@rightkit/release 0.6.24 → 0.6.25

package/build-release.mjs

@@ -27,10 +27,9 @@ import { sccacheRefusal } from "./admission-host.mjs";
 import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { fileURLToPath } from "node:url";
 import { dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
-import { assertInsideSource, assertReleaseSource, gitRootOf, isSnapshotSource, qaAdmissionSourceOptions, resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
+import { assertInsideSource, assertReleaseSource, gitRootOf, isSnapshotSource, resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { ArtifactPathError, assertSplitCommandPaths, boundTargetsEvidence, releaseCommandSteps, resolveArtifactPath as resolveSplitArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
-import { admitSourceQa } from "./release-qa-audit.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
@@ -361,11 +360,6 @@ try {
   for (const check of preflight) {
     if (check.status !== "ok") console.error(`[right-release] preflight ${check.name}: ${check.detail}`);
   }
-  // Hardening step 4: source QA is recorded, not enforced. A missing or rejected receipt warns loudly and the outcome
-  // is sealed into the manifest (`qa.status`) for `right-release qa audit`. Dev lanes (install-app --dev) never reach this file.
-  // A split compares the source QA receipt with the SELECTED commit (its tree, repository identity and lockfile closure from its objects), not HEAD.
-  const qaAdmission = admitSourceQa({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath), ...qaAdmissionSourceOptions(releaseSource) });
-
   // A tool being INSTALLED is not the same as it being the one PATH picks. The
   // vendored-OpenSSL build shells out to `perl`, and under Git Bash/MSYS that
   // resolves to MSYS Perl, which cannot configure OpenSSL. Put the real Windows
@@ -566,7 +560,13 @@ try {
           if (linked.action === "moved-aside") console.error(`[right-release] hosted CI: moved existing ${targetLink} aside to ${linked.aside}`);
         }
         // A Cargo-less native iOS app installs Node dependencies only when it has a package.json.
-        if (nativeIos ? hasPackageJson : resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runLocalStep(() => runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, heavyDecisionOfRun?.localSteps ? { ...env, RIGHTSUITE_HEAVY_WORK_OWNER: "1" } : env, cacheTarget, path.join(stateRoot, "stall-install.log")));
+        const needsNodeInstall = nativeIos ? hasPackageJson : resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager;
+        // rightkit#1443.3: in a gate split the snapshot's node_modules were already installed by the gate, offline, from the same lockfile; a
+        // second install here would run inside the snapshot around the broker (which refuses it). It is skipped; a snapshot without them is refused.
+        if (needsNodeInstall && splitSource) {
+          if (!existsSync(path.join(appRoot, "node_modules"))) fail(`the gate's snapshot at ${appRoot} has no node_modules: the gate installs them before the package stage; nothing is installed here (rightkit#1443)`);
+          console.error(`[right-release] node_modules already installed by the gate in the snapshot; no second install (rightkit#1443)`);
+        } else if (needsNodeInstall) await runLocalStep(() => runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, heavyDecisionOfRun?.localSteps ? { ...env, RIGHTSUITE_HEAVY_WORK_OWNER: "1" } : env, cacheTarget, path.join(stateRoot, "stall-install.log")));
       },
       build: async () => {
         throwIfInterrupted();
@@ -602,7 +602,7 @@ try {
         });
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, managedCargoTarget, artifactPaths, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields: rightKitResolution ? registryManifestFields(rightKitResolution.snapshot, RELEASE_TOOL_VERSION) : undefined, splitSealSource: splitSource ? { commit: releaseSource.commit, tree: releaseSource.tree, snapshotAppRoot: appRoot, checkoutAppRoot: releaseSource.checkoutAppRoot } : null });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, artifactPaths, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot, stateRoot, rightkitRegistryFields: rightKitResolution ? registryManifestFields(rightKitResolution.snapshot, RELEASE_TOOL_VERSION) : undefined, splitSealSource: splitSource ? { commit: releaseSource.commit, tree: releaseSource.tree, snapshotAppRoot: appRoot, checkoutAppRoot: releaseSource.checkoutAppRoot } : null });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -695,7 +695,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, managedCargoTarget, artifactPaths = null, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields, splitSealSource = null }) {
+function sealRelease({ configRoot, managedCargoTarget, artifactPaths = null, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot, stateRoot, rightkitRegistryFields, splitSealSource = null }) {
   // Every app's release config names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
@@ -869,7 +869,6 @@ function sealRelease({ configRoot, managedCargoTarget, artifactPaths = null, and
     // The exact registry resolution (identities, digests, registries, policy revision, observation time, observed latest)
     // this release was built against. Upload and resume consume it; neither resolves again.
     ...rightkitRegistryFields,
-    qa: qaAdmission,
     // DevTools allowance (owner's fixed design): { mode: "denied" } for every app; content-only only for an allow-listed app.
     devtools: devtoolsEvidence(resolveDevtoolsAllowance({ config, root: configRoot })),
     platform,

