@rightkit/release 0.6.24 → 0.6.25

package/rightkit-registry-resolver.mjs

@@ -320,6 +320,9 @@ export async function resolveRightKitPins({
   const observedAt = new Date(now()).toISOString();
   const packuments = new Map();
   const packument = (name) => { if (!packuments.has(name)) packuments.set(name, client.getJson(npmUrl(name), { accept: "application/vnd.npm.install-v1+json" })); return packuments.get(name); };
+  // The freshness bar needs publish dates: the abbreviated packument has no `time`, so the full one is read for the settle.
+  const fullPackuments = new Map();
+  const fullPackument = (name) => { if (!fullPackuments.has(name)) fullPackuments.set(name, client.getJson(npmUrl(name), { accept: "application/json" })); return fullPackuments.get(name); };
   const indexes = new Map();
   const index = (name) => { if (!indexes.has(name)) indexes.set(name, client.getJson(cargoIndexUrl(name), { text: true })); return indexes.get(name); };
 
@@ -379,17 +382,24 @@ export async function resolveRightKitPins({
   };
   await pool(names, async (entry) => {
     try {
-      let value;
+      let value; let body;
       if (entry.ecosystem === "npm") {
-        value = (await packument(entry.name)).body?.["dist-tags"]?.latest;
+        body = (await fullPackument(entry.name)).body;
+        value = body?.["dist-tags"]?.latest;
       } else {
         const response = await client.getJson(`${REGISTRIES.cargoApi}${entry.name}`);
+        body = response.body;
         value = response.body?.crate?.max_stable_version;
       }
       if (typeof value !== "string" || !EXACT_SEMVER.test(value)) throw new RightKitRegistryError("registry-outage", `${entry.name} registry answer carries no usable latest version`, { recoverable: true });
       const previous = cache.read("latest", entry.ecosystem, entry.name);
       const mark = previous?.highWater?.version ?? previous?.latest;
-      const row = { ecosystem: entry.ecosystem, name: entry.name, latest: value, observedAt, via: "live" };
+      // The freshness bar is the settled latest (published at least SETTLE_MS ago), never above the live latest.
+      const settled = settledLatest(entry.ecosystem, body);
+      // Fail closed: a registry answer without publish dates cannot prove a version is settled (never fall back to the live latest).
+      if (settled === null) throw new RightKitRegistryError("registry-outage", `${entry.name} registry answer carries no publish dates, so the 24-hour settle cannot be judged`, { recoverable: true });
+      const bar = settled && EXACT_SEMVER.test(settled) && compareVersions(settled, value) < 0 ? settled : value;
+      const row = { ecosystem: entry.ecosystem, name: entry.name, latest: bar, ...(bar !== value ? { liveLatest: value } : {}), observedAt, via: "live" };
       let highWater = { version: value, observedAt };
       if (typeof mark === "string" && EXACT_SEMVER.test(mark) && compareVersions(mark, value) > 0) {
         if (entry.ecosystem === "npm" && await stillPublished(entry, mark)) {
@@ -586,6 +596,28 @@ export function verifiedVersionMaps(snapshot) {
   return maps;
 }
 
+/**
+ * Adrian, 2026-11-02: a pin is held to the newest version that has been published for at least 24 hours (`SETTLE_MS`), so a RightKit publish
+ * during an app's run never turns its pins stale. The registry's live latest is still recorded (`liveLatest`). Versions are the registry's own:
+ * crates.io `versions[]` ({num, created_at, yanked}), npm `time` + `versions` (deprecated skipped). When no stable version is that old, the
+ * oldest stable version is the floor (nothing newer is required yet). Returns null when the registry answer carries no dates.
+ */
+export const SETTLE_MS = 24 * 60 * 60 * 1000;
+export function settledLatest(ecosystem, body, { now = Date.now(), settleMs = SETTLE_MS } = {}) {
+  let rows;
+  if (ecosystem === "npm") {
+    const times = body?.time ?? {}; const versions = body?.versions ?? {};
+    rows = Object.keys(versions).filter((v) => !versions[v]?.deprecated).map((v) => ({ v, at: Date.parse(times[v]) }));
+  } else {
+    rows = (body?.versions ?? []).filter((r) => r && !r.yanked).map((r) => ({ v: r.num, at: Date.parse(r.created_at) }));
+  }
+  rows = rows.filter((r) => typeof r.v === "string" && EXACT_SEMVER.test(r.v) && !r.v.includes("-") && Number.isFinite(r.at));
+  if (!rows.length) return null;
+  const byVersion = (a, b) => compareVersions(a.v, b.v);
+  const settled = rows.filter((r) => now - r.at >= settleMs).sort(byVersion);
+  return settled.length ? settled.at(-1).v : rows.sort(byVersion)[0].v;
+}
+
 // ---------------------------------------------------------------------------------------------- freshness + holds
 
 function matchesPattern(name, pattern) {

package/rightkit-versions.json

@@ -49,7 +49,7 @@
     "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.24",
+    "@rightkit/release": "0.6.25",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/social-ui": "0.1.0",
     "@rightkit/system-ui": "0.1.0",
@@ -607,7 +607,7 @@
     "rightkit-playback": "0.3.0",
     "rightkit-policy-rules": "0.1.0",
     "rightkit-privileged-helper": "0.1.0",
-    "rightkit-qa": "0.10.1",
+    "rightkit-qa": "0.10.2",
     "rightkit-qa-driver": "0.7.0",
     "rightkit-record": "0.3.3",
     "rightkit-reframe": "0.1.0",

package/sign-windows.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Windows Authenticode signing through Azure Artifact Signing. Two entries: the CLI (`node sign-windows.mjs [--dry-run|--verify-only] [--receipt <file>] <file>...`,
-// unchanged) and the functions `signWindowsFiles` / `verifyWindowsFiles` that the gate's in-process signing steps reuse (suite-signing.mjs), so there is
+// unchanged) and the functions `signWindowsFiles` / `verifyWindowsFiles` that the gate's signing steps reuse, so there is
 // one signer and one verifier. The identity is the signer SUBJECT (WINDOWS_SIGNER_SUBJECT), never a thumbprint.
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";

package/snapshot-broker.mjs

@@ -49,9 +49,25 @@ export const CALLING_GATE_ENV = "RUSTRIGHT_CALLING_GATE";
 /** The managed `ws` roots a broker pins its generation targets under (BROKER-CONTRACT output pinning). */
 export const brokerOutputRoots = ({ dataRoot }) => [path.join(dataRoot, "rightkit-build-control", "ws")];
 
