@rightkit/release 0.6.16 → 0.6.20

package/managed-cargo.mjs

@@ -125,12 +125,38 @@ function fileHead(file) {
   catch { return ""; } finally { if (fd !== null) try { closeSync(fd); } catch { /* closed */ } }
 }
 
+/** True when `file` is a gate's own runtime cargo wrapper (cargo-target-shim.mjs installCargoShim writes it), not a toolchain cargo. */
+export function isGateCargoWrapper(file, readHead = fileHead) {
+  const head = readHead(file);
+  return head.startsWith("#!/bin/sh\n") && head.includes("cargo-target-shim.mjs") && head.includes(" --map ");
+}
+
+/**
+ * The absolute cargo a gate wraps: the first of `candidates` (a PATH lookup, in order) that is not another gate's runtime wrapper, or the
+ * toolchain cargo such a wrapper's map records (a lookup that returns only the first match finds only the wrapper).
+ * A gate started inside a scan of an outer gate finds that gate's wrapper first on PATH; wrapping it would send every call through
+ * the outer map, which binds none of this gate's workspaces (0.6.18 Linux qualify: RK_CARGO_UNBOUND_WORKSPACE "resolved (none)").
+ */
+export function realCargoOf(candidates, readHead = fileHead, readMap = (file) => JSON.parse(readFileSync(file, "utf8"))) {
+  for (const c of candidates) {
+    if (!path.isAbsolute(c)) continue;
+    if (!isGateCargoWrapper(c, readHead)) return c;
+    // A PATH lookup (`which`) names only the first match: the wrapper's own map records the toolchain cargo it wraps.
+    try {
+      const at = /--map '([^']+)'/.exec(readHead(c));
+      const wrapped = at ? readMap(at[1]).realCargo : null;
+      if (typeof wrapped === "string" && path.isAbsolute(wrapped) && !isGateCargoWrapper(wrapped, readHead)) return wrapped;
+    } catch { /* an unreadable map names nothing: keep looking */ }
+  }
+  return undefined;
+}
+
 /**
  * On a direct (Linux) host: PATH without the directories whose `cargo` is a RustRight shim (the managed agent-bin, a configured
  * RIGHTKIT_MANAGED_AGENT_BIN, or a script that routes through the broker, read 4 KiB at most), and the first real cargo left on it.
  * Plain `cargo` then can only be a real toolchain; with none, a cargo launch fails as missing, never through a shim.
  */
-export function directCargoPath({ env = process.env, exists = existsSync, readHead = fileHead, platform = process.platform } = {}) {
+export function directCargoPath({ env = process.env, exists = existsSync, readHead = fileHead, platform = process.platform, gateWrappers = false } = {}) {
   // `platform` only matters for a forced direct run on Windows (a recorded broker exception): ";" separators, backslash paths, cargo.exe.
   const win = platform === "win32";
   const norm = (d) => (win ? String(d).replaceAll("\\", "/") : d);
@@ -139,7 +165,10 @@ export function directCargoPath({ env = process.env, exists = existsSync, readHe
   for (const dir of String(env.PATH ?? "").split(win ? ";" : ":").filter(Boolean)) {
     const candidates = win ? ["cargo.exe", "cargo.cmd", "cargo.bat", "cargo"].map((n) => path.win32.join(dir, n)) : [path.posix.join(dir, "cargo")];
     const found = candidates.find((c) => exists(c));
-    const isShim = Boolean(found) && (MANAGED_AGENT_BIN.test(norm(dir)) || (configured && path.posix.resolve(norm(dir)) === configured) || /cargo-guard\.mjs|rustright/i.test(readHead(found)));
+    // `gateWrappers`: a gate resolving its OWN executor also skips another gate's runtime cargo wrapper (a gate started inside an outer gate's scan,
+    // 0.6.18/0.6.19 Linux qualify). A gate's children never pass it: inside a stage the wrapper first on PATH is the binding they must go through. The
+    // one other caller is test-support/toolchain-cargo.mjs, for a test's throwaway fixtures under the temp directory, never anything in the snapshot.
+    const isShim = Boolean(found) && (MANAGED_AGENT_BIN.test(norm(dir)) || (configured && path.posix.resolve(norm(dir)) === configured) || /cargo-guard\.mjs|rustright/i.test(readHead(found)) || (gateWrappers && isGateCargoWrapper(found, readHead)));
     if (isShim) { dropped.push(dir); continue; }
     kept.push(dir);
     if (!cargo && found) cargo = found;
@@ -201,28 +230,35 @@ function carriedSeam(args, options, { platform, spawn }) {
   return runCarriedCargo(args, options, { map: carried.map, spawn });
 }
 
