@rightkit/release 0.6.12 → 0.6.14

package/ios-package-recipe.mjs

@@ -13,14 +13,24 @@
 //
 // Upload is a separate command (ios-upload.mjs): `build` never uploads, `upload` never builds. Nothing here reads an App Store
 // Connect credential: archive and export sign through the Xcode account of the GUI session. Fails closed: every problem
-// throws IosPackageError, and once an archive or an IPA exists a failure deletes them (and any stale receipt) so a later
-// seal cannot pick up a half-verified artifact. Every external effect is injectable through `deps`.
+// throws IosPackageError, and once an IPA exists a failure deletes it (and any stale receipt) so a later
+// seal cannot pick up a half-verified artifact (the broker-owned archive and export directory are the broker's to keep and reap). Every external effect is injectable through `deps`.
+//
+// RA-09 / R3-M02: every compiler-capable phase (xcodegen generate, xcodebuild archive, xcodebuild -exportArchive and any prepare step that names a native build
+// tool) is a typed native adapter job of the production runner (`deps.native`, build-launch.mjs createNativeRunner: the carrier or the resolved executor's client),
+// never a spawn of this recipe's own. The broker owns the output root, so the call names neither -derivedDataPath, -archivePath, -exportPath nor -resultBundlePath:
+// the archive and the export directory are READ BACK from the verified receipt's managed output roles (`outputs.byRole.archive` / `.export`), and the export must read
+// the very archive that was verified. The ExportOptions.plist is a regular XML file inside the step directory (the snapshot), not under the receipt directory. Signing stays
+// the provisioned GUI session's (assertGuiSigningSession) with automatic signing and -allowProvisioningUpdates; no alternate signer exists. A missing runner, an unadvertised
+// capability or an argv the broker's grammar refuses is refused BEFORE the first tool is launched. The non-compiling queries (`xcodebuild -version`, `xcodegen --version`,
+// plutil, codesign, security, ditto, git) are this recipe's own direct steps through `deps.run`.
 import { createHash } from "node:crypto";
 import * as nodeFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { assertGuiSigningSession, IosHostError, outputTail, resolveXcodeStorage } from "./ios-host.mjs";
+import { assertGuiSigningSession, IosHostError, outputTail } from "./ios-host.mjs";
+import { nativeToolOf } from "./native-adapters.mjs";
 
 export const IOS_SIGNING_CONTRACT = "ios-xcodebuild-archive-automatic-v1";
 export const IOS_RECEIPT_NAME = "ios-archive.json";
@@ -30,7 +40,8 @@ export const IOS_DEFAULT_TIMEOUT_MS = 60 * 60 * 1000;
 /**
  * Codes: IOS_PACKAGE_CONFIG_INVALID, IOS_PACKAGE_HOST_UNSUPPORTED, IOS_PACKAGE_TOOL_MISSING, IOS_PACKAGE_GENERATE_FAILED,
  * IOS_PACKAGE_PREPARE_FAILED, IOS_PACKAGE_ARCHIVE_FAILED, IOS_PACKAGE_SOURCE_CHANGED, IOS_PACKAGE_VERIFY_FAILED,
- * IOS_PACKAGE_EXPORT_FAILED, IOS_PACKAGE_BUILD_NUMBER, IOS_PACKAGE_RECEIPT_FAILED.
+ * IOS_PACKAGE_EXPORT_FAILED, IOS_PACKAGE_BUILD_NUMBER, IOS_PACKAGE_RECEIPT_FAILED, IOS_PACKAGE_NATIVE_REQUIRED (no production native runner was supplied),
+ * IOS_PACKAGE_NATIVE_REFUSED (the door or the broker's grammar refused a native call before any launch; the message names the capability).
  */
 export class IosPackageError extends Error {
   constructor(code, message, options) { super(message, options); this.name = "IosPackageError"; this.code = code; }
@@ -39,6 +50,8 @@ const invalid = (message) => new IosPackageError("IOS_PACKAGE_CONFIG_INVALID", `
 const isPlainObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 
 // ---- config ------------------------------------------------------------------------------------------------------
+/** The ExportOptions.plist the export reads: a regular XML file inside the step directory (the snapshot), relative to the app root. It is never under the receipt directory. */
+export const IOS_EXPORT_OPTIONS_RELATIVE = ".right-release/ios-export-options.plist";
 const IOS_KEYS = ["project", "projectSpec", "scheme", "configuration", "teamId", "bundleId", "exportMethod", "signing", "buildNumber", "extraBuildSettings", "packageResolved", "trustedSwiftMacros", "trustedSwiftPlugins", "prepare", "cleanup", "checks", "archive", "ipa", "timeoutMs"];
 const CLEANUP_KEYS = ["derivedData"];
 const CHECK_KEYS = ["versionIdentity", "forbidStrings", "plist"];
@@ -138,7 +151,9 @@ export function validateIosPackageConfig(spec) {
     const bad = Object.keys(spec.cleanup).filter((key) => !CLEANUP_KEYS.includes(key));
     if (bad.length) throw invalid(`cleanup has unknown key(s): ${bad.join(", ")} (allowed: ${CLEANUP_KEYS.join(", ")})`);
     if (spec.cleanup.derivedData !== undefined && typeof spec.cleanup.derivedData !== "boolean") throw invalid("cleanup.derivedData must be a boolean");
-    cleanup.derivedData = spec.cleanup.derivedData === true;
+    // The broker owns DerivedData and its lifetime (the xcodebuild adapter's managed output root): a recipe cannot delete it, and silently ignoring the request would be a lie.
+    if (spec.cleanup.derivedData === true) throw invalid("cleanup.derivedData cannot be honoured: the broker owns the DerivedData root and its lifetime (RA-09); remove it");
+    cleanup.derivedData = false;
   }
 
   const checks = { versionIdentity: true, forbidStrings: [], plist: {} };
@@ -183,6 +198,7 @@ export function validateIosPackageConfig(spec) {
     prepare: spec.prepare === undefined ? [] : commandList(spec.prepare, "prepare"),
     cleanup,
     checks,
+    // Kept for config compatibility only: the broker owns where the archive is written (a caller names no -archivePath), so this path is validated but never used to build or read.
     archive: relativeInside(spec.archive, "archive", /\.xcarchive$/i),
     ipa: relativeInside(spec.ipa, "ipa", /\.ipa$/i),
     timeoutMs,
@@ -343,16 +359,17 @@ export function installSwiftTrustSource({ trust, root, fs = nodeFs }) {
   assertSwiftTrustUnchanged({ trust, root, fs });
 }
 
