@rightkit/release 0.6.24 → 0.6.26

package/test-command.mjs

@@ -13,9 +13,6 @@
 //       // Expands to journeys-1, journeys-2, ...: the listed journeys run `chunk` at a time in separate processes.
 //       { name: "journeys", node: "scripts/qa-browser-functional.mjs", args: ["--keep-going"],
 //         journeys: { file: "scripts/qa-e2e-journeys.json", key: "journeys", chunk: 12, flag: "--journey" } },
-//       // A sign step (suite-signing.mjs, rightkit#1303): signs what an EARLIER suite built, in-process, with the product's one identity, then
-//       // sets RIGHTKIT_QA_APP_BINARY to the signed copy of the main binary for the suites after it. It is never carried and has no cmd or node.
-//       { name: "sign-app", sign: { files: [{ from: "build-app", path: "aarch64-apple-darwin/debug/heardright" }] } },
 //     ],
 //   }
 //
@@ -29,14 +26,10 @@ import { buildLaunch } from "./build-launch.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawn } from "./background-process.mjs";
-import { carriedCargoMapOf, carriedLedgerIds, carriedOutputDirsSince } from "./carried-cargo.mjs";
-import { GATE_TARGET_DIRS_ENV } from "./qa-layout.mjs";
 import { CommandSpecError, loadAppConfig, resolveInvocation, validateStep } from "./command-spec.mjs";
 import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { fsListRustFiles } from "./signing-files.mjs";
-import { journeysCapabilityRefusal, journeysRunRefusal, qaPrebuiltCapability } from "./qa-journeys-prebuilt.mjs";
-import { SIGN_STEP_KEYS, QA_APP_BINARY_ENV, QA_SIGNING_EVIDENCE_ENV, QA_SIGNED_FILES_ENV, SuiteSigningError, assertPlanSigningPolicy, assertSuiteSigningPolicy, validateSignSpec } from "./suite-signing-policy.mjs";
-import { runSignStep } from "./suite-signing.mjs";
+import { SuiteSigningError, assertPlanSigningPolicy, assertSuiteSigningPolicy } from "./suite-signing-policy.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
@@ -122,18 +115,6 @@ export function planTests(config, { suites = [], runner, passthrough = [], appRo
   const declared = new Set();
   tests.suites.forEach((entry, index) => {
     const label = `tests.suites[${index}]`;
-    // A sign step is data, not a command: `{ name, sign: { files: [{ from, path }] } }`, judged by the policy and run in-process (runSuites).
-    if (isObject(entry) && entry.sign !== undefined) {
-      const extra = Object.keys(entry).filter((key) => !SIGN_STEP_KEYS.includes(key));
-      if (extra.length) throw new SuiteSigningError("SIGN_STEP_SHAPE", `${label} is a sign step and has unknown key(s): ${extra.join(", ")} (allowed: ${SIGN_STEP_KEYS.join(", ")}); it has no cmd, node, args or env`);
-      if (typeof entry.name !== "string" || !NAME.test(entry.name)) fail(`${label}.name must be set (letters, digits, . _ -)`);
-      if (seen.has(entry.name) || declared.has(entry.name)) fail(`${label}: duplicate suite name ${entry.name}`);
-      const sign = validateSignSpec(entry.sign, `${label}.sign`, declared);
-      seen.add(entry.name); declared.add(entry.name);
-      // A sign step needs the suites whose outputs it signs (GB-44): if one of them failed or was skipped, there is nothing to sign.
-      planned.push({ name: entry.name, group: entry.name, sign, step: null, extraArgs: [], requires: [...new Set(sign.files.map((file) => file.from))] });
-      return;
-    }
     validateStep(entry, label, ["name", "runner", "journeys", "requires"]);
     // `requires` (GB-44): the earlier suites (by name or group) whose success this suite's inputs depend on; it is skipped, with the reason recorded,
     // when one of them failed or was skipped, while every independent suite still runs.
@@ -161,26 +142,11 @@ export function planTests(config, { suites = [], runner, passthrough = [], appRo
   }
   if (passthrough.length) {
     if (selected.length !== 1) fail("arguments after -- need exactly one selected suite (or use --runner)");
-    if (selected[0].sign) fail("arguments after -- cannot go to a sign step");
     selected = [{ ...selected[0], extraArgs: [...passthrough] }];
   }
   return selected;
 }
 
-/** The refusal code of a planned `rightkit-qa journeys run` suite (GB-79). */
-/** RIGHTKIT_GATE_TARGET_DIRS: the absolute directories the gate pinned; none when unset or malformed. */
-function directOutputDirs(env) {
-  try { const dirs = JSON.parse(env[GATE_TARGET_DIRS_ENV] ?? "[]"); return Array.isArray(dirs) ? dirs.filter((d) => typeof d === "string" && path.isAbsolute(d)) : []; } catch { return []; }
-}
-
-export const QA_JOURNEYS_UNSUPPORTED = "RK_QA_JOURNEYS_PREBUILT_UNSUPPORTED";
-/** True when a suite step is `rightkit-qa journeys run ...` (by command or by node script name, extra args included). */
-export function qaJourneysRunStep(step, extraArgs = []) {
-  const words = [step.cmd ?? step.node, ...(step.args ?? []), ...extraArgs].filter((w) => typeof w === "string").map((w) => w.replaceAll("\\", "/"));
-  const at = words.findIndex((w) => /(^|\/)rightkit-qa(\.exe)?$/.test(w));
-  return at >= 0 && words[at + 1] === "journeys" && words[at + 2] === "run";
-}
-
 export function eventPrefix(config) {
   const prefix = config?.tests?.eventPrefix ?? "test";
   if (typeof prefix !== "string" || !PREFIX.test(prefix)) fail("tests.eventPrefix must be lower-case letters, digits and underscores");
@@ -191,12 +157,8 @@ export function eventPrefix(config) {
  * Run the planned suites in order, collecting every reachable failure (GB-44): a failed suite does not stop an independent one, a suite that requires a
  * failed or skipped one is skipped with its reason, and the run ends non-zero. `spawnFn` and `log` are injectable.
