@rightkit/release 0.6.2 → 0.6.4

package/release-qa-audit.mjs

@@ -1,14 +1,18 @@
-// Warn-and-record QA admission plus the ad hoc `right-release qa audit` scan.
+// QA admission plus the ad hoc `right-release qa audit` scan.
 //
-// A missing or invalid QA receipt never blocks a release. The gates in release-qa-receipt.mjs still verify
-// receipts exactly as before; this module turns a refusal into a loud stderr warning and a durable record
+// Per-app policy (qa-admission-policy.json, release-qa-policy.mjs): `warn` is the default, `refuse` is switched on
+// per app once the app has earned it. The gates in release-qa-receipt.mjs verify receipts, and the hardening in
+// release-qa-hardening.mjs re-checks platform, release id, approved runner digest, every release-critical journey
+// and the signing/test separation. In warn mode a refusal becomes a loud stderr warning and a durable record
 // (the sealed manifest `qa` field for the source stage, `state/<releaseId>/<platformDir>/qa-installed.json`
-// for the installed stage). `qa audit` reads those records so a weekly run can flag released builds
-// that lack passing QA.
+// for the installed stage). In refuse mode the same refusal throws a QaAdmissionError and nothing is sealed or
+// published. `qa audit` reads the records so a weekly run can flag released builds that lack passing QA.
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { assertInstalledQaAdmission, assertSourceQaAdmission, qaReceiptPath, readQaReceipt } from "./release-qa-receipt.mjs";
+import { hardenQaReceipt } from "./release-qa-hardening.mjs";
+import { admissionModeFor, loadAdmissionPolicy } from "./release-qa-policy.mjs";
+import { assertInstalledQaAdmission, assertSourceQaAdmission, loadQaFloor, QaAdmissionError, qaReceiptPath, readQaReceipt } from "./release-qa-receipt.mjs";
 
 const platformDirOf = (platform) => (platform === "win" ? "windows" : platform);
 
@@ -22,19 +26,40 @@ export function formatQaWarning({ status, reason, command }) {
   return `[right-release] QA warning: ${reason}; release continues and is recorded as QA ${status} for audit.${command ? ` Run: ${command}` : ""}`;
 }
 
-function admit(check, { warn = (line) => console.error(line) } = {}) {
+/** App name of a source release id `<app>-<version>-<commit8>` (callers should pass `app` explicitly). */
+export const appOfReleaseId = (releaseId) => String(releaseId).match(/^(.+?)-\d+\.\d+\.\d+(?:[-+].*)?-[0-9a-f]{8}$/)?.[1] ?? String(releaseId);
+
+function admit(check, { warn = (line) => console.error(line), mode = { mode: "warn" }, app } = {}) {
   try { return { status: "passed", result: check() }; }
   catch (error) {
     if (error?.code !== "QA_ADMISSION_REFUSED") throw error;
     const outcome = { status: refusalStatus(error), reason: refusalReason(error), command: error.command ?? null };
+    if (mode.mode === "refuse") {
+      throw new QaAdmissionError(`QA admission refused for ${app} (policy refuse since ${mode.since} by ${mode.set_by}): ${outcome.reason}`, { command: outcome.command ?? undefined });
+    }
     warn(formatQaWarning(outcome));
     return outcome;
   }
 }
 
+function policyContext(opts, hooks = {}) {
+  const loaded = hooks.policy ?? loadAdmissionPolicy({ dir: hooks.policyDir, env: opts.env });
+  const app = opts.app ?? opts.manifest?.app ?? appOfReleaseId(opts.releaseId ?? opts.manifest?.releaseId);
+  return { loaded, app, mode: admissionModeFor(loaded.policy, app) };
+}
+
+function hardening(stage, opts, loaded, hooks) {
+  const releaseId = opts.releaseId ?? opts.manifest?.releaseId;
+  return (receipt) => hardenQaReceipt({
+    receipt, stage, platform: opts.platform, releaseId, policy: loaded.policy, floor: loadQaFloor(opts.floorDir).floor,
+    repoRoot: opts.repoRoot, configName: opts.configName, gitRunner: opts.gitRunner, env: opts.env ?? process.env, now: hooks.now, pid: hooks.pid, signingStartedAt: hooks.signingStartedAt,
+  });
+}
+
 /** Build stage. Returns the `qa` block sealed into the release manifest. */
-export function admitSourceQa(opts, hooks) {
-  const outcome = admit(() => assertSourceQaAdmission(opts), hooks);
+export function admitSourceQa(opts, hooks = {}) {
+  const { loaded, app, mode } = policyContext(opts, hooks);
+  const outcome = admit(() => assertSourceQaAdmission({ ...opts, afterVerify: hardening("source", opts, loaded, hooks) }), { ...hooks, mode, app });
   if (outcome.status === "passed") return { status: "passed", sourceReceiptDigest: outcome.result.digest, floorDigest: outcome.result.floorDigest };
   return { status: outcome.status, reason: outcome.reason };
 }
@@ -42,9 +67,10 @@ export function admitSourceQa(opts, hooks) {
 export const installedQaRecordPath = ({ repoRoot, releaseId, platform }) =>
   path.join(repoRoot, ".right-release", "state", releaseId, platformDirOf(platform), "qa-installed.json");
 
