@rightkit/release 0.6.12 → 0.6.14

package/suite-signing.mjs

@@ -0,0 +1,223 @@
+// The `sign` step of `tests.suites` (rightkit#1303): a gate-run test build is signed with the product's one signing identity before anything runs it,
+// so a QA run exercises the same code identity the release carries (macOS keys privacy grants to the designated requirement).
+//
+//   { name: "sign-app", sign: { files: [{ from: "build-app", path: "aarch64-apple-darwin/debug/heardright" }, ...] } }
+//
+// It runs IN-PROCESS inside `right-release test`, in the gate's own session and outside the broker (like QA: the signing agent and the Keychain are
+// the session's, a broker job has neither), and it is never a carried step (build-launch.mjs refuses it). It reuses the release signers and adds no
+// ceremony of its own: macOS signs through signMacosEntries, which signs through runMacCodesignCommands (the signing agent) with the identity
+// resolveMacosDevelopmentSigning picks; Windows signs and verifies through sign-windows.mjs (signWindowsFiles, verifyWindowsFiles).
+//
+// What it does, in this order, and refuses at the first thing that is not so:
+//   1. the identity is derived: the product's tauri.conf.json `identifier` (mac install.bundleId must equal it); the team is SIGN_TEAM and the
+//      Windows signer subject SIGN_SUBJECT; ad hoc signing (RIGHTKIT_DEV_SIGNING, install.signing) is refused;
+//   2. each `from` names a suite that ran before in this run; its carried receipt's output directory holds `path` (a path that leaves it, by `..` or
+//      a link, is refused);
+//   3. the file is copied (sha256 checked) into a gate-managed directory outside the snapshot, the checkout and every broker output directory, and the
+//      copy is signed. The source bytes are never touched;
+//   4. read back from the signed copy: mac `Identifier`, `TeamIdentifier` and the designated requirement, which must EQUAL the release-shaped one
+//      (expectedDesignatedRequirement) and be neither ad hoc nor cdhash-bound; Windows Authenticode with the signer subject;
+//   5. only then the evidence (file, sha256 before and after, identifier, team or subject, requirement) is written, and the main binary's signed copy
+//      becomes RIGHTKIT_QA_APP_BINARY for the suites after it.
+// The main binary (identifier = the bundle id) is the file named by tauri.conf.json `mainBinaryName` when it declares one, else the first file; every
+// other file is a sidecar whose identifier is the release identifier resolveBundleIdentifier gives it (`sign.identifiers` / `identifierTemplate`, keyed
+// `Contents/MacOS/<name>` as in the bundle). RIGHTKIT_QA_APP_BINARY is the main binary's signed copy (unset by a step that signs no main binary).
+import { createHash, randomBytes } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { appendLedger, SCAN_TOKEN_ENV } from "./cargo-ledger.mjs";
+import { carriedCargoMapOf } from "./carried-cargo.mjs";
+import { MacosDevelopmentSigningError, assertStableDesignatedRequirement, expectedDesignatedRequirement, readDevSigningSettings, resolveMacosDevelopmentSigning } from "./development-signing.mjs";
+import { lookupBundlePath, resolveBundleIdentifier } from "./mac-bundle-signing.mjs";
+import { signMacosEntries } from "./mac-sign-core.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+import { resolveManagedRoots } from "./managed-roots.mjs";
+import { isInside, realish } from "./qa-snapshot.mjs";
+import { requireSignerToken, signWindowsFiles, verifyWindowsFiles } from "./sign-windows.mjs";
+import { QA_APP_BINARY_ENV, QA_SIGNED_FILES_ENV, SIGN_SUBJECT, SIGN_TEAM, SuiteSigningError, assertBundleIdMatches, containedRelative, productIdentity } from "./suite-signing-policy.mjs";
+
+const refuse = (code, message, details) => { throw new SuiteSigningError(code, message, details); };
+const sha256 = (file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+const output = (result) => `${result?.stdout ?? ""}\n${result?.stderr ?? ""}`;
+
+/** Where signed copies live: under the managed data root, which the signing agent admits and the gate never builds in. */
+export const defaultSigningDirectory = ({ env = process.env, platform = process.platform } = {}) => path.join(resolveManagedRoots({ env, platform }).dataRoot, "suite-signing");
+
+/** The Authority-independent facts `codesign -dvv` reports. */
+function codesignReport(file, { run, env, root }) {
+  const result = run("codesign", ["-dvv", file], { cwd: root, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false });
+  if (result?.error || result?.status !== 0) refuse("SIGN_READBACK_FAILED", `cannot read the signature of ${file}: ${result?.error?.message || output(result).trim() || `exit ${result?.status ?? "unavailable"}`}`);
+  const text = output(result);
+  return { identifier: /^Identifier=(.+)$/m.exec(text)?.[1]?.trim(), team: /^TeamIdentifier=(.+)$/m.exec(text)?.[1]?.trim(), adhoc: /^Signature=adhoc$/m.test(text) };
+}
+
+/** Mac: sign each copy and read it back against the release-shaped identity. Returns one evidence record per file. */
+function signMac({ copies, name, config, appRoot, env, run, deps, identifier, install, signedDir, mainIndex }) {
+  const settings = readDevSigningSettings(install, config, { root: appRoot });
+  let signing;
+  try { signing = (deps.resolveSigning ?? resolveMacosDevelopmentSigning)({ root: appRoot, bundle: signedDir, descriptor: { manifestPath: install.manifestPath }, config, env, run }); }
+  catch (cause) {
+    if (!(cause instanceof MacosDevelopmentSigningError)) throw cause;
+    // No Developer ID identity with its private key (or an ad hoc / Apple Development request): a refusal, never a fallback.
+    refuse("SIGN_CREDENTIAL_MISSING", `${name}: the Developer ID Application identity of team ${SIGN_TEAM} is not available (${cause.code}): ${cause.message}`, { cause, reason: cause.code });
+  }
+  // Developer ID of the one team, never ad hoc, never Apple Development: a different identity is a different designated requirement.