-/** The broker's receipt of one request, read through the RustRight client (`rustright status <id>`), synchronously. */
-export function receiptSync({ client, requestId, env, spawn = spawnSync, platform = process.platform }) {
-  return receiptFromReply(spawnBrokerClient(spawn, client, ["status", requestId], statusOptions(env), { platform }), requestId);
+/**
+ * The longest a read waits for a job that is still live although its client already exited (A7). The client can return before the broker
+ * has started the job (a race seen at 16 lanes), so one STATUS read of a live job is not a verdict: the read then follows the job with
+ * `rustright attach <id>` (the client's WATCH: it blocks until the job ends and rides out a broker restart; never a poll) and reads STATUS again.
+ */
+export const LIVE_WAIT_MS = 300_000;
+const liveWaitOptions = (env, ms) => ({ ...statusOptions(env), timeout: ms });
+const isLiveRead = (e) => e?.diagnosis?.kind === "live";
+const stillLive = (e, waitedMs) => Object.assign(new SnapshotRequestError(e.code, `${e.message}; the read also waited up to ${Math.round(waitedMs / 1000)} s with \`rustright attach\` (WATCH) for the terminal state and the job was still live`), { diagnosis: e.diagnosis });
+
+/** The broker's receipt of one request, read through the RustRight client (`rustright status <id>`), synchronously; a live job is waited for once, bounded (LIVE_WAIT_MS). */
+export function receiptSync({ client, requestId, env, spawn = spawnSync, platform = process.platform, liveWaitMs = LIVE_WAIT_MS }) {
+  const read = () => receiptFromReply(spawnBrokerClient(spawn, client, ["status", requestId], statusOptions(env), { platform }), requestId);
+  try { return read(); } catch (e) {
+    if (!isLiveRead(e) || !(liveWaitMs > 0)) throw e;
+    // The attach result is not the verdict (its stream is not a receipt): whatever it ends with, the terminal state is read back by STATUS.
+    spawnBrokerClient(spawn, client, ["attach", requestId], liveWaitOptions(env, liveWaitMs), { platform });
+    try { return read(); } catch (again) { throw isLiveRead(again) ? stillLive(again, liveWaitMs) : again; }
+  }
 }
 const statusOptions = (env) => ({ encoding: "utf8", env, timeout: 60_000, maxBuffer: 64 * 1024 * 1024 });
 
