@rightkit/release 0.6.10 → 0.6.11

package/init-command.mjs

@@ -253,7 +253,7 @@ export function initTemplate(root, options) {
 
 /** What a person does after init: the steps no command can do for them, in order. */
 export const NEXT_STEPS = Object.freeze([
-  "pnpm install                      (installs the pinned packages and, through `prepare`, the pre-push hook)",
+  "pnpm install                      (installs the pinned packages and, through `prepare`, the agent hook; no git hook)",
   "right-release doctor              (the build's own checks for this app, as rows)",
   "set the app's public legal host in legal-snapshot.config.json, replace legal/PRODUCT_SCHEDULE.md and legal/PRIVACY_NOTICE.md with reviewed text, then `pnpm exec legal-snapshot`",
   "register the repository on each host: add it to packages/release/ownership-repositories.json in RightKit (and its byte copy under packages/build-control-policy), then run `right-release ownership trust-refresh` on the Mac and the Dell (a person with administrator rights; an agent cannot)",

package/inventory-check.mjs

@@ -621,8 +621,8 @@ async function checkThirdParty({ repoRoot, records, live, findings }) {
     declarations.get(key).wheres.add(where);
   };
 
-  const rootManifest = await readToml(join(repoRoot, "Cargo.toml"));
-  const cargoSources = [{ where: "Cargo.toml", manifest: rootManifest }];
+  // Every crate is its own Cargo workspace (rightkit#1285): there is no root manifest, each crate declares its own requirements.
+  const cargoSources = [];
   for (const record of records.filter((r) => r.ecosystem === "cargo")) {
     cargoSources.push({ where: relative(repoRoot, join(record.dir, "Cargo.toml")), manifest: record.manifest });
   }
@@ -673,11 +673,14 @@ async function checkThirdParty({ repoRoot, records, live, findings }) {
   });
 
   const lockDuplicates = [];
-  const lockText = await readText(join(repoRoot, "Cargo.lock"));
-  if (lockText !== null) {
+  // One lock per crate workspace: look for duplicate resolutions in each crate's own crates/<x>/Cargo.lock.
+  for (const record of records.filter((r) => r.ecosystem === "cargo").sort((a, b) => a.dir.localeCompare(b.dir))) {
+    const lockFile = relative(repoRoot, join(record.dir, "Cargo.lock"));
+    const lockText = await readText(join(repoRoot, lockFile));
+    if (lockText === null) continue;
     for (const dup of duplicateCargoVersions(lockText)) {
-      lockDuplicates.push(dup);
-      findings.push(issue("thirdParty", `crate ${dup.name}`, "duplicate-lock-versions", `Cargo.lock resolves ${dup.versions.join(", ")}`));
+      lockDuplicates.push({ ...dup, lock: lockFile });
+      findings.push(issue("thirdParty", `crate ${dup.name} (${lockFile})`, "duplicate-lock-versions", `${lockFile} resolves ${dup.versions.join(", ")}`));
     }
   }
   return { declarations: declarations.size, uniquePackages: unique, lockDuplicates };
@@ -914,8 +917,8 @@ export function renderMarkdown(report) {
   section("account");
   lines.push(`## ${SECTIONS.thirdParty}`, "", `Declarations checked: ${report.sections.thirdParty.declarations}. Unique external packages: ${report.sections.thirdParty.uniquePackages}.`, "");
   section("thirdParty");
-  lines.push("Multiple versions in the root Cargo.lock:", "");
-  for (const dup of report.sections.thirdParty.lockDuplicates) lines.push(`- \`${dup.name}\`: ${dup.versions.join(", ")}`);
+  lines.push("Multiple versions in a crate's own Cargo.lock (one per crate workspace):", "");
+  for (const dup of report.sections.thirdParty.lockDuplicates) lines.push(`- \`${dup.name}\` in \`${dup.lock}\`: ${dup.versions.join(", ")}`);
   if (!report.sections.thirdParty.lockDuplicates.length) lines.push("- none");
   lines.push("");
   lines.push(`## ${SECTIONS.apps}`, "", "| App | Present | Duplicate copies in lock files |", "| --- | --- | ---: |");

package/ios-upload.mjs

@@ -33,8 +33,8 @@ import { IOS_SIGNING_CONTRACT } from "./ios-package-recipe.mjs";
 import { ASC_API, createAscClient, createTokenProvider, distributeToTestFlight, normalizeGroupSelection, TestFlightError, testflightPlan } from "./ios-testflight.mjs";
 import { iosOwnershipScope } from "./ownership-scope.mjs";
 import { assertArtifactUnchanged, digestBytes, verifyPublicationRelease } from "./publication-artifacts.mjs";
-import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
-import { assertCleanSource } from "./source-gate.mjs";
+import { assertBindsSource, assertInsideSource, assertReleaseSource, gitRootOf, isSnapshotSource, resolveReleaseSource } from "./release-source-identity.mjs";
+import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
 import { targetDistribution } from "./target-distribution.mjs";
 
 export const IOS_PROVIDER = "app-store-connect";
@@ -129,28 +129,33 @@ export function iosUploadPlan({ distribution, ipa, receipt }) {
 }
 
 // ---- authorisation -----------------------------------------------------------------------------------------------
-const git = (cwd, args) => {
-  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
-  if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${result.stderr}`);
-  return result.stdout.trim();
-};
 
