@rightkit/release 0.6.8 → 0.6.11

package/ownership-evidence.mjs

@@ -8,6 +8,7 @@ import { acquireCommittedSource, assertCommittedCheckoutClean, committedSourceDa
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { runningPolicyBundle } from "./ownership-policy-bundle.mjs";
 import { canonicalRepositoryIdentity, loadTrustedExternal, resolveKeyLogTrust, sha256, validateOwnershipFloor, verifyRepositoryRegistration } from "./ownership-approval.mjs";
+import { isReleaseSource } from "./release-source-brand.mjs";
 
 const digestFile = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
 
@@ -32,8 +33,22 @@ function createEvidence(repoRoot, {
   requireCleanCheckout = false,
   allowPendingAdvisory = false,
   policyBundleProvider = runningPolicyBundle,
+  // A door source split (release-source-identity.mjs `resolveReleaseSource`, item 7 row 7.04): the evidence binds the SELECTED commit's
+  // objects, read from the checkout's object database, and never the checkout's HEAD or status. null (and a checkout-mode source) is today's behaviour.
+  releaseSource = null,
 } = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
+  if (releaseSource !== null && !isReleaseSource(releaseSource)) throw new Error("ownership evidence: the release source was not resolved by resolveReleaseSource");
+  const snapshotSource = releaseSource?.mode === "snapshot" ? releaseSource : null;
   const root = path.resolve(repoRoot);
+  // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
+  const realPath = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
+  if (snapshotSource && realPath(root) !== realPath(snapshotSource.checkout)) throw new Error(`ownership evidence: in a door source split the git root is the run's checkout ${snapshotSource.checkout}, not ${root}`);
+  // The caller names its app root in the snapshot (its cwd); the committed scan places it by its path inside the repository, which is the
+  // same relative path in the checkout. Nothing is read from either: the scan reads committed objects.
+  if (snapshotSource) {
+    const relative = path.relative(realPath(snapshotSource.snapshot), realPath(scanRoot));
+    if (relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative))) scanRoot = path.join(snapshotSource.checkout, relative);
+  }
   const scope = requestedScope ? [...new Set(requestedScope)].sort() : null;
   const manifestBytes = readFileSync(manifestPath);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
@@ -48,8 +63,14 @@ function createEvidence(repoRoot, {
   // a useful local backlog scan. It cannot assert a protected source binding or verify
   // approval signatures, so this result is deliberately advisory.
   const useCommittedSource = committed && (!enrollmentPending || Boolean(trustState.trust?.rootFingerprint));
-  if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root);
-  const source = useCommittedSource ? acquireCommittedSource(root, { requiredPaths: [...(trustState.trust?.provenance ?? []).flatMap((record) => record.paths ?? []), ...(trustState.trust?.rootFingerprint && !trustState.trust?.keyAuthority ? [".rightkit/ownership-keys.json"] : [])] }) : null;
+  // In a split the evidence is the selected commit's committed source or nothing: the advisory fallback would scan a mutable tree and
+  // read HEAD, which are exactly the reads a split replaces. Fail closed.
+  if (snapshotSource && !useCommittedSource) throw new Error("ownership evidence in a door source split needs the committed-source scan; this host's trust enrollment cannot provide it (RK_SOURCE_SPLIT)");
+  // The clean-checkout condition guards "bytes scanned (committed blobs) = bytes built (working tree)". A split builds a verified snapshot
+  // of the commit instead, so the checkout's cleanliness is irrelevant there (GC:24, GC:156 item 1).
+  if (useCommittedSource && requireCleanCheckout && !snapshotSource) assertCommittedCheckoutClean(root);
+  const selected = snapshotSource ? { commit: snapshotSource.commit, expectedTree: snapshotSource.tree } : {};
+  const source = useCommittedSource ? acquireCommittedSource(root, { ...selected, requiredPaths: [...(trustState.trust?.provenance ?? []).flatMap((record) => record.paths ?? []), ...(trustState.trust?.rootFingerprint && !trustState.trust?.keyAuthority ? [".rightkit/ownership-keys.json"] : [])] }) : null;
   let keyLogEvidence = null;
   if (trustState.trust?.keyAuthority) {
     const resolved = readAuthority(trustState.trust);
@@ -59,7 +80,7 @@ function createEvidence(repoRoot, {
     keyLogEvidence = { keyLogDigest: resolved.digest, keyCheckpoint: resolved.keyCheckpoint, rootFingerprint: resolved.rootFingerprint, keyAuthority: resolved.authority };
     if (!resolved.resolvedTrust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
   } else if (trustState.trust?.rootFingerprint) {
-    const keySource = source ?? acquireCommittedSource(root, { requiredPaths: [".rightkit/ownership-keys.json"] });
+    const keySource = source ?? acquireCommittedSource(root, { ...selected, requiredPaths: [".rightkit/ownership-keys.json"] });
     const sourceData = committedSourceDataForInternalUse(keySource);
     if (!sourceData) throw new Error("protected ownership key log requires authenticated committed source");
     const entry = sourceData.entries.find((item) => item.rel === ".rightkit/ownership-keys.json");
@@ -70,7 +91,8 @@ function createEvidence(repoRoot, {
     keyLogEvidence = { keyLogDigest: resolved.keyLogDigest, keyCheckpoint: resolved.checkpoint, rootFingerprint: resolved.trust.rootFingerprint };
     if (!resolved.trust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
   }
-  if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root, { expectedCommit: source.commit, expectedTree: source.tree });
+  if (useCommittedSource && requireCleanCheckout && !snapshotSource) assertCommittedCheckoutClean(root, { expectedCommit: source.commit, expectedTree: source.tree });
+  if (snapshotSource && (source.commit !== snapshotSource.commit || source.tree !== snapshotSource.tree)) throw new Error("ownership evidence: the acquired committed source is not the selected commit's");
   const commit = useCommittedSource ? source.commit : git(root, ["rev-parse", "HEAD"], gitRunner);
   if (!commit) throw new Error("ownership evidence: scan source did not produce a HEAD commit");
   const tree = useCommittedSource ? source.tree : git(root, ["rev-parse", `${commit}^{tree}`], gitRunner);
@@ -92,8 +114,7 @@ function createEvidence(repoRoot, {
     ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest, ...(policyBundleDigest !== undefined ? { policyBundleDigest } : {}) })
     : { ok: true, problems: [], warnings: ["protected ownership floor is unavailable: no protected trust registry is enrolled on this host (warning only)"] };
   floor.warnings = [...(floor.warnings ?? []), ...(bundleProblem ? [bundleProblem] : [])];
-  // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
-  const real = (p) => { try { return realpathSync.native(p); } catch { return path.resolve(p); } };
+  const real = realPath;
   const requestedRoot = path.relative(real(root), real(scanRoot)).replaceAll("\\", "/") || ".";
   if (requestedRoot.startsWith("../") || requestedRoot === ".." || path.isAbsolute(requestedRoot)) throw new Error("ownership evidence scan root must be inside repository");
   const evidenceDiagnostics = [];
@@ -199,13 +220,13 @@ function createEvidence(repoRoot, {
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */
-export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
-  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
+export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null, releaseSource = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true, releaseSource });
 }
 
