@rightkit/release 0.6.5 → 0.6.7

package/binary-license-notices.mjs

@@ -18,6 +18,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { escapeHtml } from "./npm-license-notices.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
@@ -123,7 +124,7 @@ export function generateBinaryNotices({ appRoot, config, flags = {}, check = fal
 }
 
 export function parseBinaryNoticeArgs(argv) {
-  const opts = { config: "right-release.config.mjs", output: undefined, productName: undefined, receipt: undefined, check: false };
+  const opts = { config: defaultReleaseConfigFile(), output: undefined, productName: undefined, receipt: undefined, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--output" || arg === "--product-name" || arg === "--receipt") {

package/build-release.mjs

@@ -23,7 +23,8 @@ import { spawn, spawnSync } from "./background-process.mjs";
 import { RightKitRegistryError, SNAPSHOT_ENV, SNAPSHOT_FILE, assertManifestRegistryEvidence, loadAdmittedSnapshot, prepareRightKitResolution, registryManifestFields, rightKitLockInventory, writeAdmissionRecord, writeSnapshot } from "./rightkit-registry-resolver.mjs";
 import { formatAdmission, formatNotRun, runAdmission } from "./admission.mjs";
 import { sccacheRefusal } from "./admission-host.mjs";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
+import { fileURLToPath } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { admitSourceQa } from "./release-qa-audit.mjs";
@@ -51,7 +52,7 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { ANDROID_RECEIPT_NAME, androidSealEntry, validateAndroidTarget, verifyAndroidReceipt } from "./android-release.mjs";
 import { IOS_RECEIPT_NAME, iosSealEntry, verifyIosReceipt } from "./ios-package-recipe.mjs";
 import { expandIosPackageTarget } from "./package-recipe-targets.mjs";
-import { assertUpdaterSignature } from "./github-updater-release.mjs";
+import { assertUpdaterKeyId, assertUpdaterSignature, isSuiteUpdaterApp, resolveUpdaterTrust } from "./github-updater-release.mjs";
 
 // The iOS lane's own packaging code, kept out of the win/mac fingerprint for the same reason as the Android one.
 const IOS_PIPELINE_FINGERPRINT = createHash("sha256")
@@ -111,7 +112,7 @@ const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
 const RELEASE_TOOL_VERSION = JSON.parse(readFileSync(path.join(TOOL_ROOT, "package.json"), "utf8")).version;
 const args = process.argv.slice(2);
-let configName = "right-release.config.mjs";
+let configName = defaultReleaseConfigFile();
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let dryRun = false;
 let skipChecks = false;
@@ -195,7 +196,7 @@ try {
   const shortCommit = commit.slice(0, 8);
   const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
   if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
-  const config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default;
+  const config = await importReleaseConfig(configPath, { query: `commit=${commit}` });
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
     fail("app and version must be safe release-id components");
@@ -566,7 +567,7 @@ async function admit() {
     commit = git(invocationRoot, ["rev-parse", "HEAD"]);
     const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
     if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
-    try { config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default; } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
+    try { config = await importReleaseConfig(configPath, { query: `commit=${commit}` }); } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
   } catch (error) {
     if (error?.reported) process.exit(1);
     throw error;
@@ -630,7 +631,7 @@ function sqlCipherFeatures(text) {
 }
 