package/cargo-profile-contract.mjs

@@ -1,16 +1,17 @@
 // RightKit standard Cargo profile contract (Adrian, 2026-10-16; Astra-reviewed option C).
 //
-// Every app workspace-root Cargo.toml carries the tables of templates/cargo-profiles.toml verbatim:
-//   - [profile.dev] and [profile.dev.package."*"] equal the template (no missing, changed or extra keys),
-//   - panic = "unwind" in dev and release,
-//   - no [profile.release-iterate] (and nothing that inherits it),
-//   - no [profile.test] overrides (test inherits dev).
-// The same scan also flags the two source patterns the single dev profile makes wrong, because a dev
-// build now has debug_assertions on:
-//   - `cfg_attr(not(debug_assertions), windows_subsystem = ...)`: an installed dev app would open a
-//     console window on Windows. Set windows_subsystem = "windows" unconditionally.
-//   - an environment-variable override gated by cfg(debug_assertions): move it to the app's test-mode
-//     feature. Heuristic: a cfg(debug_assertions) attribute or cfg! within 12 lines before an env read.
+// One build output and one warm cache per app per host (GATE-CONTRACT GC-A01, GC-A07). Every gate compile (check, clippy,
+// rustdoc, the test compile and both installers) builds with [profile.release] for the host's own target, whatever the caller
+// passed (cross-targets.mjs oneOutput); the dev installer is the release profile plus the `qa-native` feature. So no gate build
+// has debug_assertions, and the release tool's scans (not debug assertions) keep the QA control server out of a release.
+// Every app workspace-root Cargo.toml therefore carries:
+//   - [profile.release] with panic = "unwind" (templates/cargo-profiles.toml),
+//   - no other profile table: no [profile.dev], [profile.test] or custom profile (each would be a second output directory),
+//   - no [profile.release-iterate] (retired; nor anything that inherits it).
+// The same scan also flags a source pattern that behaves differently between the profiles:
+//   - an environment-variable override gated by cfg(debug_assertions): no gate build compiles it (tests and installers
+//     are all release), so only a developer's own cargo run reaches it. Gate it on an explicit feature instead. Heuristic: a
+//     cfg(debug_assertions) attribute or cfg! within 12 lines before an env read.
 //     Suppress a reviewed site with a `rightkit-allow: debug-assertions-env` comment on the cfg line or
 //     the line above it.
 // The template file is the single source: this module reads it, it never copies the values.
@@ -28,12 +29,10 @@ const ENV_WINDOW_LINES = 12;
 // Never part of an app's shipped source: tests, examples, benches and vendored reference copies.
 const SOURCE_SKIP = new Set(["tests", "examples", "benches", "reference"]);
 const ENV_READ = /env::var|var_os|env::set_var|env::remove_var|\benv!\s*\(|option_env!|_env\(|env_var|env_nonempty/;
-const WINDOWS_SUBSYSTEM_GATED = /cfg_attr\s*\((?:(?!\]).)*?not\s*\(\s*debug_assertions\s*\)(?:(?!\]).)*?windows_subsystem/gs;
 
 export function loadCargoProfileTemplate(file = CARGO_PROFILE_TEMPLATE) {
   const profile = parse(readFileSync(file, "utf8")).profile ?? {};
-  const { package: packages = {}, ...dev } = profile.dev ?? {};
-  return { dev, devPackageStar: packages["*"] ?? {}, releasePanic: profile.release?.panic };
+  return { releasePanic: profile.release?.panic };
 }
 
