@rightkit/release 0.6.12 → 0.6.14

package/pnpm-adapter-grammar.mjs

@@ -0,0 +1,226 @@
+// The door's mirror of the broker's `rightkit-pnpm` adapter grammar (rustright-policy adapter.rs `scan`, `check_argv`, `snapshot_argv_check`,
+// `check_environment`; GB-03 and GB-04 of the gate-vs-broker audit).
+//
+// RustRight owns the registered grammar; RightKit validates every pnpm argv and every request environment against that registration BEFORE it is
+// sent, and refuses with a typed reason naming the registration, so a refusal never costs a mark, a process or a stage. The reference registration
+// is RustRight's `adapters.pnpm` entry of docs/contracts/adapter-argv.fixtures.json (test-support/vectors/, pinned in vectors-source.json): the
+// operator installs exactly that registration, and every accepted and refused row of the vector is judged by `adapterArgvRefusal` here.
+//
+// Facts the planner depends on (the registration, not RightKit inventions): a global flag that takes a value is registered as a flag AND as a leading
+// subcommand token (`--dir`, `-C`, `--filter`); `--if-present` is a `run` option and goes after `run`; everything after the target of `run` or
+// `exec` belongs to the target and is opaque (`run x --flag` and `run x -- --flag` are both admitted, so the gate never rewrites them); `exec`
+// admits only the targets in `opaqueTargets.exec`, never an arbitrary executable.
+//
+// The door reads the LIVE registration when it can (liveAdapterGrammar) and otherwise judges by PNPM_ADAPTER_GRAMMAR, the reference. A test compares
+// the constant with the vector and, on a host that has the registration, with the live entry, so neither can drift without a failing test.
+import fs, { readFileSync } from "node:fs";
+import path from "node:path";
+import { resolveManagedRoots } from "./managed-roots.mjs";
+
+export const PNPM_ADAPTER = "rightkit-pnpm";
+/** The scratch child prefix of a `scratchPackDir` / `scratchPath` value (adapter.rs SCRATCH_CHILD_PREFIX). */
+const SCRATCH_CHILD_PREFIX = "rk-local-publish-";
+
+const frozenList = (v) => Object.freeze(Array.isArray(v) ? v.filter((s) => typeof s === "string") : []);
+
+/**
+ * The reference registration of the pnpm adapter, as RustRight's vector carries it (docs/contracts/adapter-argv.fixtures.json `adapter`, minus the
+ * host's pinned script and scratch root): `subcommands` are the registered first arguments, `flags` the registered flags with their value kind,
+ * `env` the only non-reserved request-environment keys the adapter takes.
+ */
+export const PNPM_ADAPTER_GRAMMAR = Object.freeze({
+  subcommands: Object.freeze(["install", "run", "exec", "pack", "-r", "--dir", "-C", "--filter", "--workspace-concurrency=1"]),
+  flags: Object.freeze({
+    "--dir": "relpathOrScratchPath", "-C": "relpathOrScratchPath", "--filter": "any", "--if-present": "none", "--workspace-concurrency": "int", "--pack-destination": "scratchPackDir",
+  }),
+  positionals: "relpath",
+  env: Object.freeze(["RK_ISOLATED_CHECKOUT", "RIGHTKIT_QA_APP_BINARY", "RIGHTKIT_QA_SIGNING_EVIDENCE"]),
+  opaqueAfterTarget: Object.freeze(["run", "exec"]),
+  opaqueTargets: Object.freeze({ exec: Object.freeze(["tauri"]) }),
+  snapshotSubcommands: Object.freeze(["run", "exec", "pack"]),
+  // The host's scratch root is host configuration (the vector's `{scratch}` placeholder): unknown here, so a scratch-kind value is judged by shape and the
+  // broker's canonical containment check decides (a live registration, which names its root, is judged canonically too).
+  scratchRoot: undefined,
+});
+
+/** The grammar a registered adapter spec declares (the fields the door uses), or null when `spec` is not a usable registration. */
+export function grammarFromSpec(spec) {
+  if (!spec || typeof spec !== "object" || (spec.subcommands !== undefined && spec.subcommands !== null && (!Array.isArray(spec.subcommands) || !spec.subcommands.every((s) => typeof s === "string" && s !== "")))) return null;
+  if (!Array.isArray(spec.flags) || !spec.flags.every((f) => f && typeof f.name === "string" && typeof f.value === "string")) return null;
+  const targets = spec.opaqueTargets && typeof spec.opaqueTargets === "object" && !Array.isArray(spec.opaqueTargets) ? spec.opaqueTargets : {};
+  return Object.freeze({
+    subcommands: Array.isArray(spec.subcommands) ? Object.freeze([...spec.subcommands]) : null,
+    flags: Object.freeze(Object.fromEntries(spec.flags.map((f) => [f.name, f.value]))),
+    positionals: typeof spec.positionals === "string" ? spec.positionals : "none",
+    env: frozenList(spec.env),
+    opaqueAfterTarget: frozenList(spec.opaqueAfterTarget),
+    ...(Array.isArray(spec.positionalValues) ? { positionalValues: frozenList(spec.positionalValues) } : {}),
+    ...(spec.flagPrefixes && typeof spec.flagPrefixes === "object" ? { flagPrefixes: Object.freeze({ ...spec.flagPrefixes }) } : {}),
+    opaqueTargets: Object.freeze(Object.fromEntries(Object.entries(targets).map(([command, list]) => [command, frozenList(list)]))),
+    snapshotSubcommands: frozenList(spec.snapshotSubcommands),
+    scratchRoot: typeof spec.scratchRoot === "string" && spec.scratchRoot !== "" ? spec.scratchRoot : null,
+  });
+}
+
+/** The live registration on this host (the managed control root's config.json, adapters["rightkit-pnpm"]), or null when it cannot be read. */
+export function liveAdapterGrammar({ env = process.env, platform = process.platform, readFile = (file) => readFileSync(file, "utf8"), adapter = PNPM_ADAPTER } = {}) {
+  try {
+    const { configPath } = resolveManagedRoots({ env, platform });
+    return grammarFromSpec(JSON.parse(readFile(configPath))?.adapters?.[adapter]);
+  } catch { return null; }
+}
+
+// ---- value kinds (adapter.rs value_ok / relpath_ok / scratch_shape_ok) ----
