@rightkit/release 0.6.6 → 0.6.7

package/ownership-class-rules.mjs

@@ -0,0 +1,277 @@
+// Ownership class rules for the app check (plan items 0.5 and 0.6). Code is placed by class, never by consumer count:
+//   foundation    a row of ownership-mandatory-set.json for the app's profile: the app must use its owner;
+//   add-on        any other catalogued capability: RightKit-owned from its first consumer;
+//   app-specific  product domain logic and presentation only.
+// Non-product code stays in an app only under an approved, expiring entry of .rightkit/ownership-exceptions.json that names the
+// RightKit issue that moves it. These two rules run wherever the app check runs (`rightkit-gate check`, `right-release check`, the
+// pre-push hook, the start of every checked right-release command and RightKit's own preflight):
+//
+//   mandatory-foundation  OW-05  an app whose profile requires a foundation owner the app does not declare as a dependency (missing,
+//                                or dev-only), or that selects an unknown or unratified profile. An app is a repository whose root
+//                                holds its declaration, rightkit-mandatory.json, or that ships a desktop app: a root
+//                                right-release.config.(mjs|json), or one beside a src-tauri/tauri.conf.json; when that directory
+//                                holds its own declaration (RightKit's desktop-app-template), its rulings are checked here and its
+//                                owners when the directory is checked as its own root (no TOML parser is needed before install). An app without the
+//                                declaration is a finding, so a missing declaration is never an exemption. A row the app declares not applicable is
+//                                excused only by a ratified ruling: appAmendments.<app>.notApplicable.<row> for the `app` the
+//                                declaration names and its profile, with the reason copied verbatim; any other not-applicable row is
+//                                a finding and the row still applies (rightkit#1140). Owner-pending rows never fail. Below-required versions
+//                                and path/git overrides stay with `right-release ownership-mandatory --enforce` (versions move with
+//                                every publish). Findings carry an identity, so an app may ratchet them in its baseline.
+//   ownership-exceptions  OW-06  every committed .rightkit/ownership-exceptions.json: { schema?: 1, generated?, exceptions: [...] };
+//                                each entry holds only the known keys, with capability, package (or crate), reason, owner,
+//                                approvedBy, a real `date` not later than today, a real `expires` not before `date`, and `issue`, a
+//                                RightKit issue (`<owner>/rightkit#<n>` or https://github.com/<owner>/rightkit/issues/<n>). Schema
+//                                findings carry an identity (an adoption ratchet, bounded by the baseline's 90-day sunset); an entry
+//                                past its `expires` date is a finding with no identity, so no baseline can silence an expiry. Each
+//                                entry must also match a ratified ruling, appAmendments.<app>.exceptions in ownership-mandatory-set.json
+//                                for the `app` the root rightkit-mandatory.json names: same capability, package (or crate), path when
+//                                the ruling names one, and RightKit issue, expiring no later than the ruling. `approvedBy` alone is
+//                                text the app writes; an entry no ruling covers is a finding.
+import fs from "node:fs";
+import path from "node:path";
+
+const readText = (root, rel) => { try { return fs.readFileSync(path.join(root, rel), "utf8"); } catch { return null; } };
+const readJson = (root, rel) => { const text = readText(root, rel); try { return text === null ? null : JSON.parse(text); } catch { return null; } };
+
+// The mandatory-set evaluator parses Cargo.toml (smol-toml). It is loaded only when a checked tree is an app, so a copy of the check
+// without it still runs every other rule; an app whose check cannot load it fails the rule ("the rule itself failed").
+let mandatorySet = null;
+let mandatorySetError = null;
+try { mandatorySet = await import("./ownership-mandatory-set.mjs"); } catch (error) { mandatorySetError = error; }
+
+export const APP_MARKERS = Object.freeze(["rightkit-mandatory.json"]);
+export const APP_DECLARATION_FILE = "rightkit-mandatory.json";
+const RELEASE_CONFIG = /^(?:(.+)\/)?right-release\.config\.(?:mjs|json)$/;
+const SKIPPED_TREE = /(^|\/)(node_modules|vendor|target)\//;
+const MANDATORY_DATA = new URL("./ownership-mandatory-set.json", import.meta.url);
+/** The mandatory-set data, read as JSON (no TOML parser needed), or null when it cannot be read. */
+export function mandatoryData() { try { return JSON.parse(fs.readFileSync(MANDATORY_DATA, "utf8")); } catch { return null; } }
+export const OWNERSHIP_LEDGER_FILE = ".rightkit/ownership-exceptions.json";
+export const LEDGER_TOP_KEYS = Object.freeze(["schema", "generated", "exceptions"]);
