@rightkit/release 0.6.5 → 0.6.7

package/deterministic-scans.mjs

@@ -2,7 +2,7 @@
 // every scan that applies to a change runs here, before any artifact build, local or CI.
 //
 //   Class A: compile-free, executes no tests and no repository-supplied plugin or generator.
-//   Class B: needs the compiler or runs tests or repository code (clippy, check, doc, tsc, eslint,
+//   Class B: needs the compiler or runs tests or repository code (clippy, check, doc, tsc, eslint, biome,
 //            package tests, the repository's own docs generator).
 //
 // A required tool that is missing FAILS (status "fail", code TOOL_MISSING); a scan is never skipped.
@@ -11,7 +11,7 @@
 // pass (result.ok and result.complete are false while any scan is deferred) and cannot become a SCAN_B receipt.
 // Content scans run on the exported HEAD (contentRoot). Only a scan that inherently needs the live
 // checkout uses liveRoot: `rustright cargo` scans (the broker binds to the registered checkout), the
-// tsc, eslint and package tests (need installed node_modules).
+// tsc, eslint, biome and package tests (need installed node_modules).
 // Class B runs only when every selected class A scan passed (SCAN_B is distinct from SCAN_A and
 // follows it). Rust commands go through `rustright cargo`, JavaScript tools through `pnpm exec`.
 // The runner takes injectable spawn/exists/readFile/readdir so tests execute nothing real. The
@@ -26,18 +26,34 @@ import { spawn as spawnChild, spawnSync } from "./background-process.mjs";
 import { checkAdvisoryExceptions } from "./advisory-exceptions.mjs";
 import { canonicalJson, digestScanSet, requiredScanIds, rustCratePlan, rustScanId } from "./scan-digest.mjs";
 import { reach } from "./lock-graph.mjs";
+import { cargoManifestState } from "./cargo-manifest-text.mjs";
+import { advisoryCacheRoot, ensureAdvisoryDb, prepareDenyOverlay, readAdvisoryPin } from "./advisory-db.mjs";
 
 export const SCAN_RESULT_SCHEMA = "rightkit.deterministic-scans/1";
+/**
+ * The checker that produced a scan result: `<name>@<version>#<digest>` where the digest covers this module and scan-digest.mjs,
+ * so a changed checker at the same version is a different identity. null when it cannot be computed; prior class A evidence
+ * then never unlocks class B (an unknown checker is not trusted, it is refused).
+ */
+export const CHECKER_IDENTITY = (() => {
+  try {
+    const p = JSON.parse(fs.readFileSync(new URL("./package.json", import.meta.url), "utf8"));
+    const h = crypto.createHash("sha256");
+    for (const f of ["./deterministic-scans.mjs", "./scan-digest.mjs"]) { h.update(f); h.update("\0"); h.update(fs.readFileSync(new URL(f, import.meta.url))); h.update("\0"); }
+    return `${p.name}@${p.version}#${h.digest("hex").slice(0, 16)}`;
+  } catch { return null; }
+})();
+export const CHECKER_VERSION = CHECKER_IDENTITY;
 export const SCAN_CLASS = Object.freeze({ A: "A", B: "B" });
 
 /** Scan id prefixes (the text before the first ":") that belong to each class. */
 export const CLASS_A_SCAN_PREFIXES = Object.freeze([
   "rustfmt", "node-check", "json-parse", "toml-parse", "yaml-parse", "ownership-catalog",
-  "actionlint", "pnpm-lockfile", "pnpm-audit", "cargo-metadata", "cargo-deny", "cargo-audit", "cargo-package-list",
+  "actionlint", "shellcheck", "pnpm-lockfile", "pnpm-audit", "cargo-metadata", "cargo-deny", "cargo-audit", "cargo-package-list",
   "changelog-version", "license", "secret-scan", "path-policy", "advisory-exceptions", "suite-api",
 ]);
 export const CLASS_B_SCAN_PREFIXES = Object.freeze([
-  "clippy", "check", "check-all-features", "check-features", "check-dependent", "doc", "tsc", "eslint", "swift-build", "test", "generated-docs",
+  "clippy", "check", "check-all-features", "check-features", "check-dependent", "doc", "tsc", "eslint", "biome", "swift-build", "test", "generated-docs",
 ]);
 
 /**
@@ -54,6 +70,27 @@ export function deterministicScansEnabled(config) {
   return config?.deterministicScans?.enabled === true;
 }
 
+let neutralDir = null;
+/** An empty directory outside every repository, for tool version probes. */
+function probeDir() {
+  if (!neutralDir || !fs.existsSync(neutralDir)) neutralDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-probe-"));
+  return neutralDir;
+}
+
+/** JSONC to JSON: drops line and block comments outside strings, and trailing commas before } or ]. */
+export function stripJsonComments(text) {
+  let out = ""; let i = 0; let inString = false;
+  while (i < text.length) {
+    const c = text[i];
+    if (inString) { out += c; if (c === "\\") { out += text[i + 1] ?? ""; i += 2; continue; } if (c === "\"") inString = false; i++; continue; }
+    if (c === "\"") { inString = true; out += c; i++; continue; }
+    if (c === "/" && text[i + 1] === "/") { while (i < text.length && text[i] !== "\n") i++; continue; }
+    if (c === "/" && text[i + 1] === "*") { i += 2; while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++; i += 2; continue; }
+    out += c; i++;
+  }
+  return out.replace(/,(\s*[}\]])/g, "$1");
+}
+
 /** "A", "B" or null for an id such as "clippy:rightkit-fs". */
 export function scanClassOf(id) {
   const prefix = String(id).split(":")[0];
@@ -177,6 +214,16 @@ function containedPath(raw, contentRoot) {
   return { path: norm };
 }
 const PNPM_NO_HOOKS_ENV = Object.freeze({ npm_config_ignore_pnpmfile: "true", npm_config_ignore_scripts: "true", pnpm_config_ignore_pnpmfile: "true", pnpm_config_ignore_scripts: "true" });
+// pnpm 11 checks, before every `pnpm run` and `pnpm exec`, that node_modules matches pnpm-lock.yaml (`verify-deps-before-run`, default
+// `install`) and answers a stale tree by running `pnpm install` in it. That install wants to purge the modules directory and, with no TTY (a
+// gate child has none), aborts: `[ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY] Aborted removal of modules directory due to no TTY` and a
+// stack through runDepsStatusCheck, before the tool or the test runs at all (CodeRight, 2026-10-25: tsc, biome and test:npm failed in 2 s on a
+// tree installed before the last lockfile change). A gate scan must not install into, or purge, the checkout it reads, and the lockfile is
+// verified where it belongs, by `pnpm-lockfile` (`install --frozen-lockfile --lockfile-only`) in the clean export, so the class B pnpm scans
+// turn the check off and run against the tree as installed, as pnpm 10 (default `false`) always did; a tree that is really missing something
+// fails in the tool or the test with its own error. The `pnpm_config_` spelling is the one pnpm 11.25 honours for this setting
+// (`npm_config_verify_deps_before_run=false` still aborted, checked on a stale tree), the lowercase spelling PNPM_NO_HOOKS_ENV uses for its settings.
+const PNPM_RUN_ENV = Object.freeze({ pnpm_config_verify_deps_before_run: "false" });
 const CONFIG_CRATE_FILE = /(^|\/)Cargo\.(toml|lock)$/;
 const JS_TOOLING_FILE = /(^|\/)(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)$/;
 // Root files that change how EVERY crate (or package) builds: a change to one puts every unit in scope,
@@ -202,18 +249,45 @@ export const ancestorConfigChanged = (ws, changed, pattern = ANCESTOR_RUST_CONFI
   return rel !== null && pattern.test(rel);
 }));
 const WORKSPACE_JS_FILE = /^(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|\.npmrc)$/;
-const ESLINT_FILES = ["eslint.config.js", "eslint.config.mjs", ".eslintrc.json"];
-const ROOT_LINT_FILES = [...ESLINT_FILES, "biome.json"];
+// The linter a package has is the one it configures. ESLint reads a flat `eslint.config.*` or a legacy `.eslintrc*` from the package directory or
+// any ancestor of it; Biome reads `biome.json` / `biome.jsonc` the same way. A Biome-only app (ViewRight, ScrapeRight: `"lint": "biome lint ."`)
+// has no ESLint config and no ESLint dependency, so `eslint .` there fails with "couldn't find an eslint.config" (a gate false positive):
+// planScans plans eslint only where an ESLint config exists and biome only where a Biome config exists, both where both do.
+export const ESLINT_CONFIG_FILES = Object.freeze([
+  "eslint.config.js", "eslint.config.mjs", ".eslintrc.json",
+  "eslint.config.cjs", "eslint.config.ts", "eslint.config.mts", "eslint.config.cts",
+  ".eslintrc", ".eslintrc.js", ".eslintrc.cjs", ".eslintrc.yaml", ".eslintrc.yml",
+]);
+export const BIOME_CONFIG_FILES = Object.freeze(["biome.json", "biome.jsonc"]);
 // Everything scripts/generate-index.mjs reads or writes (its header and loadInventory): crate and package manifests and
 // READMEs, the root Cargo.toml (workspace version), the versions and ownership data, the ownership-availability helper it imports, itself,
 // the port matrix generator it imports, and its outputs (the port matrix's MD and HTML are checked for consistency with its JSON).
 // The Right Suite API contract and every projection scripts/gen-suite-api.mjs writes from it (the test-vector copy included).
-const SUITE_API_INPUT = /^(contracts\/right-suite-api\.v1\.json|scripts\/gen-suite-api\.mjs|crates\/rightkit-license\/src\/suite_api_generated\.rs|packages\/app-update\/src\/suite-api\.generated\.ts|packages\/release\/suite-api\.generated\.mjs|crates\/rightkit-license\/test-vectors\/right-suite-api\.v1\.json)$/;
+const SUITE_API_INPUT = /^(contracts\/right-suite-api\.v1\.json|scripts\/gen-suite-api\.mjs|crates\/rightkit-license\/src\/suite_api_generated\.rs|packages\/app-update\/src\/suite-api\.generated\.ts|packages\/release\/suite-api\.generated\.mjs|swift\/RightKitSwift\/Sources\/RightKitLicense\/RightSuiteAPI\.generated\.swift|crates\/rightkit-license\/test-vectors\/right-suite-api\.v1\.json)$/;
 const GENERATOR_INPUT = /^(crates\/[^/]+\/(Cargo\.toml|README\.md)|packages\/[^/]+\/(package\.json|README\.md)|Cargo\.toml|packages\/release\/(rightkit-versions\.json|rightkit-ownership\.json|ownership-availability\.mjs)|scripts\/generate-(index|port-matrix)\.mjs|INDEX\.md|docs\/(ADOPTION|CAPABILITY-MAP|PORT-MATRIX)\.md|docs\/port-matrix\.(html|json))$/;
 const PROBES = Object.freeze({
   rustfmt: ["--version"], node: ["--version"], rustright: ["cargo", "--version"], pnpm: ["--version"],
-  actionlint: ["-version"], "right-git": ["--version"], swift: ["--version"],
+  actionlint: ["-version"], shellcheck: ["--version"], "right-git": ["--version"], swift: ["--version"],
 });
+/**
+ * The one version of each analyzer whose verdict class A accepts. A class A finding must not depend on which build of the
+ * analyzer a host happens to have: ShellCheck 0.10.0 fails SellRight's repaired deploy scripts on SC2015 and a documented
+ * `# shellcheck disable=SC2329` on SC2317 (0.11.0 split that code), so the same commit was red on one host and green on another.
+ * A scan (or a scan's `requires`) whose tool answers another version fails with TOOL_VERSION; it is never passed or skipped.
+ * The installers (.github/workflows/publish.yml, publish-app.yml, ci.yml) and the managed host path in ci/rk-pipeline.json
+ * provision exactly this version; scripts/ci/scan-receipt.test.mjs holds them to it.
+ */
+export const PINNED_SCAN_TOOLS = Object.freeze({ shellcheck: "0.11.0" });
+// The version a probe's output names, for a tool whose first line is not its version (`shellcheck --version` opens with a banner).
+const PROBE_VERSION = Object.freeze({
+  shellcheck: (text) => { const m = /^version:\s*(\S+)\s*$/m.exec(text); return m ? `shellcheck ${m[1]}` : null; },
+});
+/** null when `version` (a probe's answer) is the pinned one or the tool has no pin, else the problem. */
+export function pinnedVersionProblem(tool, version) {
+  const required = PINNED_SCAN_TOOLS[tool];
+  if (!required || version === `${tool} ${required}`) return null;
+  return `${tool} found ${version ? `"${version}"` : "with no readable version"}, class A requires ${tool} ${required} (PINNED_SCAN_TOOLS in @rightkit/release deterministic-scans.mjs); another version judges scripts differently, so it is refused, never passed or skipped`;
+}
 
