@rightkit/release 0.6.24 → 0.6.26

package/provenance-verify.mjs

@@ -217,10 +217,12 @@ export const CAUSE_EVIDENCE_SCHEMA = "rustright.cause-evidence.v1";
 /** The refusal codes of a verdict that is not `explained` (the other cause-evidence refusals are `evidence`, like every malformed signed field). */
 export const CAUSE_UNKNOWN = "cause-unknown";
 export const CAUSE_UNEXPLAINED = "cause-unexplained";
-/** cargo_evidence.rs EXPLAINED_CAUSES: the only causes that explain a rebuilt unit; any other (including `unexplained`, `fingerprint-missing` and one this list does not know) does not. */
+/** cargo_evidence.rs EXPLAINED_CAUSES (the same 10, in the broker's order): the only causes that explain a rebuilt unit; any other (including `unexplained`, `fingerprint-missing` and one this list does not know) does not. */
 export const EXPLAINED_CAUSES = Object.freeze([
   "first-build", "toolchain-changed", "source-or-dependency-changed", "env-rustflags-profile-features-or-target-changed",
   "generation-change", "authorized-eviction", "new-unit", "new-namespace",
+  // A unit missing its recorded fingerprint row while its package has a fingerprint dir under another build (rustright judge step 0, cargo_evidence.rs same_package_other_build).
+  "after-failed-build", "fingerprint-changed",
 ]);
 const CAUSE_STATES = Object.freeze(["complete", "incomplete", "unavailable"]);
 const CAUSE_VERDICTS = Object.freeze(["explained", "unexplained", "unknown"]);

package/qa-build-features.mjs

@@ -179,8 +179,17 @@ export function cargoManifestIssues(manifestText, label = "Cargo.toml", { allowD
     const shell = dependencies.get(name);
     if (shell && !shell.optional && shell.features.includes("dev-inspect")) issues.push(`${label}: dependency \`${name}\` lists \`dev-inspect\` unconditionally (developer inspection ships in release builds)`);
   }
-  const service = dependencies.get("rightkit-daemon");
-  if (service && !service.optional && service.features.includes("test-mode")) issues.push(`${label}: dependency \`rightkit-daemon\` lists \`test-mode\` unconditionally (test-mode capability ships in release builds)`);
+  // GC-A09: no `test-mode` feature exists anywhere (own `[features]` table or any dependency, optional or not,
+  // `<crate>/test-mode` forwards included): tests are isolated by injection (a temp data root, a MemoryBackend).
+  const isTestModeName = (name) => name === "test-mode" || name.endsWith("-test-mode");
+  for (const name of features.keys()) {
+    if (isTestModeName(name)) issues.push(`${label}: declares feature \`${name}\` (no test-mode feature may exist: inject a temp data root and a MemoryBackend instead)`);
+  }
+  for (const [alias, dep] of dependencies) {
+    for (const feature of dep.features) {
+      if (isTestModeName(feature)) issues.push(`${label}: dependency \`${alias}\` enables feature \`${feature}\` (no test-mode feature may exist: inject a temp data root and a MemoryBackend instead)`);
+    }
+  }
   const wdio = dependencies.get(FORBIDDEN_DEPENDENCY);
   if (wdio && !wdio.optional) issues.push(`${label}: dependency \`${FORBIDDEN_DEPENDENCY}\` is not optional`);
   const reached = new Set(); const stack = [...(features.get("default") ?? [])];

package/release-qa-audit.mjs

@@ -1,12 +1,10 @@
 // QA admission plus the ad hoc `right-release qa audit` scan.
 //
 // Per-app policy (qa-admission-policy.json, release-qa-policy.mjs): `warn` is the default, `refuse` is switched on
-// per app once the app has earned it, and separately per stage: the build (source) admission and the publication
-// (installed) admission each read their own mode. The gates in release-qa-receipt.mjs verify receipts, and the
+// per app once the app has earned it. Only the publication (installed) admission exists (GATE-CONTRACT GC-A07: no source QA stage). The gates in release-qa-receipt.mjs verify receipts, and the
 // hardening in release-qa-hardening.mjs re-checks platform, release id, approved runner digest (for that platform),
 // every release-critical journey and the signing/test separation. In warn mode a refusal becomes a loud stderr
-// warning and a durable record (the sealed manifest `qa` field for the source stage,
-// `state/<releaseId>/<platformDir>/qa-installed.json` for the installed stage). In refuse mode the same refusal
+// warning and a durable record (`state/<releaseId>/<platformDir>/qa-installed.json`). In refuse mode the same refusal
 // throws a QaAdmissionError and nothing is sealed or published. `qa audit` reads the records so a weekly run can
 // flag released builds that lack passing QA.
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -14,13 +12,13 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { hardenQaReceipt } from "./release-qa-hardening.mjs";
 import { admissionModeFor, loadAdmissionPolicy } from "./release-qa-policy.mjs";
-import { assertInstalledQaAdmission, assertSourceQaAdmission, loadQaFloor, QaAdmissionError, qaReceiptPath, readQaReceipt } from "./release-qa-receipt.mjs";
+import { assertInstalledQaAdmission, loadQaFloor, QaAdmissionError, qaReceiptPath, readQaReceipt } from "./release-qa-receipt.mjs";
 import { platformDirOf, platformOfDir } from "./platform-dir.mjs";
 
 
 /** "missing" when no receipt exists; "rejected" for anything else the gate refused (bad receipt, no key, wrong commit). */
 function refusalStatus(error) {
-  return /^no (?:source|installed) QA receipt/.test(error.message) ? "missing" : "rejected";
+  return /^no installed QA receipt/.test(error.message) ? "missing" : "rejected";
 }
 const refusalReason = (error) => String(error.message).split("\n  run:")[0];
 
