@rightkit/release 0.6.8 → 0.6.11

package/local-publish.mjs

@@ -13,6 +13,7 @@
 // all-features check, packaging, gate, publish and registry readback, and writes its own evidence file. Crates
 // of one dependency layer publish concurrently (bounded); layer N+1 starts only after every layer-N crate is
 // visible in the registry index with the verified checksum.
+import { buildLaunch } from "./build-launch.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
@@ -28,6 +29,7 @@ import { refuseHostUpload } from "./host-upload-refusal.mjs";
 import { pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
 import { recordPublished, stageSourceVersions, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
+import { requireDoorRun, gateStateDir } from "./gate-stages.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
 export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
@@ -46,6 +48,12 @@ export const DEFAULT_CONCURRENCY = 4;
 const MAX_CONCURRENCY = 8;
 const CRATE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const JOBS_SUBCOMMANDS = new Set(["test", "clippy", "check", "package"]);
+// The argv of the broker jobs a unit's compile and package stages launch. Built here, once, for the stages themselves and for
+// stage-commands.mjs, which derives what a qualification's signed receipts must show (the hosted admission and the gate share it).
+export const qualifyFmtArgs = (unit) => ["fmt", "-p", unit, "--check"];
+export const npmPackArgs = (packDir, scratch) => ["--dir", packDir, "pack", "--pack-destination", scratch];
+export const cargoPackageArgs = (unit, qualifyOnly) => ["package", "--locked", ...(qualifyOnly ? [] : ["--no-verify"]), "-p", unit];
+export const CARGO_METADATA_ARGS = Object.freeze(["metadata", "--offline", "--format-version", "1", "--no-deps"]);
 export function withCargoJobs(args, jobs) {
   return jobs !== undefined && JOBS_SUBCOMMANDS.has(args[0])
     ? [args[0], "--jobs", String(jobs), ...args.slice(1)] : args;
@@ -121,8 +129,8 @@ export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
     if (arg === "--local") local = true;
     else if (arg === flag) unit = argv[++i];
     else if (arg === "--workspace") workspace = argv[++i];
-    else if (kind === "cargo" && arg === "--qualify-only") qualifyOnly = true;
-    else if (kind === "cargo" && arg === "--bundle") bundle = argv[++i];
+    else if (arg === "--qualify-only") qualifyOnly = true;
+    else if (arg === "--bundle") bundle = argv[++i];
     // Same meaning as publish.yml's allow_ignored: this unit may have ignored tests; the count is recorded.
     else if (arg === "--allow-ignored") allowIgnored = true;
     else if (kind === "cargo" && arg === "--crates") crates = crateList(argv[++i], "--crates");
@@ -365,31 +373,26 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
 
 /**
  * The clippy invocations that replace each crate's own `cargo clippy -p <crate> --no-deps --all-targets
- * <featureSets[0]> -- -D warnings`: same flags and lint level, so the same lints on the same code. Crates
- * whose first feature set is empty or `--all-features` share one `-p a -p b` invocation (the flags mean the
- * same for every crate); any other feature set runs per crate, because `--features x` must not reach a crate
- * that lacks x. The caller passes ONE dependency layer: no selected crate depends on another, so `-p` does not
- * unify extra features into a selected crate and each is linted with exactly the features it was before.
- * Crates with a different RIGHTKIT_REQUIRE_ASSETS (asset-gated) stay apart so the environment is unchanged.
+ * <featureSets[0]> -- -D warnings`: same flags and lint level, so the same lints on the same code. Every crate is its own
+ * Cargo workspace with its own Cargo.lock (rightkit#1285), so cargo runs in that crate's directory and one invocation never
+ * names two crates: one `-p <crate>` run per crate and feature set, in layer order. Crates with a different
+ * RIGHTKIT_REQUIRE_ASSETS (asset-gated) keep their own environment.
  */
 export function batchClippyInvocations(layer, { featuresOf = () => [], featureSetsOf = (unit) => [featuresOf(unit)], assetGatedOf = () => false } = {}) {
-  const groups = new Map();
+  const invocations = [];
   for (const unit of layer) {
     // Every tested feature set of a crate is linted, in order; identical sets of one crate collapse to one run.
     const sets = featureSetsOf(unit) ?? [[]];
     const unique = sets.filter((set, index) => sets.findIndex((other) => JSON.stringify(other ?? []) === JSON.stringify(set ?? [])) === index);
     for (const set of unique) {
       const features = set ?? [];
-      const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
-      const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}:${JSON.stringify(features)}`;
-      if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
-      groups.get(key).crates.push(unit);
+      invocations.push({
+        crates: [unit], assetGated: assetGatedOf(unit),
+        args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
+      });
     }
   }
-  return [...groups.values()].map(({ crates, features, assetGated }) => ({
-    crates, assetGated,
-    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
-  }));
+  return invocations;
 }
 
 const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
@@ -414,6 +417,19 @@ function assertLocalHost(deps, workspaceRoot, kind) {
 
