@rightkit/release 0.6.12 → 0.6.14

package/deterministic-scans.mjs

@@ -31,8 +31,10 @@ import { cargoManifestState } from "./cargo-manifest-text.mjs";
 import { LAUNCH_GUARD_IMPORT } from "./class-a-launch-guard.mjs";
 import { advisoryCacheRoot, ensureAdvisoryDb, prepareDenyOverlay, readAdvisoryPin } from "./advisory-db.mjs";
 import { observedEnvOf, readRequestRef, verifySnapshotReceipt, writeSnapshotRequest } from "./snapshot-request.mjs";
-import { SCAN_TOKEN_ENV, readLedger, scanTokenOf, unclaimedLedgers } from "./cargo-ledger.mjs";
-import { verifyBrokerLedger } from "./snapshot-broker.mjs";
+import { SCAN_TOKEN_ENV, appendLedger, readLedger, scanTokenOf, unclaimedLedgers } from "./cargo-ledger.mjs";
+import { brokerSection, carryBrokerAdapter, verifyBrokerLedger } from "./snapshot-broker.mjs";
+import { CANCEL_WAIT_ENV, operationDeadlineEnv } from "./broker-wire.mjs";
+import { removeCarrier } from "./carrier-census.mjs";
 
 export const SCAN_RESULT_SCHEMA = "rightkit.deterministic-scans/1";
 /**
@@ -382,6 +384,7 @@ const GENERATOR_INPUT = /^(crates\/[^/]+\/(Cargo\.toml|README\.md)|packages\/[^/
 const PROBES = Object.freeze({
   rustfmt: ["--version"], node: ["--version"], rustright: ["cargo", "--version"], pnpm: ["--version"],
   actionlint: ["-version"], shellcheck: ["--version"], "right-git": ["--version"], swift: ["--version"],
+  "cargo-deny": ["--version"], "cargo-audit": ["audit", "--version"], // as cargo itself starts the subcommand binaries
 });
 /**
  * The one version of each analyzer whose verdict class A accepts. A class A finding must not depend on which build of the
@@ -423,6 +426,80 @@ export function pinnedVersionProblem(tool, version) {
   return `${tool} found ${version ? `"${version}"` : "with no readable version"}, class A requires ${tool} ${required} (PINNED_SCAN_TOOLS in @rightkit/release deterministic-scans.mjs); another version judges scripts differently, so it is refused, never passed or skipped`;
 }
 
+/**
+ * RA-18 / L9-03: the analyzers whose verdict class A accepts run only from an ENROLLED executable. The scan-tool policy is data the host
+ * owner enrols (ci/rk-pipeline.json `tools.<name>.<platform>`: an absolute `path`, the file's `sha256` and the `version`), handed to
+ * runScans as `options.toolPolicy` (scanToolPolicyFromPipeline reads it). A tool is resolved ONCE per run from that entry, never from PATH: the
+ * file's real path must be an executable regular file whose SHA-256 is the enrolled one, its `--version` must name the enrolled version, and the
+ * same digest is read again immediately before every scan that runs it. The path, digest and version are bound into the scan's evidence
+ * (`row.identities`, `result.toolIdentities`) and into its cache key. A tool with no enrolment is TOOL_UNTRUSTED, an enrolled file that
+ * is absent or not runnable is TOOL_MISSING, a file whose bytes are not the enrolled ones (at resolution or after the probe) is TOOL_REPLACED,
+ * another version is TOOL_VERSION: never a pass, never a skip, and a PATH stub that answers `--version` convincingly changes none of this.
+ * A scan the broker carries (a snapshot-broker host's cargo-deny / cargo-audit) runs the broker's own registered tool: its identity is the
+ * broker's tool registration (RustRight), recorded here as `source: "broker"` and never claimed as bound by the gate.
+ */
+export const TRUSTED_SCAN_TOOLS = Object.freeze(["actionlint", "shellcheck", "cargo-deny", "cargo-audit"]);
+const SHA256_HEX = /^[0-9a-f]{64}$/i;
+
+/** The scan-tool policy of a pipeline file's `tools` object for `platform`: `{ [tool]: { path, sha256, version } }` for each trusted tool that has a `<platform>` entry (shape unchecked here; resolveTrustedScanTool judges it). */
+export function scanToolPolicyFromPipeline(tools, platform = process.platform) {
+  const policy = {};
+  for (const name of TRUSTED_SCAN_TOOLS) {
+    const entry = tools && typeof tools === "object" && Object.hasOwn(tools, name) ? tools[name] : null;
+    const host = entry && typeof entry === "object" && Object.hasOwn(entry, platform) ? entry[platform] : null;
+    if (host && typeof host === "object") policy[name] = { path: host.path, sha256: host.sha256, version: host.version ?? entry.version };
+  }
+  return policy;
+}
+
+const sha256OfFile = (file) => {
+  const hash = crypto.createHash("sha256"); const fd = fs.openSync(file, "r");
+  try { const buffer = Buffer.alloc(1 << 20); for (let n = fs.readSync(fd, buffer, 0, buffer.length, null); n > 0; n = fs.readSync(fd, buffer, 0, buffer.length, null)) hash.update(buffer.subarray(0, n)); } finally { fs.closeSync(fd); }
+  return hash.digest("hex");
+};
+const DEFAULT_TOOL_OPS = Object.freeze({ realpath: (p) => fs.realpathSync.native(p), stat: (p) => fs.statSync(p), digestFile: sha256OfFile });
+
+/** `{ ok: true, identity: { tool, path, enrolledPath, sha256, version, source: "policy" } }` or `{ ok: false, code, why }` (TOOL_UNTRUSTED | TOOL_MISSING | TOOL_REPLACED). `ops` (realpath/stat/digestFile) is for tests of the judging only. */
+export function resolveTrustedScanTool(tool, { policy, platform = process.platform, ops } = {}) {
+  const o = { ...DEFAULT_TOOL_OPS, ...ops };
+  const where = `ci/rk-pipeline.json tools.${tool}.${platform}`;
+  const entry = policy && typeof policy === "object" && Object.hasOwn(policy, tool) ? policy[tool] : null;
+  const untrusted = (why) => ({ ok: false, code: "TOOL_UNTRUSTED", why: `${why}; a binary found on PATH is never trusted and an unenrolled scan tool is never passed (the host's scan-tool policy owner enrols it: ${where} with an absolute path, the file's sha256 and its version, handed to the gate as options.toolPolicy)` });
+  if (!entry || typeof entry !== "object") return untrusted(`${tool} is not enrolled in the scan-tool policy`);
+  const paths = platform === "win32" ? path.win32 : path.posix;
+  if (typeof entry.path !== "string" || !paths.isAbsolute(entry.path) || entry.path.split(/[\\/]/).includes("..") || entry.path.includes("\0")) return untrusted(`the ${tool} enrolment has no absolute path without '..'`);
+  if (typeof entry.sha256 !== "string" || !SHA256_HEX.test(entry.sha256)) return untrusted(`the ${tool} enrolment has no sha256`);
+  if (typeof entry.version !== "string" || !entry.version.trim()) return untrusted(`the ${tool} enrolment has no version`);
+  let real; let meta;