+  if (signing.adhoc || !/^Developer ID Application:/.test(signing.identity ?? "")) refuse("SIGN_IDENTITY_REFUSED", `suite signing needs the Developer ID Application identity of team ${SIGN_TEAM}; got ${JSON.stringify(signing.identity)}. There is no ad hoc or Apple Development fallback`, { identity: signing.identity });
+  if (signing.teamIdentifier !== SIGN_TEAM || !signing.identity.endsWith(`(${SIGN_TEAM})`)) refuse("SIGN_TEAM_MISMATCH", `suite signing resolved ${JSON.stringify(signing.identity)} (team ${signing.teamIdentifier}), not team ${SIGN_TEAM}`, { identity: signing.identity, team: signing.teamIdentifier });
+  const entries = copies.map((copy, index) => {
+    const relative = `Contents/MacOS/${path.basename(copy.file)}`;
+    let id;
+    if (index === mainIndex) id = identifier;
+    else {
+      try { id = resolveBundleIdentifier({ relative, identifiers: settings.identifiers, template: settings.identifierTemplate, bundleId: identifier, plain: true }); }
+      catch (cause) { refuse("SIGN_SIDECAR_IDENTIFIER", cause.message); }
+    }
+    // A sidecar the release signs with no declared identifier is signed by codesign with no --identifier, which derives the file name: the same here
+    // (nothing is passed), and the read-back expects exactly that name.
+    const entitlements = (index === mainIndex ? lookupBundlePath(settings.entitlements, ".") : undefined) ?? lookupBundlePath(settings.entitlements, relative);
+    return { file: copy.file, ...(id !== undefined ? { identifier: id } : {}), expectedIdentifier: id ?? path.basename(copy.file), ...(entitlements ? { entitlements } : {}) };
+  });
+  const signOne = deps.signOne ?? ((args) => runMacCodesignCommands([args], { env, run, cwd: appRoot })[0]);
+  const inspect = deps.inspect ?? ((command, args) => {
+    const result = run(command, args, { cwd: appRoot, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false });
+    if (result?.error || result?.status !== 0) refuse("SIGN_READBACK_FAILED", `${command} ${args.join(" ")} failed: ${output(result).trim() || result?.error?.message}`);
+    return output(result);
+  });
+  let records;
+  try { records = signMacosEntries(entries.map(({ expectedIdentifier: _derived, ...entry }) => entry), { identity: signing.identity, signOne, inspect, bundle: signedDir }); }
+  catch (cause) { refuse("SIGN_FAILED", `${name}: ${cause.message}`, { cause }); }
+  return records.map((record, index) => {
+    const entry = entries[index];
+    const report = codesignReport(record.file, { run, env, root: appRoot });
+    if (report.adhoc) refuse("SIGN_ADHOC", `${copies[index].path}: the signed copy is ad hoc signed`);
+    if (report.team !== SIGN_TEAM) refuse("SIGN_TEAM_MISMATCH", `${copies[index].path}: TeamIdentifier=${report.team ?? "missing"}, expected ${SIGN_TEAM}`, { team: report.team });
+    if (report.identifier !== entry.expectedIdentifier) refuse("SIGN_IDENTIFIER_MISMATCH", `${copies[index].path}: Identifier=${report.identifier ?? "missing"}, expected ${entry.expectedIdentifier}`, { identifier: report.identifier });
+    const expected = expectedDesignatedRequirement(entry.expectedIdentifier, SIGN_TEAM);
+    let requirement;
+    try { requirement = assertStableDesignatedRequirement({ root: appRoot, installed: record.file, expected, env, run }); }
+    catch (error) { if (!(error instanceof MacosDevelopmentSigningError)) throw error; refuse("SIGN_REQUIREMENT_MISMATCH", `${copies[index].path}: ${error.message}`, { expected, actual: error.installedRequirement }); }
+    // assertStableDesignatedRequirement is silent about an unreadable or cdhash-bound requirement (it has no grants to protect); here either is a refusal.
+    if (requirement !== expected) refuse("SIGN_REQUIREMENT_MISMATCH", `${copies[index].path}: the designated requirement could not be read back, or is cdhash-bound, instead of ${JSON.stringify(expected)}`, { expected });
+    return { platform: "mac", file: copies[index].path, signed: record.file, sha256Before: record.before.sha256, sha256After: record.after.sha256, identifier: entry.expectedIdentifier, team: report.team, identity: signing.identity, requirement };
+  });
+}
+
+/** Windows: sign each copy through sign-windows and check the signer subject. */
+function signWin({ copies, name, env, run, deps }) {
+  let evidence;
+  try {
+    evidence = (deps.signWindows ?? ((files) => signWindowsFiles(files)))(copies.map((copy) => copy.file));
+    if (!Array.isArray(evidence) || evidence.length !== copies.length) refuse("SIGN_FAILED", `${name}: the Windows signer returned ${Array.isArray(evidence) ? evidence.length : "no"} record(s) for ${copies.length} file(s)`);
+    const verified = (deps.verifyWindows ?? ((files) => verifyWindowsFiles(files)))(copies.map((copy) => copy.file));
+    if (!Array.isArray(verified) || verified.length !== copies.length) refuse("SIGN_FAILED", `${name}: the Windows verifier returned ${Array.isArray(verified) ? verified.length : "no"} record(s) for ${copies.length} file(s)`);
+    verified.forEach((record, index) => { if (record.subject !== SIGN_SUBJECT) refuse("SIGN_SUBJECT_MISMATCH", `${copies[index].path}: signer subject ${JSON.stringify(record.subject)}, expected ${SIGN_SUBJECT}`, { subject: record.subject }); });
