@rightkit/release 0.6.8 → 0.6.11

package/preflight.mjs

@@ -23,6 +23,7 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
+import { isReleaseSource } from "./release-source-brand.mjs";
 import { appRuntimeBudgetAdoptionCheck } from "./runtime-budgets.mjs";
 import { isSwiftProject } from "./project-type.mjs";
 
@@ -203,6 +204,12 @@ export function collectPreflight({
   bridge = true,
   msix = false,
   findSdkTool = findWindowsSdkTool,
+  // A door source split (release-source-identity.mjs `resolveReleaseSource`, row 7.04). Only the ownership check reads it: the evidence is
+  // then the selected commit's, read from the checkout's object database, whatever `repoRoot` the caller names.
+  releaseSource = null,
+  // The artifact-path context of a door split (release-artifact-path.mjs, row 7.04c). When it is a split, the target-bridge check is replaced by
+  // the R-T1 check: every manifest has a bound target outside the snapshot, and nothing sits where a snapshot-relative target/ would.
+  splitTargets = null,
 } = {}) {
   const checks = [];
   const windows = platform === "win" || platform === "win32";
@@ -219,7 +226,14 @@ export function collectPreflight({
     );
   }
 
-  if (appRoot && !noBridge) {
+  if (appRoot && !noBridge && splitTargets?.mode === "split") {
+    const planted = splitTargets.boundTargets.map((bound) => path.join(appRoot, bound.prefix)).filter((dir) => { try { lstatSync(dir); return true; } catch { return false; } });
+    checks.push(
+      planted.length
+        ? fail("split-target", `RK_SPLIT_TARGET_PATH: ${planted.join(", ")} exists in the snapshot; a split binds its target outside it and nothing may sit there`, "remove it from the commit (it is build output) and add the directory to .gitignore")
+        : ok("split-target", splitTargets.boundTargets.length ? `target bound outside the snapshot: ${[...new Set(splitTargets.boundTargets.map((bound) => bound.dir))].join(", ")}` : "no target to bind"),
+    );
+  } else if (appRoot && !noBridge) {
     const target = targetLink ?? nativeLayout?.targetLink ?? path.join(appRoot, "src-tauri", "target");
     const targetLabel = nativeLayout?.targetPrefix || "src-tauri/target/";
     let entry = null;
@@ -339,8 +353,12 @@ export function collectPreflight({
     checks.push(fail("ownership", `ownership scope refused: ${ownershipScopeError}`, "fix the target's ownership scope configuration; the build refuses it too"));
   } else if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
-    const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
-    checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory }));
+    // In a split the layout is the snapshot's (the commit's), the git root is the checkout, and the source is the one the identity module resolved.
+    if (releaseSource !== null && !isReleaseSource(releaseSource)) throw new Error("preflight: the release source was not resolved by resolveReleaseSource");
+    const split = releaseSource?.mode === "snapshot" ? releaseSource : null;
+    const gitRoot = split ? split.checkout : repoRoot;
+    const workspace = existsSync(path.join(split ? split.snapshot : repoRoot, "tools", "rightkit", "packages", "release"));
+    checks.push(ownershipCheck(gitRoot, { scanRoot: workspace && appRoot ? appRoot : gitRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory, ...(split ? { releaseSource: split } : {}) }));
   }
 
   return checks;
@@ -349,9 +367,14 @@ export function collectPreflight({
 /** Release-blocking: the app keeps no unexcepted copy of a RightKit-owned capability. */
 export function ownershipCheck(repoRoot, options = {}) {
   let checked;
-  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot, options.scope ?? null); }
+  const split = options.releaseSource?.mode === "snapshot" ? options.releaseSource : null;
+  try { checked = (options.evidenceFactory ?? createOwnershipEvidence)(repoRoot, options.scanRoot ?? repoRoot, options.scope ?? null, ...(split ? [split] : [])); }
   catch (error) { return fail("ownership", `ownership evidence failed: ${error.message}`, "restore protected RightKit ownership trust and catalog"); }
   const { result, evidence, floor } = checked;
+  // R4: evidence for another commit or tree than the selected one is refused whatever produced it (a factory that read HEAD, a stale one).
+  if (split && (evidence?.commit !== split.commit || (evidence?.tree !== undefined && evidence.tree !== split.tree))) {
+    return fail("ownership", `ownership evidence is for commit ${String(evidence?.commit ?? "(none)").slice(0, 12)}, not the selected commit ${split.commit.slice(0, 12)}`, "the door run builds the selected commit's snapshot; re-run the door for that commit");
+  }
   if (checked.ok) {
     const excepted = result.covered.length;
     const detail = excepted ? `no unapproved copies (${excepted} excepted findings)` : "no copies of RightKit-owned capabilities";

package/project-type.mjs

@@ -41,5 +41,5 @@ export function targetUsesMsix(target) {
   return Boolean(target?.msix) || target?.signingContract === "windows-msix-signed-v1";
 }
 