@@ -63,7 +79,8 @@ function receiptFromReply(r, requestId) {
   // A refused or unavailable reply may arrive with a nonzero exit (the client exits 125 on a REJECTED result): its typed body is still diagnosed (GB-84).
   try { doc = JSON.parse(String(r.stdout)); } catch { throw r.status !== 0 ? failedRun() : new SnapshotRequestError("receipt", `rustright status ${requestId} printed no JSON`); }
   // The status envelope is `{type:"STATUS", id, state, ..., receipt}`: `receipt` is null while the job is live and full once it is
-  // terminal. Polling is not allowed, so a null receipt after the cargo process exited is a clear error, never a retry.
+  // terminal. A null receipt after the cargo process exited is not a verdict at once: the caller waits for the terminal state once (receiptSync:
+  // `rustright attach`, bounded, never a poll), and a job still live after that is a clear error, never a retry.
   // GB-53: an over-cap outcome is a typed truncation, never a missing-field mystery.
   const over = overCapProblem(doc);
   if (over) throw new SnapshotRequestError(over.code, `rustright status ${requestId}: ${over.message}`);
@@ -386,7 +403,7 @@ function carryBrokerCargoOnce({ words, cwd, env, section, workspace, checkoutWor
     } catch (e) { return refuse("RK_CARGO_BROKER_CARRIER", e.message); }
     try { record({ ...base, status: "pending", nonce: made.carrier.nonce, requestRef: path.join(refDir, "request.json"), ownershipHandle: made.carrier.ownership.handle, checkoutCwd, spawnCwd }); } catch (e) { removeCarrier(made.file); return refuse("RK_CARGO_LEDGER_ERROR", `the call cannot be recorded (${e.message}); it does not run`); }
     // GB-52: the call's operation deadline (the caller's own cap is never replaced) and an outer guard past the client's own cancel wait.
-    const childEnv = { ...clientEnv, ...made.env, ...operationDeadlineEnv({ env: clientEnv, deadlineMs }) };
+    const childEnv = { RUST_BACKTRACE: clientEnv.RUST_BACKTRACE ?? "1", ...clientEnv, ...made.env, ...operationDeadlineEnv({ env: clientEnv, deadlineMs }) };
     const guard = clientGuardMs(childEnv);
     const capture = stdio === "capture";
     // Broker work may exist from the next statement on: the ownership records this request's sub-handle first (a mark that does not land sends nothing).
@@ -410,6 +427,7 @@ function carryBrokerCargoOnce({ words, cwd, env, section, workspace, checkoutWor
     } catch (e) {
       outcome = { status: "unverified", code: e.code ?? "error", message: e.message, ...(ref ? { requestId: ref.requestId, workspace: ref.workspace } : {}) };
     }
+    outcome = { ...outcome, clientStatus: r.status ?? null, clientSignal: r.signal ?? null }; // A7: the client's own exit, kept with every outcome
     const out = capture ? { stdout: String(r.stdout ?? ""), stderr: String(r.stderr ?? "") } : { stdout: "", stderr: "" };
     // GB-54: a request the broker REFUSED (admission paused, a suspended or unknown job, a cutover drain) never started: the client's typed REJECTED result is kept as the outcome's
     // code ("admission is paused; nothing was spawned"), not folded into a missing request reference. It is never a build outcome.
@@ -595,7 +613,7 @@ function* carryBrokerAdapterSteps({ adapter, words, cwd, env, section, record, e
     } catch (e) { return refuse("RK_ADAPTER_BROKER_CARRIER", e.message); }
     try { record({ ...base, status: "pending", nonce: made.carrier.nonce, requestRef: path.join(refDir, "request.json"), ownershipHandle: made.carrier.ownership.handle, checkoutCwd, spawnCwd }); } catch (e) { removeCarrier(made.file); return refuse("RK_CARGO_LEDGER_ERROR", `the call cannot be recorded (${e.message}); it does not run`); }
     // GB-52: the call's operation deadline (the caller's own cap is never replaced) and an outer guard past the client's own cancel wait.
-    const childEnv = { ...clientEnv, ...made.env, ...operationDeadlineEnv({ env: clientEnv, deadlineMs }) };
+    const childEnv = { RUST_BACKTRACE: clientEnv.RUST_BACKTRACE ?? "1", ...clientEnv, ...made.env, ...operationDeadlineEnv({ env: clientEnv, deadlineMs }) };
     const guard = clientGuardMs(childEnv);
     const capture = stdio === "capture";
     // Broker work may exist from the next statement on: the ownership records this request's sub-handle first (a mark that does not land sends nothing).
@@ -625,14 +643,21 @@ function* carryBrokerAdapterSteps({ adapter, words, cwd, env, section, record, e
       // directory in the snapshot), which must be inside that root"). It is the carrier's primaryCwd, never the toplevel for a step run from a subfolder
       // (an app whose root is `app/`), and never a directory outside the primary checkout or one that is not this call's counterpart.
       if (canonicalCounterpart(ref.workspace) !== canonicalCounterpart(checkoutCwd) || !inside(canonicalCounterpart(ref.workspace), section.checkout)) throw new SnapshotRequestError("workspace", `the request's workspace ${ref.workspace} is not the primary checkout counterpart ${checkoutCwd} of the step's directory ${realCwd} (primary toplevel ${section.checkout})`);
-      const statusReply = yield { args: ["status", ref.requestId], options: statusOptions(clientEnv) };
-      const receipt = receiptFromReply(statusReply, ref.requestId);
+      let statusReply = yield { args: ["status", ref.requestId], options: statusOptions(clientEnv) };
+      // A job still live although its client exited (A7): follow it once with `rustright attach` (WATCH, bounded), then read STATUS again; never a poll.
+      let liveWaited = false;
+      try { receiptFromReply(statusReply, ref.requestId); } catch (probe) {
+        if (isLiveRead(probe)) { yield { args: ["attach", ref.requestId], options: liveWaitOptions(clientEnv, LIVE_WAIT_MS) }; statusReply = yield { args: ["status", ref.requestId], options: statusOptions(clientEnv) }; liveWaited = true; }
+      }
+      let receipt;
+      try { receipt = receiptFromReply(statusReply, ref.requestId); } catch (again) { throw liveWaited && isLiveRead(again) ? stillLive(again, LIVE_WAIT_MS) : again; }
       const { payload, evidence, attribution, toolchain, nestedChildren } = verifySnapshotReceipt(receipt, { pins: section.pins, jobId: ref.requestId, carrier: made.carrier, argv: words, workspace: ref.workspace, adapter, adapterEnv, checkout: section.checkout, outputRoots: section.outputRoots, platform: section.platform });
       nativeManaged = signedNativeOutputs(receipt, payload);
       outcome = { status: "verified", requestId: ref.requestId, workspace: ref.workspace, outputDir: evidence.outputDir, nestedChildren, treeAtStart: evidence.snapshot.treeAtStart, treeAtExit: evidence.snapshot.treeAtExit, attribution, toolchain };
     } catch (e) {
       outcome = { status: "unverified", code: e.code ?? "error", message: e.message, ...(ref ? { requestId: ref.requestId, workspace: ref.workspace } : {}) };
     }
+    outcome = { ...outcome, clientStatus: r.status ?? null, clientSignal: r.signal ?? null }; // A7: the client's own exit, kept with every outcome
     const out = capture ? { stdout: String(r.stdout ?? ""), stderr: String(r.stderr ?? "") } : { stdout: "", stderr: "" };
     // GB-54: a request the broker REFUSED (admission paused, a suspended or unknown job, a cutover drain) never started: the client's typed REJECTED result is kept as the outcome's
     // code ("admission is paused; nothing was spawned"), not folded into a missing request reference. It is never a build outcome.

