@rightkit/release 0.6.10 → 0.6.12

package/ownership-hooks.mjs

@@ -1,41 +1,22 @@
-// right-release hooks install: writes the advisory pre-commit ownership gate into an app repository.
+// right-release hooks: the advisory pre-commit ownership gate is retired (docs/GATE-CONTRACT.md: "Commit and push run no gate and no
+// local hook checks"). Nothing here writes a hook any more.
 //
-//   right-release hooks install [--app <dir>]
+//   right-release hooks install [--app <dir>]   (`right-release hooks install` is `rightkit-gate install-hook`: it retires the hook)
 //
-// The hook runs the app's pinned @rightkit/release (node_modules) via `right-release ownership --staged`.
-// An existing foreign pre-commit is preserved as pre-commit.rightkit-foreign and chained first.
-// The gate is advisory: `git commit --no-verify` bypasses it; broker admission and the release gate
-// remain authoritative.
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+// An earlier release wrote `.git/hooks/pre-commit` (or the one in core.hooksPath) running `right-release ownership --staged`, and
+// kept a foreign pre-commit as pre-commit.rightkit-foreign. Retirement removes the hook by its own marker only and puts the foreign
+// pre-commit back. `right-release ownership --staged` stays a manual command; broker admission and the release gate remain
+// authoritative.
+import { lstatSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, unlinkSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { HOOK_MARKER, retireHooksIn } from "./hook-retirement.mjs";
 import { repositoryRootFor } from "./ownership-staged.mjs";
 
-export const HOOK_MARKER = "rightkit-ownership-precommit v1";
-const FOREIGN = "pre-commit.rightkit-foreign";
-const PINNED_CLI = path.join("node_modules", "@rightkit", "release", "cli", "right-release.mjs");
+export { HOOK_MARKER };
 
-export function renderPreCommitHook() {
-  return [
-    "#!/bin/sh",
-    `# ${HOOK_MARKER}: advisory ownership gate installed by \`right-release hooks install\`.`,
-    "# Block-tier findings without a valid exception fail here; --no-verify bypasses this gate.",
-    "# Authoritative enforcement remains in broker admission and the release gate.",
-    "ROOT=\"$(git rev-parse --show-toplevel)\" || exit 1",
-    "HOOKS_DIR=\"$(dirname \"$0\")\"",
-    `if [ -x "$HOOKS_DIR/${FOREIGN}" ]; then`,
-    `  "$HOOKS_DIR/${FOREIGN}" "$@" || exit $?`,
-    "fi",
-    `GATE="$ROOT/${PINNED_CLI.split(path.sep).join("/")}"`,
-    "if [ ! -f \"$GATE\" ]; then",
-    "  echo \"[rightkit] @rightkit/release is not installed in this repository; add it as a devDependency, then re-run: right-release hooks install\" >&2",
-    "  exit 1",
-    "fi",
-    "exec node \"$GATE\" ownership --staged",
-    "",
-  ].join("\n");
-}
+const FS_OPS = Object.freeze({ readdir: readdirSync, readFile: (file) => readFileSync(file, "utf8"), lstat: lstatSync, unlink: unlinkSync, rename: renameSync, rmdir: rmdirSync });
 
 function git(cwd, args) {
   const result = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", windowsHide: true, env: Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_/i.test(k))) });
@@ -52,46 +33,26 @@ export function hooksDirectoryFor(root) {
   return path.resolve(root, common);
 }
 
-/**
- * Idempotent install. Returns { status: "installed" | "updated" | "unchanged" | "chained", file }.
- */
-export function installPreCommitHook(repoDir) {
+/** Remove the ownership pre-commit hook an earlier release wrote, restoring the foreign pre-commit it displaced. { status: "retired" | "restored" | "absent", file } */
+export function retirePreCommitHook(repoDir) {
   const root = repositoryRootFor(repoDir);
-  const pinned = path.join(root, PINNED_CLI);
-  if (!existsSync(pinned)) throw new Error(`@rightkit/release is not installed at ${pinned}; add it as a devDependency and run pnpm install first`);
   const hooksDir = hooksDirectoryFor(root);
+  const result = retireHooksIn(hooksDir, FS_OPS, { scripts: false });
   const file = path.join(hooksDir, "pre-commit");
-  const foreign = path.join(hooksDir, FOREIGN);
-  const body = renderPreCommitHook();
-  mkdirSync(hooksDir, { recursive: true });
-  let status = "installed";
-  if (lstatSync(file, { throwIfNoEntry: false })) {
-    const current = readFileSync(file, "utf8");
-    if (current === body) return { status: "unchanged", file };
-    if (current.includes(HOOK_MARKER)) status = "updated";
-    else {
-      if (existsSync(path.join(hooksDir, FOREIGN))) throw new Error(`${FOREIGN} already exists; resolve the chained hook manually before installing`);
-      renameSync(file, foreign);
-      status = "chained";
-    }
-  }
-  const temporary = `${file}.${process.pid}.tmp`;
-  writeFileSync(temporary, body, { mode: 0o755 });
-  chmodSync(temporary, 0o755);
-  renameSync(temporary, file);
-  return { status, file };
+  return { status: result.restored.length ? "restored" : result.removed.includes("pre-commit") ? "retired" : "absent", file };
 }
 
