@rightkit/release 0.6.13 → 0.6.14

package/development.mjs

@@ -2,7 +2,9 @@ import { discoverBrokerSocket, resolveManagedRoots } from './managed-roots.mjs';
 import { spawnSync } from "./background-process.mjs";
 import { createHash } from "node:crypto";
 import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, lstatSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
-import { buildLaunch } from "./build-launch.mjs";
+import { buildLaunch, createNativeRunner } from "./build-launch.mjs";
+import { carriedOutputDir, carriedOutputDirsSince } from "./carried-cargo.mjs";
+import { lockedTauriArgs } from "./tauri-locked.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
@@ -17,8 +19,12 @@ import { stageDevelopmentBinaries, validateStageEntries } from "./stage-binary.m
 import { assertStableDesignatedRequirement, readBundleExecutable, requestedCiAdhocSigning, signMacosDevelopmentBundle } from "./development-signing.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { installTauriDevId, resolveTauriDevIdDescriptor, TAURI_DEVID_KIND } from "./install-tauri-devid.mjs";
+import { TAURI_AUTHENTICODE_KIND, installTauriAuthenticode, resolveAuthenticodeDescriptor, validateAuthenticodeBuild } from "./install-tauri-authenticode.mjs";
+import { signWindowsFiles, verifyWindowsFiles } from "./sign-windows.mjs";
+import { assertSuiteSigningPolicy } from "./suite-signing-policy.mjs";
+import { fsListRustFiles } from "./signing-files.mjs";
 import { ASSEMBLED_APP_KIND, installAssembledMac, installAssembledWindows, resolveAssembledInstall } from "./install-assembled-app.mjs";
-import { assertIosDevelopmentSession, installIosDevelopment, iosUiTestCommands, prepareIosDevelopment, prepareIosUiTests, validateIosDevelopment } from "./ios-dev.mjs";
+import { assertIosDevelopmentSession, installIosDevelopment, iosDevelopmentApp, iosUiTestCommands, prepareIosDevelopment, prepareIosUiTests, runIosDevelopmentCommands, validateIosDevelopment } from "./ios-dev.mjs";
 import { packLinuxArtifacts, validateLinuxArchive } from "./linux-artifacts.mjs";
 import { buildAndEmbedNativeHelpers, nativeHelpersFromConfig } from "./native-helpers.mjs";
 import { androidDevelopmentNdkCommand, androidDevelopmentSerial, installAndroidDevelopment, validateAndroidDevelopment } from "./android-dev.mjs";
@@ -48,9 +54,12 @@ export function developmentEnvironment(env = process.env, platform = process.pla
   delete result.CARGO_INCREMENTAL;
   // A dev build is debug-signed: a release signing-properties path never reaches it.
   delete result.RIGHTKIT_ANDROID_SIGNING_PROPERTIES;
-  const client = managedRuntimeClient(result);
+  // A direct (Linux) host never gets the managed agent-bin on PATH or a discovered socket, even when it DECLARES a broker route: managedRuntimeClient then returns the declared,
+  // pinned client, but the agent-bin directory and socket here come from environment-derived managed roots that nothing validated. Whatever the build needs from the broker
+  // goes through the executor's validated client (buildLaunch / createNativeRunner), never a PATH lookup, and a second endpoint variable would make the declared route ambiguous.
+  const client = directPlatform(platform) ? undefined : managedRuntimeClient(result, platform);
   if (client) {
-    const { agentBin } = resolveManagedRoots({ env: result });
+    const { agentBin } = resolveManagedRoots({ env: result, platform });
     if (agentBin && existsSync(agentBin)) {
       const pathKey = Object.keys(result).find((key) => key.toLowerCase() === "path") ?? "PATH";
       result[pathKey] = [agentBin, result[pathKey]].filter(Boolean).join(path.delimiter);
@@ -58,7 +67,7 @@ export function developmentEnvironment(env = process.env, platform = process.pla
     // Same default as the agent-bin `rightkit` shim: children that run the managed client directly
     // (resolveCommand("rustright"), build scripts) must not lose the broker endpoint.
     const socket = discoverBrokerSocket(result);
-    if (!result.RIGHTKIT_BUILD_BROKER_SOCKET && socket && existsSync(socket)) result.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
+    if (!result.RUSTRIGHT_BUILD_BROKER_SOCKET && !result.RIGHTKIT_BUILD_BROKER_SOCKET && socket && existsSync(socket)) result.RUSTRIGHT_BUILD_BROKER_SOCKET = socket;
   }
   return result;
 }
@@ -84,6 +93,10 @@ export function validateDevelopmentConfig(config, platform, { root = process.cwd
     if (platform !== "mac") throw new Error(`the ${TAURI_DEVID_KIND} development installer is for --platform mac`);
     resolveTauriDevIdDescriptor(target.install, { appRoot: root });
     if (!target.install.targetTriple && !target.install.bundleDirectory) throw new Error(`development.targets.${platform}.install requires targetTriple (or bundleDirectory) to find the built .app`);
+  } else if (target.install?.kind === TAURI_AUTHENTICODE_KIND) {
+    if (platform !== "win") throw new Error(`the ${TAURI_AUTHENTICODE_KIND} development installer is for --platform win`);
+    resolveAuthenticodeDescriptor(target.install, `development.targets.${platform}.install`);
+    validateAuthenticodeBuild(target.build, `development.targets.${platform}.build`, (rel) => { try { return readFileSync(path.resolve(root, rel), "utf8"); } catch { return null; } });
   } else if (target.install?.kind === ASSEMBLED_APP_KIND) {
     if (platform !== "mac" && platform !== "win") throw new Error(`the ${ASSEMBLED_APP_KIND} development installer is for --platform mac or win`);
     // The assembly (assembly.<platform>) and the install keys are validated together, before any build.