  * Resolves `{ exitCode, results: [{ suite, exitCode, durationMs, skipped?, reason?, error? }] }`; a signal (cancellation) rejects.
- * A `sign` step (suite-signing.mjs) runs IN THIS PROCESS, never through `door` (it is no command and never a broker job); it signs what an earlier
- * suite built, named by that suite's verified carried receipts, and only a success sets RIGHTKIT_QA_APP_BINARY for the suites after it.
- * On a direct host (no carrier) a suite's outputs are the Cargo output directories the gate pinned for the stage (RIGHTKIT_GATE_TARGET_DIRS).
- * `within({ outputs, env })`, when given, runs once every suite passed and before the signed copies are removed; its result is returned as `within`.
  */
-export async function runSuites(plan, { appRoot, prefix = "test", env = process.env, spawnFn = spawn, log = console.log, errLog = console.error, door = buildLaunch, config = null, platform = process.platform, signDeps = {}, signStep = runSignStep, within = null, snapshotStage = Boolean(carriedCargoMapOf(env)?.map), qaCapability = (qa) => qaPrebuiltCapability(qa, { env }) } = {}) {
+export async function runSuites(plan, { appRoot, prefix = "test", env = process.env, spawnFn = spawn, log = console.log, errLog = console.error, door = buildLaunch, config = null, platform = process.platform } = {}) {
   const results = [];
   // One signing policy, enforced here whatever the config's format (the route probe reads JSON configs only; a legacy .mjs config is judged now): an
   // unsigned or ad hoc product build, or an identifier override, is refused before any suite runs (rightkit#1303). Mac and Dell only.
@@ -211,111 +173,49 @@ export async function runSuites(plan, { appRoot, prefix = "test", env = process.
     errLog(`right-release test: [${error.code}] ${error.message}`);
     return { exitCode: 1, results };
   }
-  // GB-79 (GATE test stage/E1/E6/E11): `rightkit-qa journeys run` spawns its own broker build, which a gate-carried snapshot stage cannot allow. When the installed rightkit-qa
-  // advertises `journeys-prebuilt-input` the door carries the build itself, signs the products and hands QA the verified listing and attestation (qa-journeys-prebuilt.mjs).
-  // Without the capability it is a PLANNING failure naming it, before any suite runs; nothing is silently skipped and an empty journey set is never green. A step that names
-  // its own listing, attestation or plan flag is refused too (an input the gate did not verify). Only a gate-carried snapshot stage (a carrier map in the environment) has the
-  // one-build rule; a direct host starts it as it always did.
-  const journeys = snapshotStage ? plan.filter((item) => !item.sign && item.step && qaJourneysRunStep(item.step, item.extraArgs)) : [];
-  const unsupported = [];
-  for (const item of journeys) {
-    const argv = [item.step.cmd ?? item.step.node, ...(item.step.args ?? []), ...(item.extraArgs ?? [])].filter((w) => typeof w === "string");
-    const at = argv.findIndex((w) => /(^|[\\/])rightkit-qa(\.exe)?$/.test(w));
-    const own = journeysRunRefusal(argv.slice(at + 1));
-    if (own) { errLog(`right-release test: [${QA_JOURNEYS_UNSUPPORTED}] ${item.name}: ${own}. Nothing ran`); unsupported.push(item); continue; }
-    if (!qaCapability(argv[at], item.step)) { errLog(`right-release test: [${QA_JOURNEYS_UNSUPPORTED}] ${journeysCapabilityRefusal(item.name)}`); unsupported.push(item); }
-  }
-  if (unsupported.length) return { exitCode: 1, results };
-  // The environment later suites get: the caller's, plus RIGHTKIT_QA_APP_BINARY and RIGHTKIT_QA_SIGNING_EVIDENCE once a sign step succeeded.
-  let suiteEnv = env;
-  // The verified carried receipts' output directories of each suite that passed, by name and by group (a sign step reads them).
-  const outputs = new Map();
-  const signedDirs = [];
   // GB-44 (BR29): every reachable failure is collected. A failed or errored suite does not stop its independent siblings; only a suite that
-  // REQUIRES a failed or skipped one (a sign step needs the suites it signs; a suite after a sign step needs every earlier sign step unless it declares its own `requires`; an explicit
-  // `requires`) is skipped, with the reason recorded. Cancellation (a signal) still stops the whole run, and nothing is signed or launched from a failed build.