+  try { real = o.realpath(entry.path); meta = o.stat(real); } catch (e) { return { ok: false, code: "TOOL_MISSING", why: `the enrolled ${tool} ${entry.path} cannot be resolved (${e.code ?? e.message})` }; }
+  if (!meta.isFile?.()) return { ok: false, code: "TOOL_MISSING", why: `the enrolled ${tool} ${real} is not a regular file` };
+  if (platform !== "win32" && (meta.mode & 0o111) === 0) return { ok: false, code: "TOOL_MISSING", why: `the enrolled ${tool} ${real} is not executable` };
+  let digest;
+  try { digest = o.digestFile(real); } catch (e) { return { ok: false, code: "TOOL_MISSING", why: `the enrolled ${tool} ${real} cannot be read for its identity (${e.code ?? e.message})` }; }
+  if (digest !== entry.sha256.toLowerCase()) return { ok: false, code: "TOOL_REPLACED", why: `the ${tool} at ${real} has digest ${digest}, not the enrolled ${entry.sha256.toLowerCase()}` };
+  return { ok: true, identity: Object.freeze({ tool, path: real, enrolledPath: entry.path, sha256: digest, version: entry.version.trim(), source: "policy" }) };
+}
+
+/** null while the executable still is the one resolved (same real path, same digest), else `{ code: "TOOL_REPLACED", detail }`: read again immediately before a scan runs it. */
+export function trustedScanToolProblem(identity, { ops } = {}) {
+  const o = { ...DEFAULT_TOOL_OPS, ...ops };
+  try {
+    const real = o.realpath(identity.enrolledPath);
+    if (real !== identity.path) return { code: "TOOL_REPLACED", detail: `${identity.tool}: ${identity.enrolledPath} now resolves to ${real}, not the ${identity.path} that was verified` };
+    const digest = o.digestFile(real);
+    if (digest !== identity.sha256) return { code: "TOOL_REPLACED", detail: `${identity.tool}: ${real} was replaced after it was verified (digest ${digest}, verified ${identity.sha256})` };
+  } catch (e) { return { code: "TOOL_REPLACED", detail: `${identity.tool}: ${identity.path} can no longer be verified (${e.code ?? e.message})` }; }
+  return null;
+}
+
+/** null when the probe's answer names the enrolled version (a whole token of its first line, a leading `v` ignored), else the problem. */
+export function enrolledVersionProblem(identity, probeText) {
+  const bare = (text) => String(text).trim().replace(/^v(?=\d)/i, "");
+  const line = String(probeText ?? "").split(/\r?\n/).find((l) => l.trim()) ?? "";
+  if (line.split(/\s+/).some((token) => bare(token) === bare(identity.version))) return null;
+  return `${identity.tool} at ${identity.path} answers ${line.trim() ? `"${line.trim().slice(0, 120)}"` : "with no readable version"}, the enrolment names ${identity.version}`;
+}
+
 function commandText(d) {
   if (d.internal) return `internal:${d.internal}`;
   const env = Object.keys(d.env ?? {}).sort().map((k) => `${k}=${d.env[k]} `).join("");
@@ -766,9 +843,11 @@ export function planScans({
   // Which scans this plan owes (Adrian, 2026-10-26; app-check.mjs TIERS): "compile" leaves out the scans added after @rightkit/release
   // 0.6.6 (shellcheck, and actionlint's shellcheck requirement) until every app builds through the door again; "release" plans everything.
   tier = "compile",
-  // A broker host (rustright): cargo scans run in this primary checkout instead of the content root, because the RustRight client refuses
-  // every cargo command but a locked metadata outside the app's primary checkout (RK_NOT_PRIMARY_CHECKOUT). The gate sets it only after
-  // proving the checkout's Cargo inputs are blob-identical to the snapshot's (cargoInputsDiffer); null keeps the content/live roots.
+  // A broker host (rustright): the primary checkout's directory. The RustRight client refuses to start anywhere that is not a Cargo workspace
+  // of the app's primary checkout (RK_NOT_PRIMARY_CHECKOUT), so (a) every CLASS B cargo scan (a compile the snapshot carrier admits) is
+  // started from here, naming the snapshot as its source, and (b) the client's version probe runs here. CLASS A cargo scans (metadata,
+  // package list, cargo-deny, cargo-audit) never read the checkout: they keep the content root (the snapshot) and run there as carried
+  // read-only requests (snapshot-metadata.mjs), so an uncommitted edit in the checkout cannot reach them. null on a direct host.
   cargoLiveRoot = null,
   // { [cargoDir]: absolute directory }: the checkout's resolved target directory per Cargo workspace, set as CARGO_TARGET_DIR on
   // that workspace's cargo scans when the scans read a snapshot (the door's commit compile, joint plan step 4c).
@@ -856,7 +935,7 @@ export function planScans({
   const under = (prefix) => files.filter((f) => f.startsWith(prefix));
   if (!["compile", "release"].includes(tier)) throw new Error(`planScans: tier must be compile or release, not ${JSON.stringify(tier)}`);
   let scans = []; const notes = [];
-  if (cargoLiveRoot) notes.push(`broker host: cargo scans run in the primary checkout ${cargoLiveRoot}, whose Cargo inputs match the checked snapshot (rustright refuses cargo outside the primary checkout)`);
+  if (cargoLiveRoot) notes.push(`broker host: class A cargo scans run in the snapshot as carried read-only requests, class B compiles are carried requests started from the primary checkout ${cargoLiveRoot} (uncommitted edits there never reach a scan)`);
   // A snapshot compile's scans carry its target map (item 7): the map is part of every scan's cache key, so no result cached by a
   // live-checkout run (or a compile with another map) is taken for one that writes to these directories.
   const snapshotTargets = targetDirs ? { RK_SNAPSHOT_TARGETS: canonicalJson(targetDirs) } : {};
@@ -880,7 +959,13 @@ export function planScans({
   const plainDir = (d) => !ABSOLUTE_PATH.test(d) && !d.split("/").includes("..") && SAFE_UNIT_DIR.test(d);
   const cargoWs = cleanDir(cargoDir);
   if (!plainDir(cargoWs)) throw new TypeError("planScans: cargoDir must be a plain repository-relative directory");
-  const cargoIn = (ws, ...args) => ({ tool: cargoCommand[0], args: [...cargoCommand.slice(1), ...everyFailure(args)], ...(ws !== "." ? { cwd: ws } : {}), ...(cargoLiveRoot ? { root: "cargoLive" } : {}), ...(targetDirs?.[ws] ? { env: { CARGO_TARGET_DIR: targetDirs[ws] } } : {}) });
+  const cargoBase = (ws, args) => ({ tool: cargoCommand[0], args: [...cargoCommand.slice(1), ...everyFailure(args)], ...(ws !== "." ? { cwd: ws } : {}), ...(targetDirs?.[ws] ? { env: { CARGO_TARGET_DIR: targetDirs[ws] } } : {}) });
+  // Class B (compiles): started from the primary checkout on a broker host, the snapshot carrier names the source.