@@ -101,13 +114,18 @@ export function validateDevelopmentConfig(config, platform, { root = process.cwd
 }
 
 export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync, door = buildLaunch,
-  codesignEnvironment = macosCodesignEnvironment, serial, uiTests = false }) {
+  codesignEnvironment = macosCodesignEnvironment, serial, uiTests = false, hostPlatform = process.platform, nativeHost = process.platform }) {
   // UI test journeys (`right-release test --platform ios`): the declared XCUITest journeys on the dev device, under the same guards.
   if (uiTests && platform !== "ios") throw new Error("UI test journeys run for --platform ios only");
   if (!new Set(["win", "mac", "linux", "android", "ios"]).has(platform)) throw new Error("--platform must be win, mac, linux, android or ios");
   // iOS: --dry-run validates the config and prints the plan on any host; everything else needs macOS with Xcode.
-  if (!(platform === "ios" && dryRun)) assertNativeDevelopmentHost(platform);
+  // `nativeHost` is the kernel the build runs on (assertNativeDevelopmentHost), `hostPlatform` the host the suite signing policy judges: the same on a real host, apart only in a fixture that
+  // runs the Mac or Windows build mechanics on another kernel under a host the signing policy exempts.
+  if (!(platform === "ios" && dryRun)) assertNativeDevelopmentHost(platform, nativeHost);
   const target = validateDevelopmentConfig(config, platform, { root });
+  // One signing policy, enforced here whatever the config's format (the route probe reads JSON configs only; a legacy .mjs config is judged now): a dev
+  // target that would build ad hoc, unsigned or under another identifier is refused before it builds (rightkit#1303). Mac and Dell only.
+  if (!dryRun && !uiTests) assertSuiteSigningPolicy({ config, platform: hostPlatform, env, to: "dev", devPlatform: platform, buildOnly, listFiles: fsListRustFiles(root), readFile: (rel) => { try { return readFileSync(path.resolve(root, rel), "utf8"); } catch { return null; } } });
   // Inside the door's source split `root` is the snapshot of a commit (no git directory): the repository is the checkout the door
   // ran in, whose primary-checkout rule and execution policy still apply, and the commit is the split's.
   const split = readSourceSplit({ env, cwd: root });
@@ -115,7 +133,7 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   assertPrimaryReleaseCheckout(repoRoot, env);
   if (dryRun && uiTests) {
     if (!target.uiTests) throw new Error("development.targets.ios.uiTests is not declared: list the journeys in uiTests.onlyTesting");
-    return { built: false, installed: false, plan: { tests: iosUiTestCommands(target, { root, storage: { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>", resultBundle: "<fresh .xcresult per run>" }) } };
+    return { built: false, installed: false, plan: { tests: iosUiTestCommands(target, { root, destinationId: "<device or simulator id>" }) } };
   }
   if (dryRun) return { built: false, installed: false, plan: { ...(target.ndk ? { ndk: androidDevelopmentNdkCommand(target.ndk) } : {}), build: target.build, install: buildOnly ? null : target.install ?? null, profile: DEVELOPMENT_PROFILE } };
   assertReleaseExecutionAllowed({ cwd: repoRoot, environment: env, command: `right-release dev --platform ${platform}` });
@@ -138,15 +156,25 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
     const startedMs = Date.now();
     // Android: cargo-ndk (Cargo dev profile) fills the generated jniLibs, then the Gradle debug build packages it.
     if (target.ndk) { rmSync(target.ndk.jniLibs, { recursive: true, force: true }); execute(androidDevelopmentNdkCommand(target.ndk), { root, env: childEnv, dryRun, run, door, label: "native build" }); }
+    // RA-09: the iOS compile steps (xcodegen, xcodebuild build / build-for-testing / test-without-building) are broker adapter jobs of the production native runner, planned together before the first
+    // launch; there is no execute() of this file's own for them. The app's own non-native `prepare` commands are the only direct steps and keep going through the door. The built app and the
+    // result bundle are read back from the verified receipt's managed output roles.