@@ -58,14 +56,6 @@ function hardening(stage, opts, loaded, hooks) {
   });
 }
 
-/** Build stage. Returns the `qa` block sealed into the release manifest. */
-export function admitSourceQa(opts, hooks = {}) {
-  const { loaded, app, mode } = policyContext(opts, hooks, "source");
-  const outcome = admit(() => assertSourceQaAdmission({ ...opts, afterVerify: hardening("source", opts, loaded, hooks) }), { ...hooks, mode, app });
-  if (outcome.status === "passed") return { status: "passed", sourceReceiptDigest: outcome.result.digest, floorDigest: outcome.result.floorDigest };
-  return { status: outcome.status, reason: outcome.reason };
-}
-
 export const installedQaRecordPath = ({ repoRoot, releaseId, platform }) =>
   path.join(repoRoot, ".right-release", "state", releaseId, platformDirOf(platform), "qa-installed.json");
 
@@ -92,13 +82,6 @@ export function admitInstalledQa(opts, { provider, now = () => new Date(), ...ho
 const readJson = (file) => { try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; } };
 const subdirs = (dir) => (existsSync(dir) ? readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name) : []);
 
-function sourceStatus(manifest) {
-  const qa = manifest.qa;
-  if (qa?.status === "passed" || (!qa?.status && qa?.sourceReceiptDigest)) return { status: "passed" };
-  if (qa?.status) return { status: qa.status, ...(qa.reason ? { reason: qa.reason } : {}) };
-  return { status: "missing", reason: "sealed manifest records no source QA" };
-}
-
 function installedStatus({ repoRoot, releaseId, platformDir }) {
   const stateDir = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
   const record = readJson(path.join(stateDir, "qa-installed.json"));
@@ -121,12 +104,11 @@ export function auditQa({ repoRoot, since } = {}) {
       if (!manifest) continue;
       if (since && String(manifest.sealedAt ?? "") < since) continue;
       const installed = installedStatus({ repoRoot, releaseId, platformDir });
-      const source = sourceStatus(manifest);
       const { uploaded, ...installedRest } = installed;
       rows.push({
         releaseId, platform: platformDir, version: manifest.version ?? null, sealedAt: manifest.sealedAt ?? null, uploaded,
-        source, installed: installedRest,
-        ok: !uploaded || (source.status === "passed" && installedRest.status === "passed"),
+        installed: installedRest,
+        ok: !uploaded || installedRest.status === "passed",
       });
     }
   }
@@ -135,8 +117,8 @@ export function auditQa({ repoRoot, since } = {}) {
 
 export function formatAuditTable(report) {
   if (!report.rows.length) return "right-release qa audit: no sealed releases found";
-  const header = ["release", "platform", "source", "installed", "result"];
-  const body = report.rows.map((row) => [row.releaseId, row.platform, row.source.status, row.installed.status, row.ok ? (row.uploaded ? "ok" : "ok (not uploaded)") : "FLAG"]);
+  const header = ["release", "platform", "installed", "result"];
+  const body = report.rows.map((row) => [row.releaseId, row.platform, row.installed.status, row.ok ? (row.uploaded ? "ok" : "ok (not uploaded)") : "FLAG"]);
   const widths = header.map((_, column) => Math.max(header[column].length, ...body.map((line) => line[column].length)));
   const line = (cells) => cells.map((cell, column) => cell.padEnd(widths[column])).join("  ").trimEnd();
   const flagged = report.rows.filter((row) => !row.ok);
@@ -144,7 +126,7 @@ export function formatAuditTable(report) {
     line(header), ...body.map(line),
     "",
     flagged.length
-      ? `${flagged.length} uploaded build(s) lack passing QA:\n${flagged.map((row) => `  ${row.releaseId} ${row.platform}: ${[row.source.status !== "passed" && `source ${row.source.status}${row.source.reason ? ` (${row.source.reason})` : ""}`, row.installed.status !== "passed" && `installed ${row.installed.status}${row.installed.reason ? ` (${row.installed.reason})` : ""}`].filter(Boolean).join("; ")}`).join("\n")}`
+      ? `${flagged.length} uploaded build(s) lack passing QA:\n${flagged.map((row) => `  ${row.releaseId} ${row.platform}: ${[row.installed.status !== "passed" && `installed ${row.installed.status}${row.installed.reason ? ` (${row.installed.reason})` : ""}`].filter(Boolean).join("; ")}`).join("\n")}`
       : "all uploaded builds have passing QA",
   ].join("\n");
 }