+export const LEDGER_ENTRY_KEYS = Object.freeze(["capability", "package", "crate", "path", "fingerprint", "reason", "owner", "approvedBy", "date", "expires", "issue"]);
+const RIGHTKIT_ISSUE = /^(?:https:\/\/github\.com\/([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))\/rightkit\/issues\/([1-9]\d*)|([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))\/rightkit#([1-9]\d*))$/i;
+const todayOf = (now) => (now instanceof Date ? now : new Date()).toISOString().slice(0, 10);
+
+/** True when `text` is a real calendar date written YYYY-MM-DD (UTC). */
+export function isRealDate(text) {
+  if (typeof text !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(text)) return false;
+  const parsed = new Date(`${text}T00:00:00Z`);
+  return !Number.isNaN(parsed.getTime()) && parsed.toISOString().slice(0, 10) === text;
+}
+
+/** The RightKit issue an `issue` field names, as `<owner>/rightkit#<n>`, or null when it names no RightKit issue. */
+export function rightkitIssue(text) {
+  const m = typeof text === "string" ? RIGHTKIT_ISSUE.exec(text.trim()) : null;
+  return m ? `${m[1] ?? m[3]}/rightkit#${m[2] ?? m[4]}` : null;
+}
+
+const nonEmpty = (value) => typeof value === "string" && value.trim().length > 0;
+
+/**
+ * Validate one ledger entry. Returns { problems: [string], expired: boolean }; `expired` is set only for an otherwise dated entry
+ * whose `expires` is before `today` (YYYY-MM-DD, UTC).
+ */
+export function validateLedgerEntry(entry, { today = todayOf() } = {}) {
+  const problems = [];
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return { problems: ["is not an object"], expired: false };
+  const unknown = Object.keys(entry).filter((key) => !LEDGER_ENTRY_KEYS.includes(key));
+  if (unknown.length) problems.push(`unknown key(s) ${unknown.join(", ")} (allowed: ${LEDGER_ENTRY_KEYS.join(", ")})`);
+  for (const key of ["capability", "reason", "owner", "approvedBy"]) if (!nonEmpty(entry[key])) problems.push(`missing ${key}`);
+  if (entry.package !== undefined && entry.crate !== undefined) problems.push("names both package and crate; keep one");
+  else if (!nonEmpty(entry.package ?? entry.crate)) problems.push("missing package (or crate)");
+  for (const key of ["path", "fingerprint"]) if (entry[key] !== undefined && !nonEmpty(entry[key])) problems.push(`${key} must be a non-empty string when present`);
+  const dated = isRealDate(entry.date);
+  if (!dated) problems.push("date must be a real date, YYYY-MM-DD (UTC)");
+  else if (entry.date > today) problems.push(`date ${entry.date} is later than today (${today}, UTC)`);
+  const expiring = isRealDate(entry.expires);
+  if (!expiring) problems.push("expires must be a real date, YYYY-MM-DD (UTC): every exception expires");
+  else if (dated && entry.expires < entry.date) problems.push(`expires ${entry.expires} is before date ${entry.date}`);
+  if (entry.issue === undefined) problems.push("missing issue: the RightKit issue that moves this code into RightKit");
+  else if (!rightkitIssue(entry.issue)) problems.push(`issue ${JSON.stringify(entry.issue)} is not a RightKit issue (<owner>/rightkit#<n> or https://github.com/<owner>/rightkit/issues/<n>)`);
+  return { problems, expired: expiring && entry.expires < today };
+}
+
+/**
+ * Validate one ledger document (parsed JSON, or null when unparseable). Returns [{ problem, fix, subject?, expired? }]:
+ * a schema finding carries a `subject`; an expired entry carries `expired: true` and no subject.
+ */
+export function validateLedger(doc, { today = todayOf() } = {}) {
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return [{ problem: "is not a JSON object { exceptions: [...] }", fix: "write { \"exceptions\": [] } and add approved, expiring entries", subject: "document" }];
+  const out = [];
+  const unknown = Object.keys(doc).filter((key) => !LEDGER_TOP_KEYS.includes(key));
+  if (unknown.length) out.push({ problem: `unknown top-level key(s) ${unknown.join(", ")} (allowed: ${LEDGER_TOP_KEYS.join(", ")})`, fix: "remove them", subject: "document" });
+  if (doc.schema !== undefined && doc.schema !== 1) out.push({ problem: `schema ${JSON.stringify(doc.schema)} is not 1`, fix: "set \"schema\": 1 or drop it", subject: "document" });
+  if (!Array.isArray(doc.exceptions)) { out.push({ problem: "exceptions must be an array", fix: "write \"exceptions\": []", subject: "document" }); return out; }
+  doc.exceptions.forEach((entry, index) => {
+    const label = entry && typeof entry === "object" && !Array.isArray(entry) ? `${entry.capability ?? "?"}/${entry.package ?? entry.crate ?? "?"}${entry.path ? ` ${entry.path}` : ""}` : "?";
+    const { problems, expired } = validateLedgerEntry(entry, { today });
+    if (problems.length) out.push({ problem: `entry #${index} (${label}): ${problems.join("; ")}`, fix: "every exception needs capability, package, reason, owner, approvedBy, date, expires and the RightKit issue that moves the code", subject: `#${index} ${label}` });
+    if (expired) out.push({ problem: `entry #${index} (${label}) expired on ${entry.expires} (today ${today}, UTC); an expired exception is a failure and no baseline lists it`, fix: `move the code into RightKit (${rightkitIssue(entry.issue) ?? "its RightKit issue"}) and remove the entry, or record a fresh approval with a new expires date`, expired: true });
+  });
+  return out;
+}
+
+/**