-/** Publication stage (upload, publish-update, github). Records the outcome durably and never blocks. */
+/** Publication stage (upload, publish-update, github). Records the outcome durably; throws in `refuse` mode. */
 export function admitInstalledQa(opts, { provider, now = () => new Date(), ...hooks } = {}) {
-  const outcome = admit(() => assertInstalledQaAdmission(opts), hooks);
+  const { loaded, app, mode } = policyContext(opts, hooks);
+  const outcome = admit(() => assertInstalledQaAdmission({ ...opts, afterVerify: hardening("installed", opts, loaded, { ...hooks, now }) }), { ...hooks, mode, app });
   const record = {
     status: outcome.status,
     ...(outcome.status === "passed" ? { receiptDigest: outcome.result.digest } : { reason: outcome.reason }),

package/release-qa-command.mjs

@@ -9,8 +9,13 @@
 //   qa: { version: "1", config: "rightkit-qa.toml", runner?: "<path to rightkit-qa>",
 //         args?: { source?: [..], installed?: [..] },                                   // {sealedDir} {releaseId} expand; installed also {installedApp} {installedDir} {qaRoot}
 //         installed?: { installDir?: "<abs dir>" },                                       // opt in: mount the sealed DMG (mac) / run the sealed NSIS installer (win, needs RIGHT_RELEASE_QA_ALLOW_INSTALL=1 off CI), see release-qa-installed.mjs
+//         journeys?: { manifest?: "journeys.toml", receipt?: "<path to a rightkit.journeys.receipt/1>", args?: { source?: [..], installed?: [..] } },
 //         checks: { "smoke.launch": ["app.launch"], journey: ["journey.*"] } }          // floor id -> evidence check names
 // Every id in release-qa-floor.json must be mapped; skipped/failed/missing required checks fail the receipt.
+// `qa.journeys` maps the floor's `journey` id to "every release-critical journey required on this platform passed":
+// `rightkit-qa journeys run` is run (or `receipt` is read), the receipt is validated through `rightkit-qa journeys
+// validate-receipt --manifest .. --tree ..`, and the validated summary is sealed into the receipt (release-qa-hardening.mjs).
+// This command refuses to seal from inside a QA run (RIGHT_RELEASE_QA_STAGE set): sealing is never test execution.
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import os from "node:os";
@@ -21,6 +26,7 @@ import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { verifySealedRelease } from "./release-state.mjs";
 import { auditMain } from "./release-qa-audit.mjs";
+import { journeyRequiredItem, QA_RUN_ENV, relativePosix, validateJourneysReceipt } from "./release-qa-hardening.mjs";
 import { prepareInstalledArtifacts } from "./release-qa-installed.mjs";
 import { darwinKeyFile, PROTECTED_SECRETS } from "./protected-credentials.mjs";
 import {
@@ -49,6 +55,12 @@ function resolveRunner({ qa, appRoot, platform = process.platform, runner = spaw
   return realpathSync(file);
 }
 
+/** `rightkit-qa journeys run` prints `run <id> (<run dir>)` first; the receipt is `<run dir>/receipt.json`. */
+export function journeysReceiptFromOutput(stdout) {
+  const dir = String(stdout ?? "").match(/^run \S+ \((.+)\)\s*$/m)?.[1];
+  return dir ? path.join(dir, "receipt.json") : null;
+}
+
 export function evidencePathFromOutput(stdout) {
   const line = String(stdout).split(/\r?\n/).reverse().find((item) => item.startsWith("[qa]") && /evidence\s+\S/.test(item));
   return line?.match(/evidence\s+(.+?)\s*$/)?.[1] ?? null;
@@ -56,6 +68,8 @@ export function evidencePathFromOutput(stdout) {
 