 export function main(args, { print = (line) => console.log(line) } = {}) {
   const flag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };
   if (args[0] !== "install") {
-    print("right-release hooks install [--app <dir>]");
+    print("right-release hooks install [--app <dir>]   (retires the ownership pre-commit hook; no hook is written)");
     return args.includes("--help") ? 0 : 2;
   }
   try {
-    const result = installPreCommitHook(path.resolve(flag("--app") ?? process.cwd()));
-    print(`[right-release] pre-commit ownership gate ${result.status}: ${result.file}`);
-    if (result.status === "chained") print(`[right-release] previous pre-commit preserved as ${FOREIGN} and runs first`);
+    const result = retirePreCommitHook(path.resolve(flag("--app") ?? process.cwd()));
+    print(`[right-release] pre-commit ownership gate retired (${result.status}): ${result.file}`);
+    if (result.status === "restored") print("[right-release] the previous pre-commit hook is back in place");
+    print("[right-release] commit runs no local hook check; `right-release ownership --staged` is still available by hand");
     return 0;
   } catch (error) {
     print(`[right-release] hooks install FAILED: ${error.message}`);

package/ownership-lockfiles.mjs

@@ -322,9 +322,22 @@ export function transitiveDependencies(appRoot, inventory, manifests, catalogOwn
     if (bytes && !contentDigests.some((item) => item.path === rel)) contentDigests.push({ path: rel, digest: sha256(bytes) });
     return bytes;
   };
+  // Directories the repository declares as gate fixtures (ci/gate.config.json `fixtures`: consumer recipes, vendored crates,
+  // spikes) are samples and harnesses, never the app's code: the gate builds none of them as units, and neither are they scanned here.
+  let fixtures = [];
+  try {
+    const rel = "ci/gate.config.json";
+    const config = inventory.snapshotFiles?.get(`${inventory.pathPrefix ?? ""}${rel}`)?.bytes ?? files.get(rel)?.bytes
+      ?? (!inventory.committed && existsSync(path.resolve(appRoot, rel)) ? readFileSync(path.resolve(appRoot, rel)) : undefined);
+    if (config) fixtures = (JSON.parse(config.toString("utf8")).fixtures ?? []).map((d) => String(d).replace(/\/+$/, ""));
+  } catch { fixtures = []; }
+  const underFixture = (rel) => fixtures.some((d) => rel === d || rel.startsWith(`${d}/`));
   for (const manifest of manifests) {
     const base = path.posix.basename(manifest.rel), ecosystem = base === "Cargo.toml" ? "cargo" : base === "package.json" ? "npm" : null;
     if (!ecosystem || !manifest.bytes) continue;
+    if (underFixture(manifest.rel)) continue;
+    // A Cargo manifest with its own [workspace] table is a workspace root: its lock sits beside it and Cargo never looks higher.
+    const workspaceRoot = ecosystem === "cargo" && /^\s*\[workspace\]\s*$/m.test(manifest.bytes.toString("utf8"));
     const names = ecosystem === "cargo" ? ["Cargo.lock"] : OWNERSHIP_LOCKFILES.slice(1);
     let dir = path.posix.dirname(manifest.rel), found = false;
     try {
@@ -337,7 +350,7 @@ export function transitiveDependencies(appRoot, inventory, manifests, catalogOwn
           }
           found = true; break;
         }
-        if (dir === ".") break;
+        if (dir === "." || workspaceRoot) break;
         dir = path.posix.dirname(dir);
       }
       if (!found) diagnostic(manifest.rel, "lockfile-missing", ecosystem);