 function commandText(d) {
   if (d.internal) return `internal:${d.internal}`;
@@ -221,6 +295,139 @@ function commandText(d) {
   return `${env}${d.tool} ${d.args.join(" ")}`.trim();
 }
 
+// ---- package scripts that call the broker -----------------------------------------------------------------------------------
+// A package's `test` script may run Rust through the broker (`rustright storage run --app x -- right-release test`, `rustright cargo test`) or
+// through plain cargo, which on a host with no broker means the unmanaged toolchain. On such a host the `test:npm:<unit>` scan cannot pass, and
+// its failure says nothing about the code: rightkit-gate defers it with the Rust gate. scriptBrokerCall only reads the scripts; it runs nothing.
+const SCRIPT_TEXT_LIMIT = 16 * 1024;
+const BROKER_TOOLS = new Set(["rustright", "cargo"]);
+const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+// Words that run the command after them.
+const COMMAND_WRAPPERS = new Set(["cross-env", "env", "time", "exec", "command", "sudo", "nice", "nohup"]);
+const PACKAGE_MANAGERS = new Set(["pnpm", "npm", "yarn"]);
+const PACKAGE_RUNNERS = new Set(["npx", "bunx"]);
+// Package manager options that point the run at another package or at every package: the script that runs is not in this package.json.
+const RETARGET_FLAGS = new Set(["-r", "--recursive", "-w", "--workspace-root", "--workspaces", "-ws", "--include-workspace-root"]);
+const RETARGET_VALUE_OPTIONS = new Set(["-F", "--filter", "--filter-prod", "-C", "--dir", "--prefix", "--workspace"]);
+const SAME_DIR_VALUES = new Set([".", "./"]);
+// Options that take the next word as their value (the rest are flags).
+const VALUE_OPTIONS = new Set(["--reporter", "--loglevel", "--color", "--workspace-concurrency", "--stream", "--shell-emulator", "--test-pattern"]);
+
+/** The simple commands of a shell line, each as its words: split on `&&`, `||`, `;`, `|`, `&`, `(`, `)` and newlines outside quotes. A backslash outside quotes is a path separator (Windows), not an escape. */
+function shellCommands(text) {
+  const commands = []; let words = []; let word = ""; let inWord = false; let quote = null;
+  const endWord = () => { if (inWord) words.push(word); word = ""; inWord = false; };
+  const endCommand = () => { endWord(); if (words.length) commands.push(words); words = []; };
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) {
+      if (c === quote) quote = null;
+      else if (c === "\\" && quote === '"' && i + 1 < text.length) word += text[++i];
+      else word += c;
+      continue;
+    }
+    if (c === '"' || c === "'") { quote = c; inWord = true; continue; }
+    if (c === "&" || c === "|" || c === ";" || c === "\n" || c === "(" || c === ")") { endCommand(); continue; }
+    if (/\s/.test(c)) { endWord(); continue; }
+    word += c; inWord = true;
+  }
+  endCommand();
+  return commands;
+}
+
+/** What `pnpm|npm|yarn <args>` does in this package: { run: <script name> } or {} (another package, a built-in, an unknown word). */
+function inspectPackageManager(args, scripts) {
+  let i = 0;
+  while (i < args.length && args[i].startsWith("-") && args[i] !== "--") {
+    const [name, ...inline] = args[i].split("=");
+    const value = inline.length ? inline.join("=") : undefined;
+    if (RETARGET_FLAGS.has(name)) return {};
+    if (RETARGET_VALUE_OPTIONS.has(name)) {
+      if (!SAME_DIR_VALUES.has(value ?? args[i + 1])) return {};
+      i += value === undefined ? 2 : 1;
+    } else i += VALUE_OPTIONS.has(name) && value === undefined ? 2 : 1;
+  }
+  const sub = args[i];
+  if (sub === undefined || sub === "--") return {};
+  const rest = args.slice(i + 1);
+  if (sub === "exec" || sub === "dlx") return inspectCommand(rest, scripts);
+  if (sub === "run" || sub === "run-script" || sub === "rum" || sub === "urun") {
+    let j = 0;
+    while (j < rest.length && rest[j].startsWith("-") && rest[j] !== "--") j += VALUE_OPTIONS.has(rest[j]) ? 2 : 1;
+    return rest[j] !== undefined && rest[j] !== "--" ? { run: rest[j] } : {};
+  }
+  if (sub === "test" || sub === "t" || sub === "tst") return { run: "test" };
+  return Object.hasOwn(scripts, sub) ? { run: sub } : {};
+}
+
+/** What one simple command does: { call: "rustright" | "cargo" } when it runs the tool (through env words and wrappers), { run: <script> } for a package script, else {}. */
+function inspectCommand(words, scripts) {
+  let i = 0;
+  for (let guard = 0; guard < 16; guard += 1) {
+    while (i < words.length && ENV_ASSIGNMENT.test(words[i])) i += 1;
+    if (i >= words.length) return {};
+    const word = path.posix.basename(words[i].replaceAll("\\", "/")).replace(/\.(exe|cmd|bat)$/i, "");
+    if (BROKER_TOOLS.has(word)) return { call: word };
+    if (PACKAGE_MANAGERS.has(word)) return inspectPackageManager(words.slice(i + 1), scripts);
+    if (COMMAND_WRAPPERS.has(word) || PACKAGE_RUNNERS.has(word)) {
+      i += 1;
+      while (i < words.length && words[i].startsWith("-")) i += 1;
+      continue;
+    }
+    return {};
+  }
+  return {};
+}
+
+/**
+ * Whether the package script `entry` runs `rustright` or `cargo`, directly or through the scripts it starts in the same package.json
+ * (`pnpm <script>`, `pnpm run <script>`, `npm run <script>`, `yarn [run] <script>`, `npm test`), their `pre<script>` and `post<script>` hooks, and
+ * `exec`/`dlx`/`npx` wrappers. A run pointed at another package (`--filter`, `-r`, `--dir` elsewhere) is not followed. Bounded to `maxDepth` nested
+ * scripts and cycle-safe. Returns `{ tool, via, command }` for the first call in execution order (`via` is the scripts walked, `command` the command
+ * line that calls the tool), or null. Reads package.json `scripts` data only.
+ */
+export function scriptBrokerCall(scripts, entry = "test", { maxDepth = 8 } = {}) {
+  if (scripts === null || typeof scripts !== "object" || Array.isArray(scripts)) return null;
+  const textOf = (name) => (Object.hasOwn(scripts, name) && typeof scripts[name] === "string" ? scripts[name].slice(0, SCRIPT_TEXT_LIMIT) : null);
+  const seen = new Set();
+  const visit = (name, via) => {
+    if (via.length >= maxDepth || seen.has(name)) return null;
+    seen.add(name);
+    for (const part of [`pre${name}`, name, `post${name}`]) {
+      const text = textOf(part);
+      if (text === null) continue;
+      for (const words of shellCommands(text)) {
+        const found = inspectCommand(words, scripts);
+        if (found.call) return { tool: found.call, via: [...via, part], command: words.join(" ").slice(0, 200) };
+        if (found.run !== undefined) {
+          const deeper = visit(found.run, [...via, part]);
+          if (deeper) return deeper;
+        }
+      }
+    }
+    return null;
+  };
+  return visit(String(entry), []);
+}
+
+// A test script can reach the broker in ways scriptBrokerCall cannot read from package.json alone: `node -e "...spawnSync('pnpm', ['run', n])..."`,
+// `node ./scripts/verify-local.mjs` (a script that spawns `rustright cargo test`), `sh -c`, `pnpm --dir <elsewhere> run verify`, `pnpm --filter`. HeardRight's
+// root `test` is a `node -e` over `verify`, which is `pnpm --dir tauri-app-next run verify`, which is `node ./scripts/verify-local.mjs`, which runs
+// `rustright cargo test`; guessing from the text of such a script would defer tests that merely mention the tool, so the app says it instead.
+// `ci/gate.config.json` `npm.<unit>.requiresBroker` is `{ "reason": "<why this unit's test needs the broker>" }`, committed with the app and reviewed in the
+// diff that adds it. The reason is required: a declaration without one, or of any other shape, is ignored (the test is planned and runs where this host can
+// run it, the way the fail-closed default goes) and planScans says so in a note. `false` and `null` are plain "no declaration". It changes nothing on a host
+// with the broker, in CI, on a protected ref or with the opt-out: the scan runs there exactly as before. Only where rightkit-gate defers the Rust gate does it
+// take the unit's `test:npm:<unit>` scan out, with the Rust scans, named with its reason and never passed.
+const REQUIRES_BROKER_REASON_LIMIT = 400;
+export function declaredBrokerCall(unit, value) {
+  if (value === undefined || value === null || value === false) return {};
+  const reason = typeof value === "object" && !Array.isArray(value) && typeof value.reason === "string" ? value.reason.replace(/\s+/g, " ").trim() : "";
+  if (!reason) return { problem: `ci/gate.config.json npm.${unit}.requiresBroker is ignored: it must be { "reason": "<why this unit's test needs the broker>" } with a non-empty reason; test:npm:${unit} is planned as if it were not there` };
+  const text = reason.length > REQUIRES_BROKER_REASON_LIMIT ? `${reason.slice(0, REQUIRES_BROKER_REASON_LIMIT)}...` : reason;
+  return { call: { tool: "rustright", via: ["test"], command: `ci/gate.config.json npm.${unit}.requiresBroker: ${text}`, declared: true } };
+}
+
 /**
  * The scan plan for a change: derived from the changed files plus the manifests they belong to.
