@rightkit/release 0.6.3 → 0.6.4

package/README.md

@@ -59,6 +59,18 @@ Every Right app has absolutely NO access to DevTools; the single exception is Vi
 - S1-S4 need `compiledOut`: `feature:<name>`, `cfg:test`, `cfg:debug_assertions` or, for Swift, `swift:DEBUG` (the read sits inside `#if DEBUG`; the read exists only there). The source walk skips test directories, including Swift bundles named `Tests`, `UITests`, `<App>Tests` and `<App>UITests`. S5 needs `userGesture: true`. S6 needs `valueType` of `bool`, `int` or `enum`.
 - `anchor` and `note` are informational. Fixtures: `fixtures/release-switches/` (`app/` is a clean example).
 
+#### Non-shipped tooling: `releaseSwitches.nonShipped`
+
+On desktop (non-iOS) targets the source walk covers the whole app root, so app tooling that never ships (a bakeoff harness) can produce `unregistered-read` findings that cannot truthfully be declared in `switches.json`. Declare such directories in the release config:
+
+```json
+"releaseSwitches": { "nonShipped": [ { "dir": "bakeoff", "reason": "bakeoff harness; not compiled or bundled" } ] }
+```
+
+- It is an exclusion list: any directory not listed is still scanned, so an omission fails safe. `dir` is relative to the app root; `reason` is required and non-empty. iOS is unchanged (it already walks only the Xcode project and the local crates in its cargo tree).
+- Every entry is validated before the walk and a bad one fails the release with `inventory-invalid`. Refused: a dir that is missing, not a real directory (a symlink), absolute, escaping the root, or the root itself; an empty `reason`; a dir that contains or sits inside a local crate of the resolved release cargo tree (a crate at the app root protects `src/`), `src-tauri`, or the Tauri `frontendDist` bundle; a dir that contains a `package.json` or sits inside a directory below the root that has one; when the root has a `package.json`, `src/`, `public/` and every existing directory named by the root `index.html` (`src`/`href`), a quoted string in `vite.config.*` (root, publicDir, build input) or `include`/`files` of `tsconfig.json`, plus anything inside or containing them; and any dir holding a path named by `src-tauri/tauri.conf.json` `beforeBuildCommand`/`beforeDevCommand`/`beforeBundleCommand` a root `package.json` `build*` script, or the release recipe's own commands (`targets.<os>.prePackage`, `package`, `postSign`, `packageHook`, the finalizer; followed through `pnpm|npm|yarn run <script>`), because those run during the release build.
+- Not protected: the release code does not otherwise know the frontend source layout. A frontend input that none of the rules above names (for example one referenced only from a nested config, or built by a script not reachable from those commands) is not refused, so list only directories you know never ship.
+
 ## Commands
 
 `right-release` maps these subcommands to the modules in this package:
@@ -109,7 +121,7 @@ a JSON line before and after (`{"event":"e2e_suite_completed","suite":"tooling",
 (repeatable) selects suites; a group name such as `journeys` selects all its chunks. `--runner vitest -- run --project unit`
 runs a runner once with the arguments after `--` (watch mode, one project); `-- <args>` after `--suite` is allowed when exactly
 one suite is selected. `--list [--json]` prints the resolved commands and runs nothing. Wrap it as the repository needs, for
-example `rightkit storage run --app <app> -- right-release test`.
+example `rustright storage run --app <app> -- right-release test`.
 
 ### `right-release build --web` (or `web-build`)
 
@@ -187,9 +199,27 @@ Only a target directory under a managed root (`resolveManagedRoots`: `RIGHTKIT_D
 `postSign`: it packs the signed, stapled `.app` and signs the tarball. The default output is `<App>.app.tar.gz`, named after the
 app in `notarize.app`. Declare the file in `updater.artifacts` as before. See `docs/MAC-PACKAGE-RECIPE.md`.
 
-## QA receipts (warn-and-record)
+## QA receipts and admission (warn by default, refuse per app)
+
+`right-release qa --stage source|installed --platform mac|win` runs `rightkit-qa` and writes a MAC'd receipt. Admission is a per-app policy in `qa-admission-policy.json`:
 
-`right-release qa --stage source|installed --platform mac|win` still runs `rightkit-qa` and writes a signed receipt, and receipt verification is unchanged. A missing or invalid receipt no longer blocks a release. `build`, `upload`, `publish-update` and `github` print `[right-release] QA warning: ...` to stderr, continue, and record the outcome:
+```json
+{ "schema": 1,
+  "apps": { "postright": { "mode": "refuse", "since": "2026-11-02", "set_by": "adrian" } },
+  "approvedRunners": [ { "sha256": "<64 hex>", "version": "0.8.0" } ] }
+```
+
+- **`warn` (default; an app with no entry).** A missing or invalid receipt does not block. `build`, `upload`, `publish-update` and `github` print `[right-release] QA warning: ...` to stderr, continue, and record the outcome (below).
+- **`refuse`.** The same refusal throws `QA admission refused for <app> (policy refuse since ... by ...)`; nothing is sealed, uploaded or published. Switch an app on with `node release-qa-policy.mjs set --app <app> --mode refuse --set-by <name>`. Moving an app back to `warn` (or deleting its entry) is refused unless `set_by` is `adrian`; a hand edit that does so is caught on every load by comparing with the copy committed at `RIGHT_RELEASE_QA_POLICY_BASELINE_REF` (default `HEAD`; CI should use `origin/main`). `set_by` is a recorded claim, not an authenticated identity: the file must be owner-protected in the repository (CODEOWNERS and branch protection), and a downgrade that was already committed becomes the new baseline. An unreadable or malformed policy file is a hard error, never a fall back to warn.
+
+Hardening, applied in both modes (a failure is a warning in `warn` and a refusal in `refuse`):
+
+1. **Platform and release id.** The sealed receipt must be for the platform and the release id being sealed or published.
+2. **Approved runner.** The `rightkit-qa` executable's sha256 recorded in the receipt must be listed in `approvedRunners`. An empty list approves nothing. The binary is digested before the run and again after it; a swap during the run is refused.
+3. **Every release-critical journey.** With `qa.journeys` in the release config (`{ manifest?: "journeys.toml", receipt?: "<path>", args?: { source?, installed? } }`) `right-release qa` runs `rightkit-qa journeys run` (or reads `receipt`), validates the `rightkit.journeys.receipt/1` through `rightkit-qa journeys validate-receipt --manifest .. --tree ..` (exit code 0 and a final `ACCEPTED` line), and seals a `journeys` summary. `release-qa-floor.json` maps the `journey` floor id to "all release-critical journeys passed": at admission the required set is recomputed from the `journeys.toml` committed at the receipt's commit (every `release_critical` journey that lists the platform), and each must be `passed`. Zero critical journeys is never a pass. One matching check no longer satisfies the floor.
+4. **Signing outside test execution.** Checked: the receipt records the test processes' pids and the window they ran in; admission refuses a receipt sealed before that window ended, signing that began before it ended (`signingStartedAt`), a sealing or admitting process that is a test process, `RIGHT_RELEASE_QA_STAGE` set at admission (admission or signing inside a QA run), and `right-release qa` itself refuses to seal inside a QA run. Not checkable here: that test processes cannot reach the signing key (OS credential store and signing agent ACL) and that CI runs QA and signing as separate jobs (the carried receipt, rightkit#183, is the hook).
+
+`right-release qa` keeps the older behavior for evidence checks and verification of the receipt itself; the outcome is recorded:
 