-export function archiveArgv(spec, { root, buildNumber, storage, trusted }) {
+/**
+ * The archive call as the broker's xcodebuild adapter admits it: no -archivePath, -derivedDataPath or -resultBundlePath (the broker owns the output root and names the archive by
+ * its managed `archive` role in the signed receipt). Signing is automatic through the provisioned session.
+ */
+export function archiveArgv(spec, { root, buildNumber, trusted }) {
   const trustFlags = swiftTrustFlags(spec, trusted);
   return [
     "-project", path.resolve(root, spec.project),
     "-scheme", spec.scheme,
     "-configuration", spec.configuration,
     "-destination", "generic/platform=iOS",
-    "-archivePath", path.resolve(root, spec.archive),
-    "-derivedDataPath", storage.derivedData,
-    ...(storage.resultBundle ? ["-resultBundlePath", storage.resultBundle] : []),
     `DEVELOPMENT_TEAM=${spec.teamId}`,
     `CURRENT_PROJECT_VERSION=${buildNumber}`,
     ...Object.entries(spec.extraBuildSettings).map(([name, value]) => `${name}=${value}`),
@@ -362,11 +379,9 @@ export function archiveArgv(spec, { root, buildNumber, storage, trusted }) {
   ];
 }
 
-/** A dedicated directory beside the IPA (never the IPA's own directory, which may be the app root): xcodebuild fills it with logs and plists. */
-export const exportDirectory = (spec, root) => path.join(path.dirname(path.resolve(root, spec.ipa)), `${path.basename(spec.ipa, ".ipa")}.export`);
-
-export function exportArgv(spec, { root, optionsFile }) {
-  return ["-exportArchive", "-archivePath", path.resolve(root, spec.archive), "-exportPath", exportDirectory(spec, root), "-exportOptionsPlist", optionsFile, "-allowProvisioningUpdates"];
+/** The export call: `-exportArchive` stands alone with its options file; the broker reads the managed archive the archive call wrote and names the export directory (role `export`). */
+export function exportArgv(spec, { optionsFile }) {
+  return ["-exportArchive", "-exportOptionsPlist", optionsFile, "-allowProvisioningUpdates"];
 }
 
 /** Dry-run display only: the flags the run would add once its own check passes. The real run never uses this. */
@@ -377,27 +392,26 @@ const plannedTrust = (spec) => {
   return planned;
 };
 
-/** The ordered plan (pure; no secret is part of any argument). Used by --dry-run and by the run itself. */
-export function iosPackagePlan(spec, { root, buildNumber = "<YYYYMMDDNN>", storage = { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, receiptDir }) {
-  const optionsFile = path.join(receiptDir, "ios-export-options.plist");
+/** The ordered plan (pure; no secret is part of any argument). Used by --dry-run and by the run itself. `native` names the broker adapter that runs the step. */
+export function iosPackagePlan(spec, { root, buildNumber = "<YYYYMMDDNN>", receiptDir }) {
+  const optionsFile = path.join(root, IOS_EXPORT_OPTIONS_RELATIVE);
   return {
     steps: [
-      { id: "preflight", description: "macOS host, GUI signing session, xcodebuild" + (spec.projectSpec ? ", xcodegen (required)" : "") },
-      ...(spec.projectSpec ? [{ id: "generate", cmd: "xcodegen", args: xcodegenArgv(spec, root) }] : []),
-      ...spec.prepare.map((step, index) => ({ id: "prepare", index, cmd: step.cmd, args: step.args, cwd: step.cwd ?? "." })),
+      { id: "preflight", description: "macOS host, GUI signing session, xcodebuild" + (spec.projectSpec ? ", xcodegen (required)" : "") + "; every compiler-capable call is planned against the broker's adapter grammar before the first launch" },
+      ...(spec.projectSpec ? [{ id: "generate", cmd: "xcodegen", args: xcodegenArgv(spec, root), native: "rightkit-xcodegen" }] : []),
+      ...spec.prepare.map((step, index) => ({ id: "prepare", index, cmd: step.cmd, args: step.args, cwd: step.cwd ?? ".", ...(nativeToolOf(step.cmd) ? { native: true } : {}) })),
       ...(spec.trustedSwiftMacros.length || spec.trustedSwiftPlugins.length
         ? [{ id: "trust-check", description: `Package.resolved (${spec.packageResolved ?? defaultPackageResolvedPath(spec.project)}) tracked and equal to HEAD; ${[...spec.trustedSwiftMacros, ...spec.trustedSwiftPlugins].map((entry) => entry.package).join(", ")} pinned to the reviewed revisions; the skip flags below are added only after this passes` }]
         : []),
-      { id: "archive", cmd: "xcodebuild", args: archiveArgv(spec, { root, buildNumber, storage, trusted: plannedTrust(spec) }) },
+      { id: "archive", cmd: "xcodebuild", args: archiveArgv(spec, { root, buildNumber, trusted: plannedTrust(spec) }), native: "rightkit-xcodebuild", outputs: "managed role archive (read back from the signed receipt)" },
       { id: "verify-archive", description: "version identity across app, appex and Watch plists; bundle id; build number; QA scan; forbidden strings" },
-      { id: "export", cmd: "xcodebuild", args: exportArgv(spec, { root, optionsFile }), optionsFile },
+      { id: "export", cmd: "xcodebuild", args: exportArgv(spec, { optionsFile }), optionsFile, native: "rightkit-xcodebuild", outputs: "managed roles archive (must equal the verified one) and export (read back from the signed receipt)" },
       { id: "verify-ipa", description: "extracted IPA: version identity, entitlements, embedded.mobileprovision, code signature" },
       { id: "receipt", file: path.join(receiptDir, IOS_RECEIPT_NAME) },
     ],
     teamId: spec.teamId,
     bundleId: spec.bundleId,
     ipa: path.resolve(root, spec.ipa),
-    archive: path.resolve(root, spec.archive),
   };
 }
 