 /** Local checks only; no network, no secret. The sealed release is the only input: build-free by construction. */
-export async function authorizeIosUpload({ releaseId, cwd = process.cwd(), configName = defaultReleaseConfigFile(cwd) }) {
+export async function authorizeIosUpload({ releaseId, cwd = process.cwd(), configName = defaultReleaseConfigFile(cwd), env = process.env }) {
   if (!RELEASE_ID.test(releaseId ?? "")) refuse("IOS_UPLOAD_RELEASE_REQUIRED", "--release <sealed-id> is required");
-  const repoRoot = git(cwd, ["rev-parse", "--show-toplevel"]);
-  assertPrimaryReleaseCheckout(repoRoot);
-  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
-  assertCleanSource({ status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release upload" });
+  // Source identity (release-source-identity.mjs, item 7 row 7.04). Outside a door run: the checkout's HEAD, primary worktree and a clean
+  // status, as always. Inside one: the selected commit and its verified snapshot, with HEAD, status and branch of the checkout unread.
+  const release = resolveReleaseSource({ cwd, env });
+  assertReleaseSource(release, { commandId: "right-release upload", env });
+  const split = isSnapshotSource(release);
+  const repoRoot = gitRootOf(release);
+  const commit = release.commit;
   const configPath = path.resolve(cwd, configName);
+  assertInsideSource(release, configPath, "the release config");
   if (!existsSync(configPath)) refuse("IOS_UPLOAD_CONFIG_INVALID", `release config is required: ${configName}`);
   // A legacy config is a module that runs on import (a JSON config is data): loaded only after the tree is proven clean.
   const config = await importReleaseConfig(configPath, { query: `upload=${Date.now()}` });
   const distribution = validateIosDistribution(targetDistribution(config, "ios"));
   const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, "ios");
-  const appRoot = path.dirname(configPath);
+  // The sealed release, its signing receipts and the state live where the build wrote them (the checkout's `.right-release`); the scope of
+  // the ownership scan is read from the snapshot's own config and project, which are the commit's.
+  const appRoot = split ? release.checkoutAppRoot : path.dirname(configPath);
+  const scopeRepoRoot = split ? release.snapshot : repoRoot;
+  const scopeAppRoot = path.dirname(configPath);
   // The IPA is verified by a streamed hash and never held in memory (streamRoles); the parts are read as byte ranges at upload time.
-  const sealed = verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app: config.app, version: config.version, platform: "ios", configPath, releaseId, streamRoles: ["ipa"], ownershipScope: iosOwnershipScope({ repoRoot, appRoot, target: config.targets?.ios, nativeAssembly: config.nativeAssembly }) });
+  const sealed = verifyPublicationRelease({ sealedDir, repoRoot, appRoot, commit, app: config.app, version: config.version, platform: "ios", configPath, releaseId, streamRoles: ["ipa"], ownershipScope: iosOwnershipScope({ repoRoot: scopeRepoRoot, appRoot: scopeAppRoot, target: config.targets?.ios, nativeAssembly: config.nativeAssembly }) },
+    split ? { verifyOwnership: (expected, root, scanRoot, scope) => verifyOwnershipEvidence(expected, root, scanRoot, scope, release) } : {});
+  if (split) assertBindsSource(release, sealed.manifest, "the sealed release");
   const entries = sealed.manifest.files.filter((entry) => entry.role === "ipa");
   if (entries.length !== 1) refuse("IOS_IPA_MISSING", "the sealed release must hold exactly one ipa entry");
   const ipa = sealed.artifacts.get(entries[0].name);
@@ -221,7 +226,7 @@ export async function runIosUpload({
   acquireLock = acquireFileLock, journalDir, sleep, monotonic, now = () => new Date(),
 }) {
   refuseIosAscEnv(env);
-  const auth = await authorize({ releaseId, configName, cwd });
+  const auth = await authorize({ releaseId, configName, cwd, env });
   const ipaEvidence = { name: auth.entry.name, sha256: auth.entry.sha256, sizeBytes: auth.entry.sizeBytes };
   const plan = iosUploadPlan({ distribution: auth.distribution, ipa: ipaEvidence, receipt: auth.receipt });
   const stateRoot = path.join(auth.repoRoot, ".right-release", "state", releaseId, "ios");

package/local-publish.mjs

@@ -373,31 +373,26 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
 
 /**
  * The clippy invocations that replace each crate's own `cargo clippy -p <crate> --no-deps --all-targets
- * <featureSets[0]> -- -D warnings`: same flags and lint level, so the same lints on the same code. Crates
- * whose first feature set is empty or `--all-features` share one `-p a -p b` invocation (the flags mean the
- * same for every crate); any other feature set runs per crate, because `--features x` must not reach a crate
- * that lacks x. The caller passes ONE dependency layer: no selected crate depends on another, so `-p` does not
- * unify extra features into a selected crate and each is linted with exactly the features it was before.
- * Crates with a different RIGHTKIT_REQUIRE_ASSETS (asset-gated) stay apart so the environment is unchanged.
+ * <featureSets[0]> -- -D warnings`: same flags and lint level, so the same lints on the same code. Every crate is its own
+ * Cargo workspace with its own Cargo.lock (rightkit#1285), so cargo runs in that crate's directory and one invocation never
+ * names two crates: one `-p <crate>` run per crate and feature set, in layer order. Crates with a different
+ * RIGHTKIT_REQUIRE_ASSETS (asset-gated) keep their own environment.
  */
 export function batchClippyInvocations(layer, { featuresOf = () => [], featureSetsOf = (unit) => [featuresOf(unit)], assetGatedOf = () => false } = {}) {
-  const groups = new Map();
+  const invocations = [];
   for (const unit of layer) {
     // Every tested feature set of a crate is linted, in order; identical sets of one crate collapse to one run.
     const sets = featureSetsOf(unit) ?? [[]];
     const unique = sets.filter((set, index) => sets.findIndex((other) => JSON.stringify(other ?? []) === JSON.stringify(set ?? [])) === index);
     for (const set of unique) {
       const features = set ?? [];
-      const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
-      const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}:${JSON.stringify(features)}`;
-      if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
-      groups.get(key).crates.push(unit);
+      invocations.push({
+        crates: [unit], assetGated: assetGatedOf(unit),
+        args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
+      });
     }
   }
-  return [...groups.values()].map(({ crates, features, assetGated }) => ({
-    crates, assetGated,
-    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
-  }));
+  return invocations;
 }
 
 const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
@@ -450,15 +445,47 @@ export async function runLocalPublishUploadEngine(kind, argv, deps = {}) {
 
