@rightkit/release 0.6.24 → 0.6.26

package/build-helper-trace.mjs

@@ -0,0 +1,264 @@
+// rightkit#1450 (Adrian, 2026-11-02: "can't we run every new crate with a helper, see exactly what it does, where it builds, ONCE and then add it
+// to the list?" ... "yes, record it and implment it asap"). Replaces a per-job sandbox (rustright#197).
+//
+// A build-helper unit is a crates.io package that runs code at build time: a build script (`custom-build` target) or a proc macro. It is keyed
+// exactly as cargo keys the unit it compiles: crate + version + checksum (Cargo.lock) + enabled features + target triple + toolchain. Class A
+// keeps a HOST list of traced units. A unit not on the list was never seen doing its build-time work on this host: Class A refuses it, naming
+// it, until it is traced once (built alone with every file write recorded: macOS fs_usage, Windows ETW). A trace passes when every write lies
+// inside the unit's OUT_DIR, the build's target directory, CARGO_HOME or the temp directory; a pass is recorded and never traced again; a
+// fail is recorded with the paths it wrote and keeps refusing. Any key change (a new version, checksum, feature set, target or toolchain) is a
+// new unit and traces once more. Limit (accepted in #1450): a trace proves what the helper did with those inputs, not what a deliberately
+// malicious crate could do later.
+//
+// Tracing needs admin rights on the host (fs_usage / ETW); enabling that is Adrian's host step. Everything here is pure except the list I/O.
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export const BUILD_HELPER_LIST_SCHEMA = "rightkit.build-helper-trace/1";
+export const BUILD_HELPER_UNTRACED = "RK_BUILD_HELPER_UNTRACED";
+export const BUILD_HELPER_WROTE_OUTSIDE = "RK_BUILD_HELPER_WROTE_OUTSIDE";
+const CRATES_IO = new Set(["registry+https://github.com/rust-lang/crates.io-index", "sparse+https://index.crates.io/"]);
+
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+
+/** The unit key: sha256 of the canonical {crate, version, checksum, features (sorted), target, toolchain}. */
+export function buildHelperKey({ crate, version, checksum, features = [], target, toolchain }) {
+  return sha256(JSON.stringify({ crate, version, checksum, features: [...features].sort(), target, toolchain }));
+}
+
+/** Checksums of crates.io packages from a Cargo.lock text: Map "name version" -> checksum. */
+export function lockChecksums(lockText) {
+  const out = new Map();
+  for (const block of String(lockText).split(/\n\[\[package\]\]\n/)) {
+    const name = /\nname = "([^"]+)"/.exec(`\n${block}`)?.[1];
+    const version = /\nversion = "([^"]+)"/.exec(`\n${block}`)?.[1];
+    const checksum = /\nchecksum = "([0-9a-f]{64})"/.exec(`\n${block}`)?.[1];
+    if (name && version && checksum) out.set(`${name} ${version}`, checksum);
+  }
+  return out;
+}
+
+/**
+ * Every build-helper unit of a workspace, from `cargo metadata --format-version 1` (with `resolve`) and its Cargo.lock: crates.io packages
+ * in the resolved graph that have a `custom-build` target or are a proc macro, with the features cargo enabled for them.
+ */
+export function buildHelperUnits(metadata, lockText, { target, toolchain }) {
+  if (typeof target !== "string" || !target || typeof toolchain !== "string" || !toolchain) throw new TypeError("buildHelperUnits: target and toolchain are required");
+  const checksums = lockChecksums(lockText);
+  const features = new Map((metadata?.resolve?.nodes ?? []).map((n) => [n.id, Array.isArray(n.features) ? n.features : []]));
+  const inGraph = new Set((metadata?.resolve?.nodes ?? []).map((n) => n.id));
+  const units = [];
+  for (const pkg of metadata?.packages ?? []) {
+    if (!CRATES_IO.has(pkg.source) || !inGraph.has(pkg.id)) continue;
+    const kinds = new Set((pkg.targets ?? []).flatMap((t) => t.kind ?? []));
+    const role = kinds.has("custom-build") ? "build-script" : kinds.has("proc-macro") ? "proc-macro" : null;
+    if (!role) continue;
+    const checksum = checksums.get(`${pkg.name} ${pkg.version}`) ?? null;
+    const unit = { crate: pkg.name, version: pkg.version, checksum, features: [...(features.get(pkg.id) ?? [])].sort(), target, toolchain, role };
+    units.push({ ...unit, key: buildHelperKey(unit) });
+  }
+  return units.sort((a, b) => (a.crate === b.crate ? (a.version < b.version ? -1 : 1) : a.crate < b.crate ? -1 : 1));
+}
+
+/** The host list file: <managed data root>/build-helper-trace/<platform>.json. */
+export const hostListPath = (dataRoot, platform = process.platform) => path.join(dataRoot, "build-helper-trace", `${platform}.json`);
+
+/** The host list ({ schema, units: { [key]: entry } }); an absent file is an empty list, a malformed one throws. */
+export function readHostList(file, { readFile = (f) => fs.readFileSync(f, "utf8"), exists = fs.existsSync } = {}) {
+  if (!exists(file)) return { schema: BUILD_HELPER_LIST_SCHEMA, units: {} };
+  const doc = JSON.parse(readFile(file));
+  if (doc?.schema !== BUILD_HELPER_LIST_SCHEMA || !doc.units || typeof doc.units !== "object") throw new Error(`${file} is not a ${BUILD_HELPER_LIST_SCHEMA} list`);
+  return doc;
+}
+
+/** Record one trace verdict in the list (atomic write). */
+/** Tracers whose verdicts count: each follows the build's whole process tree. fs_usage (name-filtered) verdicts recorded before do not count. */
+export const TRUSTED_TRACERS = Object.freeze(["eslogger", "strace-ff", "etw"]);
+export const TRACER_OF = Object.freeze({ darwin: "eslogger", linux: "strace-ff", win32: "etw" });
+
+export function recordTrace(file, unit, verdict, { now = () => new Date().toISOString(), fsApi = fs, tracer = TRACER_OF[process.platform] } = {}) {
+  const list = readHostList(file, { readFile: (f) => fsApi.readFileSync(f, "utf8"), exists: (f) => fsApi.existsSync(f) });
+  list.units[unit.key] = { crate: unit.crate, version: unit.version, checksum: unit.checksum, features: unit.features, target: unit.target, toolchain: unit.toolchain, role: unit.role, verdict: verdict.ok ? "pass" : "fail", outside: verdict.outside ?? [], tracer, tracedAt: now() };
+  fsApi.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fsApi.writeFileSync(tmp, `${JSON.stringify(list, null, 2)}\n`);
+  fsApi.renameSync(tmp, file);
+  return list;
+}
+
+/**
+ * Class A's verdict: `{ ok, untraced: [unit], failed: [{unit, outside}] }`. A unit with no checksum (not from crates.io's lock) is untraced by
+ * definition. Nothing listed as a pass under the same key ever runs a trace again.