package/snapshot-metadata.mjs

@@ -121,3 +121,35 @@ export function snapshotCargoSpawn({ spawn, carrySpawn = spawn, cargoCommand, sn
     } catch (e) { return refused(e.code ?? "RK_SNAPSHOT_BROKER", e.message); }
   };
 }
+
+/**
+ * GATE-CONTRACT GC-A11 (Adrian, 2026-11-02: "Class a never in the broker. Any cargo things that are cheap and non compiling are in class a,
+ * can run outside the broker."): the same read-only shapes as above, run DIRECTLY with the host's real toolchain cargo, never carried to the
+ * broker. `directPath` is the PATH with RustRight shims and outer gate wrappers taken off (managed-cargo.mjs directCargoPath), so `cargo`
+ * resolves to the pinned toolchain, not the broker's shim. Each call writes only to its own scratch target under `tmpRoot` (cargo would
+ * otherwise write target/.rustc_info.json beside the manifest and the snapshot would no longer be the commit's tree); the scratch is removed
+ * when the call returns. Every other cargo call inside the snapshot is refused (a compile belongs to the broker); calls outside the snapshot
+ * and every non-cargo command pass through to `spawn` unchanged. `spawn` may be synchronous or return a promise.
+ */
+export function directReadSpawn({ spawn, cargoCommand, snapshotRoot, directPath, pathKey = "PATH", tmpRoot, env, err = () => {} }) {
+  const prefix = cargoCommand.slice(1);
+  const refused = (code, message) => { err(`rightkit-gate: ${code}: ${message}`); return { status: BROKER_REFUSAL_STATUS, signal: null, error: null, stdout: "", stderr: `rightkit-gate: ${code}: ${message}\n` }; };
+  return (cmd, args, opts = {}) => {
+    const cargo = cmd === cargoCommand[0] && prefix.every((w, i) => args[i] === w);
+    if (!cargo || typeof opts.cwd !== "string" || !within(real(opts.cwd), real(snapshotRoot))) return spawn(cmd, args, opts);
+    const words = args.slice(prefix.length);
+    const shape = carriedScanRefusal(words);
+    if (shape !== null) return refused(CARRIED_METADATA_REFUSED, `\`cargo ${words.join(" ")}\` would run inside the managed snapshot ${snapshotRoot} and is not one of the read-only shapes Class A runs directly (GC-A11): ${shape}`);
+    let scratch;
+    try { fs.mkdirSync(tmpRoot, { recursive: true }); scratch = fs.mkdtempSync(path.join(tmpRoot, "rk-class-a-cargo-")); }
+    catch (e) { return refused("RK_CLASS_A_SCRATCH", `cannot create a scratch target under ${tmpRoot}: ${e.message}`); }
+    const childEnv = { ...env, ...(opts.env ?? {}), [pathKey]: directPath, CARGO_TARGET_DIR: scratch };
+    const cleanup = () => { try { fs.rmSync(scratch, { recursive: true, force: true }); } catch { /* best effort: a scratch dir under the gate's tmp root */ } };
+    let r;
+    try { r = spawn("cargo", words, { ...opts, env: childEnv }); }
+    catch (e) { cleanup(); throw e; }
+    if (r && typeof r.then === "function") return r.finally(cleanup);
+    cleanup();
+    return r;
+  };
+}

package/snapshot-request.mjs

@@ -23,7 +23,7 @@ import path from "node:path";
 import { REQUEST_OVER_CAP_CODE, requestOverCap } from "./broker-wire.mjs";
 import { ownerFileOf, writeCarrierOwner } from "./carrier-census.mjs";
 import { BROKER_COMPILE_COMMANDS, CARGO_COMMAND_ALIASES, cargoCommandIndex, cargoSubcommandOf, expandCargoAliases, isCompileCommand, isPackageObservation } from "./cargo-shapes.mjs";
-import { canonicalJson, CAUSE_EVIDENCE_SCHEMA, CAUSE_UNEXPLAINED, CAUSE_UNKNOWN, ProvenanceError, requireExplainedCauses, verifyBr19Evidence, verifyCauseEvidence, verifyProvenance, verifyReceiptCoverage, verifyResultEvidence } from "./provenance-verify.mjs";
+import { canonicalJson, CAUSE_EVIDENCE_SCHEMA, CAUSE_UNEXPLAINED, CAUSE_UNKNOWN, ProvenanceError, verifyBr19Evidence, verifyCauseEvidence, verifyProvenance, verifyReceiptCoverage, verifyResultEvidence } from "./provenance-verify.mjs";
 
 export const SNAPSHOT_REQUEST_SCHEMA = "rustright.snapshot-request/1";
 // One spelling per variable, the current one (rustright-cli shims.rs reads RUSTRIGHT_* first, then the legacy RIGHTKIT_* spelling, which task
@@ -646,8 +646,11 @@ export function verifySnapshotReceipt(receipt, { pins, jobId, carrier, argv, wor
   // legitimately carries no census; when one carries cause evidence anyway it must still be well formed, but nothing is judged for it (nothing was rebuilt).
   const signedFreshness = stage.freshness ?? null;
   let causeEvidence = null;
-  if (compile) causeEvidence = requireExplainedCauses(signedFreshness);
-  else if (isObject(signedFreshness) && signedFreshness.causeEvidence !== undefined) causeEvidence = verifyCauseEvidence(signedFreshness);
+  // Adrian, 2026-11-02 (the broker owner's chat, checked with pulse `said`): "Refusal, remove but I want a daily job checking the warmth etc and
+  // reporting issues." An unexplained or unknown rebuild no longer fails a stage: the cause evidence is still read, checked well formed and
+  // recorded (the daily warmth check reports it), never judged here. The broker stopped refusing it too (rustright b00220f).
+  // A compile must still carry well-formed signed cause evidence (verifyCauseEvidence refuses a missing or incoherent one); its verdict is not judged.
+  if (compile || (isObject(signedFreshness) && signedFreshness.causeEvidence !== undefined)) causeEvidence = verifyCauseEvidence(signedFreshness);
   // Fields the signature does not cover must still be present with their types (the consumer reads them). Every carried command:
   // exit (an integer, or null with a signal) and signal, timingsMs{admission, queue, bind, cargo, afterExitBind, diagnostics} (each a
   // number or null) and diagnosticsPath (a path, or null). Success needs exit 0 and no signal, as signed. `verdict` and `refreshed`