  * `contentRoot` is a clean export of the commit (pure content checks); `liveRoot` is the checkout the
@@ -255,12 +462,20 @@ export function planScans({
   // `crateFeatures` is read by `name` first, then by `crate`. Units of different workspaces never share a lock, a deny/audit run or a
   // `cargo metadata`; a unit that sets no cargoDir belongs to the global `cargoDir` above.
   rustUnits = null, npmUnits = null, cargoDir = ".",
+  // pnpm roots: repository-relative directories ("." for the repository root) that hold their own lock or workspace file. null keeps the single
+  // root "." (every npm unit belongs to it; one pnpm-lockfile and one pnpm-audit scan run there). With a list, each root gets its own
+  // `pnpm-lockfile:<root>` and `pnpm-audit:<root>` scans, run in that directory ("." keeps the unsuffixed ids), planned when one of its units is in
+  // scope or one of its own package.json / pnpm-lock.yaml / pnpm-workspace.yaml changed. An npm unit names its root as `root` (default "."); a
+  // repository with no pnpm root at all (npmRoots: []) plans no pnpm scan (CodeRight: two independent roots and nothing at the repository root).
+  npmRoots = null,
   // Parsed Cargo.lock graph (lock-graph.mjs parseLock). With it, every workspace crate that depends on a crate in scope and is
   // not itself in scope gets a `check-dependent` scan, as CI's rust-check rows do. null plans none.
   rustLock = null,
   // The same per Cargo workspace: { [cargoDir]: parsedLock }. A workspace without an entry here (and not the global `cargoDir`) plans
   // no reverse dependents.
   rustLocks = null,
+  // The pinned RustSec advisory database ({ url, commit }, advisory-db.json): cargo-deny and cargo-audit read exactly that commit and never fetch.
+  advisoryPin = null,
 } = {}) {
   if (!contentRoot) throw new TypeError("planScans: contentRoot is required");
   if (!Array.isArray(cargoCommand) || cargoCommand.length === 0 || !["rustright", "cargo"].includes(cargoCommand[0]) || cargoCommand.slice(1).some((a) => a !== "cargo")) {
@@ -320,6 +535,15 @@ export function planScans({
       const dir = cleanDir(u.dir);
       if (!plainDir(dir)) { refuse(`${kind} unit ${JSON.stringify(u.name)} directory ${JSON.stringify(u.dir)}`, "not a plain repository-relative path"); continue; }
       const entry = { dir, publish: u.publish !== false };
+      if (kind === "npm") {
+        entry.root = ".";
+        if (u.root !== undefined) {
+          if (typeof u.root !== "string") throw new TypeError(`planScans: npm unit ${u.name} needs a string root`);
+          const r = cleanDir(u.root);
+          if (!plainDir(r) || !(r === "." || dir === r || dir.startsWith(`${r}/`))) { refuse(`npm unit ${JSON.stringify(u.name)} root ${JSON.stringify(u.root)}`, "not a plain repository-relative directory that holds the unit"); continue; }
+          entry.root = r;
+        }
+      }
       if (kind === "rust") {
         if (u.crate !== undefined && typeof u.crate !== "string") throw new TypeError(`planScans: rust unit ${u.name} needs a string crate`);
         entry.crate = u.crate ?? u.name;
@@ -335,6 +559,24 @@ export function planScans({
     return map;
   };
   const rustMap = unitMap(rustUnits, "rust"); const npmMap = unitMap(npmUnits, "npm");
+  // The pnpm roots (see npmRoots): the listed ones and the roots the units name.
+  let pnpmRoots = ["."];
+  if (npmRoots !== null) {
+    if (!Array.isArray(npmRoots)) throw new TypeError("planScans: npmRoots must be null or an array of repository-relative directories");
+    const set = new Set(npmMap ? [...npmMap.values()].map((u) => u.root) : []);
+    for (const raw of npmRoots) {
+      const r = cleanDir(String(raw));
+      if (plainDir(r)) set.add(r); else refuse(`pnpm root ${JSON.stringify(raw)}`, "not a plain repository-relative path");
+    }
+    pnpmRoots = [...set].sort();
+  }
+  const rootOfUnit = (n) => (npmRoots !== null && npmMap ? npmMap.get(n).root : ".");
+  // The deepest pnpm root that holds a repository-relative file (every file is under "." when "." is a root).
+  const rootOfFile = (f) => {
+    let best = null;
+    for (const r of pnpmRoots) if ((r === "." || f.startsWith(`${r}/`)) && (best === null || r.length > best.length)) best = r;
+    return best;
+  };
   // Units of an explicit-workspace layout (some unit names its cargoDir) get workspace-suffixed ids for the per-workspace scans.
   const perWorkspaceIds = Array.isArray(rustUnits) && rustUnits.some((u) => u?.cargoDir !== undefined);
   const wsIdSuffix = (ws) => (perWorkspaceIds && ws !== "." ? `:${ws}` : "");
@@ -379,21 +621,16 @@ export function planScans({
   };
   const rustFiles = files.filter((f) => f.endsWith(".rs") && !verbatimUpstream(f) && !recordedPatch(f) && !generatedRust(f));
   const byEdition = new Map();
+  const editionOf = rustEditionResolver({ contentRoot, exists, readFile });
+  const refusedEditions = new Set();
   for (const f of rustFiles) {
-    let dir = path.dirname(path.join(contentRoot, f));
-    let edition = "2021";
-    while (dir.startsWith(path.normalize(contentRoot))) {
-      const manifest = path.join(dir, "Cargo.toml");
-      if (exists(manifest)) {
-        const m = readFile(manifest).match(/^edition\s*=\s*"(\d{4})"/m);
-        if (m) edition = m[1];
-        break;
-      }
-      const parent = path.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
+    const found = editionOf(f);
+    if (found.problem) {
+      // Never guess an edition: a file whose edition cannot be resolved is not rustfmt-checked under a default, the gate fails on it.
+      if (!refusedEditions.has(found.manifest)) { refusedEditions.add(found.manifest); refuse(`rustfmt edition of ${found.manifest}`, found.problem); }
+      continue;
     }
-    byEdition.set(edition, [...(byEdition.get(edition) ?? []), f]);
+    byEdition.set(found.edition, [...(byEdition.get(found.edition) ?? []), f]);
   }
   for (const [edition, group] of [...byEdition].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
     add({ id: `rustfmt:${edition}`, class: A, tool: "rustfmt", args: ["--check", "--edition", edition, ...group.sort()], root: "content" });
@@ -417,7 +654,8 @@ export function planScans({
   // A workspace is also wide when Rust configuration changed in ANY ancestor directory of it (a repository-level .cargo/config.toml,
   // an intermediate apps/.cargo, a root rust-toolchain.toml, clippy.toml, rustfmt.toml or deny.toml reaches every nested workspace).
   const wideWs = new Set(workspaces.filter((ws) => ancestorConfigChanged(ws, files) || files.some((f) => { const r = wsRel(ws, f); return r !== null && WORKSPACE_RUST_FILE.test(r); })));
-  const jsWide = files.some((f) => WORKSPACE_JS_FILE.test(f));
+  // A pnpm root's own install graph (package.json, lock, workspace file, .npmrc) changed: every unit of that root is in scope.
+  const wideJsRoots = new Set(pnpmRoots.filter((r) => files.some((f) => { const rel = wsRel(r, f); return rel !== null && WORKSPACE_JS_FILE.test(rel); })));
   const wideCrates = wideWs.size ? (rustMap ? [...rustMap.keys()].filter((n) => wideWs.has(wsOf(n))) : listDir(path.join(contentRoot, "crates"))).filter((n) => !rustScope || rustScope.has(n)) : [];
   if (wideWs.size && rustScope) notes.push(`workspace Rust change reaches ${wideCrates.length} crate(s) through the lock graph`);
   const crateNames = safeUnits([...new Set([...(rustMap ? files.map((f) => unitOf(rustMap, f)).filter(Boolean) : under("crates/").map((f) => f.split("/")[1])), ...wideCrates])].filter((n) => exists(path.join(contentRoot, rustDir(n), "Cargo.toml"))).sort(), "crate");
@@ -440,18 +678,37 @@ export function planScans({
     if (n !== null && npmMap.get(n).dir === "." && rustMap) { const r = unitOf(rustMap, f); if (r !== null && rustMap.get(r).dir !== ".") return null; }
     return n;
   };
-  const pkgNames = safeUnits([...new Set([...(npmMap ? files.map(npmOwner).filter(Boolean) : under("packages/").map((f) => f.split("/")[1])), ...(jsWide ? (npmMap ? [...npmMap.keys()] : listDir(path.join(contentRoot, "packages"))) : [])])].filter((n) => exists(path.join(contentRoot, npmDir(n), "package.json"))).sort(), "package");
-  const jsTouched = pkgNames.length > 0 || files.some((f) => JS_TOOLING_FILE.test(f));
+  const pkgNames = safeUnits([...new Set([...(npmMap ? files.map(npmOwner).filter(Boolean) : under("packages/").map((f) => f.split("/")[1])), ...(wideJsRoots.size ? (npmMap ? [...npmMap.keys()].filter((n) => wideJsRoots.has(rootOfUnit(n))) : wideJsRoots.has(".") ? listDir(path.join(contentRoot, "packages")) : []) : [])])].filter((n) => exists(path.join(contentRoot, npmDir(n), "package.json"))).sort(), "package");
+  // The pnpm roots with something to check: a unit in scope, or a package.json / lock / workspace file that belongs to the root (the deepest one).
+  const jsRoots = [...new Set([...pkgNames.map(rootOfUnit), ...files.filter((f) => JS_TOOLING_FILE.test(f)).map(rootOfFile).filter((r) => r !== null)])].sort();
 