+    const iosNative = (commands) => runIosDevelopmentCommands(commands, {
+      native: createNativeRunner({ cwd: root, env: childEnv }), root, env: childEnv,
+      direct: (command) => { execute(command, { root, env: childEnv, dryRun, run, door, label: "prepare" }); return { status: 0 }; },
+    });
     if (uiTests) {
-      for (const command of iosPrepared.tests) execute(command, { root, env: childEnv, dryRun, run, door, label: "ui tests" });
-      console.log(`right-release test: ios journeys passed (${target.uiTests.onlyTesting.join(", ")}); result bundle ${iosPrepared.resultBundle}`);
-      return { built: true, installed: false, tested: true, resultBundle: iosPrepared.resultBundle };
+      const tested = iosNative(iosPrepared.tests);
+      console.log(`right-release test: ios journeys passed (${target.uiTests.onlyTesting.join(", ")}); result bundle ${tested.resultBundle ?? "(not reported)"}`);
+      return { built: true, installed: false, tested: true, resultBundle: tested.resultBundle };
     }
-    for (const command of iosPrepared ? iosPrepared.build : target.build) execute(command, { root, env: childEnv, dryRun, run, door, label: "build" });
+    let built = null;
+    if (iosPrepared) built = iosNative(iosPrepared.build);
+    else for (const command of target.build) execute(command, { root, env: childEnv, dryRun, run, door, label: "build" });
+    if (iosPrepared?.install && !dryRun) iosPrepared.install.app = iosDevelopmentApp(target, built.outputs);
     // Dev and QA binaries run from one stable staged path, copied in place (no backup of the old copy), never from the
     // broker's per-generation target folder or a hashed dev-targets folder.
-    const staged = target.stage?.length ? stageDevelopmentBinaries(target.stage, { root, platform: platform === "win" ? "win32" : process.platform }) : [];
+    const staged = target.stage?.length ? stageDevelopmentBinaries(target.stage, { root, platform: platform === "win" ? "win32" : process.platform, managedOutputDirs: carriedOutputDirsSince(childEnv) }) : [];
     for (const file of staged) console.log(`right-release dev: staged ${file}`);
     // Linux: the declared files become one tarball per architecture plus the digest manifest a guest link pins (rightkit#1230).
     // Only from a clean checkout: an artifact others install must name the exact commit it was built from.
@@ -174,6 +202,22 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
         .then((outcome) => ({ built: true, installed: true, ...(staged.length ? { staged } : {}), devid: outcome }))
         .finally(() => lease.release());
     }
+    if (target.install.kind === TAURI_AUTHENTICODE_KIND) {
+      // The unsigned Windows installer is never run: this kind signs the exe, bundles it, signs the installer, then installs (install-tauri-authenticode.mjs).
+      const descriptor = resolveAuthenticodeDescriptor(target.install, `development.targets.${platform}.install`);
+      const bundleRoot = resolveBundleRoot(descriptor, { root, env: childEnv, runCargo: runCargoSync });
+      const debugDir = path.resolve(bundleRoot, "..", "..");
+      const bundleStartedMs = Date.now();
+      const authenticode = installTauriAuthenticode({ descriptor, debugDir, appRoot: root, releaseConfig: config, deps: {
+        signWindows: (files) => signWindowsFiles(files),
+        verifyWindows: (files) => verifyWindowsFiles(files),
+        bundle: (command) => execute(command, { root, env: childEnv, dryRun, run, door, label: "bundle" }),
+        findInstaller: () => resolveTauriBundleDirectory(descriptor, { root, platform, env: childEnv, sinceMs: bundleStartedMs }).installer,
+        install: (installer) => installWindowsDevelopment(descriptor, installer, { root, env: childEnv, run, debugDir }),
+        installedExe: () => path.resolve(root, descriptor.expectedInstalledPath),
+      } });
+      return { built: true, installed: true, ...(staged.length ? { staged } : {}), authenticode };
+    }
     if (target.install.kind === ASSEMBLED_APP_KIND) {
       const { spec, descriptor } = resolveAssembledInstall({ config, platform });
       if (platform === "win") {
@@ -220,7 +264,15 @@ function install(descriptor, { root, platform, config, env, run, door, sinceMs =
   if (platform === "win") {
     if (!descriptor.expectedInstalledPath) throw new Error("Windows Tauri installer requires expectedInstalledPath for installed verification");
     const { bundleRoot, installer: app } = resolveTauriBundleDirectory(descriptor, { root, platform, env, sinceMs });
-    const built = path.resolve(bundleRoot, "..", "..", path.basename(descriptor.expectedInstalledPath));
+    return installWindowsDevelopment(descriptor, app, { root, env, run, debugDir: path.resolve(bundleRoot, "..", "..") });
+  }
+  return installMacosDevelopment(descriptor, { root, platform, config, env, run });
+}
+
+/** Run the silent NSIS installer of a Windows dev build in place and check the installed exe is this build's. */
+function installWindowsDevelopment(descriptor, app, { root, env, run, debugDir }) {
+  {
+    const built = path.resolve(debugDir, path.basename(descriptor.expectedInstalledPath));
     assertNonEmptyExecutable(built);
     // Tauri's silent installer force-kills a running copy of the app (utils.nsh: IfSilent kill). When it
     // was running, pass /R so the installer relaunches it as the user (RunAsUser, outside this process tree).