package/stage-sidecar.mjs

@@ -46,6 +46,7 @@ import {
   bundledFileName, planMediaSidecar, sourceOfferText, stagedFileName, validateMediaSidecarConfig, verifyStagedSidecars, writeMediaSidecarNotices,
 } from "./media-sidecar.mjs";
 import { ContentDigestError, contentIdentity, digestFor } from "./content-digest.mjs";
+import { oneOutput } from "./cross-targets.mjs";
 
 export const STAGE_SIDECAR_CONTRACT = "rightkit-stage-sidecar-v1";
 export const STAGE_SIDECAR_RECEIPT_NAME = "stage-sidecar.json";
@@ -107,7 +108,7 @@ const NATIVE_OTHER_ROUTE = Object.freeze({ ffmpeg: "has its own kind: use { kind
 /** A catalog version token (1.24.4, chromium/8021): only compared with the rows, never used as a path. */
 const NATIVE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+/-]{0,63}$/;
 const KEYS = Object.freeze({
-  "cargo-bin": ["kind", "package", "bin", "name", "profile", "features", "manifestPath", "sha256", "dest", "clean", "platforms"],
+  "cargo-bin": ["kind", "package", "bin", "name", "profile", "features", "devFeatures", "manifestPath", "sha256", "dest", "clean", "platforms"],
   ffmpeg: ["kind", "variant", "variants", "tools", "notices", "catalog", "stage", "bundleDir", "resourceDir", "sources", "probe", "platforms"],
   onnxruntime: ["kind", "version", "catalog", "resourceDir", "as", "licenseDir", "cacheDir", "companions", "platforms"],
   "native-library": ["kind", "library", "version", "catalog", "resourceDir", "licenseDir", "cacheDir", "as", "files", "companions", "source", "platforms"],
@@ -190,6 +191,8 @@ export function resolveBuildMode(env = process.env) {
 
 /** A profile is a Cargo profile name or exactly { dev, release } of names. Returns the pair or the single name. */
 function parseProfile(value, label, errors) {
+  // One build output (GATE-CONTRACT GC-A15): a sidecar builds only the release profile; any other profile, or a { dev, release } pair, is refused.
+  if (value !== "release") { errors.push(`${label} must be "release" (no other Cargo profile is allowed, GC-A15); omit it, release is the default`); return "release"; }
   if (typeof value === "string") {
     if (!PROFILE.test(value)) errors.push(`${label} must be a Cargo profile name`);
     return value;
@@ -329,8 +332,9 @@ export function validateSidecarManifest(raw, { target, mode = "release" } = {})
   if (!isObject(wrapper)) fail("STAGE_SIDECAR_CONFIG_INVALID", "sidecars must be an array (or { sidecars, stageDir?, receiptPath?, profiles? })");
   for (const key of Object.keys(wrapper)) if (!["sidecars", "stageDir", "receiptPath", "profiles", "wipeStageDir"].includes(key)) errors.push(`unknown key ${JSON.stringify(key)}`);
   if (wrapper.wipeStageDir !== undefined && typeof wrapper.wipeStageDir !== "boolean") errors.push("wipeStageDir must be a boolean");
-  const defaultProfile = wrapper.profiles === undefined ? undefined : parseProfile(wrapper.profiles, "profiles", errors);
-  if (typeof defaultProfile === "string") errors.push("profiles must be { dev, release }");
+  // The { dev, release } profile pair is retired (GC-A15): every sidecar builds release; a `profiles` key is refused.
+  if (wrapper.profiles !== undefined) errors.push("profiles is not allowed: every sidecar builds the release profile (GC-A15); remove the key");
+  const defaultProfile = undefined;
   if (!Array.isArray(wrapper.sidecars) || !wrapper.sidecars.length) errors.push("sidecars must be a non-empty array");
   const stageDir = relativePath(wrapper.stageDir ?? DEFAULT_STAGE_DIR, "stageDir", errors);
   const receiptPath = wrapper.receiptPath === undefined
@@ -374,8 +378,13 @@ export function validateSidecarManifest(raw, { target, mode = "release" } = {})
       if (typeof name !== "string" || !NAME.test(name) || /\.exe$/i.test(name) || name !== path.basename(name)) errors.push(`${where}: name must be a bare sidecar name (no path, no .exe, no target triple)`);
       const declared = item.profile !== undefined ? parseProfile(item.profile, `${where}: profile`, errors) : (defaultProfile ?? "release");
       const profile = isObject(declared) ? declared[mode] : declared;
-      const features = item.features ?? [];
-      if (!Array.isArray(features) || features.some((f) => typeof f !== "string" || !/^[A-Za-z0-9_/-]+$/.test(f))) errors.push(`${where}: features must be a list of feature names (package/feature allowed)`);
+      // `devFeatures` are added only for the dev build (RIGHTKIT_BUILD_MODE=dev, set by the dev lane): the app's QA feature, e.g. qa-native.
+      // The Cargo profile is release either way (GC-A15); the release tool refuses those features in a release (release-switch-registry.json).
+      const devFeatures = item.devFeatures ?? [];
+      const badList = (list) => !Array.isArray(list) || list.some((f) => typeof f !== "string" || !/^[A-Za-z0-9_/-]+$/.test(f));
+      if (badList(item.features ?? [])) errors.push(`${where}: features must be a list of feature names (package/feature allowed)`);
+      if (badList(devFeatures)) errors.push(`${where}: devFeatures must be a list of feature names (package/feature allowed)`);
+      const features = [...(item.features ?? []), ...(mode === "dev" && Array.isArray(devFeatures) ? devFeatures : [])];
       const manifestPath = item.manifestPath === undefined ? undefined : relativePath(item.manifestPath, `${where}: manifestPath`, errors);
       sha(item.sha256, "sha256");
       const dest = destOf(item.dest);
@@ -961,7 +970,14 @@ function stageCargoBin(entry, ctx) {
   fs.chmodSync(temporary, 0o755);
   fs.renameSync(temporary, dest);
   carryMtime(ctx, dest, slices.map((slice) => slice.source));
-  return [{ kind: "cargo-bin", name: entry.name, path: rel(ctx, dest), sha256, sizeBytes: fs.statSync(dest).size, changed, sourceSha256: sha256, package: entry.package, bin: entry.bin, profile: entry.profile, features: entry.features, externalBin: !entry.dest, slices: slices.map((slice) => ({ triple: slice.triple, sha256: slice.sourceSha256 })) }];
+  // rightkit#1443.2: Tauri's universal build compiles each arch and resolves an externalBin per THIN triple, so each slice is also staged as
+  // `<name>-<thin triple>` beside the universal file (the pre-gate R2 build staged all three). Only for an externalBin (no `dest`).
+  const thin = entry.dest ? [] : slices.map((slice) => {
+    const thinDest = path.resolve(ctx.appRoot, ctx.stageDir, stagedName(entry.name, parseTargetTriple(slice.triple)));
+    const copied = copyInto(ctx, slice.source, thinDest, { executable: true });
+    return { kind: "cargo-bin", name: entry.name, path: rel(ctx, thinDest), ...copied, sourceSha256: slice.sourceSha256, package: entry.package, bin: entry.bin, profile: entry.profile, features: entry.features, externalBin: false, sliceOf: rel(ctx, dest), triple: slice.triple };
+  });
+  return [{ kind: "cargo-bin", name: entry.name, path: rel(ctx, dest), sha256, sizeBytes: fs.statSync(dest).size, changed, sourceSha256: sha256, package: entry.package, bin: entry.bin, profile: entry.profile, features: entry.features, externalBin: !entry.dest, slices: slices.map((slice) => ({ triple: slice.triple, sha256: slice.sourceSha256 })) }, ...thin];
 }
 