+  const cargoIn = (ws, ...args) => ({ ...cargoBase(ws, args), ...(cargoLiveRoot ? { root: "cargoLive" } : {}) });
+  // Class A (reads Cargo inputs, compiles nothing): always the content root, the snapshot or the commit's own tree. These still execute
+  // cargo (through the broker on a broker host), so a unit-scoped check follows the Rust closure for them (app-closure.mjs scopeScans reads
+  // the ids `cargo-metadata|cargo-deny|cargo-audit[:<label>]` and `cargo-package-list:<unit>` and the scan's `cwd`; rename one there too).
+  const cargoReadIn = (ws, ...args) => cargoBase(ws, args);
   const unitMap = (units, kind) => {
     if (units === null) return null;
     if (!Array.isArray(units)) throw new TypeError(`planScans: ${kind}Units must be an array of { name, dir }`);
@@ -1079,14 +1164,16 @@ export function planScans({
   const actionlintConfig = exists(path.join(contentRoot, ".github/actionlint.yaml")) ? ["-config-file", ".github/actionlint.yaml"] : [];
   // actionlint lints every run: script with shellcheck only when shellcheck is found, and otherwise passes silently; class A
   // requires it (`requires`), so a host without it fails the scan instead of skipping the shell checks.
-  if (workflowFiles.length) add({ id: "actionlint", class: A, tool: "actionlint", requires: tier === "release" ? ["shellcheck"] : [], args: [...actionlintConfig, ...workflowFiles], root: "content", runScriptLimit: { files: workflowFiles, bytes: RUN_SCRIPT_LIMIT_BYTES } });
+  if (workflowFiles.length) add({ id: "actionlint", class: A, tool: "actionlint", requires: ["shellcheck"], args: [...actionlintConfig, ...workflowFiles], root: "content", runScriptLimit: { files: workflowFiles, bytes: RUN_SCRIPT_LIMIT_BYTES } });
   // Standalone shell scripts (SellRight's deploy scripts failed SC2154, SC2030/2031 and SC2016 in CI): every tracked .sh/.bash file,
   // with ShellCheck's own defaults and the repository's .shellcheckrc (data, not code). actionlint covers only workflow run: blocks.
   // A script whose shebang names another shell (zsh, fish) is not ShellCheck's to judge, so it is left out, never failed.
   const otherShell = (f) => { try { return /^#!.*\b(zsh|fish|pwsh|powershell)\b/.test(String(readFile(path.join(contentRoot, f))).split("\n", 1)[0]); } catch { return false; } };
   const shellFiles = files.filter((f) => /\.(sh|bash)$/.test(f) && !/(^|\/)node_modules\//.test(f) && !otherShell(f)).sort();
-  if (shellFiles.length && tier !== "release") notes.push("compile tier: shellcheck (added after 0.6.6) is not planned; it runs in the release tier (--to qualify|release)");
-  if (shellFiles.length && tier === "release") add({ id: "shellcheck", class: A, tool: "shellcheck", tier: "release", args: ["--format=gcc", "--external-sources", ...shellFiles], root: "content" });
+  // GB-83 (GATE rule-tier correction, E1/E17, B1/B14): the deterministic scan inventory does not depend on the app-rule tier. Only the app's
+  // release rules (approvals, ratified rulings, notice digests) are deferred at the compile tier; every approved Class A scan, shellcheck
+  // and the locked package listing included, is planned for dev, test, package, qualify and release alike.
+  if (shellFiles.length) add({ id: "shellcheck", class: A, tool: "shellcheck", args: ["--format=gcc", "--external-sources", ...shellFiles], root: "content" });
   // No right-git drift scan: the one workflow right-git renders here, ci.yml, is hand-owned (its header;
   // docs/CI.md) and held by scripts/ci/ci-scans-contract.mjs instead, so drift is always reported by design.
 
@@ -1118,18 +1205,18 @@ export function planScans({
     else notes.push("suite-api: RightKit's own generator contract runs from the in-tree gate and CI, not from this installed copy");
   }
   if (rustTouched) {
-    for (const ws of touchedWs) add({ id: `cargo-metadata${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, ...metadataArgs()) });
+    for (const ws of touchedWs) add({ id: `cargo-metadata${wsIdSuffix(ws)}`, class: A, ...cargoReadIn(ws, ...metadataArgs()) });
     // Locked package listings are observations in RustRight (#1216). They run through the selected executor
     // from the checked Cargo inputs, just like metadata; an executor refusal remains a failed scan.
-    if (tier === "release") for (const name of crateNames.filter((n) => rustMap?.get(n).publish !== false)) add({ id: rustScanId.packageList(name), class: A, tier: "release", ...cargoIn(wsOf(name), "package", "-p", crateOf(name), "--list", "--allow-dirty", "--locked") });
+    for (const name of crateNames.filter((n) => rustMap?.get(n).publish !== false)) add({ id: rustScanId.packageList(name), class: A, ...cargoReadIn(wsOf(name), "package", "-p", crateOf(name), "--list", "--allow-dirty", "--locked") });
   }
   for (const ws of [...configWs].sort()) {
     // Offline against the pinned database. The pin commit is part of the command (env), so a pin change is a different scan, and the
     // placeholders are filled at run time from the materialised checkout (runScans).
     const pin = advisoryPin ?? (advisoryPin = readAdvisoryPin());
     const pinEnv = { RK_ADVISORY_DB_COMMIT: pin.commit };
-    add({ id: `cargo-deny${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "deny", "--frozen", "--metadata-path", "{advisoryMetadata}", "--config", "{advisoryDenyConfig}", "check"), env: pinEnv, advisoryDb: "deny", advisoryPin: pin });
-    add({ id: `cargo-audit${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "audit", "--db", "{advisoryDb}", "--no-fetch"), env: pinEnv, advisoryDb: "audit", advisoryPin: pin });
+    add({ id: `cargo-deny${wsIdSuffix(ws)}`, class: A, ...cargoReadIn(ws, "deny", "--frozen", "--metadata-path", "{advisoryMetadata}", "--config", "{advisoryDenyConfig}", "check"), env: pinEnv, advisoryDb: "deny", advisoryPin: pin });
+    add({ id: `cargo-audit${wsIdSuffix(ws)}`, class: A, ...cargoReadIn(ws, "audit", "--db", "{advisoryDb}", "--no-fetch"), env: pinEnv, advisoryDb: "audit", advisoryPin: pin });
   }
   // The audit policy is the consumer's own: every package.json script that is exactly `pnpm audit <flags>` (only --prod, --dev,
   // --audit-level <low|moderate|high|critical> are accepted) declares one, and the scan runs the strictest of them all: a dependency
@@ -1669,13 +1756,29 @@ export function laneOf(scan) {
 // The lines a reader needs from a failed scan: every line that names a failure (a failed test, a panic, a compiler or tool error,
 // cargo test's `failures:` block header, pnpm's ERR_ codes), at most twelve of them, then the last four lines of stdout and of
 // stderr. cargo test writes results to stdout and "Running ..." to stderr, so a plain tail showed only harness chatter.