 function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields }) {
-  // Every app's right-release.config.mjs names installer/updater artifacts
+  // Every app's release config names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
   // targetBridge.ensure() deliberately leaves a real local directory alone,
@@ -687,17 +688,24 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
   }
   if (sources.size === 0) fail(`nothing to seal: declare installer.artifacts, updater.artifacts or artifacts for the ${platform} target`);
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
-  // Every minisign updater requires an explicit trust root & full-byte signature
-  // verification before any seal directory or artifact copy is created.
+  // Every minisign updater is checked against a trust root, by key id and over the full bytes, before any seal directory or
+  // artifact copy is created. A Right Suite app's root is the Right Suite contract's; any other app must declare its own key.
   const updaterPublicKey = config.distribution?.updaterPublicKey ?? config.distribution?.updaterPubkey ?? target?.updater?.pubkey ?? target?.updater?.publicKey;
   if ((target.updater?.artifacts?.length ?? 0) > 0 && target.updater?.kind !== "appinstaller") {
-    if (typeof updaterPublicKey !== "string" || !updaterPublicKey.trim()) fail("updater public key is required to verify updater artifacts before sealing");
+    if (!isSuiteUpdaterApp(config.app) && (typeof updaterPublicKey !== "string" || !updaterPublicKey.trim())) fail("updater public key is required to verify updater artifacts before sealing");
+    let trust;
+    try { trust = resolveUpdaterTrust({ app: config.app, configuredPublicKey: updaterPublicKey, configuredKeyId: config.distribution?.updaterKeyId }); }
+    catch (error) { fail(`updater trust rejected at seal: ${error.message}`); }
     for (const artifact of target.updater?.artifacts ?? []) {
       const source = resolveArtifactPath(artifact.file);
       const signature = readFileSync(resolveArtifactPath(artifact.signature), "utf8").trim();
       if (!signature) fail(`updater signature is empty, refusing to seal: ${artifact.signature}`);
-      try { assertUpdaterSignature(readFileSync(source), signature, updaterPublicKey, `signature of ${path.basename(artifact.file)}`); }
-      catch (error) { fail(`updater signature rejected at seal: ${error.message}`); }
+      const label = `signature of ${path.basename(artifact.file)}`;
+      // The id comes first: a signature by another key would otherwise fail verification without saying whose it is.
+      try {
+        assertUpdaterKeyId(signature, trust.keyId, label, { app: config.app });
+        assertUpdaterSignature(readFileSync(source), signature, trust.publicKey, label);
+      } catch (error) { fail(`updater signature rejected at seal: ${error.message}`); }
     }
   }
   // Android: the build receipt must describe exactly the AAB being sealed (bytes re-hashed) and its signer must be the pinned
@@ -1053,7 +1061,7 @@ function writeJson(file, value) {
 }
 
 function usage(code) {
-  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.mjs] [--dry-run]");
+  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.json] [--dry-run]");
   process.exit(code);
 }
 

package/cache-command.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import {
   applyCachePrune,
   inspectCache,
@@ -12,6 +12,7 @@ import {
   resolveSharedCacheIdentity,
   resolveSharedCacheRoot,
 } from "./cache-policy.mjs";
+import { importReleaseConfig } from "./release-config.mjs";
 import { resolveReleaseLayout } from "./release-state.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
@@ -52,11 +53,11 @@ export async function runCacheCommand(args = process.argv.slice(2), { env = proc
   }
   if (command === "migrate") {
     const configPath = option(rest, "--config");
-    if (!configPath) throw new Error("cache migrate requires --config <right-release.config.mjs>");
+    if (!configPath) throw new Error("cache migrate requires --config <right-release.config.json>");
     rejectUnknown(rest.filter((value) => value !== "--config" && value !== configPath), new Set(["--json", "--dry-run", "--apply"]));
     if (rest.includes("--dry-run") && rest.includes("--apply")) throw new Error("cache migrate accepts either --dry-run or --apply");
     const configFile = path.resolve(configPath);
-    const config = (await import(pathToFileURL(configFile).href)).default;
+    const config = await importReleaseConfig(configFile);
     if (!config?.app) throw new Error("cache migrate config must expose app");
     const appRoot = path.dirname(configFile);
     const configuredTarget = config.targets?.[platform] ?? {};

package/cargo-license-notices.mjs

@@ -15,6 +15,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
@@ -73,7 +74,7 @@ export function generateCargoNotices({ appRoot, config, flags = {}, check = fals
 }
 
 export function parseCargoNoticeArgs(argv) {
-  const opts = { config: "right-release.config.mjs", output: undefined, check: false };
+  const opts = { config: defaultReleaseConfigFile(), output: undefined, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--output") {