 function stageCargoSlice(entry, ctx, triple, { dest }) {
@@ -974,9 +990,10 @@ function stageCargoSlice(entry, ctx, triple, { dest }) {
 /** Build one slice through `rustright cargo` and locate the executable. Returns { source, sourceSha256 }. */
 function stageCargoBuild(entry, ctx, triple) {
   const { run, appRoot, env, fs } = ctx;
-  const args = ["cargo", "build", "--locked", ...(entry.manifestPath ? ["--manifest-path", path.resolve(appRoot, entry.manifestPath)] : []),
-    "-p", entry.package, "--bin", entry.bin, "--target", triple, "--profile", entry.profile,
-    ...(entry.features.length ? ["--features", entry.features.join(",")] : []), "--message-format=json-render-diagnostics"];
+  // One output directory (oneOutput, cross-targets.mjs): a sidecar always builds with the release profile, whatever profile its entry names.
+  const args = oneOutput(["cargo", "build", "--locked", ...(entry.manifestPath ? ["--manifest-path", path.resolve(appRoot, entry.manifestPath)] : []),
+    "-p", entry.package, "--bin", entry.bin, "--target", triple,
+    ...(entry.features.length ? ["--features", entry.features.join(",")] : []), "--message-format=json-render-diagnostics"]);
   ctx.log(`stage-sidecar: rightkit ${args.join(" ")}`);
   // From a snapshot, Cargo would resolve `target/` (or a relative build.target-dir) against the snapshot: its output directory is
   // resolved in the checkout instead and passed as an absolute CARGO_TARGET_DIR, so the warm outputs stay the checkout's and the
@@ -996,7 +1013,7 @@ function stageCargoBuild(entry, ctx, triple) {
   if (carried && (!source || !fs.existsSync(source))) {
     const targetDir = typeof built.outputDir === "string" && path.isAbsolute(built.outputDir) ? built.outputDir : undefined;
     if (!targetDir) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `cargo reported no ${entry.bin} executable and the receipt names no output directory`, { bin: entry.bin });
-    const candidates = builtBinaryCandidates({ targetDir, targetDirs: [], triple, profile: entry.profile, bin: entry.bin, windows: ctx.windows });
+    const candidates = builtBinaryCandidates({ targetDir, targetDirs: [], triple, profile: "release", bin: entry.bin, windows: ctx.windows });
     source = candidates.find((file) => fs.existsSync(file));
     if (!source) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `the build did not produce ${entry.bin} (looked in ${candidates.join(", ")})`, { bin: entry.bin, candidates });
   } else if (!source || !fs.existsSync(source)) {
@@ -1008,7 +1025,7 @@ function stageCargoBuild(entry, ctx, triple) {
     // authoritative; an explicit CARGO_TARGET_DIR in this environment is tried too, resolved against the app root.
     const envDir = typeof buildEnv.CARGO_TARGET_DIR === "string" && buildEnv.CARGO_TARGET_DIR.trim() ? path.resolve(appRoot, buildEnv.CARGO_TARGET_DIR) : undefined;
     if (!targetDir && !envDir) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `cargo reported no ${entry.bin} executable and its target directory cannot be read`, { bin: entry.bin });
-    const candidates = builtBinaryCandidates({ targetDir, targetDirs: envDir ? [envDir] : [], triple, profile: entry.profile, bin: entry.bin, windows: ctx.windows });
+    const candidates = builtBinaryCandidates({ targetDir, targetDirs: envDir ? [envDir] : [], triple, profile: "release", bin: entry.bin, windows: ctx.windows });
     source = candidates.find((file) => fs.existsSync(file));
     if (!source) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `the build did not produce ${entry.bin} (looked in ${candidates.join(", ")})`, { bin: entry.bin, candidates });
   }

