@rightkit/release 0.6.11 → 0.6.13

package/bin/rightkit-gate.mjs

@@ -1394,8 +1394,11 @@ async function runStages(o, args, root, git, io) {
   };
   const sealedNow = receipt.stages.package?.ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
   const sealedIntact = Boolean(sealedNow && sealedNow.id === receipt.stages.package.sealed && sealedNow.digest === receipt.stages.package.manifestSha256);
-  // Every deterministic rule and scan must run before compilation, for every door stage.
-  const earlyTier = "release";
+  // Every deterministic scan (full class A) runs before any compile, for every door stage. The app rules run at the tier the stage
+  // owes: dev, test and package take the compile-tier rules; qualify and release add the release-only rules (approvals, ratified
+  // rulings, notice digests), which are conditions for publishing, not for compiling (Adrian, 2026-10-30, rightkit#1296; the
+  // 2026-10-28 change to release tier everywhere was never his decision and blocked HeardRight's dev and test builds).
+  const earlyTier = ["qualify", "release"].includes(to) ? "release" : "compile";
   const tierAtLeast = (have, need) => have === "release" || need === "compile";
   for (const stage of stages) {
     if (stage === "check" && receipt.stages.check?.ok && tierAtLeast(receipt.stages.check.ruleTier ?? "compile", earlyTier)) { o.out(`${tag} [check] already passed (${receipt.stages.check.ruleTier ?? "compile"} tier) for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
@@ -2084,15 +2087,12 @@ export async function main(argv, io = {}) {
     }
     const requestedTier = option("--rule-tier") ?? "compile";
     if (!["compile", "release"].includes(requestedTier)) { o.err(`rightkit-gate: check --rule-tier must be compile or release, not ${JSON.stringify(requestedTier)}`); return 2; }
-    // Full admission cannot be downgraded by a caller's tier flag. Partial views retain their requested tier.
+    // Full admission runs every deterministic scan; its app rules run at the tier the stage owes (compile unless named): dev, test
+    // and package compile on the compile-tier rules, qualify and release name the release tier (rightkit#1296).
     const fullAdmission = args.includes("--full-a") && !args.includes("--list") && !args.includes("--print-baseline") && !args.includes("--only");
     const stripSnapshot = (list) => { const i = list.indexOf("--snapshot"); return i < 0 ? list : [...list.slice(0, i), ...list.slice(i + 2)]; };
     const appArgs = stripSnapshot(args.slice(1).filter((a) => a !== "--full-a"));
-    if (fullAdmission) {
-      const tierIndex = appArgs.indexOf("--rule-tier");
-      if (tierIndex >= 0) appArgs.splice(tierIndex, 2);
-      appArgs.push("--rule-tier", "release");
-    }
+    if (fullAdmission && !appArgs.includes("--rule-tier")) appArgs.push("--rule-tier", requestedTier);
     const appCheck = await (o.appCheck ?? (await import("../app-check.mjs")).main)(appArgs, { out: o.out, err: o.err, label: "check", cwd: o.cwd });
     if (args.includes("--list") || args.includes("--print-baseline") || args.includes("--only") || o.classA === false) {
       // A view of the app rules, never a class A verdict: say so, so no caller can take its exit 0 for a full check.
@@ -2107,8 +2107,8 @@ export async function main(argv, io = {}) {
     }
     const repoArg = option("--repo");
     const checkCwd = repoArg ? path.resolve(o.cwd, repoArg) : o.cwd;
-    // Admission uses the full tier; a partial diagnostic check may choose either tier.
-    const ruleTier = fullAdmission ? "release" : requestedTier;
+    // The app rules' tier is the stage's (rightkit#1296); class A's deterministic scans are the same at either tier.
+    const ruleTier = requestedTier;
     const classA = await main(["--class-a", "--rule-tier", ruleTier, ...(args.includes("--full-a") ? ["--full-a"] : []), ...(args.includes("--worktree") ? ["--worktree"] : ["--commit", snapshotCommit?.commit ?? option("--commit") ?? "HEAD"]), ...(snapshotDir ? ["--snapshot", snapshotDir] : [])], { ...io, cwd: checkCwd });
     // RightKit checking itself: its own rules (line endings, consumer recipes, npm surface, version copies and the version feed, dispatcher
     // pins, consumer locks, generated docs, temp paths: scripts/preflight.mjs) and its exports' import safety are class A for the RightKit repository.
@@ -2941,7 +2941,9 @@ export const callingGatePath = () => fs.realpathSync(fileURLToPath(import.meta.u
 if (invokedDirectly) {
   // Every child this run starts that can reach rustright (scans, unit stages, right-release dev/test, their builds) inherits it.
   process.env.RIGHTKIT_CALLING_GATE = callingGatePath();
-  // Production carries the RustRight snapshot carrier (`o.snapshotBroker`, item 7 rows 7.20 to 7.24): the door's seam for a broker host.
-  // The per-compile broker (pins, declared inputs, ownership, receipts) is built where the snapshot compile runs. Tests inject their own.
-  import("../snapshot-broker.mjs").then(({ PRODUCTION_SNAPSHOT_CARRIER }) => main(process.argv.slice(2), { snapshotBroker: PRODUCTION_SNAPSHOT_CARRIER })).then((code) => process.exit(code), (e) => { console.error(`rightkit-gate: ${e?.stack ?? e}`); process.exit(2); });
+  // Interim (decision 2): production carries no snapshot carrier until every child that reaches Cargo has one (item 7 row 7.24,
+  // right-release dev and test, is not wired). With it wired early, 0.6.12 refused every dev, test and sidecar package build on the
+  // Mac and the Dell (rightkit#1296, HeardRight 2026-10-30); without it they keep the checkout route, as in 0.6.10. Linux takes the
+  // snapshot route regardless (direct, no carrier). Tests inject a carrier. The cutover commit wires PRODUCTION_SNAPSHOT_CARRIER here.
+  Promise.resolve(main(process.argv.slice(2))).then((code) => process.exit(code), (e) => { console.error(`rightkit-gate: ${e?.stack ?? e}`); process.exit(2); });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -32,7 +32,7 @@
     "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.11",
+    "@rightkit/release": "0.6.13",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.3",
@@ -378,7 +378,9 @@
       "0.6.6",
       "0.6.7",
       "0.6.8",
-      "0.6.10"
+      "0.6.10",
+      "0.6.11",
+      "0.6.12"
     ],
     "@rightkit/settings-ui": [
       "0.1.0",
@@ -640,7 +642,7 @@
       "@rightkit/qa": "0.6.1",
       "@rightkit/qa-chrome": "0.1.12",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.6.10",
+      "@rightkit/release": "0.6.12",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",