+/**
+ * The ONE route a call takes to the broker's client on a broker host (runCargoSync and cargo-guard both use it): the declared Linux route when the host declared one (only when it
+ * validates; an invalid one is `{ refusal }`, never a fallback to another client), else the installed runtime client with its discovered socket (on the Mac a missing socket is
+ * `{ refusal: "RightKit broker socket is unavailable" }`), else null. `{ client, env, mapUnavailable }` runs as `<client> cargo <args>`; `mapUnavailable` says a RK_BROKER_UNAVAILABLE
+ * answer of the client is to be reported as an unavailable broker (the declared route, and the Mac).
+ */
+export function brokerClientRoute({ env = process.env, platform = process.platform, exists = existsSync, fsOps, linuxRoute = resolveLinuxBrokerRoute, installedClient = managedRuntimeClient, socketOf = discoverBrokerSocket } = {}) {
+  const linux = linuxRoute({ env, platform, fsOps });
+  if (linux.declared) return linux.ok ? { client: linux.client, env: { ...env, RUSTRIGHT_BUILD_BROKER_SOCKET: linux.socket }, mapUnavailable: true } : { refusal: linux.problem };
+  const client = installedClient(env, platform, exists);
+  if (!client) return null;
+  const socket = socketOf(env, { platform, exists });
+  if (platform === 'darwin' && (!socket || !exists(socket))) return { refusal: 'RightKit broker socket is unavailable' };
+  return { client, env: socket ? { ...env, RUSTRIGHT_BUILD_BROKER_SOCKET: socket } : env, mapUnavailable: platform === 'darwin' };
+}
+
 export function runCargoSync(args, options = {}, { platform = process.platform, exists = existsSync, spawn = spawnSync, fsOps } = {}) {
   const env = options.env ?? process.env;
   const seam = carriedSeam(args, options, { platform, spawn });
   if (seam) return seam;
   // A gate run outside the broker by Adrian's recorded exception: the real toolchain, shims off PATH, on every platform (NO_BROKER_ENV).
   if (gateNoBroker(env)) return spawn("cargo", args, { ...options, env: directCargoEnv(env, platform, exists) });
-  // A Linux host that declared a broker route: every call goes to the validated client at the declared endpoint, or is refused. Never direct.
-  const linux = resolveLinuxBrokerRoute({ env, platform, fsOps });
-  if (linux.declared) {
-    if (!linux.ok) return unavailable(linux.problem);
-    const result = spawn(linux.client, ["cargo", ...args], { ...options, env: { ...env, RUSTRIGHT_BUILD_BROKER_SOCKET: linux.socket } });
-    if (result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) return { ...result, error: unavailable(String(result.stderr).trim()).error };
-    return result;
-  }
-  const client = managedRuntimeClient(env, platform, exists);
-  if (client) {
-    const socket = discoverBrokerSocket(env, { platform, exists });
-    if (platform === 'darwin' && (!socket || !exists(socket))) return unavailable('RightKit broker socket is unavailable');
-    const childEnv = socket ? { ...env, RUSTRIGHT_BUILD_BROKER_SOCKET: socket } : env;
-    const invocation = managedRuntimeCommand(client, ["cargo", ...args]);
-    const result = spawn(invocation.command, invocation.args, { ...options, env: childEnv });
-    if (platform === 'darwin' && result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) {
+  // A Linux host that declared a broker route: every call goes to the validated client at the declared endpoint, or is refused. Never direct. Otherwise the managed client (brokerClientRoute).
+  const route = brokerClientRoute({ env, platform, exists, fsOps });
+  if (route?.refusal) return unavailable(route.refusal);
+  if (route) {
+    const invocation = managedRuntimeCommand(route.client, ["cargo", ...args]);
+    const result = spawn(invocation.command, invocation.args, { ...options, env: route.env });
+    if (route.mapUnavailable && result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) {
       return { ...result, error: unavailable(String(result.stderr).trim()).error };
     }
     return result;

package/ownership-lockfiles.mjs

@@ -1,5 +1,9 @@
 // Stage 1: resolved lock graphs, without feature or production-only pruning.
-import { parse as parseToml } from "smol-toml";
+import { createRequire } from "node:module";
+// smol-toml loads on first parse, not at import: CI jobs whose closure reaches this module without installing
+// @rightkit/release dependencies (publish.yml crates pack, bind) never parse TOML here (rightkit#1341).
+let smolTomlParse;
+const parseToml = (text) => (smolTomlParse ??= createRequire(import.meta.url)("smol-toml").parse)(text);
 import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { sha256 } from "./ownership-approval.mjs";
@@ -281,8 +285,14 @@ function pnpmGraph(text, manifests, lockDir, workspaceBytes) {
     if (typeof ref !== "string") fail("invalid pnpm dependency version");
     if (/^(?:link:|workspace:)/.test(ref)) {
       if (!ref.startsWith("link:")) throw new LockError("lockfile-unresolved-dependency", ref);
-      const importer = node.id.replace(/^importer:/, "");
-      return g.nodes.get(`importer:${path.posix.normalize(path.posix.join(importer, ref.slice(5)))}`);
+      const importer = node.id.replace(/^importer:/, ""), target = path.posix.normalize(path.posix.join(importer, ref.slice(5)));
+      const found = g.nodes.get(`importer:${target}`);
+      if (found) return found;
+      // A link to a directory of the scanned repository outside this lock's importers (RightKit's own sample apps link
+      // packages/*) is that repository's own source: a local node, never a gap. A link leaving the repository stays unresolved.
+      const repoRel = path.posix.normalize(path.posix.join(lockDir, target));
+      if (repoRel === ".." || repoRel.startsWith("../") || path.posix.isAbsolute(repoRel)) return undefined;
+      return g.nodes.get(`linked:${repoRel}`) ?? g.add(`linked:${repoRel}`, name, "0.0.0", `path:${repoRel}`, true);
     }
     const candidates = [ref, `${name}@${ref}`, `/${name}@${ref}`];
     const exact = candidates.map((id) => g.nodes.get(id)).find(Boolean);
@@ -292,6 +302,7 @@ function pnpmGraph(text, manifests, lockDir, workspaceBytes) {
     return g.nodes.get(normalized) ?? g.nodes.get(`/${normalized}`);
   };
   for (const node of g.nodes.values()) {
+    if (node.id.startsWith("linked:")) continue; // its own dependencies belong to its own manifest and lock
     const isImporter = node.id.startsWith("importer:"), pkg = isImporter ? lock.importers[node.id.slice(9)] : snapshots[node.id];
     for (const section of isImporter ? sections : ["dependencies", "optionalDependencies"]) {
       if (pkg[section] !== undefined && !object(pkg[section])) fail("invalid pnpm dependency map");