package/ownership-policy-bundle.mjs

@@ -17,10 +17,11 @@ const CATALOG_FILE = "rightkit-ownership.json";
 const REGISTRY_FILE = "ownership-repositories.json";
 // Step 4: the release QA requirement floor is protected like the catalog. Dropping a required check changes the digest.
 export const QA_FLOOR_FILE = "release-qa-floor.json";
-// Modules that make or carry enforcement decisions. Their import closure is pinned.
+// Modules that make or carry enforcement decisions. Their import closure is pinned. ownership-hooks.mjs left the list with the
+// advisory pre-commit hook it used to write (GATE-CONTRACT: commit runs no local hook check): it retires that hook and decides nothing.
 export const POLICY_BUNDLE_ENTRYPOINTS = Object.freeze([
   "ownership-scan-worker.mjs", "ownership-evidence.mjs", "ownership-verdict.mjs", "ownership-admission.mjs",
-  "ownership-staged.mjs", "ownership-hooks.mjs", "ownership-key-trust.mjs", "release-qa-receipt.mjs",
+  "ownership-staged.mjs", "ownership-key-trust.mjs", "release-qa-receipt.mjs",
 ]);
 // Data files are pinned through their own digests, not as source files.
 const DATA_FILES = new Set([CATALOG_FILE, REGISTRY_FILE, ALLOWLIST_FILE, QA_FLOOR_FILE]);

package/ownership-staged.mjs

@@ -1,4 +1,5 @@
-// Advisory pre-commit ownership gate: scans the STAGED tree (index content), never the working tree.
+// Ownership gate for the STAGED tree (index content), never the working tree: the manual command `right-release ownership --staged`.
+// No git hook runs it any more (docs/GATE-CONTRACT.md: commit runs no local hook check).
 // Authoritative enforcement stays in broker admission and the release gate.
 //
 //   right-release ownership --staged [--app <dir>] [--json]

package/ownership.mjs

@@ -382,6 +382,9 @@ function resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDi
             const refs = lock.package.filter((p) => p.name === owner).flatMap((p) => p.dependencies ?? []);
             candidates = candidates.filter((p) => refs.some((ref) => ref === `${d.name} ${p.version}` || ref.startsWith(`${d.name} ${p.version} (`)));
           }
+          // A crate may declare two versions of one package under different names (windows 0.61 and 0.62 lanes): the declared
+          // requirement picks the resolved one, by Cargo's default caret rule (or an exact `=` pin).
+          if (candidates.length > 1 && typeof d.requirement === "string") candidates = candidates.filter((p) => cargoRequirementMatches(d.requirement, p.version));
           if (candidates.length !== 1 || typeof candidates[0].version !== "string") throw new Error(`Cargo.lock resolution missing or ambiguous: ${d.name}`);
           d.resolvedVersion = candidates[0].version;
         }
@@ -917,3 +920,24 @@ export function checkCommittedApp(appRoot, manifest, options = {}) {
 export function checkCommittedAppForTest(appRoot, manifest, options = {}) {
   return checkCommitted(appRoot, manifest, options, options.acquireCommittedSourceForTest ?? acquireCommittedSource, options.readAuthorityForTest);
 }
+
+/** Cargo's default requirement (`0.61`, `^1.2`, `=0.3.4`, `>=2.10.1, <3`) against a resolved version; anything else matches. */
+function cargoRequirementMatches(requirement, version) {
+  const parse = (v) => String(v).split("+")[0].split("-")[0].split(".").map((n) => Number(n));
+  const [x, y = 0, z = 0] = parse(version);
+  const cmp = (a, b) => a[0] - b[0] || (a[1] ?? 0) - (b[1] ?? 0) || (a[2] ?? 0) - (b[2] ?? 0);
+  return requirement.split(",").map((r) => r.trim()).filter(Boolean).every((r) => {
+    const m = /^(=|\^|>=|<=|>|<|~)?\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(r);
+    if (!m) return true;
+    const op = m[1] ?? "^"; const want = [Number(m[2]), m[3] === undefined ? undefined : Number(m[3]), m[4] === undefined ? undefined : Number(m[4])];
+    const v = [x, y, z]; const c = cmp(v, want);
+    if (op === "=") return want.every((n, i) => n === undefined || n === v[i]);
+    if (op === ">=") return c >= 0; if (op === ">") return c > 0; if (op === "<=") return c <= 0; if (op === "<") return c < 0;
+    if (op === "~") return c >= 0 && v[0] === want[0] && (want[1] === undefined || v[1] === want[1]);
+    if (c < 0) return false;
+    if (want[0] > 0) return v[0] === want[0];
+    if (want[1] === undefined) return v[0] === 0;
+    if (want[1] > 0) return v[0] === 0 && v[1] === want[1];
+    return v[0] === 0 && v[1] === 0 && (want[2] === undefined || v[2] === want[2]);
+  });
+}