 /** Alias spelling makes the immutable-source contract explicit at adapter boundaries. */
-export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
-  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true });
+export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null, releaseSource = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, releaseSource });
 }
 
 // Injection seam is deliberately named for tests and is not used by release commands.
@@ -228,12 +249,15 @@ export function runProtectedLocalOwnershipCheck(repoRoot, scanRoot = repoRoot) {
 }
 
 /** Re-scan exact source and compare every sealed binding before release upload. */
-export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null) {
-  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope), scope);
+export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null, releaseSource = null) {
+  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope, releaseSource), scope);
 }
 
 export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
-  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options), options.scope ?? null);
+  // Re-scan the way the evidence was made: committed-git-tree evidence (always the case in a door source split) through the
+  // committed-source scan, as verifyOwnershipEvidence does in production.
+  const rescan = expected?.source === "committed-git-tree" ? createCommittedOwnershipEvidenceForTest : createOwnershipEvidenceForTest;
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => rescan(repoRoot, options), options.scope ?? null);
 }
 
 function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent, scope = null) {

package/ownership-hooks.mjs

@@ -1,41 +1,22 @@
-// right-release hooks install: writes the advisory pre-commit ownership gate into an app repository.
+// right-release hooks: the advisory pre-commit ownership gate is retired (docs/GATE-CONTRACT.md: "Commit and push run no gate and no
+// local hook checks"). Nothing here writes a hook any more.
 //
-//   right-release hooks install [--app <dir>]
+//   right-release hooks install [--app <dir>]   (`right-release hooks install` is `rightkit-gate install-hook`: it retires the hook)
 //
-// The hook runs the app's pinned @rightkit/release (node_modules) via `right-release ownership --staged`.
-// An existing foreign pre-commit is preserved as pre-commit.rightkit-foreign and chained first.
-// The gate is advisory: `git commit --no-verify` bypasses it; broker admission and the release gate
-// remain authoritative.
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+// An earlier release wrote `.git/hooks/pre-commit` (or the one in core.hooksPath) running `right-release ownership --staged`, and
+// kept a foreign pre-commit as pre-commit.rightkit-foreign. Retirement removes the hook by its own marker only and puts the foreign
+// pre-commit back. `right-release ownership --staged` stays a manual command; broker admission and the release gate remain
+// authoritative.
+import { lstatSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, unlinkSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { HOOK_MARKER, retireHooksIn } from "./hook-retirement.mjs";
 import { repositoryRootFor } from "./ownership-staged.mjs";
 
