform !== platform) fail("RK_BROKER_PINS_INVALID", `${file} is the record of ${record.platform}, not ${platform}`);
+  return { ...validatePins(record, file), source: "enrolled", file };
+}
+
+const git = (spawn, cwd, args) => {
+  const r = spawn("git", args, { cwd, encoding: "utf8" });
+  if (r.error || r.status !== 0) return null;
+  return String(r.stdout ?? "").trim();
+};
+
+/**
+ * RightKit's own pins, from the revision of the running gate: the repository that holds `gateFile` and its HEAD commit, only when
+ * that repository IS the checkout being compiled (RightKit itself). Null when the gate is not run from a RightKit checkout.
+ */
+export function readGateRevisionPins({ gateFile, checkout, platform = process.platform, spawn = spawnSync, realpath = (p) => fs.realpathSync.native(p) }) {
+  const here = path.dirname(gateFile);
+  const top = git(spawn, here, ["rev-parse", "--show-toplevel"]);
+  if (!top) return null;
+  let same = false;
+  try { same = realpath(top) === realpath(checkout); } catch { same = false; }
+  if (!same) return null;
+  const revision = git(spawn, here, ["rev-parse", "--verify", "HEAD^{commit}"]);
+  if (!revision || !/^[0-9a-f]{40,64}$/.test(revision)) fail("RK_BROKER_PINS_INVALID", "the running gate's revision cannot be read");
+  const blob = spawn("git", ["show", `${revision}:${PIPELINE_FILE}`], { cwd: here, encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+  if (blob.error || blob.status !== 0) return null;
+  let pipeline;
+  try { pipeline = JSON.parse(String(blob.stdout)); } catch (e) { fail("RK_BROKER_PINS_INVALID", `${PIPELINE_FILE} at the gate's revision ${revision.slice(0, 12)} is not JSON (${e.message})`); }
+  if (pipeline?.schema !== PIPELINE_SCHEMA) fail("RK_BROKER_PINS_INVALID", `${PIPELINE_FILE} at the gate's revision is not ${PIPELINE_SCHEMA}`);
+  const entry = pipeline.attestation?.[platform];
+  if (!entry) return null;
+  return { ...validatePins(entry, `${PIPELINE_FILE} (${platform}) at the gate's revision ${revision.slice(0, 12)}`), source: "rk-pipeline", revision };
+}
+
+/**
+ * The pins this gate verifies broker receipts against: the enrolled record, else (RightKit only) the running gate's own revision.
+ * Throws RK_BROKER_PINS_MISSING when neither exists: an app repository without an enrollment compiles nothing through a broker.
+ */
+export function loadBrokerPins({ dataRoot, platform = process.platform, gateFile, checkout, spawn, realpath }) {
+  const enrolled = readEnrolledPins({ dataRoot, platform });
+  if (enrolled) return enrolled;
+  const fallback = gateFile && checkout ? readGateRevisionPins({ gateFile, checkout, platform, spawn, realpath }) : null;
+  if (fallback) return fallback;
+  return fail("RK_BROKER_PINS_MISSING", `no broker enrollment for ${platform} (${pinsFile({ dataRoot, platform })}), and this is not the RightKit checkout whose gate revision carries ${PIPELINE_FILE} pins; enroll the host's broker explicitly, the gate never enrolls one itself`);
+}
+
+/**
+ * The explicit enroll operation. Values come from the caller (the output of `rustright-broker --generate-attestation-key` and the
+ * installed runtime's `brokerDigest`); nothing is read from the broker, its key file or the environment. An existing record is
+ * replaced only with `rotate: true`.