 - Source stage: sealed into the manifest as `qa: { status: "passed", sourceReceiptDigest, floorDigest }` or `qa: { status: "missing" | "rejected", reason }`.
 - Installed stage: written to `.right-release/state/<releaseId>/<platformDir>/qa-installed.json` as `{ status, reason?, receiptDigest?, checkedAt, provider }`. It is written when publication starts, so a later upload failure still leaves a record.
@@ -212,7 +242,7 @@ right-release install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id d
 
 It mounts the image read-only and hidden (`-nobrowse`), verifies the app (`codesign --verify --deep --strict`, `spctl --assess`, `stapler validate`, bundle id, and Team ID against the installed copy; a Team ID change is refused) before touching the installed copy, stages a `ditto` copy beside it in the destination and verifies that copy, quits the running instance with SIGTERM (15 s, then SIGKILL), swaps the staged copy in (one atomic exchange when the `rightkit-swap` helper is found, otherwise two journaled renames; the old bundle is restored on failure), re-verifies the installed copy, only then moves the old bundle to `~/.Trash/<App> <timestamp>.app`, and relaunches only if it was running or `--relaunch` is given, using `open -g -j -b` (background, hidden, never activated). `--json` emits one lifecycle event per line (`start`, `verified`, `quit`, `replaced`, `relaunched`, `done`/`failed`, among others). `right-release install-app --recover [--dest <dir>] [--app-name <App.app>] [--json]` rolls an interrupted install forward or back from its journal; every install runs that recovery first. Win32 exits with "not implemented on win32". Exit codes: 0 ok, 1 failed, 2 usage, 3 unsupported platform.
 
-The shipped `bin/darwin/rightkit-swap` is Developer ID signed. Local publish adds it via `right-release publish npm --package @rightkit/release --local` on the Mac (managed `rightkit cargo build --release -p rightkit-fs --bin rightkit-swap`, `codesign --options runtime --timestamp`, strict verify). CI qualification adds it via `publish.yml` build-swap → sign-swap → pack (`docs/CI.md`); sign-swap needs `APPLE_CERTIFICATE_BASE64`, `APPLE_CERTIFICATE_PASSWORD`, `APPLE_KEYCHAIN_PASSWORD` & `APPLE_DEVELOPER_ID` in the `release` environment, & stays blocked until root provisions the certificate pair. Exporting that identity requires an Aqua login session: SSH export fails `errSecInteractionNotAllowed` (-25308) & the Aqua signing agent exposes only codesign/updater/notarize/staple, no key export — do not retry either route. `install-app` refuses a helper that exists but is not validly signed (`SWAP_HELPER_UNSIGNED`, naming the fix); with no helper at all it uses the journaled two-rename fallback and logs it (`swap-fallback`, `replaced {swap}`).
+The shipped `bin/darwin/rightkit-swap` is Developer ID signed. Local publish adds it via `right-release publish npm --package @rightkit/release --local` on the Mac (managed `rustright cargo build --release -p rightkit-fs --bin rightkit-swap`, `codesign --options runtime --timestamp`, strict verify). CI qualification adds it via `publish.yml` build-swap → sign-swap → pack (`docs/CI.md`); sign-swap needs `APPLE_CERTIFICATE_BASE64`, `APPLE_CERTIFICATE_PASSWORD`, `APPLE_KEYCHAIN_PASSWORD` & `APPLE_DEVELOPER_ID` in the `release` environment, & stays blocked until root provisions the certificate pair. Exporting that identity requires an Aqua login session: SSH export fails `errSecInteractionNotAllowed` (-25308) & the Aqua signing agent exposes only codesign/updater/notarize/staple, no key export — do not retry either route. `install-app` refuses a helper that exists but is not validly signed (`SWAP_HELPER_UNSIGNED`, naming the fix); with no helper at all it uses the journaled two-rename fallback and logs it (`swap-fallback`, `replaced {swap}`).
 
 Development builds (from `@rightkit/ci` `devArtifact`, Developer ID-signed but not notarized) install with `--dev` and exactly one of `--dmg`, `--zip <path.zip>` (extracted with `ditto -x -k`), or `--app <path.app>`: `right-release install-app --dev --zip dev-mac.zip`. `--dev` still requires `codesign --verify --deep --strict`, a Team ID, no Team ID change, and a bundle-id match; it skips only `spctl` and `stapler`, removes `com.apple.quarantine` from the new bundle only, prints `DEV BUILD (not notarized)`, and sets `dev: true` on every JSON event.
 