@@ -234,8 +286,10 @@ function install(descriptor, { root, platform, config, env, run, door, sinceMs =
     if (result.status !== 0) throw new Error(`development installer failed (${result.status}): ${app}`);
     const installed = path.resolve(root, descriptor.expectedInstalledPath);
     assertInstalledExecutableMatches(built, installed);
-    return;
   }
+}
+
+function installMacosDevelopment(descriptor, { root, platform, config, env, run }) {
   const app = resolveTauriArtifact(descriptor, { root, platform, env });
   // One fixed install path per app: macOS keys privacy grants to it. No /Applications/<name> guess.
   if (!descriptor.destination) throw new DevelopmentInstallError("DEV_INSTALL_DESTINATION_REQUIRED", "development.targets.mac.install.destination is required: the one fixed path this app installs to (for example /Applications/<Product>.app)");
@@ -301,11 +355,36 @@ export function resolveTauriArtifact(descriptor, { root, platform, env = process
   return resolveTauriBundleDirectory(descriptor, { root, platform, env, runCargo }).installer;
 }
 
+/**
+ * GB-60 (GATE output pinning; E16/E19): a build whose compile is receipt-managed (a broker host's carried build) writes its outputs under the broker's
+ * output directory a signed receipt named, never under the source tree or the snapshot. A configured path that reads "target/..." (relative to the Cargo
+ * workspace) is therefore migrated EXPLICITLY onto that directory; a source-relative output path that is not under a `target` directory cannot hold what that
+ * build wrote and is refused with a typed error. It is never silently ignored, never resolved to a stale same-name file in the snapshot, and never
+ * replaced by a scan for the newest match. `declared` is the configured path relative to `root`; `manifestDir` the Cargo manifest's directory relative to it.
+ */
+export function receiptRelativeOutputPath({ declared, root, manifestDir = ".", managedOutputDir, label }) {
+  const relative = path.relative(path.resolve(root), path.resolve(root, declared)).split(path.sep).join("/");
+  const segments = relative.split("/").filter(Boolean);
+  const manifestParts = String(manifestDir).split(/[\\/]/).filter((part) => part && part !== ".");
+  const at = segments.findIndex((segment, index) => segment === "target" && segments.slice(0, index).every((part, i) => part === manifestParts[i]));
+  if (at < 0) {
+    const error = new Error(`${label} ${JSON.stringify(declared)} is a source-relative path, but this build is receipt-managed: its outputs are under ${managedOutputDir}, not the source tree or the snapshot. Declare it relative to the Cargo target directory (target/<triple>/debug/bundle/...), or omit it so the receipt's directory is used`);
+    error.code = "DEV_OUTPUT_SOURCE_RELATIVE";
+    throw error;
+  }
+  return path.join(managedOutputDir, ...segments.slice(at + 1));
+}
+
 export function resolveTauriBundleDirectory(descriptor, { root, platform, env = process.env, runCargo = runCargoSync, sinceMs = null }) {
-  const bundleRoot = descriptor.bundleDirectory
-    ? path.resolve(root, descriptor.bundleDirectory)
-    : resolveBundleRoot(descriptor, { root, env, runCargo });
-  if (descriptor.bundleDirectory && !inside(root, bundleRoot)) throw new Error("Tauri bundleDirectory must stay inside app root");
+  let bundleRoot;
+  if (descriptor.bundleDirectory) {
+    const declared = path.resolve(root, descriptor.bundleDirectory);
+    if (!inside(root, declared)) throw new Error("Tauri bundleDirectory must stay inside app root");
+    const managed = descriptor.manifestPath ? carriedOutputDir(env, path.resolve(root, descriptor.manifestPath), { preferNested: true }) : null;
+    bundleRoot = managed
+      ? receiptRelativeOutputPath({ declared: descriptor.bundleDirectory, root, manifestDir: path.dirname(descriptor.manifestPath), managedOutputDir: managed, label: "Tauri bundleDirectory" })
+      : declared;
+  } else bundleRoot = resolveBundleRoot(descriptor, { root, env, runCargo });
   const entries = readdirSync(bundleRoot, { withFileTypes: true });
   const candidates = platform === "mac"
     ? entries.filter((entry) => entry.isDirectory() && entry.name === `${descriptor.productName}.app`).map((entry) => path.join(bundleRoot, entry.name))
@@ -345,6 +424,10 @@ function assertNonEmptyExecutable(file) { if (!existsSync(file) || !statSync(fil
 function resolveBundleRoot(descriptor, { root, env, runCargo }) {
   if (!descriptor.manifestPath) throw new Error("Tauri installer requires manifestPath when bundleDirectory is omitted");
   const manifest = path.resolve(root, descriptor.manifestPath);
+  // The bundle root is under the output directory a signed receipt of this stage named, not under a read-only metadata call
+  // (the compile the Tauri CLI made nested under the build step's carried adapter job, from the broker's signed list of its children).