-export const HOOK_MARKER = "rightkit-ownership-precommit v1";
-const FOREIGN = "pre-commit.rightkit-foreign";
-const PINNED_CLI = path.join("node_modules", "@rightkit", "release", "cli", "right-release.mjs");
+export { HOOK_MARKER };
 
-export function renderPreCommitHook() {
-  return [
-    "#!/bin/sh",
-    `# ${HOOK_MARKER}: advisory ownership gate installed by \`right-release hooks install\`.`,
-    "# Block-tier findings without a valid exception fail here; --no-verify bypasses this gate.",
-    "# Authoritative enforcement remains in broker admission and the release gate.",
-    "ROOT=\"$(git rev-parse --show-toplevel)\" || exit 1",
-    "HOOKS_DIR=\"$(dirname \"$0\")\"",
-    `if [ -x "$HOOKS_DIR/${FOREIGN}" ]; then`,
-    `  "$HOOKS_DIR/${FOREIGN}" "$@" || exit $?`,
-    "fi",
-    `GATE="$ROOT/${PINNED_CLI.split(path.sep).join("/")}"`,
-    "if [ ! -f \"$GATE\" ]; then",
-    "  echo \"[rightkit] @rightkit/release is not installed in this repository; add it as a devDependency, then re-run: right-release hooks install\" >&2",
-    "  exit 1",
-    "fi",
-    "exec node \"$GATE\" ownership --staged",
-    "",
-  ].join("\n");
-}
+const FS_OPS = Object.freeze({ readdir: readdirSync, readFile: (file) => readFileSync(file, "utf8"), lstat: lstatSync, unlink: unlinkSync, rename: renameSync, rmdir: rmdirSync });
 
 function git(cwd, args) {
   const result = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", windowsHide: true, env: Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_/i.test(k))) });
@@ -52,46 +33,26 @@ export function hooksDirectoryFor(root) {
   return path.resolve(root, common);
 }
 
-/**
- * Idempotent install. Returns { status: "installed" | "updated" | "unchanged" | "chained", file }.
- */
-export function installPreCommitHook(repoDir) {
+/** Remove the ownership pre-commit hook an earlier release wrote, restoring the foreign pre-commit it displaced. { status: "retired" | "restored" | "absent", file } */
+export function retirePreCommitHook(repoDir) {
   const root = repositoryRootFor(repoDir);
-  const pinned = path.join(root, PINNED_CLI);
-  if (!existsSync(pinned)) throw new Error(`@rightkit/release is not installed at ${pinned}; add it as a devDependency and run pnpm install first`);
   const hooksDir = hooksDirectoryFor(root);
+  const result = retireHooksIn(hooksDir, FS_OPS, { scripts: false });
   const file = path.join(hooksDir, "pre-commit");
-  const foreign = path.join(hooksDir, FOREIGN);
-  const body = renderPreCommitHook();
-  mkdirSync(hooksDir, { recursive: true });
-  let status = "installed";
-  if (lstatSync(file, { throwIfNoEntry: false })) {
-    const current = readFileSync(file, "utf8");
-    if (current === body) return { status: "unchanged", file };
-    if (current.includes(HOOK_MARKER)) status = "updated";
-    else {
-      if (existsSync(path.join(hooksDir, FOREIGN))) throw new Error(`${FOREIGN} already exists; resolve the chained hook manually before installing`);
-      renameSync(file, foreign);
-      status = "chained";
-    }
-  }
-  const temporary = `${file}.${process.pid}.tmp`;
-  writeFileSync(temporary, body, { mode: 0o755 });
-  chmodSync(temporary, 0o755);
-  renameSync(temporary, file);
-  return { status, file };
+  return { status: result.restored.length ? "restored" : result.removed.includes("pre-commit") ? "retired" : "absent", file };
 }
 
 export function main(args, { print = (line) => console.log(line) } = {}) {
   const flag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };
   if (args[0] !== "install") {
-    print("right-release hooks install [--app <dir>]");
+    print("right-release hooks install [--app <dir>]   (retires the ownership pre-commit hook; no hook is written)");
     return args.includes("--help") ? 0 : 2;
   }
   try {
-    const result = installPreCommitHook(path.resolve(flag("--app") ?? process.cwd()));
-    print(`[right-release] pre-commit ownership gate ${result.status}: ${result.file}`);
-    if (result.status === "chained") print(`[right-release] previous pre-commit preserved as ${FOREIGN} and runs first`);
+    const result = retirePreCommitHook(path.resolve(flag("--app") ?? process.cwd()));
+    print(`[right-release] pre-commit ownership gate retired (${result.status}): ${result.file}`);
+    if (result.status === "restored") print("[right-release] the previous pre-commit hook is back in place");
+    print("[right-release] commit runs no local hook check; `right-release ownership --staged` is still available by hand");
     return 0;
   } catch (error) {
     print(`[right-release] hooks install FAILED: ${error.message}`);