   // Explicit files: the exported commit has no .git for actionlint's project discovery.
   const workflowFiles = files.filter((f) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(f)).sort();
   const actionlintConfig = exists(path.join(contentRoot, ".github/actionlint.yaml")) ? ["-config-file", ".github/actionlint.yaml"] : [];
-  if (workflowFiles.length) add({ id: "actionlint", class: A, tool: "actionlint", args: [...actionlintConfig, ...workflowFiles], root: "content" });
+  // actionlint lints every run: script with shellcheck only when shellcheck is found, and otherwise passes silently; class A
+  // requires it (`requires`), so a host without it fails the scan instead of skipping the shell checks.
+  if (workflowFiles.length) add({ id: "actionlint", class: A, tool: "actionlint", requires: ["shellcheck"], args: [...actionlintConfig, ...workflowFiles], root: "content" });
+  // Standalone shell scripts (SellRight's deploy scripts failed SC2154, SC2030/2031 and SC2016 in CI): every tracked .sh/.bash file,
+  // with ShellCheck's own defaults and the repository's .shellcheckrc (data, not code). actionlint covers only workflow run: blocks.
+  // A script whose shebang names another shell (zsh, fish) is not ShellCheck's to judge, so it is left out, never failed.
+  const otherShell = (f) => { try { return /^#!.*\b(zsh|fish|pwsh|powershell)\b/.test(String(readFile(path.join(contentRoot, f))).split("\n", 1)[0]); } catch { return false; } };
+  const shellFiles = files.filter((f) => /\.(sh|bash)$/.test(f) && !/(^|\/)node_modules\//.test(f) && !otherShell(f)).sort();
+  if (shellFiles.length) add({ id: "shellcheck", class: A, tool: "shellcheck", args: ["--format=gcc", "--external-sources", ...shellFiles], root: "content" });
   // No right-git drift scan: the one workflow right-git renders here, ci.yml, is hand-owned (its header;
   // docs/CI.md) and held by scripts/ci/ci-scans-contract.mjs instead, so drift is always reported by design.
 