+  const fromReceipt = carriedOutputDir(env, manifest, { preferNested: true });
+  if (fromReceipt) return path.join(fromReceipt, descriptor.targetTriple, cargoProfileDirectory(DEVELOPMENT_PROFILE), "bundle", platformBundleKind(descriptor));
   const cwd = process.cwd();
   let metadata;
   try {
@@ -353,7 +436,9 @@ function resolveBundleRoot(descriptor, { root, env, runCargo }) {
   } finally { process.chdir(cwd); }
   if (metadata.error || metadata.status !== 0) throw new Error(`RightKit Cargo metadata failed (${metadata.status ?? "unavailable"})${metadata.error ? `: ${metadata.error.message}` : ""}`);
   let targetDirectory;
-  try { targetDirectory = JSON.parse(metadata.stdout).target_directory; } catch { throw new Error("RightKit Cargo metadata returned invalid JSON"); }
+  // A carried call (a snapshot stage's, carried-cargo.mjs) reports the signed receipt's output directory, not what metadata prints.
+  if (typeof metadata.outputDir === "string") targetDirectory = metadata.outputDir;
+  else try { targetDirectory = JSON.parse(metadata.stdout).target_directory; } catch { throw new Error("RightKit Cargo metadata returned invalid JSON"); }
   if (!targetDirectory || !path.isAbsolute(targetDirectory)) throw new Error("Cargo metadata omitted absolute target_directory");
   return path.join(targetDirectory, descriptor.targetTriple, cargoProfileDirectory(DEVELOPMENT_PROFILE), "bundle", platformBundleKind(descriptor));
 }
@@ -364,7 +449,7 @@ function execute(command, { root, env, dryRun, run, label, door = null }) {
   validateCommand(command, `development ${label}`);
   const cwd = path.resolve(root, command.cwd ?? ".");
   if (!inside(root, cwd)) throw new Error(`development ${label} cwd must stay inside app root`);
-  const args = (command.args ?? []).map(String);
+  const args = lockedTauriArgs((command.args ?? []).map(String), env);
   if (dryRun) return { cmd: command.cmd, args, cwd };
   // A pnpm step through the door is the broker's rightkit-pnpm job (or plain pnpm on a direct host), launched by name: the door never uses
   // the node entry resolveCommand would find, so resolving pnpm's JavaScript CLI here would only fail a host that does not need it.
@@ -375,8 +460,8 @@ function execute(command, { root, env, dryRun, run, label, door = null }) {
   // is the rightkit-pnpm broker job (by its own name, not the node entry resolveCommand finds), anything else as resolved.
   // A configured command can run code regardless of its label, so installation commands use the door too.
   const own = resolved.command === process.execPath && resolved.args[0] === OWN_RIGHT_RELEASE;
-  const launch = own || !door ? resolved : { ...resolved, ...door(command.cmd === "pnpm" ? "pnpm" : resolved.command, command.cmd === "pnpm" ? args : resolved.args, { env: resolved.env ?? env, cwd, exists: existsSync }) };
-  const result = run(launch.command, launch.args, { cwd, env: launch.env ?? env, stdio: "inherit", windowsHide: true, shell: false, timeout: command.timeoutMs });
+  const launch = own || !door ? resolved : { ...resolved, ...door(command.cmd === "pnpm" ? "pnpm" : resolved.command, command.cmd === "pnpm" ? args : resolved.args, { env: resolved.env ?? env, stepEnv: command.env, cwd, exists: existsSync }) };
+  const result = run(launch.command, launch.args, { cwd, env: launch.env && launch.env !== resolved.env ? { ...(resolved.env ?? env), ...launch.env } : (launch.env ?? env), stdio: "inherit", windowsHide: true, shell: false, timeout: command.timeoutMs });
   if (result.status !== 0) throw new Error(`development ${label} command failed (${result.status}): ${command.name ?? command.cmd}`);
 }
 /** This package's own right-release entry: the door's RightKit, whatever the app's node_modules holds. */
@@ -403,7 +488,7 @@ export function resolveCommand(command, args, { root, env = process.env, platfor
     const client = managedRuntimeClient(env);
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
     const socket = discoverBrokerSocket(env);
-    const childEnv = !env.RIGHTKIT_BUILD_BROKER_SOCKET && existsSync(socket) ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : undefined;
+    const childEnv = !env.RUSTRIGHT_BUILD_BROKER_SOCKET && !env.RIGHTKIT_BUILD_BROKER_SOCKET && existsSync(socket) ? { ...env, RUSTRIGHT_BUILD_BROKER_SOCKET: socket } : undefined;
     return { ...managedRuntimeCommand(client, args), ...(childEnv ? { env: childEnv } : {}) };
   }
   return { command, args };

package/direct-origin.mjs

@@ -0,0 +1,107 @@
+// GB-29 (GATE-CONTRACT GC-L01; R-L, A-L, P-L; E3, E4, E5): direct Linux origin trust, with no broker, no new service, no custom signature scheme and no fabricated broker receipt.