package/package-recipe-targets.mjs

@@ -8,6 +8,7 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { ArtifactPathError, SPLIT_TARGET_UNRESOLVED_CODE, isSplitArtifactEnv } from "./release-artifact-path.mjs";
 import { defaultManagedRoots, isUnderManagedRoot } from "./managed-target-stage.mjs";
 import { NativeHelpersError, nativeHelperNestedCode, validateNativeHelpers } from "./native-helpers.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
@@ -79,13 +80,13 @@ const configArgs = (extras, appRoot, cwd) => (extras.tauriConfig ? ["--config",
  * release.mjs runs ONE prePackage command: node recipe-build.mjs runs the built-in cleanup, prepare, the Tauri build,
  * the artifact stability poll and postBuild in order. `cleanup` and `stability` are recipe-build plan sections.
  */
-function recipeBuildCommand({ extras, build, env, cleanup, stability, stage, timeoutMs, verifySidecars, nativeHelpers }) {
+function recipeBuildCommand({ extras, build, env, cleanup, stability, stage, timeoutMs, verifySidecars, nativeHelpers, boundTargets }) {
   const steps = [
     ...extras.prepare.map((step) => ({ phase: "prepare", ...step })),
     { phase: "build", cmd: build.cmd, args: build.args, cwd: build.cwd },
     ...extras.postBuild.map((step) => ({ phase: "postBuild", ...step })),
   ];
-  const plan = { version: 1, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage && (stage.pre?.length || stage.post?.length) ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
+  const plan = { version: 1, steps, ...(boundTargets?.length ? { boundTargets } : {}), ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage && (stage.pre?.length || stage.post?.length) ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
   return { cmd: process.execPath, args: [RECIPE_BUILD, "--plan", JSON.stringify(plan)], env, ...(timeoutMs ? { timeoutMs } : {}) };
 }
 
@@ -114,6 +115,9 @@ function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, m
 function buildTargetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, managedRoots, staged }) {
   const explicit = spec.cargoTargetRoot;
   if (explicit !== undefined && explicit !== true && explicit !== false && typeof explicit !== "string") fail(`${label}.cargoTargetRoot must be true or an app-relative Cargo.toml path`);
+  // A door split (row 7.04c, R-T1/R-T3): the snapshot has no target directory, so every declared target path is the bound target's, absolute, and
+  // nothing is copied (the #924 bridge plans zero staged entries): the build output is read and signed in place.
+  if (isSplitArtifactEnv(env)) return splitTargetRootMapper({ spec, appRoot, cwd, resolveTargetRoot, label });
   const envDir = typeof env.CARGO_TARGET_DIR === "string" && env.CARGO_TARGET_DIR.trim() !== "";
   if (explicit === false || (!explicit && !envDir)) return (declared) => declared;
   const manifestRel = typeof explicit === "string" ? relativeInside(explicit, `${label}.cargoTargetRoot`) : path.posix.join(cwd === "." ? "" : cwd, "src-tauri", "Cargo.toml");
@@ -141,9 +145,34 @@ function buildTargetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, lab
   };
 }
 
-function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability, stage }) {
+function splitTargetRootMapper({ spec, appRoot, cwd, resolveTargetRoot, label }) {
+  const explicit = spec.cargoTargetRoot;
+  const manifestRel = typeof explicit === "string" ? relativeInside(explicit, `${label}.cargoTargetRoot`) : path.posix.join(cwd === "." ? "" : cwd, "src-tauri", "Cargo.toml");
+  const manifest = path.resolve(appRoot, manifestRel);
+  // An app that declares no recipe target and has no src-tauri manifest has nothing to bind; a declared one that is missing is refused below.
+  if (explicit !== true && typeof explicit !== "string" && !existsSync(manifest)) return (declared) => declared;
+  let targetDir;
+  try { targetDir = resolveTargetRoot(manifest); } catch (error) {
+    throw new ArtifactPathError(SPLIT_TARGET_UNRESOLVED_CODE, `${label}: cannot resolve the Cargo target directory of ${manifest} (${error.message}); a split never falls back to a snapshot-relative target/`);
+  }
+  const relativeToApp = path.relative(appRoot, targetDir);
+  if (relativeToApp === "" || (!relativeToApp.startsWith("..") && !path.isAbsolute(relativeToApp))) {
+    throw new ArtifactPathError(SPLIT_TARGET_UNRESOLVED_CODE, `${label}: the Cargo target directory ${targetDir} is inside the snapshot; a split binds it outside (CARGO_TARGET_DIR, row 7.09)`);
+  }
+  const prefix = path.posix.join(path.posix.dirname(manifestRel).replace(/^\.$/, ""), "target");
+  const mapper = (declared) => {
+    const normalized = String(declared).replaceAll("\\", "/");
+    if (normalized !== prefix && !normalized.startsWith(`${prefix}/`)) return declared;
+    if (normalized.split("/").includes("..")) fail(`${label}: ${declared} must not contain ..`);
+    return path.resolve(targetDir, normalized.slice(prefix.length + 1));
+  };
+  mapper.bound = [targetDir];
+  return mapper;
+}
+
+function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability, stage, boundTargets }) {
   const args = ["exec", "tauri", "build", "--no-bundle", "--target", triple, ...configArgs(extras, appRoot, cwd), ...buildCargoArgs(extras, jobs)];
-  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, stage, timeoutMs });
+  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, stage, timeoutMs, boundTargets });
 }
 