-const FAILURE_LINE = /(^|[\s\[])(FAILED|panicked at|error(\[E\d+\])?:|error\[|^failures:|ERR_PNPM_\w+|Error:|assertion `?left|^thread '.*' panicked)/;
+const FAILURE_LINE = /(^|[\s\[])(FAILED|panicked at|error(\[E\d+\])?:|error\[|^failures:|ERR_PNPM_\w+|Error:|assertion `?left|^thread '.*' panicked)|^\[ERROR\]|^\w+Error:|error \(E[A-Z]+\)/;
 export function failureDetail(r) {
   const lines = (text) => String(text ?? "").split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim());
   const out = lines(r?.stdout); const err = lines(r?.stderr);
   const named = [...out, ...err].filter((l) => FAILURE_LINE.test(l)).slice(0, 12);
   const ends = [...out.slice(-4), ...err.slice(-4)];
-  return [...new Set([...named, ...ends])].join(" | ");
+  // `cargo audit` / `cargo deny` without the cargo-audit / cargo-deny binary: cargo's own "no such command" text told a reader to
+  // search crates.io; the scan's tool is required and missing, which is what actionlint's row already says (E2E L9-02).
+  const missing = [...out, ...err].map((l) => l.match(/^error: no such command: `(audit|deny)`/)?.[1]).find(Boolean);
+  const lead = missing ? [`required tool cargo-${missing} is missing or not runnable (cargo has no \`${missing}\` subcommand); a required scan is never skipped`] : [];
+  return [...new Set([...lead, ...auditVulnerabilities(r?.stdout), ...named, ...ends])].join(" | ");
+}
+// cargo-audit prints one `Crate:/Version:/.../ID:` block per advisory: a vulnerability has no `Warning:` line, an unmaintained or unsound
+// crate has one and does not fail the scan. The failing blocks lead the detail (E2E L9-01); a tail of the output alone named a warning.
+function auditVulnerabilities(text) {
+  const out = [];
+  for (const block of String(text ?? "").split(/\r?\n[ \t]*\r?\n/)) {
+    const m = block.match(/^Crate:[ \t]+(\S+)[ \t]*\r?\nVersion:[ \t]+(\S+)/m);
+    if (!m || /^Warning:/m.test(block)) continue;
+    const id = block.match(/^ID:[ \t]+(\S+)/m)?.[1];
+    out.push(`vulnerable: ${m[1]} ${m[2]}${id ? ` ${id}` : ""}`);
+  }
+  return out.slice(0, 6);
 }
 const tail = failureDetail;
 
@@ -1894,10 +1997,55 @@ const INTERNAL = {
   },
 };
 
+/**
+ * SwiftPM's build directory for one Swift package scan: `<tmpRoot>/rightkit-swift-scratch/<sha256(repository root)[:16]>/<scan id>`, outside every root
+ * the scan reads (the commit snapshot, the checkout), the same path every run (so the build stays warm). Throws when it would land inside one of them.
+ */
+/**
+ * GB-52: a carried scan's client gets an operation deadline BEFORE the scan's own limit, so the client cancels the job by id and watches its terminal state (within a 15 s cancel wait)
+ * instead of being killed with the job still running; a user-set RUSTRIGHT_OPERATION_DEADLINE_MS or cancel wait is never replaced.
+ */
+export function scanOperationEnv(env, limitMs) {
+  const deadline = operationDeadlineEnv({ env, deadlineMs: Math.max(Math.floor(limitMs / 2), limitMs - 20_000) });
+  if (Object.keys(deadline).length === 0) return {};
+  return { ...deadline, ...(Object.keys(env ?? {}).some((k) => k.toUpperCase() === CANCEL_WAIT_ENV) ? {} : { [CANCEL_WAIT_ENV]: "15000" }) };
+}
+
+export function swiftScratchPath({ tmpRoot, roots, id }) {
+  const real = (p) => { try { return fs.realpathSync.native(p); } catch { return path.resolve(p); } };
+  const repo = real(roots.find(Boolean));
+  const dir = path.join(real(tmpRoot), "rightkit-swift-scratch", crypto.createHash("sha256").update(repo).digest("hex").slice(0, 16), id.replace(/[^A-Za-z0-9._-]/g, "_"));
+  for (const root of roots.filter(Boolean)) {
+    const rel = path.relative(real(root), dir);
+    if (rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel))) throw new Error(`the SwiftPM build directory ${dir} would be inside ${real(root)}; set RK_GATE_TMPDIR outside the repository`);
+  }
+  return dir;
+}
+
+/**
+ * The output directory of ONE Class A Cargo scan that runs natively (no broker carries it): a fresh directory under `tmpRoot`, outside every
+ * root the scan reads (the commit snapshot, the checkout). Cargo writes `target/.rustc_info.json` (and CACHEDIR.TAG) beside the manifest it
+ * reads, so a scan run with no CARGO_TARGET_DIR leaves a `target/` in the snapshot, which must stay exactly the commit's tree (E6). The caller
+ * removes the directory when the scan ends. Throws, removing it, when it would land inside one of `roots`.
+ */
+export function cargoReadTargetDir({ tmpRoot, roots }) {
+  const real = (p) => { try { return fs.realpathSync.native(p); } catch { return path.resolve(p); } };
+  const dir = real(fs.mkdtempSync(path.join(real(tmpRoot), "rk-cargo-read-")));
+  for (const root of roots.filter(Boolean)) {
+    const rel = path.relative(real(root), dir);
+    if (rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel))) {
+      fs.rmSync(dir, { recursive: true, force: true });
+      throw new Error(`the Cargo output directory ${dir} would be inside ${real(root)}; set RK_GATE_TMPDIR outside the repository`);
+    }
+  }
+  return dir;
+}
+
 /**
  * Run a plan. Options: classes (default ["A","B"]), exclude(scan) => boolean (an explicit, recorded
  * omission such as a caller that runs its own tests), plus the injectable spawn/exists/readFile/readdir/env.
  * Class B runs only when every selected class A scan passed; otherwise each B scan is "not-run".
+ * `cargoReadTargetRoot` (default `tmpRoot`) is where a natively run Class A Cargo scan's own output directory is made (cargoReadTargetDir).
  */
 export async function runScans(plan, options = {}) {
   const deps = {
@@ -1914,11 +2062,15 @@ export async function runScans(plan, options = {}) {
   // An AbortSignal: once aborted, no further scan starts, running children are killed (process tree) and every unfinished scan is "not-run" with code CANCELLED.
   const signal = options.signal; const sig = signal ? { signal } : {};
   const { contentRoot, liveRoot, cargoLiveRoot = null } = plan.roots;
+  // Where the gate's own temporary files live (cargo-deny's metadata file and config overlay): a directory the gate owns, never inside the
+  // checkout or the snapshot; the broker reads them by absolute path (options.tmpRoot, else the system temp directory).