package/ownership.mjs

@@ -2,7 +2,11 @@
 import { isBlockingFinding } from "./ownership-verdict.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { canonicalRepositoryIdentity, loadTrustedExternal, occurrenceHash, resolveKeyLogTrust, sha256, verifyProtectedProvenance } from "./ownership-approval.mjs";
-import { parse as parseToml } from "smol-toml";
+import { createRequire } from "node:module";
+// smol-toml loads on first parse, not at import: CI jobs whose closure reaches this module without installing
+// @rightkit/release dependencies (publish.yml crates pack, bind) never parse TOML here (rightkit#1341).
+let smolTomlParse;
+const parseToml = (text) => (smolTomlParse ??= createRequire(import.meta.url)("smol-toml").parse)(text);
 import { sourceNonCode } from "./ownership-source.mjs";
 import { OWNERSHIP_LOCKFILES, transitiveDependencies } from "./ownership-lockfiles.mjs";
 import { ALLOWLIST_FILE, ALLOWLIST_FINDING_ID, evaluateDependency, sourceKind, validateAllowlist } from "./ownership-dependency-allowlist.mjs";

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.16",
+  "version": "0.6.20",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-release": "cli/right-release.mjs",
     "rightkit-gate": "bin/rightkit-gate.mjs",
+    "rightkit-linux-setup": "bin/rightkit-linux-setup.mjs",
     "rightkit-agent-hook": "bin/rightkit-agent-hook.mjs"
   },
   "exports": {
     "./bin/rightkit-agent-hook.mjs": "./bin/rightkit-agent-hook.mjs",
     "./bin/rightkit-gate.mjs": "./bin/rightkit-gate.mjs",
+    "./bin/rightkit-linux-setup.mjs": "./bin/rightkit-linux-setup.mjs",
     "./cargo-contract.mjs": "./cargo-contract.mjs",
     "./cargo-target.mjs": "./cargo-target.mjs",
     "./cli/right-release.mjs": "./cli/right-release.mjs",
@@ -23,6 +25,7 @@
     "./engine-locator.mjs": "./engine-locator.mjs",
     "./github-release.mjs": "./github-release.mjs",
     "./legal-contract.mjs": "./legal-contract.mjs",
+    "./linux-setup.mjs": "./linux-setup.mjs",
     "./macos-file-evidence.mjs": "./macos-file-evidence.mjs",
     "./macos-notarization.mjs": "./macos-notarization.mjs",
     "./macos-signing-identity.mjs": "./macos-signing-identity.mjs",
@@ -53,6 +56,9 @@
         "rightkit-gate": [
           "--version"
         ],
+        "rightkit-linux-setup": [
+          "--version"
+        ],
         "rightkit-agent-hook": {
           "args": [],
           "output": "{}"
@@ -80,14 +86,6 @@
     "!provenance-real-receipt.fixture.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node test-support/run-test-shards.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "test:signer:windows": "node sign-release-manifest.integration.mjs",
-    "prepublishOnly": "pnpm test && pnpm test:signer:windows && pnpm test:registry-parity",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -97,9 +95,17 @@
     "url": "git+https://github.com/bogusyogi/rightkit.git",
     "directory": "packages/release"
   },
-  "packageManager": "pnpm@12.16.1",
   "dependencies": {
     "@rightkit/outdated": "0.3.0",
     "smol-toml": "1.9.1"
+  },
+  "scripts": {
+    "test": "node test-support/run-test-shards.mjs --class=unit",
+    "test:broker": "node test-support/run-test-shards.mjs --class=broker",
+    "test:all": "node test-support/run-test-shards.mjs --class=all",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "test:signer:windows": "node sign-release-manifest.integration.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
   }
-}
+}

package/protected-credentials.mjs

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { isManagedHost, refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
+import { CREDENTIAL_PROVIDER_INSTALL, updaterCredentialProvider } from "./credential-provider.mjs";
 