 // Stage state never leaves this process: persisted receipts are reports, not authority to skip unit tests.
 const unitStages = new WeakMap();
-function assertUnitDoor(root, stage, env, identity) {
-  const commit = defaultGit(["rev-parse", "HEAD"], root);
-  const tree = defaultGit(["rev-parse", "HEAD^{tree}"], root);
-  const common = defaultGit(["rev-parse", "--git-common-dir"], root);
+
+/**
+ * A unit stage built from a door SNAPSHOT (item 7 row 7.06a): `source` is { checkout, commit, tree } of the commit the door selected,
+ * and `--workspace` is the gate-owned snapshot of it. Identity is that commit's immutable objects, read from the CHECKOUT's object
+ * database, plus the door's start and end verification of the snapshot; it is never the checkout's HEAD or status. The git calls of
+ * the unit flow are mapped: HEAD and its tree are the selection, `status` is clean by the door's verify, `show HEAD:<path>` and
+ * `ls-files --error-unmatch` read the selected commit, and everything else runs in the checkout.
+ */
+export function sourceGit(source, git = defaultGit) {
+  return (args, cwd) => {
+    const [a, b] = args;
+    if (a === "rev-parse" && b === "HEAD") return source.commit;
+    if (a === "rev-parse" && b === "HEAD^{tree}") return source.tree;
+    if (a === "status") return "";
+    if (a === "show" && /^HEAD:/.test(b ?? "")) return git(["show", `${source.commit}:${b.slice(5)}`], source.checkout);
+    if (a === "ls-files" && b === "--error-unmatch") { const files = args.slice(args.indexOf("--") + 1); for (const f of files) if (git(["cat-file", "-e", `${source.commit}:${f}`], source.checkout) === null) return null; return files.join("\n"); }
+    return git(args, source.checkout);
+  };
+}
+
+/** The local-build grant read from the SELECTED COMMIT (`git show <commit>:.rightkit-local-build.json`), its repository checked against the checkout's origin. */
+export function localBuildGrantedAt(source, git = defaultGit) {
+  try {
+    const grant = JSON.parse(git(["show", `${source.commit}:${LOCAL_BUILD_FILE}`], source.checkout) ?? "null");
+    if (grant?.allow !== "build-test-publish" || typeof grant.repository !== "string") return false;
+    const origin = git(["config", "--get", "remote.origin.url"], source.checkout) ?? "";
+    const repo = /github\.com[:/]([^/]+\/[^/.\s]+?)(?:\.git)?\/?$/i.exec(origin)?.[1];
+    return !!repo && repo.toLowerCase() === grant.repository.toLowerCase();
+  } catch { return false; }
+}
+
+function assertUnitDoor(root, stage, env, identity, source = null) {
+  const commit = source ? source.commit : defaultGit(["rev-parse", "HEAD"], root);
+  const tree = source ? source.tree : defaultGit(["rev-parse", "HEAD^{tree}"], root);
+  const common = defaultGit(["rev-parse", "--git-common-dir"], source ? source.checkout : root);
   if (!/^[0-9a-f]{40}$/.test(commit ?? "") || !/^[0-9a-f]{40}$/.test(tree ?? "") || !common) refuse("cannot bind unit stage to HEAD and tree");
   if (identity && (identity.commit !== commit || identity.tree !== tree)) refuse("unit stage HEAD or tree changed");
-  const dirty = defaultGit(["status", "--porcelain", "--untracked-files=no"], root);
+  // The snapshot route has no checkout cleanliness to ask: the door verifies the snapshot against the commit at each stage's start and end.
+  const dirty = source ? "" : defaultGit(["status", "--porcelain", "--untracked-files=no"], root);
   if (dirty === null || dirty !== "") refuse("unit stage requires a clean tracked checkout");
-  const commonDir = path.resolve(root, common);
+  const commonDir = path.resolve(source ? source.checkout : root, common);
   const denial = requireDoorRun({ env, commonDir, commit, command: `unit ${stage}` });
   if (denial) refuse(denial);
   let run;
@@ -467,17 +494,17 @@ function assertUnitDoor(root, stage, env, identity) {
   return { commit, tree };
 }
 