+  const tmpRoot = options.tmpRoot ?? os.tmpdir();
   const rootDir = (r) => (r === "content" ? contentRoot : r === "parent" ? path.dirname(contentRoot) : r === "cargoLive" ? (cargoLiveRoot ?? liveRoot) : liveRoot);
   const selected = plan.scans.filter((s) => classes.includes(s.class) && !exclude(s));
   const ordered = [...selected.filter((s) => s.class === SCAN_CLASS.A), ...selected.filter((s) => s.class === SCAN_CLASS.B)];
   const ctx = { deps, contentRoot, read: (f) => deps.readFile(path.join(contentRoot, f)) };
-  const toolVersions = {}; const probed = new Map(); const advisoryDbs = new Map();
+  const cargoReadsAreCarried = Boolean(deps.snapshotBroker) || options.cargoReadsCarried === true;
+  const toolVersions = {}; const toolIdentities = {}; const probed = new Map(); const advisoryDbs = new Map();
   const results = [];
   // The gate-owned cargo ledger of a wrapped snapshot compile (options.cargoLedger = { dir }): every call the wrapper decided, filed
   // under its scan's token. `ledgerSeen` is the run's one-use record of carriers and request ids across every scan.
@@ -1951,8 +2103,11 @@ export async function runScans(plan, options = {}) {
   async function probe(tool, scanDir = null) {
     if (probed.has(tool)) return probed.get(tool);
     let outcome;
-    const command = toolCommand(tool);
-    if (!command) outcome = { ok: false, why: "not found" };
+    // A trusted analyzer is resolved ONCE, from its enrolment (never PATH), and its bytes verified before this probe runs it.
+    const trust = TRUSTED_SCAN_TOOLS.includes(tool) ? resolveTrustedScanTool(tool, { policy: options.toolPolicy, platform: deps.platform, ops: options.toolOps }) : null;
+    const command = trust ? (trust.ok ? trust.identity.path : null) : toolCommand(tool);
+    if (trust && !trust.ok) outcome = { ok: false, code: trust.code, why: trust.why };
+    else if (!command) outcome = { ok: false, why: "not found" };
     else {
       // A version probe never runs inside the repository: a tool started there reads the repository's own configuration first
       // (pnpm's .npmrc and pnpmfile, corepack's packageManager pin, cargo's .cargo/config), before any scan's protections apply.
@@ -1973,7 +2128,9 @@ export async function runScans(plan, options = {}) {
       else {
         const text = String(r.stdout || r.stderr || "");
         const version = PROBE_VERSION[tool] ? PROBE_VERSION[tool](text) : text.split(/\r?\n/).find((l) => l.trim())?.trim() ?? "unknown";
-        outcome = { ok: true, command, version: version ?? "unknown", pinProblem: pinnedVersionProblem(tool, version) };
+        const identity = trust?.identity ?? null;
+        outcome = { ok: true, command, version: version ?? "unknown", pinProblem: pinnedVersionProblem(tool, version) ?? (identity ? enrolledVersionProblem(identity, version ?? text) : null), ...(identity ? { identity } : {}) };
+        if (identity) toolIdentities[tool] = { ...identity, probed: version ?? "unknown" };
       }
     }
     toolVersions[tool] = outcome.ok ? outcome.version : null;
@@ -2114,12 +2271,17 @@ export async function runScans(plan, options = {}) {
       // which allows no licence at all.
       denyToml = deps.defaultDenyToml ?? fs.readFileSync(new URL("./deny-default.toml", import.meta.url), "utf8");
     }
-    const overlay = prepare({ denyToml, dbDir: db.dir, pin: s.advisoryPin });
+    const overlay = prepare({ denyToml, dbDir: db.dir, pin: s.advisoryPin, tmpRoot });
     return { dbDir: db.dir, configPath: overlay.configPath, cleanup: overlay.cleanup };
   }
 
   // `extraEnv` (the quiet lease id) reaches the child but never the cache key: a lease changes nothing a scan proves.
   async function scanRow(s, extraEnv = null) {
+    // What one scan makes outside the plan and must remove when it ends: a Class A Cargo scan's output directory (cargoReadTargetDir).
+    const owned = { cargoReadTarget: null };
+    try { return await scanRowIn(s, extraEnv, owned); } finally { if (owned.cargoReadTarget) fs.rmSync(owned.cargoReadTarget, { recursive: true, force: true }); }
+  }
+  async function scanRowIn(s, extraEnv, owned) {
     const row = { id: s.id, class: s.class, command: s.command, tool: s.tool ?? null, toolVersion: null, status: "fail" };
     if (s.class === SCAN_CLASS.B && classBBlocked) {
       return { ...row, status: "not-run", code: "CLASS_A_REQUIRED", detail: "class B refused: class A did not run in this call and no valid prior class A evidence for the same scan set was supplied" };
@@ -2140,17 +2302,35 @@ export async function runScans(plan, options = {}) {
         else if (out.length) { status = "fail"; detail = out.join("; "); }
       } else {
         const scanDir = path.join(rootDir(s.root), s.cwd ?? "");
-        const p = await probe(s.tool, scanDir);
+        // The RustRight client's version probe starts in a Cargo workspace of the primary checkout; a class A cargo scan's own directory is
+        // in the snapshot, so its probe uses the checkout's counterpart (reading no file of it), or the checkout when it has none.
+        let probeAt = scanDir;
+        if (cargoLiveRoot && s.root !== "cargoLive" && (s.tool === "rustright" || s.tool === "cargo")) {
+          const counterpart = path.join(cargoLiveRoot, s.cwd ?? "");
+          let isDir = false; try { isDir = fs.statSync(counterpart).isDirectory(); } catch { isDir = false; }
+          probeAt = isDir ? counterpart : cargoLiveRoot;
+        }
+        const p = await probe(s.tool, probeAt);
         row.toolVersion = p.ok ? p.version : null;
-        let missingDep = null; let depVersionProblem = null; const depVersions = [];
-        for (const dep of s.requires ?? []) {
+        // The broker runs the cargo-deny / cargo-audit a carried scan names: that identity is the broker's tool registration, not the gate's to bind.
+        // `options.cargoReadsCarried === true` (the gate, when its executor is the broker and cargo reads go through carried requests, as in the check stage that has no snapshotBroker) makes them carried exactly as snapshotBroker does; it waives nothing else (actionlint and shellcheck stay locally enrolled).