package/ownership-lockfiles.mjs

@@ -322,9 +322,22 @@ export function transitiveDependencies(appRoot, inventory, manifests, catalogOwn
     if (bytes && !contentDigests.some((item) => item.path === rel)) contentDigests.push({ path: rel, digest: sha256(bytes) });
     return bytes;
   };
+  // Directories the repository declares as gate fixtures (ci/gate.config.json `fixtures`: consumer recipes, vendored crates,
+  // spikes) are samples and harnesses, never the app's code: the gate builds none of them as units, and neither are they scanned here.
+  let fixtures = [];
+  try {
+    const rel = "ci/gate.config.json";
+    const config = inventory.snapshotFiles?.get(`${inventory.pathPrefix ?? ""}${rel}`)?.bytes ?? files.get(rel)?.bytes
+      ?? (!inventory.committed && existsSync(path.resolve(appRoot, rel)) ? readFileSync(path.resolve(appRoot, rel)) : undefined);
+    if (config) fixtures = (JSON.parse(config.toString("utf8")).fixtures ?? []).map((d) => String(d).replace(/\/+$/, ""));
+  } catch { fixtures = []; }
+  const underFixture = (rel) => fixtures.some((d) => rel === d || rel.startsWith(`${d}/`));
   for (const manifest of manifests) {
     const base = path.posix.basename(manifest.rel), ecosystem = base === "Cargo.toml" ? "cargo" : base === "package.json" ? "npm" : null;
     if (!ecosystem || !manifest.bytes) continue;
+    if (underFixture(manifest.rel)) continue;
+    // A Cargo manifest with its own [workspace] table is a workspace root: its lock sits beside it and Cargo never looks higher.
+    const workspaceRoot = ecosystem === "cargo" && /^\s*\[workspace\]\s*$/m.test(manifest.bytes.toString("utf8"));
     const names = ecosystem === "cargo" ? ["Cargo.lock"] : OWNERSHIP_LOCKFILES.slice(1);
     let dir = path.posix.dirname(manifest.rel), found = false;
     try {
@@ -337,7 +350,7 @@ export function transitiveDependencies(appRoot, inventory, manifests, catalogOwn
           }
           found = true; break;
         }
-        if (dir === ".") break;
+        if (dir === "." || workspaceRoot) break;
         dir = path.posix.dirname(dir);
       }
       if (!found) diagnostic(manifest.rel, "lockfile-missing", ecosystem);

package/ownership-policy-bundle.mjs

@@ -17,10 +17,11 @@ const CATALOG_FILE = "rightkit-ownership.json";
 const REGISTRY_FILE = "ownership-repositories.json";
 // Step 4: the release QA requirement floor is protected like the catalog. Dropping a required check changes the digest.
 export const QA_FLOOR_FILE = "release-qa-floor.json";
-// Modules that make or carry enforcement decisions. Their import closure is pinned.
+// Modules that make or carry enforcement decisions. Their import closure is pinned. ownership-hooks.mjs left the list with the
+// advisory pre-commit hook it used to write (GATE-CONTRACT: commit runs no local hook check): it retires that hook and decides nothing.
 export const POLICY_BUNDLE_ENTRYPOINTS = Object.freeze([
   "ownership-scan-worker.mjs", "ownership-evidence.mjs", "ownership-verdict.mjs", "ownership-admission.mjs",
-  "ownership-staged.mjs", "ownership-hooks.mjs", "ownership-key-trust.mjs", "release-qa-receipt.mjs",
+  "ownership-staged.mjs", "ownership-key-trust.mjs", "release-qa-receipt.mjs",
 ]);
 // Data files are pinned through their own digests, not as source files.
 const DATA_FILES = new Set([CATALOG_FILE, REGISTRY_FILE, ALLOWLIST_FILE, QA_FLOOR_FILE]);

package/ownership-staged.mjs

@@ -1,4 +1,5 @@
-// Advisory pre-commit ownership gate: scans the STAGED tree (index content), never the working tree.
+// Ownership gate for the STAGED tree (index content), never the working tree: the manual command `right-release ownership --staged`.
+// No git hook runs it any more (docs/GATE-CONTRACT.md: commit runs no local hook check).
 // Authoritative enforcement stays in broker admission and the release gate.
 //
 //   right-release ownership --staged [--app <dir>] [--json]