 // Host uploads are retired: only --qualify-only (no upload) runs. The upload engine below is kept for direct calls in
 // tests; no CLI path reaches it (see host-upload-refusal.mjs).
+/** One door: a publish engine entry (the CLI's `publish <kind> --local`, or a direct call of the engine) runs only inside a
+ * live rightkit-gate door run for the workspace's HEAD (RK_GATE_RUN; gate-stages requireDoorRun). The unit stages
+ * (compileLocalUnit and its successors) never pass through here: they are the gate's own path and carry their own door. */
+export function requireEngineDoor(parsed, { env = process.env, git = defaultGit, command = "right-release publish --local" } = {}) {
+  const root = parsed.workspaceRoot;
+  const common = git(["rev-parse", "--git-common-dir"], root);
+  const commit = git(["rev-parse", "HEAD"], root);
+  if (!common || !/^[0-9a-f]{40}$/.test(commit ?? "")) refuse(`${command} runs only inside a rightkit-gate door run of a git checkout (no HEAD or common dir in ${root})`);
+  const denial = requireDoorRun({ env, commonDir: path.resolve(root, common), commit, command });
+  if (denial) refuse(denial);
+  return { commit, commonDir: path.resolve(root, common) };
+}
+
 export async function runLocalPublish(kind, argv, deps = {}) {
   const parsed = parseLocalPublishArgs(kind, argv, deps.cwd);
   if (!parsed.qualifyOnly) refuseHostUpload(`right-release publish ${kind} --local`);
@@ -422,10 +438,101 @@ export async function runLocalPublish(kind, argv, deps = {}) {
 
 export async function runLocalPublishUploadEngine(kind, argv, deps = {}) {
   const parsed = parseLocalPublishArgs(kind, argv, deps.cwd);
+  (deps.requireDoor ?? requireEngineDoor)(parsed, { env: deps.env ?? process.env, command: `right-release publish ${kind} --local` });
   if (parsed.batch) return runLocalPublishBatch(parsed, deps);
   return publishUnit(parsed, deps, null);
 }
 