 /** Run the QA plan through the runner, then seal a receipt. `deps` are test seams; production uses the defaults. */
 export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo = null, deps = {} }) {
+  if ((deps.env ?? process.env)[QA_RUN_ENV]) throw new Error(`refusing to seal a QA receipt inside a QA run (${QA_RUN_ENV} is set): sealing and signing happen outside test execution`);
+  const executionStartedAt = new Date();
   const gitRunner = deps.gitRunner ?? spawnSync;
   const appRoot = path.dirname(configPath);
   const repoRoot = String(gitRunner("git", ["-C", appRoot, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true }).stdout ?? "").trim();
@@ -86,6 +100,7 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
   const key = ensureQaReceiptKey({ env: deps.env ?? process.env, credentialStore: deps.credentialStore, provision: deps.provision ?? provisionKeyOnHost });
   const runnerFile = deps.runnerFile ?? resolveRunner({ qa: config.qa, appRoot });
   const runnerSha = sha256File(runnerFile);
+  const journeysConfig = config.qa.journeys ?? null;
   const qaConfig = path.resolve(appRoot, config.qa.config);
   if (!existsSync(qaConfig)) throw new Error(`qa.config does not exist: ${qaConfig}`);
   // #184: opt in with `qa.installed: { installDir? }`. Mounts the sealed DMG (mac) or runs the sealed NSIS installer into a
@@ -98,15 +113,22 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
       deps: { log: (event) => { if (!deps.quiet) console.error(`[qa] ${JSON.stringify(event)}`); } },
     });
   }
-  let run;
+  let run, journeysRun = null;
   try {
     const expand = (value) => String(value).replaceAll("{sealedDir}", sealed?.sealedDir ?? "").replaceAll("{releaseId}", releaseId)
       .replaceAll("{installedApp}", installedQa?.installedApp ?? "").replaceAll("{installedDir}", installedQa?.installedDir ?? "").replaceAll("{qaRoot}", installedQa?.qaRoot ?? "");
+    const runEnv = { ...process.env, RIGHT_RELEASE_QA_STAGE: stage, RIGHT_RELEASE_QA_COMMIT: source.commit, RIGHT_RELEASE_QA_RELEASE_ID: releaseId, ...(sealed ? { RIGHT_RELEASE_QA_SEALED_DIR: sealed.sealedDir } : {}), ...(installedQa?.env ?? {}) };
     const args = ["run", "--config", qaConfig, ...((config.qa.args?.[stage] ?? []).map(expand))];
     run = (deps.spawnRunner ?? spawnSync)(runnerFile, args, {
       cwd: appRoot, encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024,
-      env: { ...process.env, RIGHT_RELEASE_QA_STAGE: stage, RIGHT_RELEASE_QA_COMMIT: source.commit, RIGHT_RELEASE_QA_RELEASE_ID: releaseId, ...(sealed ? { RIGHT_RELEASE_QA_SEALED_DIR: sealed.sealedDir } : {}), ...(installedQa?.env ?? {}) },
+      env: runEnv,
     });
+    // Journeys lane: the one release proof (ADR-0001 item 10). A receipt named in the config is read as is.
+    if (journeysConfig && !journeysConfig.receipt) {
+      journeysRun = (deps.spawnJourneys ?? deps.spawnRunner ?? spawnSync)(runnerFile, ["journeys", "run", "--root", appRoot, ...((journeysConfig.args?.[stage] ?? []).map(expand))], {
+        cwd: appRoot, encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024, env: runEnv,
+      });
+    }
   } finally {
     installedQa?.cleanup();
   }
@@ -118,7 +140,22 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
     evidenceSha256 = createHash("sha256").update(bytes).digest("hex");
     evidence = JSON.parse(bytes.toString("utf8"));
   }
-  const required = evaluateRequiredChecks({ floor, stage, qa: config.qa, evidence });
+  // The runner binary that produced the evidence is the one that was digested; a swap during the run is refused.
+  if (sha256File(runnerFile) !== runnerSha) throw new Error("the rightkit-qa runner changed while QA was running; refusing to seal");
+  let journeys = null;
+  let required = evaluateRequiredChecks({ floor, stage, qa: config.qa, evidence });
+  if (journeysConfig && floor.journeys) {
+    if (journeysRun && !deps.quiet) { process.stdout.write(String(journeysRun.stdout ?? "")); process.stderr.write(String(journeysRun.stderr ?? "")); }
+    const manifestFile = path.resolve(appRoot, journeysConfig.manifest ?? "journeys.toml");
+    const receiptFile = journeysConfig.receipt ? path.resolve(appRoot, String(journeysConfig.receipt)) : journeysReceiptFromOutput(journeysRun?.stdout);
+    const validation = receiptFile
+      ? validateJourneysReceipt({ runnerFile, runnerSha256: runnerSha, receiptFile, manifestFile, manifestRelPath: relativePosix(repoRoot, manifestFile), platform, spawn: deps.spawnValidator ?? deps.spawnRunner ?? spawnSync })
+      : { ok: false, problems: ["rightkit-qa journeys run reported no run directory, so there is no journeys receipt to validate"], block: null };
+    if (!deps.quiet) for (const problem of validation.problems) console.error(`[qa] journeys: ${problem}`);
+    journeys = validation.block;
+    required = required.map((item) => (item.id === floor.journeys.floorId ? journeyRequiredItem({ floorId: item.id, validation }) : item));
+  }
+  const executionFinishedAt = new Date();
   // A passing receipt needs the runner to exit cleanly AND an evidence bundle that itself passed.
   if (run.status !== 0 && evidence) evidence = { ...evidence, status: "failed" };
   const receipt = sealQaReceipt(buildQaReceipt({
@@ -126,7 +163,11 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
     releaseConfigSha256: sha256File(configPath), qa: config.qa, floor, floorDigest,
     policyBundleDigest: deps.policyBundleDigest ?? currentPolicyBundleDigest(deps.floorDir),
     runner: { basename: path.basename(runnerFile).replace(/\.exe$/i, ""), path: runnerFile, sha256: runnerSha },
-    evidence, evidenceSha256, required, artifacts, sourceReceiptDigest,
+    evidence, evidenceSha256, required, artifacts, sourceReceiptDigest, journeys,
+    execution: {
+      startedAt: executionStartedAt.toISOString(), finishedAt: executionFinishedAt.toISOString(),
+      runnerPids: [run.pid, journeysRun?.pid].filter((pid) => Number.isInteger(pid) && pid > 0), sealerPid: process.pid,
+    },
   }), key);
   const file = qaReceiptPath({ repoRoot, releaseId, platform, stage });
   writeQaReceipt(file, receipt);
@@ -140,7 +181,7 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
 }
 