+  // REQUIRES a failed or skipped one (its explicit `requires`) is skipped, with the reason recorded. Cancellation (a signal) still stops the whole run.
   const status = new Map(); // suite name and group -> "passed" | "failed" | "skipped"
-  const signsSoFar = [];
-  // What a suite waits for. A sign step waits for the suites it signs. Any other suite positioned after a sign step is by default a CONSUMER of its
-  // signed output (a QA runner, a launcher: nothing in its command line shows what its script reads), so it waits for every earlier sign step too;
-  // a suite that declares `requires` (even an empty list) states its own dependencies instead and so keeps running for its diagnostics.
-  // Fail closed: nothing that may consume signed bytes runs after a sign step that failed or was skipped.
-  const waitsFor = (item) => (item.sign || Array.isArray(item.requires) ? (item.requires ?? []) : signsSoFar);
+  const waitsFor = (item) => item.requires ?? [];
   const record = (item, outcome) => { for (const key of new Set([item.name, item.group])) status.set(key, outcome); };
   const firstFailure = () => results.find((r) => r.exitCode !== 0 && r.skipped !== true)?.exitCode ?? (results.some((r) => r.skipped) ? 1 : 0);
-  try {
-    for (const item of plan) {
-      const unmet = waitsFor(item).filter((name) => status.has(name) && status.get(name) !== "passed");
-      if (unmet.length) {
-        const reason = `${[...new Set(unmet)].map((n) => JSON.stringify(n)).join(", ")} did not pass, and ${item.name} ${item.sign ? "signs what it builds" : "needs what it produces"}`;
-        errLog(`right-release test: ${item.name}: skipped: ${reason}`);
-        log(JSON.stringify({ event: `${prefix}_suite_skipped`, suite: item.name, reason }));
-        results.push({ suite: item.name, exitCode: null, skipped: true, reason, durationMs: 0 });
-        record(item, "skipped");
-        if (item.sign) signsSoFar.push(item.name);
-        continue;
-      }
-      log(JSON.stringify({ event: `${prefix}_suite_started`, suite: item.name }));
-      const started = Date.now();
-      if (item.sign) {
-        let exitCode = 0;
-        try {
-          const signed = signStep({ name: item.name, sign: item.sign, appRoot, config, env: suiteEnv, platform, outputDirsOf: (suite) => outputs.get(suite) ?? null, deps: signDeps, log: errLog });
-          signedDirs.push(signed.signedDir);
-          // The variable is set only now, after every file was signed and read back.
-          if (signed.appBinary) suiteEnv = { ...suiteEnv, [QA_APP_BINARY_ENV]: signed.appBinary };
-          // The evidence file lives in the signed directory, kept until this run ends: a consumer checks what it was handed against it.
-          suiteEnv = { ...suiteEnv, [QA_SIGNING_EVIDENCE_ENV]: signed.evidenceFile, [QA_SIGNED_FILES_ENV]: JSON.stringify(signed.signedFiles ?? {}) };
-          log(JSON.stringify({ event: `${prefix}_suite_signed`, suite: item.name, appBinary: signed.appBinary, signing: signed.evidence }));
-        } catch (error) {
-          if (!(error instanceof SuiteSigningError)) throw error;
-          errLog(`right-release test: ${item.name}: [${error.code}] ${error.message}`);
-          exitCode = 1;
-        }
-        const durationMs = Date.now() - started;
-        log(JSON.stringify({ event: `${prefix}_suite_completed`, suite: item.name, exitCode, durationMs }));
-        results.push({ suite: item.name, exitCode, durationMs });
-        record(item, exitCode === 0 ? "passed" : "failed");
-        signsSoFar.push(item.name);
-        continue;
-      }
-      const invocation = resolveInvocation(item.step, { appRoot, baseEnv: suiteEnv, extraArgs: item.extraArgs });
-      const before = carriedLedgerIds(env);
-      let exitCode; let failure = null;
-      try {
-        exitCode = await new Promise((resolve, reject) => {
-          // A test suite goes through the one door (build-launch.mjs): a broker job on a managed host, which builds it under the app's claim.
-          const target = door(invocation.cmd, invocation.args, { env: invocation.env, stepEnv: item.step.env, cwd: invocation.cwd, exists: existsSync });
-          const child = spawnFn(target.command, target.args, { cwd: invocation.cwd, env: target.env ? { ...invocation.env, ...target.env } : invocation.env, stdio: "inherit" });
-          child.once("error", (error) => reject(Object.assign(error, { spawnFailure: true })));
-          child.once("exit", (code, signal) => {
-            if (signal) reject(Object.assign(new Error(`${item.name} stopped by ${signal}`), { cancelled: true }));
-            else resolve(code ?? 1);
-          });
+  for (const item of plan) {
+    const unmet = waitsFor(item).filter((name) => status.has(name) && status.get(name) !== "passed");
+    if (unmet.length) {
+      const reason = `${[...new Set(unmet)].map((n) => JSON.stringify(n)).join(", ")} did not pass, and ${item.name} needs what it produces`;
+      errLog(`right-release test: ${item.name}: skipped: ${reason}`);
+      log(JSON.stringify({ event: `${prefix}_suite_skipped`, suite: item.name, reason }));
+      results.push({ suite: item.name, exitCode: null, skipped: true, reason, durationMs: 0 });
+      record(item, "skipped");
+      continue;
+    }
+    log(JSON.stringify({ event: `${prefix}_suite_started`, suite: item.name }));
+    const started = Date.now();
+    const invocation = resolveInvocation(item.step, { appRoot, baseEnv: env, extraArgs: item.extraArgs });
+    let exitCode; let failure = null;
+    try {
+      exitCode = await new Promise((resolve, reject) => {
+        // A test suite goes through the one door (build-launch.mjs): a broker job on a managed host, which builds it under the app's claim.