+ */
+export function checkBuildHelpers(units, list) {
+  const untraced = []; const failed = [];
+  for (const u of units) {
+    const entry = list?.units?.[u.key];
+    if (!entry || !u.checksum || !TRUSTED_TRACERS.includes(entry.tracer)) untraced.push(u);
+    else if (entry.verdict !== "pass") failed.push({ unit: u, outside: entry.outside ?? [] });
+  }
+  return { ok: untraced.length === 0 && failed.length === 0, untraced, failed };
+}
+
+/** The refusal text Class A prints for a failing verdict, naming every unit (and the paths a failed one wrote). */
+export function buildHelperRefusal(verdict) {
+  const lines = [];
+  for (const u of verdict.untraced) lines.push(`${BUILD_HELPER_UNTRACED}: ${u.crate} ${u.version} (${u.role}; features ${u.features.join(",") || "none"}; ${u.target}; ${u.toolchain}) has never been traced on this host; trace it once (rightkit-gate trace-build-helpers)`);
+  for (const f of verdict.failed) lines.push(`${BUILD_HELPER_WROTE_OUTSIDE}: ${f.unit.crate} ${f.unit.version} wrote outside its build directories when traced: ${f.outside.slice(0, 10).join(", ")}${f.outside.length > 10 ? ` (+${f.outside.length - 10} more)` : ""}`);
+  return lines;
+}
+
+/**
+ * Judge one trace: every written path must lie inside one of the allowed roots (the unit's OUT_DIR, the build's target directory,
+ * CARGO_HOME, the temp directory). Returns `{ ok, outside }` with the offending paths, sorted and unique.
+ */
+export function judgeTrace(writes, { allowed, platform = process.platform, mustSee = null }) {
+  const mod = platform === "win32" ? path.win32 : path.posix;
+  const norm = (p) => { const r = mod.resolve(p); return platform === "win32" ? r.toLowerCase() : r; };
+  const roots = (allowed ?? []).filter(Boolean).map(norm);
+  const inside = (p) => roots.some((r) => { const rel = mod.relative(r, p); return rel === "" || (!rel.startsWith("..") && !mod.isAbsolute(rel)); });
+  const outside = [...new Set(writes.map(norm).filter((p) => !inside(p)))].sort();
+  // Proof the tracer saw the build: at least one write under the build's own target. A tracer that started late or lost events sees
+  // nothing, and an empty trace must never pass.
+  if (mustSee) {
+    const root = norm(mustSee);
+    const saw = writes.map(norm).some((p) => { const rel = mod.relative(root, p); return rel === "" || (!rel.startsWith("..") && !mod.isAbsolute(rel)); });
+    if (!saw) return { ok: false, outside: [...outside, `(the tracer recorded no write under ${mustSee}: the build was not observed)`] };
+  }
+  return { ok: outside.length === 0, outside };
+}
+
+/**
+ * The written paths of macOS `fs_usage -w -f filesys <pid...>` output: lines whose call creates, writes, renames, links or removes a file,
+ * the path being the last absolute path on the line. Reads are ignored.
+ */
+export function parseFsUsageWrites(text) {
+  // fs_usage prints an open's mode as a flag group, e.g. "(R_____)" read, "(_W____)" write, "(_WC___)" create, "(_W_T__)" truncate.
+  const OPEN = /\bopen[a-z_]*\b[^(]*\(([A-Z_]{4,})\)/;
+  const MUTATING = /\b(creat|write|pwrite|writev|rename|renameat|renamex_np|link|linkat|symlink|unlink|unlinkat|mkdir|mkdirat|rmdir|truncate|ftruncate|clonefile|clonefileat|copyfile|exchangedata|setattrlist|chmod|fchmod|chown|fchown|utimes|futimes)\b/;
+  const out = new Set();
+  for (const line of String(text).split(/\r?\n/)) {
+    const open = OPEN.exec(line);
+    const writes = open ? /[WCTA]/.test(open[1]) : MUTATING.test(line);
+    if (!writes) continue;
+    const paths = line.match(/\/[^\s]+/g);
+    if (paths?.length) out.add(paths.at(-1));
+  }
+  return [...out];
+}
+
+/**
+ * The written paths of Linux `strace -f -e trace=<file calls>` output: successful calls that create, write, rename, link or remove a file.
+ * An open counts when its flags include O_WRONLY, O_RDWR, O_CREAT, O_TRUNC or O_APPEND; every other listed call mutates by definition.
+ * A failed call (`= -1`) wrote nothing. Every quoted path of a mutating call is taken (rename names both); a relative path resolves
+ * against `cwd` (the traced cargo's directory; a build script that changes directory is resolved approximately, a recorded limit).
+ */
+export function parseStraceWrites(text, { cwd = "/" } = {}) {
+  const OPEN = /\b(open|openat|openat2)\((?:[^"]*?)"((?:[^"\\]|\\.)*)"[^)]*?\b(O_[A-Z_|]+)/;
+  const MUTATING = /\b(creat|rename|renameat|renameat2|unlink|unlinkat|mkdir|mkdirat|rmdir|link|linkat|symlink|symlinkat|truncate|chmod|fchmodat|chown|fchownat|lchown|utimensat|utimes)\(/;
+  const out = new Set();
+  for (const line of String(text).split(/\r?\n/)) {
+    if (/=\s*-1\s/.test(line) || /<unfinished \.\.\.>/.test(line)) continue;
+    let paths = [];
+    const open = OPEN.exec(line);
+    if (open) { if (/O_WRONLY|O_RDWR|O_CREAT|O_TRUNC|O_APPEND/.test(open[3])) paths = [open[2]]; }
+    else if (MUTATING.test(line)) paths = [...line.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1]);
+    for (const p of paths) if (p) out.add(path.posix.isAbsolute(p) ? p : path.posix.resolve(cwd, p));
+  }
+  return [...out];
+}
+
+/** The repository's committed list (`.rightkit/build-helper-trace.json`, same schema): reviewed passes every host and CI reads. */
+export const repoListPath = (workspaceRoot) => path.join(workspaceRoot, ".rightkit", "build-helper-trace.json");
+
+/** The host list and the repository list together: a unit passes when either holds a pass for its key and neither holds a fail. */
+export function mergeLists(...lists) {
+  const units = {};
+  for (const list of lists) for (const [key, entry] of Object.entries(list?.units ?? {})) {
+    if (!units[key] || entry.verdict !== "pass") units[key] = entry;
+  }
+  return { schema: BUILD_HELPER_LIST_SCHEMA, units };
+}
+
+/**
+ * The written paths of a Windows ETW trace exported by `tracerpt -of XML` from two kernel sessions: Microsoft-Windows-Kernel-Process (process
+ * starts, to follow the build's own tree) and Microsoft-Windows-Kernel-File (create, create-new-file, write, delete-path, rename-path). Only
+ * events from `rootPid`'s descendants count. A Create counts as a write unless its disposition is FILE_OPEN (1); a Write event is named by the
+ * FileObject its Create recorded. Kernel paths (\Device\HarddiskVolumeN\...) are mapped back to drive letters through `devices`
+ * ({ "\\Device\\HarddiskVolume3": "D:" }).