 function usage(code) {
-  console.log("usage: right-release qa --stage source|installed --platform mac|win [--release <sealed-id>] [--config right-release.config.mjs] [--carry-to <dir>]\n       right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]");
+  console.log("usage: right-release qa --stage source|installed --platform mac|win [--release <sealed-id>] [--config right-release.config.mjs] [--carry-to <dir>]\n       (seals the QA receipt; admission is warn or refuse per app in qa-admission-policy.json; refused inside a QA run)\n       right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]");
   process.exit(code);
 }
 

package/release-qa-fixtures.mjs

@@ -0,0 +1,127 @@
+// Shared builders for the QA admission hardening tests (release-qa-hardening.test.mjs, release-qa-carried.test.mjs).
+// Test support only: nothing in the release path imports this file.
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { journeyRequiredItem, validateJourneysReceipt } from "./release-qa-hardening.mjs";
+import {
+  buildQaReceipt, dependencyClosure, evaluateRequiredChecks, loadQaFloor, qaReceiptPath, sealQaReceipt, sourceIdentity, writeQaReceipt,
+} from "./release-qa-receipt.mjs";
+
+export const here = path.dirname(fileURLToPath(import.meta.url));
+export const KEY = "unit-test-key";
+export const store = { read: () => KEY };
+export const BUNDLE = "b".repeat(64);
+export const SHA = (c) => c.repeat(64);
+export const RUNNER_SHA = SHA("e");
+export const OTHER_RUNNER_SHA = SHA("9");
+export const policyWith = ({ apps = {}, approvedRunners = [{ sha256: RUNNER_SHA, version: "0.8.0" }] } = {}) => ({ policy: { schema: 1, apps, approvedRunners }, digest: SHA("a"), baseline: "none" });
+
+// J-001 and J-002 are release-critical on macos and windows, J-003 is not critical, J-004 is critical on windows only.
+export const MANIFEST_TOML = `version = 1
+app = "demo"
+
+[[journey]]
+id = "J-001"
+platforms = ["macos", "windows"]
+release_critical = true
+
+[[journey]]
+id = "J-002"
+platforms = ["macos", "windows"]
+release_critical = true
+
+[[journey]]
+id = "J-003"
+platforms = ["macos", "windows"]
+release_critical = false
+
+[[journey]]
+id = "J-004"
+platforms = ["windows"]
+release_critical = true
+`;
+
+export const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+
+function sh(cwd, args) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
+  if (result.status !== 0) throw new Error(`git ${args.join(" ")}: ${result.stderr}`);
+  return result.stdout.trim();
+}
+
+/** A git repo with a lockfile and a committed journeys.toml. */
+export function gitFixture(manifestText = MANIFEST_TOML) {
+  const root = mkdtempSync(path.join(tmpdir(), "rk-qa-hard-"));
+  sh(root, ["init", "-q", "-b", "main"]);
+  sh(root, ["config", "user.email", "t@example.com"]); sh(root, ["config", "user.name", "t"]);
+  sh(root, ["remote", "add", "origin", "https://github.com/bogusyogi/example-app.git"]);
+  writeFileSync(path.join(root, "Cargo.lock"), "lock-1\n");
+  writeFileSync(path.join(root, ".gitignore"), ".right-release/\n");
+  writeFileSync(path.join(root, "journeys.toml"), manifestText);
+  sh(root, ["add", "-A"]); sh(root, ["commit", "-q", "-m", "init"]);
+  return root;
+}
+
+export const OS = { mac: "macos", win: "windows" };
+
+/** A journeys receipt as rightkit-qa writes it (only the fields the release side reads). */
+export function journeysReceiptJson({ root, platform = "mac", manifestText = MANIFEST_TOML, statuses = {}, hostOs, startedAt, endedAt }) {
+  const os = hostOs ?? OS[platform];
+  const critical = (id) => ["J-001", "J-002", "J-004"].includes(id);
+  const ids = ["J-001", "J-002", "J-003", ...(platform === "win" ? ["J-004"] : [])];
+  return {
+    schema: "rightkit.journeys.receipt/1", run_id: "run-1", runner: "rightkit-qa", runner_version: "0.8.0", verdict: "passed",
+    started_at: startedAt, ended_at: endedAt, host: { os, arch: "x86_64", session: "interactive" },