+// Stage state never leaves this process: persisted receipts are reports, not authority to skip unit tests.
+const unitStages = new WeakMap();
+
+/**
+ * A unit stage built from a door SNAPSHOT (item 7 row 7.06a): `source` is { checkout, commit, tree } of the commit the door selected,
+ * and `--workspace` is the gate-owned snapshot of it. Identity is that commit's immutable objects, read from the CHECKOUT's object
+ * database, plus the door's start and end verification of the snapshot; it is never the checkout's HEAD or status. The git calls of
+ * the unit flow are mapped: HEAD and its tree are the selection, `status` is clean by the door's verify, `show HEAD:<path>` and
+ * `ls-files --error-unmatch` read the selected commit, and everything else runs in the checkout.
+ */
+export function sourceGit(source, git = defaultGit) {
+  return (args, cwd) => {
+    const [a, b] = args;
+    if (a === "rev-parse" && b === "HEAD") return source.commit;
+    if (a === "rev-parse" && b === "HEAD^{tree}") return source.tree;
+    if (a === "status") return "";
+    if (a === "show" && /^HEAD:/.test(b ?? "")) return git(["show", `${source.commit}:${b.slice(5)}`], source.checkout);
+    if (a === "ls-files" && b === "--error-unmatch") { const files = args.slice(args.indexOf("--") + 1); for (const f of files) if (git(["cat-file", "-e", `${source.commit}:${f}`], source.checkout) === null) return null; return files.join("\n"); }
+    return git(args, source.checkout);
+  };
+}
+
+/** The local-build grant read from the SELECTED COMMIT (`git show <commit>:.rightkit-local-build.json`), its repository checked against the checkout's origin. */
+export function localBuildGrantedAt(source, git = defaultGit) {
+  try {
+    const grant = JSON.parse(git(["show", `${source.commit}:${LOCAL_BUILD_FILE}`], source.checkout) ?? "null");
+    if (grant?.allow !== "build-test-publish" || typeof grant.repository !== "string") return false;
+    const origin = git(["config", "--get", "remote.origin.url"], source.checkout) ?? "";
+    const repo = /github\.com[:/]([^/]+\/[^/.\s]+?)(?:\.git)?\/?$/i.exec(origin)?.[1];
+    return !!repo && repo.toLowerCase() === grant.repository.toLowerCase();
+  } catch { return false; }
+}
+
+function assertUnitDoor(root, stage, env, identity, source = null) {
+  const commit = source ? source.commit : defaultGit(["rev-parse", "HEAD"], root);
+  const tree = source ? source.tree : defaultGit(["rev-parse", "HEAD^{tree}"], root);
+  const common = defaultGit(["rev-parse", "--git-common-dir"], source ? source.checkout : root);
+  if (!/^[0-9a-f]{40}$/.test(commit ?? "") || !/^[0-9a-f]{40}$/.test(tree ?? "") || !common) refuse("cannot bind unit stage to HEAD and tree");
+  if (identity && (identity.commit !== commit || identity.tree !== tree)) refuse("unit stage HEAD or tree changed");
+  // The snapshot route has no checkout cleanliness to ask: the door verifies the snapshot against the commit at each stage's start and end.
+  const dirty = source ? "" : defaultGit(["status", "--porcelain", "--untracked-files=no"], root);
+  if (dirty === null || dirty !== "") refuse("unit stage requires a clean tracked checkout");
+  const commonDir = path.resolve(source ? source.checkout : root, common);
+  const denial = requireDoorRun({ env, commonDir, commit, command: `unit ${stage}` });
+  if (denial) refuse(denial);
+  let run;
+  try { run = JSON.parse(fs.readFileSync(path.join(gateStateDir(commonDir), "runs", `${env.RK_GATE_RUN}.json`), "utf8")); } catch { refuse("cannot read the unit door run"); }
+  if (run.stage !== stage || run.tree !== tree) refuse(`unit ${stage} needs its own live door run for this tree`);
+  return { commit, tree };
+}
+
+export async function compileLocalUnit(kind, argv, { env = process.env, source = null } = {}) {
+  const parsed = parseLocalPublishArgs(kind, argv);
+  if (!parsed.qualifyOnly || parsed.batch) refuse("unit stages require one --qualify-only unit and a new bundle");
+  const identity = assertUnitDoor(parsed.workspaceRoot, "compile", env, undefined, source);
+  const runner = publishUnitStages(parsed, source ? { env, git: sourceGit(source), localBuildGranted: () => localBuildGrantedAt(source) } : { env }, null);
+  try {
+    const step = await runner.next();
+    if (step.done || step.value?.stage !== "compile") refuse("unit compile did not complete");
+    assertUnitDoor(parsed.workspaceRoot, "compile", env, identity, source);
+    const state = Object.freeze({});
+    unitStages.set(state, { runner, parsed, identity, source, stage: "compile", compileRequests: [...(step.value.brokerRequests ?? [])] });
+    return state;
+  } catch (error) { await runner.return(); throw error; }
+}
+
+async function advanceLocalUnit(state, expected, stage, env) {
+  const entry = unitStages.get(state);
+  if (!entry || entry.stage !== expected) refuse(`unit ${stage} requires this process's completed ${expected} stage`);
+  entry.stage = "running";
+  try {
+    assertUnitDoor(entry.parsed.workspaceRoot, stage, env, entry.identity, entry.source);
+    const step = await entry.runner.next(env);
+    if (stage === "package" ? step.done || step.value?.stage !== "package" : !step.done || !step.value?.qualifiedOnly) refuse(`unit ${stage} did not complete`);
+    assertUnitDoor(entry.parsed.workspaceRoot, stage, env, entry.identity, entry.source);
+    entry.stage = stage;
+    if (stage === "qualify") unitStages.delete(state);
+    return step.value;
+  } catch (error) { unitStages.delete(state); await entry.runner.return(); throw error; }
+}
+
+export const packageLocalUnit = (state, { env = process.env } = {}) => advanceLocalUnit(state, "compile", "package", env);
+export const qualifyLocalUnit = (state, { env = process.env } = {}) => advanceLocalUnit(state, "package", "qualify", env);
+/** The broker request ids of this process's completed compile stage (the package stage's ride on its result). */
+export const localUnitCompileRequests = (state) => [...(unitStages.get(state)?.compileRequests ?? [])];
+export async function closeLocalUnit(state) {
+  const entry = unitStages.get(state);
+  if (entry) { unitStages.delete(state); await entry.runner.return(); }
+}
+
 /**
  * Qualify and publish ONE unit. `batch` (cargo batch mode only) is `{ head, tree, receipt, commands }`: the
  * batch-level fmt, secret scan and clippy already ran at `head`/`tree`, so this unit skips its own clippy and
@@ -433,11 +540,31 @@ export async function runLocalPublishUploadEngine(kind, argv, deps = {}) {
  * publish and the registry readback) runs for this unit exactly as in single mode.
  */
 async function publishUnit(parsed, deps, batch) {
+  const runner = publishUnitStages(parsed, deps, batch);
+  let result;
+  do { result = await runner.next(); } while (!result.done);
+  return result.value;
+}
+
+async function* publishUnitStages(parsed, deps, batch) {
   const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
   const { kind, unit, allowIgnored, workspaceRoot } = parsed;
   const git = deps.git ?? defaultGit;
   const readJson = deps.readJson ?? defaultReadJson;
-  const run = deps.run ?? (batch ? defaultRunAsync : defaultRun);
+  // Every broker job a stage launches prints `rustright: request <id>`; the unit gate fetches those jobs' signed receipts, so the ids
+  // are collected here per stage and handed over at each stage yield (compile, then package). Nothing about what runs changes.
+  const brokerRequests = [];
+  const noteBrokerRequests = (result) => { for (const [, id] of `${result?.stdout ?? ""}\n${result?.stderr ?? ""}`.matchAll(/^rustright: request ([0-9a-f-]{36})/gm)) if (!brokerRequests.includes(id)) brokerRequests.push(id); return result; };
+  const launch = deps.run ?? (batch ? defaultRunAsync : defaultRun);
+  // Every pnpm step goes through the one door for build and test launches (build-launch.mjs): a rightkit-pnpm broker job on a
+  // managed host (refused, never run directly, when the broker is unreachable), direct on a host without one. A run headed to release
+  // then also has the signed receipt each stage owes (stage-commands.mjs). Other commands (cargo is already a broker job) are unchanged.
+  const run = (command, args, options) => {
+    const target = command === "pnpm" ? buildLaunch(command, args, { env: options?.env ?? process.env, platform: deps.platform ?? process.platform, exists: fs.existsSync }) : { command, args };
+    const result = launch(target.command, target.args, options);
+    return typeof result?.then === "function" ? result.then(noteBrokerRequests) : noteBrokerRequests(result);
+  };
+
 