+//
+// A Linux origin runs the gate direct. Its compile and package stages leave DIRECT-ORIGIN records: the gate's own evidence (commit, the snapshot tree at start and at exit, the
+// command identity, the output digest), never presented as, and never carrying the fields of, a broker's signed receipt. The record is NOT authority: it is a claim a verifier
+// re-derives. The hosted side recomputes, from the dispatched commit alone, everything it can (the real git tree, the unit's version, the unit's content digest, its own full gate) and
+// admits only a record whose every bound field equals ITS value; what it cannot recompute (that a local compile ran) is recorded as the origin's claim and grants nothing. The
+// candidate identity (repository, commit, tree, unit, version, registry and the exact bytes) is what dispatch and publication join or reject on, so a replay of another candidate, a
+// different artifact under one identity, a broker-shaped or non-Linux record, a stale tree or a digest the hosted pack does not reproduce are each refused by name.
+//
+// Activation is NOT here: widening the publish workflow's `admission` input beyond `broker` is the reserved publication authorization (GC-T22), so this verifier is the model and its tests,
+// and the qualification a direct Linux origin writes (unit-gate.mjs) is verified by it locally exactly as the hosted side will, before anything could be dispatched.
+import { createHash } from "node:crypto";
+
+export const DIRECT_ORIGIN_SCHEMA = "rightkit.direct-origin/1";
+/** The stages a direct origin evidences (the attested stages of a broker host). */
+export const DIRECT_ORIGIN_STAGES = Object.freeze(["compile", "package"]);
+export const DIRECT_ORIGIN_REFUSED = "RK_DIRECT_ORIGIN_REFUSED";
+/** The repository whose units a direct origin releases. */
+export const RIGHTKIT_REPOSITORY = "bogusyogi/rightkit";
+/** Fields only a broker's signed job receipt or a broker request carries: a direct record that has any is a fabricated broker receipt and is refused. */
+export const BROKER_ONLY_FIELDS = Object.freeze(["verdict", "refreshed", "reusedFrom", "provenance", "signature", "payload", "jobId", "requestId", "brokerVersion", "keyId", "nonce"]);
+const RECORD_KEYS = ["schema", "executor", "repository", "commit", "tree", "unit", "registry", "artifact", "stages", "candidate"];
+const STAGE_KEYS = ["stage", "ok", "commit", "tree", "treeAtStart", "treeAtExit", "command", "outputSha256"];
+const SHA256 = /^[0-9a-f]{64}$/;
+const SHA1 = /^[0-9a-f]{40}$/;
+
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+const canonical = (value) => (Array.isArray(value) ? `[${value.map(canonical).join(",")}]` : value !== null && typeof value === "object" ? `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}` : JSON.stringify(value));
+const refuse = (message) => { throw Object.assign(new Error(`${DIRECT_ORIGIN_REFUSED}: ${message}`), { code: DIRECT_ORIGIN_REFUSED }); };
+const same = (a, b) => canonical(a) === canonical(b);
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** The identity dispatch and publication join or reject on: what a candidate IS, independent of who built it or when. */
+export function candidateIdentity({ repository, commit, tree, unit, registry, artifact }) {
+  return sha256(canonical({ repository, commit, tree, unit: { kind: unit.kind, name: unit.name, version: unit.version }, registry, artifactSha256: artifact.artifactSha256, contentSha256: artifact.contentSha256 ?? null }));
+}
+
+/** One stage's evidence on a direct origin: the gate's own facts, taken after the stage guard confirmed the snapshot was the commit's bytes at start and at exit. */
+export function directStageEvidence({ stage, commit, tree, treeAtStart = tree, treeAtExit = tree, command, outputSha256 = null }) {
+  return { stage, ok: true, commit, tree, treeAtStart, treeAtExit, command, outputSha256 };
+}
+
+/** The record a direct Linux origin writes into its qualification (`directOrigin`). `stages` is `{ compile, package }` of directStageEvidence. */
+export function buildDirectOrigin({ repository, commit, tree, unit, registry, platform, artifact, stages }) {
+  const record = { schema: DIRECT_ORIGIN_SCHEMA, executor: { kind: "direct", platform }, repository, commit, tree, unit: { kind: unit.kind, name: unit.name, version: unit.version }, registry, artifact: { artifactSha256: artifact.artifactSha256, contentSha256: artifact.contentSha256 ?? null }, stages: DIRECT_ORIGIN_STAGES.map((stage) => stages[stage]) };
+  return { ...record, candidate: candidateIdentity({ repository, commit, tree, unit, registry, artifact: record.artifact }) };
+}
+
+function noBrokerFields(value, where) {
+  if (Array.isArray(value)) { value.forEach((item, i) => noBrokerFields(item, `${where}[${i}]`)); return; }
+  if (!isObject(value)) return;
+  for (const [key, inner] of Object.entries(value)) {
+    if (BROKER_ONLY_FIELDS.includes(key)) refuse(`${where}.${key} is a broker receipt field: a direct origin has no broker and a direct record never carries or imitates one`);
+    noBrokerFields(inner, `${where}.${key}`);
+  }
+}
+
+/**
+ * The verifier (hosted side, and the origin's own self-check). `expected` is what the verifier derives independently:
+ * `{ repository, commit, tree (the real git tree of the commit), unit: { kind, name, version }, registry, contentSha256 (the unit's content digest recomputed from the commit; required for an
+ * npm unit), artifactSha256 (a crate's archive digest, when recomputed) }`. Throws RK_DIRECT_ORIGIN_REFUSED naming the first thing that is not so; returns `{ candidate }`.