@@ -384,7 +414,7 @@ Updater artifacts are declared as for R2 but need no `key`; `platform` must be a
 ```js
 targets: {
   win: {
-    updater: { keyFile: "%APPDATA%/RightKit/updater.key", artifacts: [
+    updater: { artifacts: [
       { file: "src-tauri/target/release/bundle/nsis/Ember_1.2.3_x64-setup.exe", signature: "src-tauri/target/release/bundle/nsis/Ember_1.2.3_x64-setup.exe.sig", platform: "windows-x86_64" },
     ] },
     artifacts: ["dist/Ember-1.2.3-portable-win.zip"], // portable zips seal alongside; they are not in latest.json
@@ -395,6 +425,8 @@ targets: {
 }
 ```
 
+Updater signing keys are never named in the config: `sign-updater` reads the minisign key from the OS credential provider (`rightkit-credentials`, namespace `rightsuite-updater-key`; see `protected-credentials.mjs`). `targets.<platform>.updater.keyFile` is refused at config validation (`RELEASE_CONFIG_UPDATER_KEY_FILE`, listed by `right-release doctor` and the build with every other finding) and is never forwarded to the signer, so remove it from apps that still set it.
+
 NSIS, MSI, `.app.tar.gz` and AppImage bundles all work the same way (any file signed by `sign-updater`). With no sealed installer the installer platform-trust check is skipped (reported in the output); installer-bearing seals still run it. The app side: `plugins.updater.endpoints` is the `latest.json` URL above and `plugins.updater.pubkey` is the suite updater public key (see `@rightkit/app-update` README).
 
 ## Android (AAB build, Play internal track, dev install)

package/bin/rightkit-gate.mjs

@@ -750,13 +750,13 @@ export function quietLeaseLane(o, { tag = "rightkit-gate:", reason = "rightkit-g
 
 // ---- command resolution -------------------------------------------------------------------------------------
 
-// Cargo only through the broker: `rightkit cargo`, or a `cargo` on PATH that is the managed shim (it runs cargo-guard.mjs).
+// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim (it runs cargo-guard.mjs).
 function resolveCargoCommand(o) {
   const which = (cmd) => {
     const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]);
     return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
   };
-  if (which("rightkit").length) return ["rightkit", "cargo"];
+  if (which("rustright").length) return ["rustright", "cargo"];
   const first = which("cargo")[0];
   if (first) { try { if (o.readFile(first).includes("cargo-guard.mjs")) return ["cargo"]; } catch { /* unreadable: not the shim */ } }
   return null;
@@ -900,12 +900,12 @@ export async function main(argv, io = {}) {
   const readLive = (f) => o.readFile(f);
 
   // Units come from the live checkout (cargo reads it); a dirty checkout then blocks below.
-  let rust; let npm; let cargoCommand = ["rightkit", "cargo"];
+  let rust; let npm; let cargoCommand = ["rustright", "cargo"];
   try {
     const manifests = tracked("Cargo.toml");
     if (manifests.length) {
       cargoCommand = resolveCargoCommand(o);
-      if (!cargoCommand) { o.err(`${tag} BLOCKED: neither \`rightkit\` nor the managed cargo shim (cargo-guard.mjs) is first on PATH; plain cargo is never used`); return 1; }
+      if (!cargoCommand) { o.err(`${tag} BLOCKED: neither \`rustright\` nor the managed cargo shim (cargo-guard.mjs) is first on PATH; plain cargo is never used`); return 1; }
       if (!o.exists(path.join(root, GRANT_FILE))) { o.err(`${tag} BLOCKED: no local compile grant (${GRANT_FILE}); the broker refuses cargo, so the Rust units cannot be discovered or scanned`); return 1; }
     }
     // Untracked (not ignored) manifests only: git does not descend into ignored directories, so this stays cheap. A member of a

package/cli/right-release.mjs

@@ -270,7 +270,8 @@ Commands:
   upload --platform ios --release <id> [--apply]       Sealed IPA to TestFlight, then the exact build into the beta groups; dry run unless --apply (macOS)
   ios-credentials store --key-id <KEYID> --issuer <uuid> | check
                                                       Put the App Store Connect API key (stdin), key id and issuer into the login Keychain once, or check them; never a file (macOS)
-  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa and write the sealed QA receipt (a missing receipt warns and is recorded; it never blocks)
+  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa (and the journeys lane when the config sets qa.journeys) and write the sealed QA receipt. Refused inside a QA run. The receipt must match the platform and release id, come from an approved runner digest, and show every release-critical journey passed
+                                                      Admission is per app in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks build, upload and publish. Only adrian moves an app from refuse back to warn
   qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
@@ -307,7 +308,7 @@ Commands:
   apple profile renew [--config <file>] [--profile <file>] [--dry-run]
                                                       Renew macOS profile for current Keychain signer
   signing-agent install|uninstall|status              Manage invisible Aqua-session signing service
-  doctor [--platform mac|win]                        Inspect one app's release config
+  doctor [--platform mac|win] [--gates]               Inspect one app's release config; --gates also runs the build's pre-build source gates
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories
   ownership [--app <dir>] [--json]                   Fail on app copies of RightKit-owned capabilities