 // Protected credential loaders for release sites that previously read only
 // ambient environment variables. The storage pattern matches release-token.mjs:
@@ -35,13 +36,17 @@ export class ProtectedSecretMissingError extends Error {
 
 // One-line command the operator runs once per host. macOS prompts for the value
 // (-w with no argument); Windows prompts with Read-Host -AsSecureString.
-export function protectedSecretStoreCommand(name, platform = process.platform) {
+// `provider` is the enrolled rightkit-credentials a Windows store command runs (execWithUpdaterCredential's file); unset, the bare executable name.
+export function protectedSecretStoreCommand(name, platform = process.platform, { provider, env = process.env } = {}) {
   const spec = PROTECTED_SECRETS[name];
   if (!spec) throw new Error(`unknown protected secret: ${name}`);
   if (platform === "darwin" && spec.darwinFile) return null;
   if (platform === "darwin") return `security add-generic-password -a "$USER" -s ${spec.keychain} -U -w`;
   if (platform === "win32") {
-    if (spec.providerExec) return `$rightkitSecure = Read-Host -AsSecureString '${spec.label}'; $rightkitPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($rightkitSecure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rightkitPointer) | & rightkit-credentials.exe set --namespace '${spec.keychain}' --account ([Environment]::UserName) --replace } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rightkitPointer) }`;
+    if (spec.providerExec && !provider && platform === process.platform) {
+      try { provider = updaterCredentialProvider({ env, hostPlatform: platform }).file; } catch { /* not enrolled: the hint names the bare executable; signing itself refuses with the install command */ }
+    }
+    if (spec.providerExec) return `$rightkitSecure = Read-Host -AsSecureString '${spec.label}'; $rightkitPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($rightkitSecure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rightkitPointer) | & ${provider ? `'${String(provider).replaceAll("'", "''")}'` : "rightkit-credentials.exe"} set --namespace '${spec.keychain}' --account ([Environment]::UserName) --replace } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rightkitPointer) }`;
     return `powershell -NoProfile -Command "$s = Read-Host -AsSecureString '${spec.label}'; $d = Join-Path $env:APPDATA 'RightKit'; New-Item -ItemType Directory -Force -Path $d | Out-Null; [IO.File]::WriteAllText((Join-Path $d '${spec.file}'), [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($s)))"`;
   }
   return null;
@@ -120,9 +125,11 @@ export function resolveEnvBackedSecret({ name, envName, env = process.env, crede
 
 // M11 owns OS acquisition & secret lifetime. The release adapter supplies only
 // non-secret identity plus an absolute native child executable and literal argv.
+// The provider is the ENROLLED rightkit-credentials (credential-provider.mjs; installed by `rightkit-gate --to tool --unit cargo:rightkit-credentials`) on a Mac or
+// Windows host, resolved and re-hashed here; the bare PATH name is used only where no managed data root exists (Linux, CI). `provider` names a file explicitly.
 export function execWithUpdaterCredential(command, args, {
-  env = process.env, cwd = process.cwd(), run = spawnSync,
-  provider = process.platform === "win32" ? "rightkit-credentials.exe" : "rightkit-credentials",
+  env = process.env, cwd = process.cwd(), run = spawnSync, hostPlatform = process.platform, dataRoot,
+  provider,
   account = os.userInfo().username,
 } = {}) {
   for (const key of Object.keys(env)) {
@@ -131,10 +138,11 @@ export function execWithUpdaterCredential(command, args, {
     }
   }
   if (!path.isAbsolute(command)) throw new Error("credential provider child must be an absolute native executable");
+  provider ??= updaterCredentialProvider({ env, hostPlatform, dataRoot }).file;
   const result = run(provider, ["exec", "--namespace", PROTECTED_SECRETS["updater-signing-key"].keychain,
     "--account", account, "--env", "TAURI_SIGNING_PRIVATE_KEY", "--", command, ...args],
   { cwd, env: { ...env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "" }, stdio: "inherit", shell: false, windowsHide: true });
-  if (result.error?.code === "ENOENT") throw new Error("OS credential provider unavailable: install rightkit-credentials >=0.2.2 on PATH before updater signing");
+  if (result.error?.code === "ENOENT") throw new Error(`OS credential provider unavailable: install rightkit-credentials >=0.2.2 on PATH before updater signing (a Mac or Windows host installs it with \`${CREDENTIAL_PROVIDER_INSTALL}\`)`);
   return result;
 }
 