+ */
+export function verifyDirectOrigin(record, expected) {
+  if (!isObject(record)) refuse("the direct-origin record is not an object");
+  noBrokerFields(record, "directOrigin");
+  if (!same(Object.keys(record).sort(), [...RECORD_KEYS].sort())) refuse(`the record has unexpected or missing keys (${Object.keys(record).sort().join(", ")})`);
+  if (record.schema !== DIRECT_ORIGIN_SCHEMA) refuse(`schema ${JSON.stringify(record.schema)} is not ${DIRECT_ORIGIN_SCHEMA}`);
+  // Mac and the Dell always run through their broker; a direct record is a Linux origin's and nothing else's.
+  if (!isObject(record.executor) || !same(Object.keys(record.executor).sort(), ["kind", "platform"]) || record.executor.kind !== "direct" || record.executor.platform !== "linux") refuse(`the executor ${JSON.stringify(record.executor)} is not a direct Linux origin (Mac and Dell builds are broker-attested, never direct)`);
+  if (record.repository !== expected.repository) refuse(`the record is for repository ${record.repository}, not ${expected.repository}`);
+  if (!SHA1.test(record.commit ?? "") || record.commit !== expected.commit) refuse(`the record is for commit ${String(record.commit).slice(0, 12)}, not ${String(expected.commit).slice(0, 12)}`);
+  if (!SHA1.test(record.tree ?? "") || record.tree !== expected.tree) refuse(`the record's tree ${String(record.tree).slice(0, 12)} is not the commit's real tree ${String(expected.tree).slice(0, 12)}`);
+  if (!isObject(record.unit) || record.unit.kind !== expected.unit.kind || record.unit.name !== expected.unit.name || record.unit.version !== expected.unit.version) refuse(`the record covers ${JSON.stringify(record.unit)}, not ${JSON.stringify(expected.unit)}`);
+  if (record.registry !== expected.registry) refuse(`the record is for registry ${record.registry}, not ${expected.registry}`);
+  const artifact = record.artifact;
+  if (!isObject(artifact) || !SHA256.test(artifact.artifactSha256 ?? "")) refuse("the record names no artifact sha256");
+  if (expected.unit.kind === "npm") {
+    if (!SHA256.test(expected.contentSha256 ?? "")) refuse("the verifier has no recomputed content digest for this npm unit");
+    if (artifact.contentSha256 !== expected.contentSha256) refuse(`the record's content sha256 ${artifact.contentSha256} is not the ${expected.contentSha256} the verifier recomputed from the commit`);
+  } else if (expected.artifactSha256 !== undefined && artifact.artifactSha256 !== expected.artifactSha256) refuse(`the record's artifact sha256 ${artifact.artifactSha256} is not the ${expected.artifactSha256} the verifier recomputed`);
+  if (!Array.isArray(record.stages) || record.stages.length !== DIRECT_ORIGIN_STAGES.length) refuse(`the record carries ${Array.isArray(record.stages) ? record.stages.length : "no"} stage records, not ${DIRECT_ORIGIN_STAGES.join(" and ")}`);
+  record.stages.forEach((stage, i) => {
+    const name = DIRECT_ORIGIN_STAGES[i];
+    if (!isObject(stage) || !same(Object.keys(stage).sort(), [...STAGE_KEYS].sort())) refuse(`the ${name} stage record has unexpected or missing keys`);
+    if (stage.stage !== name || stage.ok !== true) refuse(`stage ${i + 1} is ${JSON.stringify(stage.stage)} ok=${stage.ok}, not a passed ${name}`);
+    if (stage.commit !== expected.commit || stage.tree !== expected.tree) refuse(`the ${name} stage is for another commit or tree`);
+    // The snapshot was the commit's bytes when the stage started and when it ended: a stale or mutated tree is no evidence.