+ */
+export function parseEtwWrites(xml, { rootPid, devices = {} }) {
+  const events = String(xml).split(/<Event[\s>]/).slice(1);
+  const field = (ev, name) => new RegExp(`<Data Name="${name}">([^<]*)</Data>`).exec(ev)?.[1];
+  const id = (ev) => Number(/<EventID>(\d+)<\/EventID>/.exec(ev)?.[1]);
+  const pidOf = (ev) => Number(/ProcessID="(\d+)"/.exec(ev)?.[1]);
+  const provider = (ev) => /Provider Name="([^"]+)"/.exec(ev)?.[1] ?? "";
+  const tree = new Set([Number(rootPid)]);
+  for (const ev of events) {
+    if (provider(ev) === "Microsoft-Windows-Kernel-Process" && id(ev) === 1) {
+      const child = Number(field(ev, "ProcessID")); const parent = Number(field(ev, "ParentProcessID"));
+      if (tree.has(parent)) tree.add(child);
+    }
+  }
+  const toDos = (p) => { if (!p) return null; for (const [dev, letter] of Object.entries(devices)) if (p.toLowerCase().startsWith(dev.toLowerCase())) return letter + p.slice(dev.length); return p; };
+  const names = new Map(); const out = new Set();
+  for (const ev of events) {
+    if (provider(ev) !== "Microsoft-Windows-Kernel-File" || !tree.has(pidOf(ev))) continue;
+    const n = id(ev);
+    if (n === 12) {
+      const name = field(ev, "FileName"); names.set(field(ev, "FileObject"), name);
+      const disposition = (Number(field(ev, "CreateOptions") ?? 0) >>> 24) & 0xff;
+      if (disposition !== 1) out.add(toDos(name));
+    } else if (n === 30) out.add(toDos(field(ev, "FileName")));
+    else if (n === 16) { const name = names.get(field(ev, "FileObject")); if (name) out.add(toDos(name)); }
+    else if (n === 26 || n === 27) { const name = field(ev, "FilePath") ?? field(ev, "FileName"); if (name) out.add(toDos(name)); }
+  }
+  out.delete(null);
+  return [...out];
+}
+
+/**
+ * The written paths of a macOS `eslogger` trace (Endpoint Security, JSON lines) restricted to `rootPid`'s process tree. Each event names
+ * its process and that process's parent (`process.audit_token.pid`, `process.ppid`), so every child a build script starts (sh, cc, cmake,
+ * perl) is followed, whatever its name. Writes: create, rename (both sides), unlink, link, truncate, an open with FWRITE, and a close that
+ * modified the file.
+ */
+export function parseEsloggerWrites(text, { rootPid }) {
+  const events = [];
+  for (const line of String(text).split(/\r?\n/)) { if (!line.trim().startsWith("{")) continue; try { events.push(JSON.parse(line)); } catch { /* a partial last line */ } }
+  const parent = new Map();
+  for (const e of events) {
+    const pid = e?.process?.audit_token?.pid; const ppid = e?.process?.ppid ?? e?.process?.original_ppid;
+    if (Number.isInteger(pid) && Number.isInteger(ppid) && !parent.has(pid)) parent.set(pid, ppid);
+    const child = e?.event?.fork?.child?.audit_token?.pid;
+    if (Number.isInteger(child) && Number.isInteger(pid)) parent.set(child, pid);
+  }
+  const inTree = (pid) => { for (let p = pid, hops = 0; Number.isInteger(p) && hops < 64; p = parent.get(p), hops += 1) if (p === rootPid) return true; return false; };
+  const joined = (np) => (np?.dir?.path && np?.filename ? `${np.dir.path.replace(/\/$/, "")}/${np.filename}` : null);
+  const dest = (d) => d?.existing_file?.path ?? joined(d?.new_path) ?? null;
+  const out = new Set();
+  for (const e of events) {
+    if (!inTree(e?.process?.audit_token?.pid)) continue;
+    const ev = e?.event ?? {};
+    const add = (p) => { if (typeof p === "string" && p) out.add(p); };
+    if (ev.create) add(dest(ev.create.destination));
+    if (ev.rename) { add(ev.rename.source?.path); add(dest(ev.rename.destination)); }
+    if (ev.unlink) add(ev.unlink.target?.path);
+    if (ev.link) { add(ev.link.source?.path); add(ev.link.target_dir?.path && ev.link.target_filename ? `${ev.link.target_dir.path.replace(/\/$/, "")}/${ev.link.target_filename}` : null); }
+    if (ev.truncate) add(ev.truncate.target?.path);
+    // std::fs::copy on macOS clones first (fclonefileat): the destination is created without an open for writing.
+    if (ev.clone) add(ev.clone.target_dir?.path && ev.clone.target_name ? `${ev.clone.target_dir.path.replace(/\/$/, "")}/${ev.clone.target_name}` : null);
+    if (ev.copyfile) add(ev.copyfile.target_file?.path ?? (ev.copyfile.target_dir?.path && ev.copyfile.target_name ? `${ev.copyfile.target_dir.path.replace(/\/$/, "")}/${ev.copyfile.target_name}` : null));
+    if (ev.exchangedata) { add(ev.exchangedata.file1?.path); add(ev.exchangedata.file2?.path); }
+    if (ev.open && (Number(ev.open.fflag) & 0x2)) add(ev.open.file?.path);
+    if (ev.close && ev.close.modified) add(ev.close.target?.path);
+  }
+  return [...out];
+}
+
+/** The strace -ff output files (`<prefix>.<pid>`, one per process: no call is ever split across lines). */
+export function readStraceFiles(prefix, { fsApi = fs } = {}) {
+  const dir = path.dirname(prefix); const base = path.basename(prefix);
+  return fsApi.readdirSync(dir).filter((n) => n.startsWith(`${base}.`)).map((n) => fsApi.readFileSync(path.join(dir, n), "utf8")).join("\n");
+}

package/build-helpers-command.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+// `right-release build-helpers check [--manifest-path <Cargo.toml>]` (Class A, rightkit#1450) and
+// `right-release build-helpers trace [--manifest-path <Cargo.toml>]` (the one-time trace: eslogger on macOS (sudo + Full Disk Access), strace -ff on Linux, ETW on Windows (Administrator)).
+//
+// check: reads the workspace's resolved graph (`cargo metadata --format-version 1 --locked`, a non-compiling call run directly: GATE-CONTRACT
+// GC-A11), its Cargo.lock, the host triple and toolchain (`rustc -vV`), and the host list, and refuses (exit 1) when any build-helper unit is
+// untraced or traced as writing outside its build directories, naming each.