   // 1. Preconditions, fail closed.
   const platform = assertLocalHost(deps, workspaceRoot, kind);
@@ -465,9 +592,24 @@ async function publishUnit(parsed, deps, batch) {
     const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
     if (tree !== batch.tree) refuse(`${unit}: HEAD tree ${tree} differs from the batch tree ${batch.tree}`);
   }
-  const dirty = git(["status", "--porcelain", "--", dir, ...GATE_CONFIG_FILES, ...(parsed.qualifyOnly ? ["Cargo.toml", "Cargo.lock"] : [])], workspaceRoot);
+  const feedPath = "packages/release/rightkit-versions.json";
+  // `dir` holds the crate's own Cargo.toml and Cargo.lock (each crate is its own workspace, #1285); a sibling crate it path-depends on
+  // shapes what is built, so its directory must match the commit too.
+  const siblingDirs = kind === "cargo" ? pathDependencyDirs(unitPath).map((sibling) => path.relative(workspaceRoot, sibling).split(path.sep).join("/")).filter((sibling) => sibling && !sibling.startsWith("..")) : [];
+  const guardedPaths = [dir, ...siblingDirs, ...GATE_CONFIG_FILES, ...(parsed.qualifyOnly && kind === "npm" ? [feedPath] : [])];
+  const dirty = git(["status", "--porcelain", "--", ...guardedPaths], workspaceRoot);
   if (dirty === null) refuse(`cannot read git status for ${dir}`);
   if (dirty !== "") refuse(`tree is not clean for ${dir} or the gate config (${GATE_CONFIG_FILES.join(", ")}); commit first:\n${dirty}`);
+  if (parsed.qualifyOnly && kind === "npm") {
+    const feedFile = path.join(workspaceRoot, feedPath);
+    if (unit === "@rightkit/release" && !fs.existsSync(feedFile)) refuse(`${unit}: committed ${feedPath} is required before packing`);
+    if (fs.existsSync(feedFile)) {
+      const committedFeed = git(["show", `HEAD:${feedPath}`], workspaceRoot);
+      if (committedFeed === null || committedFeed !== fs.readFileSync(feedFile, "utf8").trim()) refuse(`${feedPath} must match the committed HEAD before qualification`);
+      const feed = readJson(feedFile) ?? refuse(`cannot read ${feedPath}`);
+      if (feed.stagedNpm?.[unit] !== version && feed.registry?.npm?.[unit] !== version) refuse(`${unit}@${version}: stage the version in ${feedPath} and commit it before qualification`);
+    }
+  }
   if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
   log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
@@ -484,10 +626,10 @@ async function publishUnit(parsed, deps, batch) {
     if (consumerDirty === null) refuse(`cannot read git status for the consumer rows of ${unit}`);
     if (consumerDirty !== "") refuse(`tree is not clean for the consumer rows of ${unit}; commit first:\n${consumerDirty}`);
   }
-  if (parsed.qualifyOnly) {
+  if (parsed.qualifyOnly && kind === "cargo") {
     const violations = (deps.scanSecrets ?? scanCrateForSecrets)(unitPath);
     if (violations.length) refuse(`qualification secret scan rejected: ${violations.join(", ")}`);
-    plan.steps.unshift({ command: "cargo", args: ["fmt", "-p", unit, "--check"], test: false });
+    plan.steps.unshift({ command: "cargo", args: qualifyFmtArgs(unit), test: false });
   }
   const modules = await (deps.loadWorkspaceModules ?? defaultLoadWorkspaceModules)(workspaceRoot);
   const { ResultScanner, TEST_COMMAND, judgeUnit } = modules.results;
@@ -496,11 +638,14 @@ async function publishUnit(parsed, deps, batch) {
   // written reason in ci/gate.config.json (rust.<crate>.allowIgnored). The count stays in the evidence.
   const configReason = kind === "cargo" && typeof gateConfig?.rust?.[unit]?.allowIgnored === "string" ? gateConfig.rust[unit].allowIgnored.trim() : "";
   const ignoredAllowed = Boolean(allowIgnored || parsed.allowIgnoredUnits?.includes(unit) || configReason);
-  const steps = parsed.qualifyOnly ? [{ command: `scanCrateForSecrets ${dir}`, ok: true }] : [];
+  const steps = parsed.qualifyOnly && kind === "cargo" ? [{ command: `scanCrateForSecrets ${dir}`, ok: true }] : [];
   for (const step of plan.steps) {
     const commandText = `${step.command} ${step.args.join(" ")}`;
     log(`[right-release] ${plan.id}: ${commandText}`);
-    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: workspaceRoot, env });
+    // A crate's own steps run in its Cargo workspace (its own Cargo.lock and target directory, #1285); a consumer row names its
+    // separate workspace by --manifest-path relative to the repository root.
+    const stepCwd = kind === "cargo" && step.command === "cargo" && !step.args.includes("--manifest-path") ? unitPath : workspaceRoot;
+    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: stepCwd, env });
     const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
     if (result.error || result.status !== 0) {
       steps.push(row);
@@ -519,40 +664,55 @@ async function publishUnit(parsed, deps, batch) {
   if (verdict.status === "fail" || steps.some((s) => s.failed > 0)) refuse(`${plan.id} not qualified: ${verdict.problems.join("; ") || "failed tests reported"}`);
   if (!(verdict.executed > 0)) refuse(`${plan.id} executed no test`);
   log(`[right-release] ${plan.id}: ${verdict.executed} passed, 0 failed, ${verdict.skipped} skipped, ${verdict.ignored} ignored${isAssetGated ? " (asset-gated: RIGHTKIT_REQUIRE_ASSETS=0, skips recorded)" : ""}`);
+  const packageEnv = yield { stage: "compile", kind, name: unit, version, commit: head, brokerRequests: brokerRequests.splice(0) };
+  if (packageEnv) Object.assign(env, testEnv({ env: packageEnv }, isAssetGated));
 