+    evidence.forEach((record, index) => { if (record.subject !== SIGN_SUBJECT || record.authenticode !== "Valid") refuse("SIGN_SUBJECT_MISMATCH", `${copies[index].path}: signer subject ${JSON.stringify(record.subject)} / ${JSON.stringify(record.authenticode)}, expected ${SIGN_SUBJECT} / Valid`, { subject: record.subject }); });
+  } catch (error) {
+    if (error instanceof SuiteSigningError) throw error;
+    if (error?.code === "SIGN_WINDOWS_TOKEN_UNAVAILABLE") refuse("SIGN_WINDOWS_TOKEN_UNAVAILABLE", `${name}: ${error.message}`, { cause: error });
+    refuse("SIGN_FAILED", `${name}: ${error.message}`, { cause: error });
+  }
+  return evidence.map((record, index) => ({ platform: "win", file: copies[index].path, signed: copies[index].file, sha256Before: record.before.sha256, sha256After: record.after.sha256, subject: record.subject, authenticode: record.authenticode, timestampPresent: record.timestampPresent }));
+}
+
+/** The path of `rel` inside one of `dirs` (receipt output directories), the last that holds a regular file there. A link that leaves the directory is refused. */
+function locateSource(dirs, rel, label) {
+  const found = [];
+  for (const dir of dirs) {
+    const candidate = path.join(dir, ...rel.split("/"));
+    let info;
+    try { info = fs.lstatSync(candidate); } catch { continue; }
+    if (info.isSymbolicLink()) refuse("SIGN_PATH_ESCAPE", `${label}: ${candidate} is a link; a sign step signs the receipt's own file`);
+    if (!info.isFile()) refuse("SIGN_SOURCE_INVALID", `${label}: ${candidate} is not a regular file`);
+    if (!isInside(fs.realpathSync.native(candidate), fs.realpathSync.native(dir))) refuse("SIGN_PATH_ESCAPE", `${label}: ${candidate} resolves outside the receipt's output directory ${dir}`);
+    found.push(candidate);
+  }
+  if (!found.length) refuse("SIGN_SOURCE_MISSING", `${label}: no ${rel} in the output directory of the suite's carried receipt (${dirs.join(", ") || "none recorded"})`);
+  return found.at(-1);
+}
+
+/**
+ * Run one sign step. `outputDirsOf(suite)` returns the verified carried receipts' output directories of an earlier suite of this run, or null when it
+ * did not run. Returns `{ appBinary, evidence, evidenceFile, signedDir }`; throws SuiteSigningError (the step then sets nothing).
+ */
+export function runSignStep({ name, sign, appRoot, config, env = process.env, platform = process.platform, outputDirsOf, deps = {}, log = () => {} }) {
+  const host = platform === "darwin" ? "mac" : platform === "win32" ? "win" : null;
+  const carried = carriedCargoMapOf(env);
+  const record = (entry) => { if (carried?.map) try { appendLedger(carried.map.ledgerDir, env[SCAN_TOKEN_ENV], { id: `sign-${process.pid}-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`, mode: "signing", cwd: appRoot, argv: ["sign", name], ...entry }); } catch (error) { log(`right-release test: cannot record the signing step in the carrier's ledger: ${error.message}`); throw error; } };
+  let signedDir = null;
+  try {
+    if (!host) refuse("SIGN_PLATFORM", `${name}: a sign step runs on macOS (Developer ID) or Windows (Azure Artifact Signing), not ${platform}`);
+    // Windows signer readiness comes first: before the signing directory exists and before any copy, the Azure CLI sign-in must yield a silent token.
+    if (host === "win") {
+      try { (deps.signerPreflight ?? (() => requireSignerToken()))(); }
+      catch (error) {
+        if (error?.code === "SIGN_WINDOWS_TOKEN_UNAVAILABLE") refuse("SIGN_WINDOWS_TOKEN_UNAVAILABLE", `${name}: ${error.message}`, { cause: error });
+        refuse("SIGN_FAILED", `${name}: the Windows signer preflight failed: ${error.message}`, { cause: error });
+      }
+    }
+    // 1. The identity is derived, and ad hoc is never an option.
+    if (env.RIGHTKIT_DEV_SIGNING !== undefined) refuse("SIGN_ADHOC_REFUSED", `${name}: RIGHTKIT_DEV_SIGNING is set; a signed suite build is never ad hoc signed`);
+    const install = config?.development?.targets?.[host]?.install ?? {};
+    if (install.signing !== undefined) refuse("SIGN_ADHOC_REFUSED", `${name}: development.targets.${host}.install.signing ${JSON.stringify(install.signing)} asks for ad hoc signing`);
+    const read = (rel) => { try { return fs.readFileSync(path.resolve(appRoot, rel), "utf8"); } catch { return null; } };
+    const { identifier, mainBinaryName } = productIdentity({ readFile: read, manifestPath: install.manifestPath });
+    assertBundleIdMatches(config, identifier);
+    // 2. Where each file comes from.
+    if (!carried?.map) refuse("SIGN_RECEIPT_MISSING", `${name}: no carried receipts in this environment (${carried?.error ?? "RIGHTKIT_CARRIED_CARGO_MAP is not set"}); a sign step signs a file named by an earlier suite's signed receipt`);
+    if (typeof outputDirsOf !== "function") refuse("SIGN_RECEIPT_MISSING", `${name}: the run has no receipt reader`);
+    const sources = sign.files.map((item, index) => {
+      const file = { ...item, path: containedRelative(item.path, `${name}.files[${index}].path`) };
+      const dirs = outputDirsOf(file.from);
+      if (!dirs) refuse("SIGN_FROM_NOT_RUN", `${name}.files[${index}]: suite ${JSON.stringify(file.from)} did not run before this step in this run`);
+      return { ...file, dirs, source: locateSource(dirs, file.path, `${name}.files[${index}] (${file.from}:${file.path})`) };
+    });
+    // 3. A gate-managed copy, outside everything the build owns.
