@rightkit/release 0.6.8 → 0.6.11

package/release-source-identity.mjs

@@ -0,0 +1,171 @@
+// Release source identity (item 7 row 7.04; signed/item7-sage-decisions-2.md Q2; docs/GATE-CONTRACT.md "Commit-only build").
+//
+// Every right-release command that builds, qualifies or ships a door stage asks one question before it trusts anything it reads: which
+// source is this, and what proves it? There are exactly two answers.
+//
+//   checkout  RK_GATE_CHECKOUT is not set (hosted CI, no door, or the Mac/Dell route before the cutover). The source is the checkout's
+//             HEAD, proven the way it always was: the primary worktree, a branch-attached HEAD and a clean status (R1). Nothing here
+//             changes for that route.
+//   snapshot  RK_GATE_CHECKOUT is set: this process is a child of a live door run (source-split.mjs `readSourceSplit`). The identity is
+//             the SELECTED COMMIT's immutable objects plus the gate's start and end verification of the snapshot under held ownership.
+//             It is never the checkout's HEAD, status or branch (GC:24 "no dirty-tree condition", GC:156 item 1, GC:182 E1): the
+//             checkout may be dirty, ahead, behind or detached.
+//
+// A process that names a split it cannot prove (no live run, an ended run, another checkout, a cwd outside the snapshot) is refused
+// (R2); it never falls back to the checkout checks, because that would build bytes the identity does not describe.
+//
+// `resolveReleaseSource` is the single owner. It returns a frozen record that only it can mint (release-source-brand.mjs), so the
+// evidence, QA and upload code can refuse a hand-built one. The record's fields are frozen by the decision record:
+//   { mode: "snapshot", commit, tree, checkout, checkoutAppRoot, snapshot, appRoot, commonDir }
+//   { mode: "checkout", commit, tree, repoRoot, appRoot }
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { resolveSelectedCommit } from "./committed-source.mjs";
+import { canonicalRepositoryIdentity } from "./ownership-approval.mjs";
+import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { dependencyClosure } from "./release-qa-receipt.mjs";
+import { brandReleaseSource, isReleaseSource } from "./release-source-brand.mjs";
+import { assertCleanSource } from "./source-gate.mjs";
+import { SOURCE_SPLIT_CODE, SourceSplitError, inSnapshot, readSourceSplit } from "./source-split.mjs";
+
+export const RELEASE_SOURCE_IDENTITY_CODE = "RK_SOURCE_IDENTITY";
+export const NO_REPOSITORY_CODE = "RK_SOURCE_NO_REPOSITORY";
+
+/** A release source whose identity does not hold (a commit or tree that is not the selected one, a file outside the snapshot). */
+export class ReleaseSourceError extends Error {
+  constructor(message, code = RELEASE_SOURCE_IDENTITY_CODE) { super(message); this.name = "ReleaseSourceError"; this.code = code; }
+}
+
+// What each resolved source was resolved with, so `assertReleaseSource` can prove the same facts again (a run that has ended since is no
+// split any longer) without the caller threading the context through.
+const contexts = new WeakMap();
+
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+
+function plainGit(git, cwd, args) {
+  const result = git("git", args, { cwd, encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
+  if (result?.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${String(result?.stderr ?? "").trim() || "no output"}`);
+  return String(result.stdout);
+}
+
+/**
+ * The source this process runs under. `git` runs git (a spawnSync-shaped function; tests inject a recorder). `readFile` and `alive` are
+ * passed to the door-run reader (tests only). Throws SourceSplitError (R2, R3) when a split is named but cannot be proven; throws
+ * an Error outside a git repository when no split is named.
+ */
+export function resolveReleaseSource({ cwd = process.cwd(), env = process.env, git = spawnSync, readFile, alive } = {}) {
+  const context = Object.freeze({ cwd, env, git, ...(readFile ? { readFile } : {}), ...(alive ? { alive } : {}) });
+  // 1. A live door run under the named checkout, the same checkout, and a cwd inside the run's snapshot. Throws when anything is off.
+  const split = readSourceSplit({ env, cwd, run: git, ...(readFile ? { readFile } : {}), ...(alive ? { alive } : {}) });
+  if (split) {
+    // 2. The tree is re-derived from the object database. It is never taken from the run file alone (R3).