 /** `targets.win.winPackage` → prePackage (`tauri build --no-bundle`) and package (`tauri bundle --bundles nsis`). */
@@ -193,7 +222,7 @@ export function expandWinPackageTarget(target, { appRoot, config = {}, env = pro
   return {
     ...rest,
     signingContract: "windows-raw-exe-authenticode-before-nsis-v1",
-    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] }, stage: prePackageStage }),
+    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] }, stage: prePackageStage, boundTargets: mapPath.bound }),
     package: bundleCommand,
     sign: { ...(target.sign ?? {}), prePackageFiles: [rawExe], files: [installerFile] },
     recipe: { kind: "winPackage", productName: plan.productName, updater: plan.updater },
@@ -327,7 +356,7 @@ export function expandMacPackageTarget(target, { appRoot, config = {}, env = pro
   return {
     ...rest,
     ...postSign,
-    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stage: macStage, verifySidecars, nativeHelpers: nativeHelpersPlan }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
+    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stage: macStage, verifySidecars, nativeHelpers: nativeHelpersPlan, boundTargets: mapPath.bound }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
     // Helpers are signed by release.mjs inside-out through sign.nestedCode (deepest path first, hardened runtime, each helper's own entitlements), then the app.
     sign: { ...(target.sign ?? {}), ...(helpers ? { nestedCode: { ...nativeHelperNestedCode(helpers), ...(target.sign?.nestedCode ?? {}) } } : {}), prePackageFiles },
     notarize: { ...target.notarize, app, appBeforePackage: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/pipeline-admission.mjs

@@ -239,13 +239,13 @@ function admitRuntime(bin, rest, options, label) {
 }
 
 /**
- * `rightkit-gate install-hook`: writes the committed pre-push hook and sets core.hooksPath, so an app's `prepare` script may run it.
- * It builds, signs, packages and uploads nothing. The gate itself (`rightkit-gate`, `--base`) compiles and is run by the hook, never
- * by a release config; only the installer and the version probe are admitted.
+ * `rightkit-gate install-hook`: retires the git hooks an earlier release wrote and registers the agent hook, so an app's `prepare` script may run it.
+ * It builds, signs, packages and uploads nothing. The gate itself (`rightkit-gate`, `--base`) compiles and is never run by a release
+ * config; only the installer and the version probe are admitted.
  */
 function admitRightKitGate(args, label) {
   if (args.length === 1 && (args[0] === "install-hook" || args[0] === "--version")) return admit(`rightkit-gate-${args[0].replace(/^--/, "")}`, "owner");
-  return refuse("R1-owner-subcommand", `${label}: only rightkit-gate install-hook (and --version) is an admitted pipeline command; the gate itself runs from the pre-push hook`);
+  return refuse("R1-owner-subcommand", `${label}: only rightkit-gate install-hook (and --version) is an admitted pipeline command; the gate itself is run through the door, never by a release config`);
 }
 
 function admitRightRelease(args, label) {

package/preflight.mjs

@@ -23,6 +23,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
+import { isReleaseSource } from "./release-source-brand.mjs";
 import { appRuntimeBudgetAdoptionCheck } from "./runtime-budgets.mjs";
 import { isSwiftProject } from "./project-type.mjs";
 