-export async function compileLocalUnit(kind, argv, { env = process.env } = {}) {
+export async function compileLocalUnit(kind, argv, { env = process.env, source = null } = {}) {
   const parsed = parseLocalPublishArgs(kind, argv);
   if (!parsed.qualifyOnly || parsed.batch) refuse("unit stages require one --qualify-only unit and a new bundle");
-  const identity = assertUnitDoor(parsed.workspaceRoot, "compile", env);
-  const runner = publishUnitStages(parsed, { env }, null);
+  const identity = assertUnitDoor(parsed.workspaceRoot, "compile", env, undefined, source);
+  const runner = publishUnitStages(parsed, source ? { env, git: sourceGit(source), localBuildGranted: () => localBuildGrantedAt(source) } : { env }, null);
   try {
     const step = await runner.next();
     if (step.done || step.value?.stage !== "compile") refuse("unit compile did not complete");
-    assertUnitDoor(parsed.workspaceRoot, "compile", env, identity);
+    assertUnitDoor(parsed.workspaceRoot, "compile", env, identity, source);
     const state = Object.freeze({});
-    unitStages.set(state, { runner, parsed, identity, stage: "compile", compileRequests: [...(step.value.brokerRequests ?? [])] });
+    unitStages.set(state, { runner, parsed, identity, source, stage: "compile", compileRequests: [...(step.value.brokerRequests ?? [])] });
     return state;
   } catch (error) { await runner.return(); throw error; }
 }
@@ -487,10 +514,10 @@ async function advanceLocalUnit(state, expected, stage, env) {
   if (!entry || entry.stage !== expected) refuse(`unit ${stage} requires this process's completed ${expected} stage`);
   entry.stage = "running";
   try {
-    assertUnitDoor(entry.parsed.workspaceRoot, stage, env, entry.identity);
+    assertUnitDoor(entry.parsed.workspaceRoot, stage, env, entry.identity, entry.source);
     const step = await entry.runner.next(env);
     if (stage === "package" ? step.done || step.value?.stage !== "package" : !step.done || !step.value?.qualifiedOnly) refuse(`unit ${stage} did not complete`);
-    assertUnitDoor(entry.parsed.workspaceRoot, stage, env, entry.identity);
+    assertUnitDoor(entry.parsed.workspaceRoot, stage, env, entry.identity, entry.source);
     entry.stage = stage;
     if (stage === "qualify") unitStages.delete(state);
     return step.value;
@@ -566,7 +593,10 @@ async function* publishUnitStages(parsed, deps, batch) {
     if (tree !== batch.tree) refuse(`${unit}: HEAD tree ${tree} differs from the batch tree ${batch.tree}`);
   }
   const feedPath = "packages/release/rightkit-versions.json";
-  const guardedPaths = [dir, ...GATE_CONFIG_FILES, ...(parsed.qualifyOnly && kind === "cargo" ? ["Cargo.toml", "Cargo.lock"] : []), ...(parsed.qualifyOnly && kind === "npm" ? [feedPath] : [])];
+  // `dir` holds the crate's own Cargo.toml and Cargo.lock (each crate is its own workspace, #1285); a sibling crate it path-depends on
+  // shapes what is built, so its directory must match the commit too.
+  const siblingDirs = kind === "cargo" ? pathDependencyDirs(unitPath).map((sibling) => path.relative(workspaceRoot, sibling).split(path.sep).join("/")).filter((sibling) => sibling && !sibling.startsWith("..")) : [];
+  const guardedPaths = [dir, ...siblingDirs, ...GATE_CONFIG_FILES, ...(parsed.qualifyOnly && kind === "npm" ? [feedPath] : [])];
   const dirty = git(["status", "--porcelain", "--", ...guardedPaths], workspaceRoot);
   if (dirty === null) refuse(`cannot read git status for ${dir}`);
   if (dirty !== "") refuse(`tree is not clean for ${dir} or the gate config (${GATE_CONFIG_FILES.join(", ")}); commit first:\n${dirty}`);
@@ -612,7 +642,10 @@ async function* publishUnitStages(parsed, deps, batch) {
   for (const step of plan.steps) {
     const commandText = `${step.command} ${step.args.join(" ")}`;
     log(`[right-release] ${plan.id}: ${commandText}`);
-    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: workspaceRoot, env });
+    // A crate's own steps run in its Cargo workspace (its own Cargo.lock and target directory, #1285); a consumer row names its
+    // separate workspace by --manifest-path relative to the repository root.
+    const stepCwd = kind === "cargo" && step.command === "cargo" && !step.args.includes("--manifest-path") ? unitPath : workspaceRoot;
+    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: stepCwd, env });
     const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
     if (result.error || result.status !== 0) {
       steps.push(row);
@@ -675,11 +708,11 @@ async function* publishUnitStages(parsed, deps, batch) {
       // its evidence leaves this host, so the publishing host can reuse that exact archive's proof.
       const packageArgs = cargoPackageArgs(unit, parsed.qualifyOnly);
       packCommands.push(`cargo ${packageArgs.join(" ")}`);
-      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: workspaceRoot, env });
+      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: unitPath, env });
       if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
       if (parsed.qualifyOnly) steps.push({ command: `cargo ${packageArgs.join(" ")}`, ok: true });
       const metadataArgs = [...CARGO_METADATA_ARGS];
-      const meta = await runCargoReadOnly(metadataArgs, { cwd: workspaceRoot, env }, (_command, args, settings) => run("cargo", args, settings),
+      const meta = await runCargoReadOnly(metadataArgs, { cwd: unitPath, env }, (_command, args, settings) => run("cargo", args, settings),
         (failed) => log(`[right-release] offline Cargo metadata missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`));
       const actualMetadataArgs = meta.usedOfflineFallback ? metadataArgs.filter((arg) => arg !== "--offline") : metadataArgs;
       packCommands.push(`cargo ${actualMetadataArgs.join(" ")}`);
@@ -801,11 +834,11 @@ async function runLocalPublishBatch(parsed, deps) {
   if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
   const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
   if (!tree || !/^[0-9a-f]{40}$/.test(tree)) refuse("cannot resolve the HEAD tree");
-  // Every batch crate, the workspace manifest and lock, the gate config and EVERY crate's consumer directories must
-  // match the commit the batch checks are bound to, before the first layer publishes (0.4.1 review A3, A4).
-  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock", ...GATE_CONFIG_FILES, ...batchConsumerDirs], workspaceRoot);
+  // Every batch crate (its own Cargo.toml and Cargo.lock live in its directory, #1285), the gate config and EVERY crate's
+  // consumer directories must match the commit the batch checks are bound to, before the first layer publishes (0.4.1 review A3, A4).
+  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), ...GATE_CONFIG_FILES, ...batchConsumerDirs], workspaceRoot);
   if (dirty === null) refuse("cannot read git status for the batch");
-  if (dirty !== "") refuse(`tree is not clean for the batch crates, the workspace manifest, the gate config or a consumer directory; commit first:\n${dirty}`);
+  if (dirty !== "") refuse(`tree is not clean for the batch crates, the gate config or a consumer directory; commit first:\n${dirty}`);
   const registryHas = deps.registryHas ?? defaultRegistryHas;
   const published = (await Promise.all(crates.map(async (unit) => ((await registryHas({ kind: "cargo", name: unit, version: versions.get(unit) })) ? `${unit}@${versions.get(unit)}` : null)))).filter(Boolean);
   if (published.length) refuse(`already on the crates.io registry: ${published.join(", ")}; bump the version or remove them from the batch`);
@@ -815,15 +848,18 @@ async function runLocalPublishBatch(parsed, deps) {
   const env = testEnv(deps, false);
   const stamp = { commit: head, tree };
   const checks = []; const commands = [];
-  const batchCheck = async (name, command, args, crateNames, runEnv = env) => {
+  // One recorded check; `cwds` are the crate workspaces it runs in (each crate is its own Cargo workspace, #1285), once each.
+  const batchCheck = async (name, command, args, crateNames, runEnv = env, cwds = [workspaceRoot]) => {
     const text = `${command} ${args.join(" ")}`;
     log(`[right-release] batch ${name}: ${text}`);
-    const result = await run(command, args, { cwd: workspaceRoot, env: runEnv });
-    if (result.error || result.status !== 0) refuse(`batch ${name} failed (${result.error?.message ?? `exit ${result.status}`}): ${text}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    for (const cwd of cwds) {
+      const result = await run(command, args, { cwd, env: runEnv });
+      if (result.error || result.status !== 0) refuse(`batch ${name} failed (${result.error?.message ?? `exit ${result.status}`}): ${text}${cwd === workspaceRoot ? "" : ` (in ${path.relative(workspaceRoot, cwd)})`}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    }
     checks.push({ name, command: text, ok: true, ...stamp, ...(crateNames ? { crates: crateNames } : {}) });
     commands.push(text);
   };
-  await batchCheck("fmt", "cargo", ["fmt", "--all", "--check"]);
+  await batchCheck("fmt", "cargo", ["fmt", "--all", "--check"], undefined, env, crates.map((unit) => path.join(workspaceRoot, "crates", unit)));
   log("[right-release] batch secret-scan: crate directories of the batch");
   const scan = deps.scanSecrets ?? scanCrateForSecrets;
   const violations = crates.flatMap((unit) => scan(path.join(workspaceRoot, "crates", unit)).map((file) => `${unit}: ${file}`));
@@ -834,7 +870,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const featureSetsOf = (unit) => gateConfig?.rust?.[unit]?.featureSets ?? [[]];
   for (const layer of layers) {
     for (const invocation of batchClippyInvocations(layer, { featureSetsOf, assetGatedOf: isAssetGated })) {
-      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated));
+      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated), invocation.crates.map((unit) => path.join(workspaceRoot, "crates", unit)));
     }
   }
   const receipt = { id: `batch-${head.slice(0, 12)}-${sha256(JSON.stringify(layers)).slice(0, 8)}`, ...stamp, crates, checks };