+// trace: for each untraced unit, builds the workspace's dependency alone (`cargo build -p <crate>@<version> --locked`) under the host's tracer, into a
+// scratch target, judges every write against OUT_DIR / target / CARGO_HOME / temp, and records the verdict in the host list.
+// check --trace-missing (Linux only, where strace needs no admin; CI and Linux hosts): untraced units are traced first, then judged.
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildHelperRefusal, buildHelperUnits, checkBuildHelpers, hostListPath, judgeTrace, mergeLists, parseEsloggerWrites, parseEtwWrites, parseStraceWrites, readStraceFiles, readHostList, recordTrace, repoListPath } from "./build-helper-trace.mjs";
+import { resolveManagedRoots } from "./managed-roots.mjs";
+import { directCargoPath } from "./managed-cargo.mjs";
+
+function hostFacts(run = spawnSync) {
+  const r = run("rustc", ["-vV"], { encoding: "utf8" });
+  if (r.error || r.status !== 0) throw new Error(`rustc -vV failed (${r.error?.message ?? `exit ${r.status}`})`);
+  const host = /^host: (\S+)$/m.exec(r.stdout)?.[1];
+  const release = /^release: (\S+)$/m.exec(r.stdout)?.[1];
+  const commit = /^commit-hash: (\S+)$/m.exec(r.stdout)?.[1];
+  if (!host || !release) throw new Error("rustc -vV printed no host or release");
+  return { target: host, toolchain: `rustc ${release}${commit ? ` (${commit.slice(0, 9)})` : ""}` };
+}
+
+export function inventory({ manifestPath, run = spawnSync, readFile = (f) => fs.readFileSync(f, "utf8") }) {
+  const args = ["metadata", "--format-version", "1", "--locked", ...(manifestPath ? ["--manifest-path", manifestPath] : [])];
+  const r = run("cargo", args, { encoding: "utf8", maxBuffer: 1 << 28 });
+  if (r.error || r.status !== 0) throw new Error(`cargo ${args.join(" ")} failed (${r.error?.message ?? `exit ${r.status}`}): ${String(r.stderr ?? "").trim().split(/\r?\n/).slice(-2).join(" | ")}`);
+  const metadata = JSON.parse(r.stdout);
+  const lockText = readFile(path.join(metadata.workspace_root, "Cargo.lock"));
+  return { metadata, units: buildHelperUnits(metadata, lockText, hostFacts(run)) };
+}
+
+// Every Cargo workspace (a directory holding Cargo.lock) under `root`, skipping build outputs, dependencies and vendored copies.
+export function cargoWorkspaces(root, { depth = 4, fsApi = fs } = {}) {
+  const SKIP = new Set(["target", "node_modules", ".build", ".git", "vendor", "t", "dist"]);
+  const found = [];
+  const walk = (dir, left) => {
+    let entries; try { entries = fsApi.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    if (entries.some((e) => e.isFile() && e.name === "Cargo.lock") && entries.some((e) => e.isFile() && e.name === "Cargo.toml")) found.push(dir);
+    if (left > 0) for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name) && !e.name.startsWith(".")) walk(path.join(dir, e.name), left - 1);
+  };
+  walk(root, depth);
+  // Only repositories the gate builds: the workspace's repository root (nearest .git) carries a .rightkit directory.
+  const gated = (dir) => { for (let d = dir; ; d = path.dirname(d)) { if (fsApi.existsSync(path.join(d, ".git"))) return fsApi.existsSync(path.join(d, ".rightkit")); if (path.dirname(d) === d) return false; } };
+  return found.filter(gated).sort();
+}
+
+// `right-release build-helpers trace-all [--root <dir>]...`: one admin prompt, every workspace. On macOS it asks for the password once
+// (`sudo -v`) and keeps that credential alive while it runs; each workspace's untraced units are traced and recorded in the host list and
+// in the workspace's own committed list (--record-repo). Default root: /Volumes/D/claude (Mac), D:\claude (Windows), the current
+// directory elsewhere.
+function traceAll(argv, { env, platform, log, err }) {
+  const roots = argv.flatMap((a, i) => (a === "--root" && argv[i + 1] ? [path.resolve(argv[i + 1])] : []));
+  if (!roots.length) roots.push(platform === "darwin" ? "/Volumes/D/claude" : platform === "win32" ? "D:\\claude" : process.cwd());
+  let keepAlive = null;
+  if (platform === "darwin") {
+    log("right-release build-helpers trace-all: eslogger needs administrator rights (and Full Disk Access for this terminal); enter your password once.");
+    const ok = spawnSync("sudo", ["-v"], { stdio: "inherit" });
+    if (ok.status !== 0) { err("right-release build-helpers trace-all: sudo was not granted; nothing traced"); return 2; }
+    keepAlive = spawn("sh", ["-c", `while kill -0 ${process.pid} 2>/dev/null; do sudo -n -v; sleep 50; done`], { stdio: "ignore", detached: true });
+    keepAlive.unref();
+  }
+  const workspaces = roots.flatMap((r) => cargoWorkspaces(r));
+  log(`right-release build-helpers trace-all: ${workspaces.length} Cargo workspace(s) under ${roots.join(", ")}`);
+  let worst = 0;
+  try {
+    for (const ws of workspaces) {
+      log(`--- ${ws}`);
+      const code = main(["trace", "--manifest-path", path.join(ws, "Cargo.toml"), "--record-repo"], { env, platform, log, err });
+      if (code !== 0) err(`right-release build-helpers trace-all: ${ws} ended with ${code}`);
+      worst = Math.max(worst, code);
+    }
+  } finally { try { keepAlive?.kill(); } catch { /* already gone */ } }
+  log(`right-release build-helpers trace-all: done; commit each workspace's .rightkit/build-helper-trace.json`);
+  return worst;
+}
+
+export function main(argv = process.argv.slice(2), { env = process.env, platform = process.platform, run: runRaw = null, log = console.log, err = console.error } = {}) {
+  if (argv[0] === "trace-all") return traceAll(argv.slice(1), { env, platform, log, err });
+  // GATE-CONTRACT GC-A11: the check's cargo and rustc calls compile nothing and run directly with the real toolchain (RustRight shims off PATH),
+  // writing to a scratch target, never through the broker.
+  const pathKey = platform === "win32" ? (Object.keys(env).find((k) => k.toUpperCase() === "PATH") ?? "Path") : "PATH";
+  const directPath = directCargoPath({ env: { ...env, PATH: env[pathKey] }, platform, gateWrappers: true }).path;
+  const scratchTarget = fs.mkdtempSync(path.join(os.tmpdir(), "rk-bh-target-"));
+  const run = runRaw ?? ((cmd, args, opts = {}) => spawnSync(cmd, args, { ...opts, env: { ...env, ...(opts.env ?? {}), [pathKey]: directPath, CARGO_TARGET_DIR: opts.env?.CARGO_TARGET_DIR ?? scratchTarget } }));
+  try { return mainWith(argv, { env, platform, run, log, err }); } finally { fs.rmSync(scratchTarget, { recursive: true, force: true }); }
+}
+
+function mainWith(argv, { env, platform, run, log, err }) {
+  const [sub, ...rest] = argv;
+  const at = rest.indexOf("--manifest-path");
+  const manifestPath = at >= 0 ? rest[at + 1] : undefined;
+  const listFile = hostListPath(resolveManagedRoots({ env, platform }).dataRoot, platform);
+  let inv;
+  try { inv = inventory({ manifestPath, run }); } catch (e) { err(`right-release build-helpers: ${e.message}`); return 2; }
+  // The host's own list and the repository's committed list (.rightkit/build-helper-trace.json): CI and every host read the same reviewed
+  // passes, and a host traces only what neither holds.