+
+const relpathOk = (v) => v !== "" && !v.includes("\0") && !v.startsWith("/") && !v.startsWith("\\") && !(v.length >= 2 && v[1] === ":") && v.split(/[\\/]/).every((part) => part !== "..");
+const isAbsoluteAnywhere = (v) => path.posix.isAbsolute(v) || path.win32.isAbsolute(v) || v.startsWith("\\");
+const scratchShapeOk = (v) => v !== "" && !v.includes("\0") && (path.isAbsolute(v) || path.posix.isAbsolute(v) || path.win32.isAbsolute(v)) && v.split(/[\\/]/).every((part) => part !== "..");
+/** Build settings a caller never sets for an Apple build: they redirect where the build writes (the broker owns the output root) or choose the signing identity (the provisioned signer's). */
+const XCODE_DENIED_SETTINGS = /^(?:SYMROOT|OBJROOT|DSTROOT|BUILD_DIR|BUILD_ROOT|CONFIGURATION_BUILD_DIR|CONFIGURATION_TEMP_DIR|TARGET_BUILD_DIR|SHARED_PRECOMPS_DIR|MODULE_CACHE_DIR|DERIVED_DATA_DIR|CODE_SIGN_IDENTITY|CODE_SIGN_STYLE|OTHER_CODE_SIGN_FLAGS|PROVISIONING_PROFILE(?:_SPECIFIER)?|CODE_SIGN_ENTITLEMENTS|CODE_SIGNING_ALLOWED|CODE_SIGNING_REQUIRED)=/;
+/** CMake cache entries that run or load arbitrary code from a path the caller names. */
+const CMAKE_DENIED_DEFINES = /^(?:CMAKE_COMMAND|CMAKE_MAKE_PROGRAM|CMAKE_PROJECT_INCLUDE(?:_BEFORE)?|CMAKE_MODULE_PATH|CMAKE_PREFIX_PATH|CMAKE_PROGRAM_PATH)[:=]/;
+function valueOk(kind, v) {
+  switch (kind) {
+    case "identifier": return /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/.test(v);
+    case "gradleTask": return /^:?[A-Za-z0-9][A-Za-z0-9_:.-]{0,255}$/.test(v) && !/(?:^|:)(?:publish|upload)|(?:bundle|assemble|install)[A-Za-z0-9]*Release/i.test(v);
+    case "actionOrBuildSetting": return v.includes("=") ? valueOk("buildSetting", v) : valueOk("identifier", v);
+    case "buildSetting": return /^[A-Z][A-Za-z0-9_]*=[^\0]*$/.test(v) && !XCODE_DENIED_SETTINGS.test(v);
+    case "cmakeDefine": return /^[A-Za-z_][A-Za-z0-9_.+-]*(?::[A-Z]+)?=[^\0]*$/.test(v) && !CMAKE_DENIED_DEFINES.test(v);
+    case "none": return false;
+    case "any": return !v.includes("\0");
+    case "int": return v !== "" && /^[0-9]+$/.test(v);
+    case "swiftConfiguration": return v === "debug" || v === "release";
+    case "swiftArch": return v === "arm64" || v === "x86_64";
+    case "relpath": return relpathOk(v);
+    case "scratchPath": case "scratchPackDir": return scratchShapeOk(v);
+    case "relpathOrScratchPath": return relpathOk(v) || scratchShapeOk(v);
+    default: return false;
+  }
+}
+const needsScratchCheck = (kind, v) => kind === "scratchPath" || kind === "scratchPackDir" || (kind === "relpathOrScratchPath" && !relpathOk(v));
+
+/** adapter.rs `scratch_canonical_ok`: the value exists and, resolved, is strictly inside an `rk-local-publish-*` child of the scratch root (a pack dir: an empty-of-tgz directory). */
+function scratchCanonicalProblem(root, value, packDir, { realpath = (p) => fs.realpathSync.native(p), stat = (p) => fs.statSync(p), list = (p) => fs.readdirSync(p) } = {}) {
+  if (!scratchShapeOk(value)) return "must be an absolute path with no '..'";
+  let canonicalRoot; let canonical;
+  try { canonicalRoot = realpath(root); } catch (e) { return `the scratch root cannot be resolved: ${e.message}`; }
+  try { canonical = realpath(value); } catch (e) { return `cannot be resolved: ${e.message}`; }
+  const rel = path.relative(canonicalRoot, canonical);
+  if (rel === "" ) return "is the scratch root itself";
+  if (rel.startsWith("..") || path.isAbsolute(rel)) return "resolves outside the scratch root";
+  const parts = rel.split(path.sep);
+  if (!parts[0].startsWith(SCRATCH_CHILD_PREFIX)) return `is not inside a ${SCRATCH_CHILD_PREFIX}* child of the scratch root`;
+  if (parts.length < 2) return "is the scratch child itself; it must be strictly inside it";
+  if (packDir) {
+    try { if (!stat(canonical).isDirectory()) return "must be an existing directory"; if (list(canonical).some((n) => n.toLowerCase().endsWith(".tgz"))) return "must hold no .tgz yet"; } catch (e) { return `cannot be read: ${e.message}`; }
+  }
+  return null;
+}
+
+const flagNameOf = (word) => (word.startsWith("--") && word.includes("=") ? word.slice(0, word.indexOf("=")) : word);
+
+/**
+ * The pure pass of adapter.rs `scan`: every argument is a registered flag (with its value), a positional of the allowed kind, or the first-argument
+ * subcommand. Returns `{ error }` or `{ command, positionals, opaqueTail, flagValues, scratch }`. A subcommand that is also a registered flag
+ * (`--dir`) is read as that flag, so its value is judged by the flag's kind and never taken for a positional.
+ */
+export function scanAdapterArgv(argv, grammar = PNPM_ADAPTER_GRAMMAR) {
+  const args = [...argv].map(String);
+  const found = { command: null, target: null, positionals: [], opaqueTail: [], flagValues: [], scratch: [] };
+  let index = 0; let awaiting = false; let opaque = false; let commandSeen = false;
+  const first = args[0];
+  const name = grammar.adapter ?? PNPM_ADAPTER;
+  if (grammar.subcommands === null) {
+    // No registered first argument (an adapter whose tool takes flags and positionals only, such as gradle, cmake and xcodebuild): the scan starts at the first word.
+    index = 0;
+  } else {
+    if (first === undefined) return { error: "a subcommand is required" };
+    if (!grammar.subcommands.includes(first)) return { error: `subcommand ${JSON.stringify(first)} is not registered for ${name} (registered: ${grammar.subcommands.join(", ")}); a leading flag such as --if-present, --prefix or --config is refused (--if-present goes after \`run\`)` };
+    awaiting = grammar.opaqueAfterTarget.includes(first);
+    commandSeen = !first.startsWith("-");
+    if (commandSeen) found.command = first;
+    index = first.startsWith("-") && Object.hasOwn(grammar.flags, first) ? 0 : 1;
+  }