+ * The ratified ruling that covers a ledger entry, or null. `rulings` is appAmendments.<app>.exceptions: [{ capability, package | crate,
+ * path?, issue, expires }]. A ruling with no `path` covers every path of its capability and package.
+ */
+export function rulingFor(entry, rulings) {
+  if (!entry || typeof entry !== "object" || !Array.isArray(rulings)) return null;
+  const issue = rightkitIssue(entry.issue);
+  return rulings.find((r) => r && r.capability === entry.capability && (r.package ?? r.crate) === (entry.package ?? entry.crate)
+    && (r.path === undefined || r.path === entry.path) && issue !== null && rightkitIssue(r.issue)?.toLowerCase() === issue.toLowerCase()
+    && isRealDate(r.expires) && isRealDate(entry.expires) && entry.expires <= r.expires) ?? null;
+}
+
+/** The declaration as ownership-mandatory-set.mjs reads it (profile and not-applicable rows of 10+ characters), without its TOML parser. */
+function declarationOf(appRoot, data) {
+  const doc = readJson(appRoot, data.appDeclarationFile) ?? {};
+  const notApplicable = {};
+  for (const [id, reason] of Object.entries(doc.notApplicable ?? {})) if (typeof reason === "string" && reason.trim().length >= 10) notApplicable[id] = reason.trim();
+  return { profile: doc.profile ?? data.defaultProfile, notApplicable, records: {}, problems: [] };
+}
+
+/** The `app` a root declaration names, or null. */
+export function declaredApp(root) {
+  const doc = readJson(root, APP_DECLARATION_FILE);
+  return doc && typeof doc === "object" && typeof doc.app === "string" && doc.app.trim() ? doc.app.trim() : null;
+}
+
+/** The ownership-exceptions rule: every committed ledger in the tree. */
+export function ownershipExceptions({ root, files, now }, { data = mandatoryData() } = {}) {
+  const today = todayOf(now);
+  const app = declaredApp(root);
+  const amendment = app && data?.appAmendments ? data.appAmendments[app] : undefined;
+  const rulings = amendment && Array.isArray(amendment.exceptions) ? amendment.exceptions : [];
+  const ledgers = (files ?? []).filter((file) => file === OWNERSHIP_LEDGER_FILE || file.endsWith(`/${OWNERSHIP_LEDGER_FILE}`)).sort();
+  const out = [];
+  for (const file of ledgers) {
+    const text = readText(root, file);
+    let doc = null;
+    try { doc = JSON.parse(text); } catch (error) {
+      out.push({ file, subject: "document", problem: `${file} is not valid JSON (${error.message})`, fix: "repair the JSON" });
+      continue;
+    }
+    for (const finding of validateLedger(doc, { today })) {
+      const { subject, expired, ...rest } = finding;
+      out.push({ ...rest, problem: `${file}: ${rest.problem}`, ...(expired ? {} : { file, subject }) });
+    }
+    (Array.isArray(doc?.exceptions) ? doc.exceptions : []).forEach((entry, index) => {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry) || rulingFor(entry, rulings)) return;
+      const label = `${entry.capability ?? "?"}/${entry.package ?? entry.crate ?? "?"}${entry.path ? ` ${entry.path}` : ""}`;
+      out.push({
+        file, subject: `#${index} ${label} ruling`,
+        problem: `${file}: entry #${index} (${label}) matches no ratified ruling: ${app ? `appAmendments.${app}.exceptions in ownership-mandatory-set.json has none with this capability, ${entry.crate !== undefined ? "crate" : "package"}, path, issue and an expiry no earlier than ${entry.expires}` : `${APP_DECLARATION_FILE} names no "app", so no ruling can apply`}`,
+        fix: `ratify the exception in RightKit (appAmendments.<app>.exceptions, with its issue and expiry) and name the app in ${APP_DECLARATION_FILE}, or move the code into RightKit and remove the entry`,
+      });
+    });
+  }
+  return out;
+}
+
+/** The marker files that make the checked root an app, in APP_MARKERS order. */
+export function appMarkers(root) {
+  return APP_MARKERS.filter((name) => readText(root, name) !== null);
+}
+
+/**
+ * The release configs that make a tree an app even without its declaration: a root right-release.config.(mjs|json), or one whose
+ * directory also holds src-tauri/tauri.conf.json (a packaged desktop app).
+ */
+export function releaseAppMarkers(files) {
+  const tracked = new Set(files ?? []);
+  return [...tracked].filter((file) => {
+    const m = RELEASE_CONFIG.exec(file);
+    if (!m || SKIPPED_TREE.test(file)) return false;
+    return m[1] === undefined || tracked.has(`${m[1]}/src-tauri/tauri.conf.json`);
+  }).sort();
+}
+
+/** Split declared not-applicable rows into those a ratified ruling covers and those it does not. */
+export function ratifiedNotApplicable(declared, { app, profile, data }) {
+  const amendment = app && data?.appAmendments ? data.appAmendments[app] : undefined;
+  const rulings = amendment && amendment.profile === profile && amendment.notApplicable && typeof amendment.notApplicable === "object" ? amendment.notApplicable : {};
+  const ratified = {}, unratified = {};
+  for (const [id, reason] of Object.entries(declared ?? {})) {
+    if (typeof rulings[id] === "string" && rulings[id].trim() === reason.trim()) ratified[id] = reason;
+    else unratified[id] = reason;
+  }
+  return { ratified, unratified, ruled: Boolean(amendment) };
+}
+
+/**
+ * The findings of one app root (`dir` relative to the checked root, "" for the root itself). `owners: false` runs only the checks