+  const repoFile = repoListPath(inv.metadata.workspace_root);
+  const list = mergeLists(readHostList(listFile), readHostList(repoFile));
+  const verdict = checkBuildHelpers(inv.units, list);
+  if (sub === "check" && !verdict.ok && rest.includes("--trace-missing") && platform === "linux" && verdict.untraced.length) {
+    log(`right-release build-helpers: ${verdict.untraced.length} untraced unit(s) on this Linux host; tracing them now (strace -ff)`);
+    const traced = mainWith(["trace", ...(manifestPath ? ["--manifest-path", manifestPath] : [])], { env, platform, run, log, err });
+    if (traced !== 0) return traced;
+    return mainWith(["check", ...(manifestPath ? ["--manifest-path", manifestPath] : [])], { env, platform, run, log, err });
+  }
+  if (sub === "check") {
+    if (verdict.ok) { log(`right-release build-helpers: ${inv.units.length} build-helper unit(s), every one traced on this host (${listFile})`); return 0; }
+    for (const line of buildHelperRefusal(verdict)) err(line);
+    return 1;
+  }
+  if (sub === "trace") {
+    let devices = {};
+    if (platform === "win32") {
+      // ETW kernel sessions need an elevated shell; kernel paths are mapped back to drive letters once (QueryDosDevice).
+      const admin = run("net", ["session"], { encoding: "utf8" });
+      if (admin.status !== 0) { err("right-release build-helpers trace: run from an elevated (Administrator) shell; ETW kernel tracing needs it"); return 2; }
+      const map = run("powershell", ["-NoProfile", "-Command", "$s='[DllImport(\\\"kernel32.dll\\\")] public static extern uint QueryDosDevice(string d, System.Text.StringBuilder b, uint m);'; $k=Add-Type -MemberDefinition $s -Name K -Namespace W -PassThru; foreach($d in [IO.DriveInfo]::GetDrives()){ $l=$d.Name.Substring(0,2); $b=New-Object Text.StringBuilder 512; [void]$k::QueryDosDevice($l,$b,512); \"$l=$b\" }"], { encoding: "utf8" });
+      for (const line of String(map.stdout ?? "").split(/\r?\n/)) { const m = /^([A-Z]:)=(\\Device\\\S+)$/.exec(line.trim()); if (m) devices[m[2]] = m[1]; }
+    }
+    const recordRepo = rest.includes("--record-repo");
+    const cargoHome = env.CARGO_HOME ?? path.join(os.homedir(), ".cargo");
+    for (const unit of [...verdict.untraced, ...verdict.failed.map((f) => f.unit)]) {
+      const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "rk-bht-"));
+      const traceFile = path.join(scratch, "trace.txt");
+      const buildArgs = ["build", "-p", `${unit.crate}@${unit.version}`, "--locked", "--target-dir", path.join(scratch, "target"), ...(manifestPath ? ["--manifest-path", manifestPath] : [])];
+      const buildEnv = { ...env, CARGO_TARGET_DIR: path.join(scratch, "target") };
+      let build;
+      if (platform === "win32") {
+        const etlFile = path.join(scratch, "file.etl"); const etlProc = path.join(scratch, "proc.etl");
+        run("logman", ["stop", "rk-bht-file", "-ets"]); run("logman", ["stop", "rk-bht-proc", "-ets"]);
+        const startProc = run("logman", ["start", "rk-bht-proc", "-p", "Microsoft-Windows-Kernel-Process", "0x10", "-o", etlProc, "-ets"], { encoding: "utf8" });
+        const startFile = run("logman", ["start", "rk-bht-file", "-p", "Microsoft-Windows-Kernel-File", "0x1E90", "-o", etlFile, "-ets"], { encoding: "utf8" });
+        if (startProc.status !== 0 || startFile.status !== 0) { err(`right-release build-helpers trace: logman could not start the ETW sessions: ${String(startFile.stdout ?? startProc.stdout ?? "").trim()}`); return 2; }
+        try { build = run("cargo", buildArgs, { encoding: "utf8", env: buildEnv }); }
+        finally { run("logman", ["stop", "rk-bht-file", "-ets"]); run("logman", ["stop", "rk-bht-proc", "-ets"]); }
+        const xml = path.join(scratch, "trace.xml");
+        const exported = run("tracerpt", [etlProc, etlFile, "-o", xml, "-of", "XML", "-y"], { encoding: "utf8" });
+        if (exported.status !== 0) { err("right-release build-helpers trace: tracerpt could not export the ETW trace"); return 2; }
+        fs.writeFileSync(traceFile, fs.readFileSync(xml, "utf8"));
+      } else if (platform === "linux") {
+        // strace follows every child (-f) and records the file calls; it needs no root for the agent's own processes.
+        // -ff: one output file per process, so no system call is split across <unfinished>/<resumed> lines.
+        build = run("strace", ["-ff", "-qq", "-o", traceFile, "-e", "trace=open,openat,openat2,creat,rename,renameat,renameat2,unlink,unlinkat,mkdir,mkdirat,rmdir,link,linkat,symlink,symlinkat,truncate,chmod,fchmodat,chown,fchownat,lchown,utimensat", "cargo", ...buildArgs], { encoding: "utf8", env: buildEnv });
+        if (build.error?.code === "ENOENT") { err("right-release build-helpers trace: strace is not installed on this host"); return 2; }
+      } else {
+        // Endpoint Security (eslogger) names every event's process and its parent, so the whole tree under this process is traced: build
+        // scripts and everything they start (sh, cc, cmake, perl), whatever the name. Only the logger is root (`sudo -n`: the credential
+        // `trace-all` cached with one `sudo -v`); the build runs as the user. eslogger needs Full Disk Access for the terminal running it.