-/** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
-export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || Boolean(target?.winPackage || target?.macPackage) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));
+/** Expanded recipes must come from the validator, which strips caller-supplied recipe markers. */
+export const packageCommandOptional = (target, projectType, { expanded = false } = {}) => targetUsesMsix(target) || Boolean(target?.winPackage || target?.macPackage) || (expanded && target?.recipe?.kind === "macPackage") || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/provenance-verify.mjs

@@ -0,0 +1,115 @@
+// Verifies a RustRight broker job receipt's signed provenance envelope in pure JS (node:crypto only), exactly as
+// rustright-protocol's attestation.rs `verify_receipt` does, so a hosted runner with no broker can authenticate the receipts a local
+// gate run embedded in its qualification. Never trusts a value from the receipt that the caller can pin instead.
+import { createHash, createPublicKey, verify } from "node:crypto";
+
+export const PROVENANCE_SCHEMA = "rustright.provenance.v1";
+export const PROVENANCE_DOMAIN = "rustright-provenance-v1";
+export const QUALIFICATION_NONCE_DOMAIN = "rightkit-qualification-v1";
+
+export class ProvenanceError extends Error {
+  constructor(code, message) { super(message); this.name = "ProvenanceError"; this.code = code; }
+}
+const refuse = (code, message) => { throw new ProvenanceError(code, message); };
+
+const sha256Hex = (data) => createHash("sha256").update(data).digest("hex");
+const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+function writeString(text, out) {
+  let s = '"';
+  for (const ch of text) {
+    const code = ch.codePointAt(0);
+    if (ch === '"') s += '\\"';
+    else if (ch === "\\") s += "\\\\";
+    else if (code < 0x20) s += `\\u${code.toString(16).padStart(4, "0")}`;
+    else s += ch;
+  }
+  out.push(`${s}"`);
+}
+
+function writeCanonical(value, out) {
+  if (value === null) out.push("null");
+  else if (typeof value === "boolean") out.push(value ? "true" : "false");
+  else if (typeof value === "number") {
+    // Integers only: serde_json prints floats with its own algorithm, and an integer beyond 2^53 was already corrupted by JSON.parse.
+    // Either would make a signature fail for the wrong reason, so refuse loudly instead.
+    if (!Number.isSafeInteger(value)) refuse("canonical", "canonical JSON takes only safe integers");
+    out.push(String(value));
+  } else if (typeof value === "string") writeString(value, out);
+  else if (Array.isArray(value)) {
+    out.push("[");
+    value.forEach((item, index) => { if (index > 0) out.push(","); writeCanonical(item, out); });
+    out.push("]");
+  } else if (isRecord(value)) {
+    // Rust sorts by the UTF-8 bytes of the key; JavaScript's default sort is by UTF-16 code unit and differs above U+FFFF.
+    const keys = Object.keys(value).sort((a, b) => Buffer.compare(Buffer.from(a, "utf8"), Buffer.from(b, "utf8")));
+    out.push("{");
+    keys.forEach((key, index) => { if (index > 0) out.push(","); writeString(key, out); out.push(":"); writeCanonical(value[key], out); });
+    out.push("}");
+  } else refuse("canonical", `canonical JSON cannot carry a ${typeof value}`);
+}
+
+/** Canonical JSON: keys sorted by byte order, no whitespace, strings escape only `"`, `\` and control characters < 0x20 (\u00xx lower-case). */
+export function canonicalJson(value) {
+  const out = [];
+  writeCanonical(value, out);
+  return out.join("");
+}
+
+/** The exact bytes the broker signs for a payload. */
+export function signedBytes(payload) {
+  return Buffer.from(`${PROVENANCE_DOMAIN}\n${canonicalJson(payload)}`, "utf8");
+}
+
+const HEX = /^(?:[0-9a-fA-F]{2})+$/;
+const keyFromSec1 = (publicKeyHex) => {
+  if (typeof publicKeyHex !== "string" || !HEX.test(publicKeyHex)) refuse("pin", "pinned public key is not hex");