package/publication-gate.mjs

@@ -177,7 +177,12 @@ export function validatePublicationEvidence({ expected = {}, evidence, artifactB
   if (!SHA.test(String(commit ?? ""))) missing.push("expected commit is not a full 40-character SHA");
   const defaults = requiredHosts(kind);
   let hosts = defaults;
-  if (expected.requiredHosts !== undefined) {
+  // GB-29 (rightkit#1341): a direct Linux qualification bundle proves its own Linux run; Mac and Windows are proved by the publish run's
+  // native verify jobs before upload. Only an explicit caller request with linux-direct evidence selects it; it never satisfies an upload.
+  if (expected.directLinux === true) {
+    if (evidence?.hostPolicy !== "linux-direct" || kind === "swift") missing.push("direct Linux qualification needs linux-direct cargo or npm evidence");
+    hosts = ["linux"];
+  } else if (expected.requiredHosts !== undefined) {
     const requested = expected.requiredHosts;
     if (!(Array.isArray(requested) && requested.length > 0 && new Set(requested).size === requested.length
       && Array.from(requested).every((host) => defaults.includes(host)))) {
@@ -197,7 +202,7 @@ export function validatePublicationEvidence({ expected = {}, evidence, artifactB
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
     if (runs.some((run) => run?.batch !== undefined) && !SHA.test(String(tree ?? ""))) missing.push("expected tree is not a full 40-character SHA for batch evidence");
     for (const host of hosts) {
-      const label = host === "darwin" ? "macOS" : "Windows";
+      const label = host === "darwin" ? "macOS" : host === "linux" ? "Linux" : "Windows";
       const matching = runs.filter((run) => run?.host?.os === host);
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
       // Every run on the host must qualify: a failing run is not masked by a passing run beside it.
@@ -213,7 +218,7 @@ export function validatePublicationEvidence({ expected = {}, evidence, artifactB
 }
 
 // Acquire local source identity and cleanliness, then use the same content validator as CI.
-export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, artifactBytes, directLinux = false, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
   const missing = [];
   const head = git(["rev-parse", "HEAD"], packagePath);
   if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
@@ -230,7 +235,7 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
   // Local publication retains its recorded single-host grant. CI callers own their policy separately.
   const singleHost = (kind === "npm" || kind === "cargo") ? singleHostOfPolicy(evidence) : null;
   const result = validatePublicationEvidence({ expected: { kind, name, version, commit: head, tree,
-    ...(singleHost ? { requiredHosts: [singleHost] } : {}) }, evidence, artifactBytes });
+    ...(directLinux ? { directLinux: true } : singleHost ? { requiredHosts: [singleHost] } : {}) }, evidence, artifactBytes });
   for (const problem of result.missing) {
     if (problem === `evidence commit ${evidence?.commit} != expected commit ${head}`) {
       missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);