+        const target = door(invocation.cmd, invocation.args, { env: invocation.env, stepEnv: item.step.env, cwd: invocation.cwd, exists: existsSync });
+        const child = spawnFn(target.command, target.args, { cwd: invocation.cwd, env: target.env ? { ...invocation.env, ...target.env } : invocation.env, stdio: "inherit" });
+        child.once("error", (error) => reject(Object.assign(error, { spawnFailure: true })));
+        child.once("exit", (code, signal) => {
+          if (signal) reject(Object.assign(new Error(`${item.name} stopped by ${signal}`), { cancelled: true }));
+          else resolve(code ?? 1);
         });
-      } catch (error) {
-        // A suite that cannot start (a refused launch, a spawn error) is a failed suite; a signal is a cancellation and ends the run.
-        if (error?.cancelled) throw error;
-        failure = error; exitCode = 1;
-        errLog(`right-release test: ${item.name}: ${error?.code ? `[${error.code}] ` : ""}${error?.message ?? error}`);
-      }
-      const durationMs = Date.now() - started;
-      // Only a suite that passed hands its receipts to a sign step.
-      if (exitCode === 0) {
-        const dirs = carriedCargoMapOf(env)?.map ? carriedOutputDirsSince(env, before) : directOutputDirs(env);
-        for (const key of new Set([item.name, item.group])) outputs.set(key, [...new Set([...(outputs.get(key) ?? []), ...dirs])]);
-      }
-      log(JSON.stringify({ event: `${prefix}_suite_completed`, suite: item.name, exitCode, durationMs }));
-      results.push({ suite: item.name, exitCode, durationMs, ...(failure ? { error: String(failure.message ?? failure) } : {}) });
-      record(item, exitCode === 0 ? "passed" : "failed");
+      });
+    } catch (error) {
+      // A suite that cannot start (a refused launch, a spawn error) is a failed suite; a signal is a cancellation and ends the run.
+      if (error?.cancelled) throw error;
+      failure = error; exitCode = 1;
+      errLog(`right-release test: ${item.name}: ${error?.code ? `[${error.code}] ` : ""}${error?.message ?? error}`);
     }
-    const exitCode = results.some((r) => r.skipped !== true && r.exitCode !== 0) || results.some((r) => r.skipped) ? firstFailure() : 0;
-    if (exitCode !== 0 || !within) return { exitCode, results };
-    return { exitCode, results, within: await within({ outputs, env: suiteEnv }) };
-  } finally {
-    // The signed copies live only as long as the run that signed them.
-    for (const dir of signedDirs) { try { rmSync(dir, { recursive: true, force: true }); } catch { /* the managed root is pruned */ } }
+    const durationMs = Date.now() - started;
+    log(JSON.stringify({ event: `${prefix}_suite_completed`, suite: item.name, exitCode, durationMs }));
+    results.push({ suite: item.name, exitCode, durationMs, ...(failure ? { error: String(failure.message ?? failure) } : {}) });
+    record(item, exitCode === 0 ? "passed" : "failed");
   }
+  return { exitCode: results.some((r) => r.skipped !== true && r.exitCode !== 0) || results.some((r) => r.skipped) ? firstFailure() : 0, results };
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -332,9 +232,9 @@ export async function main(argv = process.argv.slice(2)) {
   }
   const plan = planTests(config, { suites: opts.suites, runner: opts.runner, passthrough: opts.passthrough, appRoot });
   if (opts.list) {
-    const view = plan.map((item) => (item.sign ? { suite: item.name, sign: item.sign } : { suite: item.name, ...resolveInvocation(item.step, { appRoot, baseEnv: {}, extraArgs: item.extraArgs }), env: undefined }));
+    const view = plan.map((item) => ({ suite: item.name, ...resolveInvocation(item.step, { appRoot, baseEnv: {}, extraArgs: item.extraArgs }), env: undefined }));
     if (opts.json) console.log(JSON.stringify(view, null, 2));
-    else for (const item of view) console.log(item.sign ? `${item.suite}: sign ${item.sign.files.map((file) => `${file.from}:${file.path}`).join(", ")}` : `${item.suite}: ${[item.cmd, ...item.args].join(" ")}`);
+    else for (const item of view) console.log(`${item.suite}: ${[item.cmd, ...item.args].join(" ")}`);
     return 0;
   }
   const { exitCode } = await runSuites(plan, { appRoot, prefix: eventPrefix(config), config });

package/updater-shipped-key.mjs

@@ -0,0 +1,26 @@
+// rightkit#1443 (hrmac, 2026-11-02): the pre-gate R2 build verified the updater signature against the public key the app SHIPS (its
+// tauri.conf plugins.updater.pubkey, the key every installed copy checks an update with); the gate only checked a requested key id.
+// After the updater is signed, its `.sig` must verify (minisign, github-updater-release.mjs assertUpdaterSignature) over the archive's
+// bytes with the shipped key, or the build stops: an update signed by any other key would be refused by every installed app.