+  let afterSeparator = false;
+  while (index < args.length) {
+    const word = args[index]; index += 1;
+    if (word.includes("\0")) return { error: "arguments must not contain NUL" };
+    if (opaque) { found.opaqueTail.push(word); continue; }
+    if (!afterSeparator && word === "--") { afterSeparator = true; continue; }
+    if (afterSeparator || !word.startsWith("-") || word === "-") {
+      if (grammar.positionals === "none" || !valueOk(grammar.positionals, word)) return { error: `positional argument ${JSON.stringify(word)} is not allowed` };
+      if (grammar.positionalValues && !word.includes("=") && !grammar.positionalValues.includes(word)) return { error: `positional argument ${JSON.stringify(word)} is not registered for ${grammar.adapter ?? PNPM_ADAPTER} (registered: ${grammar.positionalValues.join(", ")})` };
+      if (needsScratchCheck(grammar.positionals, word)) found.scratch.push(["positional argument", grammar.positionals, word]);
+      found.positionals.push(word);
+      if (awaiting) {
+        awaiting = false; opaque = true; found.target = word;
+        const allowed = grammar.opaqueTargets[found.command ?? ""];
+        if (allowed && !allowed.includes(word)) return { error: `target ${JSON.stringify(word)} is not registered for ${found.command} (registered targets: ${allowed.join(", ")}); an arbitrary executable is never admitted through exec` };
+      } else if (!commandSeen) {
+        commandSeen = true; found.command = word; awaiting = grammar.opaqueAfterTarget.includes(word);
+      }
+      continue;
+    }
+    // A registered flag PREFIX carries its value in the same word (`-DNAME=value`): the rest of the word is the value, judged by the prefix's kind.
+    const prefix = grammar.flagPrefixes ? Object.keys(grammar.flagPrefixes).find((p) => word.startsWith(p) && word.length > p.length) : undefined;
+    if (prefix !== undefined) {
+      const value = word.slice(prefix.length);
+      if (!valueOk(grammar.flagPrefixes[prefix], value)) return { error: `flag ${JSON.stringify(prefix)} has a value of the wrong kind or one ${grammar.adapter ?? PNPM_ADAPTER} never admits (${JSON.stringify(value)})` };
+      found.flagValues.push([`flag ${JSON.stringify(prefix)}`, grammar.flagPrefixes[prefix], value]);
+      continue;
+    }
+    const name = flagNameOf(word);
+    const inline = word.startsWith("--") && word.includes("=") ? word.slice(word.indexOf("=") + 1) : null;
+    if (!Object.hasOwn(grammar.flags, name)) return { error: `flag ${JSON.stringify(name)} is not registered for ${grammar.adapter ?? PNPM_ADAPTER}` };
+    const kind = grammar.flags[name];
+    let value;
+    if (kind === "none") { if (inline !== null) return { error: `flag ${JSON.stringify(name)} takes no value` }; continue; }
+    if (inline !== null) value = inline;
+    else {
+      value = args[index]; index += 1;
+      if (value === undefined) return { error: `flag ${JSON.stringify(name)} needs a value` };
+      if (value.includes("\0")) return { error: "arguments must not contain NUL" };
+    }
+    if (!valueOk(kind, value)) return { error: `flag ${JSON.stringify(name)} has a value of the wrong kind (${kind})` };
+    found.flagValues.push([`flag ${JSON.stringify(name)}`, kind, value]);
+    if (needsScratchCheck(kind, value)) found.scratch.push([`flag ${JSON.stringify(name)}`, kind, value]);
+  }
+  if (awaiting) return { error: "launcher subcommand requires a target" };
+  return found;
+}
+
+/** The pnpm command token the registration reads from `args` (adapter.rs scan's `command`), or null when the argv does not parse. */
+export function pnpmCommandOf(args, grammar = PNPM_ADAPTER_GRAMMAR) {
+  const found = scanAdapterArgv(args, grammar);
+  return found.error ? null : found.command;
+}
+
+/**
+ * Why the broker's pnpm adapter would refuse these arguments, or null (adapter.rs `check_argv`; with `snapshot`, also `snapshot_argv_check`'s
+ * subcommand and relative-path rules). Judged against `grammar` (the live registration, else the reference). A scratch-kind value is checked canonically
+ * against the registration's scratch root when it names one (a value of that kind with no scratch root registered is refused). The tail of an opaque
+ * target is the target's own and is never interpreted here.
+ */
+export function adapterArgvRefusal(words, grammar = PNPM_ADAPTER_GRAMMAR, { snapshot = false, fsOps = {} } = {}) {
+  const found = scanAdapterArgv(words, grammar);
+  if (found.error) return found.error;
+  for (const [what, kind, value] of found.scratch) {
+    if (grammar.scratchRoot === undefined) continue;
+    if (grammar.scratchRoot === null) return `${what}: this adapter registers no scratch root`;
+    const problem = scratchCanonicalProblem(grammar.scratchRoot, value, kind === "scratchPackDir", fsOps);
+    if (problem) return `${what} ${JSON.stringify(value)}: ${problem}`;
+  }
+  if (snapshot) {
+    if (grammar.snapshotSubcommands.length) {
+      if (found.command === null) return "a snapshot-bound call needs a command";
+      if (!grammar.snapshotSubcommands.includes(found.command)) return `subcommand ${JSON.stringify(found.command)} is not allowed in a snapshot-bound call (allowed: ${grammar.snapshotSubcommands.join(", ")})`;
+    }
+    for (const [what, kind, value] of found.flagValues) {
+      if ((kind === "relpath" || kind === "relpathOrScratchPath" || kind === "scratchPath") && isAbsoluteAnywhere(value)) return `${what} ${JSON.stringify(value)} must be relative in a snapshot-bound call`;
+    }
+  }
+  return null;
+}
+
+/** Kept name of the door's pnpm check: the argv judged by `grammar` (a snapshot-bound call when `snapshot`). */
+export const pnpmGrammarRefusal = (words, grammar = PNPM_ADAPTER_GRAMMAR, options = {}) => adapterArgvRefusal(words, grammar, options);