+ */
+export function enrollBrokerPins({ dataRoot, platform = process.platform, host, keyId, publicKey, brokerDigest, rotate = false, now = () => new Date() }) {
+  const pins = validatePins({ host, keyId, publicKey, brokerDigest }, "the enrollment");
+  const file = pinsFile({ dataRoot, platform });
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const meta = fs.lstatSync(dir);
+  if (isLink(meta) || !meta.isDirectory()) fail("RK_BROKER_PINS_INVALID", `${dir} is not a real directory`);
+  let existing = null;
+  try { existing = readEnrolledPins({ dataRoot, platform }); } catch (e) { if (!rotate) throw e; }
+  if (existing && !rotate) fail("RK_BROKER_PINS_EXISTS", `${file} already enrolls key ${existing.keyId.slice(0, 12)}; replacing it is a rotation (pass rotate: true)`);
+  const record = { schema: PINS_SCHEMA, platform, ...pins, enrolledAt: now().toISOString(), ...(existing ? { rotatedFrom: { keyId: existing.keyId, brokerDigest: existing.brokerDigest } } : {}) };
+  const tmp = `${file}.${crypto.randomUUID()}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+  try { fs.renameSync(tmp, file); } finally { fs.rmSync(tmp, { force: true }); }
+  return { file, record, rotated: Boolean(existing) };
+}
+
+/** `node broker-pins.mjs enroll --platform <darwin|win32> --data-root <dir> --host H --key-id K --public-key P --broker-digest D [--rotate]` or `show`. */
+export function main(argv, { out = (m) => process.stdout.write(`${m}\n`), err = (m) => process.stderr.write(`${m}\n`) } = {}) {
+  const [command, ...rest] = argv;
+  const opt = (name) => { const i = rest.indexOf(name); return i < 0 ? undefined : rest[i + 1]; };
+  try {
+    const dataRoot = opt("--data-root"); const platform = opt("--platform") ?? process.platform;
+    if (command === "enroll") {
+      const r = enrollBrokerPins({ dataRoot, platform, host: opt("--host"), keyId: opt("--key-id"), publicKey: opt("--public-key"), brokerDigest: opt("--broker-digest"), rotate: rest.includes("--rotate") });
+      out(`enrolled ${r.record.platform} ${r.record.host} key ${r.record.keyId} in ${r.file}${r.rotated ? " (rotation)" : ""}`);
+      return 0;
+    }
+    if (command === "show") {
+      const pins = readEnrolledPins({ dataRoot, platform });
+      out(pins ? JSON.stringify(pins) : "no enrollment");
+      return pins ? 0 : 1;
+    }
+    err("usage: broker-pins.mjs enroll|show --platform <darwin|win32> --data-root <dir> [--host H --key-id K --public-key P --broker-digest D [--rotate]]");
+    return 2;
+  } catch (e) { err(`${e.code ?? "error"}: ${e.message}`); return 1; }
+}
+
+if (process.argv[1] && (() => { try { return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })()) process.exit(main(process.argv.slice(2)));

package/build-release.mjs

@@ -26,8 +26,10 @@ import { formatAdmission, formatNotRun, runAdmission } from "./admission.mjs";
 import { sccacheRefusal } from "./admission-host.mjs";
 import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { fileURLToPath } from "node:url";
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { assertInsideSource, assertReleaseSource, gitRootOf, isSnapshotSource, qaAdmissionSourceOptions, resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import { ArtifactPathError, assertSplitCommandPaths, boundTargetsEvidence, releaseCommandSteps, resolveArtifactPath as resolveSplitArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
 import { admitSourceQa } from "./release-qa-audit.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
@@ -44,7 +46,6 @@ import { collectSwiftToolVersions, planSwiftBuild } from "./swift-build-context.
 import { planIosNativeBuild, resolveIosBuildContext } from "./ios-build-context.mjs";
 import { packageCommandOptional, requiredBuildExecutables, resolveProjectType, targetUsesMsix } from "./project-type.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
-import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, summarizePreBrokerWaits, terminateProcessTree } from "./heavy-command.mjs";
 import { processGroupCpuSeconds } from "./process-liveness.mjs";
 import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimits } from "./progress-control.mjs";
@@ -80,7 +81,7 @@ const ANDROID_PIPELINE_FINGERPRINT = createHash("sha256")
   .slice(0, 16);
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
-function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target, pinnedCargoLocks = [] }) {
+function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativeLayout, target, pinnedCargoLocks = [], releaseSource = null, sourceRoot = repoRoot, artifactPaths = null }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(appRoot, "package.json"), "utf8")).version;
@@ -88,12 +89,15 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     version = undefined;
   }
   // An iOS target is built from its Xcode project and local packages only; the ownership scan covers just those roots.