package/release-qa-command.mjs

@@ -1,19 +1,17 @@
 #!/usr/bin/env node
 // right-release qa: run RightKit's own QA runner (rightkit-qa) and write the sealed, MAC'd QA receipt.
 //
-//   right-release qa --stage source    --platform mac|win [--config right-release.config.json]
 //   right-release qa --stage installed --platform mac|win --release <sealed-id> [--config right-release.config.json]
 //   right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]   (release-qa-audit.mjs; exit 1 when an uploaded build lacks passing QA)
-//   right-release qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]
+//   right-release qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage installed]
 //                         | approve-runner --runner <file> --version <v> --platform mac|win --set-by <name> [--note <text>]   (release-qa-policy.mjs)
 //   right-release qa runner enroll --runner <built rightkit-qa> --version <v> [--platform mac|win] [--rotate] | show   (qa-runner.mjs)
 //
 // The release config declares the app's QA plan:
 //   qa: { version: "1", config: "rightkit-qa.toml", runner?: "<path to rightkit-qa>",
-//         args?: { source?: [..], installed?: [..] },                                   // {sealedDir} {releaseId} expand; installed also {installedApp} {installedDir} {qaRoot}
+//         args?: { installed?: [..] },                                   // {sealedDir} {releaseId} expand; installed also {installedApp} {installedDir} {qaRoot}
 //         installed?: { installDir?: "<abs dir>" },                                       // opt in: mount the sealed DMG (mac) / run the sealed NSIS installer (win, needs RIGHT_RELEASE_QA_ALLOW_INSTALL=1 off CI), see release-qa-installed.mjs
-//         journeys?: { manifest?: "journeys.toml", receipt?: "<path to a rightkit.journeys.receipt/1>", args?: { source?: [..], installed?: [..] } },
-//         layout?: { binary: "<bin target of the QA shell>", beside?: [..], build?: [<tests.suites names>] },   // source stage: run against the gate-built QA shell in the layout an install has, see qa-layout.mjs
+//         journeys?: { manifest?: "journeys.toml", receipt?: "<path to a rightkit.journeys.receipt/1>", args?: { installed?: [..] } },
 //         checks: { "smoke.launch": ["app.launch"], journey: ["journey.*"] } }          // floor id -> evidence check names
 // `qa.version` that is a rightkit-qa version (0.10.0) names the runner: the managed, digest-recorded one enrolled by `right-release qa runner enroll`
 // (qa-runner.mjs), never a PATH binary. A legacy plan version ("1") with no `qa.runner` still takes the first `rightkit-qa` on PATH.
@@ -21,6 +19,7 @@
 // `qa.journeys` maps the floor's `journey` id to "every release-critical journey required on this platform passed":
 // `rightkit-qa journeys run` is run (or `receipt` is read), the receipt is validated through `rightkit-qa journeys
 // validate-receipt --manifest .. --tree ..`, and the validated summary is sealed into the receipt (release-qa-hardening.mjs).
+// There is no source stage (GATE-CONTRACT GC-A07): QA journeys run after the build against the installed dev copy.
 // This command refuses to seal from inside a QA run (RIGHT_RELEASE_QA_STAGE set): sealing is never test execution.
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
@@ -42,10 +41,7 @@ import {
 } from "./release-qa-receipt.mjs";
 import { platformDirOf } from "./platform-dir.mjs";
 import { isRunnerVersion, main as runnerMain, resolveManagedQaRunner } from "./qa-runner.mjs";
-import { compiledDirsFromEnv, QA_APP_BINARY_ENV, stageQaLayout, validateQaLayout } from "./qa-layout.mjs";
-import { gateRunsRoot, resolveManagedRoots } from "./managed-roots.mjs";
-import { planTests, runSuites } from "./test-command.mjs";
-import { QA_SIGNED_FILES_ENV } from "./suite-signing-policy.mjs";
+import { resolveManagedRoots } from "./managed-roots.mjs";
 
 const sha256File = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
 
@@ -106,7 +102,11 @@ export function evidencePathFromOutput(stdout) {
 }
 
 /** Run the QA plan through the runner, then seal a receipt. `deps` are test seams; production uses the defaults. */
-export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo = null, deps = {} }) {
+export const SOURCE_QA_REMOVED = "source QA is removed (GATE-CONTRACT GC-A07): QA journeys run after the build against the installed dev copy";
+
+export async function runQa({ stage, platform, releaseIdArg, configPath, deps = {} }) {
+  if (stage === "source") throw new Error(SOURCE_QA_REMOVED);
+  if (stage !== "installed") throw new Error(`--stage must be installed (${SOURCE_QA_REMOVED})`);
   if ((deps.env ?? process.env)[QA_RUN_ENV]) throw new Error(`refusing to seal a QA receipt inside a QA run (${QA_RUN_ENV} is set): sealing and signing happen outside test execution`);
   const executionStartedAt = new Date();
   const gitRunner = deps.gitRunner ?? spawnSync;
@@ -128,22 +128,16 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
   const { floor, digest: floorDigest } = loadQaFloor(deps.floorDir);
   const problems = validateAppQaConfig(config.qa, floor, stage);
   if (problems.length) throw new Error(`release config QA plan does not meet the protected QA floor:\n- ${problems.join("\n- ")}`);
-  const layoutProblems = config.qa.layout === undefined ? [] : validateQaLayout(config.qa.layout);
-  if (layoutProblems.length) throw new Error(`release config qa.layout is invalid:\n- ${layoutProblems.join("\n- ")}`);
 
   let releaseId = releaseIdArg;
   let sealed = null;
   let artifacts = [];
-  let sourceReceiptDigest = null;
-  if (stage === "source") releaseId = `${config.app}-${config.version}-${source.commit.slice(0, 8)}`;
-  else {
+  {
     if (!releaseId) throw new Error("--release <sealed-id> is required for the installed stage");
-    sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", releaseId, platformDirOf(platform)));
+    sealed = (deps.verifySealedRelease ?? verifySealedRelease)(path.join(repoRoot, ".right-release", "sealed", releaseId, platformDirOf(platform)));
     // R4: a split binds the sealed release to the selected commit (and its tree), never to the checkout's HEAD.
     if (split) assertBindsSource(release, sealed.manifest, "the sealed release");
     else if (sealed.manifest.commit !== source.commit) throw new Error("sealed release was built from a different commit than the current checkout");
-    sourceReceiptDigest = sealed.manifest.qa?.sourceReceiptDigest ?? null;
-    if (!sourceReceiptDigest) throw new Error("sealed release records no source QA receipt; it was not built through the QA gate; rebuild after `right-release qa --stage source`");
     artifacts = sealed.manifest.files.map((file) => ({ name: file.name, sha256: file.sha256, sizeBytes: file.sizeBytes }));
   }
 
