@rightkit/release 0.6.24 → 0.6.25

package/install-tauri-authenticode.mjs

@@ -5,7 +5,7 @@
 //   1. build the app without bundling    (`target.build`: a `tauri build ... --no-bundle`; runDevelopment runs it before this module)
 //   2. patch the bundle marker           (UNK -> NSS BEFORE signing: Tauri rewrites it during bundling, and doing that to signed bytes breaks Authenticode)
 //   3. sign the exe and its sidecars, then verify them (signer subject, timestamp)
-//   4. carried `tauri bundle --bundles nsis --debug`   (the installer embeds the exe as signed)
+//   4. carried `tauri bundle --bundles nsis` (the installer embeds the exe as signed)
 //   5. check the payload                 (the exe inside the installer is byte for byte the signed one)
 //   6. sign the installer, then verify it
 //   7. install                           (the silent installer, as the unsigned kind runs it)
@@ -74,10 +74,10 @@ export function validateAuthenticodeBuild(build, label = "development.targets.wi
   if (!builds) refuse("TAURI_AUTHENTICODE_BUILD", `${label} has no \`tauri build --no-bundle\` step: this install kind signs the raw exe the build leaves in its output directory`);
 }
 
-/** The carried bundle command (step 4): the same Tauri bundle the release makes, debug profile, no Tauri-side signing (the installer is signed by step 6). */
+/** The carried bundle command (step 4): the same Tauri bundle the release makes (the release profile, GC-A07: no `--debug`), no Tauri-side signing (the installer is signed by step 6). */
 export function authenticodeBundleCommand(descriptor) {
   const override = { bundle: { createUpdaterArtifacts: false, windows: { signCommand: null } } };
-  return { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--debug", "--target", descriptor.targetTriple, "--config", JSON.stringify(override)], ...(descriptor.tauriCwd ? { cwd: descriptor.tauriCwd } : {}), name: "tauri bundle" };
+  return { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", descriptor.targetTriple, "--config", JSON.stringify(override)], ...(descriptor.tauriCwd ? { cwd: descriptor.tauriCwd } : {}), name: "tauri bundle" };
 }
 
 const exeBase = (name) => String(name).replace(/\.exe$/i, "");

package/local-publish.mjs

@@ -31,6 +31,7 @@ import { recordPublished, stageSourceVersions, workspaceFeedOptions } from "./ri
 import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
 import { exclusionsFor, npmContentDigest } from "./pack-digest.mjs";
 import { requireDoorRun, gateStateDir } from "./gate-stages.mjs";
+import { crossCompileEnv, crossTargetsFor, oneOutput } from "./cross-targets.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
 export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
@@ -341,6 +342,8 @@ const consumerDirs = (rows) => [...new Set(rows.map((row) => path.posix.dirname(
 // the file on disk must be the committed file, or the publish is refused.
 export const GATE_CONFIG_FILES = Object.freeze(["ci/gate.config.json", "ci/asset-gated.json"]);
 