+ * that need no TOML parser (the declaration parses; every not-applicable row is ratified): a nested app's foundation owners are
+ * checked when its own directory is checked, so RightKit's preflight, which runs before any install, can still see the rulings.
+ */
+function checkAppRoot({ root, dir, evaluator, data, owners = true }) {
+  const appRoot = dir ? path.join(root, dir) : root;
+  const declarationFile = data.appDeclarationFile;
+  const file = dir ? `${dir}/${declarationFile}` : declarationFile;
+  const out = [];
+  if (readJson(appRoot, declarationFile) === null) {
+    out.push({ file, subject: "declaration", problem: `${file} is not valid JSON, so the app's profile and not-applicable rows cannot be read`, fix: `repair ${file}` });
+    return out;
+  }
+  const declaration = (evaluator ?? { loadAppDeclaration: declarationOf }).loadAppDeclaration(appRoot, data);
+  const app = declaredApp(appRoot);
+  const { ratified, unratified, ruled } = ratifiedNotApplicable(declaration.notApplicable, { app, profile: declaration.profile, data });
+  for (const [row, reason] of Object.entries(unratified)) out.push({
+    file, subject: `notApplicable:${row}`,
+    problem: `notApplicable.${row} ("${reason.slice(0, 80)}${reason.length > 80 ? "..." : ""}") is not a ratified ruling: ${!app ? `${file} names no "app"` : !ruled ? `appAmendments has no entry for "${app}"` : `appAmendments.${app} (profile ${data.appAmendments[app].profile}) has no ruling for ${row} with this reason verbatim for profile ${declaration.profile}`}; the row still applies`,
+    fix: `ratify the ruling in RightKit (appAmendments.${app ?? "<app>"}.notApplicable.${row}, rightkit#1140) and copy its reason verbatim, or adopt the row's owner`,
+  });
+  if (!owners) return out;
+  const report = evaluator.checkApp(appRoot, { data, declaration: { ...declaration, notApplicable: ratified } });
+  for (const owner of report.owners) {
+    if (owner.status === "unknown-profile" || owner.status === "unratified") {
+      out.push({ file, subject: owner.owner, problem: `profile "${report.profile}" is ${owner.status === "unknown-profile" ? "not a profile of ownership-mandatory-set.json" : "not ratified (or has no rows)"}, so no foundation set can be checked`, fix: `select a ratified profile (${Object.entries(data.profiles).filter(([, p]) => p.ratified !== false).map(([name]) => name).join(", ")}) in ${file}` });
+      continue;
+    }
+    if (owner.status !== "missing") continue;
+    const devOnly = owner.evidence.some((line) => line.includes("dev-dependencies"));
+    out.push({
+      file, subject: owner.owner,
+      problem: `profile "${report.profile}" requires the foundation owner ${owner.owner} (${owner.ecosystem}, row${owner.rows.length > 1 ? "s" : ""} ${owner.rows.join(", ")}) and the app does not use it${devOnly ? " (declared only as a dev dependency)" : ""}`,
+      fix: `depend on ${owner.owner} >= ${owner.required} from the registry and use it, or, when the row truly does not apply, declare it under notApplicable in ${file} with the reason RightKit ratified for the app`,
+    });
+  }
+  return out;
+}
+
+/**
+ * The mandatory-foundation rule. The root declaration makes the whole tree one app. Without it, every release config that ships a
+ * desktop app (releaseAppMarkers) is an app: one whose own directory holds a declaration is checked from there; the others are one
+ * finding, the missing declaration (no profile is chosen for the app, so none of its rows can be excused or checked).
+ */
+export function mandatoryFoundation({ root, files }, { evaluator = mandatorySet } = {}) {
+  const markers = appMarkers(root);
+  const releaseMarkers = markers.length ? [] : releaseAppMarkers(files);
+  if (!markers.length && !releaseMarkers.length) return [];
+  const out = [];
+  const declared = [], undeclared = [];
+  for (const marker of releaseMarkers) {
+    const dir = marker.includes("/") ? marker.slice(0, marker.lastIndexOf("/")) : "";
+    (dir && readText(root, `${dir}/${APP_DECLARATION_FILE}`) !== null ? declared : undeclared).push(dir || marker);
+  }
+  if (undeclared.length) out.push({
+    file: APP_DECLARATION_FILE, subject: "declaration",
+    problem: `${undeclared.join(", ")} ships a desktop app, and the repository has no ${APP_DECLARATION_FILE}: an app without its declaration is never exempt from the mandatory foundation set`,
+    fix: `commit ${APP_DECLARATION_FILE} at the root (or beside the app's release config) with the app's "app" name, its "profile" and only the not-applicable rows ratified for it in appAmendments`,
+  });
+  if (!markers.length && !declared.length) return out;
+  if (markers.length) {
+    if (!evaluator) throw new Error(`ownership-mandatory-set.mjs could not be loaded: ${mandatorySetError?.message ?? "unknown error"}`);
+    return checkAppRoot({ root, dir: "", evaluator, data: evaluator.loadData() });
+  }
+  const data = mandatoryData();
+  if (!data) throw new Error("ownership-mandatory-set.json could not be read");
+  for (const dir of declared) out.push(...checkAppRoot({ root, dir, evaluator: null, data, owners: false }));
+  return out;
+}
+
+export const OWNERSHIP_CLASS_RULES = Object.freeze([
+  { id: "mandatory-foundation", gap: "OW-05", run: (ctx) => mandatoryFoundation(ctx) },
+  { id: "ownership-exceptions", gap: "OW-06", run: ownershipExceptions },
+]);