@@ -203,6 +204,12 @@ export function collectPreflight({
   bridge = true,
   msix = false,
   findSdkTool = findWindowsSdkTool,
+  // A door source split (release-source-identity.mjs `resolveReleaseSource`, row 7.04). Only the ownership check reads it: the evidence is
+  // then the selected commit's, read from the checkout's object database, whatever `repoRoot` the caller names.
+  releaseSource = null,
+  // The artifact-path context of a door split (release-artifact-path.mjs, row 7.04c). When it is a split, the target-bridge check is replaced by
+  // the R-T1 check: every manifest has a bound target outside the snapshot, and nothing sits where a snapshot-relative target/ would.
+  splitTargets = null,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
@@ -219,7 +226,14 @@ export function collectPreflight({
     );
   }
 
-  if (appRoot && !noBridge) {
+  if (appRoot && !noBridge && splitTargets?.mode === "split") {
+    const planted = splitTargets.boundTargets.map((bound) => path.join(appRoot, bound.prefix)).filter((dir) => { try { lstatSync(dir); return true; } catch { return false; } });
+    checks.push(
+      planted.length
+        ? fail("split-target", `RK_SPLIT_TARGET_PATH: ${planted.join(", ")} exists in the snapshot; a split binds its target outside it and nothing may sit there`, "remove it from the commit (it is build output) and add the directory to .gitignore")
+        : ok("split-target", splitTargets.boundTargets.length ? `target bound outside the snapshot: ${[...new Set(splitTargets.boundTargets.map((bound) => bound.dir))].join(", ")}` : "no target to bind"),
+    );
+  } else if (appRoot && !noBridge) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -339,8 +353,12 @@ export function collectPreflight({
     checks.push(fail("ownership", `ownership scope refused: ${ownershipScopeError}`, "fix the target's ownership scope configuration; the build refuses it too"));
   } else if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
-    const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
-    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory }));
+    // In a split the layout is the snapshot's (the commit's), the git root is the checkout, and the source is the one the identity module resolved.
+    if (releaseSource !== null && !isReleaseSource(releaseSource)) throw new Error("preflight: the release source was not resolved by resolveReleaseSource");
+    const split = releaseSource?.mode === "snapshot" ? releaseSource : null;
+    const gitRoot = split ? split.checkout : repoRoot;
+    const workspace = existsSync(path.join(split ? split.snapshot : repoRoot, "tools", "rightkit", "packages", "release"));
+    checks.push(ownershipCheck(gitRoot, { scanRoot: workspace && appRoot ? appRoot : gitRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory, ...(split ? { releaseSource: split } : {}) }));
   }
 
   return checks;
@@ -349,9 +367,14 @@ export function collectPreflight({
 /** Release-blocking: the app keeps no unexcepted copy of a RightKit-owned capability. */
 export function ownershipCheck(repoRoot, options = {}) {
   let checked;
-  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot, options.scope ?? null); }
+  const split = options.releaseSource?.mode === "snapshot" ? options.releaseSource : null;
+  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot, options.scope ?? null, ...(split ? [split] : [])); }
   catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
   const { result, evidence, floor } = checked;
+  // R4: evidence for another commit or tree than the selected one is refused whatever produced it (a factory that read HEAD, a stale one).
+  if (split && (evidence?.commit !== split.commit || (evidence?.tree !== undefined && evidence.tree !== split.tree))) {
+    return fail("ownership", `ownership evidence is for commit ${String(evidence?.commit ?? "(none)").slice(0, 12)}, not the selected commit ${split.commit.slice(0, 12)}`, "the door run builds the selected commit's snapshot; re-run the door for that commit");
+  }
   if (checked.ok) {
     const excepted = result.covered.length;
     const detail = excepted ? `no unapproved copies (${excepted} excepted findings)` : "no copies of RightKit-owned capabilities";

package/publish-cargo.mjs

@@ -397,9 +397,9 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
   if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
   if (reuseEvidence) {
-    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock", "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", `crates/${options.crate}/Cargo.toml`, `crates/${options.crate}/Cargo.lock`, "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
     // The gate config decides the steps replayed below, so an uncommitted edit would change what is demanded (0.4.1 review A3).
-    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean crate Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
     const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
     const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
     const command = `cargo package --locked -p ${options.crate}`;
@@ -480,7 +480,8 @@ export async function runCargoPublish(options, execute = (_command, args, settin
     // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
     const isReadOnlyInspection = ["package contents", "package location"].includes(step.label);
     const settings = {
-      cwd: options.workspaceRoot,
+      // Every crate is its own Cargo workspace with its own Cargo.lock and target directory (#1285): cargo runs in the crate directory.
+      cwd: crateDir,
       encoding: "utf8",
       windowsHide: true,
       stdio: step.capture || (options.offlineReadOnly === true && isReadOnlyInspection) ? "pipe" : "inherit",