+export { CROSS_TARGETS, ZIG_TARGETS, CROSS_CC_ENV, crossTargetsFor, crossCompileEnv } from "./cross-targets.mjs";
+
 /** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
 export function localTestPlan({ kind, unit, dir, config, manifest, batch = false, platform = "darwin" }) {
   if (kind === "npm") {
@@ -367,6 +370,16 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
   // Batch mode lints the whole batch once (batchClippyInvocations) and records it as a batch receipt.
   // Every tested feature set is linted (-D warnings), not only the first.
   if (!batch) for (const features of featureSets) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"], test: false });
+  // Every crate is checked for the other two OS targets too, every tested feature set, -D warnings (CROSS_TARGETS). Batch mode
+  // lints them with the batch's own clippy (batchClippyInvocations crossTargetsOf).
+  if (!batch) for (const target of crossTargetsFor(entry, platform)) {
+    for (const features of featureSets) {
+      const env = crossCompileEnv(target);
+      // GC-A14: a host without the zig C toolchain fails the check, never skips it.
+      if (!env) refuse(`RK_CROSS_CC_UNPROVISIONED: the zig C toolchain for ${target} is not provisioned; run node scripts/ci/provision-zig.mjs <managed data root>/zig (or set RIGHTKIT_CROSS_CC_DIR)`);
+      steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", "--target", target, ...features, "--", "-D", "warnings"], test: false, ...(env ? { env } : {}) });
+    }
+  }
   for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--message-format=json-render-diagnostics", "--all-targets", ...features], test: false });
   // rustdoc with -D warnings, for the tested and the checked feature sets: the same rows the CI shards (scripts/ci/gate.mjs) and
   // publish.yml's native verify run, so a broken or private intra-doc link fails this unit stage instead of a later verify.
@@ -385,7 +398,7 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
  * names two crates: one `-p <crate>` run per crate and feature set, in layer order. Crates with a different
  * RIGHTKIT_REQUIRE_ASSETS (asset-gated) keep their own environment.
  */
-export function batchClippyInvocations(layer, { featuresOf = () => [], featureSetsOf = (unit) => [featuresOf(unit)], assetGatedOf = () => false } = {}) {
+export function batchClippyInvocations(layer, { featuresOf = () => [], featureSetsOf = (unit) => [featuresOf(unit)], assetGatedOf = () => false, crossTargetsOf = () => [] } = {}) {
   const invocations = [];
   for (const unit of layer) {
     // Every tested feature set of a crate is linted, in order; identical sets of one crate collapse to one run.
@@ -397,6 +410,14 @@ export function batchClippyInvocations(layer, { featuresOf = () => [], featureSe
         crates: [unit], assetGated: assetGatedOf(unit),
         args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
       });
+      for (const target of crossTargetsOf(unit)) {
+        const env = crossCompileEnv(target);
+        if (!env) throw new Error(`RK_CROSS_CC_UNPROVISIONED: the zig C toolchain for ${target} is not provisioned; run node scripts/ci/provision-zig.mjs <managed data root>/zig (or set RIGHTKIT_CROSS_CC_DIR)`);
+        invocations.push({
+          crates: [unit], assetGated: assetGatedOf(unit), ...(env ? { env } : {}),
+          args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", "--target", target, ...features, "--", "-D", "warnings"],
+        });
+      }
     }
   }
   return invocations;
@@ -670,7 +691,7 @@ async function* publishUnitStages(parsed, deps, batch) {
     // A crate's own steps run in its Cargo workspace (its own Cargo.lock and target directory, #1285); a consumer row names its
     // separate workspace by --manifest-path relative to the repository root.
     const stepCwd = kind === "cargo" && step.command === "cargo" && !step.args.includes("--manifest-path") ? unitPath : workspaceRoot;
-    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: stepCwd, env: step.env ? { ...env, ...step.env } : env });
+    const result = await run(step.command, step.command === "cargo" ? oneOutput(withCargoJobs(step.args, parsed.jobs), { platform }) : step.args, { cwd: stepCwd, env: step.env ? { ...env, ...step.env } : env });
     const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
     if (result.error || result.status !== 0) {
       steps.push(row);
@@ -890,7 +911,7 @@ async function runLocalPublishBatch(parsed, deps) {
     const text = `${command} ${args.join(" ")}`;
     log(`[right-release] batch ${name}: ${text}`);
     for (const cwd of cwds) {
-      const result = await run(command, args, { cwd, env: runEnv });
+      const result = await run(command, command === "cargo" ? oneOutput(args, { platform }) : args, { cwd, env: runEnv });
       if (result.error || result.status !== 0) refuse(`batch ${name} failed (${result.error?.message ?? `exit ${result.status}`}): ${text}${cwd === workspaceRoot ? "" : ` (in ${path.relative(workspaceRoot, cwd)})`}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
     }
     checks.push({ name, command: text, ok: true, ...stamp, ...(crateNames ? { crates: crateNames } : {}) });
@@ -906,8 +927,9 @@ async function runLocalPublishBatch(parsed, deps) {
   commands.push(scanText);
   const featureSetsOf = (unit) => gateConfig?.rust?.[unit]?.featureSets ?? [[]];
   for (const layer of layers) {
-    for (const invocation of batchClippyInvocations(layer, { featureSetsOf, assetGatedOf: isAssetGated })) {
-      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated), invocation.crates.map((unit) => path.join(workspaceRoot, "crates", unit)));
+    for (const invocation of batchClippyInvocations(layer, { featureSetsOf, assetGatedOf: isAssetGated, crossTargetsOf: (unit) => crossTargetsFor(gateConfig?.rust?.[unit], platform) })) {
+      // A cross-target invocation carries the zig C toolchain environment for its target (crossCompileEnv).
+      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, { ...testEnv(deps, invocation.assetGated), ...(invocation.env ?? {}) }, invocation.crates.map((unit) => path.join(workspaceRoot, "crates", unit)));
     }
   }
   const receipt = { id: `batch-${head.slice(0, 12)}-${sha256(JSON.stringify(layers)).slice(0, 8)}`, ...stamp, crates, checks };