package/progress-control.mjs

@@ -1,4 +1,5 @@
-import { spawn } from "./background-process.mjs";
+import { spawn, spawnSync } from "./background-process.mjs";
+import { brokerClientInvocation } from "./broker-client.mjs";
 
 const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
 export const RELEASE_LIVENESS_OWNER_MARGIN_MS = 5 * 60 * 1000;
@@ -30,7 +31,11 @@ export function releaseProgressLimits(env = process.env, { livenessOwnerTimeoutM
 
 function runRightkitControl(args, { cwd, env, timeoutMs = 30_000 } = {}) {
   return new Promise((resolve) => {
-    const control = spawn("rustright", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    // The client starts the way every gate child starts it (broker-client.mjs): no shell; on Windows the .cmd shim's .exe target.
+    let launch;
+    try { launch = brokerClientInvocation("rustright", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true }, { probe: spawnSync }); }
+    catch (error) { resolve(Object.freeze({ code: 125, output: "", timedOut: false, error: error.message })); return; }
+    const control = spawn(launch.command, launch.args, launch.options);
     let output = "";
     let timedOut = false;
     const append = (chunk) => { output = `${output}${chunk}`.slice(-64 * 1024); };

package/provenance-real-receipt.pins.json

@@ -0,0 +1,7 @@
+{
+  "_comment": "The enrolled pins the golden-vector receipt (provenance-real-receipt.fixture.json, rustright status 36efaa30-..., 2026-10-27) was signed under: the Mac broker key a9eb1cee..., from ci/rk-pipeline.json before RustRight rotated it on 2026-10-29T22:17:21Z (BR15, d367ceb6a). The golden vector is verified against THESE pins, never the live ones, so a rotation of the live pin cannot break it; the live pin is exercised by the optional RIGHTKIT_PROVENANCE_FIXTURE vector.",
+  "host": "Adrians-Mac-Mini.local",
+  "keyId": "a9eb1ceeaa6b1cec899a7e5d01a97a084308a585c3e2c409510d02774ef7134f",
+  "publicKey": "04248e98a439add3f13756be789c4091a5e9735fbe4e85768d394eedbffc685f63ae4ad3e1a68dfee87008955b308dcdf5d142b1a760bf45e4ea0b2d3430c22dcb",
+  "brokerDigest": "2b0d6c901ccbb1c4dee517d9fbec6bfd72d49aede200fae89a7659b8e141853e"
+}

package/provenance-verify.mjs

@@ -6,6 +6,11 @@ import { createHash, createPublicKey, verify } from "node:crypto";
 export const PROVENANCE_SCHEMA = "rustright.provenance.v1";
 export const PROVENANCE_DOMAIN = "rustright-provenance-v1";
 export const QUALIFICATION_NONCE_DOMAIN = "rightkit-qualification-v1";
+export const CARRIED_CALL_NONCE_DOMAIN = "rightkit-carried-call-v1";
+/** The environment variable that carries a release-bound stage's nonce. It is no carrier variable: every carried call, a Cargo call or an
+ * adapter job (a pnpm, node, swift or QA step), derives its own per-call nonce from it (carriedCallNonce) and the broker client never
+ * sees the stage nonce itself; no step takes it as its RUSTRIGHT_ATTEST_NONCE (local-publish.mjs). */
+export const ATTEST_STAGE_NONCE_ENV = "RIGHTKIT_ATTEST_STAGE_NONCE";
 
 export class ProvenanceError extends Error {
   constructor(code, message) { super(message); this.name = "ProvenanceError"; this.code = code; }
@@ -103,12 +108,268 @@ export function verifyProvenance(receipt, pins, expected) {
   return payload;
 }
 