package/suite-signing-policy.mjs

@@ -1,12 +1,11 @@
 // The signing policy of a gate-run test or dev build (rightkit#1303, GATE-CONTRACT "One signing identity per product, every build"). Pure: it reads
-// nothing but what its caller hands it, so the gate's route decision (rightkit-gate.mjs routePlan, from the commit's own bytes), the `sign` step
-// (suite-signing.mjs, from the snapshot) and the tests all judge the same text.
+// nothing but what its caller hands it, so the gate's route decision (rightkit-gate.mjs routePlan, from the commit's own bytes) and the tests all judge the same text.
 //
 //   - The identity is derived, never declared: the app's tauri.conf.json `identifier` is the one id. Mac install.bundleId must equal it, and a
 //     dev or test Tauri `--config` that overrides it is refused. The team is DEFAULT_TEAM, the signer subject WINDOWS_SIGNER_SUBJECT.
 //   - A suite that builds a product (tauri build/bundle, or a cargo build of the tauri package or a sidecar package) must be named by a later `sign`
-//     step; a Windows dev `install.kind: "tauri"` is refused (`tauri-authenticode` is the signed route); `sign-qa-bundle` and RIGHTKIT_DEV_SIGNING
-//     (ad hoc) are refused.
+//     step; a Windows dev `install.kind: "tauri"` is refused (`tauri-authenticode` is the signed route); RIGHTKIT_DEV_SIGNING
+//     (ad hoc) is refused.
 //   - These refusals apply on Mac and Dell only (process.platform darwin or win32). Linux builds sign nothing and hosted CI is exempt.
 import path from "node:path";
 import { createRequire } from "node:module";
@@ -14,14 +13,6 @@ import { DEFAULT_TEAM, WINDOWS_SIGNER_SUBJECT } from "./signing-identity.mjs";
 
 export const SIGN_TEAM = DEFAULT_TEAM;
 export const SIGN_SUBJECT = WINDOWS_SIGNER_SUBJECT;
-/** The environment variable a successful `sign` step sets for the suites after it: the signed copy of the first file. */
-export const QA_APP_BINARY_ENV = "RIGHTKIT_QA_APP_BINARY";
-/** The environment variable a successful `sign` step sets beside it: the path of the signing evidence file (signed files, sha256 before and after, identity). */
-export const QA_SIGNING_EVIDENCE_ENV = "RIGHTKIT_QA_SIGNING_EVIDENCE";
-/** GB-42: set beside the two above: a JSON object mapping each file a `sign` step signed (its `path`, relative to the output layout) to its signed copy, so a
- * consumer is handed every declared sidecar's signed bytes, not only the main binary's. */
-export const QA_SIGNED_FILES_ENV = "RIGHTKIT_QA_SIGNED_FILES";
-export const SIGN_STEP_KEYS = Object.freeze(["name", "sign"]);
 export const WINDOWS_TAURI_KIND = "tauri";
 export const WINDOWS_SIGNED_KIND = "tauri-authenticode";
 
@@ -44,45 +35,8 @@ export class SuiteSigningError extends Error {
 }
 const refuse = (code, message, details) => { throw new SuiteSigningError(code, message, details); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const SIGNING_ID = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
 
-/** A relative path with no `..`, no drive, no root: the form a sign file path takes inside a receipt's output directory. Returns it with `/`. */
-export function containedRelative(value, label) {
-  if (typeof value !== "string" || !value.trim()) refuse("SIGN_STEP_PATH", `${label} must be a non-empty relative path`);
-  const normalized = value.replaceAll("\\", "/");
-  if (path.isAbsolute(value) || path.win32.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.startsWith("/") || normalized.split("/").includes("..") || normalized.split("/").includes("")) {
-    refuse("SIGN_STEP_PATH", `${label} must be a relative path inside the earlier suite's output directory (no absolute path, no .., no empty segment): ${JSON.stringify(value)}`);
-  }
-  return normalized;
-}
-
-/**
- * Validate one `sign` spec: `{ files: [{ from, path }] }`. `from` names an EARLIER suite of the same list (`earlier` is the set of names declared
- * before this step), `path` is relative to that suite's carried-receipt output directory. Returns the spec with normalized paths.
- */
-export function validateSignSpec(sign, label, earlier) {
-  if (!isObject(sign)) refuse("SIGN_STEP_SHAPE", `${label} must be an object { files: [{ from, path }] }`);
-  const unknown = Object.keys(sign).filter((key) => key !== "files");
-  if (unknown.length) refuse("SIGN_STEP_SHAPE", `${label} has unknown key(s): ${unknown.join(", ")} (allowed: files). The identity is derived from the product, never declared here`);
-  if (!Array.isArray(sign.files) || sign.files.length === 0) refuse("SIGN_STEP_SHAPE", `${label}.files must be a non-empty list of { from, path }`);
-  const seen = new Set();
-  const files = sign.files.map((item, index) => {
-    const at = `${label}.files[${index}]`;
-    if (!isObject(item)) refuse("SIGN_STEP_SHAPE", `${at} must be { from, path }`);
-    const extra = Object.keys(item).filter((key) => key !== "from" && key !== "path");
-    if (extra.length) refuse("SIGN_STEP_SHAPE", `${at} has unknown key(s): ${extra.join(", ")} (allowed: from, path)`);
-    if (typeof item.from !== "string" || !NAME.test(item.from)) refuse("SIGN_STEP_FROM", `${at}.from must name an earlier suite`);
-    if (!earlier.has(item.from)) refuse("SIGN_STEP_FROM", `${at}.from ${JSON.stringify(item.from)} is not a suite declared before this step (${[...earlier].join(", ") || "none"}); a sign step signs what an earlier suite built`);
-    const rel = containedRelative(item.path, `${at}.path`);
-    const key = `${item.from}\0${rel}`;
-    if (seen.has(key)) refuse("SIGN_STEP_SHAPE", `${at} repeats ${item.from}:${rel}`);
-    seen.add(key);
-    return { from: item.from, path: rel };
-  });
-  return { files };
-}
-
 // ---- what a step is -------------------------------------------------------------------------------------------------------------
 
 const base = (program) => path.basename(String(program ?? "").replaceAll("\\", "/")).replace(/\.(exe|cmd|bat)$/i, "").toLowerCase();
@@ -391,13 +345,11 @@ function signPathNames(file, layout, bin) {
 }
 