   // 3. Pack the artifact and hash it.
-  const scratch = fs.mkdtempSync(path.join(deps.tmpdir ?? os.tmpdir(), "rk-local-publish-"));
+  // An npm pack is a broker job whose --dir and --pack-destination the adapter accepts only under the host's scratch root, so it
+  // packs there (the workspace rule for run output) rather than in the OS temp directory.
+  const scratchRoot = deps.tmpdir ?? (kind === "npm" ? (platform === "win32" ? "D:\\scratch" : "/Volumes/D/scratch") : os.tmpdir());
+  const scratch = fs.mkdtempSync(path.join(scratchRoot, "rk-local-publish-"));
   const cleanup = () => fs.rmSync(scratch, { recursive: true, force: true });
   try {
     let artifactFile; const packCommands = [];
+    let packDir = dir;
     if (kind === "npm" && unit === SWAP_HELPER_PACKAGE) {
+      if (parsed.qualifyOnly) {
+        // Signing writes its binary and receipt. Keep both in the pack copy, never the source checkout.
+        packDir = path.join(scratch, "package-source");
+        fs.cpSync(unitPath, packDir, { recursive: true, filter: (source) => path.basename(source) !== "node_modules" });
+      }
       // #258: the package ships a Developer-ID-signed bin/darwin/rightkit-swap; build, sign and verify it before packing (fails closed).
-      try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: unitPath, platform, run, env, log }); }
+      try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: parsed.qualifyOnly ? packDir : unitPath, platform, run, env, log }); }
       catch (error) { refuse(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
       packCommands.push(`rustright cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
     }
     if (kind === "npm") {
       // The feed a tarball ships must list the version it ships with (#319): stage it before packing.
       const feedFile = path.join(workspaceRoot, "packages", "release", "rightkit-versions.json");
-      if (fs.existsSync(feedFile)) await withVersionsLock(() => (deps.stageSourceVersions ?? stageSourceVersions)([{ registry: "npm", name: unit, version }], { file: feedFile, root: workspaceRoot, log }));
-      const args = ["--dir", dir, "pack", "--pack-destination", scratch];
+      if (!parsed.qualifyOnly && fs.existsSync(feedFile)) await withVersionsLock(() => (deps.stageSourceVersions ?? stageSourceVersions)([{ registry: "npm", name: unit, version }], { file: feedFile, root: workspaceRoot, log }));
+      // The tarball goes to an empty `pack` directory inside the scratch directory: the adapter takes --pack-destination only as a
+      // child of a scratch directory (never the scratch directory itself) and refuses one that already holds a tarball.
+      const packOut = path.join(scratch, "pack");
+      fs.mkdirSync(packOut);
+      const args = npmPackArgs(packDir, packOut);
       packCommands.push(`pnpm ${args.join(" ")}`);
       const packed = await run("pnpm", args, { cwd: workspaceRoot, env });
       if (packed.error || packed.status !== 0) refuse(`pnpm pack failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
-      artifactFile = path.join(scratch, tarballName(unit, version));
+      artifactFile = path.join(packOut, tarballName(unit, version));
       if (!fs.existsSync(artifactFile)) refuse(`pnpm pack did not produce ${path.basename(artifactFile)}`);
       const checked = modules.checkNpmTarball({ file: artifactFile, name: unit, version, dir, spawn: deps.spawnSync ?? spawnSync });
       if (checked.problems.length) refuse(`${unit}: packed tarball refused:\n  - ${checked.problems.join("\n  - ")}`);
     } else {
       // A combined publish verifies once in `cargo publish`; detached qualification verifies here before
       // its evidence leaves this host, so the publishing host can reuse that exact archive's proof.
-      const packageArgs = ["package", "--locked", ...(parsed.qualifyOnly ? [] : ["--no-verify"]), "-p", unit];
+      const packageArgs = cargoPackageArgs(unit, parsed.qualifyOnly);
       packCommands.push(`cargo ${packageArgs.join(" ")}`);
-      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: workspaceRoot, env });
+      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: unitPath, env });
       if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
       if (parsed.qualifyOnly) steps.push({ command: `cargo ${packageArgs.join(" ")}`, ok: true });
-      const metadataArgs = ["metadata", "--offline", "--format-version", "1", "--no-deps"];
-      const meta = await runCargoReadOnly(metadataArgs, { cwd: workspaceRoot, env }, (_command, args, settings) => run("cargo", args, settings),
+      const metadataArgs = [...CARGO_METADATA_ARGS];
+      const meta = await runCargoReadOnly(metadataArgs, { cwd: unitPath, env }, (_command, args, settings) => run("cargo", args, settings),
         (failed) => log(`[right-release] offline Cargo metadata missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`));
       const actualMetadataArgs = meta.usedOfflineFallback ? metadataArgs.filter((arg) => arg !== "--offline") : metadataArgs;
       packCommands.push(`cargo ${actualMetadataArgs.join(" ")}`);
@@ -565,6 +725,16 @@ async function publishUnit(parsed, deps, batch) {
       if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
     }
     const artifactSha256 = sha256(fs.readFileSync(artifactFile));
+    if (parsed.qualifyOnly && (git(["rev-parse", "HEAD"], workspaceRoot) !== head || git(["status", "--porcelain", "--", ...guardedPaths], workspaceRoot) !== "")) refuse("qualification inputs changed while preparing the artifact; no bundle was created");
+    if (parsed.qualifyOnly) {
+      fs.mkdirSync(parsed.bundleDir, { recursive: false });
+      const bundledArtifact = path.join(parsed.bundleDir, path.basename(artifactFile));
+      fs.copyFileSync(artifactFile, bundledArtifact, fs.constants.COPYFILE_EXCL);
+      if (sha256(fs.readFileSync(bundledArtifact)) !== artifactSha256) refuse("qualification archive changed while copying");
+      artifactFile = bundledArtifact;
+      yield { stage: "package", kind, name: unit, version, commit: head, artifactFile, artifactSha256, brokerRequests: brokerRequests.splice(0) };
+      if (sha256(fs.readFileSync(artifactFile)) !== artifactSha256) refuse("qualification archive changed after packaging");
+    }
 