+    const signingRoot = deps.signingDirectory ?? defaultSigningDirectory({ env, platform });
+    signedDir = path.join(signingRoot, `${name}-${process.pid}-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`);
+    const section = carried.map.broker ?? {};
+    const forbidden = [section.snapshot?.path, section.checkout, env.RK_GATE_CHECKOUT, ...sources.flatMap((source) => source.dirs)].filter((p) => typeof p === "string" && p);
+    for (const place of forbidden) if (isInside(signedDir, place)) refuse("SIGN_COPY_PLACE", `${name}: the signing directory ${signedDir} is inside ${place} (the snapshot, the checkout or a broker output directory)`);
+    fs.mkdirSync(signedDir, { recursive: true, mode: 0o700 });
+    // The copies keep their relative paths under one directory, so a sidecar stays beside the main binary the way the build left them.
+    const taken = new Set();
+    const copies = sources.map((source) => {
+      const file = path.join(signedDir, ...source.path.split("/"));
+      if (taken.has(file)) refuse("SIGN_COPY_COLLISION", `${name}: two files would be copied to ${source.path}; give them different paths`);
+      taken.add(file);
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const before = sha256(source.source);
+      fs.copyFileSync(source.source, file);
+      fs.chmodSync(file, fs.statSync(source.source).mode & 0o777);
+      if (sha256(file) !== before) refuse("SIGN_COPY_MISMATCH", `${name}: the copy of ${source.path} differs from its source`);
+      return { path: source.path, from: source.from, source: source.source, file, sha256: before };
+    });
+    // 4. Sign the copies and read them back.
+    const run = deps.run ?? spawnSync;
+    // The main binary is the file named by the product's `mainBinaryName` when tauri.conf.json declares one (a step that signs only sidecars names none of
+    // them), else the first file. Every other file is a sidecar.
+    let mainIndex = 0;
+    if (mainBinaryName) {
+      const hits = copies.flatMap((copy, index) => (path.basename(copy.path).replace(/\.exe$/i, "") === mainBinaryName ? [index] : []));
+      if (hits.length > 1) refuse("SIGN_MAIN_AMBIGUOUS", `${name}: ${hits.length} files are named ${mainBinaryName}, the product's main binary`);
+      mainIndex = hits.length ? hits[0] : -1;
+    }
+    const evidence = host === "mac"
+      ? signMac({ copies, name, config, appRoot, env, run, deps, identifier, install, signedDir, mainIndex })
+      : signWin({ copies, name, env, run, deps });
+    for (const copy of copies) if (sha256(copy.source) !== copy.sha256) refuse("SIGN_SOURCE_CHANGED", `${name}: the receipt's ${copy.path} changed while it was signed; a sign step never modifies its source`);
+    // 5. Evidence first, then the variable.
+    const evidenceFile = path.join(signedDir, "signing-evidence.json");
+    fs.writeFileSync(evidenceFile, `${JSON.stringify({ schema: 1, step: name, ...(host === "mac" ? { identifier, team: SIGN_TEAM } : { subject: SIGN_SUBJECT }), files: evidence }, null, 2)}\n`);
+    record({ status: "ran", step: name, signing: evidence });
+    // Every signed file by its declared path (main binary and every sidecar), for the consumer that is handed the signed bytes.
+    return { appBinary: mainIndex >= 0 ? copies[mainIndex].file : null, signedFiles: Object.fromEntries(copies.map((copy) => [copy.path, copy.file])), evidence, evidenceFile, signedDir };
+  } catch (error) {
+    // A step that failed leaves no signed copy behind.
+    if (signedDir) { try { fs.rmSync(signedDir, { recursive: true, force: true }); } catch { /* the managed root is pruned */ } }
+    if (error instanceof SuiteSigningError) { try { record({ status: "refused", step: name, code: error.code, message: error.message }); } catch { /* the failure is thrown either way */ } }
+    throw error;
+  }
+}
+
+export { QA_APP_BINARY_ENV, QA_SIGNED_FILES_ENV };

package/swift-scratch.mjs

@@ -0,0 +1,25 @@
+// GB-67: SwiftPM's build state belongs to the broker. For a snapshot-bound `swift build` through the registered swift adapter RustRight appends ONE
+// `--scratch-path <outputDir>/swiftpm/<sha256 of the package's snapshot-relative path>` (the same directory for `build` and `build --show-bin-path` of one
+// package, on every run and platform) and never creates a second `.build`. A caller-supplied `--scratch-path`, `-scratch-path` or `--build-path` (also `=`-spelled) is
+// refused at admission with RK_ADAPTER_ARGV_DENIED and a message naming the canonical route. The gate therefore sends neither, refuses them before anything is sent
+// with the same explanation, and strips nothing silently: the product location is read from `build --show-bin-path`.
+const SCRATCH_OPTIONS = ["--scratch-path", "-scratch-path", "--build-path", "-build-path"];
+export const SWIFT_SCRATCH_REFUSED = "RK_SWIFT_SCRATCH_OWNED";
+
+/** The caller-supplied scratch or build-path option in a swift argv (before any `--`), or null. */
+export function swiftScratchOption(words) {
+  const end = words.indexOf("--");
+  for (const word of end < 0 ? words : words.slice(0, end)) {
+    const w = String(word);
+    const name = w.includes("=") ? w.slice(0, w.indexOf("=")) : w;
+    if (SCRATCH_OPTIONS.includes(name)) return w;
+  }
+  return null;
+}
+
+/** `{ code, message }` when a swift argv names a scratch or build path the broker owns; null otherwise. */
+export function swiftScratchRefusal(words) {
+  const option = swiftScratchOption(words);
+  if (option === null) return null;
+  return { code: SWIFT_SCRATCH_REFUSED, message: `\`swift ${words.join(" ")}\` passes ${option.split("=")[0]}, but the broker owns SwiftPM's build state (it appends the one managed --scratch-path and never creates a second .build); send \`build\` and \`build --show-bin-path\` without it and read the product location from --show-bin-path; nothing is stripped or rewritten, so nothing was sent` };
+}

package/tauri-locked.mjs

@@ -0,0 +1,25 @@
+// The Tauri CLI builds and runs Cargo itself, and an unlocked build can rewrite Cargo.lock inside the snapshot of a commit-only build.