package/deterministic-scans.mjs

@@ -10,10 +10,10 @@
 // repository has none. A deferred scan is listed by name (result.deferred, scanDeferrals), is never a
 // pass (result.ok and result.complete are false while any scan is deferred) and cannot become a SCAN_B receipt.
 // Content scans run on the exported HEAD (contentRoot). Only a scan that inherently needs the live
-// checkout uses liveRoot: `rightkit cargo` scans (the broker binds to the registered checkout), the
+// checkout uses liveRoot: `rustright cargo` scans (the broker binds to the registered checkout), the
 // tsc, eslint and package tests (need installed node_modules).
 // Class B runs only when every selected class A scan passed (SCAN_B is distinct from SCAN_A and
-// follows it). Rust commands go through `rightkit cargo`, JavaScript tools through `pnpm exec`.
+// follows it). Rust commands go through `rustright cargo`, JavaScript tools through `pnpm exec`.
 // The runner takes injectable spawn/exists/readFile/readdir so tests execute nothing real. The
 // result is a plain object (per-scan status, tool versions, scanSetDigest) usable as receipt content
 // (packages/release/pipeline-receipts.mjs); it carries no authority by itself.
@@ -34,7 +34,7 @@ export const SCAN_CLASS = Object.freeze({ A: "A", B: "B" });
 export const CLASS_A_SCAN_PREFIXES = Object.freeze([
   "rustfmt", "node-check", "json-parse", "toml-parse", "yaml-parse", "ownership-catalog",
   "actionlint", "pnpm-lockfile", "pnpm-audit", "cargo-metadata", "cargo-deny", "cargo-audit", "cargo-package-list",
-  "changelog-version", "license", "secret-scan", "path-policy", "advisory-exceptions",
+  "changelog-version", "license", "secret-scan", "path-policy", "advisory-exceptions", "suite-api",
 ]);
 export const CLASS_B_SCAN_PREFIXES = Object.freeze([
   "clippy", "check", "check-all-features", "check-features", "check-dependent", "doc", "tsc", "eslint", "swift-build", "test", "generated-docs",
@@ -206,9 +206,11 @@ const ESLINT_FILES = ["eslint.config.js", "eslint.config.mjs", ".eslintrc.json"]
 const ROOT_LINT_FILES = [...ESLINT_FILES, "biome.json"];
 // Everything scripts/generate-index.mjs reads or writes (its header and loadInventory): crate and package manifests and
 // READMEs, the root Cargo.toml (workspace version), the versions and ownership data, the ownership-availability helper it imports, itself, and its outputs.
+// The Right Suite API contract and every projection scripts/gen-suite-api.mjs writes from it (the test-vector copy included).
+const SUITE_API_INPUT = /^(contracts\/right-suite-api\.v1\.json|scripts\/gen-suite-api\.mjs|crates\/rightkit-license\/src\/suite_api_generated\.rs|packages\/app-update\/src\/suite-api\.generated\.ts|packages\/release\/suite-api\.generated\.mjs|crates\/rightkit-license\/test-vectors\/right-suite-api\.v1\.json)$/;
 const GENERATOR_INPUT = /^(crates\/[^/]+\/(Cargo\.toml|README\.md)|packages\/[^/]+\/(package\.json|README\.md)|Cargo\.toml|packages\/release\/(rightkit-versions\.json|rightkit-ownership\.json|ownership-availability\.mjs)|scripts\/generate-index\.mjs|INDEX\.md|docs\/(ADOPTION|CAPABILITY-MAP)\.md)$/;
 const PROBES = Object.freeze({
-  rustfmt: ["--version"], node: ["--version"], rightkit: ["cargo", "--version"], pnpm: ["--version"],
+  rustfmt: ["--version"], node: ["--version"], rustright: ["cargo", "--version"], pnpm: ["--version"],
   actionlint: ["-version"], "right-git": ["--version"], swift: ["--version"],
 });
 
@@ -221,7 +223,7 @@ function commandText(d) {
 /**
  * The scan plan for a change: derived from the changed files plus the manifests they belong to.
  * `contentRoot` is a clean export of the commit (pure content checks); `liveRoot` is the checkout the
- * managed `rightkit cargo` and `pnpm` run in. A scan whose files did not change is not planned.
+ * managed `rustright cargo` and `pnpm` run in. A scan whose files did not change is not planned.
  */
 export function planScans({
   changed = [], contentRoot, liveRoot = contentRoot, exists = fs.existsSync, readFile = (f) => fs.readFileSync(f, "utf8"),
@@ -230,8 +232,8 @@ export function planScans({
   // CI shards (one crate per runner, where the port, pipe, desktop and wall-clock conflicts that force the serial lane do not exist)
   // and records a note naming them (Adrian 2026-10-22: compile locally on the warm cache, qualify the conflicting tests on VMs).
   quietTests = "local",
-  // The command prefix every cargo scan runs through: `rightkit cargo` on a managed host, plain `cargo` in CI.
-  cargoCommand = ["rightkit", "cargo"],
+  // The command prefix every cargo scan runs through: `rustright cargo` on a managed host, plain `cargo` in CI.
+  cargoCommand = ["rustright", "cargo"],
   // Physical containment: a changed path whose real path leaves the real content root (a symlink) is refused.
   realpath = (p) => fs.realpathSync(p),
   // Bytes of a changed file for the input digest (defaults to readFile; the gates pass the raw reader).
@@ -260,8 +262,8 @@ export function planScans({
   rustLocks = null,
 } = {}) {
   if (!contentRoot) throw new TypeError("planScans: contentRoot is required");
-  if (!Array.isArray(cargoCommand) || cargoCommand.length === 0 || !["rightkit", "cargo"].includes(cargoCommand[0]) || cargoCommand.slice(1).some((a) => a !== "cargo")) {
-    throw new TypeError('planScans: cargoCommand must be ["rightkit", "cargo"] or ["cargo"]');
+  if (!Array.isArray(cargoCommand) || cargoCommand.length === 0 || !["rustright", "cargo"].includes(cargoCommand[0]) || cargoCommand.slice(1).some((a) => a !== "cargo")) {
+    throw new TypeError('planScans: cargoCommand must be ["rustright", "cargo"] or ["cargo"]');
   }
   const refusals = []; const accepted = [];
   for (const raw of new Set(changed)) {
@@ -434,6 +436,9 @@ export function planScans({
 