@@ -181,37 +175,16 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
     });
   }
   let run, journeysRun = null;
-  let layoutStage = null;
   try {
-    // Source stage with a declared layout: the QA shell and its layout are staged in a run-scoped directory from the gate's compile outputs (qa-layout.mjs); the snapshot is never written.
-    if (stage === "source" && config.qa.layout?.build) {
-      // The QA shell is built here, by the app's own build (and sign) suites, never by the release compile (qa-layout.mjs `build`).
-      const env = deps.env ?? process.env;
-      const plan = planTests(config, { suites: config.qa.layout.build, appRoot });
-      const stageFrom = ({ outputs, env: suiteEnv }) => {
-        const dirs = [...new Set(plan.filter((item) => !item.sign).flatMap((item) => outputs.get(item.name) ?? []))];
-        if (!dirs.length) throw new Error(`qa.layout.build: ${plan.map((item) => item.name).join(", ")} passed but named no output directory (no carried receipt, and no RIGHTKIT_GATE_TARGET_DIRS from the gate)`);
-        const signed = plan.some((item) => item.sign) ? JSON.parse(suiteEnv[QA_SIGNED_FILES_ENV] ?? "{}") : null;
-        return (deps.stageLayout ?? stageQaLayout)({ layout: config.qa.layout, snapshotAppRoot: appRoot, qaConfigFile: qaConfig, runsRoot: deps.runsRoot ?? gateRunsRoot({ env }), dirs, platform, signed });
-      };
-      const built = await (deps.runSuites ?? runSuites)(plan, { appRoot, prefix: "qa_build", env, config, log: (line) => console.error(line), errLog: (line) => console.error(line), within: stageFrom });
-      if (built.exitCode !== 0) throw new Error(`qa.layout.build: the QA shell build failed (${built.results.filter((r) => r.exitCode !== 0).map((r) => r.suite).join(", ")}); no QA ran`);
-      layoutStage = built.within;
-    } else if (stage === "source" && config.qa.layout) {
-      const dirs = deps.compiledDirs ?? compiledDirsFromEnv(deps.env ?? process.env);
-      if (!dirs) throw new Error("qa.layout needs the gate's compile outputs (RIGHT_RELEASE_QA_COMPILED_DIRS names none): run source QA through `rightkit-gate --to package`, after its compile");
-      layoutStage = (deps.stageLayout ?? stageQaLayout)({ layout: config.qa.layout, snapshotAppRoot: appRoot, qaConfigFile: qaConfig, runsRoot: deps.runsRoot ?? gateRunsRoot({ env: deps.env ?? process.env }), dirs, platform });
-    }
     const expand = (value) => String(value).replaceAll("{sealedDir}", sealed?.sealedDir ?? "").replaceAll("{releaseId}", releaseId)
       .replaceAll("{installedApp}", installedQa?.installedApp ?? "").replaceAll("{installedDir}", installedQa?.installedDir ?? "").replaceAll("{qaRoot}", installedQa?.qaRoot ?? "");
     const installedDirs = installedDirNames(config, deps.env ?? process.env);
     const runEnv = {
       ...process.env, RIGHT_RELEASE_QA_STAGE: stage, RIGHT_RELEASE_QA_COMMIT: source.commit, RIGHT_RELEASE_QA_RELEASE_ID: releaseId,
       ...(sealed ? { RIGHT_RELEASE_QA_SEALED_DIR: sealed.sealedDir } : {}), ...(installedDirs.length ? { RIGHTKIT_QA_INSTALLED_DIRS: installedDirs.join(";") } : {}), ...(installedQa?.env ?? {}),
-      ...(layoutStage ? { [QA_APP_BINARY_ENV]: layoutStage.binary } : {}),
     };
-    const runCwd = layoutStage?.appRoot ?? appRoot;
-    const args = ["run", "--config", layoutStage?.configFile ?? qaConfig, ...((config.qa.args?.[stage] ?? []).map(expand))];
+    const runCwd = appRoot;
+    const args = ["run", "--config", qaConfig, ...((config.qa.args?.[stage] ?? []).map(expand))];
     run = (deps.spawnRunner ?? spawnSync)(runnerFile, args, {
       cwd: runCwd, encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024,
       env: runEnv,
@@ -222,9 +195,6 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
         cwd: runCwd, encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024, env: runEnv,
       });
     }
-  } catch (error) {
-    layoutStage?.cleanup();
-    throw error;
   } finally {
     installedQa?.cleanup();
   }
@@ -252,36 +222,26 @@ export async function runQa({ stage, platform, releaseIdArg, configPath, carryTo
     required = required.map((item) => (item.id === floor.journeys.floorId ? journeyRequiredItem({ floorId: item.id, validation }) : item));
   }
   const executionFinishedAt = new Date();
-  // The runner's outputs (evidence, journeys receipt) have been read; the run-scoped layout is not evidence and goes.
-  const layoutEvidence = layoutStage?.evidence ?? null;
-  layoutStage?.cleanup();
   // A passing receipt needs the runner to exit cleanly AND an evidence bundle that itself passed.
   if (run.status !== 0 && evidence) evidence = { ...evidence, status: "failed" };
-  // The layout evidence rides beside the standard body (release-qa-receipt.mjs is a policy-bundle entrypoint and stays untouched); the seal covers it.
-  const receipt = sealQaReceipt({ ...buildQaReceipt({
+  const receipt = sealQaReceipt(buildQaReceipt({
     stage, app: config.app, platform, releaseId, source, closure: dependencyClosure(repoRoot, source.commit, gitRunner),
     releaseConfigSha256: sha256File(configPath), qa: config.qa, floor, floorDigest,
     policyBundleDigest: deps.policyBundleDigest ?? currentPolicyBundleDigest(deps.floorDir),
     runner: { basename: path.basename(runnerFile).replace(/\.exe$/i, ""), path: runnerFile, sha256: runnerSha, ...(managedRunner ? { version: managedRunner.version, source: "managed" } : {}) },
-    evidence, evidenceSha256, required, artifacts, sourceReceiptDigest, journeys,
+    evidence, evidenceSha256, required, artifacts, journeys,
     execution: {
       startedAt: executionStartedAt.toISOString(), finishedAt: executionFinishedAt.toISOString(),
       runnerPids: [run.pid, journeysRun?.pid].filter((pid) => Number.isInteger(pid) && pid > 0), sealerPid: process.pid,
     },
-  }), ...(layoutEvidence ? { layout: layoutEvidence } : {}) }, key);
+  }), key);
   const file = qaReceiptPath({ repoRoot, releaseId, platform, stage });
   writeQaReceipt(file, receipt);
-  // #183: copy the sealed receipt next to the candidate handoff so the signing job (a different runner) can read it.
-  let carriedFile = null;
-  if (carryTo) {
-    carriedFile = path.join(path.resolve(carryTo), `${stage}.receipt.json`);
-    writeQaReceipt(carriedFile, receipt);
-  }
-  return { receipt, file, carriedFile };
+  return { receipt, file };
 }
 