package/ownership.mjs

@@ -382,6 +382,9 @@ function resolveDependencyVersions(appRoot, inventory, deps, coverage, contentDi
             const refs = lock.package.filter((p) => p.name === owner).flatMap((p) => p.dependencies ?? []);
             candidates = candidates.filter((p) => refs.some((ref) => ref === `${d.name} ${p.version}` || ref.startsWith(`${d.name} ${p.version} (`)));
           }
+          // A crate may declare two versions of one package under different names (windows 0.61 and 0.62 lanes): the declared
+          // requirement picks the resolved one, by Cargo's default caret rule (or an exact `=` pin).
+          if (candidates.length > 1 && typeof d.requirement === "string") candidates = candidates.filter((p) => cargoRequirementMatches(d.requirement, p.version));
           if (candidates.length !== 1 || typeof candidates[0].version !== "string") throw new Error(`Cargo.lock resolution missing or ambiguous: ${d.name}`);
           d.resolvedVersion = candidates[0].version;
         }
@@ -917,3 +920,24 @@ export function checkCommittedApp(appRoot, manifest, options = {}) {
 export function checkCommittedAppForTest(appRoot, manifest, options = {}) {
   return checkCommitted(appRoot, manifest, options, options.acquireCommittedSourceForTest ?? acquireCommittedSource, options.readAuthorityForTest);
 }
+
+/** Cargo's default requirement (`0.61`, `^1.2`, `=0.3.4`, `>=2.10.1, <3`) against a resolved version; anything else matches. */
+function cargoRequirementMatches(requirement, version) {
+  const parse = (v) => String(v).split("+")[0].split("-")[0].split(".").map((n) => Number(n));
+  const [x, y = 0, z = 0] = parse(version);
+  const cmp = (a, b) => a[0] - b[0] || (a[1] ?? 0) - (b[1] ?? 0) || (a[2] ?? 0) - (b[2] ?? 0);
+  return requirement.split(",").map((r) => r.trim()).filter(Boolean).every((r) => {
+    const m = /^(=|\^|>=|<=|>|<|~)?\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(r);
+    if (!m) return true;
+    const op = m[1] ?? "^"; const want = [Number(m[2]), m[3] === undefined ? undefined : Number(m[3]), m[4] === undefined ? undefined : Number(m[4])];
+    const v = [x, y, z]; const c = cmp(v, want);
+    if (op === "=") return want.every((n, i) => n === undefined || n === v[i]);
+    if (op === ">=") return c >= 0; if (op === ">") return c > 0; if (op === "<=") return c <= 0; if (op === "<") return c < 0;
+    if (op === "~") return c >= 0 && v[0] === want[0] && (want[1] === undefined || v[1] === want[1]);
+    if (c < 0) return false;
+    if (want[0] > 0) return v[0] === want[0];
+    if (want[1] === undefined) return v[0] === 0;
+    if (want[1] > 0) return v[0] === 0 && v[1] === want[1];
+    return v[0] === 0 && v[1] === 0 && (want[2] === undefined || v[2] === want[2]);
+  });
+}

package/package-recipe-targets.mjs

@@ -8,7 +8,9 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { ArtifactPathError, SPLIT_TARGET_UNRESOLVED_CODE, isSplitArtifactEnv } from "./release-artifact-path.mjs";
 import { defaultManagedRoots, isUnderManagedRoot } from "./managed-target-stage.mjs";
+import { NativeHelpersError, nativeHelperNestedCode, validateNativeHelpers } from "./native-helpers.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
 import { IOS_SIGNING_CONTRACT, IosPackageError, validateIosPackageConfig } from "./ios-package-recipe.mjs";
 import { IosUploadError, validateIosDistribution } from "./ios-upload.mjs";
@@ -78,13 +80,13 @@ const configArgs = (extras, appRoot, cwd) => (extras.tauriConfig ? ["--config",
  * release.mjs runs ONE prePackage command: node recipe-build.mjs runs the built-in cleanup, prepare, the Tauri build,
  * the artifact stability poll and postBuild in order. `cleanup` and `stability` are recipe-build plan sections.
  */
-function recipeBuildCommand({ extras, build, env, cleanup, stability, stage, timeoutMs }) {
+function recipeBuildCommand({ extras, build, env, cleanup, stability, stage, timeoutMs, verifySidecars, nativeHelpers, boundTargets }) {
   const steps = [
     ...extras.prepare.map((step) => ({ phase: "prepare", ...step })),
     { phase: "build", cmd: build.cmd, args: build.args, cwd: build.cwd },
     ...extras.postBuild.map((step) => ({ phase: "postBuild", ...step })),
   ];
-  const plan = { version: 1, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage && (stage.pre?.length || stage.post?.length) ? { stage } : {}) };
+  const plan = { version: 1, steps, ...(boundTargets?.length ? { boundTargets } : {}), ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage && (stage.pre?.length || stage.post?.length) ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
   return { cmd: process.execPath, args: [RECIPE_BUILD, "--plan", JSON.stringify(plan)], env, ...(timeoutMs ? { timeoutMs } : {}) };
 }
 