package/ownership-key-authority.mjs

@@ -118,8 +118,10 @@ function persistCheckpoint(trust, bytes, file, audit) {
 export function readCommittedKeyAuthority(trust) { return readAuthority(trust); }
 function readAuthority(trust, { file, audit = auditPath } = {}) {
   try {
-    file ??= trustedPath();
+    // The authority's own shape is judged before anything host-specific: a malformed authority is "malformed" on every
+    // platform, not "unsupported platform" on the hosts that have no protected trust location (fixture scan-error-key-authority-malformed).
     const expected = validateAuthority(trust?.keyAuthority);
+    file ??= trustedPath();
     const top = String(git(expected.checkoutPath, ["rev-parse", "--show-toplevel"])).trim();
     const normalizedTop = process.platform === "win32" ? path.resolve(top).toLowerCase() : path.resolve(top);
     const normalizedExpected = process.platform === "win32" ? expected.checkoutPath.toLowerCase() : expected.checkoutPath;

package/ownership-mandatory-set.mjs

@@ -301,10 +301,11 @@ export function pendingAppliesTo(row, active) {
   return row.profile === "all" || (Array.isArray(row.profile) ? row.profile.includes(active) : row.profile === active);
 }
 
-export function checkApp(root, { data = loadData(), profile, amendments = [] } = {}) {
+// `declaration` replaces the one read from root (the app check passes the declaration with its unratified not-applicable rows removed).
+export function checkApp(root, { data = loadData(), profile, amendments = [], declaration: override = null } = {}) {
   const name = path.basename(root);
   if (!existsSync(root) || !statSync(root).isDirectory()) return { app: name, root, scanned: false, profile: profile ?? data.defaultProfile, owners: [], pending: [], notApplicable: [], problems: ["app root missing"], violations: 0 };
-  const declaration = loadAppDeclaration(root, data);
+  const declaration = override ?? loadAppDeclaration(root, data);
   const active = profile ?? declaration.profile;
   const problems = [...declaration.problems];
   if (!data.profiles[active]) problems.push(`unknown profile "${active}"`);