package/cargo-manifest-text.mjs

@@ -0,0 +1,25 @@
+// A line reading of the [package] table of a Cargo.toml, for the scans that must run without a TOML parser (the license scan and
+// the secret scan of the repository gate). This module has no imports on purpose: publish-cargo.mjs is in the trusted runtime
+// helper closure (scripts/ci/runtime-supplement.mjs), which may only follow static relative imports of plain modules.
+
+/**
+ * `{ hasPackage, unpublished }` for the text of a Cargo.toml: whether it has a `[package]` table, and whether that table says
+ * `publish = false` or `publish = []`. A crate that can never be published ships its licence to no one, like a package.json with
+ * `"private": true`. An array-of-tables header (`[[bin]]`, `[[package.metadata.x]]`) starts a new table like any other, so a
+ * `publish` key under it is not the package's.
+ */
+export function cargoManifestState(text) {
+  let table = "";
+  let hasPackage = false;
+  let unpublished = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    const header = /^\s*\[\[?([^\]]+)\]\]?\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      table = header[1].trim();
+      if (table === "package") hasPackage = true;
+      continue;
+    }
+    if (table === "package" && /^\s*publish\s*=\s*(?:false\b|\[\s*\])/.test(line)) unpublished = true;
+  }
+  return { hasPackage, unpublished };
+}

package/cargo-profile-contract.mjs

@@ -19,6 +19,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse } from "smol-toml";
 import { findCargoManifests, isExcludedScanDirectory } from "./cargo-contract.mjs";
+import { defaultReleaseConfigFile, isJsonReleaseConfig } from "./release-config.mjs";
 
 export const CARGO_PROFILE_TEMPLATE = fileURLToPath(new URL("./templates/cargo-profiles.toml", import.meta.url));
 export const RETIRED_PROFILE = "release-iterate";
@@ -74,28 +75,40 @@ export function checkManifestProfiles(manifest, template, file) {
 // Non-shipping workspaces: fixed prefixes plus the app's declared `cargoProfileExempt` directories.
 const NON_SHIPPING_PREFIXES = ["qa", "benchmarks"];
 const CARGO_PROFILE_EXEMPT_KEY = "cargoProfileExempt";
-const RELEASE_CONFIG = "right-release.config.mjs";
 const STRING_LITERAL = /"([^"\\\n]*)"|'([^'\\\n]*)'/g;
 
-// release.mjs imports the app's release config as an ES module. This scanner is synchronous and has only the
-// app root, so it reads the literal `cargoProfileExempt` array from the same file: every entry must be a plain
-// string literal naming a directory inside the app. Anything else is a finding, never silently ignored.
+// This scanner is synchronous and has only the app root, so it reads `cargoProfileExempt` from the release config file itself and
+// never imports it. A JSON config (the one `defaultReleaseConfigFile` picks when it exists) is parsed as data: the array must hold
+// plain strings. A legacy `.mjs` config, which release.mjs still imports as an ES module, is read as text: the literal array must
+// hold plain string literals. Either way every entry names a directory inside the app, and anything else is a finding, never
+// silently ignored. M24 command admission is not run here: this is a pure file reader.
 export function readCargoProfileExempt(root) {
-  const file = path.join(root, RELEASE_CONFIG);
+  const configFile = defaultReleaseConfigFile(root);
+  const file = path.join(root, configFile);
   const findings = [];
   if (!existsSync(file)) return { paths: [], findings };
-  const match = new RegExp(`\\b${CARGO_PROFILE_EXEMPT_KEY}\\s*:\\s*\\[([^\\]]*)\\]`).exec(readFileSync(file, "utf8"));
-  if (!match) return { paths: [], findings };
-  const body = match[1];
-  if (body.replace(STRING_LITERAL, "").replace(/[,\s]/g, "") !== "") {
-    findings.push({ rule: "invalid-exempt", file: RELEASE_CONFIG, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of string literals` });
+  let entries;
+  if (isJsonReleaseConfig(configFile)) {
+    let declared;
+    try { declared = JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, ""))?.[CARGO_PROFILE_EXEMPT_KEY]; }
+    catch (error) { return { paths: [], findings: [{ rule: "invalid-exempt", file: configFile, message: `is not valid JSON, so ${CARGO_PROFILE_EXEMPT_KEY} cannot be read: ${error.message}` }] }; }
+    if (declared === undefined) return { paths: [], findings };
+    if (!Array.isArray(declared) || declared.some((entry) => typeof entry !== "string")) findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of strings` });
+    entries = Array.isArray(declared) ? declared.filter((entry) => typeof entry === "string") : [];
+  } else {
+    const match = new RegExp(`\\b${CARGO_PROFILE_EXEMPT_KEY}\\s*:\\s*\\[([^\\]]*)\\]`).exec(readFileSync(file, "utf8"));
+    if (!match) return { paths: [], findings };
+    const body = match[1];
+    if (body.replace(STRING_LITERAL, "").replace(/[,\s]/g, "") !== "") {
+      findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of string literals` });
+    }
+    entries = [...body.matchAll(STRING_LITERAL)].map(([, double, single]) => double ?? single);
   }
   const paths = [];
-  for (const [, double, single] of body.matchAll(STRING_LITERAL)) {
-    const entry = double ?? single;
+  for (const entry of entries) {
     const normalized = path.posix.normalize(entry.replace(/\\/g, "/")).replace(/\/+$/, "");
     if (normalized === "." || normalized === "" || path.posix.isAbsolute(normalized) || normalized.split("/").includes("..")) {
-      findings.push({ rule: "invalid-exempt", file: RELEASE_CONFIG, message: `${CARGO_PROFILE_EXEMPT_KEY} entry ${JSON.stringify(entry)} must be a relative directory inside the app` });
+      findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} entry ${JSON.stringify(entry)} must be a relative directory inside the app` });
     } else paths.push(normalized);
   }
   return { paths, findings };