@@ -113,6 +115,9 @@ function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, m
 function buildTargetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, managedRoots, staged }) {
   const explicit = spec.cargoTargetRoot;
   if (explicit !== undefined && explicit !== true && explicit !== false && typeof explicit !== "string") fail(`${label}.cargoTargetRoot must be true or an app-relative Cargo.toml path`);
+  // A door split (row 7.04c, R-T1/R-T3): the snapshot has no target directory, so every declared target path is the bound target's, absolute, and
+  // nothing is copied (the #924 bridge plans zero staged entries): the build output is read and signed in place.
+  if (isSplitArtifactEnv(env)) return splitTargetRootMapper({ spec, appRoot, cwd, resolveTargetRoot, label });
   const envDir = typeof env.CARGO_TARGET_DIR === "string" && env.CARGO_TARGET_DIR.trim() !== "";
   if (explicit === false || (!explicit && !envDir)) return (declared) => declared;
   const manifestRel = typeof explicit === "string" ? relativeInside(explicit, `${label}.cargoTargetRoot`) : path.posix.join(cwd === "." ? "" : cwd, "src-tauri", "Cargo.toml");
@@ -140,9 +145,34 @@ function buildTargetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, lab
   };
 }
 
-function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability, stage }) {
+function splitTargetRootMapper({ spec, appRoot, cwd, resolveTargetRoot, label }) {
+  const explicit = spec.cargoTargetRoot;
+  const manifestRel = typeof explicit === "string" ? relativeInside(explicit, `${label}.cargoTargetRoot`) : path.posix.join(cwd === "." ? "" : cwd, "src-tauri", "Cargo.toml");
+  const manifest = path.resolve(appRoot, manifestRel);
+  // An app that declares no recipe target and has no src-tauri manifest has nothing to bind; a declared one that is missing is refused below.
+  if (explicit !== true && typeof explicit !== "string" && !existsSync(manifest)) return (declared) => declared;
+  let targetDir;
+  try { targetDir = resolveTargetRoot(manifest); } catch (error) {
+    throw new ArtifactPathError(SPLIT_TARGET_UNRESOLVED_CODE, `${label}: cannot resolve the Cargo target directory of ${manifest} (${error.message}); a split never falls back to a snapshot-relative target/`);
+  }
+  const relativeToApp = path.relative(appRoot, targetDir);
+  if (relativeToApp === "" || (!relativeToApp.startsWith("..") && !path.isAbsolute(relativeToApp))) {
+    throw new ArtifactPathError(SPLIT_TARGET_UNRESOLVED_CODE, `${label}: the Cargo target directory ${targetDir} is inside the snapshot; a split binds it outside (CARGO_TARGET_DIR, row 7.09)`);
+  }
+  const prefix = path.posix.join(path.posix.dirname(manifestRel).replace(/^\.$/, ""), "target");
+  const mapper = (declared) => {
+    const normalized = String(declared).replaceAll("\\", "/");
+    if (normalized !== prefix && !normalized.startsWith(`${prefix}/`)) return declared;
+    if (normalized.split("/").includes("..")) fail(`${label}: ${declared} must not contain ..`);
+    return path.resolve(targetDir, normalized.slice(prefix.length + 1));
+  };
+  mapper.bound = [targetDir];
+  return mapper;
+}
+
+function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability, stage, boundTargets }) {
   const args = ["exec", "tauri", "build", "--no-bundle", "--target", triple, ...configArgs(extras, appRoot, cwd), ...buildCargoArgs(extras, jobs)];
-  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, stage, timeoutMs });
+  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, stage, timeoutMs, boundTargets });
 }
 
 /** `targets.win.winPackage` → prePackage (`tauri build --no-bundle`) and package (`tauri bundle --bundles nsis`). */
@@ -192,14 +222,16 @@ export function expandWinPackageTarget(target, { appRoot, config = {}, env = pro
   return {
     ...rest,
     signingContract: "windows-raw-exe-authenticode-before-nsis-v1",
-    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] }, stage: prePackageStage }),
+    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] }, stage: prePackageStage, boundTargets: mapPath.bound }),
     package: bundleCommand,
     sign: { ...(target.sign ?? {}), prePackageFiles: [rawExe], files: [installerFile] },
     recipe: { kind: "winPackage", productName: plan.productName, updater: plan.updater },
   };
 }
 
-const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot", "updater"]);
+const MAC_KEYS = new Set(["universal", "triple", "tauriCwd", "features", "profile", "tauriConfig", "prepare", "postBuild", "cleanup", "cargoTargetRoot", "updater", "stageSidecars", "nativeHelpers"]);
+const STAGE_SIDECARS_KEYS = new Set(["config", "receipt"]);
+const DEFAULT_SIDECAR_RECEIPT = "src-tauri/binaries/stage-sidecar.json";
 const MAC_TRIPLES = ["aarch64-apple-darwin", "x86_64-apple-darwin"];
 const MAC_CLEANUP_KEYS = new Set(["staleApps", "staleDmgVolumes", "lsclean"]);
 