package/recipe-build.mjs

@@ -51,7 +51,7 @@ export class RecipeBuildError extends Error {
 const fail = (code, message, details) => { throw new RecipeBuildError(code, message, details); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const STEP_KEYS = new Set(["phase", "cmd", "args", "cwd", "env"]);
-const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage", "verifySidecars", "nativeHelpers"]);
+const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage", "verifySidecars", "nativeHelpers", "boundTargets"]);
 const VERIFY_SIDECARS_KEYS = new Set(["receipt", "target"]);
 const NATIVE_HELPERS_KEYS = new Set(["app", "helpers", "version", "forceArch", "configuration"]);
 const UNIVERSAL_TRIPLE = "universal-apple-darwin";
@@ -65,10 +65,22 @@ const unknownKeys = (value, allowed, label, errors) => { for (const key of Objec
 const positiveInt = (value) => Number.isInteger(value) && value > 0;
 const badVolumePrefix = (item) => typeof item !== "string" || !item.trim() || item === "." || item === ".." || item.includes("/") || item.includes("\\") || item.includes(":") || item.includes("\0");
 
-/** A relative path that stays inside the app root; returns the normalized form or undefined and pushes an error. */
-function insideApp(value, label, errors, { strict = false } = {}) {
+/**
+ * A relative path that stays inside the app root; returns the normalized form or undefined and pushes an error.
+ * `bound` (a door split, row 7.04c R-T2): the absolute Cargo target directories the plan binds. A path strictly inside one of them is also
+ * accepted, absolute and without `..`: the snapshot has no target directory, so a split's build output is addressed there. Any other
+ * absolute path stays refused.
+ */
+function insideApp(value, label, errors, { strict = false, bound = [] } = {}) {
   if (typeof value !== "string" || !value.trim()) { errors.push(`${label} must be a non-empty relative path`); return undefined; }
   const normalized = value.replaceAll("\\", "/");
+  if (bound.length && (path.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value))) {
+    const parts = normalized.split("/");
+    const absolute = path.resolve(value);
+    const under = !parts.includes("..") && bound.some((dir) => { const relative = path.relative(dir, absolute); return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative); });
+    if (!under) { errors.push(`${label} is an absolute path outside every bound Cargo target (${bound.join(", ")}): ${value}`); return undefined; }
+    return normalized;
+  }
   if (path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.split("/").includes("..")) { errors.push(`${label} must be relative and stay inside the app: ${value}`); return undefined; }
   const resolved = path.posix.normalize(normalized);
   if (strict && (resolved === "." || resolved === "./" || resolved === "")) { errors.push(`${label} must name a path strictly inside the app, not the app root: ${JSON.stringify(value)}`); return undefined; }
@@ -76,21 +88,31 @@ function insideApp(value, label, errors, { strict = false } = {}) {
   return normalized;
 }
 
-function validateCleanup(value, errors) {
+/** `boundTargets`: the absolute Cargo target directories of a door split (row 7.04c). Absent outside a split. */
+function validateBoundTargets(value, errors) {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || !value.length || value.some((dir) => typeof dir !== "string" || !path.isAbsolute(dir) || dir.replaceAll("\\", "/").split("/").includes(".."))) {
+    errors.push("boundTargets must be a non-empty list of absolute directories without ..");
+    return undefined;
+  }
+  return value.map((dir) => path.resolve(dir));
+}
+
+function validateCleanup(value, errors, bound = []) {
   if (value === undefined) return undefined;
   if (!isObject(value)) { errors.push("cleanup must be an object"); return undefined; }
   unknownKeys(value, CLEANUP_KEYS, "cleanup", errors);
   const out = {};
   if (value.remove !== undefined) {
     if (!Array.isArray(value.remove)) errors.push("cleanup.remove must be a list of relative paths");
-    else out.remove = value.remove.map((item, index) => insideApp(item, `cleanup.remove[${index}]`, errors, { strict: true })).filter(Boolean);
+    else out.remove = value.remove.map((item, index) => insideApp(item, `cleanup.remove[${index}]`, errors, { strict: true, bound })).filter(Boolean);
   }
   if (value.apps !== undefined) {
     if (!isObject(value.apps)) errors.push("cleanup.apps must be an object");
     else {
       unknownKeys(value.apps, APPS_KEYS, "cleanup.apps", errors);
       for (const key of ["remove", "unregister"]) if (value.apps[key] !== undefined && typeof value.apps[key] !== "boolean") errors.push(`cleanup.apps.${key} must be a boolean`);
-      const dir = insideApp(value.apps.dir, "cleanup.apps.dir", errors, { strict: true });
+      const dir = insideApp(value.apps.dir, "cleanup.apps.dir", errors, { strict: true, bound });
       if (dir) out.apps = { dir, remove: value.apps.remove === true, unregister: value.apps.unregister === true };
     }
   }
@@ -101,13 +123,13 @@ function validateCleanup(value, errors) {
   return out;
 }
 