+        const tracer = run("sh", ["-c", `sudo -n eslogger fork exec create rename unlink link truncate open close clone copyfile exchangedata > '${traceFile}' 2>'${traceFile}.err' & echo $!`], { encoding: "utf8" });
+        const tracerPid = String(tracer.stdout ?? "").trim();
+        run("sleep", ["2"]);
+        build = run("cargo", buildArgs, { encoding: "utf8", env: buildEnv });
+        run("sleep", ["1"]);
+        if (tracerPid) { run("sudo", ["-n", "pkill", "-INT", "-P", tracerPid]); run("kill", [tracerPid]); run("sleep", ["1"]); }
+      }
+      if (build.error || build.status !== 0) { err(`right-release build-helpers trace: ${unit.crate} ${unit.version} did not build (${build.error?.message ?? `exit ${build.status}`}); not recorded`); continue; }
+      let text = ""; try { text = platform === "linux" ? readStraceFiles(traceFile) : fs.readFileSync(traceFile, "utf8"); } catch { /* no trace output */ }
+      if (!text.trim()) { err(`right-release build-helpers trace: ${platform === "linux" ? "strace" : platform === "darwin" ? "eslogger (it needs sudo and Full Disk Access for this terminal)" : "ETW"} recorded nothing; nothing recorded`); return 2; }
+      const writes = platform === "win32" ? parseEtwWrites(text, { rootPid: process.pid, devices })
+        : platform === "linux" ? parseStraceWrites(text, { cwd: path.dirname(path.resolve(manifestPath ?? "Cargo.toml")) }) : parseEsloggerWrites(text, { rootPid: process.pid });
+      const allowed = platform === "win32" ? [path.join(scratch, "target"), cargoHome, os.tmpdir(), env.LOCALAPPDATA ? path.join(env.LOCALAPPDATA, "Temp") : null]
+        : [path.join(scratch, "target"), cargoHome, os.tmpdir(), "/private/var/folders", "/dev", "/proc/self"];
+      const judged = judgeTrace(writes, { allowed, platform, mustSee: path.join(scratch, "target") });
+      recordTrace(listFile, unit, judged);
+      // --record-repo also writes the verdict into the repository's committed list, for review and commit by the repository's owner.
+      if (recordRepo) recordTrace(repoFile, unit, judged);
+      log(`${judged.ok ? "pass" : "FAIL"} ${unit.crate} ${unit.version}${judged.ok ? "" : `: wrote ${judged.outside.slice(0, 5).join(", ")}`}`);
+      fs.rmSync(scratch, { recursive: true, force: true });
+    }
+    return 0;
+  }
+  err("usage: right-release build-helpers check|trace [--manifest-path <Cargo.toml>] [--record-repo] | trace-all [--root <dir>]...");
+  return 2;
+}
+
+const invoked = (() => { try { return fs.realpathSync(process.argv[1] ?? "") === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })();
+if (invoked) process.exit(main());

package/build-launch.mjs

@@ -7,13 +7,8 @@
 // - cargo <args>               -> <rustright> cargo <args>   (by the resolved broker client, whatever path the caller named: a real
 //                                  cargo binary is never launched around the broker)
 // - rustright <args>           -> <rustright> <args>         (the resolved broker client)
-// - rightkit-qa <args>         -> <rustright> run rightkit-qa -- <args>   (off the snapshot route: the whole QA run, its test binaries included,
-//                                  is one broker job holding the app's claim). ON a snapshot stage it is NOT an adapter job: QA runs an
-//                                  already-built artifact and compiles nothing, so it stays a direct, gate-run step with its GUI session and
-//                                  unscrubbed environment. A `run-tests` step with no `--from-cargo-json` is two parts (qa-snapshot-run.mjs): a
-//                                  carried test build whose listing lands under the carrier's managed directory, then QA directly against
-//                                  it. A `journeys run` step is the same two parts (qa-journeys-prebuilt-run.mjs, GB-79: the gate carries the build, signs the products, hands QA the verified input) when rightkit-qa advertises `journeys-prebuilt-input`, else refused naming it. Any other QA step whose argv would build (`--build*`) is refused (`qaBuildReason`), as
-//                                  is a QA directory outside the snapshot or an input that resolves into the primary checkout (`qaPathReason`)
+// - rightkit-qa <args>         -> refused on every route (GATE-CONTRACT GC-A07): a build stage runs no QA step; QA journeys run after the build
+//                                  against the installed dev copy (`right-release qa --stage installed`, which starts the runner itself, never through this door)
 // - this package's right-release -> unchanged (same NODE_OPTIONS as this process): it orchestrates, and every build it starts comes back
 //                                  through this door
 // A SNAPSHOT STAGE (the gate's carrier map is in the environment, RIGHTKIT_CARRIED_CARGO_MAP) carries every one of those steps itself: a
@@ -25,7 +20,7 @@
 // environment: the door sets RUSTRIGHT_ADAPTER_ENV to exactly those names (adapter-env.mjs), the broker accepts the names the adapter's
 // registration lists in `env`, and the values are bound into the signed request. A reserved name is refused here; a step with no env gets no
 // RUSTRIGHT_ADAPTER_ENV.
-// - rustright run <adapter> -- <args> on a snapshot stage -> the same step as the adapter's own program (pnpm, node, rightkit-qa, swift), so
+// - rustright run <adapter> -- <args> on a snapshot stage -> the same step as the adapter's own program (pnpm, node, swift), so
 //                                  the door's rules apply to it; any other `rustright <command>` there is refused (RK_BUILD_LAUNCH_REFUSED)
 // - pnpm exec <target>          -> only a target in EXEC_TARGETS (tauri, right-release, vite) on a broker host: the broker's pnpm entry
 //                                  has no target allowlist, so `pnpm exec node -e ...` would otherwise pass the node flag ban
@@ -51,15 +46,13 @@ import { cargoSubcommandOf, canonicalCargoCommand } from "./cargo-shapes.mjs";
 import { swiftScratchRefusal } from "./swift-scratch.mjs";
 import { NATIVE_ADAPTERS, NATIVE_SIGNING_FILE_ENV, nativeCallFsProblem, nativeManagedOutputs, nativeOutputsFromReceipt, nativeSigningFileRefusal, nativeStateDir, nativeToolLaunch, nativeToolOf } from "./native-adapters.mjs";
 import { PNPM_ADAPTER_GRAMMAR, adapterArgvRefusal, liveAdapterGrammar, scanAdapterArgv } from "./pnpm-adapter-grammar.mjs";
-import { isJourneysRun, journeysCapabilityRefusal, journeysRunRefusal, qaPrebuiltCapability } from "./qa-journeys-prebuilt.mjs";
-import { QA_VALUE_OPTIONS, hasListing, isBuildFlag, ownWords, qaPathReason, qaSnapshotPlan } from "./qa-snapshot.mjs";
 
 /** The environment variable the door sets for a stage that runs from a commit snapshot (gate-stages.mjs CHECKOUT_ENV). */
 const SNAPSHOT_STAGE_ENV = "RK_GATE_CHECKOUT";
 
 export const BUILD_LAUNCH_REFUSED = "RK_BUILD_LAUNCH_REFUSED";
-/** The program name a sign step would have if it were a command: the door refuses it on every route. */
-export const SIGN_STEP_COMMAND = "rightkit-sign-step";
+/** Why a `rightkit-qa` step never launches through this door (GATE-CONTRACT GC-A07). */
+const QA_STEP_REMOVED = "a build or test step runs no QA (GATE-CONTRACT GC-A07): QA journeys run after the build against the installed dev copy, started by `right-release qa --stage installed`";
 const OWN_RIGHT_RELEASE = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
 // GB-06: the helpers the package recipes generate (package-recipe-targets.mjs) are this package's own release operations, run by this very Node binary at their exact installed
 // paths, like right-release itself: they orchestrate in the gate's own session, and every build-capable child they start comes back through this door as a carried step.