package/python-lock.mjs

@@ -0,0 +1,209 @@
+// File-only Python lock check (class A scan `python-lock`). Reads committed files in one directory and executes nothing (no pip, uv or poetry).
+//  * `*pins.txt` (and `requirements*.txt` compiled from a sibling `<stem>.in`): every entry must be an exact `name==version` pin; when the
+//    `<stem>.in` (or `<stem>.txt`) it was pinned from exists, each of its requirements must be satisfied by the pin of that package.
+//  * `requirements*.txt` or `pyproject.toml` beside a `uv.lock` / `poetry.lock`: each direct requirement must be satisfied by the locked
+//    version of that package, and a requirements file's unpinned entries are fine only where no lock exists (they are then the declaration).
+// A requirement line the checker cannot read literally (URL, VCS, editable, unknown specifier) is a finding, never a silent pass. An entry with
+// an environment marker is checked when its package is pinned and not required to be pinned (a lock may be for another platform).
+
+export const PYTHON_LOCK_FILE = /(^|\/)(requirements[^/]*\.(txt|in)|[^/]*pins?\.txt|pyproject\.toml|uv\.lock|poetry\.lock)$/;
+const join = (dir, f) => (dir === "" || dir === "." ? f : `${dir}/${f}`);
+export const normalizeName = (n) => String(n).toLowerCase().replace(/[-_.]+/g, "-");
+
+// ---- versions (PEP 440 subset) --------------------------------------------------------------------------------------------
+const PEP440 = /^v?(\d+(?:\.\d+)*)(?:[-_.]?(a|b|rc|alpha|beta|c|pre|preview)[-_.]?(\d*))?(?:[-_.]?(?:post|rev|r)[-_.]?(\d*))?(?:[-_.]?dev[-_.]?(\d*))?(?:\+[A-Za-z0-9.]+)?$/i;
+export function parsePyVersion(text) {
+  const m = PEP440.exec(String(text).trim());
+  if (!m) return null;
+  const rank = { a: 0, alpha: 0, b: 1, beta: 1, c: 2, rc: 2, pre: 2, preview: 2 };
+  return { rel: m[1].split(".").map(Number), pre: m[2] ? [rank[m[2].toLowerCase()], Number(m[3] || 0)] : null, post: m[4] !== undefined ? Number(m[4] || 0) : null, dev: m[5] !== undefined ? Number(m[5] || 0) : null, text: String(text).trim() };
+}
+export function comparePyVersions(a, b) {
+  for (let i = 0; i < Math.max(a.rel.length, b.rel.length); i++) { const x = a.rel[i] ?? 0; const y = b.rel[i] ?? 0; if (x !== y) return x < y ? -1 : 1; }
+  const key = (v) => [v.dev !== null && v.pre === null && v.post === null ? -1 : 0, v.pre ? 0 : 1, ...(v.pre ?? [0, 0]), v.post ?? -1, v.dev === null ? 1 : 0, v.dev ?? 0];
+  const ka = key(a); const kb = key(b);
+  for (let i = 0; i < ka.length; i++) if (ka[i] !== kb[i]) return ka[i] < kb[i] ? -1 : 1;
+  return 0;
+}
+
+/** Clauses of a specifier string ("" for any): [{ op, version, wildcard }] or null when not readable. */
+export function parseSpecifier(spec) {
+  const text = String(spec).trim().replace(/^\(|\)$/g, "");
+  if (text === "") return [];
+  const out = [];
+  for (const part of text.split(",")) {
+    const m = /^\s*(===|==|!=|~=|>=|<=|>|<)\s*([^\s,]+?)(\.\*)?\s*$/.exec(part);
+    if (!m) return null;
+    if (m[3] && !["==", "!="].includes(m[1])) return null;
+    const version = parsePyVersion(m[2]);
+    if (!version) return null;
+    out.push({ op: m[1], version, wildcard: Boolean(m[3]), raw: part.trim() });
+  }
+  return out;
+}
+/** true when `version` (parsed) satisfies every clause. */
+export function satisfies(version, clauses) {
+  return clauses.every(({ op, version: v, wildcard }) => {
+    const c = comparePyVersions(version, v);
+    switch (op) {
+      case "===": case "==": return wildcard ? v.rel.every((n, i) => (version.rel[i] ?? 0) === n) : c === 0;
+      case "!=": return wildcard ? !v.rel.every((n, i) => (version.rel[i] ?? 0) === n) : c !== 0;
+      case ">=": return c >= 0;
+      case "<=": return c <= 0;
+      case ">": return c > 0;
+      case "<": return c < 0;
+      case "~=": { if (c < 0 || v.rel.length < 2) return false; return v.rel.slice(0, -1).every((n, i) => (version.rel[i] ?? 0) === n); }
+      default: return false;
+    }
+  });
+}
+
+// ---- requirement lines ----------------------------------------------------------------------------------------------------
+/** { reqs: [{ line, name, spec, clauses, marker, pinned }], problems: [{ line, text }] } from requirements-file text. */
+export function parseRequirements(text) {
+  const reqs = []; const problems = [];
+  const lines = String(text).split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const start = i + 1; let line = lines[i];
+    while (/\\\s*$/.test(line) && i + 1 < lines.length) { line = line.replace(/\\\s*$/, " ") + lines[++i]; }
+    line = line.replace(/(^|\s)#.*$/, "").trim();
+    if (!line) continue;
+    if (/^-(r|c|-requirement|-constraint)\b/.test(line) || /^--(index-url|extra-index-url|find-links|trusted-host|no-binary|only-binary|prefer-binary|pre|require-hashes|no-index|use-feature|prefer-binary)\b/.test(line) || /^-[ifz]\s/.test(line)) continue;
+    if (/^-e\b|^--editable\b|^-/.test(line)) { problems.push({ line: start, text: `option ${line.slice(0, 50)} cannot be read literally` }); continue; }
+    line = line.replace(/\s--hash[=\s]\S+/g, "").trim();
+    const [body, ...markerParts] = line.split(";");
+    const marker = markerParts.join(";").trim() || null;
+    if (/@|:\/\/|^\.{0,2}\//.test(body)) { problems.push({ line: start, text: `requirement ${body.trim().slice(0, 60)} is a URL, VCS or path reference, which cannot be read literally` }); continue; }
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*(.*)$/.exec(body.trim());
+    if (!m) { problems.push({ line: start, text: `requirement ${body.trim().slice(0, 60)} cannot be read literally` }); continue; }
+    const clauses = parseSpecifier(m[2]);
+    if (clauses === null) { problems.push({ line: start, text: `specifier ${m[2].slice(0, 60)} of ${m[1]} cannot be read literally` }); continue; }
+    const pinned = clauses.length === 1 && ["==", "==="].includes(clauses[0].op) && !clauses[0].wildcard;
+    reqs.push({ line: start, name: normalizeName(m[1]), display: m[1], spec: m[2].trim(), clauses, marker, pinned });
+  }
+  return { reqs, problems };
+}
+
+// ---- locks ----------------------------------------------------------------------------------------------------------------
+/** Map name -> [versions] from a uv.lock / poetry.lock parsed as TOML (`[[package]]` name + version). */
+export function lockVersions(doc) {
+  const map = new Map();
+  for (const p of Array.isArray(doc?.package) ? doc.package : []) {
+    if (typeof p?.name !== "string" || typeof p?.version !== "string") continue;
+    const k = normalizeName(p.name);
+    map.set(k, [...(map.get(k) ?? []), p.version]);
+  }
+  return map;
+}
+
+/** PEP 508 strings or poetry specs from a parsed pyproject.toml -> [{ name, spec, marker, where }], plus problems. */
+export function pyprojectRequirements(doc) {
+  const out = []; const problems = [];