     // 4. Evidence in the normal schema, then the EXISTING gate.
     const commands = [...plan.steps.map((s) => `${s.command} ${s.args.join(" ")}`), ...packCommands, ...(batch ? batch.commands : [])];
@@ -583,23 +753,21 @@ async function publishUnit(parsed, deps, batch) {
         steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
       }],
     };
-    const evidencePath = path.resolve(defaultEvidencePath(workspaceRoot, kind, unit));
+    // A qualification writes its evidence beside the bytes, in the bundle: the tracked release-evidence/gate file is the record of a
+    // host publish, and rewriting it would dirty the checkout the unit door guards (the first `--to release --unit` run stopped
+    // there, 2026-10-27). Never overwrite a bundle's evidence.
+    const evidencePath = parsed.qualifyOnly ? path.join(parsed.bundleDir, "gate.json") : path.resolve(defaultEvidencePath(workspaceRoot, kind, unit));
     fs.mkdirSync(path.dirname(evidencePath), { recursive: true });
-    fs.writeFileSync(evidencePath, `${JSON.stringify(evidence, null, 2)}\n`);
+    fs.writeFileSync(evidencePath, `${JSON.stringify(evidence, null, 2)}\n`, { flag: parsed.qualifyOnly ? "wx" : "w" });
     log(`[right-release] wrote ${evidencePath} (artifact sha256 ${artifactSha256})`);
-    const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath };
+    const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath, artifactBytes: fs.readFileSync(artifactFile) };
     (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { write: (line) => log(line.replace(/\n$/, "")) });
 
     if (parsed.qualifyOnly) {
-      // Keep bytes and their normal gate evidence together outside the checkout. Never overwrite a bundle.
-      fs.mkdirSync(parsed.bundleDir, { recursive: false });
-      const bundledArtifact = path.join(parsed.bundleDir, path.basename(artifactFile));
-      const bundledEvidence = path.join(parsed.bundleDir, "gate.json");
-      fs.copyFileSync(artifactFile, bundledArtifact, fs.constants.COPYFILE_EXCL);
-      if (sha256(fs.readFileSync(bundledArtifact)) !== artifactSha256) refuse("qualification archive changed while copying");
-      fs.copyFileSync(evidencePath, bundledEvidence, fs.constants.COPYFILE_EXCL);
-      log(`[right-release] qualified ${unit}@${version}; bundle ${parsed.bundleDir}; publish cargo --crate ${unit} --from-evidence ${bundledEvidence}`);
-      return { kind, name: unit, version, commit: head, artifactSha256, evidencePath: bundledEvidence, artifactFile: bundledArtifact, qualifiedOnly: true };
+      // Bytes and evidence stay together outside the checkout.
+      const bundledEvidence = evidencePath;
+      log(`[right-release] qualified ${unit}@${version}; bundle ${parsed.bundleDir}${kind === "cargo" ? `; publish cargo --crate ${unit} --from-evidence ${bundledEvidence}` : ""}`);
+      return { kind, name: unit, version, commit: head, artifactSha256, evidencePath: bundledEvidence, artifactFile, qualifiedOnly: true };
     }
 