 const isTable = (value) => value && typeof value === "object" && !Array.isArray(value);
@@ -54,21 +53,15 @@ export function checkManifestProfiles(manifest, template, file) {
   const findings = [];
   const finding = (rule, message) => findings.push({ rule, file, message });
   const profiles = isTable(manifest.profile) ? manifest.profile : {};
-  const dev = isTable(profiles.dev) ? profiles.dev : undefined;
-  const { package: devPackages, ...devRest } = dev ?? {};
-  // Subtables of [profile.dev] are checked separately below.
-  const devKeys = Object.fromEntries(Object.entries(devRest).filter(([, value]) => !isTable(value)));
-  compareTable(dev ? devKeys : undefined, template.dev, "[profile.dev]", finding);
-  compareTable(isTable(devPackages) ? devPackages["*"] : undefined, template.devPackageStar, '[profile.dev.package."*"]', finding);
-  if (isTable(devPackages)) for (const name of Object.keys(devPackages)) if (name !== "*") finding("profile-extra", `[profile.dev.package.${show(name)}] is not in the template`);
-  if (dev) for (const name of Object.keys(dev)) if (isTable(dev[name]) && name !== "package") finding("profile-extra", `[profile.dev.${name}] is not in the template`);
-  // [profile.dev] panic is checked with the rest of the dev table above.
+  // One build output (GC-A01, GC-A07): no gate build uses any profile but release, so an app carries no other profile table.
+  for (const name of Object.keys(profiles)) {
+    if (name !== "release" && name !== RETIRED_PROFILE) finding("profile-extra", `[profile.${name}] is not allowed: every gate build uses [profile.release] for the host target (one output directory, GATE-CONTRACT GC-A07); delete the table`);
+  }
   if (profiles.release?.panic !== template.releasePanic) finding("panic", `[profile.release] panic must be ${show(template.releasePanic)} (found ${show(profiles.release?.panic)})`);
   if (RETIRED_PROFILE in profiles) finding("retired-profile", `[profile.${RETIRED_PROFILE}] is retired; delete it and its package overrides`);
   for (const [name, table] of Object.entries(profiles)) {
     if (isTable(table) && table.inherits === RETIRED_PROFILE) finding("retired-profile", `[profile.${name}] inherits the retired ${RETIRED_PROFILE} profile`);
   }
-  if ("test" in profiles) finding("profile-extra", "[profile.test] overrides are not allowed; test inherits dev");
   return findings;
 }
 
@@ -149,7 +142,7 @@ function* rustFiles(dir) {
   }
 }
 
-// Source patterns the single dev profile makes wrong (see the header). Returns findings with a line number.
+// Source patterns that behave differently between the profiles (see the header). Returns findings with a line number.
 export function scanDebugAssertionSources(root) {
   const findings = [];
   for (const file of rustFiles(root)) {
@@ -157,9 +150,6 @@ export function scanDebugAssertionSources(root) {
     if (!text.includes("debug_assertions")) continue;
     const label = path.relative(root, file).split(path.sep).join("/");
     const lineAt = (index) => text.slice(0, index).split("\n").length;
-    for (const match of text.matchAll(WINDOWS_SUBSYSTEM_GATED)) {
-      findings.push({ rule: "windows-subsystem", file: label, line: lineAt(match.index), message: 'cfg_attr(not(debug_assertions), windows_subsystem = ...) opens a console for installed dev apps; set windows_subsystem = "windows" unconditionally' });
-    }
     const lines = text.split("\n");
     lines.forEach((line, index) => {
       const trimmed = line.trim();
@@ -167,7 +157,7 @@ export function scanDebugAssertionSources(root) {
       if (!/#!?\[cfg|cfg!\s*\(/.test(line)) return;
       if (line.includes(ENV_ALLOW_MARKER) || (lines[index - 1] ?? "").includes(ENV_ALLOW_MARKER)) return;
       if (ENV_READ.test(lines.slice(index, index + ENV_WINDOW_LINES + 1).join("\n"))) {
-        findings.push({ rule: "debug-assertions-env", file: label, line: index + 1, message: "environment-variable override gated by cfg(debug_assertions); move it to the app's test-mode feature" });
+        findings.push({ rule: "debug-assertions-env", file: label, line: index + 1, message: "environment-variable override gated by cfg(debug_assertions): present in cargo test, absent from both installers (dev and release use [profile.release]); inject it (a config value or a test root the caller passes), never read it from the environment" });
       }
     });
   }