+  const bytes = Buffer.from(publicKeyHex, "hex");
+  if (bytes.length !== 65 || bytes[0] !== 0x04) refuse("pin", "pinned public key is not an uncompressed SEC1 P-256 point");
+  try {
+    return createPublicKey({ key: { kty: "EC", crv: "P-256", x: bytes.subarray(1, 33).toString("base64url"), y: bytes.subarray(33, 65).toString("base64url") }, format: "jwk" });
+  } catch { return refuse("pin", "pinned public key is not a P-256 point"); }
+};
+
+/**
+ * Verifies receipt.provenance against pins the caller holds (never from the receipt) and what this invocation expects. Every check
+ * fails closed (throws ProvenanceError with a stable `code`) and returns the signed payload on success.
+ *   pins:     { publicKey (SEC1 uncompressed hex), keyId, host, brokerDigest }
+ *   expected: { jobId, nonce, requestDigest? }   requestDigest is checked only when the caller can recompute it.
+ */
+export function verifyProvenance(receipt, pins, expected) {
+  const envelope = receipt?.provenance;
+  if (!isRecord(envelope)) refuse("legacy", "the receipt has no provenance envelope");
+  if (envelope.schema !== PROVENANCE_SCHEMA) refuse("schema", "unknown provenance schema");
+  const payload = envelope.payload;
+  if (!isRecord(payload)) refuse("malformed", "payload is missing");
+  const signature = envelope.signature;
+  if (!isRecord(signature)) refuse("malformed", "signature is missing");
+  if (signature.alg !== "ES256") refuse("alg", "signature algorithm must be ES256");
+  if (!isRecord(pins) || typeof pins.publicKey !== "string" || !HEX.test(pins.publicKey)) refuse("pin", "pinned public key is not hex");
+  if (sha256Hex(Buffer.from(pins.publicKey, "hex")) !== pins.keyId) refuse("pin", "pinned key id does not match the pinned public key");
+  if (signature.keyId !== pins.keyId || payload.keyId !== pins.keyId) refuse("key", "the receipt was not signed by the pinned key");
+  const key = keyFromSec1(pins.publicKey);
+  if (typeof signature.value !== "string" || !/^[0-9a-fA-F]+$/.test(signature.value)) refuse("signature", "signature is not hex");
+  if (signature.value.length !== 128) refuse("signature", "signature is not 64 bytes r||s");
+  let good = false;
+  try { good = verify("sha256", signedBytes(payload), { key, dsaEncoding: "ieee-p1363" }, Buffer.from(signature.value, "hex")); } catch (error) { if (error instanceof ProvenanceError) throw error; }
+  if (!good) refuse("signature", "signature does not verify");
+  if (payload.host !== pins.host) refuse("host", "signed for another host");
+  if (payload.broker?.brokerDigest !== pins.brokerDigest) refuse("runtime", "signed by another broker runtime");
+  if (typeof expected?.jobId !== "string" || payload.jobId !== expected.jobId || receipt.id !== expected.jobId) refuse("job", "the receipt is for another job");
+  if (typeof expected.nonce !== "string" || payload.nonce !== expected.nonce) refuse("nonce", "the nonce is not the one this invocation sent");
+  if (expected.requestDigest !== undefined && payload.requestDigest !== expected.requestDigest) refuse("request", "the request digest is not the one this invocation computed");
+  return payload;
+}
+
+/** The nonce a unit gate run sets (RIGHTKIT_ATTEST_NONCE) for the broker jobs of one stage; the hosted admission recomputes it from
+ * what it knows of the dispatched commit, so a receipt of another commit, tree, unit or stage cannot match. 64 lowercase hex. */
+export function qualificationNonce({ commit, tree, unit, stage }) {
+  return sha256Hex(`${QUALIFICATION_NONCE_DOMAIN}\n${commit}\n${tree}\n${unit}\n${stage}`);
+}
+
+/** Broker request ids the client prints (`rustright: request <id>`) in one command's output. */
+export function brokerRequestIds(text) {
+  return [...String(text ?? "").matchAll(/^rustright: request ([0-9a-f-]{36})/gm)].map((m) => m[1]);
+}