-  const ownershipScope = preflightOwnershipScope({ repoRoot, appRoot, platform, target, nativeAssembly: config?.nativeAssembly });
+  // In a split the scope is the snapshot's (the commit's layout); the preflight reads the checkout for git, the sealed vault and the evidence.
+  const ownershipScope = preflightOwnershipScope({ repoRoot: sourceRoot, appRoot, platform, target, nativeAssembly: config?.nativeAssembly });
   return collectPreflight({
     platform,
     ownershipScope,
     appRoot,
     repoRoot,
+    releaseSource,
+    splitTargets: artifactPaths,
     app: config.app,
     configPath,
     // The version check is the doctor's job: by the time `build` runs, seal
@@ -140,10 +144,24 @@ if (resumeFrom && !["prepackage", "sign", "package", "post-sign", "harden"].incl
 const nativeReal = (file) => { try { return realpathSync.native(file); } catch { return file; } };
 const configPath = nativeReal(path.resolve(configName));
 const invocationRoot = path.dirname(configPath);
-const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
-assertPrimaryReleaseCheckout(repoRoot);
-const relativeConfig = path.relative(nativeReal(repoRoot), nativeReal(configPath)).replaceAll("\\", "/");
-if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
+// Source identity (release-source-identity.mjs, item 7 row 7.04, decision 2 Q2). Without RK_GATE_CHECKOUT the source is the checkout's HEAD,
+// proven exactly as before (primary worktree, branch-attached HEAD, clean status). Inside a door run it is the SELECTED COMMIT's objects
+// plus the gate's verified snapshot: the checkout may be dirty, ahead or detached, and no HEAD, status or branch of it is read.
+// A split that cannot be proven is refused (never a fallback to the checkout checks).
+let releaseSource;
+try { releaseSource = resolveReleaseSource({ cwd: process.env.RK_GATE_CHECKOUT ? process.cwd() : invocationRoot }); }
+catch (error) { fail(error.code === "RK_SOURCE_NO_REPOSITORY" ? `git rev-parse --show-toplevel failed: ${error.message}` : `${error.code ?? "RK_SOURCE_IDENTITY"}: ${error.message}`); }
+const splitSource = isSnapshotSource(releaseSource);
+// The checkout: every object read and every output (`.right-release`: vault, state, locks, sealed) belongs to it (GC:31, GC:65). The
+// source root is where the config, the build inputs and the QA plan are read: the snapshot in a split, else the checkout itself.
+const repoRoot = gitRootOf(releaseSource);
+const sourceRoot = sourceRootOf(releaseSource);
+try { assertReleaseSource(releaseSource, { commandId: "right-release build", skipCleanCheck: true }); } catch (error) { fail(error.message); }
+try { assertInsideSource(releaseSource, configPath, "the release config"); } catch (error) { fail(error.message); }
+const relativeConfig = path.relative(nativeReal(sourceRoot), nativeReal(configPath)).replaceAll("\\", "/");
+if (relativeConfig.startsWith("../")) fail(splitSource ? "release config must live inside the snapshot" : "release config must live inside the Git repository");
+// A split reads no dirty-checkout condition: the snapshot is the commit's bytes, proven by the door at the start and end of the stage.
+const sourceProblems = (inputs, commitId) => (splitSource ? [] : dirtyBuildInputs(repoRoot, inputs, commitId));
 const appRoot = path.dirname(configPath);
 const layout = resolveReleaseLayout({ repoRoot, configPath });
 const vaultRoot = layout.vaultRoot;
@@ -182,20 +200,17 @@ for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
 
 try {
   throwIfInterrupted();
-  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
+  const commit = releaseSource.commit;
   // A phase-resume never reads unrelated source. Its later build-input gate
   // remains strict, but requiring a globally clean mono-workspace here would
   // turn an already-built, signed installer into a needless full rebuild.