+  const pep = (list, where) => { for (const s of Array.isArray(list) ? list : []) { if (typeof s !== "string") continue; const r = parseRequirements(s); r.reqs.forEach((q) => out.push({ name: q.name, display: q.display, clauses: q.clauses, spec: q.spec, marker: q.marker, where })); r.problems.forEach((p) => problems.push(`${where}: ${p.text}`)); } };
+  pep(doc?.project?.dependencies, "[project].dependencies");
+  for (const [k, v] of Object.entries(doc?.project?.["optional-dependencies"] ?? {})) pep(v, `[project.optional-dependencies].${k}`);
+  for (const [k, v] of Object.entries(doc?.["dependency-groups"] ?? {})) pep(Array.isArray(v) ? v.filter((x) => typeof x === "string") : [], `[dependency-groups].${k}`);
+  pep(doc?.tool?.uv?.["dev-dependencies"], "[tool.uv].dev-dependencies");
+  const poetry = (table, where) => {
+    for (const [name, raw] of Object.entries(table ?? {})) {
+      if (name.toLowerCase() === "python") continue;
+      const spec = typeof raw === "string" ? raw : typeof raw?.version === "string" ? raw.version : null;
+      if (spec === null) { if (!(raw && typeof raw === "object" && (raw.git || raw.path || raw.url))) problems.push(`${where}: ${name} has no literal version`); continue; }
+      const clauses = poetrySpec(spec);
+      if (clauses === null) problems.push(`${where}: ${name} specifier ${spec} cannot be read literally`);
+      else out.push({ name: normalizeName(name), display: name, clauses, spec, marker: raw?.markers ?? (raw?.python ? "python" : null), where });
+    }
+  };
+  poetry(doc?.tool?.poetry?.dependencies, "[tool.poetry.dependencies]");
+  poetry(doc?.tool?.poetry?.["dev-dependencies"], "[tool.poetry.dev-dependencies]");
+  for (const [g, v] of Object.entries(doc?.tool?.poetry?.group ?? {})) poetry(v?.dependencies, `[tool.poetry.group.${g}.dependencies]`);
+  return { reqs: out, problems };
+}
+/** Poetry version constraint -> clauses (caret and tilde expanded, bare version exact, `*` any); null when not readable. */
+export function poetrySpec(spec) {
+  const t = String(spec).trim();
+  if (t === "*" || t === "") return [];
+  if (t.includes("||")) return null;
+  const clauses = [];
+  for (const part of t.split(",").map((x) => x.trim())) {
+    let m;
+    if ((m = /^\^\s*(\d+(?:\.\d+)*)$/.exec(part))) {
+      const r = m[1].split(".").map(Number); const at = r.findIndex((n) => n !== 0); const i = at < 0 ? r.length - 1 : at;
+      const upper = r.slice(0, i); upper.push(r[i] + 1);
+      clauses.push({ op: ">=", version: parsePyVersion(m[1]) }, { op: "<", version: parsePyVersion(upper.join(".")) });
+    } else if ((m = /^~=?\s*(\d+(?:\.\d+)*)$/.exec(part))) {
+      const r = m[1].split(".").map(Number); const upper = r.length === 1 ? [r[0] + 1] : [r[0], r[1] + 1];
+      clauses.push({ op: ">=", version: parsePyVersion(m[1]) }, { op: "<", version: parsePyVersion(upper.join(".")) });
+    } else if ((m = /^(\d+(?:\.\d+)*)$/.exec(part))) clauses.push({ op: "==", version: parsePyVersion(m[1]) });
+    else { const c = parseSpecifier(part); if (c === null || c.length !== 1) return null; clauses.push(c[0]); }
+  }
+  return clauses.every((c) => c.version) ? clauses : null;
+}
+
+// ---- the check ------------------------------------------------------------------------------------------------------------
+const describe = (r) => `${r.display ?? r.name}${r.spec ? ` ${r.spec}` : ""}`;
+function against(reqs, versionsOf, { file, source, kind }) {
+  const out = [];
+  for (const r of reqs) {
+    const have = versionsOf.get(r.name);
+    const at = `${file}${r.line ? `:${r.line}` : ""}${r.where ? ` ${r.where}` : ""}`;
+    if (!have || !have.length) { if (!r.marker) out.push(`${at}: ${describe(r)} has no ${kind} in ${source}`); continue; }
+    const parsed = have.map(parsePyVersion);
+    if (parsed.some((p) => p === null)) { out.push(`${source}: ${r.display ?? r.name} version ${have.join(", ")} is not a readable version`); continue; }
+    if (!parsed.some((p) => satisfies(p, r.clauses))) out.push(`${at}: ${describe(r)} is not satisfied by ${source}, which has ${have.join(", ")}`);
+  }
+  return out;
+}
+
+/**
+ * Findings for one directory. `names` = the directory's file names; `read(file)` takes repo-relative paths; `parseToml(text)` parses TOML.
+ */
+export function pythonLockProblems({ dir, names, read, parseToml }) {
+  const out = []; const has = (n) => names.includes(n);
+  const f = (n) => join(dir, n);
+  const isPins = (n) => /pins?\.txt$/.test(n);
+  const reqFiles = names.filter((n) => /^requirements[^/]*\.txt$/.test(n) && !isPins(n));
+  const pinsFiles = names.filter(isPins);
+  const toml = (file) => { try { return parseToml(read(file)); } catch (e) { out.push(`${file}: cannot be parsed as TOML (${String(e.message).split("\n")[0]})`); return null; } };
+  const parsedTxt = new Map();
+  const reqsOf = (n) => { if (!parsedTxt.has(n)) { const r = parseRequirements(read(f(n))); parsedTxt.set(n, r); } return parsedTxt.get(n); };
+  const needPins = (n, r) => { for (const q of r.reqs) if (!q.pinned) out.push(`${f(n)}:${q.line}: ${describe(q)} is not an exact == pin in a lock file`); };
+  const pinMap = (r) => { const m = new Map(); for (const q of r.reqs) if (q.pinned) m.set(q.name, [...(m.get(q.name) ?? []), q.clauses[0].version.text]); return m; };
+  const problems = (n, r) => r.problems.forEach((p) => out.push(`${f(n)}:${p.line}: ${p.text}`));
+
+  // pins files
+  for (const n of pinsFiles) {
+    const pins = reqsOf(n); problems(n, pins); needPins(n, pins);
+    const stem = n.replace(/[._-]?pins?\.txt$/, "");
+    for (const src of [`${stem}.in`, `${stem}.txt`]) {
+      if (src === n || !has(src) || isPins(src)) continue;
+      const direct = reqsOf(src); problems(src, direct);
+      out.push(...against(direct.reqs, pinMap(pins), { file: f(src), source: f(n), kind: "pin" }));
+      break;
+    }
+  }
+  // requirements*.txt
+  const locks = [["uv.lock"], ["poetry.lock"]].map(([n]) => n).filter(has);
+  const lockMaps = locks.map((n) => { const doc = toml(f(n)); return doc ? { n, map: lockVersions(doc) } : null; }).filter(Boolean);
+  for (const n of reqFiles) {
+    const stem = n.replace(/\.txt$/, ""); const r = reqsOf(n);
+    if (has(`${stem}.in`)) {
+      problems(n, r); needPins(n, r);
+      const direct = reqsOf(`${stem}.in`); problems(`${stem}.in`, direct);
+      out.push(...against(direct.reqs, pinMap(r), { file: f(`${stem}.in`), source: f(n), kind: "pin" }));
+    } else if (lockMaps.length) {
+      problems(n, r);
+      for (const l of lockMaps) out.push(...against(r.reqs, l.map, { file: f(n), source: f(l.n), kind: "locked version" }));
+    } else if (pinsFiles.some((p) => p.replace(/[._-]?pins?\.txt$/, "") === stem)) { /* its pins file is the lock (checked above) */ }
+  }
+  // pyproject.toml
+  if (has("pyproject.toml") && lockMaps.length) {
+    const doc = toml(f("pyproject.toml"));
+    if (doc) {
+      const p = pyprojectRequirements(doc);
+      out.push(...p.problems.map((t) => `${f("pyproject.toml")} ${t}`));
+      for (const l of lockMaps) out.push(...against(p.reqs, l.map, { file: f("pyproject.toml"), source: f(l.n), kind: "locked version" }));
+    }
+  }
+  return out;
+}