@@ -69,8 +62,6 @@ const CREATE_MAC_UPDATER_HELPER = fileURLToPath(new URL("./create-mac-updater.mj
 export const INTERNAL_RELEASE_HELPERS = Object.freeze([OWN_RIGHT_RELEASE, RECIPE_BUILD_HELPER, CREATE_MAC_UPDATER_HELPER]);
 const CARRIED_RUN = fileURLToPath(new URL("./carried-cargo-run.mjs", import.meta.url));
 const CARRIED_ADAPTER_RUN = fileURLToPath(new URL("./carried-adapter-run.mjs", import.meta.url));
-const QA_SNAPSHOT_RUN = fileURLToPath(new URL("./qa-snapshot-run.mjs", import.meta.url));
-const QA_JOURNEYS_RUN = fileURLToPath(new URL("./qa-journeys-prebuilt-run.mjs", import.meta.url));
 // pnpm options that take the next argument as their value (so that value is not the command).
 const PNPM_VALUE_OPTIONS = new Set(["--dir", "-C", "--filter", "-F", "--prefix", "--config", "--reporter", "--workspace-concurrency"]);
 // Node flags that change no code path; everything else before the script (-e, --eval, -p, --import, -r, --require, --loader, …) refuses.
@@ -78,31 +69,7 @@ const NODE_FLAGS = /^--(?:disable-warning=[A-Za-z0-9_-]+|no-experimental-webstor
 /** The pnpm `exec` targets the door admits (every app config's `pnpm exec <target>`: tauri and right-release; vite for a web build). */
 export const EXEC_TARGETS = Object.freeze(["tauri", "right-release", "vite"]);
 /** The broker adapter a `rustright run <adapter> -- ...` names, and the program whose door rules judge the step. */
-const ADAPTER_PROGRAMS = Object.freeze({ "rightkit-pnpm": "pnpm", "rightkit-node": "node", "rightkit-qa": "rightkit-qa", "rightkit-swift": "swift", "rightkit-xcodegen": "xcodegen", "rightkit-xcodebuild": "xcodebuild", "rightkit-gradle": "gradle", "rightkit-cmake": "cmake" });
-/** The tools a QA step must not start: running one is a build, and a QA step compiles nothing. */
-const QA_BUILD_PROGRAMS = new Set(["cargo", "rustc", "rustdoc", "rustright", "rightkit", "pnpm", "npm", "npx", "yarn", "swift", "swiftc", "xcodebuild", "gradle", "gradlew", "make", "cmake", "node-gyp"]);
-export { QA_VALUE_OPTIONS };
-/**
- * Why a `rightkit-qa` argv would build, or null. A QA step on a snapshot stage runs an already-built artifact: `run-tests` compiles its
- * test binaries unless it is handed an existing listing (`--from-cargo-json`, read in flag position only), `journeys run` builds through the
- * broker, `run --build`, `--build-ui` and `--build-with` build, and any named toolchain command is a build. `carried` says the gate carries a
- * `run-tests` step's build itself (qa-snapshot.mjs), so that one is not reported; `journeys run` has no prebuilt form and always is.
- */
-export function qaBuildReason(args, { carried = false } = {}) {
-  const words = args.map(String);
-  // run-tests has its own parser (words after `--` are test arguments); every other command's Args reads the whole argv (rightkit-qa.rs
-  // Args::has / value ignore `--`), so for those a build flag or tool anywhere is the build.
-  const own = words[0] === "run-tests" ? ownWords(words) : words;
-  if (words[0] === "run-tests" && !hasListing(words) && !carried) return "`rightkit-qa run-tests` without --from-cargo-json compiles its test binaries (`cargo test --no-run`)";
-  // GB-79: `journeys run` spawns its own `rustright cargo ... --no-run`. On a gate-carried stage the gate carries that build itself and hands QA the verified, signed input
-  // (qa-journeys-prebuilt.mjs, capability journeys-prebuilt-input), so there it is not a build; anywhere else it is, and a listing or attestation the step names is unverified input.
-  if (words[0] === "journeys" && words[1] === "run" && !carried) return "`rightkit-qa journeys run` builds through the broker before it launches (it spawns its own `rustright cargo ... --no-run`); only a gate-carried stage runs it, on the gate's own verified prebuilt input (capability journeys-prebuilt-input)";
-  if (words[0] === "journeys" && words[1] === "run") { const own = journeysRunRefusal(words); if (own) return own; }
-  if (own.some(isBuildFlag)) return "a --build, --build-ui or --build-with flag makes the QA run build";
-  const tool = own.find((w) => QA_BUILD_PROGRAMS.has(name(w)));
-  if (tool !== undefined) return `the argument ${JSON.stringify(tool)} names a build tool (${name(tool)}); a QA step compiles nothing`;
-  return null;
-}
+const ADAPTER_PROGRAMS = Object.freeze({ "rightkit-pnpm": "pnpm", "rightkit-node": "node", "rightkit-swift": "swift", "rightkit-xcodegen": "xcodegen", "rightkit-xcodebuild": "xcodebuild", "rightkit-gradle": "gradle", "rightkit-cmake": "cmake" });
 const name = (program) => path.basename(String(program ?? "").replaceAll("\\", "/")).replace(/\.(exe|cmd|bat)$/i, "").toLowerCase();
 
 function refuse(message, reason) {
@@ -169,8 +136,7 @@ export function snapshotInstallSkip(command, args, env) {
  * (resolveExecutor's inputs); `which` defaults to a PATH lookup over `env`.
  */
 export function buildLaunch(command, args = [], host = {}) {
-  // A `sign` step of tests.suites (suite-signing.mjs) runs in-process in the gate's own session: it is no command, no broker job and never carried.
-  if (command === SIGN_STEP_COMMAND || host.signStep) refuse("a sign step runs in-process in the gate's own session (signing agent, Keychain and Azure signer are the session's, not a broker job's); it never reaches the carrier (rightkit#1303)");
+  if (name(command) === "rightkit-qa") refuse(`rightkit-qa ${args.join(" ")}: ${QA_STEP_REMOVED}`);
   const env = host.env ?? process.env;
   const platform = host.platform ?? process.platform;
   const exists = host.exists;
@@ -223,7 +189,7 @@ export function buildLaunch(command, args = [], host = {}) {
   if (carriedArgs && carried?.map) return { command: process.execPath, args: [CARRIED_RUN, ...carriedArgs.map(String)], ...cargoHandoffEnv(carriedArgs) };
   const client = () => lookup("rustright")[0] ?? refuse(`rustright is not on PATH: on a broker-managed host ${program} runs only as a broker job`);
   // A snapshot stage's pnpm, node and swift steps are carried adapter jobs (carried-adapter-run.mjs); anywhere else they are the client's `run`.