+    let objects;
+    try { objects = resolveSelectedCommit(split.checkout, split.commit, { runner: git }); }
+    catch (error) { throw new SourceSplitError(`the door run's commit ${split.commit.slice(0, 12)} cannot be read from the object database of ${split.checkout}: ${error.message}`); }
+    if (objects.commit !== split.commit) throw new SourceSplitError(`the object database of ${split.checkout} answers ${objects.commit} for the door run's commit ${split.commit}`);
+    if (objects.tree !== split.tree) throw new SourceSplitError(`the door run records tree ${split.tree.slice(0, 12)} for commit ${split.commit.slice(0, 12)}, but the object database says ${objects.tree.slice(0, 12)} (R3)`);
+    const source = brandReleaseSource(Object.freeze({
+      mode: "snapshot", commit: objects.commit, tree: objects.tree, checkout: split.checkout, checkoutAppRoot: split.checkoutAppRoot,
+      snapshot: split.snapshot, appRoot: split.appRoot, commonDir: split.commonDir,
+    }));
+    contexts.set(source, context);
+    return source;
+  }
+  // The checkout route: HEAD of the repository at cwd, read exactly as each command always read it.
+  let repoRoot = "";
+  let detail = "";
+  try { repoRoot = plainGit(git, cwd, ["rev-parse", "--show-toplevel"]).trim(); } catch (error) { detail = ` (${error.message})`; }
+  if (!repoRoot) throw new ReleaseSourceError(`${cwd} is not inside a Git repository${detail}`, NO_REPOSITORY_CODE);
+  const commit = plainGit(git, repoRoot, ["rev-parse", "HEAD"]).trim();
+  const tree = plainGit(git, repoRoot, ["rev-parse", `${commit}^{tree}`]).trim();
+  if (!OBJECT_ID.test(commit) || !OBJECT_ID.test(tree)) throw new Error("the checkout's HEAD is not a commit");
+  const source = brandReleaseSource(Object.freeze({ mode: "checkout", commit, tree, repoRoot, appRoot: path.resolve(cwd) }));
+  contexts.set(source, context);
+  return source;
+}
+
+/** The record `resolveReleaseSource` minted, or a refusal: a hand-built look-alike never carries an identity. */
+export function requireReleaseSource(source) {
+  if (!isReleaseSource(source)) throw new SourceSplitError("the release source was not resolved by resolveReleaseSource; a hand-built source carries no identity");
+  return source;
+}
+
+export const isSnapshotSource = (source) => requireReleaseSource(source).mode === "snapshot";
+/** The root every git object read and every output, state, lock and sealed directory belongs to: the checkout (`.right-release` lives there). */
+export const gitRootOf = (source) => (requireReleaseSource(source).mode === "snapshot" ? source.checkout : source.repoRoot);
+/** The root every source, config, input and QA file is read from: the snapshot in a split, else the checkout. */
+export const sourceRootOf = (source) => (requireReleaseSource(source).mode === "snapshot" ? source.snapshot : source.repoRoot);
+
+/**
+ * Proves the source's identity holds now, for the command `commandId`.
+ *   checkout  R1, byte for byte as before: the primary worktree (branch-attached HEAD) and a clean status. `skipPrimaryCheckout` and
+ *             `skipCleanCheck` are the two existing seams (a test double; a phase resume that reads no unrelated source).
+ *   snapshot  The door run is proven again (live, this checkout, this cwd, the tree from the object database), then the checkout must
+ *             still be the primary worktree. No status, no HEAD and no branch is read: a dirty or moved checkout is irrelevant.
+ *             Writes into the snapshot are decided by the door's start and end verification, not here.
+ * Returns the source.