+// RustRight refuses a grant-minted `cargo build` or `cargo run` that carries neither `--locked` nor `--frozen` (rightkit#1301), so in a
+// snapshot stage with a carrier every `tauri build` and `tauri dev` step gets `--locked` forwarded to Cargo.
+//
+// tauri-cli 2.12.4 (confirmed from its source by the coordinator; the exact forwarding form is PENDING RustRight's confirmation):
+//   tauri build -- --locked              puts --locked on `cargo build` (before --bins), both universal-mac builds included;
+//   tauri dev -- --locked                puts it on `cargo run`, before the trailing `--` that run_dev always appends;
+//   tauri dev -- --locked -- <appArgs>   when app arguments are passed, --locked stays before the second `--`.
+// So `--locked` goes right after the first `--` (added with its own `--` when the step has none). A step that already names `--locked`
+// or `--frozen` among the Cargo arguments is left as it is.
+import { carriedCargoMapOf } from "./carried-cargo.mjs";
+
+/** `args` of a step that may run the Tauri CLI, with `--locked` forwarded to Cargo in a carried stage; unchanged otherwise. */
+export function lockedTauriArgs(args, env = process.env) {
+  const list = args.map(String);
+  if (!carriedCargoMapOf(env)?.map) return args;
+  const at = list.indexOf("tauri");
+  if (at < 0 || !["build", "dev"].includes(list[at + 1])) return args;
+  const separator = list.indexOf("--", at + 2);
+  if (separator < 0) return [...list, "--", "--locked"];
+  const own = list.slice(separator + 1);
+  const end = own.indexOf("--");
+  if ((end < 0 ? own : own.slice(0, end)).some((w) => w === "--locked" || w === "--frozen")) return args;
+  return [...list.slice(0, separator + 1), "--locked", ...own];
+}

package/test-command.mjs

@@ -13,6 +13,9 @@
 //       // Expands to journeys-1, journeys-2, ...: the listed journeys run `chunk` at a time in separate processes.
 //       { name: "journeys", node: "scripts/qa-browser-functional.mjs", args: ["--keep-going"],
 //         journeys: { file: "scripts/qa-e2e-journeys.json", key: "journeys", chunk: 12, flag: "--journey" } },
+//       // A sign step (suite-signing.mjs, rightkit#1303): signs what an EARLIER suite built, in-process, with the product's one identity, then
+//       // sets RIGHTKIT_QA_APP_BINARY to the signed copy of the main binary for the suites after it. It is never carried and has no cmd or node.
+//       { name: "sign-app", sign: { files: [{ from: "build-app", path: "aarch64-apple-darwin/debug/heardright" }] } },
 //     ],
 //   }
 //
@@ -21,13 +24,18 @@
 // from the app root. `--suite journeys` selects every chunk of that group. `--runner vitest -- run --project unit` runs
 // the runner once with the arguments after `--` (the watch or one-off case); `-- <args>` after `--suite` is allowed when
 // exactly one suite is selected. Exit code: 0 when every selected suite passed, else the failing suite's exit code.
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { buildLaunch } from "./build-launch.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawn } from "./background-process.mjs";
+import { carriedCargoMapOf, carriedLedgerIds, carriedOutputDirsSince } from "./carried-cargo.mjs";
 import { CommandSpecError, loadAppConfig, resolveInvocation, validateStep } from "./command-spec.mjs";
 import { defaultReleaseConfigFile } from "./release-config.mjs";
+import { fsListRustFiles } from "./signing-files.mjs";
+import { journeysCapabilityRefusal, journeysRunRefusal, qaPrebuiltCapability } from "./qa-journeys-prebuilt.mjs";
+import { SIGN_STEP_KEYS, QA_APP_BINARY_ENV, QA_SIGNING_EVIDENCE_ENV, QA_SIGNED_FILES_ENV, SuiteSigningError, assertPlanSigningPolicy, assertSuiteSigningPolicy, validateSignSpec } from "./suite-signing-policy.mjs";
+import { runSignStep } from "./suite-signing.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
@@ -55,7 +63,7 @@ export function parseTestArgs(argv) {
 }
 
 function mergeRunner(runner, entry) {
-  const { name: _name, runner: _runner, journeys: _journeys, ...own } = entry;
+  const { name: _name, runner: _runner, journeys: _journeys, requires: _requires, ...own } = entry;
   return {
     ...runner,
     ...own,
@@ -110,9 +118,25 @@ export function planTests(config, { suites = [], runner, passthrough = [], appRo
   if (!Array.isArray(tests.suites) || tests.suites.length === 0) fail("tests.suites must be a non-empty list");
   const planned = [];
   const seen = new Set();
+  const declared = new Set();
   tests.suites.forEach((entry, index) => {
     const label = `tests.suites[${index}]`;
-    validateStep(entry, label, ["name", "runner", "journeys"]);
+    // A sign step is data, not a command: `{ name, sign: { files: [{ from, path }] } }`, judged by the policy and run in-process (runSuites).
+    if (isObject(entry) && entry.sign !== undefined) {
+      const extra = Object.keys(entry).filter((key) => !SIGN_STEP_KEYS.includes(key));
+      if (extra.length) throw new SuiteSigningError("SIGN_STEP_SHAPE", `${label} is a sign step and has unknown key(s): ${extra.join(", ")} (allowed: ${SIGN_STEP_KEYS.join(", ")}); it has no cmd, node, args or env`);
+      if (typeof entry.name !== "string" || !NAME.test(entry.name)) fail(`${label}.name must be set (letters, digits, . _ -)`);
+      if (seen.has(entry.name) || declared.has(entry.name)) fail(`${label}: duplicate suite name ${entry.name}`);
+      const sign = validateSignSpec(entry.sign, `${label}.sign`, declared);
+      seen.add(entry.name); declared.add(entry.name);
+      // A sign step needs the suites whose outputs it signs (GB-44): if one of them failed or was skipped, there is nothing to sign.