     // 5. The EXISTING publish path.
@@ -666,11 +834,11 @@ async function runLocalPublishBatch(parsed, deps) {
   if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
   const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
   if (!tree || !/^[0-9a-f]{40}$/.test(tree)) refuse("cannot resolve the HEAD tree");
-  // Every batch crate, the workspace manifest and lock, the gate config and EVERY crate's consumer directories must
-  // match the commit the batch checks are bound to, before the first layer publishes (0.4.1 review A3, A4).
-  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock", ...GATE_CONFIG_FILES, ...batchConsumerDirs], workspaceRoot);
+  // Every batch crate (its own Cargo.toml and Cargo.lock live in its directory, #1285), the gate config and EVERY crate's
+  // consumer directories must match the commit the batch checks are bound to, before the first layer publishes (0.4.1 review A3, A4).
+  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), ...GATE_CONFIG_FILES, ...batchConsumerDirs], workspaceRoot);
   if (dirty === null) refuse("cannot read git status for the batch");
-  if (dirty !== "") refuse(`tree is not clean for the batch crates, the workspace manifest, the gate config or a consumer directory; commit first:\n${dirty}`);
+  if (dirty !== "") refuse(`tree is not clean for the batch crates, the gate config or a consumer directory; commit first:\n${dirty}`);
   const registryHas = deps.registryHas ?? defaultRegistryHas;
   const published = (await Promise.all(crates.map(async (unit) => ((await registryHas({ kind: "cargo", name: unit, version: versions.get(unit) })) ? `${unit}@${versions.get(unit)}` : null)))).filter(Boolean);
   if (published.length) refuse(`already on the crates.io registry: ${published.join(", ")}; bump the version or remove them from the batch`);
@@ -680,15 +848,18 @@ async function runLocalPublishBatch(parsed, deps) {
   const env = testEnv(deps, false);
   const stamp = { commit: head, tree };
   const checks = []; const commands = [];
-  const batchCheck = async (name, command, args, crateNames, runEnv = env) => {
+  // One recorded check; `cwds` are the crate workspaces it runs in (each crate is its own Cargo workspace, #1285), once each.
+  const batchCheck = async (name, command, args, crateNames, runEnv = env, cwds = [workspaceRoot]) => {
     const text = `${command} ${args.join(" ")}`;
     log(`[right-release] batch ${name}: ${text}`);
-    const result = await run(command, args, { cwd: workspaceRoot, env: runEnv });
-    if (result.error || result.status !== 0) refuse(`batch ${name} failed (${result.error?.message ?? `exit ${result.status}`}): ${text}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    for (const cwd of cwds) {
+      const result = await run(command, args, { cwd, env: runEnv });
+      if (result.error || result.status !== 0) refuse(`batch ${name} failed (${result.error?.message ?? `exit ${result.status}`}): ${text}${cwd === workspaceRoot ? "" : ` (in ${path.relative(workspaceRoot, cwd)})`}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    }
     checks.push({ name, command: text, ok: true, ...stamp, ...(crateNames ? { crates: crateNames } : {}) });
     commands.push(text);
   };
-  await batchCheck("fmt", "cargo", ["fmt", "--all", "--check"]);
+  await batchCheck("fmt", "cargo", ["fmt", "--all", "--check"], undefined, env, crates.map((unit) => path.join(workspaceRoot, "crates", unit)));
   log("[right-release] batch secret-scan: crate directories of the batch");
   const scan = deps.scanSecrets ?? scanCrateForSecrets;
   const violations = crates.flatMap((unit) => scan(path.join(workspaceRoot, "crates", unit)).map((file) => `${unit}: ${file}`));
@@ -699,7 +870,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const featureSetsOf = (unit) => gateConfig?.rust?.[unit]?.featureSets ?? [[]];
   for (const layer of layers) {
     for (const invocation of batchClippyInvocations(layer, { featureSetsOf, assetGatedOf: isAssetGated })) {
-      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated));
+      await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated), invocation.crates.map((unit) => path.join(workspaceRoot, "crates", unit)));
     }
   }
   const receipt = { id: `batch-${head.slice(0, 12)}-${sha256(JSON.stringify(layers)).slice(0, 8)}`, ...stamp, crates, checks };

package/local-qualify.mjs

@@ -370,7 +370,7 @@ function brokerIdentity(deps) {
   return { name: "rustright", client: String(client).replaceAll("\\", "/"), sha256: sha256((deps.readFile ?? fs.readFileSync)(client)) };
 }
 
-// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim (scripts/local-gate.mjs).
+// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim.
 function detectCargoCommand(deps) {
   const which = (command) => {
     const result = (deps.run ?? spawnSync)((deps.platform ?? process.platform) === "win32" ? "where" : "which", [command], { encoding: "utf8", windowsHide: true });
@@ -406,14 +406,16 @@ async function localScanRecord({ root, commit, crates, jobs, scratch, deps, log
     const repo = path.join(exportRoot, "rightkit");
     const tracked = String((deps.git ?? defaultGit)(["ls-files", "-z"], root) ?? "").split("\0").filter(Boolean);
     const unitDirs = crates.map((name) => `crates/${name}/`);
-    // Workspace-level scans (lock, deny, audit, workflows, YAML) plus every scan of the units; other crates and npm packages stay out of scope.
+    // Repository-level scans (workflows, YAML) plus every scan of the units, each in its own crate workspace (lock, deny, audit); other crates and npm packages stay out of scope.
     const files = tracked.filter((file) => (!file.startsWith("crates/") && !file.startsWith("packages/")) || unitDirs.some((dir) => file.startsWith(dir)));
     const crateFeatures = (deps.readJson ?? defaultReadJson)(path.join(repo, "ci", "gate.config.json"))?.rust ?? {};
     const plan = (deps.planScans ?? planScans)({ changed: files, contentRoot: repo, liveRoot: root, includeTests: false, localCompile: true, cargoCommand: detectCargoCommand(deps), crateFeatures, readBytes: (file) => fs.readFileSync(file) });
     const observedTools = modules.observeToolVersions();
     log(`[local-qualify] scans: ${plan.scans.length} planned over ${files.length} files (class A, then class B through the broker)`);
     const result = await (deps.runScans ?? runScans)(plan, { classes: ["A", "B"], jobs: Math.max(1, Number(jobs ?? 4) || 4), onResult: (row, progress) => log(`[local-qualify] scan [${progress.done}/${progress.total}] ${row.status.padEnd(7)} ${row.id}`) });
-    return modules.buildLocalScanRecord({ result, planned: plan.scans, sourceCommit: commit, headCommit: commit, cargoLockSha256: sha256(fs.readFileSync(path.join(root, "Cargo.lock"))), observedTools, units: crates, files: files.length });
+    // Every unit is bound to its own crate workspace lock (#1285): crates/<x>/Cargo.lock, no root lock.
+    const cargoLocks = Object.fromEntries([...crates].sort().map((name) => [name, { path: `crates/${name}/Cargo.lock`, sha256: sha256(fs.readFileSync(path.join(root, "crates", name, "Cargo.lock"))) }]));
+    return modules.buildLocalScanRecord({ result, planned: plan.scans, sourceCommit: commit, headCommit: commit, cargoLocks, observedTools, units: crates, files: files.length });
   } finally { fs.rmSync(exportRoot, { recursive: true, force: true }); }
 }
 