package/publish-cargo.mjs

@@ -335,10 +335,10 @@ function fileViolations(relative, bytes, records) {
  * (the repository gate) the reviewed records of `<repoRoot>/.rightkit/secret-scan-records.json` apply and each violation is a
  * `<repo-relative path>[:<line>]: <reason>` line; `repoRoot` (default `crateDir`) is the root those paths and the records are relative to.
  */
-export function scanCrateForSecrets(crateDir, { envTemplates = false, repoRoot = crateDir } = {}) {
-  if (envTemplates) return scanRepositoryForSecrets(crateDir, repoRoot);
+export function scanCrateForSecrets(crateDir, { envTemplates = false, repoRoot = crateDir, skip = null } = {}) {
+  if (envTemplates) return scanRepositoryForSecrets(crateDir, repoRoot, skip);
   const violations = [];
-  for (const file of walkFiles(crateDir)) {
+  for (const file of walkFiles(crateDir, skip)) {
     const relative = path.relative(crateDir, file).replaceAll("\\", "/");
     if (FORBIDDEN_PACKAGE_PATH.test(relative)) {
       violations.push(relative);
@@ -350,10 +350,10 @@ export function scanCrateForSecrets(crateDir, { envTemplates = false, repoRoot =
   return [...new Set(violations)].sort();
 }
 
-function scanRepositoryForSecrets(dir, repoRoot) {
+function scanRepositoryForSecrets(dir, repoRoot, skip = null) {
   const { records = new Map(), problems = [] } = readSecretScanRecords(repoRoot);
   const violations = [...problems];
-  for (const file of walkFiles(dir)) {
+  for (const file of walkFiles(dir, skip)) {
     const inDir = path.relative(dir, file).replaceAll("\\", "/");
     const relative = path.relative(repoRoot, file).replaceAll("\\", "/");
     if (neverRecordable(inDir)) {
@@ -397,9 +397,9 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   const proven = (reuseEvidence || options.trustEvidenceSteps === true) && !options.dryRun ? provenGateSteps(gate.evidence) : {};
   if (reuseEvidence && (proven.tests !== true || proven.clippy !== true)) throw new Error("--from-evidence requires gate-proven tests and clippy for this crate and commit");
   if (reuseEvidence) {
-    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", "Cargo.toml", "Cargo.lock", "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
+    const status = (deps.workspaceStatus ?? ((workspaceRoot) => spawnSync("git", ["status", "--porcelain", "--", `crates/${options.crate}/Cargo.toml`, `crates/${options.crate}/Cargo.lock`, "ci/gate.config.json", "ci/asset-gated.json"], { cwd: workspaceRoot, encoding: "utf8", windowsHide: true })))(options.workspaceRoot);
     // The gate config decides the steps replayed below, so an uncommitted edit would change what is demanded (0.4.1 review A3).
-    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean workspace Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
+    if (status.error || status.status !== 0 || String(status.stdout ?? "").trim()) throw new Error("--from-evidence requires clean crate Cargo.toml, Cargo.lock and ci gate config (ci/gate.config.json, ci/asset-gated.json)");
     const proofHost = singleHostOfPolicy(gate.evidence) ?? "darwin";
     const runs = gate.evidence.runs.filter((run) => run?.host?.os === proofHost);
     const command = `cargo package --locked -p ${options.crate}`;
@@ -480,7 +480,8 @@ export async function runCargoPublish(options, execute = (_command, args, settin
     // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
     const isReadOnlyInspection = ["package contents", "package location"].includes(step.label);
     const settings = {
-      cwd: options.workspaceRoot,
+      // Every crate is its own Cargo workspace with its own Cargo.lock and target directory (#1285): cargo runs in the crate directory.
+      cwd: crateDir,
       encoding: "utf8",
       windowsHide: true,
       stdio: step.capture || (options.offlineReadOnly === true && isReadOnlyInspection) ? "pipe" : "inherit",
@@ -521,7 +522,8 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   return publication ?? { name: options.crate, version: cargoVersion, dryRun: true };
 }
 
-function walkFiles(root) {
+// `skip(absolutePath)`: a caller's exclusion (the gate's git-ignored paths of a live tree); a skipped directory is not descended.
+function walkFiles(root, skip = null) {
   const files = [];
   const pending = [root];
   while (pending.length) {
@@ -529,6 +531,7 @@ function walkFiles(root) {
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
       if (entry.isDirectory() && [".git", "target", "node_modules"].includes(entry.name)) continue;
       const absolute = path.join(current, entry.name);
+      if (skip && skip(absolute)) continue;
       if (entry.isDirectory()) pending.push(absolute);
       else if (entry.isFile()) files.push(absolute);
     }