package/cargo-target-shim.mjs

@@ -60,6 +60,24 @@ const ALIASES = Object.freeze({ b: "build", c: "check", t: "test", r: "run", d:
 const VERSION_PROBES = Object.freeze([["-V"], ["--version"], ["-vV"], ["-Vv"], ["--version", "--verbose"], ["-V", "--verbose"], ["-v", "-V"], ["version"]]);
 // The read-only commands the broker admits to a carried request only in carriedScanRefusal's exact shapes (snapshot-metadata.mjs).
 const CARRIED_SHAPE = new Set(["metadata", "deny", "audit", "fmt"]);
+// GATE-CONTRACT GC-A11 (Adrian, 2026-11-02): a cargo call that compiles nothing never goes to the broker; in broker mode these run directly
+// with the host's real toolchain cargo (map.realCargo), each into its own scratch target, never carried (rustright a2972f0 refuses them).
+export const READ_ONLY_DIRECT = Object.freeze(new Set(["metadata", "fetch", "tree", "pkgid", "verify-project", "read-manifest", "locate-project", "deny", "audit", "fmt"]));
+/** Whether an argv compiles nothing: a READ_ONLY_DIRECT subcommand, or `cargo package --list` (lists files, builds nothing). */
+export function readOnlyCargo(args) {
+  const sub = cargoSubcommandOf(args);
+  return READ_ONLY_DIRECT.has(sub) || (sub === "package" && args.includes("--list"));
+}
+/** The cargo subcommand of an argv (after a +toolchain and global options), or null. */
+export function cargoSubcommandOf(args) {
+  for (let i = args[0]?.startsWith("+") ? 1 : 0; i < args.length; i += 1) {
+    const w = args[i];
+    if (w === "--") return null;
+    if (GLOBAL_VALUE.has(w)) { i += 1; continue; }
+    if (!w.startsWith("-")) return ALIASES[w] ?? w;
+  }
+  return null;
+}
 const insideOf = (child, parent) => { const rel = path.relative(parent, child); return rel === "" || !(rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)); };
 // Global options that take a value (`--color always`, `--explain E0001`); the subcommand is the first word after them.
 const GLOBAL_VALUE = new Set(["--color", "--explain"]);
@@ -306,6 +324,19 @@ export function runShim(argv, { env = process.env, cwd = process.cwd(), spawn =
   let decision;
   try { decision = decideCargoInvocation({ args: words, cwd, env, map, locate }); } catch (error) { return refuse({ code: "RK_CARGO_SHIM_ERROR", message: error.message }); }
   if (decision.refuse) return refuse(decision.refuse);
+  if (broker && decision.exec.workspace && readOnlyCargo(decision.exec.args) && map.realCargo) {
+    // GC-A11: a non-compiling call runs directly with the real toolchain cargo, writing only to its own scratch target (removed after).
+    let scratch;
+    try { scratch = fs.mkdtempSync(path.join(path.dirname(map.ledgerDir), "read-scratch-")); }
+    catch (error) { return refuse({ code: "RK_CARGO_SHIM_ERROR", message: `cannot create a scratch target for a read-only call (${error.message})` }); }
+    const { CARGO_TARGET_DIR: _bound, CARGO_BUILD_TARGET_DIR: _bound2, ...rest } = decision.exec.env ?? env; void _bound; void _bound2;
+    let r;
+    try { r = spawn(map.realCargo, decision.exec.args, { cwd, env: { ...rest, CARGO: map.realCargo, CARGO_TARGET_DIR: scratch }, stdio: "inherit" }); }
+    finally { try { fs.rmSync(scratch, { recursive: true, force: true }); } catch { /* scratch under the wrapper's own directory */ } }
+    if (r.error) return refuse({ code: "RK_CARGO_SHIM_ERROR", message: `${map.realCargo} did not start (${r.error.message})` });
+    record({ ...base, status: "ran", direct: true, exit: r.status ?? null });
+    return r.status ?? (r.signal ? 128 : SHIM_REFUSAL_STATUS);
+  }
   if (broker && decision.exec.workspace) {
     // The `pending` record above stays this call's until the broker call finishes: its records carry the same call id.
     return runBrokerCargo({ words: decision.exec.args, cwd, env, section: map.broker, workspace: decision.exec.workspace, checkoutWorkspace: decision.exec.checkoutWorkspace, record: (entry) => record({ ...entry, id }), spawn, err });