-  if (!resumeFrom) {
-    assertCleanSource({
-      status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], { trim: false }), // untrimmed: a leading space is the first record's X column (#782)
-      commandId: "right-release build",
-    });
-  }
+  // The checkout route runs the clean-source gate here (R1, byte for byte as before); a split re-proves its door run instead and reads
+  // no status (R2: a split that is no longer proven refuses, it never falls back).
+  try { assertReleaseSource(releaseSource, { commandId: "right-release build", skipPrimaryCheckout: true, skipCleanCheck: Boolean(resumeFrom) }); } catch (error) { fail(error.message); }
   mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
   lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
   const shortCommit = commit.slice(0, 8);
-  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+  const dirtyConfig = sourceProblems({ include: [relativeConfig], required: [relativeConfig] }, commit);
   if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
   const config = await importReleaseConfig(configPath, { query: `commit=${commit}` });
   if (!config?.app || !config?.version) fail("release config must expose app and version");
@@ -224,11 +239,25 @@ try {
     : null;
   const nativeIos = iosContext?.nativeIos ?? false;
   const nativeLayout = iosContext ? iosContext.nativeLayout : resolveNativeCargoLayout({ appRoot, config });
+  // Row 7.04c. In a door split the snapshot has no target directory: (R-T4) no step the app owns may name a target-relative path, refused here, before
+  // anything builds; (R-T1) each Cargo manifest's target is bound once, now, through the published resolver. Checkout mode does neither.
+  let artifactPaths = null;
+  if (splitSource) {
+    try {
+      assertSplitCommandPaths(releaseCommandSteps({ target, config, root: appRoot }), splitArtifactContext({ cwd: appRoot, env: process.env, nativeLayout, config, target, snapshotRoot: sourceRoot, resolve: false }));
+      artifactPaths = splitArtifactContext({
+        cwd: appRoot, nativeLayout, config, target, snapshotRoot: sourceRoot,
+        env: { ...process.env, RIGHT_RELEASE_ARTIFACT_DIR: resolveArtifactDir({ app: config.app, version: config.version, managedRoot: resolveManagedRoot({ env: process.env }) }) },
+      });
+    } catch (error) { if (error instanceof ArtifactPathError) fail(error.message); throw error; }
+  }
   if (platform === "win" && target.signingContract === "windows-raw-exe-authenticode-before-nsis-v1") {
     assertNsisInPlaceUpgradeContract(appRoot, target.nsisUpgradeContract);
   }
-  const { requiredInputs, buildInputs, cargoLockPaths: pinnedCargoLocks } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
-  const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
+  const { requiredInputs, buildInputs, cargoLockPaths: pinnedCargoLocks } = resolveReleaseBuildInputs({ repoRoot: sourceRoot, appRoot, configPath, config, target });
+  // R5: in a split every input resolves inside the snapshot (`hashInputs` below hashes the snapshot's files); the dirty-input gate is the checkout route's.
+  for (const file of requiredInputs) try { assertInsideSource(releaseSource, file, "a release build input"); } catch (error) { fail(error.message); }
+  const dirtyInputs = sourceProblems(buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
   const hasPackageJson = existsSync(path.join(appRoot, "package.json"));
   // iOS records the Xcode toolchain (and xcodegen when a project.yml is named) beside the Node and Rust tools.
@@ -316,7 +345,7 @@ try {
   // Preflight BEFORE any compile. These preconditions used to be discovered one
   // per build cycle, minutes deep, with errors that named a symptom instead of a
   // cause. Blocking problems stop here, in seconds, naming the fix.
-  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target, pinnedCargoLocks });
+  const preflight = buildPreflight({ config, configPath, appRoot, repoRoot: layout.repoRoot, platform, nativeLayout, target, pinnedCargoLocks, releaseSource, sourceRoot, artifactPaths });
   const preflightBlockers = preflightFailures(preflight);
   if (preflightBlockers.length > 0) {
     fail(`preflight found ${preflightBlockers.length} blocking problem(s):\n${formatPreflight(preflightBlockers)}`);
@@ -331,7 +360,8 @@ try {
   }
   // Hardening step 4: source QA is recorded, not enforced. A missing or rejected receipt warns loudly and the outcome
   // is sealed into the manifest (`qa.status`) for `right-release qa audit`. Dev lanes (install-app --dev) never reach this file.