package/qa-admission-policy.json

@@ -1,5 +1,14 @@
 {
   "schema": 1,
   "apps": {},
-  "approvedRunners": []
+  "approvedRunners": [
+    {
+      "sha256": "3c11788ecb51459cde33c6d98dfad936a6c4c4c409f1d11ef327b0f0781f2986",
+      "version": "0.9.1",
+      "platform": "win",
+      "set_by": "adrian",
+      "since": "2026-10-27",
+      "note": "Dell runner, Adrian's go 2026-10-28, sha256 3c11788e…2986"
+    }
+  ]
 }

package/recipe-build.mjs

@@ -30,9 +30,10 @@
 //              requires the planned target directory before and after it (a temporary bridge until the broker exposes artifacts).
 import { existsSync as nodeExistsSync, readFileSync, readdirSync as nodeReaddirSync, rmSync as nodeRmSync, statSync as nodeStatSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync as nodeSpawnSync } from "./background-process.mjs";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { buildAndEmbedNativeHelpers, validateNativeHelpers } from "./native-helpers.mjs";
 import { assertTargetDirUnchanged, removeFreshSources, stageArtifacts, verifySameContent } from "./managed-target-stage.mjs";
 
 export const RECIPE_BUILD_PLAN_VERSION = 1;
@@ -50,7 +51,10 @@ export class RecipeBuildError extends Error {
 const fail = (code, message, details) => { throw new RecipeBuildError(code, message, details); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const STEP_KEYS = new Set(["phase", "cmd", "args", "cwd", "env"]);
-const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage"]);
+const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage", "verifySidecars", "nativeHelpers", "boundTargets"]);
+const VERIFY_SIDECARS_KEYS = new Set(["receipt", "target"]);
+const NATIVE_HELPERS_KEYS = new Set(["app", "helpers", "version", "forceArch", "configuration"]);
+const UNIVERSAL_TRIPLE = "universal-apple-darwin";
 const STAGE_KEYS = new Set(["pre", "post", "verify", "resolve"]);
 const STAGE_ENTRY_KEYS = new Set(["from", "to", "fresh"]);
 const CLEANUP_KEYS = new Set(["remove", "apps", "dmgVolumes"]);
@@ -61,10 +65,22 @@ const unknownKeys = (value, allowed, label, errors) => { for (const key of Objec
 const positiveInt = (value) => Number.isInteger(value) && value > 0;
 const badVolumePrefix = (item) => typeof item !== "string" || !item.trim() || item === "." || item === ".." || item.includes("/") || item.includes("\\") || item.includes(":") || item.includes("\0");
 
-/** A relative path that stays inside the app root; returns the normalized form or undefined and pushes an error. */
-function insideApp(value, label, errors, { strict = false } = {}) {
+/**
+ * A relative path that stays inside the app root; returns the normalized form or undefined and pushes an error.
+ * `bound` (a door split, row 7.04c R-T2): the absolute Cargo target directories the plan binds. A path strictly inside one of them is also
+ * accepted, absolute and without `..`: the snapshot has no target directory, so a split's build output is addressed there. Any other
+ * absolute path stays refused.
+ */
+function insideApp(value, label, errors, { strict = false, bound = [] } = {}) {
   if (typeof value !== "string" || !value.trim()) { errors.push(`${label} must be a non-empty relative path`); return undefined; }
   const normalized = value.replaceAll("\\", "/");
+  if (bound.length && (path.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value))) {
+    const parts = normalized.split("/");
+    const absolute = path.resolve(value);
+    const under = !parts.includes("..") && bound.some((dir) => { const relative = path.relative(dir, absolute); return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative); });
+    if (!under) { errors.push(`${label} is an absolute path outside every bound Cargo target (${bound.join(", ")}): ${value}`); return undefined; }
+    return normalized;
+  }
   if (path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.split("/").includes("..")) { errors.push(`${label} must be relative and stay inside the app: ${value}`); return undefined; }
   const resolved = path.posix.normalize(normalized);
   if (strict && (resolved === "." || resolved === "./" || resolved === "")) { errors.push(`${label} must name a path strictly inside the app, not the app root: ${JSON.stringify(value)}`); return undefined; }
@@ -72,21 +88,31 @@ function insideApp(value, label, errors, { strict = false } = {}) {
   return normalized;
 }
 