+ */
+export function assertReleaseSource(source, { commandId = "release", env, git, skipPrimaryCheckout = false, skipCleanCheck = false } = {}) {
+  requireReleaseSource(source);
+  const context = contexts.get(source);
+  const runGit = git ?? context.git;
+  const environment = env ?? context.env;
+  if (source.mode === "checkout") {
+    if (!skipPrimaryCheckout) assertPrimaryReleaseCheckout(source.repoRoot, environment);
+    if (!skipCleanCheck) assertCleanSource({ status: plainGit(runGit, source.repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId });
+    return source;
+  }
+  const again = resolveReleaseSource({ ...context, env: environment, git: runGit });
+  if (again.mode !== "snapshot") throw new SourceSplitError("the door run's source split is gone; nothing may continue from a snapshot that is no longer proven");
+  for (const key of ["commit", "tree", "checkout", "snapshot", "appRoot", "checkoutAppRoot"]) {
+    if (again[key] !== source[key]) throw new SourceSplitError(`the door run's source.${key} changed while ${commandId} ran`);
+  }
+  // The primary worktree identity stays (GC:31); only the branch-attached refusal, which reads HEAD, is skipped (GC:156).
+  if (!skipPrimaryCheckout) assertPrimaryReleaseCheckout(source.checkout, environment, { split: true });
+  return source;
+}
+
+/**
+ * R5: in a split, a config, build input, QA plan or test file must resolve inside the snapshot (symlinks resolved). In the checkout
+ * route there is no containment to prove and this does nothing.
+ */
+export function assertInsideSource(source, file, label = "a source file") {
+  if (!isSnapshotSource(source)) return;
+  if (typeof file !== "string" || !file) throw new ReleaseSourceError(`${label} has no path; a split build reads only the snapshot of ${source.commit.slice(0, 12)}`);
+  if (!inSnapshot({ snapshot: source.snapshot }, path.resolve(file))) {
+    throw new ReleaseSourceError(`${label} ${file} is outside the snapshot ${source.snapshot} of ${source.commit.slice(0, 12)}; a split build reads the commit's snapshot and never the checkout (R5)`);
+  }
+}
+
+/**
+ * R4 (and R8): a record that claims a source (a sealed manifest, ownership evidence, a resumed build's state) is for the selected
+ * commit and, when it names a tree, that commit's tree. Another commit or tree is refused, never reinterpreted.
+ */
+export function assertBindsSource(source, record, label = "the record") {
+  requireReleaseSource(source);
+  if (!record || typeof record !== "object") throw new ReleaseSourceError(`${label} is missing, so it cannot be bound to commit ${source.commit.slice(0, 12)}`);
+  if (record.commit !== source.commit) throw new ReleaseSourceError(`${label} is for commit ${String(record.commit ?? "(none)").slice(0, 12)}, not the selected commit ${source.commit.slice(0, 12)} (R4)`);
+  if (record.tree !== undefined && record.tree !== source.tree) throw new ReleaseSourceError(`${label} is for tree ${String(record.tree).slice(0, 12)}, not the selected commit's tree ${source.tree.slice(0, 12)} (R4)`);
+}
+
+/**
+ * The `{ commit, tree, repositoryIdentity }` a source QA receipt binds, for a snapshot source: the selected commit and tree, and the
+ * repository identity from the checkout's origin. Reads no HEAD. (The checkout route keeps release-qa-receipt.mjs `sourceIdentity`.)
+ */
+export function snapshotSourceIdentity(source, git = spawnSync) {
+  if (!isSnapshotSource(source)) throw new ReleaseSourceError("snapshotSourceIdentity is for a door source split");
+  const origin = plainGit(git, source.checkout, ["remote", "get-url", "origin"]).trim();
+  return { commit: source.commit, tree: source.tree, repositoryIdentity: canonicalRepositoryIdentity(origin) };
+}
+
+/**
+ * The `{ source, closure }` options `admitSourceQa` / `assertSourceQaAdmission` / `assertInstalledQaAdmission` take so that the receipt they
+ * verify is compared with the SELECTED commit (its tree, its repository identity, its lockfile closure read from its objects) instead of the
+ * checkout's HEAD. `{}` for the checkout route: those functions then read HEAD exactly as before. Spread it into their options.