+    source: { head: sourceIdentity(root).commit, tree: sourceIdentity(root).tree, dirty: false, diff_sha256: null },
+    manifest: { path: "journeys.toml", sha256: sha256(manifestText) }, selection: { ids, platform: os, tier: "fast" },
+    journeys: ids.map((id) => ({ id, status: statuses[id] ?? "passed", release_critical: critical(id) })),
+  };
+}
+
+export const accepting = () => ({ status: 0, stdout: "receipt claims passed, recomputed passed: ACCEPTED\n", stderr: "" });
+export const refusing = () => ({ status: 1, stdout: "- journey_failed [J-001]: journey failed\nreceipt claims passed, recomputed failed: REFUSED\n", stderr: "" });
+
+const qa = { version: "1", config: "rightkit-qa.toml", journeys: {}, checks: { "smoke.launch": ["app.launch"] } };
+const evidence = () => ({ schemaVersion: 4, runId: "r1", status: "passed", finishedAt: "2026-10-09T00:00:00Z", checks: [{ name: "app.launch", status: "passed" }] });
+
+/**
+ * A sealed source (or installed) QA receipt written where the gate reads it, as `right-release qa` would write it
+ * with qa.journeys configured. Timestamps are relative to now so the execution window precedes admission.
+ */
+export function writeHardenedReceipt(root, {
+  stage = "source", platform = "mac", releaseId, receiptPlatform = platform, receiptReleaseId = releaseId, statuses = {}, runnerSha = RUNNER_SHA,
+  spawn = accepting, execution, tweakBlock, nowMs = Date.now(), artifacts = [], sourceReceiptDigest = null,
+} = {}) {
+  const at = (offsetSec) => new Date(nowMs + offsetSec * 1000).toISOString();
+  const dir = mkdtempSync(path.join(tmpdir(), "rk-qa-jr-"));
+  const receiptFile = path.join(dir, "receipt.json");
+  writeFileSync(receiptFile, JSON.stringify(journeysReceiptJson({ root, platform: receiptPlatform, statuses, startedAt: at(-110), endedAt: at(-20) })));
+  const manifestFile = path.join(root, "journeys.toml");
+  const validation = validateJourneysReceipt({ runnerFile: "rightkit-qa", runnerSha256: runnerSha, receiptFile, manifestFile, manifestRelPath: "journeys.toml", platform: receiptPlatform, spawn });
+  const { floor, digest } = loadQaFloor(here);
+  const source = sourceIdentity(root);
+  // `tweakBlock` forges only the receipt's journeys block; the sealed required item stays the honest one, so the
+  // admission side's recompute is what must catch the forgery.
+  const block = tweakBlock ? tweakBlock(validation.block) : validation.block;
+  const required = evaluateRequiredChecks({ floor, stage, qa, evidence: evidence() }).map((item) => (item.id === floor.journeys.floorId ? journeyRequiredItem({ floorId: item.id, validation }) : item));
+  const receipt = sealQaReceipt(buildQaReceipt({
+    stage, app: "demo", platform: receiptPlatform, releaseId: receiptReleaseId, source, closure: dependencyClosure(root, source.commit), releaseConfigSha256: SHA("d"),
+    qa, floor, floorDigest: digest, policyBundleDigest: BUNDLE, runner: { basename: "rightkit-qa", path: "/x/rightkit-qa", sha256: runnerSha },
+    evidence: evidence(), evidenceSha256: SHA("f"), required, artifacts, sourceReceiptDigest, journeys: block, now: new Date(nowMs - 5000),
+    execution: execution === false ? null : (execution ?? { startedAt: at(-120), finishedAt: at(-10), runnerPids: [4242], sealerPid: 4343 }),
+  }), KEY);
+  writeQaReceipt(qaReceiptPath({ repoRoot: root, releaseId, platform, stage }), receipt);
+  return { receipt, validation };
+}
+
+export const gateOpts = (root, releaseId, platform = "mac", extra = {}) => ({
+  repoRoot: root, releaseId, platform, configName: "right-release.config.mjs", releaseConfigSha256: SHA("d"),
+  credentialStore: store, policyBundleDigest: BUNDLE, floorDir: here, ...extra,
+});
+
+export const releaseIdOf = (root) => `demo-1.0.0-${sourceIdentity(root).commit.slice(0, 8)}`;
+export const makeDir = (root, sub) => { const dir = path.join(root, sub); mkdirSync(dir, { recursive: true }); return dir; };