-/** The nonce a unit gate run sets (RIGHTKIT_ATTEST_NONCE) for the broker jobs of one stage; the hosted admission recomputes it from
+// ---- GB-10 / GB-11 / GB-50: the rest of rustright-protocol attestation.rs `verify_receipt` and `verify_receipt_strict`, case for case ----
+// `verifyProvenance` above is the signature, pins, job, nonce and request-digest half. The functions below are the coverage half: a field the receipt carries
+// and the signature does not cover (or the reverse) is refused like a changed one. `verifyReceiptLenient` = both halves (`verify_receipt`);
+// `verifyReceiptStrict` adds the signed result evidence and the BR19 shape (`verify_receipt_strict`), which a gate applies to every compile receipt. The vector
+// docs/contracts/receipt-vectors.v1.json (test-support/vectors/, pinned) is judged here case for case, lenient and strict.
+export const STAGE_EVIDENCE_FIELDS = Object.freeze(["freshness", "attribution", "toolchain"]);
+export const RESULT_EVIDENCE_FIELDS = Object.freeze(["exit", "signal", "timingsMs", "diagnosticsPath"]);
+export const RESULT_TIMING_FIELDS = Object.freeze(["admission", "queue", "bind", "cargo", "afterExitBind", "diagnostics"]);
+export const BR19_EVIDENCE_FIELDS = Object.freeze(["profile", "stage", "resources", "environment"]);
+export const BR19_RESOURCE_FIELDS = Object.freeze(["grantedJobs", "memoryReservation", "priority"]);
+export const RETIRED_RESULT_FIELDS = Object.freeze(["verdict", "refreshed"]);
+const SNAPSHOT_EVIDENCE_NAMES = Object.freeze(["requestId", "brokerVersion", "executor", "commit", "snapshot", "declaredInputDigests", "ownership", "outputDir"]);
+
+const equalValue = (a, b) => (a === undefined || b === undefined ? a === b : canonicalJson(a) === canonicalJson(b));
+const isU64 = (v) => Number.isSafeInteger(v) && v >= 0;
+
+function covered(receipt, payload, key, fields, what) {
+  const evidence = payload[key];
+  if (evidence !== undefined) {
+    for (const name of fields) if (!equalValue(receipt[name], isRecord(evidence) ? evidence[name] : undefined)) refuse("evidence", `receipt ${name} differs from signed ${what}`);
+  } else {
+    const name = fields.find((f) => receipt[f] !== undefined);
+    if (name !== undefined) refuse("evidence", `receipt ${name} is not covered by signed ${what}`);
+  }
+}
+
+/** The coverage half of `verify_receipt`: signed snapshot evidence and nested children equal the receipt's copies; stage, result and BR19 evidence are never one-sided; the retired verdict fields are refused. */
+export function verifyReceiptCoverage(receipt, payload) {
+  const snapshotEvidence = payload.snapshotEvidence;
+  if (snapshotEvidence !== undefined) {
+    for (const name of SNAPSHOT_EVIDENCE_NAMES) if (!isRecord(snapshotEvidence) || snapshotEvidence[name] === undefined || !equalValue(receipt[name], snapshotEvidence[name])) refuse("evidence", `receipt ${name} differs from signed snapshot evidence`);
+    if (!equalValue(receipt.nestedChildren, snapshotEvidence.nestedChildren)) refuse("evidence", "receipt nestedChildren differs from signed snapshot evidence");
+  }
+  covered(receipt, payload, "stageEvidence", STAGE_EVIDENCE_FIELDS, "stage evidence");
+  covered(receipt, payload, "resultEvidence", RESULT_EVIDENCE_FIELDS, "result evidence");
+  covered(receipt, payload, "br19Evidence", BR19_EVIDENCE_FIELDS, "BR19 evidence");
+  for (const name of RETIRED_RESULT_FIELDS) {
+    if (receipt[name] !== undefined || (isRecord(payload.resultEvidence) && payload.resultEvidence[name] !== undefined)) refuse("evidence", `receipt ${name} is a retired verdict-reuse field`);
+  }
+}
+
+/** `verify_receipt`: the signature half and the coverage half. Returns the signed payload. */
+export function verifyReceiptLenient(receipt, pins, expected) {
+  const payload = verifyProvenance(receipt, pins, expected);
+  verifyReceiptCoverage(receipt, payload);
+  return payload;
+}
+
+/** GB-10 `verify_result_evidence`: the signed payload carries `resultEvidence` with exactly exit, signal, timingsMs, diagnosticsPath (null is a value; a missing or extra key is not), timingsMs exactly the six phases, every receipt copy equal. */
+export function verifyResultEvidence(receipt, payload) {
+  const evidence = payload.resultEvidence;
+  if (!isRecord(evidence)) refuse("evidence", "the signed payload carries no result evidence");
+  const extra = Object.keys(evidence).find((name) => !RESULT_EVIDENCE_FIELDS.includes(name));
+  if (extra !== undefined) refuse("evidence", `signed result evidence carries an unknown field ${extra}`);
+  for (const name of RESULT_EVIDENCE_FIELDS) {
+    if (evidence[name] === undefined) refuse("evidence", `signed result evidence lacks ${name}`);
+    if (!equalValue(receipt[name], evidence[name])) refuse("evidence", `receipt ${name} differs from signed result evidence`);
+  }
+  const timings = evidence.timingsMs;
+  if (!isRecord(timings)) refuse("evidence", "signed result evidence timingsMs is not an object");
+  if (Object.keys(timings).length !== RESULT_TIMING_FIELDS.length || RESULT_TIMING_FIELDS.some((name) => !(timings[name] === null || isU64(timings[name])))) refuse("evidence", "signed result evidence timingsMs must hold exactly the contract phases as numbers or null");
+}
+
+const isUnknownValue = (v) => isRecord(v) && Object.keys(v).length === 2 && v.state === "UNKNOWN" && typeof v.reason === "string" && v.reason !== "";
+const nonEmptyString = (v) => typeof v === "string" && v !== "";
+
+/** GB-11 `verify_br19_evidence`: signed `br19Evidence` has exactly profile, stage, resources, environment, equal to the receipt's copies, each well formed (a value or `{state:"UNKNOWN",reason}`; never absent, never an invented zero). */
+export function verifyBr19Evidence(receipt, payload) {
+  const evidence = payload.br19Evidence;
+  if (!isRecord(evidence)) refuse("evidence", "the signed payload carries no BR19 evidence");
+  const extra = Object.keys(evidence).find((name) => !BR19_EVIDENCE_FIELDS.includes(name));
+  if (extra !== undefined) refuse("evidence", `signed BR19 evidence carries an unknown field ${extra}`);
+  for (const name of BR19_EVIDENCE_FIELDS) {
+    if (evidence[name] === undefined) refuse("evidence", `signed BR19 evidence lacks ${name}`);
+    if (!equalValue(receipt[name], evidence[name])) refuse("evidence", `receipt ${name} differs from signed BR19 evidence`);
+  }
+  const bad = (what) => refuse("evidence", `signed BR19 evidence ${what}`);
+  if (!nonEmptyString(evidence.profile)) bad("profile is not a non-empty string");
+  if (!isRecord(evidence.stage) || !nonEmptyString(evidence.stage.name) || !nonEmptyString(evidence.stage.source)) bad("stage needs a name and a source");
+  const resources = isRecord(evidence.resources) ? evidence.resources : {};
+  for (const name of BR19_RESOURCE_FIELDS) {
+    const value = resources[name];
+    if (value === undefined) bad(`resources lacks ${name}`);
+    const typed = name === "priority" ? nonEmptyString(value) : isU64(value);
+    if (!typed && !isUnknownValue(value)) bad(`resources.${name} is neither a value nor UNKNOWN with a reason`);
+  }
+  const environment = isRecord(evidence.environment) ? evidence.environment : {};
+  const names = (key) => Array.isArray(environment[key]) && environment[key].every(nonEmptyString);
+  if (!(typeof environment.digest === "string" && /^[0-9a-f]{64}$/.test(environment.digest) && names("forwarded") && names("dropped"))) bad("environment needs a 64-hex digest and forwarded and dropped name lists");
+}
+
+/** `verify_receipt_strict`: `verifyReceiptLenient`, then the signed result evidence and the BR19 shape. A gate applies it to every compile receipt, never the lenient form alone. */
+export function verifyReceiptStrict(receipt, pins, expected) {
+  const payload = verifyReceiptLenient(receipt, pins, expected);
+  verifyResultEvidence(receipt, payload);