+      planned.push({ name: entry.name, group: entry.name, sign, step: null, extraArgs: [], requires: [...new Set(sign.files.map((file) => file.from))] });
+      return;
+    }
+    validateStep(entry, label, ["name", "runner", "journeys", "requires"]);
+    // `requires` (GB-44): the earlier suites (by name or group) whose success this suite's inputs depend on; it is skipped, with the reason recorded,
+    // when one of them failed or was skipped, while every independent suite still runs.
+    if (entry.requires !== undefined && (!Array.isArray(entry.requires) || entry.requires.some((r) => typeof r !== "string" || !declared.has(r)))) fail(`${label}.requires must be a list of earlier suite names`);
     if (typeof entry.name !== "string" || !NAME.test(entry.name)) fail(`${label}.name must be set (letters, digits, . _ -)`);
     if (entry.runner !== undefined && !runners[entry.runner]) fail(`${label}.runner names an undeclared runner: ${entry.runner}`);
     const base = mergeRunner(entry.runner === undefined ? undefined : runners[entry.runner], entry);
@@ -120,10 +144,12 @@ export function planTests(config, { suites = [], runner, passthrough = [], appRo
     const variants = entry.journeys === undefined
       ? [{ name: entry.name, extra: [] }]
       : expandJourneys(entry.journeys, label, appRoot).map((extra, chunk) => ({ name: `${entry.name}-${chunk + 1}`, extra }));
+    if (declared.has(entry.name)) fail(`${label}: duplicate suite name ${entry.name}`);
+    declared.add(entry.name);
     for (const variant of variants) {
       if (seen.has(variant.name)) fail(`${label}: duplicate suite name ${variant.name}`);
       seen.add(variant.name);
-      planned.push({ name: variant.name, group: entry.name, step: { ...base, args: [...base.args, ...variant.extra] }, extraArgs: [] });
+      planned.push({ name: variant.name, group: entry.name, step: { ...base, args: [...base.args, ...variant.extra] }, extraArgs: [], ...(Array.isArray(entry.requires) ? { requires: [...entry.requires] } : {}) });
     }
   });
   let selected = planned;
@@ -134,11 +160,21 @@ export function planTests(config, { suites = [], runner, passthrough = [], appRo
   }
   if (passthrough.length) {
     if (selected.length !== 1) fail("arguments after -- need exactly one selected suite (or use --runner)");
+    if (selected[0].sign) fail("arguments after -- cannot go to a sign step");
     selected = [{ ...selected[0], extraArgs: [...passthrough] }];
   }
   return selected;
 }
 
+/** The refusal code of a planned `rightkit-qa journeys run` suite (GB-79). */
+export const QA_JOURNEYS_UNSUPPORTED = "RK_QA_JOURNEYS_PREBUILT_UNSUPPORTED";
+/** True when a suite step is `rightkit-qa journeys run ...` (by command or by node script name, extra args included). */
+export function qaJourneysRunStep(step, extraArgs = []) {
+  const words = [step.cmd ?? step.node, ...(step.args ?? []), ...extraArgs].filter((w) => typeof w === "string").map((w) => w.replaceAll("\\", "/"));
+  const at = words.findIndex((w) => /(^|\/)rightkit-qa(\.exe)?$/.test(w));
+  return at >= 0 && words[at + 1] === "journeys" && words[at + 2] === "run";
+}
+
 export function eventPrefix(config) {
   const prefix = config?.tests?.eventPrefix ?? "test";
   if (typeof prefix !== "string" || !PREFIX.test(prefix)) fail("tests.eventPrefix must be lower-case letters, digits and underscores");
@@ -146,31 +182,130 @@ export function eventPrefix(config) {
 }
 
 /**
- * Run the planned suites in order; stop at the first non-zero exit. `spawnFn` and `log` are injectable.
- * Resolves `{ exitCode, results: [{ suite, exitCode, durationMs }] }`; a spawn error or a signal rejects.
+ * Run the planned suites in order, collecting every reachable failure (GB-44): a failed suite does not stop an independent one, a suite that requires a
+ * failed or skipped one is skipped with its reason, and the run ends non-zero. `spawnFn` and `log` are injectable.
+ * Resolves `{ exitCode, results: [{ suite, exitCode, durationMs, skipped?, reason?, error? }] }`; a signal (cancellation) rejects.
+ * A `sign` step (suite-signing.mjs) runs IN THIS PROCESS, never through `door` (it is no command and never a broker job); it signs what an earlier
+ * suite built, named by that suite's verified carried receipts, and only a success sets RIGHTKIT_QA_APP_BINARY for the suites after it.
  */
-export async function runSuites(plan, { appRoot, prefix = "test", env = process.env, spawnFn = spawn, log = console.log, door = buildLaunch } = {}) {
+export async function runSuites(plan, { appRoot, prefix = "test", env = process.env, spawnFn = spawn, log = console.log, errLog = console.error, door = buildLaunch, config = null, platform = process.platform, signDeps = {}, signStep = runSignStep, snapshotStage = Boolean(carriedCargoMapOf(env)?.map), qaCapability = (qa) => qaPrebuiltCapability(qa, { env }) } = {}) {
   const results = [];
-  for (const item of plan) {
-    const invocation = resolveInvocation(item.step, { appRoot, baseEnv: env, extraArgs: item.extraArgs });
-    log(JSON.stringify({ event: `${prefix}_suite_started`, suite: item.name }));
-    const started = Date.now();
-    const exitCode = await new Promise((resolve, reject) => {
-      // A test suite goes through the one door (build-launch.mjs): a broker job on a managed host, which builds it under the app's claim.