   // Exceptions expire by date, not by change: checked on every run, whatever changed.
   if (exists(path.join(contentRoot, "ci/advisory-exceptions.json"))) add({ id: "advisory-exceptions", class: A, internal: "advisory-exceptions" });
+  // Like generated-docs, planned only when a changed file is one of the contract's inputs or projections. The generator runs from
+  // the trusted scanner checkout (the import below); the exported contract and projections are data it checks.
+  if (files.some((f) => SUITE_API_INPUT.test(f)) && exists(path.join(contentRoot, "contracts/right-suite-api.v1.json"))) add({ id: "suite-api", class: A, internal: "suite-api" });
   if (rustTouched) {
     for (const ws of touchedWs) add({ id: `cargo-metadata${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, ...metadataArgs()) });
     for (const name of crateNames.filter((n) => rustMap?.get(n).publish !== false)) add({ id: rustScanId.packageList(name), class: A, ...cargoIn(wsOf(name), "package", "-p", crateOf(name), "--list", "--allow-dirty", "--locked") });
@@ -578,7 +583,7 @@ export function planScans({
   const deferred = [];
   if (!localCompile) {
     scans = scans.map((x) => {
-      if (x.tool !== "rightkit" && !(x.tool === "cargo" && cargoCommand.length === 1)) return x;
+      if (x.tool !== "rustright" && !(x.tool === "cargo" && cargoCommand.length === 1)) return x;
       deferred.push(x.id);
       return { ...x, deferred: "no local compile grant; the broker refuses this scan" };
     });
@@ -758,6 +763,12 @@ const INTERNAL = {
   // Every RustSec exception is dated, scoped to the locked versions and identical in deny.toml and
   // .cargo/audit.toml (ci/advisory-exceptions.json; Astra 2026-10-22). Expiry fails every run.
   "advisory-exceptions": (s, ctx) => checkAdvisoryExceptions({ root: ctx.contentRoot, readFile: ctx.read }),
+  // Every Right Suite API projection must equal what the generator writes from the contract. The pure check is imported from the
+  // scanner's own checkout (scripts/ sits beside packages/release), never from the content root.
+  "suite-api": async (s, ctx) => {
+    const { suiteApiProblems } = await import("../../scripts/gen-suite-api.mjs");
+    return suiteApiProblems((f) => ctx.read(f));
+  },
   "ownership-catalog": (s, ctx) => (ctx.read(s.files[0]) === ctx.read(s.files[1]) ? [] : ["copy packages/release/rightkit-ownership.json to crates/rightkit-ownership/catalog/ownership-catalog.json"]),
   "changelog-version": (s, ctx) => {
     const version = (ctx.read(s.files[0]).match(/^version\s*=\s*"([^"]+)"/m) || [])[1];

package/development.mjs

@@ -50,7 +50,7 @@ export function developmentEnvironment(env = process.env) {
       result[pathKey] = [agentBin, result[pathKey]].filter(Boolean).join(path.delimiter);
     }
     // Same default as the agent-bin `rightkit` shim: children that run the managed client directly
-    // (resolveCommand("rightkit"), build scripts) must not lose the broker endpoint.
+    // (resolveCommand("rustright"), build scripts) must not lose the broker endpoint.
     const socket = discoverBrokerSocket(result);
     if (!result.RIGHTKIT_BUILD_BROKER_SOCKET && socket && existsSync(socket)) result.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
   }
@@ -298,7 +298,8 @@ function execute(command, { root, env, dryRun, run, label }) {
 export function resolveCommand(command, args, { root, env = process.env } = {}) {
   if (command === "node") return { command: process.execPath, args };
   if (command === "pnpm") return { command: process.execPath, args: [resolvePnpmCli({ root, env }), ...args] };
-  if (command === "rightkit") {
+  if (command === "rightkit") throw new Error("`rightkit` is the retired name of the RustRight client (rustright#91); use rustright (cmd: \"rustright\")");
+  if (command === "rustright") {
     const client = managedRuntimeClient(env);
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
     const socket = discoverBrokerSocket(env);