-  const qaAdmission = admitSourceQa({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath) });
+  // A split compares the source QA receipt with the SELECTED commit (its tree, repository identity and lockfile closure from its objects), not HEAD.
+  const qaAdmission = admitSourceQa({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath), ...qaAdmissionSourceOptions(releaseSource) });
 
   // A tool being INSTALLED is not the same as it being the one PATH picks. The
   // vendored-OpenSSL build shells out to `perl`, and under Git Bash/MSYS that
@@ -343,6 +373,7 @@ try {
     ...releaseEnvironment({ root: vaultRoot, cacheRoot: sharedCacheRoot, platform, architecture: cacheIdentity.architecture, app: config.app, cacheKey, kind: "release", appRoot, mode: cacheMode }),
     ...(pathPrefix ? { PATH: `${pathPrefix}${path.delimiter}${process.env.PATH ?? ""}` } : {}),
     RIGHT_RELEASE_REPO_ROOT: layout.repoRoot,
+    ...(splitSource ? { RIGHT_RELEASE_SOURCE_ROOT: sourceRoot } : {}),
     RIGHT_RELEASE_APP_ROOT: layout.appRoot,
     RIGHTKIT_MANAGED_ROOT: resolveManagedRoot({ env: process.env }),
     RIGHT_RELEASE_ARTIFACT_DIR: resolveArtifactDir({ app: config.app, version: config.version, managedRoot: resolveManagedRoot({ env: process.env }) }),
@@ -353,6 +384,9 @@ try {
       delete env[name];
     }
   }
+  // A split's Cargo target is the one the gate bound and handed this process (row 7.09, R-T1): Cache V2's shared target does not replace it, or
+  // the bound target the seal reads would not be the one Cargo wrote.
+  if (splitSource && !managedCargoTarget && typeof process.env.CARGO_TARGET_DIR === "string" && path.isAbsolute(process.env.CARGO_TARGET_DIR)) env.CARGO_TARGET_DIR = process.env.CARGO_TARGET_DIR;
   if (cacheMode !== "shared") delete env.RIGHT_RELEASE_CACHE_OWNER;
   if (cacheMode === "shared" && env.RIGHT_RELEASE_CACHE_OWNER !== "rightkit-v2") fail("shared cache ownership token was not configured");
   if (cacheMode !== "shared" && !commandExists("sccache")) delete env.RUSTC_WRAPPER;
@@ -495,6 +529,9 @@ try {
         // cost ~5.9 GB of warm broker intermediates. The bridge's brokerManaged
         // flag already knows to leave a real directory untouched instead.
         if (swiftPlan) { /* SwiftPM: no Rust target link */ }
+        // A split writes no link into the snapshot (a link is never a ledger entry, decision 2 Q1 rule 2): Cargo writes the cache target
+        // directly (CARGO_TARGET_DIR) and the seal resolves `src-tauri/target/...` paths against it (sealRelease managedCargoTarget).