@@ -221,7 +253,26 @@ function macCleanupSpec(value) {
  * `updater: true | "<app-relative .tar.gz>"` emits the Tauri updater tarball and its signature from the signed, stapled .app:
  * it prepends a `create-mac-updater` command to `postSign` (default output `<App>.app.tar.gz` beside the app's working root).
  */
-export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot, managedRoots }) {
+/**
+ * `stageSidecars: true | { config?, receipt? }`: stage the release config's declarative `sidecars` for the build's triple through this
+ * package's own `right-release stage-sidecar --target <triple>` as the first prepare step. For `universal-apple-darwin` stage-sidecar
+ * builds each slice (aarch64 and x86_64), `lipo -create`s them into `<name>-universal-apple-darwin` (the name Tauri's universal
+ * build expects) and refuses a result without both archs; recipe-build then re-checks every externalBin in the receipt
+ * (`receipt`, default src-tauri/binaries/stage-sidecar.json) with `lipo -archs` (exactly arm64 + x86_64) before the Tauri build.
+ */
+function stageSidecarsSpec(value) {
+  if (value === undefined || value === false) return undefined;
+  if (value !== true && !isObject(value)) fail("targets.mac.macPackage.stageSidecars must be true or { config?, receipt? }");
+  const spec = value === true ? {} : value;
+  const unknownKeys = Object.keys(spec).filter((key) => !STAGE_SIDECARS_KEYS.has(key));
+  if (unknownKeys.length) fail(`targets.mac.macPackage.stageSidecars has unknown key(s): ${unknownKeys.join(", ")} (allowed: ${[...STAGE_SIDECARS_KEYS].join(", ")})`);
+  return {
+    ...(spec.config === undefined ? {} : { config: relativeInside(spec.config, "targets.mac.macPackage.stageSidecars.config") }),
+    receipt: spec.receipt === undefined ? DEFAULT_SIDECAR_RECEIPT : relativeInside(spec.receipt, "targets.mac.macPackage.stageSidecars.receipt"),
+  };
+}
+
+export function expandMacPackageTarget(target, { appRoot, config = {}, env = process.env, resolveTargetRoot = cargoResolveTargetRoot, managedRoots }) {
   if (!target?.macPackage) return withoutRecipe(target);
   const spec = target.macPackage;
   if (!isObject(spec)) fail("targets.mac.macPackage must be an object");
@@ -247,6 +298,25 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   }
   const override = { bundle: { createUpdaterArtifacts: false, macOS: { signingIdentity: null } } };
   const extras = buildExtras(spec, "targets.mac.macPackage", { postBuild: true });
+  const sidecars = stageSidecarsSpec(spec.stageSidecars);
+  if (sidecars) {
+    // First prepare step: stage the declared sidecars for this triple (universal: both slices, lipo, <name>-universal-apple-darwin).
+    extras.prepare = [{ cmd: "right-release", args: ["stage-sidecar", "--target", triple, ...(sidecars.config ? ["--config", sidecars.config] : [])] }, ...extras.prepare];
+  }
+  let helpers;
+  if (spec.nativeHelpers !== undefined) {
+    try { helpers = validateNativeHelpers(spec.nativeHelpers, { label: "targets.mac.macPackage.nativeHelpers" }); } catch (error) {
+      if (error instanceof NativeHelpersError) fail(error.message);
+      throw error;
+    }
+    // A universal app may not carry a thin helper: it would compile, sign and notarize and then fail on half the Macs.
+    const thin = triple === "universal-apple-darwin" ? helpers.filter((helper) => !helper.universal) : [];
+    if (thin.length) fail(`targets.mac.macPackage.nativeHelpers: ${thin.map((helper) => helper.name).join(", ")} must declare universal: true (this build's triple is universal-apple-darwin)`);
+    if (helpers.some((helper) => helper.kind === "app") && (typeof config?.version !== "string" || !/^\d+(\.\d+){0,2}$/.test(config.version))) fail("targets.mac.macPackage.nativeHelpers: a kind \"app\" helper needs the release config version (1-3 numeric parts) for its Info.plist");
+    const collisions = Object.keys(nativeHelperNestedCode(helpers)).filter((key) => isObject(target.sign?.nestedCode) && Object.hasOwn(target.sign.nestedCode, key));
+    if (collisions.length) fail(`targets.mac.macPackage.nativeHelpers: sign.nestedCode must not redeclare ${collisions.join(", ")}; declare entitlements on the helper entry`);
+    if (isObject(target.sign?.entitlements) ? helpers.some((helper) => Object.hasOwn(target.sign.entitlements, helper.embed)) : false) fail("targets.mac.macPackage.nativeHelpers: sign.entitlements must not redeclare a helper's embed path; declare entitlements on the helper entry");
+  }
   const args = ["exec", "tauri", "build", "--target", triple, "--bundles", "app", "--no-sign", ...configArgs(extras, appRoot, cwd), "--config", JSON.stringify(override)];
   if (spec.features?.length) args.push("--features", spec.features.join(","));
   args.push(...profileArgs(extras));
@@ -270,7 +340,10 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   // An entry inside another staged entry (a file within the .app) is covered by copying the outer one.
   const macEntries = [...mapPath.staged.values()].filter((entry) => ![...mapPath.staged.values()].some((outer) => outer !== entry && entry.to.startsWith(`${outer.to}/`)));
   const macStage = macEntries.length ? { post: macEntries.map((entry) => ({ ...entry, fresh: true })), resolve: mapPath.resolve() } : undefined;
-  const wrapped = extras.prepare.length || extras.postBuild.length || cleanup || macStage;
+  const wrapped = extras.prepare.length || extras.postBuild.length || cleanup || macStage || helpers;
+  const forceArch = helpers && triple !== "universal-apple-darwin" ? (triple === "aarch64-apple-darwin" ? "arm64" : "x86_64") : undefined;
+  const nativeHelpersPlan = helpers ? { app, helpers, ...(config?.version ? { version: config.version } : {}), ...(forceArch ? { forceArch } : {}), configuration: "release" } : undefined;
+  const verifySidecars = sidecars && triple === "universal-apple-darwin" ? { receipt: sidecars.receipt, target: triple } : undefined;
   const { macPackage, recipe: _ignoredMac, ...rest } = target;
   // The updater tarball is made from the signed .app, so it runs in postSign, ahead of any postSign the app declares.
   const updaterOutput = spec.updater === true ? `${productName}.app.tar.gz` : typeof spec.updater === "string" ? relativeInside(spec.updater, "targets.mac.macPackage.updater") : undefined;
@@ -283,8 +356,9 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   return {
     ...rest,
     ...postSign,
-    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stage: macStage }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
-    sign: { ...(target.sign ?? {}), prePackageFiles },
+    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stage: macStage, verifySidecars, nativeHelpers: nativeHelpersPlan, boundTargets: mapPath.bound }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
+    // Helpers are signed by release.mjs inside-out through sign.nestedCode (deepest path first, hardened runtime, each helper's own entitlements), then the app.
+    sign: { ...(target.sign ?? {}), ...(helpers ? { nestedCode: { ...nativeHelperNestedCode(helpers), ...(target.sign?.nestedCode ?? {}) } } : {}), prePackageFiles },
     notarize: { ...target.notarize, app, appBeforePackage: true },
     dmg: isObject(target.dmg) ? target.dmg : {},
     recipe: { kind: "macPackage", universal: triple === "universal-apple-darwin" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.8",
+  "version": "0.6.11",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -78,7 +78,8 @@
     "!*.test.mjs",
     "!cli/*.test.mjs",
     "!standalone-clone-evidence.json",
-    "!refusals.json"
+    "!refusals.json",
+    "!provenance-real-receipt.fixture.json"
   ],
   "sideEffects": false,
   "publishConfig": {
@@ -91,7 +92,7 @@
     "directory": "packages/release"
   },
   "dependencies": {
-    "@rightkit/outdated": "0.2.0",
+    "@rightkit/outdated": "0.3.0",
     "smol-toml": "1.9.1"
   },
   "scripts": {