package/hosted-workflow-policy.mjs

@@ -0,0 +1,111 @@
+// hostedWorkflows: { policy: "declared-unrelated", files: { "<file>.yml": "<reason>" | { reason, idToken } } }
+//
+// For a repository that ships more than the released app (a monorepo whose web or server pipeline is a hand-written
+// GitHub workflow). The released app still builds, signs and uploads only through right-release on its native host;
+// every hosted workflow must be declared with the reason it exists, and none may be able to build, sign or upload a
+// release. What makes that hold is credentials: an admitted workflow reaches no secret but GITHUB_TOKEN (no secrets
+// context, no `secrets: inherit`, no reusable workflow, no escape that could spell one), mints no OIDC token unless the
+// file declares why (`idToken`), and runs only commit-pinned actions. Without an Apple, Azure or store credential it
+// cannot sign or upload as Orthic Labs. The command and artifact patterns are a denylist backstop, not the guarantee:
+// a script file the workflow runs is not read.
+export const DECLARED_UNRELATED_POLICY = "declared-unrelated";
+
+const FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,60}\.ya?ml$/;
+const MIN_REASON = 12;
+
+// Release machinery a declared-unrelated workflow must never run. Matched on the whole file, comments included: a comment cannot hide a command.
+const RELEASE_MACHINERY = [
+  [/\bright-release\b/, "right-release"],
+  [/\bxcodebuild\b[^\n]*(?:\barchive\b|-exportArchive\b|-exportOptionsPlist\b)/, "xcodebuild archive/export"],
+  [/\bcodesign\b/, "codesign"],
+  [/\bnotarytool\b|\bstapler\b/, "notarization"],
+  [/\baltool\b|\biTMSTransporter\b|\bupload-testflight\b|\bapp-store-connect\b/i, "App Store upload"],
+  [/\bfastlane\b/, "fastlane"],
+  [/\bsecurity\s+import\b|\bapple-actions\//, "Apple signing keychain import"],
+  [/\bproductbuild\b|\bpkgbuild\b/, "installer package build"],
+  [/\bsigntool\b|\bAzureSignTool\b|\bazure\/(?:trusted|artifact)-signing/i, "Windows code signing"],
+  [/\btauri(?:-apps\/tauri-action|\s+build\b)/, "Tauri app build"],
+];
+
+// A `uses:` must be a local action (./...), a docker image by digest, or owner/repo[/path]@<40-hex commit>.
+const PINNED_USES = /^(?:\.\/[^\s]*|docker:\/\/[^\s@]+@sha256:[0-9a-f]{64}|[A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+@[0-9a-f]{40})$/;
+
+const normalize = (source) => source.replace(/\r\n?/g, "\n");
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const entryReason = (entry) => (isObject(entry) ? entry.reason : entry);
+
+/** Shape problems of a declared-unrelated hostedWorkflows value (an empty list when it is well formed). */
+export function declaredUnrelatedShapeProblems(value) {
+  if (!isObject(value)) return ["hostedWorkflows must be a policy string or an object"];
+  const problems = [];
+  for (const key of Object.keys(value)) if (key !== "policy" && key !== "files") problems.push(`hostedWorkflows.${key} is not a known field (policy, files)`);
+  if (value.policy !== DECLARED_UNRELATED_POLICY) problems.push(`hostedWorkflows.policy must be "${DECLARED_UNRELATED_POLICY}"`);
+  const files = value.files;
+  if (!isObject(files) || Object.keys(files).length === 0) {
+    problems.push("hostedWorkflows.files must map each workflow file name to the reason it exists");
+    return problems;
+  }
+  for (const [file, entry] of Object.entries(files)) {
+    if (!FILE_NAME.test(file)) problems.push(`hostedWorkflows.files has an invalid workflow file name ${JSON.stringify(file)}`);
+    if (isObject(entry)) {
+      for (const key of Object.keys(entry)) if (key !== "reason" && key !== "idToken") problems.push(`hostedWorkflows.files["${file}"].${key} is not a known field (reason, idToken)`);
+      if (entry.idToken !== undefined && (typeof entry.idToken !== "string" || entry.idToken.trim().length < MIN_REASON)) problems.push(`hostedWorkflows.files["${file}"].idToken must say why the workflow mints an OIDC token (at least ${MIN_REASON} characters)`);
+    }
+    const reason = entryReason(entry);
+    if (typeof reason !== "string" || reason.trim().length < MIN_REASON) problems.push(`hostedWorkflows.files["${file}"] must say why the workflow exists (at least ${MIN_REASON} characters)`);
+  }
+  return problems;
+}
+
+function credentialRefusal(file, source, entry) {
+  // GitHub decodes YAML escapes before it evaluates expressions, so an escape could spell `secrets` or a command.
+  if (/\\[xuU]/.test(source)) return `${file} contains a \\x, \\u or \\U escape; a declared-unrelated workflow must spell every name literally`;
+  // The only secret is GITHUB_TOKEN; any other use of the word (secrets.X, secrets['X'], secrets: inherit, toJSON(secrets),
+  // join(secrets)) is refused. A path segment such as /run/secrets/ is not the context.
+  const rest = source.replace(/\bsecrets\.GITHUB_TOKEN\b/g, "");
+  if (/(?<![\w/-])secrets\b(?![\w/-])/i.test(rest)) return `${file} references secrets other than GITHUB_TOKEN (or passes the secrets context on); a declared-unrelated workflow can hold no signing or store credential`;
+  for (const [, ref] of source.matchAll(/^\s*(?:-\s+)?uses:\s*["']?([^\s"'#]+)/gm)) {
+    if (/\.github\/workflows\//.test(ref)) return `${file} calls the reusable workflow ${ref}; a called workflow is not checked`;
+    if (!PINNED_USES.test(ref)) return `${file} uses ${ref}, which is not pinned to a full commit sha (or a local action, or a docker image by digest)`;
+  }
+  if (/^\s*id-token\s*:\s*write\b/m.test(source) && !(isObject(entry) && entry.idToken)) return `${file} mints an OIDC token (id-token: write) without declaring why; set hostedWorkflows.files["${file}"] to { reason, idToken: "<why>" }`;
+  return null;
+}
+
+/**
+ * Why a declared-unrelated workflow set is refused, or null when it is admitted.
+ * workflows: the file names present in .github/workflows; read(file): its text; artifacts: release artifact paths
+ * from the config's targets (a workflow that names one could produce or ship it).
+ */
+export function declaredUnrelatedRefusal({ declaration, workflows, read, artifacts = [] }) {
+  const shape = declaredUnrelatedShapeProblems(declaration);
+  if (shape.length) return shape.join("; ");
+  const declared = Object.keys(declaration.files).sort();
+  const present = [...workflows].sort();
+  const undeclared = present.filter((file) => !declared.includes(file));
+  if (undeclared.length) return `undeclared hosted workflow file(s): ${undeclared.join(", ")} (declare each in hostedWorkflows.files with its reason, or remove it)`;
+  const missing = declared.filter((file) => !present.includes(file));
+  if (missing.length) return `hostedWorkflows.files declares workflow file(s) that do not exist: ${missing.join(", ")}`;
+  for (const file of present) {
+    const source = normalize(read(file));
+    const credential = credentialRefusal(file, source, declaration.files[file]);
+    if (credential) return credential;
+    for (const [pattern, label] of RELEASE_MACHINERY) {
+      if (pattern.test(source)) return `${file} runs release machinery (${label}); the released app builds, signs and uploads only through right-release on its native host`;
+    }
+    for (const artifact of artifacts) {
+      if (artifact && source.includes(artifact)) return `${file} names the release artifact ${artifact}`;
+    }
+  }
+  return null;
+}
+
+/** Release artifact paths a config's targets declare (artifacts, iosPackage archive and ipa). */
+export function releaseArtifactPaths(config) {
+  const paths = new Set();
+  for (const target of Object.values(config?.targets ?? {})) {
+    for (const artifact of target?.artifacts ?? []) if (typeof artifact === "string") paths.add(artifact);
+    for (const key of ["archive", "ipa"]) if (typeof target?.iosPackage?.[key] === "string") paths.add(target.iosPackage[key]);
+  }
+  return [...paths];
+}