+import fs from "node:fs";
+import path from "node:path";
+import { assertUpdaterSignature } from "./github-updater-release.mjs";
+
+/** The app's shipped updater public key: plugins.updater.pubkey of the first tauri.conf.json found (src-tauri/, then the app root). */
+export function shippedUpdaterPublicKey(appRoot, { readFile = (f) => fs.readFileSync(f, "utf8"), exists = fs.existsSync } = {}) {
+  for (const rel of [["src-tauri", "tauri.conf.json"], ["tauri.conf.json"]]) {
+    const file = path.join(appRoot, ...rel);
+    if (!exists(file)) continue;
+    const key = JSON.parse(readFile(file))?.plugins?.updater?.pubkey;
+    if (typeof key === "string" && key.trim()) return { key: key.trim(), file };
+    return { key: null, file };
+  }
+  return { key: null, file: null };
+}
+
+/** Throws unless `<file>.sig` verifies over `file`'s bytes with the app's shipped updater key. */
+export function assertUpdaterMatchesShippedKey({ appRoot, file, readFile = (f) => fs.readFileSync(f), readText = (f) => fs.readFileSync(f, "utf8"), exists = fs.existsSync }) {
+  const shipped = shippedUpdaterPublicKey(appRoot, { readFile: readText, exists });
+  if (!shipped.key) throw new Error(`the app ships no updater public key (plugins.updater.pubkey in ${shipped.file ?? "src-tauri/tauri.conf.json"}), so an updater artifact cannot be verified; nothing is shipped`);
+  assertUpdaterSignature(readFile(file), readText(`${file}.sig`), shipped.key, `updater ${path.basename(file)} against the shipped key in ${shipped.file}`);
+}

package/web-build.mjs

@@ -18,8 +18,7 @@
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-import { existsSync } from "node:fs";
-import { buildLaunch } from "./build-launch.mjs";
+import { existsSync, readFileSync } from "node:fs";
 import { CommandSpecError, loadAppConfig, resolveInvocation, validateStep } from "./command-spec.mjs";
 import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { requireDoorRun } from "./gate-stages.mjs";
@@ -61,20 +60,46 @@ export function webBuildDoorRefusal({ appRoot, env = process.env, spawnSyncFn =
   return requireDoor({ env, commonDir: context.commonDir, commit: context.commit, command: "right-release web-build" });
 }
 
+/**
+ * Adrian, 2026-11-02 ("Yes send them", relayed by the broker owner and checked): tsc runs once, in Class A only, and vite (any web bundling)
+ * runs outside the broker. A `tsc` step that emits nothing (`--noEmit`, or `compilerOptions.noEmit` in the tsconfig it reads) only type-checks,
+ * which Class A already did for this commit, so it is skipped here. A tsc step that emits files still runs. An unreadable tsconfig keeps the step.
+ */
+export function typecheckOnlyTsc(invocation, { readFile = (f) => readFileSync(f, "utf8") } = {}) {
+  const script = String(invocation.args?.find((a) => /(^|[\\/])typescript[\\/]bin[\\/]tsc$/.test(String(a))) ?? "");
+  if (!script) return false;
+  const args = invocation.args.slice(invocation.args.indexOf(script) + 1).map(String);
+  if (args.includes("--noEmit")) return true;
+  if (args.some((a) => a === "--build" || a === "-b")) return false;
+  const p = args.indexOf("-p") >= 0 ? args.indexOf("-p") : args.indexOf("--project");
+  let file = p >= 0 ? args[p + 1] : "tsconfig.json";
+  if (!file) return false;
+  file = path.resolve(invocation.cwd ?? ".", file);
+  if (!/\.json$/i.test(file)) file = path.join(file, "tsconfig.json");
+  try {
+    const text = readFile(file).replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"])\/\/.*$/gm, "$1").replace(/,(\s*[}\]])/g, "$1");
+    return JSON.parse(text)?.compilerOptions?.noEmit === true;
+  } catch { return false; }
+}
+
+/** The direct launch of a web-build step: never through the broker (Adrian, 2026-11-02: vite and web bundling run outside the broker). */
+export const directWebLaunch = (cmd, args) => ({ command: cmd, args });
+
 function doorError(refusal) { const error = new Error(refusal); error.code = "RK_DOOR"; return error; }
 
 /**
  * Run the steps in order under a live door run; `spawnSyncFn`, `requireDoor` and `log` are injectable. Returns the exit code. The
  * door is checked here as well as in main: this is the only place a step is spawned.
  */
-export function runWebBuild(steps, { appRoot, env = process.env, dryRun = false, spawnSyncFn = spawnSync, requireDoor = requireDoorRun, log = console.log, door = buildLaunch } = {}) {
+export function runWebBuild(steps, { appRoot, env = process.env, dryRun = false, spawnSyncFn = spawnSync, requireDoor = requireDoorRun, log = console.log, door = directWebLaunch, readFile } = {}) {
   const refusal = webBuildDoorRefusal({ appRoot, env, spawnSyncFn, requireDoor });
   if (refusal) throw doorError(refusal);
   for (const step of steps) {
     const invocation = resolveInvocation(step, { appRoot, baseEnv: env });
+    if (typecheckOnlyTsc(invocation, readFile ? { readFile } : {})) { log(`skipped (type-check only; Class A ran tsc for this commit): ${[invocation.cmd, ...invocation.args].join(" ")}`); continue; }
     log(`${dryRun ? "[dry-run] " : ""}${[invocation.cmd, ...invocation.args].join(" ")}`);
     if (dryRun) continue;
-    // A web build is a build: through the one door (build-launch.mjs), a broker job on a managed host.