 function usage(code) {
-  console.log("usage: right-release qa --stage source|installed --platform mac|win [--release <sealed-id>] [--config right-release.config.json] [--carry-to <dir>]\n       (seals the QA receipt; admission is warn or refuse per app in qa-admission-policy.json; refused inside a QA run)\n       right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]\n       right-release qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]\n                             | approve-runner --runner <file> --version <v> --platform mac|win --set-by <name> [--note <text>]");
+  console.log("usage: right-release qa --stage installed --platform mac|win [--release <sealed-id>] [--config right-release.config.json]\n       (seals the QA receipt; admission is warn or refuse per app in qa-admission-policy.json; refused inside a QA run)\n       right-release qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]\n       right-release qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage installed]\n                             | approve-runner --runner <file> --version <v> --platform mac|win --set-by <name> [--note <text>]");
   process.exit(code);
 }
 
@@ -289,23 +249,22 @@ export async function main(args) {
   if (args[0] === "audit") process.exit(auditMain(args.slice(1)));
   if (args[0] === "policy") process.exit(policyMain(args.slice(1), { program: "right-release qa policy" }));
   if (args[0] === "runner") process.exit(runnerMain(args.slice(1), { program: "right-release qa runner" }));
-  let stage = "", platform = process.platform === "win32" ? "win" : "mac", releaseId = "", configName = defaultReleaseConfigFile(), carryTo = null;
+  let stage = "", platform = process.platform === "win32" ? "win" : "mac", releaseId = "", configName = defaultReleaseConfigFile();
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--stage") stage = args[++index];
     else if (arg === "--platform") platform = args[++index];
     else if (arg === "--release") releaseId = args[++index];
     else if (arg === "--config") configName = args[++index];
-    else if (arg === "--carry-to") carryTo = args[++index];
     else if (arg === "-h" || arg === "--help") usage(0);
     else { console.error(`right-release qa: unknown argument: ${arg}`); process.exit(2); }
   }
-  if (!QA_STAGES.includes(stage)) { console.error("right-release qa: --stage must be source or installed"); process.exit(2); }
+  if (stage === "source") { console.error(`right-release qa: ${SOURCE_QA_REMOVED}`); process.exit(2); }
+  if (!QA_STAGES.includes(stage)) { console.error("right-release qa: --stage must be installed"); process.exit(2); }
   if (platform !== "win" && platform !== "mac") { console.error("right-release qa: --platform must be win or mac"); process.exit(2); }
   try {
-    const { receipt, file, carriedFile } = await runQa({ stage, platform, releaseIdArg: releaseId, configPath: path.resolve(configName), carryTo });
+    const { receipt, file } = await runQa({ stage, platform, releaseIdArg: releaseId, configPath: path.resolve(configName) });
     console.log(`right-release qa: ${stage} receipt ${receipt.status} ${receipt.digest.slice(0, 16)} -> ${file}`);
-    if (carriedFile) console.log(`right-release qa: carried copy -> ${carriedFile}`);
     for (const item of receipt.required) console.log(`  ${item.id}: ${item.status}`);
     process.exit(receipt.status === "passed" ? 0 : 1);
   } catch (error) {

package/release-qa-fixtures.mjs

@@ -1,4 +1,4 @@
-// Shared builders for the QA admission hardening tests (release-qa-hardening.test.mjs, release-qa-carried.test.mjs).
+// Shared builders for the QA admission hardening tests (release-qa-hardening.test.mjs).
 // Test support only: nothing in the release path imports this file.
 import { createHash } from "node:crypto";
 import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
@@ -82,6 +82,10 @@ export function journeysReceiptJson({ root, platform = "mac", manifestText = MAN
   };
 }
 
+/** The one sealed artifact the installed-stage fixtures publish, and the manifest that names it (GATE-CONTRACT GC-A07: installed is the only QA stage). */
+export const ARTIFACTS = [{ name: "demo.dmg", sha256: SHA("a"), sizeBytes: 3 }];
+export const manifestOf = (root, releaseId) => ({ releaseId, app: "demo", commit: sourceIdentity(root).commit, files: ARTIFACTS });
+
 export const accepting = () => ({ status: 0, stdout: "receipt claims passed, recomputed passed: ACCEPTED\n", stderr: "" });
 export const refusing = () => ({ status: 1, stdout: "- journey_failed [J-001]: journey failed\nreceipt claims passed, recomputed failed: REFUSED\n", stderr: "" });
 
@@ -89,12 +93,12 @@ const qa = { version: "1", config: "rightkit-qa.toml", journeys: {}, checks: { "
 const evidence = () => ({ schemaVersion: 4, runId: "r1", status: "passed", finishedAt: "2026-10-09T00:00:00Z", checks: [{ name: "app.launch", status: "passed" }] });
 