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-release": "cli/right-release.mjs",
-    "rightkit-gate": "bin/rightkit-gate.mjs"
+    "rightkit-gate": "bin/rightkit-gate.mjs",
+    "rightkit-agent-hook": "bin/rightkit-agent-hook.mjs"
   },
   "exports": {
+    "./bin/rightkit-agent-hook.mjs": "./bin/rightkit-agent-hook.mjs",
     "./bin/rightkit-gate.mjs": "./bin/rightkit-gate.mjs",
     "./cargo-contract.mjs": "./cargo-contract.mjs",
     "./cargo-target.mjs": "./cargo-target.mjs",
@@ -51,7 +53,11 @@
         ],
         "rightkit-gate": [
           "--version"
-        ]
+        ],
+        "rightkit-agent-hook": {
+          "args": [],
+          "output": "{}"
+        }
       }
     }
   },
@@ -61,6 +67,7 @@
     "templates",
     "*.mjs",
     "*.json",
+    "deny-default.toml",
     "*.sh",
     "msix-repair-guard.ps1",
     "bin/darwin/rightkit-swap",

package/publish-cargo.mjs

@@ -16,7 +16,7 @@ import { formatPreflight, PREFLIGHT_FAIL } from "./preflight.mjs";
 import { cargoManifestState } from "./cargo-manifest-text.mjs";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
-const SECRET_PATTERNS = [
+export const SECRET_PATTERNS = [
   /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
   /\bAKIA[0-9A-Z]{16}\b/,
   /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/,
@@ -360,7 +360,10 @@ function scanRepositoryForSecrets(dir, repoRoot) {
       violations.push(`${relative}: refused by name (an .env file, a key or certificate file, or build output); it is never committed and cannot be recorded`);
       continue;
     }
-    const bytes = fs.readFileSync(file);
+    // A file that vanished between the walk and the read was a tool's temporary file (pnpm writes `_tmp_<pid>_*` next to a
+    // lockfile it reads), never committed content.
+    let bytes;
+    try { bytes = fs.readFileSync(file); } catch (e) { if (e.code === "ENOENT") continue; throw e; }
     violations.push(...(ENV_TEMPLATE.test(inDir) ? envTemplateViolations(relative, file, bytes, records, repoRoot) : fileViolations(relative, bytes, records)));
   }
   return [...new Set(violations)].sort();

package/publish-update.mjs

@@ -16,7 +16,7 @@ import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
 import { verifyPlatformTrust } from "./github-release.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
 import { RIGHT_SUITE_API_ORIGIN, RIGHT_SUITE_GATED_ARTIFACT_HOST, RIGHT_SUITE_PUBLIC_INSTALLER_BASE } from "./suite-api.generated.mjs";
-import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, assertUpdaterSignature, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease } from "./github-updater-release.mjs";
+import { assertAssetName, assertGitHubRepository, assertUpdaterKeyId, assertUpdaterPlatform, assertUpdaterSignature, buildLatestJson, githubAssetUrl, githubTag, publishGitHubUpdaterRelease, resolveUpdaterTrust } from "./github-updater-release.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.RIGHTAPPS_API_URL || RIGHT_SUITE_API_ORIGIN;
@@ -119,18 +119,21 @@ function git(args) {
 if (!githubLane && tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if ((githubLane || tier === "update") && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
 