+        const brokerCarried = cargoReadsAreCarried && s.class === SCAN_CLASS.A && (s.tool === "rustright" || s.tool === "cargo");
+        const advisoryTool = s.advisoryDb === "deny" ? "cargo-deny" : s.advisoryDb === "audit" ? "cargo-audit" : null;
+        const trusts = advisoryTool && !brokerCarried ? [advisoryTool] : [];
+        const identities = []; if (p.identity) identities.push(p.identity);
+        let missingDep = null; let depVersionProblem = null; let depTrust = null; const depVersions = [];
+        for (const dep of [...(s.requires ?? []), ...trusts]) {
           const d = await probe(dep, scanDir);
-          if (!d.ok) { missingDep = `${dep} (${d.why})`; break; }
+          if (!d.ok) { if (d.code && d.code !== "TOOL_MISSING") depTrust = { code: d.code, why: d.why, dep }; else missingDep = `${dep} (${d.why})`; break; }
           if (d.pinProblem) { depVersionProblem = d.pinProblem; break; }
-          depVersions.push(d.version);
+          depVersions.push(d.identity ? `${d.version}@${d.identity.sha256}` : d.version);
+          if (d.identity) identities.push(d.identity);
         }
-        if (!p.ok) { status = "fail"; code = "TOOL_MISSING"; detail = `required tool ${s.tool} is missing or not runnable (${p.why}); a required scan is never skipped`; }
+        if (advisoryTool && brokerCarried) row.identities = [{ tool: advisoryTool, source: "broker", note: "the broker runs its own registered tool; its identity is the broker's tool registration, not bound by the gate" }];
+        else if (identities.length) row.identities = identities.map((i) => ({ tool: i.tool, path: i.path, sha256: i.sha256, version: i.version, source: i.source }));
+        if (!p.ok) { status = "fail"; code = p.code ?? "TOOL_MISSING"; detail = p.code && p.code !== "TOOL_MISSING" ? `${p.code}: ${p.why}` : `required tool ${s.tool} is missing or not runnable (${p.why}); a required scan is never skipped`; }
         else if (p.pinProblem) { status = "fail"; code = "TOOL_VERSION"; detail = `TOOL_VERSION: ${p.pinProblem} (at ${p.command})`; }
+        else if (depTrust) { status = "fail"; code = depTrust.code; detail = `${depTrust.code}: ${s.tool} needs ${depTrust.dep}: ${depTrust.why}`; }
         else if (missingDep) { status = "fail"; code = "TOOL_MISSING"; detail = `${s.tool} needs ${missingDep}, which is missing or not runnable; without it the scan would pass unchecked, so it fails`; }
         else if (depVersionProblem) { status = "fail"; code = "TOOL_VERSION"; detail = `TOOL_VERSION: ${s.tool} runs ${depVersionProblem}`; }
         else {
@@ -2158,11 +2338,12 @@ export async function runScans(plan, options = {}) {
           // A cargo request that builds the commit snapshot through the broker (options.snapshotBroker) is never served from or written
           // to the scan cache: each run must carry its own request and verify the broker's own signed evidence.
           const viaSnapshotBroker = Boolean(deps.snapshotBroker) && s.root === "cargoLive" && (s.tool === "rustright" || s.tool === "cargo");
-          if (cache && !viaSnapshotBroker) {
+          const carriedRead = cargoReadsAreCarried && s.class === SCAN_CLASS.A && (s.tool === "rustright" || s.tool === "cargo"); // a snapshot compile never reuses a cargo read either
+          if (cache && !viaSnapshotBroker && !carriedRead) {
             try {
               const digest = cache.digest(s);
               // The analyzers a scan runs through (actionlint's shellcheck) judge it too, so their versions key it as well.
-              const toolVersion = [p.version, ...depVersions].join(" + ");
+              const toolVersion = [p.identity ? `${p.version}@${p.identity.sha256}` : p.version, ...depVersions].join(" + ");
               if (digest) cacheKey = scanCacheKey({ id: s.id, command: s.command, toolVersion, env: s.env ?? {}, inheritedEnv: inheritedEnvDigest({ ...deps.env, ...s.env }), digest });
             } catch { cacheKey = null; }
             const hit = cacheKey ? cache.read(cacheKey) : null;
@@ -2174,6 +2355,22 @@ export async function runScans(plan, options = {}) {
               return { ...row, status: "pass", cached: true, detail: `cached ${String(hit.at ?? "").slice(0, 10) || "earlier"}`, ...(s.kind === "test" ? { results: hit.row.results } : {}) };
             }
           }
+          // Every cargo call the wrapper decides during this scan is filed under this token in the gate's ledger: the scan's own call AND the
+          // calls the scan itself makes before it (the cargo-deny row's prefetch and its full metadata), so none is filed "unscoped" and fails the run.
+          const ledgerToken = cargoLedger ? scanTokenOf(s.id) : null;
+          if (ledgerToken) claimedTokens.add(ledgerToken);
+          const ledgerEnv = ledgerToken ? { [SCAN_TOKEN_ENV]: ledgerToken } : {};
+          // A Class A Cargo scan that runs here, not through the broker, never writes into the tree it reads: cargo puts target/.rustc_info.json
+          // beside the manifest, and the snapshot must stay exactly the commit's tree after class A. It gets an output directory of its own
+          // outside every root, removed when the scan ends (scanRow). Left alone: a scan that names its own CARGO_TARGET_DIR (a compile's
+          // checkout-pinned output), a wrapped snapshot compile (the wrapper binds every cargo call; the sentinel asserts none escapes), a
+          // carried read (the broker owns the output and a carried child gets no CARGO_TARGET_DIR) and the broker client itself.
+          let readTargetEnv = {};
+          if (s.class === SCAN_CLASS.A && s.tool === "cargo" && !cargoReadsAreCarried && !cargoLedger && !options.cargoSentinel && !Object.hasOwn(s.env ?? {}, "CARGO_TARGET_DIR")) {
+            try { owned.cargoReadTarget = cargoReadTargetDir({ tmpRoot: options.cargoReadTargetRoot ?? tmpRoot, roots: [contentRoot, liveRoot, cargoLiveRoot] }); }
+            catch (e) { return { ...row, status: "fail", code: "CARGO_READ_TARGET", detail: `${s.id}: ${e.message}` }; }
+            readTargetEnv = { CARGO_TARGET_DIR: owned.cargoReadTarget };
+          }
           let advisory = null; let args = s.args;
           if (s.advisoryDb) {
             try { advisory = prepareAdvisory(s); } catch (e) { return { ...row, status: "fail", code: "ADVISORY_DB", detail: e.message }; }
@@ -2192,16 +2389,16 @@ export async function runScans(plan, options = {}) {
               const fetchTimer = new AbortController();
               const fetchClock = setTimeout(() => fetchTimer.abort(), fetchLimit);
               let fetched;
-              try { fetched = await deps.spawn(p.command, [...args.slice(0, at), "fetch", "--locked"], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env }, signal: signal ? AbortSignal.any([signal, fetchTimer.signal]) : fetchTimer.signal, timeout: fetchLimit }); } finally { clearTimeout(fetchClock); }
+              try { fetched = await deps.spawn(p.command, [...args.slice(0, at), "fetch", "--locked"], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...readTargetEnv, ...s.env, ...ledgerEnv }, signal: signal ? AbortSignal.any([signal, fetchTimer.signal]) : fetchTimer.signal, timeout: fetchLimit }); } finally { clearTimeout(fetchClock); }
               if (!fetched || fetched.error || fetched.status !== 0) {
                 advisory.cleanup?.();
                 if (signal?.aborted) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
                 if (fetchTimer.signal.aborted || fetched?.error?.code === "ETIMEDOUT") return { ...row, status: "fail", code: "TIMEOUT", detail: `cargo fetch --locked for cargo-deny ran longer than ${Math.round(fetchLimit / 60000)} min and was killed with its process tree` };
                 return { ...row, status: "fail", code: "FETCH", detail: `cargo fetch --locked for cargo-deny failed (crate sources must be local before deny): ${fetched?.error?.message ?? (tail(fetched) || `exit ${fetched?.status}`)}` };
               }
-              const metadataDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-deny-metadata-"));
+              const metadataDir = fs.mkdtempSync(path.join(tmpRoot, "rk-deny-metadata-"));
               const metadataFile = path.join(metadataDir, "metadata.json");
-              const metadata = await deps.spawn(p.command, [...args.slice(0, at), ...metadataArgs({ noDeps: false })], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env }, stdoutFile: metadataFile, ...sig });
+              const metadata = await deps.spawn(p.command, [...args.slice(0, at), ...metadataArgs({ noDeps: false })], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...readTargetEnv, ...s.env, ...ledgerEnv }, stdoutFile: metadataFile, ...sig });
               // AUX_METADATA: the auxiliary metadata that feeds deny could not be produced; not a deny finding, so never a deterministic red (rightkit#1257).