   // Exceptions expire by date, not by change: checked on every run, whatever changed.
   if (exists(path.join(contentRoot, "ci/advisory-exceptions.json"))) add({ id: "advisory-exceptions", class: A, internal: "advisory-exceptions" });
+  // An app's advisory exceptions follow the same policy as RightKit's own: a Cargo workspace whose deny.toml or .cargo/audit.toml
+  // ignores an advisory needs its ledger, <workspace>/.rightkit/advisory-exceptions.json, with owner, evidence, an unexpired
+  // reviewBy, the exact affected versions and dependents in that workspace's Cargo.lock, and a person's approval; deny.toml and
+  // audit.toml must match it exactly.
+  for (const ws of workspaces) {
+    if (typeof ws !== "string") continue;
+    const dir = ws === "." ? "" : ws;
+    const ignores = ["deny.toml", ".cargo/audit.toml"].some((f) => { try { return /\bignore\s*=\s*\[[^\]]*\S[^\]]*\]/s.test(readFile(path.join(contentRoot, dir, f))); } catch { return false; } });
+    if (ignores && !(dir === "" && exists(path.join(contentRoot, "ci/advisory-exceptions.json")))) add({ id: `advisory-exceptions${dir ? `:${dir}` : ""}`, class: A, internal: "advisory-exceptions", dir, exceptionsFile: ".rightkit/advisory-exceptions.json" });
+  }
   // Like generated-docs, planned only when a changed file is one of the contract's inputs or projections. The generator runs from
   // the trusted scanner checkout (the import below); the exported contract and projections are data it checks.
   if (files.some((f) => SUITE_API_INPUT.test(f)) && exists(path.join(contentRoot, "contracts/right-suite-api.v1.json"))) add({ id: "suite-api", class: A, internal: "suite-api" });
@@ -460,14 +717,43 @@ export function planScans({
     for (const name of crateNames.filter((n) => rustMap?.get(n).publish !== false)) add({ id: rustScanId.packageList(name), class: A, ...cargoIn(wsOf(name), "package", "-p", crateOf(name), "--list", "--allow-dirty", "--locked") });
   }
   for (const ws of [...configWs].sort()) {
-    add({ id: `cargo-deny${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "deny", "check") });
-    add({ id: `cargo-audit${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "audit") });
+    // Offline against the pinned database. The pin commit is part of the command (env), so a pin change is a different scan, and the
+    // placeholders are filled at run time from the materialised checkout (runScans).
+    const pin = advisoryPin ?? (advisoryPin = readAdvisoryPin());
+    const pinEnv = { RK_ADVISORY_DB_COMMIT: pin.commit };
+    add({ id: `cargo-deny${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "deny", "--offline", "--metadata-path", "{advisoryMetadata}", "--config", "{advisoryDenyConfig}", "check"), env: pinEnv, advisoryDb: "deny", advisoryPin: pin });
+    add({ id: `cargo-audit${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "audit", "--db", "{advisoryDb}", "--no-fetch"), env: pinEnv, advisoryDb: "audit", advisoryPin: pin });
   }
-  if (jsTouched) {
+  // The audit policy is the consumer's own: every package.json script that is exactly `pnpm audit <flags>` (only --prod, --dev,
+  // --audit-level <low|moderate|high|critical> are accepted) declares one, and the scan runs the strictest of them all: a dependency
+  // scope only when every declaration names that same scope, and the lowest audit level any declares (one without a level means low).
+  // With none declared, every dependency at every severity. The gate never runs a weaker audit than the repository declares
+  // (RightSites declares `pnpm audit --prod`: production dependencies, all severities).
+  const LEVELS = ["low", "moderate", "high", "critical"];
+  const consumerAuditFlags = (r) => {
+    let scripts = {};
+    try { scripts = JSON.parse(readFile(path.join(contentRoot, r, "package.json"))).scripts ?? {}; } catch { /* none: the strict default */ }
+    const declared = [];
+    for (const cmd of Object.values(scripts)) {
+      const m = /^\s*pnpm\s+audit((?:\s+(?:--prod|--dev|--audit-level(?:=|\s+)(?:low|moderate|high|critical)))*)\s*$/.exec(String(cmd));
+      if (!m) continue;
+      const words = m[1].trim().split(/\s+|=/).filter(Boolean);
+      const at = words.indexOf("--audit-level");
+      const scope = words.includes("--prod") && !words.includes("--dev") ? "--prod" : words.includes("--dev") && !words.includes("--prod") ? "--dev" : null;
+      declared.push({ scope, level: at < 0 ? 0 : LEVELS.indexOf(words[at + 1]) });
+    }
+    if (!declared.length) return [];
+    const scope = declared.every((d) => d.scope === declared[0].scope) ? declared[0].scope : null;
+    const level = Math.min(...declared.map((d) => d.level));
+    return [...(scope ? [scope] : []), ...(level > 0 ? ["--audit-level", LEVELS[level]] : [])];
+  };
+  for (const r of jsRoots) {
     // Class A runs no repository hooks: `install` accepts --ignore-pnpmfile and --ignore-scripts; `audit` accepts
     // neither flag, so every class A pnpm scan also sets the same two settings through the environment.
-    add({ id: "pnpm-lockfile", class: A, tool: "pnpm", args: ["install", "--frozen-lockfile", "--lockfile-only", "--ignore-pnpmfile", "--ignore-scripts"], env: PNPM_NO_HOOKS_ENV, root: "content" });
-    add({ id: "pnpm-audit", class: A, tool: "pnpm", args: ["audit", "--prod", "--audit-level", "high"], env: PNPM_NO_HOOKS_ENV, root: "content" });
+    // One pair per pnpm root, run in the root's directory; the repository root keeps the unsuffixed ids.
+    const where = r === "." ? {} : { cwd: r }; const suffix = r === "." ? "" : `:${r}`;
+    add({ id: `pnpm-lockfile${suffix}`, class: A, tool: "pnpm", args: ["install", "--frozen-lockfile", "--lockfile-only", "--ignore-pnpmfile", "--ignore-scripts"], env: PNPM_NO_HOOKS_ENV, root: "content", ...where });
+    add({ id: `pnpm-audit${suffix}`, class: A, tool: "pnpm", args: ["audit", ...consumerAuditFlags(r)], env: PNPM_NO_HOOKS_ENV, root: "content", ...where });
   }
   const crateDirs = crateNames.map(rustDir); const pkgDirs = pkgNames.map(npmDir);
   const withChangelog = crateNames.filter((n) => exists(path.join(contentRoot, rustDir(n), "CHANGELOG.md")) && exists(path.join(contentRoot, rustDir(n), "Cargo.toml")));
@@ -521,11 +807,13 @@ export function planScans({
     const dependents = safeUnits(workspace.filter((n) => !inScope.has(n) && exists(path.join(contentRoot, rustDir(n), "Cargo.toml")) && scoped.some((t) => reach(lock, crateOf(n), memo).has(t))).sort(), "crate");
     for (const name of dependents) add({ id: `check-dependent:${name}`, class: B, ...cargoIn(ws, ...checkArgs(crateOf(name), { locked: true })) });
   }
-  const rootLint = ROOT_LINT_FILES.some((f) => exists(path.join(liveRoot, f)));
+  // A linter config in the unit's directory or any ancestor of it (a repository-level config covers every unit, as the tools look it up).
+  const hasConfig = (dir, names) => ancestorDirsOf(dir).some((d) => names.some((f) => exists(path.join(liveRoot, inDir(d, f)))));
   for (const name of pkgNames) {
     const dir = npmDir(name);
-    if (exists(path.join(liveRoot, dir, "tsconfig.json"))) add({ id: `tsc:${name}`, class: B, tool: "pnpm", args: ["exec", "tsc", "--noEmit", "-p", "tsconfig.json"], cwd: dir });
-    if (rootLint || ESLINT_FILES.some((f) => exists(path.join(liveRoot, dir, f)))) add({ id: `eslint:${name}`, class: B, tool: "pnpm", args: ["exec", "eslint", "."], cwd: dir });
+    if (exists(path.join(liveRoot, dir, "tsconfig.json"))) add({ id: `tsc:${name}`, class: B, tool: "pnpm", args: ["exec", "tsc", "--noEmit", "-p", "tsconfig.json"], env: PNPM_RUN_ENV, cwd: dir });
+    if (hasConfig(dir, ESLINT_CONFIG_FILES)) add({ id: `eslint:${name}`, class: B, tool: "pnpm", args: ["exec", "eslint", "."], env: PNPM_RUN_ENV, cwd: dir });
+    if (hasConfig(dir, BIOME_CONFIG_FILES)) add({ id: `biome:${name}`, class: B, tool: "pnpm", args: ["exec", "biome", "lint", "."], env: PNPM_RUN_ENV, cwd: dir });
   }
   if (files.some((f) => f.startsWith("swift/") || f === "Package.swift")) {
     if (platform === "darwin") add({ id: "swift-build", class: B, tool: "swift", args: ["build"] });
@@ -558,7 +846,13 @@ export function planScans({
       if (own.quietTests === true && quietTests === "ci") { deferredToCi.push(`test:npm:${name}`); continue; }
       // A gate proves the repository's own content: sibling checkouts beside it (RightKit's suite-contract tests read the app
       // repositories when present) are not inputs, so the package tests run as an isolated checkout, as they do in CI.
-      add({ id: `test:npm:${name}`, class: B, ...(own.quietTests === true ? { quiet: true } : {}), tool: "pnpm", args: ["--dir", npmDir(name), "run", "test"], env: { RIGHTKIT_ISOLATED_CHECKOUT: "1" } });
+      // `brokerCall` marks a test script that runs the broker (or cargo) through its script chain (scriptBrokerCall), or a unit whose app declares that
+      // its test needs the broker (declaredBrokerCall): rightkit-gate defers such a scan with the Rust gate where this host has no broker.
+      // A declaration (`npm.<unit>.requiresBroker`, declaredBrokerCall) covers what the script text does not show; a call the scripts do show wins.
+      const declared = declaredBrokerCall(name, own.requiresBroker);
+      if (declared.problem) notes.push(declared.problem);
+      const brokerCall = scriptBrokerCall(manifest.scripts, "test") ?? declared.call ?? null;
+      add({ id: `test:npm:${name}`, class: B, ...(own.quietTests === true ? { quiet: true } : {}), ...(brokerCall ? { brokerCall } : {}), tool: "pnpm", args: ["--dir", npmDir(name), "run", "test"], env: { ...PNPM_RUN_ENV, RIGHTKIT_ISOLATED_CHECKOUT: "1" } });
     }
     if (deferredToCi.length) notes.push(`${deferredToCi.length} quiet test scan(s) left to the CI shards (one crate per runner), not run here: ${deferredToCi.join(", ")}`);
     // scripts/ci tests run when scripts/, ci/ or .github/ changed, or a file the scripts/ci sources reference (imports and
@@ -670,9 +964,10 @@ export function killProcessTree(child, { platform = process.platform, run = spaw
 /**
  * The same invocation as defaultSpawn without blocking, so scans can run side by side. Keeps the last 4 MiB of each stream.
  * With `options.signal` (an AbortSignal), an abort kills the whole process tree and the result carries `cancelled: true`.
+ * With `options.stdoutFile`, stdout is written to that file whole instead of kept in memory.
  */
 export function defaultSpawnAsync(command, args, options = {}) {
-  const { signal, ...rest } = options;
+  const { signal, stdoutFile, ...rest } = options;
   const inv = resolveInvocation(command, args, { env: rest.env ?? process.env });
   if (inv.error) return Promise.resolve({ status: null, stdout: "", stderr: "", error: inv.error });
   if (signal?.aborted) return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("cancelled"), cancelled: true });
@@ -686,10 +981,12 @@ export function defaultSpawnAsync(command, args, options = {}) {
     const onAbort = () => killProcessTree(child);
     signal?.addEventListener("abort", onAbort, { once: true });
     child.stdout.setEncoding("utf8"); child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (c) => { stdout = keep(stdout, c); });
+    const sink = stdoutFile ? fs.createWriteStream(stdoutFile) : null;
+    if (sink) child.stdout.pipe(sink); else child.stdout.on("data", (c) => { stdout = keep(stdout, c); });
     child.stderr.on("data", (c) => { stderr = keep(stderr, c); });
     child.on("error", (e) => { error = e; });
-    child.on("close", (status) => {
+    child.on("close", async (status) => {
+      if (sink) await new Promise((done) => (sink.writableFinished ? done() : sink.on("finish", done).on("error", done)));
       signal?.removeEventListener("abort", onAbort);
       const cancelled = signal?.aborted === true;
       resolve({ status, stdout, stderr, ...(error ? { error } : cancelled ? { error: new Error("cancelled") } : {}), ...(cancelled ? { cancelled: true } : {}) });
@@ -712,7 +1009,7 @@ export function laneOf(scan) {
 // The lines a reader needs from a failed scan: every line that names a failure (a failed test, a panic, a compiler or tool error,
 // cargo test's `failures:` block header, pnpm's ERR_ codes), at most twelve of them, then the last four lines of stdout and of
 // stderr. cargo test writes results to stdout and "Running ..." to stderr, so a plain tail showed only harness chatter.
-const FAILURE_LINE = /(^|\s)(FAILED|panicked at|error(\[E\d+\])?:|error\[|^failures:|ERR_PNPM_\w+|Error:|assertion `?left|^thread '.*' panicked)/;
+const FAILURE_LINE = /(^|[\s\[])(FAILED|panicked at|error(\[E\d+\])?:|error\[|^failures:|ERR_PNPM_\w+|Error:|assertion `?left|^thread '.*' panicked)/;
 export function failureDetail(r) {
   const lines = (text) => String(text ?? "").split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim());
   const out = lines(r?.stdout); const err = lines(r?.stderr);
@@ -735,6 +1032,8 @@ export function findRustfmt({ env = process.env, exists = fs.existsSync, readdir
     if (found.length) return path.join(toolchains, found[0].d, "bin", exe);
   }
   const which = spawn(platform === "win32" ? "where" : "which", [exe]);
+  // A Promise has no status: an async spawn here would report a present rustfmt as missing.
+  if (typeof which?.then === "function") throw new TypeError("findRustfmt needs a synchronous spawn");
   return which && which.status === 0 ? String(which.stdout).split(/\r?\n/)[0].trim() : null;
 }
 