+  verifyBr19Evidence(receipt, payload);
+  return payload;
+}
+
+// ---- RA-03: the cause evidence the broker signs inside `freshness` (rustright-broker cargo_evidence.rs, schema rustright.cause-evidence.v1) ----
+// A census that counts rebuilt units proves nothing about WHY they were rebuilt. The broker therefore signs `freshness.causeEvidence`: a state (complete | incomplete |
+// unavailable), a verdict (explained | unexplained | unknown), the basis the verdict rests on, the typed gaps and the counts. `verifyCauseEvidence` reads it and refuses what
+// is missing, of a schema this gate does not read, or not coherent with itself and with the census fields beside it; `requireExplainedCauses` then refuses every verdict but
+// `explained`. An `unknown` verdict is a typed refusal, never read as zero unexplained units, and a broker that signs no causeEvidence (one that predates the schema) is
+// refused as well: nothing here relaxes for an older installed broker. One implementation serves every caller, so no second copy of the rule can drift.
+export const CAUSE_EVIDENCE_SCHEMA = "rustright.cause-evidence.v1";
+/** The refusal codes of a verdict that is not `explained` (the other cause-evidence refusals are `evidence`, like every malformed signed field). */
+export const CAUSE_UNKNOWN = "cause-unknown";
+export const CAUSE_UNEXPLAINED = "cause-unexplained";
+/** cargo_evidence.rs EXPLAINED_CAUSES: the only causes that explain a rebuilt unit; any other (including `unexplained`, `fingerprint-missing` and one this list does not know) does not. */
+export const EXPLAINED_CAUSES = Object.freeze([
+  "first-build", "toolchain-changed", "source-or-dependency-changed", "env-rustflags-profile-features-or-target-changed",
+  "generation-change", "authorized-eviction", "new-unit", "new-namespace",
+]);
+const CAUSE_STATES = Object.freeze(["complete", "incomplete", "unavailable"]);
+const CAUSE_VERDICTS = Object.freeze(["explained", "unexplained", "unknown"]);
+const CAUSE_BASES = Object.freeze(["reasons", "census-nothing-rebuilt", "nothing-compiled", "none"]);
+const CAUSE_COUNT_FIELDS = Object.freeze(["rows", "rowsDropped", "units", "unexplained", "uncovered"]);
+const shownValue = (v) => { let text; try { text = JSON.stringify(v); } catch { text = undefined; } return text === undefined ? "absent" : text.slice(0, 80); };
+/** cargo_evidence.rs `counted`: a count in a freshness object is a whole number, or a flag standing for one (`true` is one); anything else is no count. */
+const censusCount = (freshness, name) => { const v = freshness[name]; if (typeof v === "boolean") return v ? 1 : 0; return isU64(v) ? v : null; };
+
+/**
+ * Reads `freshness.causeEvidence` of a compile's signed (compact) freshness and returns `{ schema, state, verdict, basis, unavailable, gaps, counts, unexplainedUnits,
+ * unexplainedUnitsTruncated, unexplainedCount }`. Refuses (ProvenanceError `evidence`) when it is absent or null, not an object, of any schema but
+ * rustright.cause-evidence.v1, or when any field is missing or mistyped; when its state, verdict, basis, gaps and counts do not agree with one another
+ * (a verdict of `explained` needs no unexplained unit and no gap; `unknown` is the verdict of unexplained == 0 with a gap; the unit lists and their truncation counts add up
+ * to the counts; truncated reasons and uncovered units are named as gaps); when a basis that read no reasons carries counts, or claims a census the freshness fields
+ * do not show (`census-nothing-rebuilt` needs `available: true` and `notFresh: 0`; `nothing-compiled` needs `available: false` with that reason); when the sibling
+ * `unexplainedCount` is not the projection (`null` exactly when the verdict is unknown, else the unexplained count); and, for a basis of `reasons`, when `causeCounts`
+ * is missing or disagrees with the counts. It judges nothing: see `requireExplainedCauses`.
+ */
+export function verifyCauseEvidence(freshness) {
+  if (!isRecord(freshness)) refuse("evidence", "the receipt carries no freshness object to read cause evidence from");
+  const cause = freshness.causeEvidence;
+  if (cause === undefined || cause === null) refuse("evidence", `freshness carries no causeEvidence: the broker did not say why its units were rebuilt, so nothing is concluded from it (a broker that does not sign ${CAUSE_EVIDENCE_SCHEMA} is refused, never trusted as if it had)`);
+  const bad = (what) => refuse("evidence", `freshness causeEvidence ${what}`);
+  if (!isRecord(cause)) bad("is not an object");
+  if (cause.schema !== CAUSE_EVIDENCE_SCHEMA) bad(`names the schema ${shownValue(cause.schema)}, which this gate does not read (it reads ${CAUSE_EVIDENCE_SCHEMA} only)`);
+  const { state, verdict, basis, unavailable, gaps, counts } = cause;
+  if (!CAUSE_STATES.includes(state)) bad(`has the unknown state ${shownValue(state)}`);
+  if (!CAUSE_VERDICTS.includes(verdict)) bad(`has the unknown verdict ${shownValue(verdict)}`);
+  if (!CAUSE_BASES.includes(basis)) bad(`has the unknown basis ${shownValue(basis)}`);
+  if (typeof cause.historyMigrationNeeded !== "boolean") bad("does not say whether the history needs migration");
+  if (!(unavailable === null || nonEmptyString(unavailable))) bad("unavailable is neither null nor a reason");
+  if (!Array.isArray(gaps) || !gaps.every(nonEmptyString)) bad("gaps is not a list of reasons");
+  if (!isRecord(counts) || CAUSE_COUNT_FIELDS.some((name) => !isU64(counts[name]))) bad(`counts needs ${CAUSE_COUNT_FIELDS.join(", ")} as whole numbers`);
+  for (const [list, truncated, total] of [["unexplainedUnits", "unexplainedUnitsTruncated", counts.unexplained], ["uncoveredUnits", "uncoveredUnitsTruncated", counts.uncovered]]) {
+    if (!Array.isArray(cause[list]) || !cause[list].every((label) => typeof label === "string") || !isU64(cause[truncated])) bad(`${list} and ${truncated} are not a list of labels and a count`);
+    if (cause[list].length + cause[truncated] !== total) bad(`${list} (${cause[list].length}) and ${truncated} (${cause[truncated]}) do not add up to counts (${total})`);
+  }
+  const hasGap = (name) => gaps.includes(name);
+  const unexplained = counts.unexplained;
+  if (basis === "reasons") {
+    if (unavailable !== null) bad("names an unavailability reason although its reasons were read");
+    if (state !== (gaps.length === 0 ? "complete" : "incomplete")) bad(`state ${state} disagrees with its gaps (${gaps.length})`);
+    const expected = unexplained > 0 ? "unexplained" : gaps.length > 0 ? "unknown" : "explained";
+    if (verdict !== expected) bad(`verdict ${verdict} disagrees with its ${unexplained} unexplained unit(s) and ${gaps.length} gap(s) (${expected})`);
+    if (unexplained > counts.units || counts.units > counts.rows) bad("counts are not nested (unexplained <= units <= rows)");
+    if ((counts.rowsDropped > 0) !== hasGap("reasons-truncated")) bad("rowsDropped and the reasons-truncated gap disagree");
+    if ((counts.uncovered > 0) !== hasGap("rebuilt-unit-without-reason")) bad("uncovered and the rebuilt-unit-without-reason gap disagree");
+  } else {
+    if (state !== "unavailable") bad(`state ${state} is not unavailable although no reasons were read (basis ${basis})`);
+    if (!nonEmptyString(unavailable)) bad("states no reason why its reasons were not read");
+    if (CAUSE_COUNT_FIELDS.some((name) => counts[name] !== 0)) bad(`counts reasons that were never read (basis ${basis})`);
+    if (basis === "none") {
+      if (verdict !== "unknown" || !hasGap("log-not-read")) bad("basis none is the typed unknown: verdict unknown with the log-not-read gap");
+    } else {
+      if (verdict !== "explained" || gaps.length !== 0) bad(`basis ${basis} is an explained verdict with no gap`);