package/cli/right-release.mjs

@@ -13,6 +13,7 @@ const commands = new Map([
   ["publish", "upload-release.mjs"],
   ["upload", "upload-release.mjs"],
   ["deps", "deps.mjs"],
+  ["update", "outdated-command.mjs"],
   ["publish-update", "publish-update.mjs"],
   ["hardening", "hardeningscan.mjs"],
   ["harden", "hardeningscan.mjs"],
@@ -56,8 +57,27 @@ const args = process.argv.slice(2);
 const first = args[0];
 // The commands that compile, package, sign, ship or inspect a release run the app check (../app-check.mjs, CHECKED_COMMANDS) in this
 // process before they start a child. A red check prints its findings and exits 1; there is no flag that skips it.
+const WORKTREE_COMPILES = new Set(["dev", "test", "stage-sidecar"]);
 async function requireGreenCheck() {
-  const { guardCommand } = await import("../app-check.mjs");
+  const { guardCommand, checkedCommandOf, checkModeFor, appDirectory } = await import("../app-check.mjs");
+  // One door (Adrian, 2026-10-25): a commit-bound command (build, package, release, qa, upload, publish, signing) runs only when
+  // rightkit-gate --to launched it for HEAD, after class A and the compile stage passed.
+  const checked = checkedCommandOf(args);
+  // dev, test and stage-sidecar work on the uncommitted tree but compile, so they too run only under a door run
+  // (rightkit-gate --to dev|test, class A on the working tree first).
+  // Gate on the mode, not the key: a flag-first call (`right-release --platform mac`) is a build with no command word.
+  if (checkModeFor(args) === "commit" || (checked && WORKTREE_COMPILES.has(checked))) {
+    const { requireDoorRun } = await import("../gate-stages.mjs");
+    const { spawnSync } = await import("../background-process.mjs");
+    const cwd = appDirectory(args, process.cwd());
+    const gitOut = (a) => { const r = spawnSync("git", a, { cwd, encoding: "utf8" }); return r.status === 0 ? r.stdout.trim() : ""; };
+    const common = gitOut(["rev-parse", "--git-common-dir"]);
+    // Outside a git repository the app check below refuses (nothing can be bound to a commit); inside one, only a door run admits.
+    if (common) {
+      const refusal = requireDoorRun({ commonDir: path.resolve(cwd, common), commit: gitOut(["rev-parse", "HEAD"]), command: `right-release ${checked ?? args.join(" ")}`.trim() });
+      if (refusal) { console.error(`right-release: ${refusal}`); process.exit(2); }
+    }
+  }
   const refused = guardCommand({ args });
   if (!refused) return;
   for (const line of refused.lines) console.error(line);
@@ -102,9 +122,11 @@ if (first === "--version" || first === "-v") {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
 } else if (first === "check") {
-  // The same offline check as `rightkit-gate check`; the repository is the git top-level of --config's folder, else the cwd.
-  const { appDirectory, main } = await import("../app-check.mjs");
-  process.exit(await main(args.slice(1), { label: "check", cwd: appDirectory(args, process.cwd()) }));
+  // Exactly `rightkit-gate check` (one door): the app check, then every class A scan over the whole commit. The repository is the git
+  // top-level of --config's folder, else the cwd.
+  const { appDirectory } = await import("../app-check.mjs");
+  const { main } = await import("../bin/rightkit-gate.mjs");
+  process.exit(await main(["check", ...args.slice(1)], { cwd: appDirectory(args, process.cwd()) }));
 } else if (first === "hooks" && args[1] === "install") {
   // One installer: `hooks install` is `rightkit-gate install-hook` (pre-push check and gate, ownership pre-commit step) run in the app.
   const app = args.indexOf("--app");
@@ -295,8 +317,12 @@ Commands:
   ios-credentials store --key-id <KEYID> --issuer <uuid> | check
                                                       Put the App Store Connect API key (stdin), key id and issuer into the login Keychain once, or check them; never a file (macOS)
   qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa (and the journeys lane when the config sets qa.journeys) and write the sealed QA receipt. Refused inside a QA run. The receipt must match the platform and release id, come from an approved runner digest, and show every release-critical journey passed