@@ -499,24 +513,23 @@ export function scanForbiddenStrings(dir, strings, fs = nodeFs) {
 // ---- the recipe --------------------------------------------------------------------------------------------------
 /**
  * Runs the steps. `root` is the app root. `deps` (all optional, defaults are the real host):
- *   run(cmd, args, options)      spawnSync-shaped; fakes in tests
+ *   native                       REQUIRED: the production native runner ({ plan, run }, build-launch.mjs createNativeRunner). Every compiler-capable call goes through it; there is no spawn fallback
+ *   run(cmd, args, options)      spawnSync-shaped, for the NON-compiling direct steps only (xcodebuild -version, xcodegen --version, plutil, codesign, security, ditto, git)
  *   fs                           node:fs-shaped
  *   scanFiles(label, files, o)   release.mjs's assertNoQaControlBinaries (QA rules plus the release-switch binary layer)
  *   detectSession / route        GUI signing session seams (ios-host.mjs)
  *   gitHead()                    the source commit; it must not change during the build
- *   storage()                    DerivedData and result bundle (rustright storage xcode-args)
  *   scanForbidden(dir, strings)  forbidden-string scan
  *   counterDir                   where the per-app build number counter lives (the vault state root under right-release build)
  */
 export async function runIosPackageRecipe({
   root, app = "app", spec, dryRun = false, env = process.env, platform = process.platform,
   receiptDir = path.join(root, ".right-release", "receipts"), stateDir = path.join(root, ".right-release"), counterDir = stateDir,
-  run = spawnSync, fs = nodeFs, scanFiles, detectSession, route, gitHead, storage, scanForbidden = scanForbiddenStrings,
+  native, run = spawnSync, fs = nodeFs, scanFiles, detectSession, route, gitHead, scanForbidden = scanForbiddenStrings,
   now = () => new Date(), tmpRoot = os.tmpdir(), log = console.log,
 }) {
   if (!path.isAbsolute(root)) throw invalid("root must be an absolute path");
   const ipa = path.resolve(root, spec.ipa);
-  const archive = path.resolve(root, spec.archive);
   const receiptPath = path.join(receiptDir, IOS_RECEIPT_NAME);
 
   if (dryRun) {
@@ -527,6 +540,9 @@ export async function runIosPackageRecipe({
   }
   if (platform !== "darwin") throw new IosPackageError("IOS_PACKAGE_HOST_UNSUPPORTED", `the iOS package recipe needs macOS with Xcode; this host is ${platform} (only config validation and --dry-run run elsewhere)`);
 
+  // ---- the production native runner: there is no spawn route for a compiler-capable phase ----
+  if (!native || typeof native.run !== "function" || typeof native.plan !== "function") throw new IosPackageError("IOS_PACKAGE_NATIVE_REQUIRED", "the iOS package recipe needs the production native runner (build-launch.mjs createNativeRunner): xcodegen and xcodebuild archive/export run only as typed broker adapter jobs, never as a spawn of this recipe's own");
+
   // ---- preflight: before any effect ----
   let session;
   try { session = assertGuiSigningSession({ operation: "ios package", env, run, detect: detectSession, route }); }
@@ -541,18 +557,17 @@ export async function runIosPackageRecipe({
     if (gen.error || gen.status !== 0) throw new IosPackageError("IOS_PACKAGE_TOOL_MISSING", `xcodegen is required because iosPackage.projectSpec names ${spec.projectSpec}; install it (brew install xcodegen). A committed xcodeproj is never used instead`);
   }
   if (!fs.existsSync(path.resolve(root, spec.projectSpec ?? spec.project))) throw new IosPackageError("IOS_PACKAGE_CONFIG_INVALID", `${spec.projectSpec ?? spec.project} does not exist`);
-  const resolvedStorage = (storage ?? (() => resolveXcodeStorage({ env, run, cwd: root, fallbackRoot: path.join(stateDir, "ios") })))();
   const head = gitHead ?? (() => { const r = run("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", windowsHide: true }); if (r.status !== 0) throw new IosPackageError("IOS_PACKAGE_SOURCE_CHANGED", "git rev-parse HEAD failed"); return String(r.stdout).trim(); });
   const sourceCommit = head();
 
   // ---- stale outputs go first, so an old IPA is never mistaken for this build's ----
-  const exportDir = exportDirectory(spec, root);
-  const stale = [archive, ipa, exportDir, receiptPath, path.join(receiptDir, "ios-export-options.plist"), ...(resolvedStorage.resultBundle ? [resolvedStorage.resultBundle] : []), ...(spec.cleanup.derivedData ? [resolvedStorage.derivedData] : [])];
+  const optionsFile = path.join(root, IOS_EXPORT_OPTIONS_RELATIVE);
+  const stale = [ipa, receiptPath, optionsFile];
   for (const file of stale) fs.rmSync(file, { recursive: true, force: true });
   fs.mkdirSync(receiptDir, { recursive: true });
   fs.mkdirSync(path.dirname(ipa), { recursive: true });
 