package/cli/right-release.mjs

@@ -21,7 +21,6 @@ const commands = new Map([
   ["sign-windows", "sign-windows.mjs"],
   ["sign-updater", "sign-updater.mjs"],
   ["sign-dev-artifact", "sign-dev-artifact.mjs"],
-  ["sign-qa-bundle", "sign-qa-bundle.mjs"],
   ["sign-candidate", "sign-candidate.mjs"],
   ["engine-locate", "engine-locator.mjs"],
   ["stage-sidecar", "stage-sidecar-command.mjs"],
@@ -35,6 +34,7 @@ const commands = new Map([
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
   ["test", "test-command.mjs"],
   ["web-build", "web-build.mjs"],
+  ["build-helpers", "build-helpers-command.mjs"],
   ["license-notices", "npm-license-notices.mjs"],
   ["toolchain", "toolchain-swift.mjs"],
   ["github", "github-release.mjs"],
@@ -329,8 +329,6 @@ Commands:
                                                       Fail when a built web dist/ carries a forbidden marker string or mock/fixture chunk name (dev, mock or fixture code in release)
   sign-dev-artifact --artifact <dir> --manifest <sign.json> [--metadata <payload.json>] [--evidence <path>] [--dry-run]
                                                       Developer ID sign an existing CI dev artifact per file with fixed identifiers; never builds, notarizes or publishes (macOS)
-  sign-qa-bundle --app <abs .app> --qa-root <abs dir> [--entitlements <abs plist>] [--out <evidence.json>]
-                                                      QA ONLY: ad hoc sign a bundle inside a QA scratch root, nested code first, outer last, never --deep, never the signing agent (macOS); not a release artifact
   sign-candidate --platform win|mac --artifact <dir> --candidate-receipt <receipt.json> --out <binding.json> [--manifest <sign.json>] [--publisher <subject>] [--dry-run]
                                                       Sign the exact unsigned candidate bytes (sha256 checked against the candidate receipt) instead of rebuilding; writes a candidate-sha -> signed-sha binding receipt
   engine-locate --engine cutright|genright [--sha256 <hex>] [--json]
@@ -342,10 +340,10 @@ Commands:
   upload --platform ios --release <id> [--apply]       Sealed IPA to TestFlight, then the exact build into the beta groups; dry run unless --apply (macOS)
   ios-credentials store --key-id <KEYID> --issuer <uuid> | check
                                                       Put the App Store Connect API key (stdin), key id and issuer into the login Keychain once, or check them; never a file (macOS)
-  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa (and the journeys lane when the config sets qa.journeys) and write the sealed QA receipt. Refused inside a QA run. The receipt must match the platform and release id, come from an approved runner digest, and show every release-critical journey passed
-                                                      Admission is per app, and per stage (source = build, installed = upload and publish), in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks that stage. Only adrian moves an app or stage from refuse back to warn, or approves a runner
-  qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
-  qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]
+  qa --stage installed --platform mac|win [--release <id>]   Run rightkit-qa (and the journeys lane when the config sets qa.journeys) and write the sealed QA receipt. Refused inside a QA run. The receipt must match the platform and release id, come from an approved runner digest, and show every release-critical journey passed
+                                                      Admission is per app (installed = upload and publish; there is no source stage, GATE-CONTRACT GC-A07), in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks the publication. Only adrian moves an app from refuse back to warn, or approves a runner
+  qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List installed QA status per release; exit 1 if an uploaded build lacks passing QA
+  qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage installed]
                                                       Show the QA admission policy, or set an app's mode (both stages, or one with --stage)
   qa policy approve-runner --runner <file> --version <v> --platform mac|win --set-by adrian [--note <text>]
                                                       Approve a rightkit-qa runner build for one platform: the file must report "rightkit-qa <v>" from --version and <v> must be the published version

package/create-mac-updater.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from "./background-process.mjs";
 import { existsSync, rmSync } from "node:fs";
 import path from "node:path";
 import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
+import { assertUpdaterMatchesShippedKey } from "./updater-shipped-key.mjs";
 import { ArtifactPathError, loadSplitArtifactContext, resolveArtifactPath, resolveArtifactWritePath } from "./release-artifact-path.mjs";
 