-      const target = door(invocation.cmd, invocation.args, { env: invocation.env, cwd: invocation.cwd, exists: existsSync });
-      const child = spawnFn(target.command, target.args, { cwd: invocation.cwd, env: invocation.env, stdio: "inherit" });
-      child.once("error", reject);
-      child.once("exit", (code, signal) => {
-        if (signal) reject(new Error(`${item.name} stopped by ${signal}`));
-        else resolve(code ?? 1);
-      });
-    });
-    const durationMs = Date.now() - started;
-    log(JSON.stringify({ event: `${prefix}_suite_completed`, suite: item.name, exitCode, durationMs }));
-    results.push({ suite: item.name, exitCode, durationMs });
-    if (exitCode !== 0) return { exitCode, results };
+  // One signing policy, enforced here whatever the config's format (the route probe reads JSON configs only; a legacy .mjs config is judged now): an
+  // unsigned or ad hoc product build, or an identifier override, is refused before any suite runs (rightkit#1303). Mac and Dell only.
+  try {
+    const readRel = (rel) => { try { return readFileSync(path.resolve(appRoot, rel), "utf8"); } catch { return null; } };
+    const listFiles = fsListRustFiles(appRoot);
+    assertSuiteSigningPolicy({ config, platform, env, to: "test", readFile: readRel, listFiles });
+    // And the plan that actually runs: runner mode, a selected subset and `-- <args>` passthrough are judged too (rightkit#1303 H1).
+    assertPlanSigningPolicy({ config, plan, platform, env, readFile: readRel, listFiles });
+  } catch (error) {
+    if (!(error instanceof SuiteSigningError)) throw error;
+    errLog(`right-release test: [${error.code}] ${error.message}`);
+    return { exitCode: 1, results };
+  }
+  // GB-79 (GATE test stage/E1/E6/E11): `rightkit-qa journeys run` spawns its own broker build, which a gate-carried snapshot stage cannot allow. When the installed rightkit-qa
+  // advertises `journeys-prebuilt-input` the door carries the build itself, signs the products and hands QA the verified listing and attestation (qa-journeys-prebuilt.mjs).
+  // Without the capability it is a PLANNING failure naming it, before any suite runs; nothing is silently skipped and an empty journey set is never green. A step that names
+  // its own listing, attestation or plan flag is refused too (an input the gate did not verify). Only a gate-carried snapshot stage (a carrier map in the environment) has the
+  // one-build rule; a direct host starts it as it always did.
+  const journeys = snapshotStage ? plan.filter((item) => !item.sign && item.step && qaJourneysRunStep(item.step, item.extraArgs)) : [];
+  const unsupported = [];
+  for (const item of journeys) {
+    const argv = [item.step.cmd ?? item.step.node, ...(item.step.args ?? []), ...(item.extraArgs ?? [])].filter((w) => typeof w === "string");
+    const at = argv.findIndex((w) => /(^|[\\/])rightkit-qa(\.exe)?$/.test(w));
+    const own = journeysRunRefusal(argv.slice(at + 1));
+    if (own) { errLog(`right-release test: [${QA_JOURNEYS_UNSUPPORTED}] ${item.name}: ${own}. Nothing ran`); unsupported.push(item); continue; }
+    if (!qaCapability(argv[at], item.step)) { errLog(`right-release test: [${QA_JOURNEYS_UNSUPPORTED}] ${journeysCapabilityRefusal(item.name)}`); unsupported.push(item); }
+  }
+  if (unsupported.length) return { exitCode: 1, results };
+  // The environment later suites get: the caller's, plus RIGHTKIT_QA_APP_BINARY and RIGHTKIT_QA_SIGNING_EVIDENCE once a sign step succeeded.
+  let suiteEnv = env;
+  // The verified carried receipts' output directories of each suite that passed, by name and by group (a sign step reads them).
+  const outputs = new Map();
+  const signedDirs = [];
+  // GB-44 (BR29): every reachable failure is collected. A failed or errored suite does not stop its independent siblings; only a suite that
+  // REQUIRES a failed or skipped one (a sign step needs the suites it signs; a suite after a sign step needs every earlier sign step unless it declares its own `requires`; an explicit
+  // `requires`) is skipped, with the reason recorded. Cancellation (a signal) still stops the whole run, and nothing is signed or launched from a failed build.
+  const status = new Map(); // suite name and group -> "passed" | "failed" | "skipped"
+  const signsSoFar = [];
+  // What a suite waits for. A sign step waits for the suites it signs. Any other suite positioned after a sign step is by default a CONSUMER of its
+  // signed output (a QA runner, a launcher: nothing in its command line shows what its script reads), so it waits for every earlier sign step too;
+  // a suite that declares `requires` (even an empty list) states its own dependencies instead and so keeps running for its diagnostics.
+  // Fail closed: nothing that may consume signed bytes runs after a sign step that failed or was skipped.
+  const waitsFor = (item) => (item.sign || Array.isArray(item.requires) ? (item.requires ?? []) : signsSoFar);
+  const record = (item, outcome) => { for (const key of new Set([item.name, item.group])) status.set(key, outcome); };
+  const firstFailure = () => results.find((r) => r.exitCode !== 0 && r.skipped !== true)?.exitCode ?? (results.some((r) => r.skipped) ? 1 : 0);
+  try {
+    for (const item of plan) {
+      const unmet = waitsFor(item).filter((name) => status.has(name) && status.get(name) !== "passed");
+      if (unmet.length) {
+        const reason = `${[...new Set(unmet)].map((n) => JSON.stringify(n)).join(", ")} did not pass, and ${item.name} ${item.sign ? "signs what it builds" : "needs what it produces"}`;
+        errLog(`right-release test: ${item.name}: skipped: ${reason}`);
+        log(JSON.stringify({ event: `${prefix}_suite_skipped`, suite: item.name, reason }));
+        results.push({ suite: item.name, exitCode: null, skipped: true, reason, durationMs: 0 });
+        record(item, "skipped");
+        if (item.sign) signsSoFar.push(item.name);
+        continue;
+      }
+      log(JSON.stringify({ event: `${prefix}_suite_started`, suite: item.name }));
+      const started = Date.now();
+      if (item.sign) {
+        let exitCode = 0;
+        try {
+          const signed = signStep({ name: item.name, sign: item.sign, appRoot, config, env: suiteEnv, platform, outputDirsOf: (suite) => outputs.get(suite) ?? null, deps: signDeps, log: errLog });
+          signedDirs.push(signed.signedDir);
+          // The variable is set only now, after every file was signed and read back.