package/mac-package-recipe.mjs

@@ -23,6 +23,7 @@ import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { runMacCodesignCommands, signMacUpdaterFiles } from "./macos-signing-session.mjs";
 import { discoverNestedCode } from "./swift-mac-app.mjs";
+import { assertUpdaterMatchesShippedKey } from "./updater-shipped-key.mjs";
 
 /**
  * Typed error. Codes: MAC_PACKAGE_CONFIG_INVALID, MAC_PACKAGE_HOST_UNSUPPORTED, MAC_PACKAGE_INPUT_MISSING,
@@ -35,7 +36,7 @@ export class MacPackageRecipeError extends Error {
 
 export const MAC_PACKAGE_STEPS = Object.freeze(["universal", "sign-nested", "sign-app", "dmg", "sign-dmg", "notarize", "updater"]);
 const UNIVERSAL_ARCHS = ["x86_64", "arm64"];
-const MACPACKAGE_KEYS = ["universal", "dmg", "notarize", "updater", "nested", "entitlements"];
+const MACPACKAGE_KEYS = ["universal", "dmg", "notarize", "updater", "nested", "entitlements", "requiredEntitlements"];
 const DMG_KEYS = ["name", "background", "windowSize", "iconPositions"];
 const ICON_KEYS = ["app", "applications"];
 
@@ -98,7 +99,20 @@ export function validateMacPackageConfig(macPackage) {
     if (new Set(nested).size !== nested.length) throw invalid("nested globs must be unique");
   }
   if (macPackage.entitlements !== undefined && (typeof macPackage.entitlements !== "string" || !macPackage.entitlements.trim())) throw invalid("entitlements must be a path string");
-  return { universal, dmg: normalized, notarize, updater, nested, ...(macPackage.entitlements ? { entitlements: macPackage.entitlements } : {}) };
+  // rightkit#1443 (hrmac: R2 checked the production APNs entitlement in the signed app): `requiredEntitlements` maps a bundle-relative
+  // executable to entitlement keys and the exact value each must carry after signing (a string, or true for a boolean entitlement).
+  let requiredEntitlements = null;
+  if (macPackage.requiredEntitlements !== undefined) {
+    const re = macPackage.requiredEntitlements;
+    if (!re || typeof re !== "object" || Array.isArray(re) || !Object.keys(re).length) throw invalid("requiredEntitlements must map bundle-relative executables to {entitlement: value}");
+    for (const [file, keys] of Object.entries(re)) {
+      validateGlob(file, `requiredEntitlements key ${file}`);
+      if (!keys || typeof keys !== "object" || Array.isArray(keys) || !Object.keys(keys).length) throw invalid(`requiredEntitlements.${file} must be a non-empty {entitlement: value} object`);
+      for (const [k, v] of Object.entries(keys)) if (!(typeof v === "string" || v === true)) throw invalid(`requiredEntitlements.${file}.${k} must be a string or true`);
+    }
+    requiredEntitlements = re;
+  }
+  return { universal, dmg: normalized, notarize, updater, nested, ...(macPackage.entitlements ? { entitlements: macPackage.entitlements } : {}), ...(requiredEntitlements ? { requiredEntitlements } : {}) };
 }
 