               if (!metadata || metadata.error || metadata.status !== 0) { fs.rmSync(metadataDir, { recursive: true, force: true }); advisory.cleanup?.(); return { ...row, status: "fail", code: "AUX_METADATA", detail: `cargo metadata for cargo-deny failed: ${metadata?.error?.message ?? (tail(metadata) || `exit ${metadata?.status}`)}` }; }
               if (!fs.existsSync(metadataFile)) fs.writeFileSync(metadataFile, String(metadata.stdout ?? ""));
@@ -2239,6 +2436,17 @@ export async function runScans(plan, options = {}) {
           // The broker snapshot carrier (joint plan step 4d): this one cargo request names the commit, the snapshot, the ownership
           // handle and its own argv and working directory, under a fresh nonce; the ownership records the submit first.
           const finalArgs = args.map((a) => (a === "{contentRoot}" ? contentRoot : a));
+          // SwiftPM writes its `.build/` inside the package by default: that must never land in the commit snapshot or the checkout, so the
+          // build directory is the gate's own, keyed by the repository and the scan so it stays warm.
+          // GB-67: on a broker host the scan is the carried `rightkit-swift` adapter job and the broker owns SwiftPM's scratch (it appends the one managed path and the
+          // product location is `build --show-bin-path`): the gate sends no scratch or build path, and never adds one. Only a host with no broker (Linux direct) keeps its own.
+          const swiftBrokered = s.tool === "swift" && Boolean(deps.snapshotBroker);
+          // The adapter takes exactly one relative --package-path (adapter.rs check_swift_package); the scan runs in its package directory, so that is `.`.
+          if (swiftBrokered && finalArgs[0] === "build" && !finalArgs.some((a) => a === "--package-path" || a.startsWith("--package-path="))) finalArgs.splice(1, 0, "--package-path", ".");
+          if (s.tool === "swift" && finalArgs[0] === "build" && !swiftBrokered && !finalArgs.some((a) => a === "--scratch-path" || a === "--build-path" || a.startsWith("--scratch-path=") || a.startsWith("--build-path="))) {
+            try { finalArgs.push("--scratch-path", swiftScratchPath({ tmpRoot, roots: [contentRoot, liveRoot, cargoLiveRoot], id: s.id })); }
+            catch (e) { advisory?.cleanup?.(); return { ...row, status: "fail", code: "SWIFT_SCRATCH", detail: `${s.id}: ${e.message}` }; }
+          }
           let carrier = null;
           if (viaSnapshotBroker) {
             const sb = deps.snapshotBroker;
@@ -2246,11 +2454,6 @@ export async function runScans(plan, options = {}) {
             const refDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-snapreq-"));
             try {
               const cargoArgv = s.tool === "rustright" ? finalArgs.slice(1) : finalArgs;
-              // The ownership must record the submit, under this gate's handle, before anything is launched: a missing hook or a
-              // mark that did not land refuses the request (the reclaim proof reads broker.submitted).
-              if (typeof sb.markBrokerSubmit !== "function") throw new Error("no build-ownership submit hook: the broker submit cannot be recorded");
-              const marked = sb.markBrokerSubmit();
-              if (marked?.broker?.submitted !== true || marked.handle !== sb.handle) throw new Error(`the build ownership did not record the broker submit under ${sb.handle}`);
               const made = writeSnapshotRequest({ controlRoot: sb.controlRoot, commit: sb.commit, snapshot: sb.snapshot, declaredInputs: sb.declaredInputs ?? [], handle: sb.handle, primaryCwd: fs.realpathSync.native(cwd), argv: cargoArgv, requestIdFile: path.join(refDir, "request.json") });
               carrier = { made, refDir, cargoArgv };
             } catch (e) { fs.rmSync(refDir, { recursive: true, force: true }); clearTimeout(clock); advisory?.cleanup?.(); return { ...row, status: "fail", code: "SNAPSHOT_REQUEST", detail: `the snapshot request for ${s.id} could not be written: ${e.message}` }; }
@@ -2268,12 +2471,38 @@ export async function runScans(plan, options = {}) {
             fs.mkdirSync(sentinel, { recursive: true });
           }
           const sentinelEnv = sentinel ? { CARGO_TARGET_DIR: sentinel, CARGO_BUILD_TARGET_DIR: sentinel } : {};
-          // Every cargo call the wrapper decides during this scan is filed under this token in the gate's ledger.
-          const ledgerToken = cargoLedger ? scanTokenOf(s.id) : null;
-          if (ledgerToken) claimedTokens.add(ledgerToken);
-          const ledgerEnv = ledgerToken ? { [SCAN_TOKEN_ENV]: ledgerToken } : {};
           try {
-          try { r = await deps.spawn(p.command, finalArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...ledgerEnv, ...(carrier ? carrier.made.env : {}) }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
+          // The ownership records this request's sub-handle immediately before it is sent (the reclaim proof reads broker.submitted): a
+          // missing hook or a mark that did not land sends nothing.
+          if (carrier) {
+            const sub = carrier.made.carrier.ownership.handle;
+            let marked = null; let why = null;
+            try { if (typeof deps.snapshotBroker.markBrokerSubmit !== "function") throw new Error("no build-ownership submit hook"); marked = deps.snapshotBroker.markBrokerSubmit(sub); } catch (e) { why = e.message; }
+            if (marked?.broker?.submitted !== true || marked.handle !== deps.snapshotBroker.handle || !marked.broker.handles?.includes(sub)) {
+              clearTimeout(clock); advisory?.cleanup?.();
+              return { ...row, status: "fail", code: "SNAPSHOT_REQUEST", detail: `the snapshot request for ${s.id} was not sent: the build ownership did not record the broker submit under ${deps.snapshotBroker.handle}${why ? ` (${why})` : ""}` };
+            }
+          }
+          if (swiftBrokered) {
+            // One signed, ledgered adapter request in the commit's snapshot (the ownership records its sub-handle before it is sent); a refused or unverified call fails the scan.