package/release-qa-floor.json

@@ -1,9 +1,14 @@
 {
   "schema": 1,
-  "version": 1,
+  "version": 2,
   "runner": "rightkit-qa",
   "stages": {
     "source": { "required": ["smoke.launch", "journey"] },
     "installed": { "required": ["smoke.launch", "journey"] }
+  },
+  "journeys": {
+    "floorId": "journey",
+    "receiptSchema": "rightkit.journeys.receipt/1",
+    "rule": "all-release-critical-passed"
   }
 }

package/release-qa-hardening.mjs

@@ -0,0 +1,173 @@
+// Release admission hardening (ADR-0001 item 10). Two halves:
+//
+//   run side   `validateJourneysReceipt` runs `rightkit-qa journeys validate-receipt` (the pinned runner, as a
+//              subprocess; exit code and the final ACCEPTED line), cross-checks the receipt against the committed
+//              journeys manifest, and returns the `journeys` block that `right-release qa` seals into the MAC'd
+//              QA receipt. The floor id `journey` means "every release-critical journey required on this platform
+//              passed", not "one matching check passed".
+//   admit side `hardenQaReceipt` re-checks the sealed receipt at admission, independently of what the run side
+//              claimed: platform and release id, the approved runner digest, the critical journey set recomputed
+//              from the manifest committed at the receipt's commit, and the signing/test-execution separation.
+//
+// Signing outside test execution, what is checked here: the receipt records the pids of the test processes it
+// spawned and the window in which they ran; admission refuses a receipt whose window does not end before the
+// receipt was sealed and before admission (so sealing or signing cannot overlap the run), refuses when the
+// admitting process is one of those test processes, refuses when RIGHT_RELEASE_QA_STAGE is set (admission or
+// signing invoked from inside a QA run), and `right-release qa` refuses to seal inside a QA run. Not checkable
+// here: that the test processes cannot reach the signing key (that is the OS credential store and the signing
+// agent's ACL) and that CI runs QA and signing as separate jobs (the carried receipt, rightkit#183, is the hook).
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { spawnSync } from "./background-process.mjs";
+import { approvedRunnerDigests } from "./release-qa-policy.mjs";
+import { QaAdmissionError, qaCommandFor } from "./release-qa-receipt.mjs";
+
+export const JOURNEYS_RECEIPT_SCHEMA = "rightkit.journeys.receipt/1";
+export const PLATFORM_OS = Object.freeze({ mac: "macos", win: "windows" });
+export const QA_RUN_ENV = "RIGHT_RELEASE_QA_STAGE";
+const CLOCK_SKEW_MS = 60_000;
+const HEX64 = /^[a-f0-9]{64}$/;
+
+const sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+/** Release-critical journey ids the manifest requires on `platform` (mac|win), sorted. */
+export function criticalJourneyIds(manifestText, platform) {
+  const os = PLATFORM_OS[platform];
+  if (!os) throw new Error(`unknown platform ${platform}`);
+  const journeys = parseToml(manifestText).journey;
+  if (!Array.isArray(journeys)) return [];
+  return journeys.filter((journey) => journey?.release_critical === true && Array.isArray(journey.platforms) && journey.platforms.includes(os))
+    .map((journey) => String(journey.id)).sort();
+}
+
+/**
+ * Validate a journeys receipt through the runner and against the manifest. Never throws for a refusal.
+ * Returns { ok, problems, block }; `block` is the `journeys` section for the QA receipt (null when nothing readable).
+ */
+export function validateJourneysReceipt({ runnerFile, runnerSha256, receiptFile, manifestFile, manifestRelPath, platform, spawn = spawnSync }) {
+  const problems = [];
+  let bytes, receipt, manifestBytes;
+  try { bytes = readFileSync(receiptFile); receipt = JSON.parse(bytes.toString("utf8")); }
+  catch (error) { return { ok: false, problems: [`journeys receipt is unreadable (${receiptFile}): ${error.message}`], block: null }; }
+  try { manifestBytes = readFileSync(manifestFile); }
+  catch (error) { return { ok: false, problems: [`journeys manifest is unreadable (${manifestFile}): ${error.message}`], block: null }; }
+  const os = PLATFORM_OS[platform];
+  if (receipt.schema !== JOURNEYS_RECEIPT_SCHEMA) problems.push(`journeys receipt schema is ${JSON.stringify(receipt.schema)}, expected ${JOURNEYS_RECEIPT_SCHEMA}`);
+  if (receipt.runner !== "rightkit-qa") problems.push("journeys receipt was not produced by the rightkit-qa runner");
+  if (receipt.host?.os !== os) problems.push(`journeys receipt ran on ${receipt.host?.os}, this release is ${os}`);
+  if (receipt.selection?.platform !== os) problems.push(`journeys receipt selected platform ${receipt.selection?.platform}, this release is ${os}`);