 /**
@@ -160,6 +174,35 @@ const defaultInspect = (cmd, args) => {
  * listFiles(dir) -> bundle-relative posix paths, buildDmg(options), notarize(options), run(cmd, args, opts),
  * signUpdater(files, options), receiptPath, log(event).
  */
+/** Every required entitlement is present, with its exact value, in the signed executable (`codesign -d --entitlements :-`, an XML plist). */
+export function macRequiredEntitlementsCheck({ app, required, run = spawnSync, env = process.env }) {
+  const esc = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  for (const [file, keys] of Object.entries(required)) {
+    const target = path.join(app, ...file.split("/"));
+    const r = run("codesign", ["-d", "--entitlements", ":-", target], { env, encoding: "utf8" });
+    if (!r || r.error || r.status !== 0) throw new Error(`codesign -d --entitlements on ${file} failed (${r?.error?.message ?? `exit ${r?.status}`})`);
+    const plist = String(r.stdout ?? "");
+    for (const [k, v] of Object.entries(keys)) {
+      const want = v === true ? "<true\\s*/>" : `<string>${esc(String(v))}</string>`;
+      if (!new RegExp(`<key>${esc(k)}</key>\\s*${want}`).test(plist)) throw new Error(`${file} is signed without the required entitlement ${k} = ${JSON.stringify(v)}`);
+    }
+  }
+}
+
+/** Gatekeeper's verdict on the shipped app and DMG, as a user's Mac reaches it: staple validation and spctl assessment. Throws on any refusal. */
+export function macGatekeeperCheck({ app, dmg, run = spawnSync, env = process.env }) {
+  const checks = [
+    ["xcrun", ["stapler", "validate", app]],
+    ["xcrun", ["stapler", "validate", dmg]],
+    ["spctl", ["--assess", "--type", "execute", "-v", app]],
+    ["spctl", ["--assess", "--type", "open", "--context", "context:primary-signature", "-v", dmg]],
+  ];
+  for (const [cmd, args] of checks) {
+    const r = run(cmd, args, { env, encoding: "utf8" });
+    if (!r || r.error || r.status !== 0) throw new Error(`${cmd} ${args.join(" ")} refused (${r?.error?.message ?? `exit ${r?.status}`}): ${String(r?.stderr ?? r?.stdout ?? "").trim().split(/\r?\n/).slice(-2).join(" | ")}`);
+  }
+}
+
 export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} }) {
   let artifactPaths = null;
   const { recipe, app: declaredApp, dmgFile } = validateMacPackageTarget(target);
@@ -254,6 +297,10 @@ export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} })
     }
     try { signing.push(...signMacosEntries([{ file: app, hardenedRuntime: true, options: [], ...(entitlements ? { entitlements } : {}) }], { identity, ...signOptions })); }
     catch (error) { throw wrap("MAC_PACKAGE_SIGN_FAILED", "app signing", error); }
+    if (recipe.requiredEntitlements) {
+      try { (deps.entitlementsCheck ?? macRequiredEntitlementsCheck)({ app, required: recipe.requiredEntitlements, run, env }); }
+      catch (error) { throw wrap("MAC_PACKAGE_SIGN_FAILED", "required entitlements", error); }
+    }
     record("sign-app");
 