-function validateStability(value, errors) {
+function validateStability(value, errors, bound = []) {
   if (value === undefined) return undefined;
   if (!isObject(value)) { errors.push("stability must be an object"); return undefined; }
   unknownKeys(value, STABILITY_KEYS, "stability", errors);
   for (const key of ["intervalMs", "checks", "timeoutMs"]) if (value[key] !== undefined && !positiveInt(value[key])) errors.push(`stability.${key} must be a positive integer`);
   if (!Array.isArray(value.files) || !value.files.length) { errors.push("stability.files must be a non-empty list of relative paths"); return undefined; }
-  const files = value.files.map((item, index) => insideApp(item, `stability.files[${index}]`, errors, { strict: true })).filter(Boolean);
+  const files = value.files.map((item, index) => insideApp(item, `stability.files[${index}]`, errors, { strict: true, bound })).filter(Boolean);
   return { files, ...(value.intervalMs === undefined ? {} : { intervalMs: value.intervalMs }), ...(value.checks === undefined ? {} : { checks: value.checks }), ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }) };
 }
 
@@ -167,11 +189,11 @@ function validateVerifySidecars(value, errors) {
   return receipt ? { receipt, target: UNIVERSAL_TRIPLE } : undefined;
 }
 
-function validateNativeHelpersSection(value, errors) {
+function validateNativeHelpersSection(value, errors, bound = []) {
   if (value === undefined) return undefined;
   if (!isObject(value)) { errors.push("nativeHelpers must be { app, helpers, version?, forceArch?, configuration? }"); return undefined; }
   unknownKeys(value, NATIVE_HELPERS_KEYS, "nativeHelpers", errors);
-  const app = insideApp(value.app, "nativeHelpers.app", errors, { strict: true });
+  const app = insideApp(value.app, "nativeHelpers.app", errors, { strict: true, bound });
   if (app && !app.replace(/\/+$/, "").endsWith(".app")) errors.push("nativeHelpers.app must name the .app bundle");
   let helpers;
   try { helpers = validateNativeHelpers(value.helpers, { label: "nativeHelpers.helpers" }); } catch (error) { errors.push(...(error.details?.errors ?? [error.message])); }
@@ -208,13 +230,15 @@ export function validateRecipePlan(plan) {
     steps.push({ phase: step.phase, cmd: step.cmd, args: Array.isArray(args) ? [...args] : [], ...(cwd ? { cwd } : {}), ...(isObject(step.env) ? { env: { ...step.env } } : {}) });
   }
   if (builds !== 1) errors.push(`exactly one build step is required, found ${builds}`);
-  const cleanup = validateCleanup(plan.cleanup, errors);
-  const stability = validateStability(plan.stability, errors);
+  const boundTargets = validateBoundTargets(plan.boundTargets, errors);
+  const cleanup = validateCleanup(plan.cleanup, errors, boundTargets ?? []);
+  const stability = validateStability(plan.stability, errors, boundTargets ?? []);
   const stage = validateStage(plan.stage, errors);
   const verifySidecars = validateVerifySidecars(plan.verifySidecars, errors);
-  const nativeHelpers = validateNativeHelpersSection(plan.nativeHelpers, errors);
+  const nativeHelpers = validateNativeHelpersSection(plan.nativeHelpers, errors, boundTargets ?? []);
+  if (boundTargets && stage && (stage.pre?.length || stage.post?.length)) errors.push("a plan that binds Cargo targets (a door split) plans no stage copies: the build output is read and signed in place (rightkit#924 copies are zero)");
   if (errors.length) fail("RECIPE_BUILD_PLAN_INVALID", `invalid recipe plan:\n${errors.map((line) => `- ${line}`).join("\n")}`, { errors });
-  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
+  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(boundTargets ? { boundTargets } : {}), ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
 }
 
 /** This package's own right-release entry: the door's RightKit, whatever the app's node_modules holds. */