@@ -753,11 +1052,97 @@ async function defaultScanSecrets() {
   return (await import("./publish-cargo.mjs")).scanCrateForSecrets;
 }
 
+// What rustfmt needs from a Cargo.toml, read by table so an `edition` under [package.metadata.x] or [dependencies.x] is not the
+// package's: `pkg` is the [package] edition (a literal year, or "workspace" for `edition.workspace = true` / `edition = { workspace = true }`),
+// `ws` the [workspace.package] edition literal, `isWorkspace` whether the manifest declares a [workspace]. An `edition` entry in one of
+// those two tables that is none of the recognised spellings (`edition = 2021`, `edition.workspace = false`) is kept as `pkgBad` / `wsBad`
+// (the line), never skipped, so it cannot fall back to a default. Keys before any table header count as [package] keys (the fixtures of
+// this package's tests write manifests that way; cargo itself rejects them).
+export function cargoEditions(text) {
+  const out = { pkg: undefined, ws: undefined, pkgBad: undefined, wsBad: undefined, isWorkspace: false };
+  let table = "";
+  for (const raw of String(text).split(/\r?\n/)) {
+    const header = /^\s*\[\[?([^\]]+)\]\]?\s*(?:#.*)?$/.exec(raw);
+    if (header) {
+      table = header[1].trim();
+      if (table === "workspace" || table.startsWith("workspace.")) out.isWorkspace = true;
+      continue;
+    }
+    if (table !== "" && table !== "package" && table !== "workspace.package") continue;
+    const line = raw.replace(/^(\s*)(["'])edition\2/, "$1edition");
+    if (!/^\s*edition\s*(?:[.=]|$)/.test(line)) continue;
+    let value;
+    if (/^\s*edition\.workspace\s*=\s*true\s*(?:#.*)?$/.test(line) || /^\s*edition\s*=\s*\{\s*workspace\s*=\s*true\s*\}\s*(?:#.*)?$/.test(line)) value = "workspace";
+    else value = (/^\s*edition\s*=\s*(?:"(\d{4})"|'(\d{4})')\s*(?:#.*)?$/.exec(line) || []).slice(1).find(Boolean);
+    if (table === "workspace.package") {
+      if (value !== undefined && value !== "workspace") out.ws = value; else out.wsBad = raw.trim();
+    } else if (value !== undefined) out.pkg = value;
+    else out.pkgBad = raw.trim();
+  }
+  return out;
+}
+
+/**
+ * The edition rustfmt must run a Rust file under: `{ edition }`, or `{ manifest, problem }` when it cannot be resolved.
+ * The nearest Cargo.toml at or above the file decides. A literal `edition = "NNNN"` is that edition; `edition.workspace = true`
+ * (or `edition = { workspace = true }`) is the `[workspace.package] edition` of the owning workspace root, the nearest manifest at or
+ * above it that declares `[workspace]`, which is the manifest itself for a root package. An inheritance that cannot be followed
+ * (no workspace root, an unreadable manifest, or a root with no literal `[workspace.package] edition`) is a `problem`, never a default.
+ * A manifest that names no edition at all, and a file below no manifest, keep rustfmt's "2021" as before.
+ */
+function rustEditionResolver({ contentRoot, exists, readFile }) {
+  const root = path.normalize(contentRoot);
+  const inside = (dir) => { const rel = path.relative(root, dir); return rel === "" || !(rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)); };
+  const rel = (dir) => posix(path.relative(root, path.join(dir, "Cargo.toml")));
+  const parsed = new Map();
+  const manifestAt = (dir) => {
+    if (!parsed.has(dir)) {
+      let value;
+      try { value = cargoEditions(readFile(path.join(dir, "Cargo.toml"))); } catch (e) { value = { unreadable: String(e?.message ?? e).split("\n")[0] }; }
+      parsed.set(dir, value);
+    }
+    return parsed.get(dir);
+  };
+  const ancestors = function* (start) {
+    for (let dir = start; inside(dir); dir = path.dirname(dir)) {
+      yield dir;
+      if (path.dirname(dir) === dir) return;
+    }
+  };
+  return (file) => {
+    const dir = [...ancestors(path.dirname(path.join(root, file)))].find((d) => exists(path.join(d, "Cargo.toml")));
+    if (dir === undefined) return { edition: "2021" };
+    const manifest = rel(dir);
+    const info = manifestAt(dir);
+    if (info.unreadable) return { manifest, problem: `${manifest} cannot be read (${info.unreadable}), so its edition is unknown` };
+    if (info.pkgBad !== undefined) return { manifest, problem: `${manifest} has an edition entry the scan cannot read (${info.pkgBad}); write edition = "NNNN" or edition.workspace = true` };
+    if (info.pkg === undefined) return { edition: info.ws ?? "2021" };
+    if (info.pkg !== "workspace") return { edition: info.pkg };
+    const inherits = `${manifest} sets edition.workspace = true`;
+    for (const up of ancestors(dir)) {
+      if (!exists(path.join(up, "Cargo.toml"))) continue;
+      const w = manifestAt(up);
+      if (w.unreadable) return { manifest, problem: `${inherits}, but ${rel(up)} cannot be read (${w.unreadable}), so its edition is unknown` };
+      if (!w.isWorkspace) continue;
+      if (w.wsBad !== undefined) return { manifest, problem: `${inherits}, but its workspace root ${rel(up)} has a [workspace.package] edition entry the scan cannot read (${w.wsBad})` };
+      if (w.ws === undefined) return { manifest, problem: `${inherits}, but its workspace root ${rel(up)} declares no literal [workspace.package] edition = "NNNN" to inherit` };
+      return { edition: w.ws };
+    }
+    return { manifest, problem: `${inherits}, but no Cargo.toml at or above it declares a [workspace], so there is no [workspace.package] edition to inherit` };
+  };
+}
+
+// A crate that can never be published (`publish = false` or `publish = []` in its [package] table) needs no license key, like a
+// package.json with `"private": true`; cargo-manifest-text.mjs holds the one reading of that rule, which the secret scan shares.
+function cargoUnpublished(text) { return cargoManifestState(text).unpublished; }
+
 const INTERNAL = {
   "json-parse": (s, ctx) => {
     const bad = [];
     for (const f of s.files) {
-      try { JSON.parse(ctx.read(f).replace(/^/, "")); } catch (e) { bad.push(`${f}: ${e.message}`); }
+      // tsconfig/jsconfig and editor settings are JSON with comments by their own spec (TypeScript reads them that way).
+      const jsonc = /(^|\/)(tsconfig|jsconfig)(\.[^/]*)?\.json$|(^|\/)\.vscode\/[^/]+\.json$/.test(f);
+      try { const text = ctx.read(f).replace(/^\uFEFF/, ""); JSON.parse(jsonc ? stripJsonComments(text) : text); } catch (e) { bad.push(`${f}: ${e.message}`); }
     }
     return bad;
   },
@@ -778,7 +1163,9 @@ const INTERNAL = {
   refuse: (s) => [s.detail],
   // Every RustSec exception is dated, scoped to the locked versions and identical in deny.toml and
   // .cargo/audit.toml (ci/advisory-exceptions.json; Astra 2026-10-22). Expiry fails every run.
-  "advisory-exceptions": (s, ctx) => checkAdvisoryExceptions({ root: ctx.contentRoot, readFile: ctx.read }),
+  "advisory-exceptions": (s, ctx) => (s.dir === undefined
+    ? checkAdvisoryExceptions({ root: ctx.contentRoot, readFile: ctx.read })
+    : checkAdvisoryExceptions({ root: path.join(ctx.contentRoot, s.dir), readFile: (p) => ctx.read(path.join(s.dir, p)), exceptionsFile: s.exceptionsFile }).map((problem) => `${s.dir || "."}: ${problem}`)),
   // Every Right Suite API projection must equal what the generator writes from the contract. The pure check is imported from the
   // scanner's own checkout (scripts/ sits beside packages/release), never from the content root.
   "suite-api": async (s, ctx) => {
@@ -797,22 +1184,25 @@ const INTERNAL = {
     for (const f of s.files) {
       const text = ctx.read(f);
       if (f.endsWith("Cargo.toml")) {
-        if (!/^\s*(license|license-file)\s*(=|\.workspace)/m.test(text)) bad.push(`${f}: no license or license-file`);
+        if (!/^\s*(license|license-file)\s*(=|\.workspace)/m.test(text) && !cargoUnpublished(text)) bad.push(`${f}: no license or license-file`);
       } else {
         try { const m = JSON.parse(text); if (m.private !== true && !(typeof m.license === "string" && m.license.trim()) && !m.licenses) bad.push(`${f}: no license field`); } catch (e) { bad.push(`${f}: ${e.message}`); }
       }
     }
     return bad;
   },
+  // The repository gate reads env templates and test vectors against the reviewed records of the gated commit
+  // (.rightkit/secret-scan-records.json, read from the content root by the scanner); crate packaging stays strict.
+  // Each violation names its repository-relative path, so a unit that is both a crate and a package reports a file once.
   "secret-scan": async (s, ctx) => {
     const scan = await ctx.deps.scanSecrets();
-    const bad = [];
+    const bad = new Set();
     for (const dir of s.dirs) {
       const abs = path.join(ctx.contentRoot, dir);
-      if (!ctx.deps.exists(abs)) { bad.push(`${dir}: directory not found`); continue; }
-      for (const v of scan(abs)) bad.push(`${dir}: ${v}`);
+      if (!ctx.deps.exists(abs)) { bad.add(`${dir}: directory not found`); continue; }
+      for (const v of scan(abs, { envTemplates: true, repoRoot: ctx.contentRoot })) bad.add(v);
     }
-    return bad;
+    return [...bad];
   },
 };
 