+  if (receipt.manifest?.sha256 !== sha256Of(manifestBytes)) problems.push("journeys receipt was run against a different journeys manifest than the committed one");
+  if (!/^[a-f0-9]{40}$/.test(receipt.source?.tree ?? "")) problems.push("journeys receipt source.tree is not a 40-hex tree");
+  if (receipt.source?.dirty !== false) problems.push("journeys receipt records a dirty source tree");
+
+  // The runner re-checks every D5 rule; the exit code and the final line must both say accepted.
+  const run = spawn(runnerFile, ["journeys", "validate-receipt", receiptFile, "--manifest", manifestFile, "--tree", String(receipt.source?.tree ?? "")], { encoding: "utf8", windowsHide: true, maxBuffer: 16 * 1024 * 1024 });
+  const lines = String(run?.stdout ?? "").split(/\r?\n/).filter(Boolean);
+  const accepted = run?.status === 0 && /: ACCEPTED$/.test(lines.at(-1) ?? "");
+  if (!accepted) problems.push(`rightkit-qa journeys validate-receipt refused the receipt (exit ${run?.status ?? "none"}): ${lines.slice(0, 5).join(" | ") || String(run?.stderr ?? "").trim() || "no output"}`);
+
+  // Every release-critical journey required on this platform, from the manifest, must be passed in the receipt.
+  let required = [];
+  try { required = criticalJourneyIds(manifestBytes.toString("utf8"), platform); }
+  catch (error) { problems.push(`journeys manifest cannot be parsed: ${error.message}`); }
+  if (!required.length) problems.push(`the journeys manifest declares no release-critical journey for ${os}; zero is never a pass`);
+  const byId = new Map((receipt.journeys ?? []).map((journey) => [journey.id, journey]));
+  for (const id of required) {
+    const journey = byId.get(id);
+    if (!journey) problems.push(`release-critical journey ${id} has no result in the receipt`);
+    else if (journey.status !== "passed") problems.push(`release-critical journey ${id} is ${journey.status}`);
+    else if (journey.release_critical !== true) problems.push(`release-critical journey ${id} is not marked release_critical in the receipt`);
+  }
+  const block = {
+    schema: JOURNEYS_RECEIPT_SCHEMA, receiptSha256: sha256Of(bytes), runId: String(receipt.run_id ?? ""), verdict: String(receipt.verdict ?? ""),
+    hostOs: String(receipt.host?.os ?? ""), selectionPlatform: String(receipt.selection?.platform ?? ""), tree: String(receipt.source?.tree ?? ""),
+    startedAt: String(receipt.started_at ?? ""), endedAt: String(receipt.ended_at ?? ""), runnerVersion: String(receipt.runner_version ?? ""),
+    validator: { runnerSha256, exitCode: run?.status ?? null, accepted },
+    manifest: { path: manifestRelPath, sha256: sha256Of(manifestBytes) },
+    required, results: (receipt.journeys ?? []).map((journey) => ({ id: String(journey.id), status: String(journey.status), releaseCritical: journey.release_critical === true })),
+  };
+  return { ok: problems.length === 0, problems, block };
+}
+
+/** The sealed `required` entry for the floor's journey id: passed only when every critical journey passed. */
+export function journeyRequiredItem({ floorId, validation }) {
+  const results = validation.block?.results ?? [];
+  const status = validation.ok ? "passed" : validation.block ? "failed" : "missing";
+  return { id: floorId, status, evidenceChecks: results.map((result) => ({ name: result.id, status: result.status })), ...(validation.ok ? {} : { problems: validation.problems }) };
+}
+
+const readCommitted = ({ repoRoot, commit, file, gitRunner = spawnSync }) => {
+  const result = gitRunner("git", ["-C", repoRoot, "show", `${commit}:${file}`], { encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
+  if (result?.status !== 0) throw new Error(`git show ${commit.slice(0, 12)}:${file} failed`);
+  return String(result.stdout);
+};
+
+/**
+ * Admission-time re-check of a receipt that already passed `verifyQaReceipt`. Throws QaAdmissionError.
+ * `releaseId` and `platform` are what is being sealed (source) or published (installed). `signingStartedAt` is
+ * optional: a caller that knows when signing began passes it; the default is `now`.
+ */
+export function hardenQaReceipt({
+  receipt, stage, platform, releaseId, policy, floor, repoRoot, configName, gitRunner, env = process.env, now = () => new Date(), pid = process.pid, signingStartedAt,
+}) {
+  const command = qaCommandFor({ stage, platform, releaseId, configName });
+  const refuse = (reason) => { throw new QaAdmissionError(`${stage} QA receipt rejected: ${reason}`, { command }); };
+
+  // 1. The receipt is for this platform and this release id.
+  if (receipt.platform !== platform) refuse(`receipt is for platform ${receipt.platform}, this is ${platform}`);
+  if (receipt.releaseId !== releaseId) refuse(`receipt is for release ${receipt.releaseId}, this is ${releaseId}`);
+
+  // 2. The qualifying runner is pinned by an approved digest.
+  const approved = approvedRunnerDigests(policy);