package/local-runtime.mjs

@@ -163,8 +163,9 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const bindings = {};
   for (const full of [...lsTree([`crates/${crate}/src`]), `crates/${crate}/Cargo.toml`]) bindings[full] = sha256(blob(full));
   Object.assign(bindings, owner.bindHarnessMetadata(crate, prescription, blob));
-  for (const full of lsTree(["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo", `crates/${crate}/benches`, "crates/rightkit-child-process/src", "crates/rightkit-child-process/Cargo.toml"])) bindings[full] = sha256(blob(full));
-  const { specs, problems: scopeProblems = [] } = (deps.measuredPathspecs ?? H.budgets.measuredPathspecs)(crateDir);
+  // Each crate is its own Cargo workspace with its own Cargo.lock (#1285): the same context files scripts/ci/runtime-qualify.mjs binds.
+  for (const full of lsTree([`crates/${crate}/Cargo.toml`, `crates/${crate}/Cargo.lock`, "rust-toolchain.toml", ".cargo", `crates/${crate}/.cargo`, `crates/${crate}/benches`, "crates/rightkit-child-process/src", "crates/rightkit-child-process/Cargo.toml"])) bindings[full] = sha256(blob(full));
+  const { specs, problems: scopeProblems = [] } = (deps.measuredPathspecs ?? H.budgets.measuredPathspecs)(crateDir, { base: root });
   if (scopeProblems.length) throw new Error(`cannot bind the measured dependency scope: ${scopeProblems.join("; ")}`);
   for (const full of lsTree(specs)) bindings[full] = sha256(blob(full));
   const helpers = Object.fromEntries(H.helperPaths().map((name) => [name, sha256(blob(name))]));
@@ -174,9 +175,9 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const socket = discoverBrokerSocket(deps.env ?? process.env, { platform });
   if (socket) brokerEnv.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
   const run = deps.run ?? ((command, args, settings) => spawnCollect(command, args, { maxBuffer: 64 * 1024 * 1024, ...settings }));
-  const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: root, windowsHide: true, ...settings });
+  const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: crateDir, windowsHide: true, ...settings });
   const toolchainOf = async () => {
-    const rustc = await run(cargoCommand[0] === "rustright" ? "rustright" : "rustc", cargoCommand[0] === "rustright" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
+    const rustc = await run(cargoCommand[0] === "rustright" ? "rustright" : "rustc", cargoCommand[0] === "rustright" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: crateDir, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
     const cargo = await invoke(["-V"], { env: { ...baseEnv, ...brokerEnv }, timeout: 60_000 });
     if (rustc.error || rustc.status !== 0 || cargo.error || cargo.status !== 0) throw new Error("cannot read the toolchain through the broker");
     return { rustc: String(rustc.stdout).trim(), cargo: String(cargo.stdout).trim() };

package/mac-package-recipe.mjs

@@ -18,6 +18,7 @@ import { buildDmg } from "./dmg-build.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { signMacosEntries } from "./mac-sign-core.mjs";
 import { mainExecutableName } from "./mac-bundle-signing.mjs";
+import { resolveArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
 import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { runMacCodesignCommands, signMacUpdaterFiles } from "./macos-signing-session.mjs";
@@ -160,10 +161,12 @@ const defaultInspect = (cmd, args) => {
  * signUpdater(files, options), receiptPath, log(event).
  */
 export function runMacPackageRecipe({ appRoot, config = {}, target, deps = {} }) {
+  let artifactPaths = null;
   const { recipe, app: declaredApp, dmgFile } = validateMacPackageTarget(target);
   const {
     platform = process.platform, env = process.env, fs = nodeFs,
-    resolveArtifact = (root, p) => path.resolve(root, p),
+    // A door split (row 7.04c, R-T2) reads a declared target path in the bound Cargo target, never the snapshot's or the checkout's; outside a split this is path.resolve.
+    resolveArtifact = (root, p) => { artifactPaths ??= splitArtifactContext({ cwd: root, env, target }); return artifactPaths.mode === "split" ? resolveArtifactPath(p, artifactPaths) : path.resolve(root, p); },
     resolveIdentity = resolveMacosDeveloperIdIdentity,
     signOne = (codesignArgs) => runMacCodesignCommands([codesignArgs], { env })[0],
     inspect = defaultInspect, evidence, hashFile,