package/local-qualify.mjs

@@ -370,7 +370,7 @@ function brokerIdentity(deps) {
   return { name: "rustright", client: String(client).replaceAll("\\", "/"), sha256: sha256((deps.readFile ?? fs.readFileSync)(client)) };
 }
 
-// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim (scripts/local-gate.mjs).
+// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim.
 function detectCargoCommand(deps) {
   const which = (command) => {
     const result = (deps.run ?? spawnSync)((deps.platform ?? process.platform) === "win32" ? "where" : "which", [command], { encoding: "utf8", windowsHide: true });
@@ -406,14 +406,16 @@ async function localScanRecord({ root, commit, crates, jobs, scratch, deps, log
     const repo = path.join(exportRoot, "rightkit");
     const tracked = String((deps.git ?? defaultGit)(["ls-files", "-z"], root) ?? "").split("\0").filter(Boolean);
     const unitDirs = crates.map((name) => `crates/${name}/`);
-    // Workspace-level scans (lock, deny, audit, workflows, YAML) plus every scan of the units; other crates and npm packages stay out of scope.
+    // Repository-level scans (workflows, YAML) plus every scan of the units, each in its own crate workspace (lock, deny, audit); other crates and npm packages stay out of scope.
     const files = tracked.filter((file) => (!file.startsWith("crates/") && !file.startsWith("packages/")) || unitDirs.some((dir) => file.startsWith(dir)));
     const crateFeatures = (deps.readJson ?? defaultReadJson)(path.join(repo, "ci", "gate.config.json"))?.rust ?? {};
     const plan = (deps.planScans ?? planScans)({ changed: files, contentRoot: repo, liveRoot: root, includeTests: false, localCompile: true, cargoCommand: detectCargoCommand(deps), crateFeatures, readBytes: (file) => fs.readFileSync(file) });
     const observedTools = modules.observeToolVersions();
     log(`[local-qualify] scans: ${plan.scans.length} planned over ${files.length} files (class A, then class B through the broker)`);
     const result = await (deps.runScans ?? runScans)(plan, { classes: ["A", "B"], jobs: Math.max(1, Number(jobs ?? 4) || 4), onResult: (row, progress) => log(`[local-qualify] scan [${progress.done}/${progress.total}] ${row.status.padEnd(7)} ${row.id}`) });
-    return modules.buildLocalScanRecord({ result, planned: plan.scans, sourceCommit: commit, headCommit: commit, cargoLockSha256: sha256(fs.readFileSync(path.join(root, "Cargo.lock"))), observedTools, units: crates, files: files.length });
+    // Every unit is bound to its own crate workspace lock (#1285): crates/<x>/Cargo.lock, no root lock.
+    const cargoLocks = Object.fromEntries([...crates].sort().map((name) => [name, { path: `crates/${name}/Cargo.lock`, sha256: sha256(fs.readFileSync(path.join(root, "crates", name, "Cargo.lock"))) }]));
+    return modules.buildLocalScanRecord({ result, planned: plan.scans, sourceCommit: commit, headCommit: commit, cargoLocks, observedTools, units: crates, files: files.length });
   } finally { fs.rmSync(exportRoot, { recursive: true, force: true }); }
 }
 

