@rightkit/release 0.6.16 → 0.6.20

package/release-qa-policy.mjs

@@ -278,10 +278,12 @@ export function approveRunner({
   if (!runner || !String(runner).trim()) throw new QaPolicyError("runner is required");
   if (!nonEmpty(version)) throw new QaPolicyError("version is required");
   if (note !== undefined && typeof note !== "string") throw new QaPolicyError("note must be a string");
-  let published;
-  try { published = JSON.parse(readFileSync(versionsFile, "utf8")).registry?.cargo?.["rightkit-qa"]; }
+  // A runner is the published version or the one RightKit has staged for its next publication (`stagedCargo`): an app's `qa.version` may name the staged one
+  // while the gate-built binary is what runs (qa-runner.mjs); admission is still by this sha256, never by the version string.
+  let published; let staged;
+  try { const feed = JSON.parse(readFileSync(versionsFile, "utf8")); published = feed.registry?.cargo?.["rightkit-qa"]; staged = feed.stagedCargo?.["rightkit-qa"]; }
   catch (error) { throw new QaPolicyError(`the published rightkit-qa version cannot be read (${versionsFile}): ${error.message}`); }
-  if (published !== version) throw new QaPolicyError(`rightkit-qa ${version} is not the published version (rightkit-versions.json registry.cargo has ${published ?? "no rightkit-qa"}); only the published runner can be approved`);
+  if (published !== version && staged !== version) throw new QaPolicyError(`rightkit-qa ${version} is not the published version (rightkit-versions.json registry.cargo has ${published ?? "no rightkit-qa"}); only the published runner can be approved`);
   // The file that is digested is the file that is run: an absolute path, never a PATH lookup, and re-digested after.
   const file = path.resolve(String(runner));
   const sha256 = sha256Of(readRunnerBytes(file));

package/release-source-identity.mjs

@@ -76,6 +76,7 @@ export function resolveReleaseSource({ cwd = process.cwd(), env = process.env, g
   let detail = "";
   try { repoRoot = plainGit(git, cwd, ["rev-parse", "--show-toplevel"]).trim(); } catch (error) { detail = ` (${error.message})`; }
   if (!repoRoot) throw new ReleaseSourceError(`${cwd} is not inside a Git repository${detail}`, NO_REPOSITORY_CODE);
+  repoRoot = path.normalize(repoRoot); // git prints C:/dir on Windows; every other path here is in the platform's own spelling
   const commit = plainGit(git, repoRoot, ["rev-parse", "HEAD"]).trim();
   const tree = plainGit(git, repoRoot, ["rev-parse", `${commit}^{tree}`]).trim();
   if (!OBJECT_ID.test(commit) || !OBJECT_ID.test(tree)) throw new Error("the checkout's HEAD is not a commit");

package/release.mjs

@@ -15,7 +15,7 @@ import { assertQaAdoption, assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
 import { DECLARED_UNRELATED_POLICY, declaredUnrelatedRefusal, releaseArtifactPaths } from "./hosted-workflow-policy.mjs";
 import { assertNativeIosPrepareHasManifest, assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
-import { resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
+import { gitRootOf, isSnapshotSource, resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
 import { ArtifactPathError, assertSplitCommandPaths, releaseCommandSteps, resolveArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
 import { declaredCargoManifest, hasDefaultTauriManifest, resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import {
@@ -622,7 +622,15 @@ if (problems.length || prebuildFindings.length) {
   process.exit(1);
 }
 
-const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
+// The lock is an output, so a door split keeps it in the checkout's app directory: the snapshot is the commit's bytes, and a lock directory left
+// there fails the door's after-stage verify (HeardRight Windows package, 2026-11-01: ".cache/right-release is an empty directory the commit does not have").
+const lockRoot = (() => {
+  if (!workerSource || !isSnapshotSource(workerSource)) return root;
+  const relative = path.relative(sourceRootOf(workerSource), root);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) fail(`the release config directory ${root} is not inside the door snapshot ${sourceRootOf(workerSource)}; the release lock has no checkout counterpart`);
+  return path.join(gitRootOf(workerSource), relative);
+})();
+const releaseLock = acquireReleaseLock(lockRoot, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
 if (!command && opts.platform !== "android" && opts.platform !== "ios" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }), { expanded: true })) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);