@@ -824,7 +1214,9 @@ const INTERNAL = {
 export async function runScans(plan, options = {}) {
   const deps = {
     // Concurrent runs need a spawn that does not block the event loop.
-    spawn: Number(options.jobs ?? 1) > 1 || options.signal ? defaultSpawnAsync : defaultSpawn, exists: fs.existsSync, readFile: (f) => fs.readFileSync(f, "utf8"), readdir: fs.readdirSync,
+    spawn: Number(options.jobs ?? 1) > 1 || options.signal ? defaultSpawnAsync : defaultSpawn,
+    // Locating a tool (rustfmt's `which`/`where` fallback) is synchronous whatever `spawn` is.
+    lookupSpawn: defaultSpawn, exists: fs.existsSync, readFile: (f) => fs.readFileSync(f, "utf8"), readdir: fs.readdirSync,
     env: process.env, platform: process.platform, execPath: process.execPath,
     loadToml: defaultLoadToml, loadYaml: defaultLoadYaml, scanSecrets: defaultScanSecrets, findRustfmt,
     ...options,
@@ -838,7 +1230,7 @@ export async function runScans(plan, options = {}) {
   const selected = plan.scans.filter((s) => classes.includes(s.class) && !exclude(s));
   const ordered = [...selected.filter((s) => s.class === SCAN_CLASS.A), ...selected.filter((s) => s.class === SCAN_CLASS.B)];
   const ctx = { deps, contentRoot, read: (f) => deps.readFile(path.join(contentRoot, f)) };
-  const toolVersions = {}; const probed = new Map();
+  const toolVersions = {}; const probed = new Map(); const advisoryDbs = new Map();
   const results = [];
   // options.cache = { read(key), write(key, row), digest(scan) => string | null } (null: not cacheable, which is how the live class A checks opt out).
   const cache = options.cache && typeof options.cache.read === "function" && typeof options.cache.write === "function" && typeof options.cache.digest === "function" ? options.cache : null;
@@ -850,25 +1242,35 @@ export async function runScans(plan, options = {}) {
   const priorRows = Array.isArray(priorA?.scans) ? priorA.scans.filter((r) => r.class === SCAN_CLASS.A) : [];
   // Prior evidence binds to the input content (inputDigest of the changed files), the class A scan set, and a
   // class A run that actually included class A.
+  // ... and to the checker that produced it: evidence from another checker (other version, or same version with changed bytes)
+  // does not unlock class B, and an unknown identity on either side refuses.
+  const checker = CHECKER_IDENTITY;
   const priorClassAValid = Boolean(priorA) && priorA.schema === SCAN_RESULT_SCHEMA && Boolean(plan.classDigests?.A) && Boolean(plan.inputDigest)
     && priorA.inputDigest === plan.inputDigest && Array.isArray(priorA.classes) && priorA.classes.includes(SCAN_CLASS.A)
-    && priorA.classDigests?.A === plan.classDigests.A && digestScanSet(priorRows) === plan.classDigests.A && priorRows.every((r) => r.status === "pass");
+    && priorA.classDigests?.A === plan.classDigests.A && digestScanSet(priorRows) === plan.classDigests.A && priorRows.every((r) => r.status === "pass")
+    && typeof checker === "string" && priorA.checker === checker;
   // Class A ran "in this call" only when it was selected, the plan has class A scans, and none was excluded:
   // excluding every class A scan (or a plan with none) never unlocks class B; explicit prior evidence is needed.
   const planA = plan.scans.filter((x) => x.class === SCAN_CLASS.A);
   const inCallA = classes.includes(SCAN_CLASS.A) && planA.length > 0 && selected.filter((x) => x.class === SCAN_CLASS.A).length === planA.length;
   const classBBlocked = !inCallA && !priorClassAValid;
 