-  const cleanupOutputs = () => { for (const file of [ipa, archive, exportDir, receiptPath]) { try { fs.rmSync(file, { recursive: true, force: true }); } catch { /* best effort */ } } };
+  const cleanupOutputs = () => { for (const file of [ipa, receiptPath]) { try { fs.rmSync(file, { recursive: true, force: true }); } catch { /* best effort */ } } };
   const step = (id, code, cmd, args, options = {}) => {
     log(`right-release: ios ${id}: ${cmd}`);
     const { logFile, ...runOptions } = options;
@@ -561,6 +576,34 @@ export async function runIosPackageRecipe({
     if (result.error || result.status !== 0) throw new IosPackageError(code, `${cmd} ${id} failed (${result.status ?? "unavailable"})${result.error ? `: ${result.error.message}` : ""}\n${outputTail(result)}`);
     return result;
   };
+  // A compiler-capable call: the production runner only. A refusal (no runner route, an unadvertised capability, an argv the broker's grammar refuses) happened BEFORE any launch and names the capability.
+  const refusedNative = (cmd, refusal) => new IosPackageError("IOS_PACKAGE_NATIVE_REFUSED", `${cmd} was refused before any launch (${refusal.code ?? "refused"}): ${refusal.message}`);
+  const planNative = (cmd, args, options = {}) => {
+    try { native.plan(cmd, args, { cwd: root, env, ...options }); } catch (error) {
+      if (error?.code === "RK_BUILD_LAUNCH_REFUSED") throw refusedNative(cmd, { code: error.reason, message: error.message });
+      throw error;
+    }
+  };
+  const nativeStep = (id, code, cmd, args, options = {}) => {
+    log(`right-release: ios ${id}: ${cmd} (broker adapter job)`);
+    const { logFile, cwd = root } = options;
+    const result = native.run(cmd, args, { cwd, env, timeout: spec.timeoutMs });
+    if (logFile) { try { fs.writeFileSync(logFile, `${outputTail(result, 4000)}\n`); } catch { /* diagnostics only */ } }
+    if (result.refusal) throw refusedNative(cmd, result.refusal);
+    if (!result.ok) throw new IosPackageError(code, `${cmd} ${id} failed (${result.status ?? "unavailable"})${result.error ? `: ${result.error.message}` : ""}\n${outputTail(result)}`);
+    return result;
+  };
+  // The managed location of a role, read back from the verified receipt's output mapping: never a path this recipe composed.
+  const located = (result, role, code) => {
+    const outputs = result.outputs;
+    const found = outputs?.ok === true ? outputs.byRole?.[role] : undefined;
+    if (typeof found !== "string" || !path.isAbsolute(found)) throw new IosPackageError(code, `the broker did not report the managed ${role} location of ${result.tool} (${outputs && outputs.ok === false ? outputs.problem : "no verified output directory"}); a broker-owned build's output is never guessed`);
+    return found;
+  };
+  const nativeEvidence = (result) => ({
+    tool: result.tool, adapter: result.adapter, capability: result.capability, carried: result.carried, relativeCwd: result.relativeCwd, requestId: result.requestId, outputDir: result.outputDir,
+    outputsSource: result.outputs?.source ?? null, argv: result.argv, outputs: result.outputs?.outputs ?? [],
+  });
   const plist = (file) => {
     const result = sh("plutil", ["-convert", "json", "-o", "-", "--", file], { timeout: 60_000 });
     try { if (result.status === 0) return JSON.parse(String(result.stdout)); } catch { /* reported below */ }
@@ -582,23 +625,35 @@ export async function runIosPackageRecipe({
 
   let tempDir;
   try {
+    // ---- plan every compiler-capable call against the broker's grammar BEFORE the first launch: a missing capability or a refused argv stops here, with nothing sent ----
+    // The export reads an options file of the step directory, so it is written first; the build number is a placeholder here (the real one is drawn from the counter just before the archive).
+    const optionsText = exportOptionsPlist(spec);
+    fs.mkdirSync(path.dirname(optionsFile), { recursive: true });
+    fs.writeFileSync(optionsFile, optionsText);
+    const plannedBuild = `${now().toISOString().slice(0, 10).replaceAll("-", "")}01`;
+    if (spec.projectSpec) planNative("xcodegen", xcodegenArgv(spec, root));
+    planNative("xcodebuild", archiveArgv(spec, { root, buildNumber: plannedBuild, trusted: plannedTrust(spec) }));
+    planNative("xcodebuild", exportArgv(spec, { optionsFile }));
     // ---- trust-check: reviewed Swift macro/plugin pins, before anything is generated or built ----
     const trust = verifySwiftTrustSource({ spec, root, sh, fs });
     // ---- generate ----
     if (spec.projectSpec) {
-      step("generate", "IOS_PACKAGE_GENERATE_FAILED", "xcodegen", xcodegenArgv(spec, root));
+      nativeStep("generate", "IOS_PACKAGE_GENERATE_FAILED", "xcodegen", xcodegenArgv(spec, root));
       if (!fs.existsSync(path.resolve(root, spec.project))) throw new IosPackageError("IOS_PACKAGE_GENERATE_FAILED", `xcodegen did not produce ${spec.project}`);
     }
     // ---- prepare ----
     for (const [index, command] of spec.prepare.entries()) {
       const cwd = path.resolve(root, command.cwd ?? ".");
-      step(`prepare ${index + 1}`, "IOS_PACKAGE_PREPARE_FAILED", command.cmd, command.args, { cwd });
+      // A prepare step that names a native build tool is a broker adapter job like any other; the app's own non-native commands stay direct steps.
+      if (nativeToolOf(command.cmd) !== null) nativeStep(`prepare ${index + 1}`, "IOS_PACKAGE_PREPARE_FAILED", command.cmd, command.args, { cwd });
+      else step(`prepare ${index + 1}`, "IOS_PACKAGE_PREPARE_FAILED", command.cmd, command.args, { cwd });
     }
     if (trust) installSwiftTrustSource({ trust, root, fs });
     // ---- archive ----
     const buildNumber = nextDateBuildNumber({ now: now(), stateFile: path.join(counterDir, `ios-build-number.${spec.bundleId}.json`), fs });
-    step("archive", "IOS_PACKAGE_ARCHIVE_FAILED", "xcodebuild", archiveArgv(spec, { root, buildNumber, storage: resolvedStorage, trusted: trust?.evidence }), { logFile: path.join(receiptDir, "ios-archive.log") });
+    const archived = nativeStep("archive", "IOS_PACKAGE_ARCHIVE_FAILED", "xcodebuild", archiveArgv(spec, { root, buildNumber, trusted: trust?.evidence }), { logFile: path.join(receiptDir, "ios-archive.log") });
     if (trust) assertSwiftTrustUnchanged({ trust, root, fs });
+    const archive = located(archived, "archive", "IOS_PACKAGE_ARCHIVE_FAILED");
     const appsDir = path.join(archive, "Products", "Applications");
     const apps = fs.existsSync(appsDir) ? fs.readdirSync(appsDir).filter((name) => name.endsWith(".app")) : [];
     if (apps.length !== 1) throw new IosPackageError("IOS_PACKAGE_ARCHIVE_FAILED", `the archive must hold exactly one app under Products/Applications, found ${apps.length}`);
@@ -620,17 +675,20 @@ export async function runIosPackageRecipe({
     if (head() !== sourceCommit) throw new IosPackageError("IOS_PACKAGE_SOURCE_CHANGED", "the repository HEAD changed during the archive; refusing to export a mixed-source build");
 