-function validateCleanup(value, errors) {
+/** `boundTargets`: the absolute Cargo target directories of a door split (row 7.04c). Absent outside a split. */
+function validateBoundTargets(value, errors) {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || !value.length || value.some((dir) => typeof dir !== "string" || !path.isAbsolute(dir) || dir.replaceAll("\\", "/").split("/").includes(".."))) {
+    errors.push("boundTargets must be a non-empty list of absolute directories without ..");
+    return undefined;
+  }
+  return value.map((dir) => path.resolve(dir));
+}
+
+function validateCleanup(value, errors, bound = []) {
   if (value === undefined) return undefined;
   if (!isObject(value)) { errors.push("cleanup must be an object"); return undefined; }
   unknownKeys(value, CLEANUP_KEYS, "cleanup", errors);
   const out = {};
   if (value.remove !== undefined) {
     if (!Array.isArray(value.remove)) errors.push("cleanup.remove must be a list of relative paths");
-    else out.remove = value.remove.map((item, index) => insideApp(item, `cleanup.remove[${index}]`, errors, { strict: true })).filter(Boolean);
+    else out.remove = value.remove.map((item, index) => insideApp(item, `cleanup.remove[${index}]`, errors, { strict: true, bound })).filter(Boolean);
   }
   if (value.apps !== undefined) {
     if (!isObject(value.apps)) errors.push("cleanup.apps must be an object");
     else {
       unknownKeys(value.apps, APPS_KEYS, "cleanup.apps", errors);
       for (const key of ["remove", "unregister"]) if (value.apps[key] !== undefined && typeof value.apps[key] !== "boolean") errors.push(`cleanup.apps.${key} must be a boolean`);
-      const dir = insideApp(value.apps.dir, "cleanup.apps.dir", errors, { strict: true });
+      const dir = insideApp(value.apps.dir, "cleanup.apps.dir", errors, { strict: true, bound });
       if (dir) out.apps = { dir, remove: value.apps.remove === true, unregister: value.apps.unregister === true };
     }
   }
@@ -97,13 +123,13 @@ function validateCleanup(value, errors) {
   return out;
 }
 
-function validateStability(value, errors) {
+function validateStability(value, errors, bound = []) {
   if (value === undefined) return undefined;
   if (!isObject(value)) { errors.push("stability must be an object"); return undefined; }
   unknownKeys(value, STABILITY_KEYS, "stability", errors);
   for (const key of ["intervalMs", "checks", "timeoutMs"]) if (value[key] !== undefined && !positiveInt(value[key])) errors.push(`stability.${key} must be a positive integer`);
   if (!Array.isArray(value.files) || !value.files.length) { errors.push("stability.files must be a non-empty list of relative paths"); return undefined; }
-  const files = value.files.map((item, index) => insideApp(item, `stability.files[${index}]`, errors, { strict: true })).filter(Boolean);
+  const files = value.files.map((item, index) => insideApp(item, `stability.files[${index}]`, errors, { strict: true, bound })).filter(Boolean);
   return { files, ...(value.intervalMs === undefined ? {} : { intervalMs: value.intervalMs }), ...(value.checks === undefined ? {} : { checks: value.checks }), ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }) };
 }
 