package/local-runtime.mjs

@@ -163,8 +163,9 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const bindings = {};
   for (const full of [...lsTree([`crates/${crate}/src`]), `crates/${crate}/Cargo.toml`]) bindings[full] = sha256(blob(full));
   Object.assign(bindings, owner.bindHarnessMetadata(crate, prescription, blob));
-  for (const full of lsTree(["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo", `crates/${crate}/benches`, "crates/rightkit-child-process/src", "crates/rightkit-child-process/Cargo.toml"])) bindings[full] = sha256(blob(full));
-  const { specs, problems: scopeProblems = [] } = (deps.measuredPathspecs ?? H.budgets.measuredPathspecs)(crateDir);
+  // Each crate is its own Cargo workspace with its own Cargo.lock (#1285): the same context files scripts/ci/runtime-qualify.mjs binds.
+  for (const full of lsTree([`crates/${crate}/Cargo.toml`, `crates/${crate}/Cargo.lock`, "rust-toolchain.toml", ".cargo", `crates/${crate}/.cargo`, `crates/${crate}/benches`, "crates/rightkit-child-process/src", "crates/rightkit-child-process/Cargo.toml"])) bindings[full] = sha256(blob(full));
+  const { specs, problems: scopeProblems = [] } = (deps.measuredPathspecs ?? H.budgets.measuredPathspecs)(crateDir, { base: root });
   if (scopeProblems.length) throw new Error(`cannot bind the measured dependency scope: ${scopeProblems.join("; ")}`);
   for (const full of lsTree(specs)) bindings[full] = sha256(blob(full));
   const helpers = Object.fromEntries(H.helperPaths().map((name) => [name, sha256(blob(name))]));
@@ -174,9 +175,9 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const socket = discoverBrokerSocket(deps.env ?? process.env, { platform });
   if (socket) brokerEnv.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
   const run = deps.run ?? ((command, args, settings) => spawnCollect(command, args, { maxBuffer: 64 * 1024 * 1024, ...settings }));
-  const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: root, windowsHide: true, ...settings });
+  const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: crateDir, windowsHide: true, ...settings });
   const toolchainOf = async () => {
-    const rustc = await run(cargoCommand[0] === "rustright" ? "rustright" : "rustc", cargoCommand[0] === "rustright" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
+    const rustc = await run(cargoCommand[0] === "rustright" ? "rustright" : "rustc", cargoCommand[0] === "rustright" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: crateDir, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
     const cargo = await invoke(["-V"], { env: { ...baseEnv, ...brokerEnv }, timeout: 60_000 });
     if (rustc.error || rustc.status !== 0 || cargo.error || cargo.status !== 0) throw new Error("cannot read the toolchain through the broker");
     return { rustc: String(rustc.stdout).trim(), cargo: String(cargo.stdout).trim() };

package/mac-package-recipe.mjs

@@ -18,6 +18,7 @@ import { buildDmg } from "./dmg-build.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { signMacosEntries } from "./mac-sign-core.mjs";
 import { mainExecutableName } from "./mac-bundle-signing.mjs";
+import { resolveArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
 import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { runMacCodesignCommands, signMacUpdaterFiles } from "./macos-signing-session.mjs";
@@ -160,10 +161,12 @@ const defaultInspect = (cmd, args) => {
  * signUpdater(files, options), receiptPath, log(event).
  */
 export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} }) {
+  let artifactPaths = null;
   const { recipe, app: declaredApp, dmgFile } = validateMacPackageTarget(target);
   const {
     platform = process.platform, env = process.env, fs = nodeFs,
-    resolveArtifact = (root, p) => path.resolve(root, p),
+    // A door split (row 7.04c, R-T2) reads a declared target path in the bound Cargo target, never the snapshot's or the checkout's; outside a split this is path.resolve.
+    resolveArtifact = (root, p) => { artifactPaths ??= splitArtifactContext({ cwd: root, env, target }); return artifactPaths.mode === "split" ? resolveArtifactPath(p, artifactPaths) : path.resolve(root, p); },
     resolveIdentity = resolveMacosDeveloperIdIdentity,
     signOne = (codesignArgs) => runMacCodesignCommands([codesignArgs], { env })[0],
     inspect = defaultInspect, evidence, hashFile,

package/mirror-root-artifact.mjs

@@ -11,6 +11,7 @@ import { copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSy
 import { execFileSync } from "./background-process.mjs";
 import path from "node:path";
 import { importReleaseConfig } from "./release-config.mjs";
+import { ArtifactPathError, isSplitArtifactEnv, loadSplitArtifactContext, resolveArtifactPath } from "./release-artifact-path.mjs";
 