 /**
- * A sealed source (or installed) QA receipt written where the gate reads it, as `right-release qa` would write it
+ * A sealed installed QA receipt written where the gate reads it, as `right-release qa` would write it
  * with qa.journeys configured. Timestamps are relative to now so the execution window precedes admission.
  */
 export function writeHardenedReceipt(root, {
-  stage = "source", platform = "mac", releaseId, receiptPlatform = platform, receiptReleaseId = releaseId, statuses = {}, runnerSha = RUNNER_SHA,
-  spawn = accepting, execution, tweakBlock, nowMs = Date.now(), artifacts = [], sourceReceiptDigest = null,
+  stage = "installed", platform = "mac", releaseId, receiptPlatform = platform, receiptReleaseId = releaseId, statuses = {}, runnerSha = RUNNER_SHA,
+  spawn = accepting, execution, tweakBlock, nowMs = Date.now(), artifacts = ARTIFACTS,
 } = {}) {
   const at = (offsetSec) => new Date(nowMs + offsetSec * 1000).toISOString();
   const dir = mkdtempSync(path.join(tmpdir(), "rk-qa-jr-"));
@@ -111,7 +115,7 @@ export function writeHardenedReceipt(root, {
   const receipt = sealQaReceipt(buildQaReceipt({
     stage, app: "demo", platform: receiptPlatform, releaseId: receiptReleaseId, source, closure: dependencyClosure(root, source.commit), releaseConfigSha256: SHA("d"),
     qa, floor, floorDigest: digest, policyBundleDigest: BUNDLE, runner: { basename: "rightkit-qa", path: "/x/rightkit-qa", sha256: runnerSha },
-    evidence: evidence(), evidenceSha256: SHA("f"), required, artifacts, sourceReceiptDigest, journeys: block, now: new Date(nowMs - 5000),
+    evidence: evidence(), evidenceSha256: SHA("f"), required, artifacts, journeys: block, now: new Date(nowMs - 5000),
     execution: execution === false ? null : (execution ?? { startedAt: at(-120), finishedAt: at(-10), runnerPids: [4242], sealerPid: 4343 }),
   }), KEY);
   writeQaReceipt(qaReceiptPath({ repoRoot: root, releaseId, platform, stage }), receipt);

package/release-qa-floor.json

@@ -3,7 +3,6 @@
   "version": 2,
   "runner": "rightkit-qa",
   "stages": {
-    "source": { "required": ["smoke.launch", "journey"] },
     "installed": { "required": ["smoke.launch", "journey"] }
   },
   "journeys": {

package/release-qa-policy.mjs

@@ -3,17 +3,16 @@
 //
 //   { "schema": 1,
 //     "apps": { "<app>": { "mode": "warn" | "refuse", "since": "YYYY-MM-DD", "set_by": "<name>",
-//                          "stages": { "source":    { "mode": .., "since": .., "set_by": .. },
-//                                      "installed": { "mode": .., "since": .., "set_by": .. } } } },
+//                          "stages": { "installed": { "mode": .., "since": .., "set_by": .. } } } },
 //     "approvedRunners": [ { "sha256": "<64 hex>", "version": "<rightkit-qa version>", "platform": "mac" | "win",
 //                            "set_by": "<name>", "since": "YYYY-MM-DD", "note": "..." } ] }
 //
 // An app with no entry is in `warn` mode (default). In `refuse` mode `admit()` throws instead of warning.
 //
-// Stages: the build (`source`) and publication (`installed`) admissions each have their own mode. An app entry is the
-// app-level { mode, since, set_by } (governs both stages), a `stages` object, or both; a stage entry overrides the
-// app-level mode for that stage. An app entry needs a mode or a non-empty `stages`. Only `source` and `installed` are
-// stage keys.
+// Stages: the publication (`installed`) admission is the only one (GATE-CONTRACT GC-A07 removed source QA). An app entry is the
+// app-level { mode, since, set_by }, a `stages` object, or both; a stage entry overrides the
+// app-level mode for that stage. An app entry needs a mode or a non-empty `stages`. Only `installed` is a
+// stage key.
 //
 // Approved runners: `sha256` is required (lowercase hex). `platform` ("mac" | "win") binds the approval to the
 // platform the receipt is sealed or published for; an entry without it approves the digest on every platform (legacy
@@ -50,8 +49,8 @@ const DATE = /^\d{4}-\d{2}-\d{2}$/;
 export const QA_ADMISSION_POLICY_FILE = "qa-admission-policy.json";
 export const QA_POLICY_BASELINE_REF_ENV = "RIGHT_RELEASE_QA_POLICY_BASELINE_REF";
 export const ADMISSION_MODES = Object.freeze(["warn", "refuse"]);
-/** The admissions an app's mode can be set for: the build (source) and the publication (installed). */
-export const ADMISSION_STAGES = Object.freeze(["source", "installed"]);
+/** The admissions an app's mode can be set for: the publication (installed); there is no source stage (GATE-CONTRACT GC-A07). */
+export const ADMISSION_STAGES = Object.freeze(["installed"]);
 /** The platforms an approved runner can be bound to. */
 export const RUNNER_PLATFORMS = Object.freeze(["mac", "win"]);
 /** The only `set_by` that may move an app back from refuse, or approve a runner. */
@@ -205,7 +204,7 @@ export function loadAdmissionPolicy({ dir = here, baseline, baselineRef, env = p
 }
 