+    // The web build runs directly, never as a broker job: it is cheap and not cargo (Adrian, 2026-11-02).
     const target = door(invocation.cmd, invocation.args, { env: invocation.env, stepEnv: step.env, cwd: invocation.cwd, exists: existsSync });
     const result = spawnSyncFn(target.command, target.args, { cwd: invocation.cwd, env: target.env ? { ...invocation.env, ...target.env } : invocation.env, stdio: "inherit" });
     if (result.error) throw result.error;

package/qa-journeys-prebuilt-run.mjs

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-// `node qa-journeys-prebuilt-run.mjs <rightkit-qa> -- journeys run <args>`: one `rightkit-qa journeys run` step of a snapshot stage (GB-79, capability
-// `journeys-prebuilt-input`) as the gate's build-once route (qa-journeys-prebuilt.mjs): carry the build, sign the products, hand QA the verified input.
-// build-launch.mjs hands such a step to this entry instead of refusing it.
-import { carriedCargoMapOf } from "./carried-cargo.mjs";
-import { runJourneysPrebuilt } from "./qa-journeys-prebuilt.mjs";
-
-const stop = (message, status = 101) => { process.stderr.write(`rightkit-gate: ${message}\n`); process.exit(status); };
-const [qa, separator, ...args] = process.argv.slice(2);
-if (!qa || separator !== "--") stop("RK_QA_JOURNEYS_USAGE: usage: qa-journeys-prebuilt-run.mjs <rightkit-qa> -- journeys run <args>");
-const carried = carriedCargoMapOf(process.env);
-if (!carried?.map) stop(`RK_QA_JOURNEYS_CARRIER_MISSING: ${carried?.error ?? "no carried map in the environment"}; a snapshot stage's build is never run around its carrier`);
-try {
-  const { status } = runJourneysPrebuilt({ qa, args, map: carried.map });
-  process.exit(status);
-} catch (error) {
-  stop(String(error.message ?? error).startsWith("RK_") ? error.message : `${error.code ?? "RK_QA_JOURNEYS_FAILED"}: ${error.message}`, Number.isInteger(error.status) ? error.status : 101);
-}

package/qa-journeys-prebuilt.mjs

@@ -1,148 +0,0 @@
-// GB-79 (GATE test stage E1/E6/E11): `rightkit-qa journeys run` on a snapshot stage, as the gate's own build-once route (capability `journeys-prebuilt-input`).
-//
-// `journeys run` spawns its own `rustright cargo ... --no-run`, which a gate-carried stage cannot allow: a snapshot stage compiles once, in the carrier, and QA runs
-// an already-built, already-signed product outside the broker. So the gate takes the build out of QA's hands:
-//   1. ask QA what it would build, without building (`journeys run ... --print-build-plan`: the declared build command and each artifact role's marker policy);
-//   2. carry that build (`cargo test ... --no-run --message-format=json`) through the carrier: one signed, ledgered broker request, its receipt verified;
-//   3. have QA name the executable each role resolves to in the carried listing (`--print-build-plan --from-cargo-json <listing>`), and check each lies inside the
-//      receipt's verified output directory;
-//   4. sign every product (a role whose marker is required) with the product's one identity (suite-signing.mjs runSignStep), outside the broker, from the receipt's
-//      output directory; a product that cannot be signed refuses and nothing launches;
-//   5. write the attestation (`rightkit.journeys.prebuilt-input/1`: the broker request id and digest, the listing's sha256, the carried command, the sha256 of
-//      every executable QA will launch) and run QA directly with `--from-cargo-json <listing> --prebuilt-attestation <file>`, the signing evidence in its environment.
-// QA verifies all of it again (crates/rightkit-qa/src/journeys/prebuilt.rs build_from_prebuilt) and never compiles. An empty journey set is never green: the plan
-// step fails when nothing is selected, QA's own verdict needs executed journeys, and an empty listing is refused on both sides.
-import { createHash } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import crypto from "node:crypto";
-import { spawnSync } from "./background-process.mjs";
-import { runCarriedCargo } from "./carried-cargo.mjs";
-import { isInside, realish } from "./qa-snapshot.mjs";
-import { runSignStep } from "./suite-signing.mjs";
-import { QA_APP_BINARY_ENV, QA_SIGNED_FILES_ENV, QA_SIGNING_EVIDENCE_ENV } from "./suite-signing-policy.mjs";
-
-export const JOURNEYS_PREBUILT_CAPABILITY = "journeys-prebuilt-input";
-export const PREBUILT_SCHEMA = "rightkit.journeys.prebuilt-input/1";
-export const BUILD_PLAN_SCHEMA = "rightkit.journeys.build-plan/1";
-/** The suite name the sign step reads the carried receipt's output directory under. */
-export const JOURNEYS_BUILD_SUITE = "journeys-build";
-/** The exact key set of the attestation (QA reads it with unknown fields denied). */
-export const ATTESTATION_KEYS = Object.freeze(["schema", "request_id", "request_sha256", "listing_sha256", "command", "outputs"]);
-
-const sha256 = (data) => createHash("sha256").update(data).digest("hex");
-const words = (args) => args.map(String);
-const OWN_FLAGS = ["--from-cargo-json", "--prebuilt-attestation", "--print-build-plan"];
-const flagOf = (w) => { const at = w.indexOf("="); return at > 0 && w.startsWith("--") ? w.slice(0, at) : w; };
-
-/** True when this QA argv is `journeys run ...`. */
-export const isJourneysRun = (args) => { const w = words(args); return w[0] === "journeys" && w[1] === "run"; };
-
-/** Why a `journeys run` argv cannot be carried, or null: the listing and attestation are the gate's to write, never the step's (an input the gate did not verify). */
-export function journeysRunRefusal(args) {
-  const own = words(args).filter((w) => w.startsWith("-")).map(flagOf);
-  const named = OWN_FLAGS.find((flag) => own.includes(flag));
-  return named ? `${named} is the gate's own: a journeys step names no listing, attestation or plan flag (the gate carries the build and hands QA the verified input)` : null;
-}
-
-/**
- * Whether the installed `rightkit-qa` implements the prebuilt journey input: its `journeys run --help` names the capability. A binary that cannot be asked, or does
- * not name it, has no such mode.