@@ -154,6 +180,29 @@ function validateStage(value, errors) {
   return out;
 }
 
+function validateVerifySidecars(value, errors) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("verifySidecars must be { receipt, target }"); return undefined; }
+  unknownKeys(value, VERIFY_SIDECARS_KEYS, "verifySidecars", errors);
+  if (value.target !== UNIVERSAL_TRIPLE) errors.push(`verifySidecars.target must be ${UNIVERSAL_TRIPLE}`);
+  const receipt = insideApp(value.receipt, "verifySidecars.receipt", errors, { strict: true });
+  return receipt ? { receipt, target: UNIVERSAL_TRIPLE } : undefined;
+}
+
+function validateNativeHelpersSection(value, errors, bound = []) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("nativeHelpers must be { app, helpers, version?, forceArch?, configuration? }"); return undefined; }
+  unknownKeys(value, NATIVE_HELPERS_KEYS, "nativeHelpers", errors);
+  const app = insideApp(value.app, "nativeHelpers.app", errors, { strict: true, bound });
+  if (app && !app.replace(/\/+$/, "").endsWith(".app")) errors.push("nativeHelpers.app must name the .app bundle");
+  let helpers;
+  try { helpers = validateNativeHelpers(value.helpers, { label: "nativeHelpers.helpers" }); } catch (error) { errors.push(...(error.details?.errors ?? [error.message])); }
+  if (value.forceArch !== undefined && !["arm64", "x86_64"].includes(value.forceArch)) errors.push("nativeHelpers.forceArch must be arm64 or x86_64");
+  if (value.configuration !== undefined && !["release", "debug"].includes(value.configuration)) errors.push("nativeHelpers.configuration must be release or debug");
+  if (value.version !== undefined && (typeof value.version !== "string" || !/^\d+(\.\d+){0,2}$/.test(value.version))) errors.push("nativeHelpers.version must be 1-3 numeric parts");
+  return app && helpers ? { app, helpers, ...(value.version === undefined ? {} : { version: value.version }), ...(value.forceArch ? { forceArch: value.forceArch } : {}), ...(value.configuration ? { configuration: value.configuration } : {}) } : undefined;
+}
+
 /** Validate a plan strictly; every problem is reported at once as RECIPE_BUILD_PLAN_INVALID. Returns the normalized plan. */
 export function validateRecipePlan(plan) {
   const errors = [];
@@ -181,13 +230,19 @@ export function validateRecipePlan(plan) {
     steps.push({ phase: step.phase, cmd: step.cmd, args: Array.isArray(args) ? [...args] : [], ...(cwd ? { cwd } : {}), ...(isObject(step.env) ? { env: { ...step.env } } : {}) });
   }
   if (builds !== 1) errors.push(`exactly one build step is required, found ${builds}`);
-  const cleanup = validateCleanup(plan.cleanup, errors);
-  const stability = validateStability(plan.stability, errors);
+  const boundTargets = validateBoundTargets(plan.boundTargets, errors);
+  const cleanup = validateCleanup(plan.cleanup, errors, boundTargets ?? []);
+  const stability = validateStability(plan.stability, errors, boundTargets ?? []);
   const stage = validateStage(plan.stage, errors);
+  const verifySidecars = validateVerifySidecars(plan.verifySidecars, errors);
+  const nativeHelpers = validateNativeHelpersSection(plan.nativeHelpers, errors, boundTargets ?? []);
+  if (boundTargets && stage && (stage.pre?.length || stage.post?.length)) errors.push("a plan that binds Cargo targets (a door split) plans no stage copies: the build output is read and signed in place (rightkit#924 copies are zero)");
   if (errors.length) fail("RECIPE_BUILD_PLAN_INVALID", `invalid recipe plan:\n${errors.map((line) => `- ${line}`).join("\n")}`, { errors });
-  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}) };
+  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(boundTargets ? { boundTargets } : {}), ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
 }
 
+/** This package's own right-release entry: the door's RightKit, whatever the app's node_modules holds. */
+export const OWN_RIGHT_RELEASE = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
 // cmd.exe would reinterpret these in a shell launch; refuse rather than escape.
 const SHELL_UNSAFE = /[&|<>^%"!\r\n]/;
 