-  const toolCommand = (tool) => (tool === "node" ? deps.execPath : tool === "rustfmt" ? deps.findRustfmt({ env: deps.env, exists: deps.exists, readdir: deps.readdir, platform: deps.platform, spawn: deps.spawn }) : tool);
+  const toolCommand = (tool) => (tool === "node" ? deps.execPath : tool === "rustfmt" ? deps.findRustfmt({ env: deps.env, exists: deps.exists, readdir: deps.readdir, platform: deps.platform, spawn: deps.lookupSpawn }) : tool);
   async function probe(tool) {
     if (probed.has(tool)) return probed.get(tool);
     let outcome;
     const command = toolCommand(tool);
     if (!command) outcome = { ok: false, why: "not found" };
     else {
-      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd: liveRoot, env: deps.env, ...sig });
+      // A version probe never runs inside the repository: a tool started there reads the repository's own configuration first
+      // (pnpm's .npmrc and pnpmfile, corepack's packageManager pin, cargo's .cargo/config), before any scan's protections apply.
+      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd: deps.probeDir ?? probeDir(), env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0" }, ...sig });
       if (!r || r.error || r.status !== 0) outcome = { ok: false, why: r?.error?.message ?? `exit ${r?.status}` };
-      else outcome = { ok: true, command, version: String(r.stdout || r.stderr || "").split(/\r?\n/).find((l) => l.trim())?.trim() ?? "unknown" };
+      else {
+        const text = String(r.stdout || r.stderr || "");
+        const version = PROBE_VERSION[tool] ? PROBE_VERSION[tool](text) : text.split(/\r?\n/).find((l) => l.trim())?.trim() ?? "unknown";
+        outcome = { ok: true, command, version: version ?? "unknown", pinProblem: pinnedVersionProblem(tool, version) };
+      }
     }
     toolVersions[tool] = outcome.ok ? outcome.version : null;
     probed.set(tool, outcome);
@@ -922,6 +1324,29 @@ export async function runScans(plan, options = {}) {
     results.push(...slots);
   }
 
+  // The pinned advisory database, materialised once per run on first use (a failure is remembered and refuses every advisory scan).
+  function prepareAdvisory(s) {
+    const key = s.advisoryPin.commit;
+    if (!advisoryDbs.has(key)) {
+      try {
+        const ensure = deps.ensureAdvisoryDb ?? ensureAdvisoryDb;
+        advisoryDbs.set(key, { dir: ensure({ cacheRoot: deps.advisoryCacheRoot ?? advisoryCacheRoot({ env: deps.env, platform: deps.platform }), pin: s.advisoryPin }) });
+      } catch (e) { advisoryDbs.set(key, { error: e }); }
+    }
+    const db = advisoryDbs.get(key);
+    if (db.error) throw db.error;
+    if (s.advisoryDb !== "deny") return { dbDir: db.dir };
+    const prepare = deps.prepareDenyOverlay ?? prepareDenyOverlay;
+    let denyToml = "";
+    try { denyToml = deps.readFile(path.join(rootDir(s.root), s.cwd ?? "", "deny.toml")); } catch {
+      // No deny.toml in the workspace: RightKit's own policy (deny-default.toml) applies, never cargo-deny's empty default,
+      // which allows no licence at all.
+      denyToml = deps.defaultDenyToml ?? fs.readFileSync(new URL("./deny-default.toml", import.meta.url), "utf8");
+    }
+    const overlay = prepare({ denyToml, dbDir: db.dir, pin: s.advisoryPin });
+    return { dbDir: db.dir, configPath: overlay.configPath, cleanup: overlay.cleanup };
+  }
+
   // `extraEnv` (the quiet lease id) reaches the child but never the cache key: a lease changes nothing a scan proves.
   async function scanRow(s, extraEnv = null) {
     const row = { id: s.id, class: s.class, command: s.command, tool: s.tool ?? null, toolVersion: null, status: "fail" };
@@ -945,13 +1370,25 @@ export async function runScans(plan, options = {}) {
       } else {
         const p = await probe(s.tool);
         row.toolVersion = p.ok ? p.version : null;
+        let missingDep = null; let depVersionProblem = null; const depVersions = [];
+        for (const dep of s.requires ?? []) {
+          const d = await probe(dep);
+          if (!d.ok) { missingDep = `${dep} (${d.why})`; break; }
+          if (d.pinProblem) { depVersionProblem = d.pinProblem; break; }
+          depVersions.push(d.version);
+        }
         if (!p.ok) { status = "fail"; code = "TOOL_MISSING"; detail = `required tool ${s.tool} is missing or not runnable (${p.why}); a required scan is never skipped`; }
+        else if (p.pinProblem) { status = "fail"; code = "TOOL_VERSION"; detail = `TOOL_VERSION: ${p.pinProblem} (at ${p.command})`; }
+        else if (missingDep) { status = "fail"; code = "TOOL_MISSING"; detail = `${s.tool} needs ${missingDep}, which is missing or not runnable; without it the scan would pass unchecked, so it fails`; }
+        else if (depVersionProblem) { status = "fail"; code = "TOOL_VERSION"; detail = `TOOL_VERSION: ${s.tool} runs ${depVersionProblem}`; }
         else {
           let cacheKey = null;
           if (cache) {
             try {
               const digest = cache.digest(s);
-              if (digest) cacheKey = scanCacheKey({ id: s.id, command: s.command, toolVersion: p.version, env: s.env ?? {}, inheritedEnv: inheritedEnvDigest({ ...deps.env, ...s.env }), digest });
+              // The analyzers a scan runs through (actionlint's shellcheck) judge it too, so their versions key it as well.
+              const toolVersion = [p.version, ...depVersions].join(" + ");
+              if (digest) cacheKey = scanCacheKey({ id: s.id, command: s.command, toolVersion, env: s.env ?? {}, inheritedEnv: inheritedEnvDigest({ ...deps.env, ...s.env }), digest });
             } catch { cacheKey = null; }
             const hit = cacheKey ? cache.read(cacheKey) : null;
             if (hit && hit.key === cacheKey && hit.row?.status === "pass" && hit.row.id === s.id && hit.row.command === s.command) {
@@ -959,7 +1396,29 @@ export async function runScans(plan, options = {}) {
               return { ...row, status: "pass", cached: true, detail: `cached ${String(hit.at ?? "").slice(0, 10) || "earlier"}` };
             }
           }
-          const r = await deps.spawn(p.command, s.args.map((a) => (a === "{contentRoot}" ? contentRoot : a)), { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env, ...(extraEnv ?? {}) }, ...sig });
+          let advisory = null; let args = s.args;
+          if (s.advisoryDb) {
+            try { advisory = prepareAdvisory(s); } catch (e) { return { ...row, status: "fail", code: "ADVISORY_DB", detail: e.message }; }
+            // cargo-deny --offline must not fetch the advisory database, but its own `cargo metadata` would then be offline too and
+            // fail on a runner whose cargo cache is cold. The workspace's metadata is resolved first, online and --locked (the
+            // lockfile decides every version), and handed to cargo-deny as a file.
+            if (s.advisoryDb === "deny") {
+              const at = args.indexOf("deny");
+              // The whole document is needed (the concurrent spawn keeps only the tail of stdout), so it streams to the file; a
+              // spawn that does not know `stdoutFile` returns stdout, which is written below.
+              const metadataDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-deny-metadata-"));
+              const metadataFile = path.join(metadataDir, "metadata.json");
+              const metadata = await deps.spawn(p.command, [...args.slice(0, at), ...metadataArgs({ noDeps: false })], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env }, stdoutFile: metadataFile, ...sig });
+              if (!metadata || metadata.error || metadata.status !== 0) { fs.rmSync(metadataDir, { recursive: true, force: true }); advisory.cleanup?.(); return { ...row, status: "fail", code: "EXIT", detail: `cargo metadata for cargo-deny failed: ${metadata?.error?.message ?? (tail(metadata) || `exit ${metadata?.status}`)}` }; }
+              if (!fs.existsSync(metadataFile)) fs.writeFileSync(metadataFile, String(metadata.stdout ?? ""));
+              advisory.metadataPath = metadataFile;
+              const overlayCleanup = advisory.cleanup;
+              advisory.cleanup = () => { fs.rmSync(metadataDir, { recursive: true, force: true }); overlayCleanup?.(); };
+            }
+            args = args.map((a) => (a === "{advisoryDb}" ? advisory.dbDir : a === "{advisoryDenyConfig}" ? advisory.configPath : a === "{advisoryMetadata}" ? advisory.metadataPath : a));
+          }
+          let r;
+          try { r = await deps.spawn(p.command, args.map((a) => (a === "{contentRoot}" ? contentRoot : a)), { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env, ...(extraEnv ?? {}) }, ...sig }); } finally { advisory?.cleanup?.(); }
           if (signal?.aborted && (!r || r.error || r.status !== 0)) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
           if (!r || r.error) { status = "fail"; code = "SPAWN_ERROR"; detail = r?.error?.message ?? "no result"; }
           else if (r.status !== 0) { status = "fail"; code = "EXIT"; detail = tail(r) || `exit ${r.status}`; }
@@ -973,7 +1432,7 @@ export async function runScans(plan, options = {}) {
 
   const cancelled = signal?.aborted === true;
   return {
-    schema: SCAN_RESULT_SCHEMA, ok: !cancelled && results.every((r) => r.status === "pass"), complete: !cancelled && results.every((r) => r.status === "pass"), classes, ...(cancelled ? { cancelled: true } : {}),
+    schema: SCAN_RESULT_SCHEMA, ok: !cancelled && results.every((r) => r.status === "pass"), complete: !cancelled && results.every((r) => r.status === "pass"), classes, checker, ...(cancelled ? { cancelled: true } : {}),
     inputDigest: plan.inputDigest ?? null,
     deferred: results.filter((r) => r.status === "deferred").map((r) => r.id),
     scans: results, toolVersions, cacheHits: [...cacheHits].sort(), notes: plan.notes ?? [],