package/ios-dev.mjs

@@ -13,7 +13,7 @@
 //           | { kind: "device",     device: "<devicectl identifier>", bundleId, productName?, launch?: true, launchArgs?: [] },
 //   }
 // The build commands are generated from the config (a hand-written `build` is refused). The device is chosen by id only, never
-// "the only device": `install.device`, `--serial` or RIGHTKIT_IOS_DEVICE. DerivedData comes from `rightkit storage xcode-args`.
+// "the only device": `install.device`, `--serial` or RIGHTKIT_IOS_DEVICE. DerivedData comes from `rustright storage xcode-args`.
 import * as nodeFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -102,7 +102,7 @@ export function validateIosDevelopment(target, { root, env = process.env } = {})
     install = { ...descriptor, productName: descriptor.productName ?? target.scheme, launchArgs: [...(descriptor.launchArgs ?? [])] };
   }
   const normalized = { project, projectSpec, scheme: target.scheme, configuration, teamId: target.teamId, extraBuildSettings, prepare, install };
-  return { ...normalized, build: iosDevelopmentBuildCommands(normalized, { root, storage: { derivedData: "<rightkit storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>" }) };
+  return { ...normalized, build: iosDevelopmentBuildCommands(normalized, { root, storage: { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>" }) };
 }
 
 const destinationFor = (install, id) => (install?.kind === "device" ? `id=${id}` : `platform=iOS Simulator,id=${id}`);

package/ios-host.mjs

@@ -34,29 +34,29 @@ export function assertGuiSigningSession({ operation, env = process.env, run = sp
 }
 
 /**
- * DerivedData and result-bundle paths. With RIGHTKIT_RUN_ROOT set they come from `rightkit storage xcode-args --run-root <root>`
+ * DerivedData and result-bundle paths. With RIGHTKIT_RUN_ROOT set they come from `rustright storage xcode-args --run-root <root>`
  * (a JSON argv list holding -derivedDataPath and -resultBundlePath), the same source CodeRight and HeardRight use. Without a
  * managed run the fallback is a directory under the right-release state root, never an in-repo DerivedData.
  */
 export function resolveXcodeStorage({ env = process.env, run = spawnSync, cwd = process.cwd(), fallbackRoot }) {
   const runRoot = typeof env.RIGHTKIT_RUN_ROOT === "string" ? env.RIGHTKIT_RUN_ROOT.trim() : "";
   if (!runRoot) {
-    if (!fallbackRoot) throw new IosHostError("IOS_STORAGE_UNAVAILABLE", "no RIGHTKIT_RUN_ROOT and no fallback storage root; run via: rightkit storage run --app <app> -- right-release ...");
+    if (!fallbackRoot) throw new IosHostError("IOS_STORAGE_UNAVAILABLE", "no RIGHTKIT_RUN_ROOT and no fallback storage root; run via: rustright storage run --app <app> -- right-release ...");
     return { derivedData: path.join(fallbackRoot, "DerivedData"), resultBundle: undefined, source: "fallback" };
   }
-  const result = run("rightkit", ["storage", "xcode-args", "--run-root", runRoot], { cwd, env, encoding: "utf8", windowsHide: true, shell: false, timeout: 30_000 });
-  if (result.error || result.status !== 0) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args failed (${result.status ?? "unavailable"})`);
+  const result = run("rustright", ["storage", "xcode-args", "--run-root", runRoot], { cwd, env, encoding: "utf8", windowsHide: true, shell: false, timeout: 30_000 });
+  if (result.error || result.status !== 0) throw new IosHostError("IOS_STORAGE_FAILED", `rustright storage xcode-args failed (${result.status ?? "unavailable"})`);
   let args;
   try { args = JSON.parse(String(result.stdout ?? "")); } catch { args = null; }
-  if (!Array.isArray(args) || !args.length || args.some((arg) => typeof arg !== "string")) throw new IosHostError("IOS_STORAGE_FAILED", "rightkit storage xcode-args returned no argv list");
+  if (!Array.isArray(args) || !args.length || args.some((arg) => typeof arg !== "string")) throw new IosHostError("IOS_STORAGE_FAILED", "rustright storage xcode-args returned no argv list");
   const value = (flag, required) => {
     const index = args.indexOf(flag);
     if (index < 0 || index + 1 >= args.length) {
-      if (required) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args is missing ${flag}`);
+      if (required) throw new IosHostError("IOS_STORAGE_FAILED", `rustright storage xcode-args is missing ${flag}`);
       return undefined;
     }
     const found = args[index + 1];
-    if (!path.isAbsolute(found)) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args ${flag} is not an absolute path`);
+    if (!path.isAbsolute(found)) throw new IosHostError("IOS_STORAGE_FAILED", `rustright storage xcode-args ${flag} is not an absolute path`);
     return found;
   };
   return { derivedData: value("-derivedDataPath", true), resultBundle: value("-resultBundlePath", false), source: "rightkit-storage" };

package/ios-package-recipe.mjs

@@ -378,7 +378,7 @@ const plannedTrust = (spec) => {
 };
 