 /**
- * The mode for an app at `stage` ("source" | "installed"): the stage entry, else the app-level entry, else `warn`.
+ * The mode for an app at `stage` ("installed"): the stage entry, else the app-level entry, else `warn`.
  * Without a stage it is the app-level result.
  */
 export function admissionModeFor(policy, app, stage) {
@@ -326,7 +325,7 @@ export function main(args, {
       stdout(`qa runner approved: ${entry.sha256} rightkit-qa ${entry.version} (${entry.platform ?? "any platform"}, since ${entry.since}, set_by ${entry.set_by})`);
       return 0;
     }
-    stderr(`usage: ${program} show\n       ${program} set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]\n       ${program} approve-runner --runner <file> --version <v> --platform mac|win --set-by <name> [--note <text>]`);
+    stderr(`usage: ${program} show\n       ${program} set --app <app> --mode warn|refuse --set-by <name> [--stage installed]\n       ${program} approve-runner --runner <file> --version <v> --platform mac|win --set-by <name> [--note <text>]`);
     return 2;
   } catch (error) {
     stderr(`release-qa-policy: ${error.message}`);

package/release-qa-receipt.mjs

@@ -1,9 +1,8 @@
 // Release QA receipts (hardening step 4): no signed release on any channel without a passing, artifact-bound
 // QA receipt for the exact commit.
 //
-//   source stage    admits the candidate build/sign: QA ran against the committed source.
-//   installed stage admits upload/publication: QA ran on the built, sealed artifacts (exact sha256) and chains
-//                   to the source receipt digest recorded in the sealed manifest.
+//   installed stage admits upload/publication: QA ran on the built, sealed artifacts (exact sha256).
+//   There is no source stage (GATE-CONTRACT GC-A07): QA journeys run after the build against the installed dev copy.
 //
 // A receipt is written only by `right-release qa`, which runs RightKit's own runner (`rightkit-qa`), digests the
 // runner binary and the evidence bundle it produced, evaluates the protected QA floor, and MACs the result with a
@@ -25,7 +24,7 @@ import { SCANNER_VERSION } from "./ownership.mjs";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const HEX64 = /^[a-f0-9]{64}$/;
 export const QA_RECEIPT_SCHEMA = 1;
-export const QA_STAGES = Object.freeze(["source", "installed"]);
+export const QA_STAGES = Object.freeze(["installed"]);
 export const QA_KEY_ENV = "RIGHTKIT_QA_RECEIPT_KEY";
 const MAC_DOMAIN = "rightkit-qa-receipt-v1\0";
 
@@ -51,22 +50,6 @@ export function qaReceiptPath({ repoRoot, releaseId, platform, stage }) {
   return path.join(repoRoot, ".right-release", "qa", releaseId, platformDirOf(platform), `${stage}.receipt.json`);
 }
 
-export const QA_CARRIED_RECEIPT_ENV = "RIGHT_RELEASE_QA_RECEIPT";
-
-/**
- * Receipt carried from the job that ran source QA to the signing job (Orthic-Labs/rightkit#183).
- * `RIGHT_RELEASE_QA_RECEIPT` names the receipt file, or a directory holding `source.receipt.json`.
- * Returns the file path when it exists, else null. The carried file is verified exactly like a local one
- * (MAC, commit, tree, lockfile closure, config, floor, bundle), so carrying adds no trust.
- */
-export function carriedSourceReceiptPath(env = process.env) {
-  const value = String(env?.[QA_CARRIED_RECEIPT_ENV] ?? "").trim();
-  if (!value) return null;
-  const resolved = path.resolve(value);
-  const file = existsSync(resolved) && statSync(resolved).isDirectory() ? path.join(resolved, "source.receipt.json") : resolved;
-  return existsSync(file) ? file : null;
-}
-
 export function loadQaFloor(dir = here) {
   const file = path.join(dir, QA_FLOOR_FILE);
   let floor;
@@ -196,7 +179,7 @@ export function receiptDigest(receipt) {
 
 export function buildQaReceipt({
   stage, app, platform, releaseId, source, closure, releaseConfigSha256, qa, floor, floorDigest, policyBundleDigest,
-  runner, evidence, evidenceSha256, required, artifacts = [], sourceReceiptDigest = null, now = new Date(), journeys = null, execution = null,
+  runner, evidence, evidenceSha256, required, artifacts = [], now = new Date(), journeys = null, execution = null,
 }) {
   const evidenceOk = evidence?.status === "passed" && Boolean(evidence?.finishedAt);
   const status = evidenceOk && required.every((item) => item.status === "passed") ? "passed" : "failed";
@@ -211,7 +194,7 @@ export function buildQaReceipt({
     runner,
     evidence: { sha256: evidenceSha256, runId: evidence?.runId ?? null, status: evidence?.status ?? null, schemaVersion: evidence?.schemaVersion ?? null },
     required, checks: (evidence?.checks ?? []).map((check) => ({ name: String(check.name), status: String(check.status) })),
-    artifacts, sourceReceiptDigest, status, createdAt: now.toISOString(),
+    artifacts, status, createdAt: now.toISOString(),
     ...(journeys ? { journeys } : {}),
     ...(execution ? { execution } : {}),
   };
@@ -221,7 +204,7 @@ export function buildQaReceipt({
  * Verify a receipt against the exact current state. Returns { ok, reason, receipt }.
  * `expected.artifacts` ([{name, sha256}]) must equal the receipt's artifacts exactly (installed stage).
  */
-export function verifyQaReceipt(receipt, { key, stage, repoRoot, releaseConfigSha256, floorDir = here, artifacts, sourceReceiptDigest, gitRunner, policyBundleDigest, source, closure }) {
+export function verifyQaReceipt(receipt, { key, stage, repoRoot, releaseConfigSha256, floorDir = here, artifacts, gitRunner, policyBundleDigest, source, closure }) {
   const refuse = (reason) => ({ ok: false, reason });
   if (!receipt || receipt.schema !== QA_RECEIPT_SCHEMA) return refuse("receipt is missing or has an unsupported schema");
   if (receipt.stage !== stage) return refuse(`receipt is for stage ${receipt.stage}, not ${stage}`);
@@ -257,7 +240,6 @@ export function verifyQaReceipt(receipt, { key, stage, repoRoot, releaseConfigSh
     const wanted = [...(artifacts ?? [])].map((item) => `${item.name}:${item.sha256}`).sort();
     const have = (receipt.artifacts ?? []).map((item) => `${item.name}:${item.sha256}`).sort();
     if (!wanted.length || JSON.stringify(wanted) !== JSON.stringify(have)) return refuse("receipt artifact hashes do not match the sealed artifacts");
-    if (!sourceReceiptDigest || receipt.sourceReceiptDigest !== sourceReceiptDigest) return refuse("installed QA is not chained to the source QA receipt sealed into this release");
   }
   return { ok: true, receipt };
 }
@@ -276,25 +258,6 @@ function loadKeyOrRefuse(opts, command) {
   catch (error) { throw new QaAdmissionError(`QA receipt key is unavailable (${error.message})`, { command }); }
 }
 