+        else if (splitSource) { /* no target link in the snapshot */ }
         else if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
         else {
           const linked = ensureLegacyTargetLink({ targetLink, cacheTarget, fs: { existsSync, realpathSync, renameSync, symlinkSync } });
@@ -538,7 +575,7 @@ try {
         });
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields: rightKitResolution ? registryManifestFields(rightKitResolution.snapshot, RELEASE_TOOL_VERSION) : undefined });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, artifactPaths, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields: rightKitResolution ? registryManifestFields(rightKitResolution.snapshot, RELEASE_TOOL_VERSION) : undefined, splitSealSource: splitSource ? { commit: releaseSource.commit, tree: releaseSource.tree, snapshotAppRoot: appRoot, checkoutAppRoot: releaseSource.checkoutAppRoot } : null });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -565,8 +602,8 @@ async function admit() {
   let commit;
   let config;
   try {
-    commit = git(invocationRoot, ["rev-parse", "HEAD"]);
-    const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+    commit = releaseSource.commit;
+    const dirtyConfig = sourceProblems({ include: [relativeConfig], required: [relativeConfig] }, commit);
     if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
     try { config = await importReleaseConfig(configPath, { query: `commit=${commit}` }); } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
   } catch (error) {
@@ -579,7 +616,7 @@ async function admit() {
     && existsSync(path.join(repoRoot, ".right-release", "sealed", `${config.app}-${config.version}-${commit.slice(0, 8)}`, platformName, "release-manifest.json"));
   const reuse = Boolean(resumeFrom) || Boolean(sealed);
   const result = await runAdmission({
-    root: appRoot, repoRoot, configPath, config: config ?? {}, platform, commit, skipChecks,
+    root: appRoot, repoRoot: sourceRoot, releaseSource, configPath, config: config ?? {}, platform, commit, skipChecks,
     tiers: reuse ? ["files", "host"] : ["files", "host", "network"],
     registry: async (ctx) => {
       const inputs = ctx.buildInputs();
@@ -631,7 +668,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields }) {
+function sealRelease({ configRoot, managedCargoTarget, artifactPaths = null, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields, splitSealSource = null }) {
   // Every app's release config names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
@@ -642,7 +679,11 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
   const targetPrefix = "src-tauri/target/";
   // A Cargo-less iOS app has no native layout and no managed cargo target: only the default prefix is ever compared.
   const effectiveTargetPrefix = nativeLayout?.targetPrefix ?? targetPrefix;
-  const resolveArtifactPath = (file) => {
+  const resolveArtifactPath = artifactPaths?.mode === "split" ? (file) => {
+    // Row 7.04c (R-T2): a split's declared artifact is read in place in the bound target (or the snapshot, or the managed artifact directory),
+    // through the one resolver; the prefix remap below is the checkout route's.
+    try { return resolveSplitArtifactPath(file, artifactPaths); } catch (error) { if (error instanceof ArtifactPathError) fail(error.message); throw error; }
+  } : (file) => {
     const normalized = file.replaceAll(path.win32.sep, "/");
     if (managedCargoTarget && normalized.startsWith(targetPrefix)) {
       return path.join(managedCargoTarget, normalized.slice(targetPrefix.length));
@@ -793,6 +834,10 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
     app: config.app,
     version: config.version,
     commit,
+    // A split seal names the selected commit AND its tree and says its bytes came from the door's snapshot (decision 2 Q2 item 5).
+    ...(splitSealSource ? { tree: splitSealSource.tree, source: "snapshot" } : {}),
+    // The Cargo targets this split bound (R-T1); the door cross-checks them against its own resolution (RK_SPLIT_TARGET_DRIFT).
+    ...(artifactPaths?.mode === "split" ? { boundTargets: boundTargetsEvidence(artifactPaths) } : {}),
     ownershipEvidence,
     // The exact registry resolution (identities, digests, registries, policy revision, observation time, observed latest)
     // this release was built against. Upload and resume consume it; neither resolves again.
@@ -814,7 +859,15 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
         if (present.length !== signingIdentity.receiptInputs.length) fail("missing current-build macOS signing or notarization receipt");
         validateNotarizationReceipt({ receiptPath: signingIdentity.receiptInputs[1], archive: resolveArtifactPath(target.notarize.file) });
       }
-      return present.map((file) => ({ file, sha256: hashFile(file) }));
+      // A split records each receipt relative to a base the checkout reproduces (its app root), never the snapshot's: the snapshot's bytes are
+      // replaced at the next sync. A receipt written INSIDE the snapshot cannot be re-read later, so it is refused (configure sign.receipt under the state root).
+      const recorded = (file) => {
+        if (!splitSealSource) return file;
+        const rel = (base) => path.relative(base, file).replaceAll("\\", "/");
+        if (!rel(splitSealSource.snapshotAppRoot).startsWith("../") && rel(splitSealSource.snapshotAppRoot) !== "..") fail(`signing receipt ${file} is inside the snapshot, which the next sync replaces; write it under the state root (${stateRoot}) so the seal can name it`);
+        return rel(splitSealSource.checkoutAppRoot);
+      };
+      return present.map((file) => ({ file: recorded(file), sha256: hashFile(file) }));
     })() } : null,
     files,
     routes,

package/cargo-ledger.mjs

@@ -0,0 +1,62 @@
+// The gate-owned ledger of every call the runtime cargo wrapper decides (item 7 rows 7.10 and 7.24, Sage decision C).