@@ -196,7 +251,11 @@ const SHELL_UNSAFE = /[&|<>^%"!\r\n]/;
  * release runs under pnpm). On Windows a non-.exe command is a .cmd shim that only a shell can start, so it is allowed
  * only when no argument could be reinterpreted by that shell.
  */
-export function resolveLaunch({ cmd, args = [], platform = process.platform, env = process.env, execPath = process.execPath }) {
+export function resolveLaunch({ cmd, args = [], platform = process.platform, env = process.env, execPath = process.execPath, ownRightRelease = OWN_RIGHT_RELEASE }) {
+  // A step's `right-release ...` (also `pnpm exec right-release ...` and `pnpm right-release ...`) runs THIS package's own CLI, never the
+  // app's node_modules copy that `pnpm exec` would put first on PATH (the same rule as development.mjs resolveCommand).
+  if (cmd === "right-release") return { command: execPath, args: [ownRightRelease, ...args], shell: false };
+  if (cmd === "pnpm" && ((args[0] === "exec" && args[1] === "right-release") || args[0] === "right-release")) return { command: execPath, args: [ownRightRelease, ...args.slice(args[0] === "exec" ? 2 : 1)], shell: false };
   if (cmd === "pnpm" && env.npm_execpath) return { command: execPath, args: [env.npm_execpath, ...args], shell: false };
   if (platform === "win32" && !/\.(?:exe|com)$/i.test(cmd)) {
     if ([cmd, ...args].some((value) => SHELL_UNSAFE.test(value))) fail("RECIPE_BUILD_LAUNCH_UNSAFE", `${cmd} needs a shell on Windows and its arguments contain characters a shell would reinterpret; run the release under pnpm (npm_execpath) or name an .exe`, { cmd });
@@ -330,6 +389,7 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
   const cleaned = runRecipeCleanup(plan.cleanup, { appRoot, platform, log, spawnSync, ...(fs ? { fs } : {}) });
   let stable = [];
   let staged = [];
+  let nativeHelpers = null;
   const stagePost = plan.stage?.post ?? [];
   const resolveEntry = (entry, appKey) => ({ ...entry, [appKey]: path.resolve(appRoot, entry[appKey]) });
   for (const [index, step] of plan.steps.entries()) {
@@ -342,6 +402,7 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
       // Immediately before the step that embeds the real EXE: it must be exactly the signed in-app copy.
       verifyReal("after the copy-back, before the build step");
     }
+    if (step.phase === "build" && plan.verifySidecars) verifyUniversalSidecars(plan.verifySidecars, { appRoot, spawnSync, env, log, ...(fs?.readFileSync ? { readFile: fs.readFileSync } : {}) });
     const launch = resolveLaunch({ cmd: step.cmd, args: step.args, platform, env });
     const cwd = path.resolve(appRoot, step.cwd ?? ".");
     log(`recipe-build: [${step.phase}] ${step.cmd} ${step.args.join(" ")}`.trimEnd());
@@ -355,8 +416,39 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
     if (step.phase === "build" && stagePost.length) waitForStableArtifacts({ ...(plan.stability ?? {}), files: stagePost.map((entry) => entry.from).filter((file) => (fs?.existsSync ?? nodeExistsSync)(file)) }, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
     if (step.phase === "build" && stagePost.length) staged.push(...stageArtifacts(stagePost.map((entry) => resolveEntry(entry, "to")), { ...(fs ? { fs } : {}), log }));
     if (step.phase === "build") stable = waitForStableArtifacts(plan.stability, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
+    // Native Swift helpers are built and embedded into the built .app AFTER the app exists and BEFORE postBuild and signing.
+    if (step.phase === "build" && plan.nativeHelpers) {
+      const section = plan.nativeHelpers;
+      nativeHelpers = buildAndEmbedNativeHelpers({ appRoot, app: path.resolve(appRoot, section.app), helpers: section.helpers, version: section.version, forceArch: section.forceArch, configuration: section.configuration ?? "release", env, spawn: spawnSync, log, ...(fs ? { fs } : {}) });
+    }
+  }
+  return { steps: done, cleaned, stable, staged, nativeHelpers };
+}
+
+/**
+ * After the prepare steps of a universal macOS build: the stage-sidecar receipt must be for universal-apple-darwin and every
+ * externalBin file it lists must be named `<name>-universal-apple-darwin` (the name Tauri's universal build looks for) and hold
+ * exactly arm64 and x86_64 (`lipo -archs`). Anything else throws RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL before the Tauri build starts.
+ * Options: appRoot, spawnSync, readFile, env, log.
+ */
+export function verifyUniversalSidecars(section, { appRoot, spawnSync = nodeSpawnSync, readFile = readFileSync, env = process.env, log = () => {} } = {}) {
+  const receiptFile = path.resolve(appRoot, section.receipt);
+  let receipt;
+  try { receipt = JSON.parse(readFile(receiptFile, "utf8")); } catch (error) { fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `cannot read the stage-sidecar receipt ${section.receipt} (${error.message}); stageSidecars must run before the build`); }
+  if (!isObject(receipt) || !Array.isArray(receipt.files)) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `${section.receipt} is not a stage-sidecar receipt`);
+  if (receipt.target !== section.target) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `${section.receipt} was staged for ${receipt.target}, not ${section.target}`);
+  const checked = [];
+  for (const file of receipt.files.filter((item) => item?.externalBin === true)) {
+    if (typeof file.path !== "string" || !file.path.endsWith(`-${UNIVERSAL_TRIPLE}`)) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `externalBin ${file.name} is staged as ${file.path}, not <name>-${UNIVERSAL_TRIPLE}`);
+    const absolute = path.resolve(appRoot, file.path);
+    if (path.relative(appRoot, absolute).startsWith("..")) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `externalBin ${file.name} path escapes the app: ${file.path}`);
+    const result = spawnSync("lipo", ["-archs", absolute], { cwd: appRoot, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const archs = String(result?.stdout ?? "").trim().split(/\s+/).filter(Boolean).sort();
+    if (result?.error || result?.status !== 0 || archs.join(" ") !== "arm64 x86_64") fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `externalBin ${file.path} must hold exactly arm64 and x86_64, lipo -archs reports ${JSON.stringify(archs.join(" "))}${result?.error ? ` (${result.error.message})` : ""}`, { file: file.path, archs });
+    checked.push(file.path);
   }
-  return { steps: done, cleaned, stable, staged };
+  log(`recipe-build: universal sidecars verified (${checked.length} externalBin file(s))`);
+  return checked;
 }
 
 export function parseRecipeBuildArgs(argv) {