-                                                      Admission is per app in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks build, upload and publish. Only adrian moves an app from refuse back to warn
+                                                      Admission is per app, and per stage (source = build, installed = upload and publish), in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks that stage. Only adrian moves an app or stage from refuse back to warn, or approves a runner
   qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
+  qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]
+                                                      Show the QA admission policy, or set an app's mode (both stages, or one with --stage)
+  qa policy approve-runner --runner <file> --version <v> --platform mac|win --set-by adrian [--note <text>]
+                                                      Approve a rightkit-qa runner build for one platform: the file must report "rightkit-qa <v>" from --version and <v> must be the published version
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
@@ -368,9 +394,13 @@ Commands:
   disk check [--json]                                Per-writer sizes vs caps and free-space floor (exit 3 on warning)
   disk sweep [--dry-run] [--days N] [--delete] [--json]
                                                       Move stale idle heavy data to the heavy volume (delete only with --delete)
-  disk run                                           self-check, check, dry-run sweep, move sweep, warn (the scheduled job)
-  disk schedule install|uninstall|status             Daily launchd job (Mac) / hidden Task Scheduler entry (Windows), bound to the stable per-user copy
+  disk run [--auto|--light]                          self-check, then the full pass (check, sweep, purge, daily report); --light is the stat-only hourly pass (floors, temp-like writers, scratch; purges only below the agent volume's soft floor); --auto picks full once a day after 03:30, else light (the scheduled job)
+  disk run-root <name> [--days N] [--json]           Lease a run directory under the scratch root (default 3 days): the sweep skips it until the lease ends
+  disk run-root --release <name>                     End a run-root lease
+  disk schedule install|uninstall|status             Hourly launchd job (Mac) / hidden Task Scheduler entry (Windows) running "disk run --auto", bound to the stable per-user copy; status fails when no full pass finished in 26 h
   deps --check|--audit|--update                      Shared dependency lane
+  update check|apply|gate|land|discard|run|schedule [--repo <path>]
+                                                      Run the pinned @rightkit/outdated updater (right-update) that moves stale pins; reads .rightkit/update.json
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background

package/command-spec.mjs

@@ -5,13 +5,12 @@
 // `cwd` and `node` are app-relative and may not leave the app. `nodeFlags` go before the script, `nodeOptions` are merged
 // (de-duplicated) into NODE_OPTIONS for the child. Unknown keys are refused so a typo cannot silently change a run.
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 
-/** Load an app's `right-release.config.mjs`; the app root is the config file's directory. */
-export async function loadAppConfig(configFile = "right-release.config.mjs") {
+/** Load an app's release config (`right-release.config.json`, or the legacy `.mjs` while it is the only one); the app root is the config file's directory. */
+export async function loadAppConfig(configFile = defaultReleaseConfigFile()) {
   const configPath = path.resolve(configFile);
-  const loaded = await import(pathToFileURL(configPath).href);
-  return { config: loaded.default ?? loaded.config ?? loaded, appRoot: path.dirname(configPath), configPath };
+  return { config: await importReleaseConfig(configPath, { lenient: true }), appRoot: path.dirname(configPath), configPath };
 }
 