+            try {
+              const carried = carryBrokerAdapter({ adapter: "rightkit-swift", words: finalArgs, cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env, ...(extraEnv ?? {}) }, section: brokerSection(deps.snapshotBroker), record: (entry) => { if (cargoLedger && ledgerToken) appendLedger(cargoLedger.dir, ledgerToken, entry); }, err: () => {}, stdio: "capture" });
+              r = { status: carried.status, stdout: carried.stdout, stderr: carried.stderr };
+            } catch (e) { r = { error: e }; } finally { clearTimeout(clock); advisory?.cleanup?.(); }
+          } else {
+          // The executables this scan runs are the ones resolved and verified above: read their bytes again now, immediately before the launch
+          // (a replaced binary is TOOL_REPLACED), and hand the scan only those paths: actionlint its shellcheck, cargo its cargo-deny / cargo-audit.
+          for (const identity of identities) {
+            const swapped = trustedScanToolProblem(identity, { ops: options.toolOps });
+            if (swapped) { clearTimeout(clock); advisory?.cleanup?.(); return { ...row, status: "fail", code: swapped.code, detail: `${swapped.code}: ${swapped.detail}; the scan did not run` }; }
+          }
+          const shellcheckIdentity = s.tool === "actionlint" ? identities.find((i) => i.tool === "shellcheck") : null;
+          const spawnArgs = shellcheckIdentity ? ["-shellcheck", shellcheckIdentity.path, ...finalArgs] : finalArgs;
+          const trustedDirs = trusts.map((tool) => identities.find((i) => i.tool === tool)).filter(Boolean).map((i) => path.dirname(i.path));
+          const pathKey = Object.keys({ ...deps.env, ...s.env }).find((k) => k.toLowerCase() === "path") ?? "PATH";
+          const trustEnv = trustedDirs.length ? { [pathKey]: [...trustedDirs, ({ ...deps.env, ...s.env })[pathKey]].filter(Boolean).join(deps.platform === "win32" ? ";" : ":") } : {};
+          try { r = await deps.spawn(p.command, spawnArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...readTargetEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...ledgerEnv, ...(carrier ? carrier.made.env : {}), ...(carrier ? scanOperationEnv({ ...deps.env, ...s.env }, limitMs) : {}), ...trustEnv }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
+          }
           if (signal?.aborted && (!r || r.error || r.status !== 0)) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
           if ((timer.signal.aborted || r?.error?.code === "ETIMEDOUT") && (!r || r.error || r.status !== 0)) return { ...row, status: "fail", code: "TIMEOUT", detail: `${s.id} ran longer than ${Math.round(limitMs / 60000)} min and was killed with its process tree; a scan that does not finish fails` };
           if (!r || r.error) { status = "fail"; code = "SPAWN_ERROR"; detail = r?.error?.message ?? "no result"; }
@@ -2317,7 +2546,7 @@ export async function runScans(plan, options = {}) {
             }
           }
           } finally {
-            if (carrier) { fs.rmSync(carrier.made.file, { force: true }); fs.rmSync(carrier.refDir, { recursive: true, force: true }); }
+            if (carrier) { removeCarrier(carrier.made.file); fs.rmSync(carrier.refDir, { recursive: true, force: true }); }
             if (tscProject) fs.rmSync(tscProject.dir, { recursive: true, force: true });
           }
           if (status === "fail" && options.scanLogDir && r) {
@@ -2361,7 +2590,7 @@ export async function runScans(plan, options = {}) {
     schema: SCAN_RESULT_SCHEMA, ok: !cancelled && results.every((r) => r.status === "pass"), complete: !cancelled && results.every((r) => r.status === "pass"), classes, checker, ...(cancelled ? { cancelled: true } : {}),
     inputDigest: plan.inputDigest ?? null,
     deferred: results.filter((r) => r.status === "deferred").map((r) => r.id),
-    scans: results, toolVersions, cacheHits: [...cacheHits].sort(), notes: [...(plan.notes ?? []), ...(cargoLedger ? [UNOBSERVED_NESTED_CARGO_NOTE] : [])],
+    scans: results, toolVersions, toolIdentities, cacheHits: [...cacheHits].sort(), notes: [...(plan.notes ?? []), ...(cargoLedger ? [UNOBSERVED_NESTED_CARGO_NOTE] : [])],
     scanSetDigest: digestScanSet(results),
     classDigests: { A: digestScanSet(results.filter((r) => r.class === "A")), B: digestScanSet(results.filter((r) => r.class === "B")) },
   };

package/development-signing.mjs

@@ -6,6 +6,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { adhocSafeEntitlements } from "./adhoc-entitlements.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+import { DEFAULT_TEAM } from "./signing-identity.mjs";
 import { bundleRelativePath, compileBundlePathMap, globToRegExp, isGlobPattern, lookupBundlePath, resolveBundleIdentifier, validateBundleRelativeKey, validateIdentifierTemplate, validateSigningIdentifier } from "./mac-bundle-signing.mjs";
 
 export class MacosDevelopmentSigningError extends Error {
@@ -17,7 +18,7 @@ export class MacosDevelopmentSigningError extends Error {
   }
 }
 
-const DEFAULT_TEAM = "6KLGD3LLKF";
+export { DEFAULT_TEAM };
 const output = (result) => `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
 const captureOptions = (root, env) => ({ cwd: root, env, encoding: "utf8", stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: false });
 
@@ -387,6 +388,18 @@ export function signMacosDevelopmentBundle(options) {
   } finally { rmSync(scratch, { recursive: true, force: true }); }
 }
 
+/**
+ * The designated requirement a Developer ID Application signature of `bundleId` by `team` carries, exactly as `codesign -d -r-` prints it:
+ * the signing identifier, Apple's anchor, the Developer ID intermediate and leaf OIDs, and the team. A suite-signed QA binary and a release
+ * build of the same product have this same requirement, so macOS keeps one set of privacy grants for both. The team is printed bare when it
+ * starts with a letter and quoted when it starts with a digit (what `csreq -t` prints; a bare digit-first word does not parse).
+ */
+export function expectedDesignatedRequirement(bundleId, team = DEFAULT_TEAM) {
+  if (typeof bundleId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/.test(bundleId)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", `designated requirement: ${JSON.stringify(bundleId)} is not a signing identifier`);
+  if (typeof team !== "string" || !/^[A-Z0-9]{10}$/.test(team)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", `designated requirement: ${JSON.stringify(team)} is not a ten-character Apple team identifier`);
+  return `identifier "${bundleId}" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ${/^[A-Za-z]/.test(team) ? team : `"${team}"`}`;
+}
+
 /**
  * One stable designated requirement across dev installs. macOS keys privacy grants (TCC) to the code identity, so a dev
  * build whose designated requirement differs from the installed copy's would silently drop every grant. Fails with