- */
-export function qaPrebuiltCapability(qa, { spawn = spawnSync, env = process.env } = {}) {
-  try {
-    const r = spawn(qa, ["journeys", "run", "--help"], { encoding: "utf8", env, windowsHide: true, timeout: 20000 });
-    return r?.status === 0 && String(r.stdout ?? "").includes(JOURNEYS_PREBUILT_CAPABILITY);
-  } catch { return false; }
-}
-
-/** The refusal text of a planned journeys step on a snapshot stage whose QA lacks the capability, naming it. */
-export const journeysCapabilityRefusal = (name) => `${name}: \`rightkit-qa journeys run\` needs capability "${JOURNEYS_PREBUILT_CAPABILITY}" and the installed rightkit-qa does not advertise it (\`rightkit-qa journeys run --help\`): without it QA would compile through the broker itself, and a gate-carried stage must build once, sign, then run prebuilt bytes. Nothing ran`;
-
-const fail = (code, message, status = 101) => Object.assign(new Error(`${code}: ${message}`), { code, status });
-
-function parsePlan(result, what) {
-  if (result?.error) throw fail("RK_QA_JOURNEYS_PLAN", `${what}: rightkit-qa did not start (${result.error.message})`);
-  if (result?.status !== 0) throw fail("RK_QA_JOURNEYS_PLAN", `${what}: rightkit-qa exited ${result?.status}: ${String(result?.stderr ?? "").trim().slice(0, 600) || "no message"}; nothing was built`);
-  let plan;
-  try { plan = JSON.parse(String(result.stdout).trim().split(/\r?\n/).filter(Boolean).pop() ?? ""); } catch { throw fail("RK_QA_JOURNEYS_PLAN", `${what}: rightkit-qa printed no build plan`); }
-  if (plan?.schema !== BUILD_PLAN_SCHEMA || !Array.isArray(plan.command) || !Array.isArray(plan.artifacts) || typeof plan.cwd !== "string") throw fail("RK_QA_JOURNEYS_PLAN", `${what}: the build plan is not a ${BUILD_PLAN_SCHEMA} document`);
-  return plan;
-}
-
-/**
- * The gate's build-once run of one `journeys run` step. `args` is QA's argv (`journeys run ...`); `map` is the carrier map. Resolves `{ status }` (QA's own exit status)
- * or throws an Error with a typed `code` (nothing ran, or QA was never started). Every effect is injectable: `spawn` (QA), `carry` (the carrier), `signStep`, `loadConfig`.
- */
-export function runJourneysPrebuilt({ qa, args, cwd = process.cwd(), env = process.env, map, platform = process.platform, spawn = spawnSync, carry = runCarriedCargo, signStep = runSignStep, signDeps = {}, loadConfig = defaultConfig, log = (m) => process.stderr.write(`${m}\n`) }) {
-  const given = words(args);
-  if (!isJourneysRun(given)) throw fail("RK_QA_JOURNEYS_USAGE", `rightkit-qa ${given.join(" ")} is not a journeys run step`);
-  const own = journeysRunRefusal(given);
-  if (own) throw fail("RK_QA_JOURNEYS_FLAG", own);
-  const section = map.broker ?? {};
-  const snapshot = section.snapshot?.path;
-  const checkouts = [section.checkout, env.RK_GATE_CHECKOUT].filter((c) => typeof c === "string" && c);
-  const run = (extra, what) => spawn(qa, [...given, ...extra], { cwd, env, encoding: "utf8", windowsHide: true, maxBuffer: 1 << 26 });
-  // 1. what QA would build (nothing is created or built).
-  const plan = parsePlan(run(["--print-build-plan"]), "the build plan");
-  if (plan.command[0] !== "rustright" || plan.command[1] !== "cargo" || plan.command.length < 3) throw fail("RK_QA_JOURNEYS_PLAN", `the declared build ${JSON.stringify(plan.command)} is not a \`rustright cargo ...\` command; a snapshot stage carries Cargo builds only`);
-  if (plan.artifacts.length === 0) throw fail("RK_QA_JOURNEYS_EMPTY", "the journeys build declares no artifact: an empty journey set is never green");
-  if (!snapshot || !isInside(plan.cwd, snapshot) || checkouts.some((c) => isInside(plan.cwd, c))) throw fail("RK_QA_JOURNEYS_PLACE", `the journeys build directory ${plan.cwd} is not inside the commit's snapshot${snapshot ? ` (${snapshot})` : ""}`);
-  // 2. the carried build.