 /**
- * GB-42 (GATE 42, E19; stable identity before launch): why an earlier sign step never makes `cargo run` or an integration test that uses
- * CARGO_BIN_EXE_ safe. The signer signs a COPY outside the build's output directory, and neither Cargo nor a compile-time literal is redirected to it
- * (RIGHTKIT_QA_APP_BINARY changes nothing for them), so such a step starts the raw, unsigned bytes in the target directory even though the sign
- * declaration names the right paths. The supported route is: compile only (`cargo test --no-run`, a build), sign, then a consumer that is handed the
- * signed path (the QA runner, which reads RIGHTKIT_QA_APP_BINARY and RIGHTKIT_QA_SIGNED_FILES) and runs prebuilt bytes.
+ * GB-42 (GATE 42, E19; stable identity before launch): why `cargo run` or an integration test that uses CARGO_BIN_EXE_ is never safe in a build
+ * stage. Cargo resolves the product bin inside the build's output directory, so such a step starts the raw, unsigned bytes in the target directory.
+ * Product bins run only from the installed, signed build (GATE-CONTRACT GC-A07: QA journeys run after the build against the installed dev copy).
  */
-export const RAW_TARGET_LAUNCH = "launches a product bin Cargo resolves inside the build's target directory (cargo run, or an integration test using CARGO_BIN_EXE_): the signer signs a copy elsewhere and nothing redirects Cargo or a compile-time literal to it, so an earlier sign step does not bind the bytes that run. Build compile-only (cargo test --no-run), sign, then run a consumer that is handed the signed path (RIGHTKIT_QA_APP_BINARY, RIGHTKIT_QA_SIGNED_FILES)";
+export const RAW_TARGET_LAUNCH = "launches a product bin Cargo resolves inside the build's target directory (cargo run, or an integration test using CARGO_BIN_EXE_): the signer signs a copy elsewhere and nothing redirects Cargo or a compile-time literal to it, so the bytes that run are never the signed ones. Product bins run only from the installed, signed build (GATE-CONTRACT GC-A07)";
 
 /**
  * Launch binding (rightkit#1303): the earlier sign steps that satisfy a launching suite must name, in `sign.files`, each executable it launches. `launch` is
@@ -435,11 +387,9 @@ export function isProductBuildStep(step, targets = { packages: new Set(), manife
   return found.product || found.launches || found.unknown.length > 0;
 }
 
-/** Why a step asks for ad hoc signing (the QA bundle signer, or the ad hoc opt-in), or null. */
+/** Why a step asks for ad hoc signing (the ad hoc opt-in), or null. */
 export function adHocReason(step) {
   const words = stepWords(step);
-  const bad = words.find((word) => /sign-qa-bundle/.test(word));
-  if (bad !== undefined) return `${JSON.stringify(bad)} runs the ad hoc QA bundle signer (sign-qa-bundle)`;
   const named = words.find((word) => /RIGHTKIT_DEV_SIGNING/.test(word));
   if (named !== undefined) return `${JSON.stringify(named)} names RIGHTKIT_DEV_SIGNING`;
   if (isObject(step?.env) && Object.keys(step.env).some((key) => key === "RIGHTKIT_DEV_SIGNING")) return "its env sets RIGHTKIT_DEV_SIGNING (ad hoc signing)";

package/templates/cargo-profiles.toml

@@ -1,28 +1,9 @@
-# RightKit standard Cargo profiles for every app workspace (Adrian, 2026-10-16; Astra-reviewed option C).
-# One development profile: Cargo's built-in `dev`, used by build, test, check, clippy and `right-release dev`.
-# `release-iterate` is retired. Panic behaviour is the same in every app: unwind.
-# Copy these tables verbatim into the app's workspace-root Cargo.toml; the RightKit ownership scanner
-# flags any deviation. Keep the app's existing [profile.release] optimization keys, but set panic = "unwind".
-
-[profile.dev]
-opt-level = 1
-debug = "line-tables-only"
-strip = "none"
-debug-assertions = true
-overflow-checks = true
-lto = "off"
-panic = "unwind"
-incremental = true
-codegen-units = 256
-rpath = false
-
-# Dependencies: non-incremental so sccache can cache them across apps.
-[profile.dev.package."*"]
-incremental = false
-codegen-units = 16
-
-# No test-profile overrides: test inherits dev.
-# The retired release-iterate profile must not appear: delete it and its package overrides.
+# RightKit standard Cargo profile for every app workspace (Adrian, 2026-10-16; GATE-CONTRACT GC-A01, GC-A07).
+# One build output and one warm cache per app per host: every gate compile (check, clippy, rustdoc, the test compile and
+# both installers, dev and release) uses [profile.release] for the host's target (cross-targets.mjs oneOutput). The dev
+# installer is the release profile plus `qa-native`. An app carries no [profile.dev], [profile.test] or other custom
+# profile: the RightKit ownership scanner refuses them. `release-iterate` is retired. Panic behaviour is the same in every
+# app: unwind. Keep the app's existing [profile.release] optimization keys, but set panic = "unwind".
 
 [profile.release]
 panic = "unwind"