-/**
- * Build gate: source QA must have passed for this exact commit before a candidate is built/signed.
- * Returns the receipt digest to record in the sealed manifest.
- */
-export function assertSourceQaAdmission({ repoRoot, releaseId, platform, configName, releaseConfigSha256, ...opts }) {
-  const command = qaCommandFor({ stage: "source", platform, releaseId, configName });
-  // A receipt carried from the QA job (RIGHT_RELEASE_QA_RECEIPT) wins over the local path; the signing job has no local one.
-  const carried = carriedSourceReceiptPath(opts.env ?? process.env);
-  const receipt = readQaReceipt(carried ?? qaReceiptPath({ repoRoot, releaseId, platform, stage: "source" }));
-  if (!receipt) throw new QaAdmissionError(`no source QA receipt for ${releaseId} (${platform}); a candidate cannot be built or signed without passing source QA`, { command });
-  const verdict = verifyQaReceipt(receipt, { key: loadKeyOrRefuse(opts, command), stage: "source", repoRoot, releaseConfigSha256, floorDir: opts.floorDir, gitRunner: opts.gitRunner, policyBundleDigest: opts.policyBundleDigest, source: opts.source, closure: opts.closure });
-  if (!verdict.ok) throw new QaAdmissionError(`source QA receipt rejected: ${verdict.reason}`, { command });
-  if (carried && (receipt.releaseId !== releaseId || receipt.platform !== platform)) {
-    throw new QaAdmissionError(`source QA receipt rejected: carried receipt is for ${receipt.releaseId} (${receipt.platform}), not ${releaseId} (${platform})`, { command });
-  }
-  opts.afterVerify?.(receipt); // hardening hook (release-qa-hardening.mjs); throws QaAdmissionError
-  return { digest: receipt.digest, floorDigest: receipt.floor.digest };
-}
-
 /**
  * Upload/publication gate for every provider (R2 + RightApps, GitHub Releases, updater channels): an installed-QA
  * receipt for the exact sealed artifact hashes and commit must exist and pass. Dev builds never reach this gate —
@@ -308,7 +271,6 @@ export function assertInstalledQaAdmission({ repoRoot, manifest, platform, confi
   const verdict = verifyQaReceipt(receipt, {
     key: loadKeyOrRefuse(opts, command), stage: "installed", repoRoot, releaseConfigSha256, floorDir: opts.floorDir,
     artifacts: (manifest.files ?? []).map((file) => ({ name: file.name, sha256: file.sha256 })),
-    sourceReceiptDigest: manifest.qa?.sourceReceiptDigest,
     gitRunner: opts.gitRunner, policyBundleDigest: opts.policyBundleDigest, source: opts.source, closure: opts.closure,
   });
   if (!verdict.ok) throw new QaAdmissionError(`installed QA receipt rejected: ${verdict.reason}`, { command });

package/release-source-identity.mjs

@@ -23,7 +23,6 @@ import { spawnSync } from "./background-process.mjs";
 import { resolveSelectedCommit } from "./committed-source.mjs";
 import { canonicalRepositoryIdentity } from "./ownership-approval.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
-import { dependencyClosure } from "./release-qa-receipt.mjs";
 import { brandReleaseSource, isReleaseSource } from "./release-source-brand.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { SOURCE_SPLIT_CODE, SourceSplitError, inSnapshot, readSourceSplit } from "./source-split.mjs";
@@ -150,7 +149,7 @@ export function assertBindsSource(source, record, label = "the record") {
 }
 
 /**
- * The `{ commit, tree, repositoryIdentity }` a source QA receipt binds, for a snapshot source: the selected commit and tree, and the
+ * The `{ commit, tree, repositoryIdentity }` a QA receipt binds, for a snapshot source: the selected commit and tree, and the
  * repository identity from the checkout's origin. Reads no HEAD. (The checkout route keeps release-qa-receipt.mjs `sourceIdentity`.)
  */
 export function snapshotSourceIdentity(source, git = spawnSync) {
@@ -159,14 +158,4 @@ export function snapshotSourceIdentity(source, git = spawnSync) {
   return { commit: source.commit, tree: source.tree, repositoryIdentity: canonicalRepositoryIdentity(origin) };
 }
 
-/**
- * The `{ source, closure }` options `admitSourceQa` / `assertSourceQaAdmission` / `assertInstalledQaAdmission` take so that the receipt they
- * verify is compared with the SELECTED commit (its tree, its repository identity, its lockfile closure read from its objects) instead of the
- * checkout's HEAD. `{}` for the checkout route: those functions then read HEAD exactly as before. Spread it into their options.
- */
-export function qaAdmissionSourceOptions(source, git = spawnSync) {
-  if (!isSnapshotSource(source)) return {};
-  return { source: snapshotSourceIdentity(source, git), closure: dependencyClosure(source.checkout, source.commit, git) };
-}
-
 export { SOURCE_SPLIT_CODE };

package/release-switch-registry.json

@@ -13,12 +13,15 @@
     "demo",
     "dev-overrides",
     "qa-probes",
+    "qa-env",
     "dev-worker-override",
     "qa-shot",
     "qa-tools",
     "dev-control",
     "bench-native",
-    "rightkit-qa/control"
+    "rightkit-qa/control",
+    "test-overrides",
+    "qa-views"
   ],
   "testModeMarker": "RIGHTKIT-TEST-MODE-COMPILED",
   "denyNames": [