     // ---- export ----
-    const optionsFile = path.join(receiptDir, "ios-export-options.plist");
-    const optionsText = exportOptionsPlist(spec);
-    fs.writeFileSync(optionsFile, optionsText);
     // Taken just before the export: xcodebuild registers a build upload for this version and build during it (see ios-build-upload.mjs).
     const exportStartedAt = now().toISOString();
-    step("export", "IOS_PACKAGE_EXPORT_FAILED", "xcodebuild", exportArgv(spec, { root, optionsFile }), { logFile: path.join(receiptDir, "ios-export.log") });
+    const exported = nativeStep("export", "IOS_PACKAGE_EXPORT_FAILED", "xcodebuild", exportArgv(spec, { optionsFile }), { logFile: path.join(receiptDir, "ios-export.log") });
     {
+      // The export must have read the very archive that was verified, and its directory is the broker's managed `export` role.
+      const exportedArchive = located(exported, "archive", "IOS_PACKAGE_EXPORT_FAILED");
+      if (path.normalize(exportedArchive) !== path.normalize(archive)) throw new IosPackageError("IOS_PACKAGE_EXPORT_FAILED", `the export read ${exportedArchive}, not the verified archive ${archive}`);
+      const exportDir = located(exported, "export", "IOS_PACKAGE_EXPORT_FAILED");
       const produced = fs.existsSync(exportDir) ? fs.readdirSync(exportDir).filter((name) => name.endsWith(".ipa")) : [];
-      if (produced.length !== 1) throw new IosPackageError("IOS_PACKAGE_EXPORT_FAILED", `the export must produce exactly one .ipa in ${path.basename(exportDir)}, found ${produced.length}`);
+      if (produced.length !== 1) throw new IosPackageError("IOS_PACKAGE_EXPORT_FAILED", `the export must produce exactly one .ipa in the managed export directory, found ${produced.length}`);
+      const source = path.join(exportDir, produced[0]);
       fs.mkdirSync(path.dirname(ipa), { recursive: true });
-      fs.renameSync(path.join(exportDir, produced[0]), ipa);
+      fs.copyFileSync(source, ipa);
+      if (sha256Bytes(fs.readFileSync(source)) !== sha256Bytes(fs.readFileSync(ipa))) throw new IosPackageError("IOS_PACKAGE_EXPORT_FAILED", "the IPA copied out of the managed export directory differs from the exported bytes");
     }
     if (!fs.statSync(ipa).size) throw new IosPackageError("IOS_PACKAGE_EXPORT_FAILED", "the exported IPA is empty");
 
@@ -690,6 +748,8 @@ export async function runIosPackageRecipe({
       profile,
       bundles: ipaInfos.map((bundle) => ({ role: bundle.role, name: bundle.label, bundleId: String(bundle.info.CFBundleIdentifier ?? "") })),
       archiveVersion: identity,
+      // RA-09: the broker's output readback. The archive and the export directory are the managed roles of the signed receipts of the archive and export calls (never paths this recipe chose).
+      native: { archivePath: archive, archive: nativeEvidence(archived), export: nativeEvidence(exported) },
       // Present only when the app trusts reviewed Swift macros/plugins: what was trusted and the exact pins file it was checked against.
       ...(trust ? { swiftTrust: { packageResolved: { path: trust.sourceRel, sha256: trust.sha256 }, macros: trust.evidence.macros, plugins: trust.evidence.plugins } } : {}),
     };
@@ -701,7 +761,6 @@ export async function runIosPackageRecipe({
     cleanupOutputs();
     throw error instanceof IosPackageError ? error : new IosPackageError("IOS_PACKAGE_VERIFY_FAILED", `iOS package failed: ${error.message}`, { cause: error });
   } finally {
-    try { fs.rmSync(exportDir, { recursive: true, force: true }); } catch { /* best effort */ }
     if (tempDir) { try { fs.rmSync(tempDir, { recursive: true, force: true }); } catch { /* best effort */ } }
   }
 }

package/linux-artifacts.mjs

@@ -6,6 +6,7 @@ import { createHash } from "node:crypto";
 import nodeFs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
+import { readSourceSplit } from "./source-split.mjs";
 
 export const LINUX_ARTIFACTS_SCHEMA = "rightkit.linux-artifacts/1";
 export const LINUX_ARCHES = Object.freeze(["x86_64", "aarch64"]);
@@ -57,11 +58,25 @@ function listFiles(fs, root, rel) {
   return fs.readdirSync(abs).flatMap((entry) => listFiles(fs, root, path.join(rel, entry)));
 }
 
+/**
+ * Where the archive and its manifest go: `<app root>/.right-release/linux`. Inside the door's source split (docs/GATE-CONTRACT.md "Commit-only build") `root`
+ * is the SNAPSHOT of the commit, and `.right-release` is a reserved path segment of the stage-output ledger: a file there is never an admissible ledger
+ * entry, so the stage would end "result covers no known bytes" (exit 2) after a good build. Every output right-release owns stays with the CHECKOUT
+ * (source-split.mjs; build-release.mjs puts the vault, state and sealed there), so a split packs into the checkout's same app-relative
+ * `.right-release/linux`, which is also where an unsplit run writes it. The split is the live door run's (readSourceSplit: proven, or a refusal), never
+ * a path the caller names. `split` overrides the lookup (a caller that has already read it).
+ */
+export function linuxArtifactsOutDir({ root, split, env = process.env, run = spawnSync }) {
+  const found = split !== undefined ? split : readSourceSplit({ env, cwd: root, run });
+  return path.join(found ? found.checkoutAppRoot : root, ".right-release", "linux");
+}
+
 /**
  * Pack `archive.include` (relative to `root`) into `<outDir>/<name>-<version>-linux-<arch>.tar.gz`, then write or merge
- * `<outDir>/linux-artifacts.json`. A manifest of another version or commit is replaced, never mixed.
+ * `<outDir>/linux-artifacts.json`. A manifest of another version or commit is replaced, never mixed. `outDir` defaults to
+ * linuxArtifactsOutDir: under `root` itself, except inside a source split, where it is the checkout's (never the snapshot's).
  */
-export function packLinuxArtifacts({ root, archive, app, version, commit, outDir = path.join(root, ".right-release", "linux"), run = spawnSync, fs = nodeFs, log = console.log }) {
+export function packLinuxArtifacts({ root, archive, app, version, commit, split, env = process.env, outDir = linuxArtifactsOutDir({ root, split, env }), run = spawnSync, fs = nodeFs, log = console.log }) {
   if (!/^\d+\.\d+\.\d+([-+][0-9A-Za-z.-]+)?$/.test(String(version ?? ""))) throw new Error(`linux artifacts: version ${JSON.stringify(version)} is not semver`);
   if (!/^[0-9a-f]{40}$/.test(String(commit ?? ""))) throw new Error("linux artifacts: commit must be the 40-hex source commit");
   const arch = linuxArch(run);