+    if (stage.treeAtStart !== expected.tree || stage.treeAtExit !== expected.tree) refuse(`the ${name} stage's snapshot tree changed (start ${String(stage.treeAtStart).slice(0, 12)}, exit ${String(stage.treeAtExit).slice(0, 12)}, commit ${expected.tree.slice(0, 12)})`);
+    if (typeof stage.command !== "string" || !stage.command) refuse(`the ${name} stage names no command`);
+    if (name === "package" && stage.outputSha256 !== artifact.artifactSha256) refuse("the package stage's output is not the record's artifact");
+  });
+  const candidate = candidateIdentity({ repository: expected.repository, commit: expected.commit, tree: expected.tree, unit: expected.unit, registry: expected.registry, artifact });
+  if (record.candidate !== candidate) refuse("the record's candidate identity is not the one its own fields give (a replayed or edited record)");
+  return { candidate };
+}
+
+/**
+ * Dispatch and publication join or reject on the candidate identity (GC-T21): the same identity and bytes JOIN the existing claim; a different candidate or different bytes for the same
+ * dispatch key (repository, commit, unit, version, registry) REJECT; no claim is created here. `existing` is the claim already held for the key, or null.
+ */
+export function reconcileClaim(existing, record) {
+  const key = sha256(canonical({ repository: record.repository, commit: record.commit, unit: record.unit, registry: record.registry }));
+  if (existing === null || existing === undefined) return { action: "claim", key, candidate: record.candidate };
+  if (existing.key !== key) refuse("the existing claim is for another dispatch key");
+  if (existing.candidate === record.candidate && existing.artifactSha256 === record.artifact.artifactSha256) return { action: "join", key, candidate: record.candidate };
+  refuse(`a claim for this dispatch key already binds candidate ${String(existing.candidate).slice(0, 12)} (artifact ${String(existing.artifactSha256).slice(0, 12)}); conflicting bytes are rejected, never replaced`);
+}

package/disk-command.mjs

@@ -822,6 +822,7 @@ export async function runDiskCommand(args = process.argv.slice(2), { env = proce
     if (!purged) {
       purged = purgeHoldings({ policy, platform, env, ...deps.purge });
       stdout(`purged ${purged.results.filter((r) => r.ok).length} holding dir(s), ${formatBytes(purged.purgedBytes)}`);
+      for (const r of purged.results.filter((x) => !x.ok)) stdout(`purge FAILED: ${r.path}: ${r.error}`);
     }
     const after = check();
     const warn = after.warn;

package/disk-policy.mjs

@@ -1,8 +1,9 @@
-import { closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, statfsSync, appendFileSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, statfsSync, appendFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { brokerClientInvocation } from "./broker-client.mjs";
 
 export const DISK_EXIT_WARNING = 3;
 export const DEFAULT_POLICY_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), "disk-policy.json");
@@ -339,7 +340,8 @@ export const BUDGET_PARTS = ["targets", "sccache", "cargoHome", "toolchains", "t
  * missing, fails, times out or answers with anything else. Nothing is cached and no shell is used. */
 export function readRustrightBudget({ run = spawnSync } = {}) {
   try {
-    const r = run("rustright", ["doctor", "--json", "--no-scan"], { encoding: "utf8", timeout: 20_000, shell: false, maxBuffer: 1 << 24 });
+    const launch = brokerClientInvocation("rustright", ["doctor", "--json", "--no-scan"], { encoding: "utf8", timeout: 20_000, shell: false, maxBuffer: 1 << 24 }, { probe: run });
+    const r = run(launch.command, launch.args, launch.options);
     if (!r || r.error || r.status !== 0) return null;
     const budget = JSON.parse(String(r.stdout)).buildBudget;
     if (!budget || typeof budget !== "object") return null;
@@ -1029,7 +1031,20 @@ function newestWriteMs(dir) {
  * moved into or written in the dir within the last `days` either, so every item is held at least `days` even though the
  * folder name carries only a date. Only dirs this tool created: the base must carry the holding marker (or, for the legacy
  * heavy dir, the tool's own log), the child must be a real directory named YYYY-MM-DD, never a symlink. */
-export function purgeHoldings({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), days = policy.holdingDays ?? 3, dryRun = false, bases, remove = (p) => rmSync(p, { recursive: true, force: true }), size = walkSize } = {}) {
+/** Remove a held tree whose items arrived read-only (frozen sources, Go module caches): make every real directory owner-writable
+ * first, never following symlinks, since `rmSync` cannot unlink entries inside a directory it may not write. */
+function removeHeld(dir) {
+  const walk = (d) => {
+    try { chmodSync(d, lstatSync(d).mode | 0o700); } catch { return; }
+    let names = [];
+    try { names = readdirSync(d); } catch { return; }
+    for (const n of names) { const c = path.join(d, n); try { if (lstatSync(c).isDirectory()) walk(c); } catch { /* vanished */ } }
+  };
+  walk(dir);
+  rmSync(dir, { recursive: true, force: true });
+}
+
+export function purgeHoldings({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), days = policy.holdingDays ?? 3, dryRun = false, bases, remove = removeHeld, size = walkSize } = {}) {
   const key = platformKey(platform);
   const legacy = policy.heavyVolume?.[key];
   const list = bases ?? [...knownHoldingBases({ policy, platform, env, home }), ...(legacy ? [legacy] : [])];