 /** The ordered plan (pure; no secret is part of any argument). Used by --dry-run and by the run itself. */
-export function iosPackagePlan(spec, { root, buildNumber = "<YYYYMMDDNN>", storage = { derivedData: "<rightkit storage xcode-args -derivedDataPath>" }, receiptDir }) {
+export function iosPackagePlan(spec, { root, buildNumber = "<YYYYMMDDNN>", storage = { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, receiptDir }) {
   const optionsFile = path.join(receiptDir, "ios-export-options.plist");
   return {
     steps: [
@@ -504,7 +504,7 @@ export function scanForbiddenStrings(dir, strings, fs = nodeFs) {
  *   scanFiles(label, files, o)   release.mjs's assertNoQaControlBinaries (QA rules plus the release-switch binary layer)
  *   detectSession / route        GUI signing session seams (ios-host.mjs)
  *   gitHead()                    the source commit; it must not change during the build
- *   storage()                    DerivedData and result bundle (rightkit storage xcode-args)
+ *   storage()                    DerivedData and result bundle (rustright storage xcode-args)
  *   scanForbidden(dir, strings)  forbidden-string scan
  *   counterDir                   where the per-app build number counter lives (the vault state root under right-release build)
  */

package/local-publish.mjs

@@ -529,7 +529,7 @@ async function publishUnit(parsed, deps, batch) {
       // #258: the package ships a Developer-ID-signed bin/darwin/rightkit-swap; build, sign and verify it before packing (fails closed).
       try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: unitPath, platform, run, env, log }); }
       catch (error) { refuse(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
-      packCommands.push(`rightkit cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
+      packCommands.push(`rustright cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
     }
     if (kind === "npm") {
       // The feed a tarball ships must list the version it ships with (#319): stage it before packing.

package/local-qualify.mjs

@@ -370,16 +370,16 @@ function brokerIdentity(deps) {
   return { name: "rustright", client: String(client).replaceAll("\\", "/"), sha256: sha256((deps.readFile ?? fs.readFileSync)(client)) };
 }
 
-// Cargo only through the broker: `rightkit cargo`, or a `cargo` on PATH that is the managed shim (scripts/local-gate.mjs).
+// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim (scripts/local-gate.mjs).
 function detectCargoCommand(deps) {
   const which = (command) => {
     const result = (deps.run ?? spawnSync)((deps.platform ?? process.platform) === "win32" ? "where" : "which", [command], { encoding: "utf8", windowsHide: true });
     return result.status === 0 ? String(result.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean) : [];
   };
-  if (which("rightkit").length) return ["rightkit", "cargo"];
+  if (which("rustright").length) return ["rustright", "cargo"];
   const first = which("cargo")[0];
   if (first) { try { if (fs.readFileSync(first, "utf8").includes("cargo-guard.mjs")) return ["cargo"]; } catch { /* not the managed shim */ } }
-  return refuse("neither `rightkit` nor the managed cargo shim (cargo-guard.mjs) is first on PATH; plain cargo is never used");
+  return refuse("neither `rustright` nor the managed cargo shim (cargo-guard.mjs) is first on PATH; plain cargo is never used");
 }
 
 const loadFromRoot = (root, file) => {

package/local-runtime.mjs

@@ -176,7 +176,7 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const run = deps.run ?? ((command, args, settings) => spawnCollect(command, args, { maxBuffer: 64 * 1024 * 1024, ...settings }));
   const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: root, windowsHide: true, ...settings });
   const toolchainOf = async () => {
-    const rustc = await run(cargoCommand[0] === "rightkit" ? "rightkit" : "rustc", cargoCommand[0] === "rightkit" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
+    const rustc = await run(cargoCommand[0] === "rustright" ? "rustright" : "rustc", cargoCommand[0] === "rustright" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
     const cargo = await invoke(["-V"], { env: { ...baseEnv, ...brokerEnv }, timeout: 60_000 });
     if (rustc.error || rustc.status !== 0 || cargo.error || cargo.status !== 0) throw new Error("cannot read the toolchain through the broker");
     return { rustc: String(rustc.stdout).trim(), cargo: String(cargo.stdout).trim() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/pipeline-admission.mjs

@@ -352,11 +352,12 @@ export function admitInvocation(step, options = {}) {
   if (name === "right-release") return admitRightRelease(args, label);
   if (name === "pnpm") return admitPnpm(args, inner, label, chain);
   if (name === "node") return admitNode(args, inner, label);
-  if (name === "rightkit") {
-    if (args[0] !== "cargo" || !CARGO_SUBCOMMANDS.has(args[1])) return refuse("R1-managed-client", `${label}: only rightkit cargo ${[...CARGO_SUBCOMMANDS].join("|")} is admitted`);
-    return shellSafeArgs(args, label) ?? admit(`rightkit-cargo-${args[1]}`, "managed-cargo");
+  if (name === "rightkit") return refuse("R1-retired-client", `${label}: rightkit is the retired name of the RustRight client (rustright#91); use rustright ${args.slice(0, 2).join(" ")}`);
+  if (name === "rustright") {
+    if (args[0] !== "cargo" || !CARGO_SUBCOMMANDS.has(args[1])) return refuse("R1-managed-client", `${label}: only rustright cargo ${[...CARGO_SUBCOMMANDS].join("|")} is admitted`);
+    return shellSafeArgs(args, label) ?? admit(`rustright-cargo-${args[1]}`, "managed-cargo");
   }
-  if (name === "cargo" || name === "rustc" || name === "rustdoc") return refuse("R1-bare-cargo", `${label}: run Cargo through the managed client (rightkit cargo ...), never bare ${name}`);
+  if (name === "cargo" || name === "rustc" || name === "rustdoc") return refuse("R1-bare-cargo", `${label}: run Cargo through the managed client (rustright cargo ...), never bare ${name}`);
   if (name === "tauri") return refuse("R1-direct-tauri", `${label}: run the Tauri CLI as pnpm exec tauri ..., or through right-release; a bare tauri is not an approved installed runtime`);
   if (PACKAGE_MANAGERS.has(name)) return refuse("R1-package-manager", `${label}: ${name} is not allowed; the workspace uses pnpm`);
   if (INTERPRETERS.has(name)) return refuse("R1-interpreter", `${label}: ${name} runs script text or a script file the app owns; only an admitted shared generator may do that`);