package/linux-qualifier.mjs

@@ -0,0 +1,83 @@
+// GB-29 (GATE-CONTRACT GC-L02; P-L, A-L; E4): the private Linux qualifier, only where a manifest DECLARES a Linux target, and the pending candidate that waits for it.
+//
+// A private app qualifies on Mac or Dell, never on a mandatory GitHub CI path. When its manifest declares a Linux deliverable (`targets.linux`), the exact sealed Linux bytes the Linux origin
+// produced are qualified in a COMPATIBLE Linux runtime (OS, architecture, libc) hosted by the Mac or the Dell: they are not rebuilt there. With no compatible runtime the candidate WAITS:
+// a pending record keeps the candidate identity, the exact sealed digest and the pinned policy, nothing is discarded, and a later qualification resumes it only when it binds the same
+// candidate, the same bytes, the same policy digest and every expected check passed. Nothing declared, nothing created: an app that declares no Linux target has no Linux artifact or qualification.
+import { createHash } from "node:crypto";
+
+export const PENDING_SCHEMA = "rightkit.pending-linux-candidate/1";
+export const LINUX_QUALIFIER_REFUSED = "RK_LINUX_QUALIFIER_REFUSED";
+const SHA256 = /^[0-9a-f]{64}$/;
+const ARCHES = new Set(["x86_64", "aarch64"]);
+const HOSTS = ["dell", "mac"];
+const refuse = (message) => { throw Object.assign(new Error(`${LINUX_QUALIFIER_REFUSED}: ${message}`), { code: LINUX_QUALIFIER_REFUSED }); };
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** The Linux targets a product manifest declares (`targets.linux`: one object or a list, each `{ arch, libc? }`); none when it declares none. Never inferred from another target. */
+export function declaredLinuxTargets(config) {
+  const declared = config?.targets?.linux;
+  if (declared === undefined || declared === null) return [];
+  const list = Array.isArray(declared) ? declared : [declared];
+  return list.map((target, i) => {
+    if (!isObject(target) || !ARCHES.has(target.arch) || (target.libc !== undefined && !["glibc", "musl"].includes(target.libc))) refuse(`targets.linux[${i}] must be { arch: x86_64|aarch64, libc?: glibc|musl }`);
+    return { os: "linux", arch: target.arch, ...(target.libc ? { libc: target.libc } : {}) };
+  });
+}
+
+/** Whether one hosted runtime can qualify one declared target: Linux, the same architecture, the same libc when the target names one, and available now. */
+export function runtimeCompatible(runtime, target) {
+  return isObject(runtime) && runtime.os === "linux" && runtime.available === true && runtime.arch === target.arch && (target.libc === undefined || runtime.libc === target.libc);
+}
+
+/**
+ * The qualifier for each declared target, or the reason it waits. `hosts` is the Mac and Dell's hosted Linux runtimes `[{ host: "dell"|"mac", runtime: { kind, os, arch, libc?, available } }]`.
+ * `{ state: "NOT_APPLICABLE" }` when nothing is declared; `{ state: "QUALIFIER", assignments }` when every declared target has a compatible hosted runtime (the Dell first, then the Mac, so the
+ * choice is stable); `{ state: "WAITING", assignments, missing }` otherwise. Never CI, never a rebuild.
+ */
+export function selectLinuxQualifier({ config, hosts }) {
+  const targets = declaredLinuxTargets(config);
+  if (targets.length === 0) return { state: "NOT_APPLICABLE", reason: "the manifest declares no Linux target: no Linux artifact or qualification is created" };
+  const ordered = [...(hosts ?? [])].filter((h) => HOSTS.includes(h?.host)).sort((a, b) => HOSTS.indexOf(a.host) - HOSTS.indexOf(b.host));
+  const assignments = []; const missing = [];
+  for (const target of targets) {
+    const hit = ordered.find((h) => runtimeCompatible(h.runtime, target));
+    if (hit) assignments.push({ target, host: hit.host, runtime: { kind: hit.runtime.kind, os: "linux", arch: hit.runtime.arch, ...(hit.runtime.libc ? { libc: hit.runtime.libc } : {}) } });
+    else missing.push({ target, reason: ordered.length ? `no hosted Linux runtime of ${ordered.map((h) => `${h.host}:${h.runtime?.arch ?? "?"}${h.runtime?.available === true ? "" : " (unavailable)"}`).join(", ")} is compatible with ${target.arch}${target.libc ? `/${target.libc}` : ""}` : "no Mac or Dell hosted Linux runtime is registered" });
+  }
+  return missing.length ? { state: "WAITING", assignments, missing } : { state: "QUALIFIER", assignments };
+}
+
+const digest = (text) => createHash("sha256").update(text).digest("hex");
+
+/** The pending record of a Linux candidate that has no qualifier yet: it keeps everything a later qualification must bind to, and discards nothing. */
+export function pendingCandidate({ candidate, artifactSha256, target, policyDigest, missing }) {
+  if (!SHA256.test(candidate ?? "") || !SHA256.test(artifactSha256 ?? "") || !SHA256.test(policyDigest ?? "")) refuse("a pending candidate names its candidate identity, sealed artifact digest and pinned policy digest");
+  return { schema: PENDING_SCHEMA, state: "WAITING", candidate, artifactSha256, target, policyDigest, missing: missing ?? [] };
+}
+
+/**
+ * Resume a pending candidate from a qualification run. Refuses (the pending record stays WAITING, unchanged) unless the evidence binds the same candidate and the exact sealed bytes, was
+ * produced by a runtime compatible with the declared target on a Mac or Dell host, ran under the policy digest pinned before the run, rebuilt nothing, and executed every expected check with a
+ * pass: a missing, skipped or failed check, an empty suite or a changed policy fails.
+ */
+export function resumeCandidate(pending, evidence) {
+  if (!isObject(pending) || pending.schema !== PENDING_SCHEMA || pending.state !== "WAITING") refuse("only a pending (WAITING) Linux candidate can be resumed");
+  if (!isObject(evidence)) refuse("the qualification evidence is not an object");
+  if (evidence.candidate !== pending.candidate) refuse("the evidence is for another candidate");
+  if (evidence.artifactSha256 !== pending.artifactSha256) refuse(`the evidence qualified ${String(evidence.artifactSha256).slice(0, 12)}, not the sealed ${pending.artifactSha256.slice(0, 12)}: the exact sealed bytes are qualified, never a rebuild`);
+  if (evidence.rebuilt === true) refuse("the qualifier rebuilt the bytes: sealed Linux bytes are qualified unchanged");
+  if (!HOSTS.includes(evidence.host)) refuse(`the qualifier host ${JSON.stringify(evidence.host)} is not the Mac or the Dell`);
+  if (!runtimeCompatible({ ...evidence.runtime, available: true }, pending.target)) refuse("the qualifier's runtime is not compatible with the declared target");
+  if (evidence.policyDigest !== pending.policyDigest) refuse("the qualification ran under another policy than the one pinned before the run");
+  const expected = evidence.expectedChecks; const executed = evidence.checks;
+  if (!Array.isArray(expected) || expected.length === 0) refuse("an empty mandatory suite is never a qualification");
+  if (!Array.isArray(executed)) refuse("the evidence carries no executed checks");
+  for (const id of expected) {
+    const run = executed.filter((c) => c?.id === id);
+    if (run.length !== 1) refuse(`expected check ${id} was ${run.length === 0 ? "not executed" : "executed more than once"}`);
+    if (run[0].result !== "pass") refuse(`check ${id} is ${run[0].result}`);
+  }
+  if (executed.some((c) => !expected.includes(c?.id))) refuse("the evidence carries a check the pinned policy does not expect");
+  return { state: "QUALIFIED", candidate: pending.candidate, artifactSha256: pending.artifactSha256, host: evidence.host, evidenceDigest: digest(JSON.stringify(evidence)) };
+}