     // 4) branded DMG from the signed app.
@@ -280,6 +327,10 @@ export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} })
       try { receipt = notarize({ archive: dmg, app, receiptPath, env, run }); }
       catch (error) { throw wrap("MAC_PACKAGE_NOTARIZE_FAILED", "notarization", error); }
       if (!receipt || receipt.notarization?.status !== "Accepted") throw new MacPackageRecipeError("MAC_PACKAGE_NOTARIZE_FAILED", `macPackage notarization did not report Accepted for ${dmg}`);
+      // rightkit#1443 (hrmac: R2's verify-macos-release-artifacts.mjs did this; the gate had dropped it): what a user's Mac will check, checked
+      // here: the staple of the app and the DMG validates, and Gatekeeper accepts the app (execute) and the DMG (open, primary signature).
+      try { (deps.gatekeeper ?? macGatekeeperCheck)({ app, dmg, run, env }); }
+      catch (error) { throw wrap("MAC_PACKAGE_NOTARIZE_FAILED", "Gatekeeper and staple validation", error); }
       record("notarize");
     }
 
@@ -296,6 +347,8 @@ export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} })
       try { signUpdater([updater], { cwd: appRoot, env }); }
       catch (error) { throw wrap("MAC_PACKAGE_UPDATER_FAILED", "updater signing", error); }
       for (const file of updaterFiles) if (!fs.existsSync(file)) throw missing("updater artifact", file);
+      try { (deps.verifyUpdater ?? assertUpdaterMatchesShippedKey)({ appRoot, file: updater }); }
+      catch (error) { throw wrap("MAC_PACKAGE_UPDATER_FAILED", "updater signature against the shipped key", error); }
       record("updater");
     }
   } catch (error) {