+//
+// The wrapper (cargo-target-shim.mjs) appends one record BEFORE it acts (`pending`) and one after (`ran`, `verified`, `unverified` or
+// `refused`), to `<ledger dir>/<scan token>.jsonl`. The gate (runScans) reads the file of each scan after it ended and fails the scan
+// on anything but a completed, successful call: a refused call fails its unit even when the test swallowed cargo's exit status, and a
+// call that never completed (the wrapper was killed, or the record was never finished) is unverified, never skipped. Records the gate
+// cannot attribute to a scan (the scan token was cleared) fail the run as a row of their own.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export const LEDGER_SCHEMA = "rightkit.cargo-ledger/1";
+export const SCAN_TOKEN_ENV = "RIGHTKIT_CARGO_SCAN";
+export const UNSCOPED = "unscoped";
+/** Statuses that are a completed success: a direct call that ran, a broker call whose signed receipt verified. */
+export const OK_STATUSES = Object.freeze(["ran", "verified"]);
+
+/** The token a scan's calls are filed under: stable per scan id, never the id itself. */
+export const scanTokenOf = (scanId) => crypto.createHash("sha256").update(String(scanId)).digest("hex").slice(0, 16);
+
+const tokenFile = (dir, token) => path.join(dir, `${token}.jsonl`);
+const validToken = (token) => (typeof token === "string" && /^[0-9a-f]{16}$/.test(token) ? token : UNSCOPED);
+
+/** Appends one record. Throws when it cannot be written: a call that cannot be recorded does not run. */
+export function appendLedger(dir, token, entry) {
+  if (!dir || !path.isAbsolute(dir)) throw new Error("the cargo ledger directory is not set");
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const fd = fs.openSync(tokenFile(dir, validToken(token)), fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+  try { fs.writeSync(fd, `${JSON.stringify({ schema: LEDGER_SCHEMA, at: new Date().toISOString(), ...entry })}\n`); } finally { fs.closeSync(fd); }
+}
+
+/**
+ * The calls filed under `token`, one per call id (a later record replaces an earlier one), and the problems found: an unreadable
+ * line, and every call that is not a completed success.
+ */
+export function readLedger(dir, token) {
+  const file = tokenFile(dir, validToken(token));
+  let text = "";
+  try { text = fs.readFileSync(file, "utf8"); } catch (e) { if (e.code === "ENOENT") return { entries: [], problems: [] }; throw e; }
+  const byId = new Map(); const problems = [];
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    let entry;
+    try { entry = JSON.parse(line); } catch { problems.push(`an unreadable ledger record in ${path.basename(file)}`); continue; }
+    if (entry?.schema !== LEDGER_SCHEMA || typeof entry.id !== "string") { problems.push(`a malformed ledger record in ${path.basename(file)}`); continue; }
+    byId.set(entry.id, { ...(byId.get(entry.id) ?? {}), ...entry });
+  }
+  const entries = [...byId.values()];
+  for (const e of entries) {
+    if (OK_STATUSES.includes(e.status)) continue;
+    const call = `cargo ${(e.argv ?? []).join(" ")}`.trim();
+    problems.push(e.status === "pending" ? `${call} (from ${e.cwd}) never completed: the wrapper recorded it and no outcome, so it is unverified` : `${call} (from ${e.cwd}) was ${e.status}${e.code ? ` (${e.code})` : ""}${e.message ? `: ${e.message}` : ""}`);
+  }
+  return { entries, problems };
+}
+
+/** Ledger files nobody claimed: the scan token was cleared or invented by the code under test. */
+export function unclaimedLedgers(dir, claimedTokens) {
+  let names = [];
+  try { names = fs.readdirSync(dir); } catch (e) { if (e.code === "ENOENT") return []; throw e; }
+  return names.filter((n) => n.endsWith(".jsonl")).map((n) => n.slice(0, -".jsonl".length)).filter((t) => !claimedTokens.has(t));
+}