package/pipeline-admission.mjs

@@ -239,13 +239,13 @@ function admitRuntime(bin, rest, options, label) {
 }
 
 /**
- * `rightkit-gate install-hook`: writes the committed pre-push hook and sets core.hooksPath, so an app's `prepare` script may run it.
- * It builds, signs, packages and uploads nothing. The gate itself (`rightkit-gate`, `--base`) compiles and is run by the hook, never
- * by a release config; only the installer and the version probe are admitted.
+ * `rightkit-gate install-hook`: retires the git hooks an earlier release wrote and registers the agent hook, so an app's `prepare` script may run it.
+ * It builds, signs, packages and uploads nothing. The gate itself (`rightkit-gate`, `--base`) compiles and is never run by a release
+ * config; only the installer and the version probe are admitted.
  */
 function admitRightKitGate(args, label) {
   if (args.length === 1 && (args[0] === "install-hook" || args[0] === "--version")) return admit(`rightkit-gate-${args[0].replace(/^--/, "")}`, "owner");
-  return refuse("R1-owner-subcommand", `${label}: only rightkit-gate install-hook (and --version) is an admitted pipeline command; the gate itself runs from the pre-push hook`);
+  return refuse("R1-owner-subcommand", `${label}: only rightkit-gate install-hook (and --version) is an admitted pipeline command; the gate itself is run through the door, never by a release config`);
 }
 
 function admitRightRelease(args, label) {