+          if (signed.appBinary) suiteEnv = { ...suiteEnv, [QA_APP_BINARY_ENV]: signed.appBinary };
+          // The evidence file lives in the signed directory, kept until this run ends: a consumer checks what it was handed against it.
+          suiteEnv = { ...suiteEnv, [QA_SIGNING_EVIDENCE_ENV]: signed.evidenceFile, [QA_SIGNED_FILES_ENV]: JSON.stringify(signed.signedFiles ?? {}) };
+          log(JSON.stringify({ event: `${prefix}_suite_signed`, suite: item.name, appBinary: signed.appBinary, signing: signed.evidence }));
+        } catch (error) {
+          if (!(error instanceof SuiteSigningError)) throw error;
+          errLog(`right-release test: ${item.name}: [${error.code}] ${error.message}`);
+          exitCode = 1;
+        }
+        const durationMs = Date.now() - started;
+        log(JSON.stringify({ event: `${prefix}_suite_completed`, suite: item.name, exitCode, durationMs }));
+        results.push({ suite: item.name, exitCode, durationMs });
+        record(item, exitCode === 0 ? "passed" : "failed");
+        signsSoFar.push(item.name);
+        continue;
+      }
+      const invocation = resolveInvocation(item.step, { appRoot, baseEnv: suiteEnv, extraArgs: item.extraArgs });
+      const before = carriedLedgerIds(env);
+      let exitCode; let failure = null;
+      try {
+        exitCode = await new Promise((resolve, reject) => {
+          // A test suite goes through the one door (build-launch.mjs): a broker job on a managed host, which builds it under the app's claim.
+          const target = door(invocation.cmd, invocation.args, { env: invocation.env, stepEnv: item.step.env, cwd: invocation.cwd, exists: existsSync });
+          const child = spawnFn(target.command, target.args, { cwd: invocation.cwd, env: target.env ? { ...invocation.env, ...target.env } : invocation.env, stdio: "inherit" });
+          child.once("error", (error) => reject(Object.assign(error, { spawnFailure: true })));
+          child.once("exit", (code, signal) => {
+            if (signal) reject(Object.assign(new Error(`${item.name} stopped by ${signal}`), { cancelled: true }));
+            else resolve(code ?? 1);
+          });
+        });
+      } catch (error) {
+        // A suite that cannot start (a refused launch, a spawn error) is a failed suite; a signal is a cancellation and ends the run.
+        if (error?.cancelled) throw error;
+        failure = error; exitCode = 1;
+        errLog(`right-release test: ${item.name}: ${error?.code ? `[${error.code}] ` : ""}${error?.message ?? error}`);
+      }
+      const durationMs = Date.now() - started;
+      // Only a suite that passed hands its receipts to a sign step.
+      if (exitCode === 0) {
+        const dirs = carriedOutputDirsSince(env, before);
+        for (const key of new Set([item.name, item.group])) outputs.set(key, [...new Set([...(outputs.get(key) ?? []), ...dirs])]);
+      }
+      log(JSON.stringify({ event: `${prefix}_suite_completed`, suite: item.name, exitCode, durationMs }));
+      results.push({ suite: item.name, exitCode, durationMs, ...(failure ? { error: String(failure.message ?? failure) } : {}) });
+      record(item, exitCode === 0 ? "passed" : "failed");
+    }
+    return { exitCode: results.some((r) => r.skipped !== true && r.exitCode !== 0) || results.some((r) => r.skipped) ? firstFailure() : 0, results };
+  } finally {
+    // The signed copies live only as long as the run that signed them.
+    for (const dir of signedDirs) { try { rmSync(dir, { recursive: true, force: true }); } catch { /* the managed root is pruned */ } }
   }
-  return { exitCode: 0, results };
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -187,12 +322,12 @@ export async function main(argv = process.argv.slice(2)) {
   }
   const plan = planTests(config, { suites: opts.suites, runner: opts.runner, passthrough: opts.passthrough, appRoot });
   if (opts.list) {
-    const view = plan.map((item) => ({ suite: item.name, ...resolveInvocation(item.step, { appRoot, baseEnv: {}, extraArgs: item.extraArgs }), env: undefined }));
+    const view = plan.map((item) => (item.sign ? { suite: item.name, sign: item.sign } : { suite: item.name, ...resolveInvocation(item.step, { appRoot, baseEnv: {}, extraArgs: item.extraArgs }), env: undefined }));
     if (opts.json) console.log(JSON.stringify(view, null, 2));
-    else for (const item of view) console.log(`${item.suite}: ${[item.cmd, ...item.args].join(" ")}`);
+    else for (const item of view) console.log(item.sign ? `${item.suite}: sign ${item.sign.files.map((file) => `${file.from}:${file.path}`).join(", ")}` : `${item.suite}: ${[item.cmd, ...item.args].join(" ")}`);
     return 0;
   }
-  const { exitCode } = await runSuites(plan, { appRoot, prefix: eventPrefix(config) });
+  const { exitCode } = await runSuites(plan, { appRoot, prefix: eventPrefix(config), config });
   return exitCode;
 }