package/local-publish.mjs

@@ -29,6 +29,7 @@ import { refuseHostUpload } from "./host-upload-refusal.mjs";
 import { pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
 import { recordPublished, stageSourceVersions, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
+import { exclusionsFor, npmContentDigest } from "./pack-digest.mjs";
 import { requireDoorRun, gateStateDir } from "./gate-stages.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
@@ -546,6 +547,16 @@ async function publishUnit(parsed, deps, batch) {
   return result.value;
 }
 
+
+/**
+ * The host's scratch root for an npm pack: the disk policy's root (`/Volumes/D/scratch`, `D:\scratch`) where it exists, the system temp directory where it does not
+ * (a hosted runner, a cloud container, any host the disk policy does not govern). The pack destination is always a fresh child of the root that is returned.
+ */
+export function hostScratchRoot(platform, exists = fs.existsSync) {
+  const root = platform === "win32" ? "D:\\scratch" : "/Volumes/D/scratch";
+  return exists(root) ? root : os.tmpdir();
+}
+
 async function* publishUnitStages(parsed, deps, batch) {
   const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
   const { kind, unit, allowIgnored, workspaceRoot } = parsed;
@@ -559,6 +570,10 @@ async function* publishUnitStages(parsed, deps, batch) {
   // Every pnpm step goes through the one door for build and test launches (build-launch.mjs): a rightkit-pnpm broker job on a
   // managed host (refused, never run directly, when the broker is unreachable), direct on a host without one. A run headed to release
   // then also has the signed receipt each stage owes (stage-commands.mjs). Other commands (cargo is already a broker job) are unchanged.
+  // A release-bound stage carries its nonce in RIGHTKIT_ATTEST_STAGE_NONCE (unit-gate.mjs stageEnv), which is no carrier variable. Every pnpm
+  // and Cargo step of a snapshot stage is a carried request of its own (build-launch.mjs routes pnpm to the carried adapter runner, carried-cargo.mjs
+  // runCarriedAdapter), and each derives its per-call nonce from the stage nonce (snapshot-broker.mjs carryBrokerAdapter and carryBrokerCargo,
+  // rightkit#1301 B8), so nothing is given the stage nonce itself and no step sets RUSTRIGHT_ATTEST_NONCE.
   const run = (command, args, options) => {
     const target = command === "pnpm" ? buildLaunch(command, args, { env: options?.env ?? process.env, platform: deps.platform ?? process.platform, exists: fs.existsSync }) : { command, args };
     const result = launch(target.command, target.args, options);
@@ -668,22 +683,20 @@ async function* publishUnitStages(parsed, deps, batch) {
   if (packageEnv) Object.assign(env, testEnv({ env: packageEnv }, isAssetGated));
 