+      if (basis === "nothing-compiled" && !(freshness.available === false && freshness.reason === "nothing-compiled")) bad("claims nothing was compiled but the census does not say so");
+      if (basis === "census-nothing-rebuilt" && !(freshness.available === true && censusCount(freshness, "notFresh") === 0 && (censusCount(freshness, "parseErrors") ?? 0) === 0 && (censusCount(freshness, "notFreshPackagesTruncated") ?? 0) === 0)) bad("claims the census rebuilt nothing but the census does not prove it (available, notFresh 0, no parse errors, no truncated list)");
+    }
+  }
+  const projected = verdict === "unknown" ? null : unexplained;
+  if (freshness.unexplainedCount !== projected) refuse("evidence", `freshness unexplainedCount (${shownValue(freshness.unexplainedCount)}) is not the projection of causeEvidence (${projected === null ? "null, because the verdict is unknown" : projected})`);
+  if (basis === "reasons") {
+    const causes = freshness.causeCounts;
+    if (!isRecord(causes) || !Object.values(causes).every(isU64)) refuse("evidence", "freshness causeCounts is missing or not a count per cause although causeEvidence read reasons");
+    let total = 0; let unexplainedRows = 0;
+    for (const [name, n] of Object.entries(causes)) { total += n; if (!EXPLAINED_CAUSES.includes(name)) unexplainedRows += n; }
+    if (total !== counts.rows) refuse("evidence", `freshness causeCounts add up to ${total} reason(s), not causeEvidence counts.rows (${counts.rows})`);
+    if ((unexplainedRows > 0) !== (unexplained > 0) || unexplained > unexplainedRows) refuse("evidence", `freshness causeCounts name ${unexplainedRows} row(s) without an explained cause, which cannot give ${unexplained} unexplained unit(s)`);
+  }
+  return {
+    schema: cause.schema, state, verdict, basis, unavailable, gaps: [...gaps], counts: { ...counts },
+    unexplainedUnits: [...cause.unexplainedUnits], unexplainedUnitsTruncated: cause.unexplainedUnitsTruncated, unexplainedCount: projected,
+  };
+}
+
+/**
+ * The gate's warm judgment over a compile's signed freshness: `verifyCauseEvidence`, then a refusal for every verdict but `explained`. `unknown` (a quiet, caller-logged
+ * or artifact-running root whose log was not read, dropped output, an unattributable or uncovered unit) is refused as `cause-unknown`; `unexplained` (a unit
+ * rebuilt with no explained cause) as `cause-unexplained`, naming the units the receipt kept. Returns the verified evidence only when the verdict is `explained`.
+ */
+export function requireExplainedCauses(freshness) {
+  const cause = verifyCauseEvidence(freshness);
+  if (cause.verdict === "unknown") {
+    const why = cause.unavailable ?? cause.gaps[0] ?? "unknown";
+    refuse(CAUSE_UNKNOWN, `the broker could not say why its rebuilt units were rebuilt (${why}${cause.gaps.length > 0 ? `; gaps: ${cause.gaps.join(", ")}` : ""}): cause evidence is mandatory for a compile, and an unknown cause is never read as no unexplained unit, so the call is unverified`);
+  }
+  if (cause.verdict === "unexplained") {
+    const named = cause.unexplainedUnits.slice(0, 5).map((label) => label.slice(0, 120)).join("; ");
+    refuse(CAUSE_UNEXPLAINED, `${cause.counts.unexplained} rebuilt unit(s) have no explained cause (${named}${cause.counts.unexplained > 5 || cause.unexplainedUnitsTruncated > 0 ? "; more not listed" : ""}): a rebuild the broker cannot explain is not a success`);
+  }
+  return cause;
+}
+
+// ---- GB-50: the full attribution a Clippy (or check) route needs, read from the signed detail descriptor, never from the compact counts ----
+export const STAGE_EVIDENCE_SCHEMA = "rustright.stage-evidence/1";
+
+/**
+ * `rustright_protocol::attestation::verify_attribution_detail(receipt, file_bytes)`, case for case (vector attribution-detail-vectors.v1.json). `receipt` is a
+ * receipt `verifyReceiptStrict` already accepted (so its compact `attribution`, `toolchain` and the descriptor's sha256 are signed) and `bytes` the evidence file the
+ * descriptor names. Checks in order: the descriptor is present and `bytes` hash to its sha256 (`detail`); the schema is rustright.stage-evidence/1 (`schema`); the
+ * file's `id` is this receipt's request (`job`) and its `toolchain` the receipt's (`evidence`); its attribution is available, `truncated` is exactly 0 in the file and in
+ * the compact twin (`truncated`); every row names package, target and kind with numeric errors and warnings; the compact `units`, `packages`, `errors`, `warnings`,
+ * `otherMessages` and `freshUnits` equal the values recomputed from the rows. Returns `{ rows, failedUnits }`. Counts alone never pass.
+ */
+export function verifyAttributionDetail(receipt, bytes) {
+  const compact = receipt?.attribution;
+  if (!isRecord(compact)) refuse("evidence", "the receipt carries no attribution");
+  const descriptor = compact.detail;
+  if (!isRecord(descriptor) || typeof descriptor.sha256 !== "string" || typeof descriptor.path !== "string") refuse("detail", "the attribution names no evidence file");
+  if (sha256Hex(bytes) !== descriptor.sha256) refuse("detail", "the evidence file is not the one the receipt signed");
+  let document;
+  try { document = JSON.parse(Buffer.from(bytes).toString("utf8")); } catch { refuse("malformed", "the evidence file is not JSON"); }
+  if (!isRecord(document) || document.schema !== STAGE_EVIDENCE_SCHEMA) refuse("schema", "unknown stage evidence schema");
+  if (typeof document.id !== "string" || document.id !== receipt.id) refuse("job", "the evidence file is for another request");
+  if (typeof document.toolchain !== "string" || document.toolchain !== receipt.toolchain) refuse("evidence", "the evidence file names another toolchain than the receipt");
+  const attribution = document.attribution;
+  if (!isRecord(attribution) || attribution.available !== true) refuse("evidence", "the evidence file holds no available attribution");
+  if (!isU64(attribution.truncated)) refuse("evidence", "the evidence file does not say whether the attribution is complete");
+  if (attribution.truncated !== 0 || compact.truncated !== 0) refuse("truncated", "the attribution is truncated or its completeness is not stated");
+  const rows = attribution.units;
+  if (!Array.isArray(rows)) refuse("evidence", "the evidence file holds no unit rows");
+  const packages = new Set(); let errors = 0; let warnings = 0; let other = 0; let fresh = 0; let failedUnits = 0;
+  for (const row of rows) {
+    const text = (name) => (isRecord(row) && typeof row[name] === "string" && row[name] !== "" ? row[name] : null);
+    const count = (name) => (isRecord(row) && isU64(row[name]) ? row[name] : null);
+    const [pkg, target, kind, e, w] = [text("package"), text("target"), text("kind"), count("errors"), count("warnings")];
+    if (pkg === null || target === null || kind === null || e === null || w === null) refuse("evidence", "a unit row lacks its package, target, kind, errors or warnings");
+    packages.add(pkg); errors += e; warnings += w; other += count("otherMessages") ?? 0; fresh += row.fresh === true ? 1 : 0; failedUnits += e > 0 ? 1 : 0;
+  }
+  const derived = { units: rows.length, packages: packages.size, errors, warnings, otherMessages: other, freshUnits: fresh };
+  for (const [name, value] of Object.entries(derived)) if (compact[name] !== value) refuse("evidence", `the receipt's compact attribution ${name} disagrees with the evidence file's rows`);
+  return { rows, failedUnits };
+}
+
+/** The stage nonce a unit gate run sets (RIGHTKIT_ATTEST_STAGE_NONCE) for the broker jobs of one stage; the hosted admission recomputes it from
  * what it knows of the dispatched commit, so a receipt of another commit, tree, unit or stage cannot match. 64 lowercase hex. */
 export function qualificationNonce({ commit, tree, unit, stage }) {
   return sha256Hex(`${QUALIFICATION_NONCE_DOMAIN}\n${commit}\n${tree}\n${unit}\n${stage}`);
 }
 