-// Cryptographic gate before any upload: every sealed minisign signature must verify over the
-// exact final artifact bytes against the declared public key. No declared key means the
-// signature cannot be verified, so a sealed (real) publish fails closed; key-id pinning is
-// supplementary only. Integrator owns declaring distribution.updaterPublicKey in app configs
-// (suite key already pinned per-app as tauri plugins.updater.pubkey).
+// Cryptographic gate before any upload: every sealed minisign signature must verify over the exact final artifact
+// bytes against the updater trust root. A Right Suite app takes that key, and its key id, from the Right Suite contract
+// (a declared key must be the contract's) and is always pinned to the id; any other app must declare
+// distribution.updaterPublicKey, and without one a sealed (real) publish fails closed.
 const updaterPublicKey = config.distribution?.updaterPublicKey ?? config.distribution?.updaterPubkey ?? target?.updater?.pubkey ?? target?.updater?.publicKey;
+const trust = sealed && artifacts.length && !appInstallerKind
+  ? resolveUpdaterTrust({ app: config.app, configuredPublicKey: updaterPublicKey, configuredKeyId: config.distribution.updaterKeyId })
+  : null;
 if (sealed) for (const artifact of artifacts) {
   const signature = signatureFor(artifact);
-  if (!appInstallerKind) {
-    if (!updaterPublicKey) throw new PublicationError("PUBLICATION_SIGNATURE_UNVERIFIABLE", `no updater public key declared (distribution.updaterPublicKey); refusing to upload ${path.basename(artifact.file)} with an unverified signature`);
-    assertUpdaterSignature(assertArtifactUnchanged(verifiedArtifact(artifact.file)), signature, updaterPublicKey, `signature of ${path.basename(artifact.file)}`);
-    assertUpdaterKeyId(signature, config.distribution.updaterKeyId, `signature of ${path.basename(artifact.file)}`);
+  if (trust) {
+    const label = `signature of ${path.basename(artifact.file)}`;
+    // The id comes first: a signature by another key would otherwise fail verification without saying whose it is.
+    assertUpdaterKeyId(signature, trust.keyId, label, { app: config.app });
+    assertUpdaterSignature(assertArtifactUnchanged(verifiedArtifact(artifact.file)), signature, trust.publicKey, label);
   }
 }
 let releaseToken = null;
@@ -156,7 +159,7 @@ if (githubLane) {
       const name = assertAssetName(path.basename(file));
       // Same signature source and process as the r2 lane: the sealed minisign .sig written by sign-updater.
       const signature = dryRun ? `<signature:${artifact.signature ?? "msix-authenticode"}>` : signatureFor(artifact);
-      if (!dryRun && !appInstallerKind) assertUpdaterKeyId(signature, config.distribution.updaterKeyId, `signature of ${name}`);
+      if (!dryRun && !appInstallerKind) assertUpdaterKeyId(signature, trust.keyId, `signature of ${name}`, { app: config.app });
       platforms[artifact.platform] = { signature, url: githubAssetUrl(githubRepo, tag, name) };
       assets.set(file, { file, evidence: dryRun ? undefined : verifiedArtifact(file) });
       if (!appInstallerKind) {

package/release-config.mjs

@@ -29,6 +29,7 @@ import { pathToFileURL } from "node:url";
 import { parse as parseToml } from "smol-toml";
 import { collectConfigCommands, formatFindings, validateConfigPipeline } from "./pipeline-config.mjs";
 import { loadGeneratorRegistry } from "./pipeline-generators.mjs";
+import { RIGHT_SUITE_APP_KEYS, RIGHT_SUITE_UPDATER_PUBLIC_KEYS } from "./suite-api.generated.mjs";
 
 export const RELEASE_CONFIG_FILE = "right-release.config.json";
 export const LEGACY_RELEASE_CONFIG_FILE = "right-release.config.mjs";
@@ -267,16 +268,31 @@ export function validateReleaseConfigShape(config, { file = RELEASE_CONFIG_FILE,
   return config;
 }
 