 export class CommandSpecError extends Error {

package/compile-inputs.mjs

@@ -0,0 +1,66 @@
+// The declared compile inputs a RustRight broker captured for a compile (RIGHTKIT_COMPILE_INPUTS): the gate judges exactly
+// those bytes, where the broker copied them, so what is checked is what the compile reads. The tree's tracked files are
+// judged from the commit as always; the declared inputs are the ignored paths (a built `dist`, generated assets) the
+// commit does not hold, listed in the captured tree's `.rightkit/compile-inputs.json`.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { SECRET_PATTERNS } from "./publish-cargo.mjs";
+
+export const COMPILE_INPUTS_FILE = ".rightkit/compile-inputs.json";
+
+/** Files of one declared input in the broker's order (children by name), refusing links; [{ name, abs }]. */
+function inputFiles(root, input) {
+  const out = [];
+  const walk = (abs, name) => {
+    const st = fs.lstatSync(abs);
+    if (st.isSymbolicLink()) throw new Error(`declared compile input holds a symbolic link at ${name}`);
+    if (st.isDirectory()) {
+      for (const child of fs.readdirSync(abs).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) walk(path.join(abs, child), `${name}/${child}`);
+    } else if (st.isFile()) out.push({ name, abs });
+  };
+  walk(path.join(root, input), input);
+  return out;
+}
+
+/**
+ * Judges the captured declared inputs under `root`: each declared path must exist without links; every `.js/.mjs/.cjs`
+ * file parses (`node --check`), every `.json` file parses, and no file carries a secret. Returns { inputs: [{ path, sha256,
+ * files }], findings: [string] }; `sha256` is computed as the broker records it (name, NUL, bytes, NUL per file, in order),
+ * so the receipt and the gate name the same bytes.
+ */
+export function judgeCompileInputs(root, { spawn = spawnSync, execPath = process.execPath } = {}) {
+  const findings = [];
+  let declared = [];
+  const file = path.join(root, COMPILE_INPUTS_FILE);
+  if (!fs.existsSync(file)) return { inputs: [], findings };
+  try {
+    declared = JSON.parse(fs.readFileSync(file, "utf8")).inputs;
+    if (!Array.isArray(declared) || declared.some((p) => typeof p !== "string")) throw new Error("`inputs` must be a list of paths");
+  } catch (e) {
+    return { inputs: [], findings: [`${COMPILE_INPUTS_FILE}: ${e.message}`] };
+  }
+  const inputs = [];
+  for (const input of declared) {
+    if (path.isAbsolute(input) || input.split(/[\\/]/).some((part) => part === ".." || part === "." || part === "")) { findings.push(`${input}: not a plain relative path`); continue; }
+    let files;
+    try { files = inputFiles(root, input); } catch (e) { findings.push(`${input}: ${e.code === "ENOENT" ? "missing from the captured tree" : e.message}`); continue; }
+    const hash = crypto.createHash("sha256");
+    for (const f of files) {
+      const bytes = fs.readFileSync(f.abs);
+      hash.update(f.name); hash.update(Buffer.from([0])); hash.update(bytes); hash.update(Buffer.from([0]));
+      const text = bytes.toString("utf8");
+      if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) findings.push(`${f.name}: holds a secret (token or private key pattern)`);
+      if (/\.(m|c)?js$/.test(f.name)) {
+        const r = spawn(execPath, ["--check", f.abs], { encoding: "utf8" });
+        if (r.status !== 0) findings.push(`${f.name}: does not parse (${String(r.stderr ?? "").split("\n").find((l) => /Error/.test(l))?.trim() ?? `node --check exit ${r.status}`})`);
+      }
+      if (/\.json$/.test(f.name)) {
+        try { JSON.parse(text); } catch (e) { findings.push(`${f.name}: invalid JSON (${e.message})`); }
+      }
+    }
+    inputs.push({ path: input, sha256: hash.digest("hex"), files: files.length });
+  }
+  return { inputs, findings };
+}