   // 3. Pack the artifact and hash it.
-  // An npm pack is a broker job whose --dir and --pack-destination the adapter accepts only under the host's scratch root, so it
-  // packs there (the workspace rule for run output) rather than in the OS temp directory.
-  const scratchRoot = deps.tmpdir ?? (kind === "npm" ? (platform === "win32" ? "D:\\scratch" : "/Volumes/D/scratch") : os.tmpdir());
+  // An npm pack is a broker job whose --pack-destination the adapter accepts only as an empty child of the host's scratch root, so the
+  // tarball goes there (the workspace rule for run output) rather than in the OS temp directory; the package itself is packed from the
+  // snapshot (relative --dir).
+  const scratchRoot = deps.tmpdir ?? (kind === "npm" ? hostScratchRoot(platform, deps.exists ?? fs.existsSync) : os.tmpdir());
   const scratch = fs.mkdtempSync(path.join(scratchRoot, "rk-local-publish-"));
   const cleanup = () => fs.rmSync(scratch, { recursive: true, force: true });
   try {
     let artifactFile; const packCommands = [];
-    let packDir = dir;
     if (kind === "npm" && unit === SWAP_HELPER_PACKAGE) {
-      if (parsed.qualifyOnly) {
-        // Signing writes its binary and receipt. Keep both in the pack copy, never the source checkout.
-        packDir = path.join(scratch, "package-source");
-        fs.cpSync(unitPath, packDir, { recursive: true, filter: (source) => path.basename(source) !== "node_modules" });
-      }
-      // #258: the package ships a Developer-ID-signed bin/darwin/rightkit-swap; build, sign and verify it before packing (fails closed).
-      try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: parsed.qualifyOnly ? packDir : unitPath, platform, run, env, log }); }
+      // #258: the package ships a Developer-ID-signed bin/darwin/rightkit-swap; build, sign and verify it before packing (fails closed). The
+      // helper and its signing receipt are written into the unit's own directory of the snapshot (packages/release/bin/darwin, both ignored by
+      // packages/release/.gitignore): declared stage outputs of this stage, recorded by the gate's stage-output ledger (stage-ledger.mjs) like
+      // any ignored generated file, never a copy of the package kept outside the snapshot, so the pack below runs from the snapshot.
+      try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: unitPath, platform, run, env, log }); }
       catch (error) { refuse(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
       packCommands.push(`rustright cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
     }
@@ -695,7 +708,9 @@ async function* publishUnitStages(parsed, deps, batch) {
       // child of a scratch directory (never the scratch directory itself) and refuses one that already holds a tarball.
       const packOut = path.join(scratch, "pack");
       fs.mkdirSync(packOut);
-      const args = npmPackArgs(packDir, packOut);
+      // `--dir` is the unit's directory RELATIVE to the repository root, where the step runs: a snapshot-bound adapter job refuses an absolute --dir; only
+      // --pack-destination is outside the snapshot (an empty child of the scratch directory).
+      const args = npmPackArgs(dir, packOut);
       packCommands.push(`pnpm ${args.join(" ")}`);
       const packed = await run("pnpm", args, { cwd: workspaceRoot, env });
       if (packed.error || packed.status !== 0) refuse(`pnpm pack failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
@@ -725,6 +740,7 @@ async function* publishUnitStages(parsed, deps, batch) {
       if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
     }
     const artifactSha256 = sha256(fs.readFileSync(artifactFile));
+    let contentSha256 = null, contentExcluded = [];
     if (parsed.qualifyOnly && (git(["rev-parse", "HEAD"], workspaceRoot) !== head || git(["status", "--porcelain", "--", ...guardedPaths], workspaceRoot) !== "")) refuse("qualification inputs changed while preparing the artifact; no bundle was created");
     if (parsed.qualifyOnly) {
       fs.mkdirSync(parsed.bundleDir, { recursive: false });
@@ -732,7 +748,13 @@ async function* publishUnitStages(parsed, deps, batch) {
       fs.copyFileSync(artifactFile, bundledArtifact, fs.constants.COPYFILE_EXCL);
       if (sha256(fs.readFileSync(bundledArtifact)) !== artifactSha256) refuse("qualification archive changed while copying");
       artifactFile = bundledArtifact;
-      yield { stage: "package", kind, name: unit, version, commit: head, artifactFile, artifactSha256, brokerRequests: brokerRequests.splice(0) };
+      // An npm archive is bound hosted by what it ships (pack-digest.mjs), not by its bytes; the swap helper and its signing receipt are
+      // the only entries left out, for @rightkit/release alone, and their presence is recorded.
+      if (kind === "npm") {
+        try { const digest = npmContentDigest(artifactFile, { exclude: exclusionsFor(unit) }); contentSha256 = digest.contentSha256; contentExcluded = Object.keys(digest.excluded).sort(); }
+        catch (error) { refuse(`${unit}: cannot read the packed archive for its content digest (${error.message})`); }
+      }
+      yield { stage: "package", kind, name: unit, version, commit: head, artifactFile, artifactSha256, ...(contentSha256 ? { contentSha256, contentExcluded } : {}), brokerRequests: brokerRequests.splice(0) };
       if (sha256(fs.readFileSync(artifactFile)) !== artifactSha256) refuse("qualification archive changed after packaging");
     }
 
@@ -767,7 +789,7 @@ async function* publishUnitStages(parsed, deps, batch) {
       // Bytes and evidence stay together outside the checkout.
       const bundledEvidence = evidencePath;
       log(`[right-release] qualified ${unit}@${version}; bundle ${parsed.bundleDir}${kind === "cargo" ? `; publish cargo --crate ${unit} --from-evidence ${bundledEvidence}` : ""}`);
-      return { kind, name: unit, version, commit: head, artifactSha256, evidencePath: bundledEvidence, artifactFile, qualifiedOnly: true };
+      return { kind, name: unit, version, commit: head, artifactSha256, ...(contentSha256 ? { contentSha256, contentExcluded } : {}), evidencePath: bundledEvidence, artifactFile, qualifiedOnly: true };
     }
 
     // 5. The EXISTING publish path.

package/local-runtime.mjs

@@ -33,7 +33,7 @@ const round3 = (value) => Math.round(value * 1000) / 1000;
 const tail = (text, lines = 30) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
 const loadFromRoot = (root, ...segments) => import(pathToFileURL(path.join(root, ...segments)).href);
 const CREDENTIAL_LIKE = /TOKEN|PASSWORD|SECRET|CREDENTIAL|^ACTIONS_ID_TOKEN/i;
-const BROKER_ENV = ["RIGHTKIT_BUILD_BROKER_SOCKET", "RIGHTKIT_CONTROL_ROOT", "RIGHTKIT_DATA_ROOT", "RIGHTKIT_MANAGED_ROOT"];
+const BROKER_ENV = ["RUSTRIGHT_BUILD_BROKER_SOCKET", "RIGHTKIT_BUILD_BROKER_SOCKET", "RIGHTKIT_CONTROL_ROOT", "RIGHTKIT_DATA_ROOT", "RIGHTKIT_MANAGED_ROOT"];
 const BENCH_TIMEOUT_MS = 40 * 60 * 1000;
 
 // ---- host evidence -------------------------------------------------------------------------------
@@ -173,7 +173,7 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const baseEnv = Object.fromEntries(Object.entries(deps.env ?? process.env).filter(([name]) => !CREDENTIAL_LIKE.test(name)));
   const brokerEnv = Object.fromEntries(BROKER_ENV.filter((name) => baseEnv[name]).map((name) => [name, baseEnv[name]]));
   const socket = discoverBrokerSocket(deps.env ?? process.env, { platform });
-  if (socket) brokerEnv.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
+  if (socket) brokerEnv.RUSTRIGHT_BUILD_BROKER_SOCKET = socket;
   const run = deps.run ?? ((command, args, settings) => spawnCollect(command, args, { maxBuffer: 64 * 1024 * 1024, ...settings }));
   const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: crateDir, windowsHide: true, ...settings });
   const toolchainOf = async () => {