-  const dir = path.join(path.dirname(map.ledgerDir), "qa-listings");
-  if (isInside(dir, snapshot) || checkouts.some((c) => isInside(dir, c))) throw fail("RK_QA_JOURNEYS_PLACE", `the listing directory ${dir} is inside the snapshot or the primary checkout`);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const stem = path.join(realish(dir), `${process.pid}-${Date.now().toString(36)}-${crypto.randomBytes(4).toString("hex")}`);
-  const listingFile = `${stem}.jsonl`; const attestationFile = `${stem}.attestation.json`;
-  const cargoWords = plan.command.slice(2);
-  const built = carry(cargoWords, { cwd: plan.cwd, env, stdio: "capture" }, { map });
-  if (built.stderr) process.stderr.write(built.stderr);
-  if (built.error) throw fail("RK_QA_JOURNEYS_BUILD", built.error.message);
-  if (built.status !== 0 || built.refusal || built.outputDir === undefined || !built.requestId || !/^[0-9a-f]{64}$/.test(built.requestDigest ?? "")) {
-    throw Object.assign(fail("RK_QA_JOURNEYS_BUILD", `the carried build \`cargo ${cargoWords.join(" ")}\` did not complete with a verified receipt (exit ${built.status}${built.refusal ? `, ${built.refusal.code}` : ""}); QA did not run`), { status: built.status || 101 });
-  }
-  let signedDir = null;
-  try {
-    const listing = String(built.stdout ?? "");
-    fs.writeFileSync(listingFile, listing, { mode: 0o600 });
-    // 3. the executable of each role, as QA resolves it from this listing; each must be a file the receipt's output directory holds.
-    const resolved = parsePlan(run(["--print-build-plan", "--from-cargo-json", listingFile]), "the role to executable mapping");
-    const roles = resolved.artifacts;
-    const outputs = [];
-    for (const role of roles) {
-      if (typeof role.executable !== "string" || !role.executable) throw fail("RK_QA_JOURNEYS_PLAN", `role ${role.role} resolves to no executable in the carried listing`);
-      const real = realish(role.executable);
-      if (!isInside(real, built.outputDir)) throw fail("RK_QA_JOURNEYS_PLACE", `role ${role.role}: ${role.executable} is not inside the receipt's output directory ${built.outputDir}`);
-      let data;
-      try { if (!fs.statSync(real).isFile()) throw new Error("not a file"); data = fs.readFileSync(real); } catch (e) { throw fail("RK_QA_JOURNEYS_PLACE", `role ${role.role}: ${role.executable} cannot be read (${e.message})`); }
-      outputs.push({ role: role.role, marker: role.marker, path: role.executable, real, sha256: sha256(data) });
-    }
-    if (outputs.length === 0) throw fail("RK_QA_JOURNEYS_EMPTY", "the carried build resolved no executable: an empty journey set is never green");
-    // 4. sign every product before anything launches.
-    let signEnv = {};
-    const products = outputs.filter((o) => o.marker === "required");
-    if (products.length) {
-      let signed;
-      try {
-        const files = products.map((o) => ({ from: JOURNEYS_BUILD_SUITE, path: path.relative(realish(built.outputDir), o.real).split(path.sep).join("/") }));
-        signed = signStep({ name: "journeys-sign", sign: { files }, appRoot: cwd, config: loadConfig(cwd), env, platform, outputDirsOf: (suite) => (suite === JOURNEYS_BUILD_SUITE ? [built.outputDir] : null), deps: signDeps, log });
-      } catch (e) { throw fail(e.code ?? "RK_QA_JOURNEYS_UNSIGNED", `a product of the journeys build could not be signed: ${e.message}; an unsigned product is never launched, and QA did not run`); }
-      signedDir = signed.signedDir;
-      signEnv = { [QA_SIGNING_EVIDENCE_ENV]: signed.evidenceFile, [QA_SIGNED_FILES_ENV]: JSON.stringify(signed.signedFiles ?? {}), ...(signed.appBinary ? { [QA_APP_BINARY_ENV]: signed.appBinary } : {}) };
-    }
-    // 5. the attestation, then QA directly against the verified input.
-    const attestation = { schema: PREBUILT_SCHEMA, request_id: built.requestId, request_sha256: built.requestDigest, listing_sha256: sha256(Buffer.from(listing)), command: [...plan.command.slice(1)], outputs: outputs.map((o) => ({ path: o.path, sha256: o.sha256 })) };
-    fs.writeFileSync(attestationFile, JSON.stringify(attestation), { mode: 0o600 });
-    const ran = spawn(qa, [...given, "--from-cargo-json", listingFile, "--prebuilt-attestation", attestationFile], { cwd, env: { ...env, ...signEnv }, stdio: "inherit", windowsHide: true });
-    if (ran.error) throw fail("RK_QA_JOURNEYS_RUN", ran.error.message);
-    return { status: ran.status ?? 1, attestation };
-  } finally {
-    for (const f of [listingFile, attestationFile]) { try { fs.rmSync(f, { force: true }); } catch { /* pruned with the managed directory */ } }
-    if (signedDir) { try { fs.rmSync(signedDir, { recursive: true, force: true }); } catch { /* the managed root is pruned */ } }
-  }
-}
-
-/** The app's right-release config JSON beside the step's directory (the sign step derives the product identity from it); null when there is none. */
-function defaultConfig(cwd) {
-  try { return JSON.parse(fs.readFileSync(path.join(cwd, "right-release.config.json"), "utf8")); } catch { return null; }
-}