package/qa-admission-policy.json

@@ -9,6 +9,38 @@
       "set_by": "adrian",
       "since": "2026-10-27",
       "note": "Dell runner, Adrian's go 2026-10-28, sha256 3c11788e…2986"
+    },
+    {
+      "sha256": "569069fee0feb5f9d60e75ef8a5825fbff44edbffd5aa927c25d4032e9dca7a0",
+      "version": "0.10.1",
+      "platform": "win",
+      "set_by": "adrian",
+      "since": "2026-11-01",
+      "note": "Dell runner built by rightkit-gate --to tool from e2f2d2152 (world QA root fix) on BOGUS-DELL, rotated in; replaces 9cb78352 (rightkit#1309: pins/trust routine)"
+    },
+    {
+      "sha256": "974b646b50f4630ff829c96e3747f800d17cf5125667ead0fa43ee809de4781f",
+      "version": "0.10.0",
+      "platform": "win",
+      "set_by": "adrian",
+      "since": "2026-11-01",
+      "note": "Dell runner built and enrolled by rightkit-gate --to tool from 05eb0d689 on BOGUS-DELL (rightkit#1309: pins/trust routine)"
+    },
+    {
+      "sha256": "a1e84a19d1b75d49a98fbff34e4ac1001014ff0aafcd129ce23721eb3297e4b3",
+      "version": "0.10.0",
+      "platform": "mac",
+      "set_by": "adrian",
+      "since": "2026-10-31",
+      "note": "Mac runner built by rightkit-gate --to tool from 24c5a9281 (rightkit#1309: pins/trust routine)"
+    },
+    {
+      "sha256": "14eba841b7af8f8b015d25be6dbf68ad3c96863a4c9c43adc104b1ab632f9f60",
+      "version": "0.10.1",
+      "platform": "mac",
+      "set_by": "adrian",
+      "since": "2026-11-01",
+      "note": "Mac runner built by rightkit-gate --to tool from e8da5a7b7 (world token + temp-length fixes), rotated in; replaces e7590e12 (rightkit#1309: pins/trust routine)"
     }
   ]
 }