+// The same rule as UPDATER_KEY_ID_RE in github-updater-release.mjs, kept here because that module's import graph loads the release state
+// machine, which this loader must not depend on.
+const UPDATER_KEY_ID = /^[0-9A-F]{16}$/;
+// A typed template ({ "$fromJson": ... }) is a string only after expansion, so the raw-phase check leaves it to the final one.
+const isTemplateNode = (value) => isObject(value) && Object.keys(value).some((key) => key.startsWith("$"));
+const isBlank = (value) => value === undefined || value === null || (typeof value === "string" && !value.trim());
+
 /**
  * Field-level refusals that need no other part of the config, so a caller (the loader, the doctor) can list them next to every other
- * finding: `[{ name, code, pointer, detail }]`. Today: `targets.<t>.updater.keyFile`. Updater minisign keys come from the OS credential
- * provider (`protected-credentials.mjs`, secret "updater-signing-key", namespace `rightsuite-updater-key`; `sign-updater.mjs` refuses
- * `--key-file`), so a config that names a key file could only fail mid-signing. It is refused up front instead, and never forwarded.
+ * finding: `[{ name, code, pointer, detail }]`.
+ *
+ * `targets.<t>.updater.keyFile`: updater minisign keys come from the OS credential provider (`protected-credentials.mjs`, secret
+ * "updater-signing-key", namespace `rightsuite-updater-key`; `sign-updater.mjs` refuses `--key-file`), so a config that names a key
+ * file could only fail mid-signing. It is refused up front instead, and never forwarded.
+ *
+ * `distribution.updaterKeyId` must be 16 upper-case hex digits and, for a Right Suite app, a key the Right Suite contract accepts; a
+ * Right Suite app must not declare an updater public key of its own (`distribution.updaterPublicKey`, `updaterPubkey`,
+ * `targets.<t>.updater.pubkey` or `publicKey`) unless it is exactly a contract key's text. Publish and seal refuse the same things
+ * (`resolveUpdaterTrust`); here they are found before a build starts.
  */
 export function releaseConfigFieldProblems(config) {
   const problems = [];
-  if (!isObject(config) || !isObject(config.targets)) return problems;
-  for (const [name, target] of Object.entries(config.targets)) {
+  if (!isObject(config)) return problems;
+  const targets = isObject(config.targets) ? Object.entries(config.targets) : [];
+  for (const [name, target] of targets) {
     if (!isObject(target) || !isObject(target.updater) || !Object.prototype.hasOwnProperty.call(target.updater, "keyFile")) continue;
     problems.push({
       name: "updater-key-file",
@@ -285,6 +301,35 @@ export function releaseConfigFieldProblems(config) {
       detail: `targets.${name}.updater.keyFile is not supported: updater signing keys come from the OS credential provider (rightkit-credentials, namespace rightsuite-updater-key; see protected-credentials.mjs and sign-updater.mjs), never from a key file. Remove updater.keyFile from the release config.`,
     });
   }
+  const suiteApp = typeof config.app === "string" && RIGHT_SUITE_APP_KEYS.includes(config.app.toLowerCase());
+  const distribution = isObject(config.distribution) ? config.distribution : {};
+  const keyId = distribution.updaterKeyId;
+  if (keyId !== undefined && !isTemplateNode(keyId)) {
+    const accepted = RIGHT_SUITE_UPDATER_PUBLIC_KEYS.map((key) => key.kid);
+    const detail = typeof keyId !== "string" || !UPDATER_KEY_ID.test(keyId)
+      ? `distribution.updaterKeyId must be the 16 upper-case hex digits of a minisign key id, got ${JSON.stringify(keyId)}.`
+      : suiteApp && !accepted.includes(keyId)
+        ? `distribution.updaterKeyId ${keyId} is not an updater key in the Right Suite contract (accepted: ${accepted.join(", ")}). Remove it to sign with the contract's signing key.`
+        : null;
+    if (detail) problems.push({ name: "updater-key-id", code: "RELEASE_CONFIG_UPDATER_KEY_ID", pointer: "/distribution/updaterKeyId", detail });
+  }
+  if (suiteApp) {
+    const contractTexts = RIGHT_SUITE_UPDATER_PUBLIC_KEYS.map((key) => key.publicKey);
+    const declared = (pointer, label, value) => {
+      if (isBlank(value) || isTemplateNode(value) || contractTexts.includes(value)) return;
+      problems.push({
+        name: "updater-public-key",
+        code: "RELEASE_CONFIG_UPDATER_PUBLIC_KEY",
+        pointer,
+        detail: `${label} is not a Right Suite contract key: ${config.app} is a suite app and takes its updater keys from the contract (contracts/right-suite-api.v1.json), so remove ${label}.`,
+      });
+    };
+    for (const field of ["updaterPublicKey", "updaterPubkey"]) declared(`/distribution/${field}`, `distribution.${field}`, distribution[field]);
+    for (const [name, target] of targets) {
+      if (!isObject(target) || !isObject(target.updater)) continue;
+      for (const field of ["pubkey", "publicKey"]) declared(`/targets/${pointerKey(name)}/updater/${field}`, `targets.${name}.updater.${field}`, target.updater[field]);
+    }
+  }
   return problems;
 }
 
@@ -297,7 +342,7 @@ function packageScripts(appRoot, readText) {
 
 /**
  * Load, validate and expand a release config. Returns `{ config, configPath, appRoot, sha256, inputs, lineOf }`. Throws ReleaseConfigError
- * (RELEASE_CONFIG_LEGACY_EXECUTABLE | _NOT_JSON | _NOT_FOUND | _INVALID_JSON | _SCHEMA | _KEY | _UPDATER_KEY_FILE | _TEMPLATE | _M24). `validatePipeline: false`
+ * (RELEASE_CONFIG_LEGACY_EXECUTABLE | _NOT_JSON | _NOT_FOUND | _INVALID_JSON | _SCHEMA | _KEY | _UPDATER_KEY_FILE | _UPDATER_KEY_ID | _UPDATER_PUBLIC_KEY | _TEMPLATE | _M24). `validatePipeline: false`
  * skips only the M24 command admission (the pipeline scanner reports those findings itself); nothing else is optional.
  * File access, the generator registry, the environment and the home directory are injectable for tests.
  */