-  // A QA step is not one of them: it runs an already-built artifact (see the rightkit-qa branch below).
+  // A QA step is not one of them: the door refuses it (see the rightkit-qa branch below).
   const adapterMap = ["pnpm", "node", "swift"].includes(program) || nativeToolOf(command) !== null ? carriedCargoMapOf(env) : null;
   if (adapterMap?.error) refuse(`${name(command)} ${args.join(" ")}: ${adapterMap.error}; a snapshot stage's step is never sent to the client around its carrier`);
   // The step's own environment rides the adapter request (adapter-env.mjs): RUSTRIGHT_ADAPTER_ENV names exactly what the step declares, plus the
@@ -253,47 +219,17 @@ export function buildLaunch(command, args = [], host = {}) {
   if (program === "rustright") {
     const snapshotMap = carriedCargoMapOf(env);
     if (!snapshotMap) {
-      // GB-27: the client spelling of the same unregistered adapter is refused as well (no snapshot carrier, no rightkit-qa route).
-      if (args[0] === "run" && String(args[1]) === "rightkit-qa") refuse(`rustright ${args.join(" ")}: a QA run is a direct, noncompiling step of a snapshot stage under the door; the broker registers no rightkit-qa adapter, so outside a snapshot stage there is no uncarried route`);
+      // The client spelling of the QA adapter is refused as well (GATE-CONTRACT GC-A07).
+      if (args[0] === "run" && String(args[1]) === "rightkit-qa") refuse(`rustright ${args.join(" ")}: ${QA_STEP_REMOVED}`);
       return { command: client(), args: args.map(String) };
     }
     if (snapshotMap.error) refuse(`rustright ${args.join(" ")}: ${snapshotMap.error}; a snapshot stage's step is never sent to the client around its carrier`);
     // A snapshot stage: `rustright run <adapter> -- <args>` is that adapter's step (judged by the door's rules for its program, then carried);
     // any other `rustright <command>` is an uncarried client call that no registered adapter takes, so it is refused, naming the step.
     const adapterProgram = args[0] === "run" && args[2] === "--" ? ADAPTER_PROGRAMS[String(args[1])] : undefined;
-    if (!adapterProgram) refuse(`rustright ${args.join(" ")}: a snapshot stage carries every compile, and this client call maps to no registered adapter (rustright run rightkit-pnpm|rightkit-node|rightkit-qa|rightkit-swift -- <args>); it is never sent to the client uncarried`);
+    if (!adapterProgram) refuse(`rustright ${args.join(" ")}: a snapshot stage carries every compile, and this client call maps to no registered adapter (rustright run rightkit-pnpm|rightkit-node|rightkit-swift -- <args>); it is never sent to the client uncarried`);
     return buildLaunch(adapterProgram, args.slice(3), host);
   }
-  if (program === "rightkit-qa") {
-    // On a snapshot stage QA is a direct, gate-run step against the already-built artifact: no broker job (a QA run needs the GUI session and
-    // the unscrubbed environment the broker's job lacks), and nothing in it may compile (the broker refuses an uncarried compile from the snapshot).
-    const snapshotMap = carriedCargoMapOf(env);
-    if (snapshotMap?.error) refuse(`rightkit-qa ${args.join(" ")}: ${snapshotMap.error}; a snapshot stage's step is never run around its carrier`);
-    // GB-27 (GATE one entry): the broker registers no `rightkit-qa` adapter, so a QA step with no snapshot carrier has no route: it is
-    // refused here, naming the step, never sent as `rustright run rightkit-qa` (an unregistered capability the broker would refuse after the
-    // gate had marked the call submitted). QA runs only as the direct, noncompiling step of a snapshot stage under the door.
-    if (!snapshotMap) refuse(`rightkit-qa ${args.join(" ")}: a QA run is a direct, noncompiling step of a snapshot stage under the door; the broker registers no rightkit-qa adapter, so outside a snapshot stage there is no uncarried route (and any build the run needs is its own carried build step)`);
-    // The step runs from the snapshot and reads only the snapshot and managed output: its directory is inside the snapshot, and nothing it
-    // names (the listing, --root, --cwd, --manifest-path) resolves into the primary checkout.
-    const section = snapshotMap.map.broker ?? {};
-    const checkouts = [section.checkout, env[SNAPSHOT_STAGE_ENV]].filter((c) => typeof c === "string" && c);
-    const placed = qaPathReason(args, { cwd: host.cwd ?? process.cwd(), snapshot: section.snapshot?.path, checkouts, env: { ...env, ...host.stepEnv } });
-    if (placed) refuse(`rightkit-qa ${args.join(" ")}: ${placed}`);
-    const reason = qaBuildReason(args, { carried: true });
-    if (reason) refuse(`rightkit-qa ${args.join(" ")}: ${reason}; a QA step of a snapshot stage runs the already-built artifact and compiles nothing, so a build it needs is its own carried build step (a test build with --no-run --message-format=json, then run-tests --from-cargo-json)`);
-    const qa = lookup("rightkit-qa")[0] ?? "rightkit-qa";
-    // `run-tests` with no listing: the gate carries its test build, then runs QA directly against the listing (qa-snapshot-run.mjs).
-    // GB-79: a `journeys run` step is the gate's build-once route (carry the build, sign the products, hand QA the verified input) when QA implements the prebuilt input.
-    if (isJourneysRun(args)) {
-      const capable = (host.qaPrebuiltCapability ?? ((binary) => qaPrebuiltCapability(binary, { env: { ...env, ...host.stepEnv } })))(qa);
-      if (!capable) refuse(journeysCapabilityRefusal(`rightkit-qa ${args.join(" ")}`));
-      return { command: process.execPath, args: [QA_JOURNEYS_RUN, qa, "--", ...args.map(String)] };
-    }
-    const plan = qaSnapshotPlan(args);
-    if (plan?.refusal) refuse(`rightkit-qa ${args.join(" ")}: ${plan.refusal}`);
-    if (plan) return { command: process.execPath, args: [QA_SNAPSHOT_RUN, qa, "--", ...args.map(String)] };
-    return { command: qa, args: args.map(String) };
-  }
   // GB-51 / RA-07..RA-09: a declared native build tool (xcodegen, xcodebuild, Gradle and its wrapper, CMake) is a snapshot-bound adapter job of its own constrained adapter (native-adapters.mjs): its argv is
   // judged by the registration and by the broker's own shape and file rules BEFORE the send (an output override, an unregistered flag or a shape the broker has no managed form for is refused here, naming
   // the capability), paths are made relative to the step's directory, and the step carries no environment of its own: the signing-properties file is a typed handoff, never an environment, and refuses