package/managed-roots.mjs

@@ -27,17 +27,23 @@ export const envNamed = (env, name) => {
  * way (rustright 07829c05, pinned in the shared fixtures as "linux no-env defaults to the account state directory"). The broker's answering roots, not either
  * resolver's guess, say where a running broker keeps its state.
  */
-export function resolveManagedRoots({ env = process.env, platform = process.platform, home = homedir(), controlRoot, dataRoot, runtimeRoot } = {}) {
+export function resolveManagedRoots({ env = process.env, platform = process.platform, home = homedir(), controlRoot, dataRoot, runtimeRoot, windowsControlDefault = 'localappdata' } = {}) {
   const paths = platform === 'win32' ? win32 : posix;
   const legacyRoot = platform === 'win32' ? 'D:\\.rightkit-managed' : '/Volumes/D/.rightkit-managed';
   const managedPlatform = platform === 'darwin' || platform === 'win32';
   dataRoot ??= envNamed(env, 'DATA_ROOT') || envNamed(env, 'MANAGED_ROOT') || envNamed(env, 'EXTERNAL_ROOT') || (managedPlatform ? legacyRoot : paths.join(home, '.local', 'state', 'rightkit'));
+  // rustright#54 (Adrian, 2026-11-02: "all apps are installed in internal drives ... doesn't rr belong there? the dev workspace sits on d"): the
+  // Windows control root (config, logs, policy, agent-bin, attestation) is %LOCALAPPDATA%\RightKit\build-control, as the Mac's is under Application
+  // Support; build data (ws, sccache, cargo home, snapshots) stays on the data root. Flipped together with rustright-config WindowsControlDefault.
+  const localAppData = () => env.LOCALAPPDATA || paths.join(home, 'AppData', 'Local');
   controlRoot ??= envNamed(env, 'CONTROL_ROOT') || (platform === 'darwin'
-    ? paths.join(home, 'Library', 'Application Support', 'RightKit', 'build-control') : dataRoot);
-  runtimeRoot ??= envNamed(env, 'RUNTIME_ROOT') || (platform === 'darwin' ? paths.join(home, 'Library', 'Application Support', 'RustRight') : platform === 'win32' ? 'D:\\.rustright' : controlRoot);
+    ? paths.join(home, 'Library', 'Application Support', 'RightKit', 'build-control')
+    : platform === 'win32' && windowsControlDefault === 'localappdata' ? paths.join(localAppData(), 'RightKit', 'build-control') : dataRoot);
+  runtimeRoot ??= envNamed(env, 'RUNTIME_ROOT') || (platform === 'darwin' ? paths.join(home, 'Library', 'Application Support', 'RustRight') : platform === 'win32' ? (windowsControlDefault === 'localappdata' ? paths.join(localAppData(), 'RustRight') : 'D:\\.rustright') : controlRoot);
   return Object.freeze({ controlRoot, dataRoot, legacyRoot, runtimeCurrent: paths.join(controlRoot, 'runtime'), runtimeRoot, liveRuntime: paths.join(runtimeRoot, 'runtime'),
     configPath: paths.join(controlRoot, 'config.json'), socket: platform === 'win32' ? null : paths.join(controlRoot, 'broker.sock'),
-    logs: paths.join(controlRoot, 'logs'), agentBin: paths.join(controlRoot, 'agent-bin'),
+    // rustright 303c6c6: on Windows agent-bin stays on the data root (agents' PATH and broker job PATH use D:\\.rightkit-managed\\agent-bin).
+    logs: paths.join(controlRoot, 'logs'), agentBin: platform === 'win32' ? paths.join(dataRoot, 'agent-bin') : paths.join(controlRoot, 'agent-bin'),
     agentPolicy: paths.join(controlRoot, 'agent-policy'), ownershipInstall: paths.join(controlRoot, 'ownership-install'),
     // The Mac signing agent already lives on the internal disk; moving it would force a re-provision.
     signingAgent: platform === 'darwin' ? paths.join(home, 'Library', 'Application Support', 'Orthic Labs', 'shared', 'signing-agent')
@@ -144,6 +150,8 @@ export function managedRuntimeClient(env = process.env, platform = process.platf
   const roots = managedControlCandidates({ env, platform, home });
   const configured = resolveManagedRoots({ env, platform, home });
   const ordered = [paths.join(configured.liveRuntime, exe)];
+  // rustright#54: until a Windows host's cutover moves the runtime to %LOCALAPPDATA%\\RustRight, its live runtime is still the legacy one.
+  if (platform === 'win32') ordered.push(paths.join(resolveManagedRoots({ env, platform, home, windowsControlDefault: 'legacy' }).liveRuntime, exe));
   for (const root of roots) ordered.push(paths.join(root, 'runtime', exe));
   for (const root of roots) ordered.push(paths.join(root, 'runtime-current', exe)); // the pre-cutover link: last, never preferred over the live runtime
   if (platform === 'darwin') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.24",
+  "version": "0.6.25",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -100,12 +100,8 @@
     "smol-toml": "1.9.1"
   },
   "scripts": {
-    "test": "node test-support/run-test-shards.mjs --class=unit",
-    "test:broker": "node test-support/run-test-shards.mjs --class=broker",
-    "test:all": "node test-support/run-test-shards.mjs --class=all",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "test:signer:windows": "node sign-release-manifest.integration.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }
 }

package/pipeline-admission.mjs

@@ -40,7 +40,7 @@ export const hasShellMeta = (text) => SHELL_META.test(String(text));
 /** right-release subcommands a config may invoke (the CLI's own commands; unknown names are refused). */
 export const OWNER_SUBCOMMANDS = Object.freeze(new Set([
   "release", "build", "package", "publish", "upload", "deps", "publish-update", "hardening", "harden", "hardeningscan", "sign-windows",
-  "sign-updater", "sign-dev-artifact", "sign-qa-bundle", "sign-candidate", "engine-locate", "stage-sidecar", "init", "pe", "icons", "recipe-build",
+  "sign-updater", "sign-dev-artifact", "sign-candidate", "engine-locate", "stage-sidecar", "init", "pe", "icons", "recipe-build",
   "signing-agent", "create-mac-updater", "mirror-root-artifact", "test", "web-build", "license-notices", "toolchain", "github",
   "cargo-target", "qa", "ownership", "ownership-approval", "ownership-report", "ownership-mandatory", "adoption-evidence", "swift-package", "bundle-scan",
   "check-release-dependencies", "dist-scan", "identity-scan", "apple-profile-create", "ios-credentials", "dev", "doctor", "hooks",