 const args = process.argv.slice(2);
@@ -56,6 +57,9 @@ else {
   console.log(`pnpm exec tauri signer sign ${outputPath}`);
   try { signMacUpdaterFiles([outputPath], { cwd, env }); }
   catch (error) { fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
+  // rightkit#1443: the signature must verify with the key the app ships (tauri.conf plugins.updater.pubkey), whatever key signed it.
+  try { assertUpdaterMatchesShippedKey({ appRoot: cwd, file: outputPath }); }
+  catch (error) { fail(`[MAC_UPDATER_SHIPPED_KEY] ${error.message}`); }
 }
 
 function run(command, commandArgs) {

package/cross-targets.mjs

@@ -0,0 +1,94 @@
+// The three OS targets every crate is checked for on every host (Adrian, 2026-11-02: "anything run through the Mac or the Windows or
+// Linux must all check for all 3"). The host builds and tests its own OS; the other two are `cargo clippy --target` checks, so code under
+// cfg(target_os = "macos") or cfg(windows) fails at the gate instead of at publish.yml native verify (five crates did on 2026-11-02:
+// system-monitor, local-gen, app-manager, dictation-models, credentials). Windows is checked as the GNU target: zig supplies its C
+// toolchain from any host (scripts/ci/provision-zig.mjs), and cfg(windows) code is the same for both Windows ABIs.
+// Shared by local-publish.mjs (unit plans and batch clippy), deterministic-scans.mjs (the gate's class B scans), stage-sidecar.mjs and
+// scripts/ci/gate.mjs. Imports only node:fs and node:path.
+import fs from "node:fs";
+import path from "node:path";
+
+export const CROSS_TARGETS = Object.freeze({ linux: "x86_64-unknown-linux-gnu", darwin: "aarch64-apple-darwin", win32: "x86_64-pc-windows-gnu" });
+/** zig's name for each cross target, for the C compiler wrappers scripts/ci/provision-zig.mjs writes. */
+export const ZIG_TARGETS = Object.freeze({ "x86_64-unknown-linux-gnu": "x86_64-linux-gnu", "aarch64-apple-darwin": "aarch64-macos", "x86_64-pc-windows-gnu": "x86_64-windows-gnu" });
+export const CROSS_CC_ENV = "RIGHTKIT_CROSS_CC_DIR";
+
+/** The host's own build target, as the package stage names it: Windows builds MSVC (win-package-recipe), the Mac and Linux their native arch. */
+export const HOST_TARGETS = Object.freeze({ "darwin-arm64": "aarch64-apple-darwin", "darwin-x64": "x86_64-apple-darwin", "win32-x64": "x86_64-pc-windows-msvc", "win32-arm64": "aarch64-pc-windows-msvc", "linux-x64": "x86_64-unknown-linux-gnu", "linux-arm64": "aarch64-unknown-linux-gnu" });
+export function hostTarget(platform = process.platform, arch = process.arch) {
+  const target = HOST_TARGETS[`${platform}-${arch}`];
+  if (!target) throw new Error(`no host Rust target for ${platform}-${arch}`);
+  return target;
+}
+
+/**
+ * The foreign targets every crate is checked for on `platform`: the other two of CROSS_TARGETS, always. There is no opt-out (Adrian,
+ * 2026-11-03): a crate that cannot be type-checked for an OS has a bug to fix (cfg-gate its OS code, or make its build script return early
+ * for a foreign CARGO_CFG_TARGET_OS). A `crossTargets` key in ci/gate.config.json is refused.
+ */
+export function crossTargetsFor(entry = {}, platform = "darwin") {
+  if (entry?.crossTargets !== undefined || entry?.crossTargetsSkip !== undefined) throw new Error("ci/gate.config.json crossTargets/crossTargetsSkip is not allowed: every crate is checked for all three OS targets");
+  const native = CROSS_TARGETS[platform];
+  if (!native) throw new Error(`no native target for ${platform}`);
+  return Object.values(CROSS_TARGETS).filter((target) => target !== native);
+}
+
+/**
+ * The provisioned zig wrapper directory: RIGHTKIT_CROSS_CC_DIR, else `<managed data root>/zig/cross-cc` (where scripts/ci/provision-zig.mjs
+ * writes on a Mac or Dell), else null.
+ */
+export function crossCcDir({ env = process.env, exists = fs.existsSync, platform = process.platform } = {}) {
+  if (env[CROSS_CC_ENV]) return env[CROSS_CC_ENV];
+  const managed = platform === "win32" ? "D:\\.rightkit-managed" : platform === "darwin" ? "/Volumes/D/.rightkit-managed" : null;