 const args = parseArgs(process.argv.slice(2));
 const usage = "Usage: right-release mirror-root-artifact (--file <artifact> --package-root <dir> [--name <filename>] | --config <file> --platform mac|win [--package-root <dir>])";
@@ -52,15 +53,27 @@ if (args.config) {
 
 const packageRoot = realpathSync(path.resolve(rootArg));
 const managedOutput = path.resolve(process.env.RIGHT_RELEASE_ARTIFACT_DIR);
-const repoRoot = path.resolve(git(packageRoot, "rev-parse", "--show-toplevel"));
-if (inside(managedOutput, repoRoot)) {
-  console.error(`right-release mirror-root-artifact: managed output must be outside repository: ${managedOutput}`);
-  process.exit(2);
+// A door split (row 7.04c): the package root is the snapshot, which has no git directory; the repositories the output must stay out of are the
+// checkout and the snapshot, and a target-prefixed source is the bound Cargo target's (read in place, never the checkout's).
+const splitMirror = isSplitArtifactEnv(process.env);
+const artifactPaths = await loadSplitArtifactContext({ cwd: packageRoot });
+const repoRoots = splitMirror ? [path.resolve(process.env.RK_GATE_CHECKOUT), packageRoot] : [path.resolve(git(packageRoot, "rev-parse", "--show-toplevel"))];
+for (const repoRoot of repoRoots) {
+  if (inside(managedOutput, repoRoot)) {
+    console.error(`right-release mirror-root-artifact: managed output must be outside repository: ${managedOutput}`);
+    process.exit(2);
+  }
 }
 const safeName = (name) => name === path.basename(name) && /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(name);
 
 for (const entry of entries) {
-  const source = path.resolve(packageRoot, entry.file);
+  let source;
+  try { source = splitMirror ? resolveArtifactPath(entry.file, artifactPaths) : path.resolve(packageRoot, entry.file); }
+  catch (error) {
+    if (!(error instanceof ArtifactPathError)) throw error;
+    console.error(`right-release mirror-root-artifact: ${error.message}`);
+    process.exit(2);
+  }
   const name = entry.name || path.basename(source);
   if (!safeName(name)) {
     console.error(`right-release mirror-root-artifact: unsafe artifact name: ${name}`);

package/ownership-class-rules.mjs

@@ -4,7 +4,7 @@
 //   app-specific  product domain logic and presentation only.
 // Non-product code stays in an app only under an approved, expiring entry of .rightkit/ownership-exceptions.json that names the
 // RightKit issue that moves it. These two rules run wherever the app check runs (`rightkit-gate check`, `right-release check`, the
-// pre-push hook, the start of every checked right-release command and RightKit's own preflight):
+// start of every checked right-release command and RightKit's own preflight):
 //
 //   mandatory-foundation  OW-05  an app whose profile requires a foundation owner the app does not declare as a dependency (missing,
 //                                or dev-only), or that selects an unknown or unratified profile. An app is a repository whose root

package/ownership-evidence.mjs

@@ -8,6 +8,7 @@ import { acquireCommittedSource, assertCommittedCheckoutClean, committedSourceDa
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { runningPolicyBundle } from "./ownership-policy-bundle.mjs";
 import { canonicalRepositoryIdentity, loadTrustedExternal, resolveKeyLogTrust, sha256, validateOwnershipFloor, verifyRepositoryRegistration } from "./ownership-approval.mjs";
+import { isReleaseSource } from "./release-source-brand.mjs";
 