+/** The nonce of one carried cargo call of a stage (rightkit#1301 B8): derived from the stage nonce, the directory of the repository the call
+ * runs in (`.` or `crates/x`, posix, relative) and the argv it sends (the locked words, no `cargo`), so a call's receipt binds the stage,
+ * the directory and the command, and a stage nonce is never itself a carrier nonce. 64 lowercase hex. The gate derives it per call
+ * (snapshot-broker.mjs carryBrokerCargo) and the hosted admission recomputes it from each stage row. */
+export function carriedCallNonce({ stageNonce, cwd, argv }) {
+  return sha256Hex(`${CARRIED_CALL_NONCE_DOMAIN}\n${stageNonce}\n${cwd}\n${canonicalJson([...argv])}`);
+}
+
 /** Broker request ids the client prints (`rustright: request <id>`) in one command's output. */
 export function brokerRequestIds(text) {
   return [...String(text ?? "").matchAll(/^rustright: request ([0-9a-f-]{36})/gm)].map((m) => m[1]);

package/publication-outcomes.mjs

@@ -0,0 +1,21 @@
+// The one definition of a SUCCESSFUL publication row (GB-45; GATE E9, same-bytes retry reconciliation), shared by its producer (scripts/ci/upload.mjs
+// writes the rows) and its consumer (unit-gate.mjs reads them back). A leaf module: node builtins only.
+//
+// Two outcomes are success, and both mean the registry serves the sealed bytes: `published` (this attempt sent them and read them back) and
+// `published-by-earlier-attempt` (an earlier attempt sent them; this attempt found the exact version AND hash on the registry before sending
+// anything, and `publishedBy: "earlier-attempt"` says so). A generic "already exists" answer is neither: the producer only records the second after
+// reconcileUnit proved the same bytes, and the consumer still reads the registry back itself against the row's hash.
+export const PUBLISHED = "published";
+export const PUBLISHED_BY_EARLIER_ATTEMPT = "published-by-earlier-attempt";
+export const SUCCESSFUL_PUBLICATION_OUTCOMES = Object.freeze([PUBLISHED, PUBLISHED_BY_EARLIER_ATTEMPT]);
+
+/** Why `row` is not a verified successful publication row, or null when it is. */
+export function publicationRowProblem(row) {
+  if (!row || typeof row !== "object") return "no row";
+  if (row.published !== true) return "it is not recorded as published";
+  if (row.registryVerified !== true) return "it is not registry-verified";
+  if (!SUCCESSFUL_PUBLICATION_OUTCOMES.includes(row.outcome)) return `its outcome is ${JSON.stringify(row.outcome ?? null)}, not one of ${SUCCESSFUL_PUBLICATION_OUTCOMES.join(" or ")}`;
+  if (!/^[0-9a-f]{64}$/.test(row.sha256 ?? "")) return "it carries no sha256";
+  if (row.outcome === PUBLISHED_BY_EARLIER_ATTEMPT && row.publishedBy !== "earlier-attempt") return "its provenance is ambiguous (a reconciled prior publication must name publishedBy: earlier-attempt)";
+  return null;
+}

package/publish-update.mjs

@@ -17,6 +17,7 @@ import { verifyPlatformTrust } from "./github-release.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
 import { RIGHT_SUITE_API_ORIGIN, RIGHT_SUITE_GATED_ARTIFACT_HOST, RIGHT_SUITE_PUBLIC_INSTALLER_BASE } from "./suite-api.generated.mjs";
 import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, assertUpdaterSignature, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease, resolveUpdaterTrust } from "./github-updater-release.mjs";
+import { platformDirOf } from "./platform-dir.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.RIGHTAPPS_API_URL || RIGHT_SUITE_API_ORIGIN;
@@ -71,7 +72,7 @@ if (!dryRun || releaseId) {
   assertPrimaryReleaseCheckout(repoRoot);
   const commit = git(["rev-parse", "HEAD"]);
   assertCleanSource({ status: git(["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release publish-update" });
-  sealed = verifyPublicationRelease({ sealedDir: path.join(repoRoot, ".right-release", "sealed", releaseId, platform === "win" ? "windows" : "mac"), repoRoot, appRoot: root, commit, app: config.app, version: versionForStorage, platform, configPath, releaseId });
+  sealed = verifyPublicationRelease({ sealedDir: path.join(repoRoot, ".right-release", "sealed", releaseId, platformDirOf(platform)), repoRoot, appRoot: root, commit, app: config.app, version: versionForStorage, platform, configPath, releaseId });
   const routes = sealed.manifest.routes?.[githubLane ? "update" : tier] ?? [];
   const configured = githubLane
     ? artifacts.map((item) => ({ ...item, key: githubKey(item), role: "updater" }))

package/qa-journeys-prebuilt-run.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// `node qa-journeys-prebuilt-run.mjs <rightkit-qa> -- journeys run <args>`: one `rightkit-qa journeys run` step of a snapshot stage (GB-79, capability
+// `journeys-prebuilt-input`) as the gate's build-once route (qa-journeys-prebuilt.mjs): carry the build, sign the products, hand QA the verified input.
+// build-launch.mjs hands such a step to this entry instead of refusing it.
+import { carriedCargoMapOf } from "./carried-cargo.mjs";
+import { runJourneysPrebuilt } from "./qa-journeys-prebuilt.mjs";
+
+const stop = (message, status = 101) => { process.stderr.write(`rightkit-gate: ${message}\n`); process.exit(status); };
+const [qa, separator, ...args] = process.argv.slice(2);
+if (!qa || separator !== "--") stop("RK_QA_JOURNEYS_USAGE: usage: qa-journeys-prebuilt-run.mjs <rightkit-qa> -- journeys run <args>");
+const carried = carriedCargoMapOf(process.env);
+if (!carried?.map) stop(`RK_QA_JOURNEYS_CARRIER_MISSING: ${carried?.error ?? "no carried map in the environment"}; a snapshot stage's build is never run around its carrier`);
+try {
+  const { status } = runJourneysPrebuilt({ qa, args, map: carried.map });
+  process.exit(status);
+} catch (error) {
+  stop(String(error.message ?? error).startsWith("RK_") ? error.message : `${error.code ?? "RK_QA_JOURNEYS_FAILED"}: ${error.message}`, Number.isInteger(error.status) ? error.status : 101);
+}