+  const dir = managed ? path.join(managed, "zig", "cross-cc") : null;
+  return dir && exists(dir) ? dir : null;
+}
+
+/** cc-rs / cmake environment pointing a target's C, C++ and archiver at the provisioned zig wrappers (none when unprovisioned). */
+export function crossCompileEnv(target, dir = crossCcDir(), platform = process.platform) {
+  if (!dir) return undefined;
+  const key = target.replaceAll("-", "_");
+  const ext = platform === "win32" ? ".cmd" : "";
+  return {
+    [`CC_${key}`]: path.join(dir, `cc-${target}${ext}`),
+    [`CXX_${key}`]: path.join(dir, `cxx-${target}${ext}`),
+    [`AR_${key}`]: path.join(dir, `ar-${target}${ext}`),
+  };
+}
+
+// One build output and one warm cache per app per host (Adrian: "Flag, no flag, it should go into 1 directory"; GATE-CONTRACT GC-A01, GC-A07).
+// Cargo picks the output directory from the profile (dev -> debug, release -> release) and from whether a target is named
+// (target/<profile> vs target/<triple>/<profile>), so every compile the gate launches is rewritten here, whatever its caller passed:
+// `--profile release` is always set (a request for any other profile, `--debug` included, is refused), and a call that names no target gets
+// the host's own. A call that names another target keeps it (the cross-target check: that OS's own directory, still release).
+// Non-compiling subcommands (metadata, tree, deny, audit, package --list, fmt) are returned unchanged.
+const COMPILE_SUBCOMMANDS = new Set(["build", "b", "check", "c", "clippy", "rustc", "rustdoc", "doc", "d", "test", "t", "bench", "run", "r"]);
+export function oneOutput(args, { platform = process.platform, arch = process.arch } = {}) {
+  // The subcommand is the first word after an optional leading `cargo`, `+<toolchain>` and cargo's own global options.
+  let at = 0;
+  if (args[at] === "cargo") at += 1;
+  while (at < args.length && (args[at].startsWith("+") || args[at].startsWith("-"))) at += ["--config", "-Z", "-C", "--color"].includes(args[at]) ? 2 : 1;
+  if (!COMPILE_SUBCOMMANDS.has(args[at])) return [...args];
+  const head = args.slice(0, at + 1); const rest = [];
+  const tail = args.slice(at + 1);
+  const sep = tail.indexOf("--");
+  const own = sep < 0 ? tail : tail.slice(0, sep);
+  // Hard block (Adrian, 2026-11-03: "i wnat all dev completely gone. all debug too ... never another, hard block"): a compile that asks for any
+  // profile but release is refused, never rewritten. `--release` / `-r` is release and is normalized to `--profile release`.
+  for (let i = 0; i < own.length; i += 1) {
+    const a = own[i];
+    if (a === "--release" || a === "-r") continue;
+    const asked = a === "--debug" ? "dev" : a === "--profile" ? own[i + 1] : a.startsWith("--profile=") ? a.slice("--profile=".length) : null;
+    if (asked !== null) {
+      if (asked !== "release") throw new Error(`RK_PROFILE_REFUSED: cargo ${args[at]} asks for the ${JSON.stringify(asked)} profile; only release is allowed (one build output per app, GATE-CONTRACT GC-A07)`);
+      if (a === "--profile") i += 1;
+      continue;
+    }
+    rest.push(a);
+  }
+  // GATE-CONTRACT GC-A09: tests are isolated by injection; no `test-mode` feature exists in any build (Adrian: "No, no flag").
+  const featureLists = rest.flatMap((a, i) => (a === "--features" || a === "-F" ? [rest[i + 1] ?? ""] : a.startsWith("--features=") ? [a.slice("--features=".length)] : []));
+  if (featureLists.some((list) => list.split(/[\s,]+/).some((f) => f === "test-mode" || f.endsWith("/test-mode")))) throw new Error(`RK_TEST_MODE_REFUSED: cargo ${args[at]} enables a test-mode feature; tests are isolated by injection (GATE-CONTRACT GC-A09), no build has a test mode`);
+  const named = rest.includes("--target") || rest.some((a) => a.startsWith("--target="));
+  return [...head, "--profile", "release", ...(named ? [] : ["--target", hostTarget(platform, arch)]), ...rest, ...(sep < 0 ? [] : tail.slice(sep))];
+}