 const digestFile = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
 
@@ -32,8 +33,22 @@ function createEvidence(repoRoot, {
   requireCleanCheckout = false,
   allowPendingAdvisory = false,
   policyBundleProvider = runningPolicyBundle,
+  // A door source split (release-source-identity.mjs `resolveReleaseSource`, item 7 row 7.04): the evidence binds the SELECTED commit's
+  // objects, read from the checkout's object database, and never the checkout's HEAD or status. null (and a checkout-mode source) is today's behaviour.
+  releaseSource = null,
 } = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
+  if (releaseSource !== null && !isReleaseSource(releaseSource)) throw new Error("ownership evidence: the release source was not resolved by resolveReleaseSource");
+  const snapshotSource = releaseSource?.mode === "snapshot" ? releaseSource : null;
   const root = path.resolve(repoRoot);
+  // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
+  const realPath = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
+  if (snapshotSource && realPath(root) !== realPath(snapshotSource.checkout)) throw new Error(`ownership evidence: in a door source split the git root is the run's checkout ${snapshotSource.checkout}, not ${root}`);
+  // The caller names its app root in the snapshot (its cwd); the committed scan places it by its path inside the repository, which is the
+  // same relative path in the checkout. Nothing is read from either: the scan reads committed objects.
+  if (snapshotSource) {
+    const relative = path.relative(realPath(snapshotSource.snapshot), realPath(scanRoot));
+    if (relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative))) scanRoot = path.join(snapshotSource.checkout, relative);
+  }
   const scope = requestedScope ? [...new Set(requestedScope)].sort() : null;
   const manifestBytes = readFileSync(manifestPath);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
@@ -48,8 +63,14 @@ function createEvidence(repoRoot, {
   // a useful local backlog scan. It cannot assert a protected source binding or verify
   // approval signatures, so this result is deliberately advisory.
   const useCommittedSource = committed && (!enrollmentPending || Boolean(trustState.trust?.rootFingerprint));
-  if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root);
-  const source = useCommittedSource ? acquireCommittedSource(root, { requiredPaths: [...(trustState.trust?.provenance ?? []).flatMap((record) => record.paths ?? []), ...(trustState.trust?.rootFingerprint && !trustState.trust?.keyAuthority ? [".rightkit/ownership-keys.json"] : [])] }) : null;
+  // In a split the evidence is the selected commit's committed source or nothing: the advisory fallback would scan a mutable tree and
+  // read HEAD, which are exactly the reads a split replaces. Fail closed.
+  if (snapshotSource && !useCommittedSource) throw new Error("ownership evidence in a door source split needs the committed-source scan; this host's trust enrollment cannot provide it (RK_SOURCE_SPLIT)");
+  // The clean-checkout condition guards "bytes scanned (committed blobs) = bytes built (working tree)". A split builds a verified snapshot
+  // of the commit instead, so the checkout's cleanliness is irrelevant there (GC:24, GC:156 item 1).
+  if (useCommittedSource && requireCleanCheckout && !snapshotSource) assertCommittedCheckoutClean(root);
+  const selected = snapshotSource ? { commit: snapshotSource.commit, expectedTree: snapshotSource.tree } : {};
+  const source = useCommittedSource ? acquireCommittedSource(root, { ...selected, requiredPaths: [...(trustState.trust?.provenance ?? []).flatMap((record) => record.paths ?? []), ...(trustState.trust?.rootFingerprint && !trustState.trust?.keyAuthority ? [".rightkit/ownership-keys.json"] : [])] }) : null;
   let keyLogEvidence = null;
   if (trustState.trust?.keyAuthority) {
     const resolved = readAuthority(trustState.trust);
@@ -59,7 +80,7 @@ function createEvidence(repoRoot, {
     keyLogEvidence = { keyLogDigest: resolved.digest, keyCheckpoint: resolved.keyCheckpoint, rootFingerprint: resolved.rootFingerprint, keyAuthority: resolved.authority };
     if (!resolved.resolvedTrust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
   } else if (trustState.trust?.rootFingerprint) {
-    const keySource = source ?? acquireCommittedSource(root, { requiredPaths: [".rightkit/ownership-keys.json"] });
+    const keySource = source ?? acquireCommittedSource(root, { ...selected, requiredPaths: [".rightkit/ownership-keys.json"] });
     const sourceData = committedSourceDataForInternalUse(keySource);
     if (!sourceData) throw new Error("protected ownership key log requires authenticated committed source");
     const entry = sourceData.entries.find((item) => item.rel === ".rightkit/ownership-keys.json");
@@ -70,7 +91,8 @@ function createEvidence(repoRoot, {
     keyLogEvidence = { keyLogDigest: resolved.keyLogDigest, keyCheckpoint: resolved.checkpoint, rootFingerprint: resolved.trust.rootFingerprint };
     if (!resolved.trust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
   }
-  if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root, { expectedCommit: source.commit, expectedTree: source.tree });
+  if (useCommittedSource && requireCleanCheckout && !snapshotSource) assertCommittedCheckoutClean(root, { expectedCommit: source.commit, expectedTree: source.tree });
+  if (snapshotSource && (source.commit !== snapshotSource.commit || source.tree !== snapshotSource.tree)) throw new Error("ownership evidence: the acquired committed source is not the selected commit's");
   const commit = useCommittedSource ? source.commit : git(root, ["rev-parse", "HEAD"], gitRunner);
   if (!commit) throw new Error("ownership evidence: scan source did not produce a HEAD commit");
   const tree = useCommittedSource ? source.tree : git(root, ["rev-parse", `${commit}^{tree}`], gitRunner);
@@ -92,8 +114,7 @@ function createEvidence(repoRoot, {
     ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest, ...(policyBundleDigest !== undefined ? { policyBundleDigest } : {}) })
     : { ok: true, problems: [], warnings: ["protected ownership floor is unavailable: no protected trust registry is enrolled on this host (warning only)"] };
   floor.warnings = [...(floor.warnings ?? []), ...(bundleProblem ? [bundleProblem] : [])];
-  // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
-  const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
+  const real = realPath;
   const requestedRoot = path.relative(real(root), real(scanRoot)).replaceAll("\\", "/") || ".";
   if (requestedRoot.startsWith("../") || requestedRoot === ".." || path.isAbsolute(requestedRoot)) throw new Error("ownership evidence scan root must be inside repository");
   const evidenceDiagnostics = [];
@@ -199,13 +220,13 @@ function createEvidence(repoRoot, {
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */
-export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
-  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
+export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null, releaseSource = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true, releaseSource });
 }
 
 /** Alias spelling makes the immutable-source contract explicit at adapter boundaries. */
-export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
-  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true });
+export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null, releaseSource = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, releaseSource });
 }
 
 // Injection seam is deliberately named for tests and is not used by release commands.
@@ -228,12 +249,15 @@ export function runProtectedLocalOwnershipCheck(repoRoot, scanRoot = repoRoot) {
 }
 
 /** Re-scan exact source and compare every sealed binding before release upload. */
-export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null) {
-  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope), scope);
+export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null, releaseSource = null) {
+  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope, releaseSource), scope);
 }
 
 export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
-  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options), options.scope ?? null);
+  // Re-scan the way the evidence was made: committed-git-tree evidence (always the case in a door source split) through the
+  // committed-source scan, as verifyOwnershipEvidence does in production.
+  const rescan = expected?.source === "committed-git-tree" ? createCommittedOwnershipEvidenceForTest : createOwnershipEvidenceForTest;
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => rescan(repoRoot, options), options.scope ?? null);
 }
 
 function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent, scope = null) {