+  if (!approved.length) refuse("no rightkit-qa runner digest is approved in qa-admission-policy.json");
+  if (!approved.includes(receipt.runner?.sha256)) refuse(`rightkit-qa runner sha256 ${String(receipt.runner?.sha256).slice(0, 16)} is not an approved runner`);
+
+  // 3. The journey floor id means every release-critical journey required on this platform passed.
+  const mapping = floor?.journeys;
+  if (!mapping?.floorId) refuse("the QA floor does not map the journey floor id to a journeys receipt");
+  const journeys = receipt.journeys;
+  if (!journeys) refuse("receipt carries no journeys receipt block; run `rightkit-qa journeys run` through `right-release qa` (qa.journeys in the release config)");
+  const os = PLATFORM_OS[platform];
+  if (journeys.schema !== mapping.receiptSchema) refuse(`journeys receipt schema is ${journeys.schema}`);
+  if (journeys.verdict !== "passed" || journeys.validator?.accepted !== true || journeys.validator?.exitCode !== 0) refuse("the journeys receipt was not accepted by rightkit-qa journeys validate-receipt");
+  if (journeys.validator?.runnerSha256 !== receipt.runner?.sha256) refuse("the journeys receipt was validated by a different runner than the one pinned");
+  if (journeys.hostOs !== os || journeys.selectionPlatform !== os) refuse(`journeys receipt is for ${journeys.hostOs}/${journeys.selectionPlatform}, this is ${os}`);
+  if (journeys.tree !== receipt.tree) refuse("journeys receipt source tree differs from the QA receipt tree");
+  if (!HEX64.test(journeys.receiptSha256 ?? "") || !HEX64.test(journeys.manifest?.sha256 ?? "")) refuse("journeys block has malformed digests");
+  let committedManifest;
+  try { committedManifest = readCommitted({ repoRoot, commit: receipt.commit, file: journeys.manifest.path, gitRunner }); }
+  catch (error) { refuse(`the journeys manifest at the receipt's commit cannot be read: ${error.message}`); }
+  if (sha256Of(committedManifest) !== journeys.manifest.sha256) refuse("the journeys manifest committed at the receipt's commit differs from the one the journeys run used");
+  let required;
+  try { required = criticalJourneyIds(committedManifest, platform); } catch (error) { refuse(`journeys manifest cannot be parsed: ${error.message}`); }
+  if (!required.length) refuse(`the journeys manifest declares no release-critical journey for ${os}; zero is never a pass`);
+  const byId = new Map((journeys.results ?? []).map((result) => [result.id, result]));
+  const notPassed = required.filter((id) => byId.get(id)?.status !== "passed" || byId.get(id)?.releaseCritical !== true);
+  if (notPassed.length) refuse(`release-critical journeys not passed on ${os}: ${notPassed.map((id) => `${id} (${byId.get(id)?.status ?? "missing"})`).join(", ")}`);
+  const item = (receipt.required ?? []).find((entry) => entry.id === mapping.floorId);
+  if (item?.status !== "passed") refuse(`floor id ${mapping.floorId} is ${item?.status ?? "not recorded"}`);
+
+  // 4. Signing (and admission) happen outside test execution.
+  const exec = receipt.execution;
+  if (!exec) refuse("receipt records no execution window; it predates the signing/test separation rule");
+  const at = (value) => Date.parse(value);
+  const [started, finished, created, nowMs] = [at(exec.startedAt), at(exec.finishedAt), at(receipt.createdAt), now().getTime()];
+  if ([started, finished, created].some(Number.isNaN)) refuse("execution window has malformed timestamps");
+  if (!(started <= finished)) refuse("execution window ends before it starts");
+  if (finished > created) refuse("the receipt was sealed before the test run finished (sealing overlapped test execution)");
+  const signing = signingStartedAt ? at(signingStartedAt) : nowMs;
+  if (Number.isNaN(signing) || finished > signing) refuse("signing began before the test run finished (signing overlapped test execution)");
+  if (created > nowMs + CLOCK_SKEW_MS) refuse("receipt is dated in the future");
+  const jStart = at(journeys.startedAt), jEnd = at(journeys.endedAt);
+  if (Number.isNaN(jStart) || Number.isNaN(jEnd) || jStart < started - CLOCK_SKEW_MS || jEnd > finished + CLOCK_SKEW_MS) refuse("the journeys run is not inside the recorded execution window");
+  const testPids = exec.runnerPids;
+  if (!Array.isArray(testPids) || !testPids.length || testPids.some((value) => !Number.isInteger(value) || value < 1)) refuse("receipt records no test process ids");
+  if (testPids.includes(exec.sealerPid)) refuse("the sealing process is a test process");
+  if (testPids.includes(pid)) refuse("admission is running inside a test process");
+  if (env?.[QA_RUN_ENV]) refuse(`${QA_RUN_ENV} is set: admission or signing was invoked from inside a QA run`);
+  return { requiredJourneyIds: required, testPids };
+}
+
+export const relativePosix = (root, file) => path.relative(root, file).split(path.sep).join("/");