+ */
+export function qaAdmissionSourceOptions(source, git = spawnSync) {
+  if (!isSnapshotSource(source)) return {};
+  return { source: snapshotSourceIdentity(source, git), closure: dependencyClosure(source.checkout, source.commit, git) };
+}
+
+export { SOURCE_SPLIT_CODE };

package/release.mjs

@@ -3,6 +3,7 @@ import { expandPackageRecipeTarget } from "./package-recipe-targets.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { buildLaunch } from "./build-launch.mjs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -13,6 +14,8 @@ import { assertQaAdoption, assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
 import { DECLARED_UNRELATED_POLICY, declaredUnrelatedRefusal, releaseArtifactPaths } from "./hosted-workflow-policy.mjs";
 import { assertNativeIosPrepareHasManifest, assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { resolveReleaseSource, sourceRootOf } from "./release-source-identity.mjs";
+import { ArtifactPathError, assertSplitCommandPaths, releaseCommandSteps, resolveArtifactPath, splitArtifactContext } from "./release-artifact-path.mjs";
 import { declaredCargoManifest, hasDefaultTauriManifest, resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import {
   canonicalPackageIdentity,
@@ -274,10 +277,17 @@ const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
 // state root and admission record; a snapshot from anywhere else is refused. The standalone doctor resolves live.
 const rightKitSnapshotFile = process.env[SNAPSHOT_ENV] || null;
 let rightKitResolution = null; // null when the registry resolution failed (recorded as the `rightkit-registry` finding)
+// The worker of a door split (row 7.04): its cwd is the snapshot, which has no git directory. Its commit and source root are the selected
+// commit's and the snapshot's (release-source-identity.mjs); the checkout route reads them from git as before.
+let workerSource = null;
+let artifactPathContext = null; // the declared-artifact resolver's context (artifactContext, row 7.04c)
+if (!opts.doctor && process.env.RK_GATE_CHECKOUT) {
+  try { workerSource = resolveReleaseSource({ cwd: process.cwd() }); } catch (error) { fail(`${error.code ?? "RK_SOURCE_IDENTITY"}: ${error.message}`); }
+}
 try {
   const lockInventory = () => {
     try {
-      const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+      const repoRoot = workerSource ? sourceRootOf(workerSource) : git(root, ["rev-parse", "--show-toplevel"]);
       let canonicalTarget = config.targets?.[opts.platform];
       try { canonicalTarget = expandPackageRecipeTarget(canonicalTarget, { platform: opts.platform, appRoot: root, config }); } catch { /* reported later */ }
       const inputs = resolveReleaseBuildInputs({ repoRoot, appRoot: root, configPath, config, target: canonicalTarget });
@@ -291,7 +301,7 @@ try {
     if (!rightKitSnapshotFile) throw new RightKitRegistryError("no-admission", "no admitted RightKit registry snapshot was handed to the release worker; run it through `right-release build`, which admits the release");
     const stateRoot = process.env.RIGHT_RELEASE_STATE_ROOT;
     if (!stateRoot) throw new RightKitRegistryError("no-admission", "RIGHT_RELEASE_STATE_ROOT is not set; the admitted RightKit registry snapshot cannot be located");
-    const commit = git(root, ["rev-parse", "HEAD"]);
+    const commit = workerSource ? workerSource.commit : git(root, ["rev-parse", "HEAD"]);
     boundSnapshot = loadAdmittedSnapshot(stateRoot, { releaseId: `${config.app}-${config.version}-${commit.slice(0, 8)}`, commit, platform: opts.platform, snapshotFile: rightKitSnapshotFile });
   }
   rightKitResolution = await prepareRightKitResolution({
@@ -347,6 +357,12 @@ await check("target", [], () => {
   if (!expanded) throw new Error(`${config.app ?? "app"} has no ${opts.platform} release target`);
   target = expanded;
 });
+// Row 7.04c (R-T1, R-T4): in a door split each Cargo manifest's target is bound now, once, before any step runs, and no step the app owns may name
+// a target-relative path (the snapshot has no target directory). Checkout mode checks nothing here.
+await check("split-artifact-paths", ["target"], () => {
+  if (!workerSource) return;
+  assertSplitCommandPaths(releaseCommandSteps({ target, config, root }), artifactContext());
+});
 const legalCheck = await check("legal-contract", [], () => (config.legal
   ? assertLegalReleaseContract(root, config.legal, config.app ?? path.basename(root), opts.platform)
   : null));
@@ -608,7 +624,7 @@ if (problems.length || prebuildFindings.length) {
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
-if (!command && opts.platform !== "android" && opts.platform !== "ios" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (!command && opts.platform !== "android" && opts.platform !== "ios" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }), { expanded: true })) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
   fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
 }
@@ -635,7 +651,7 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   // writes the App Installer route and the seal record. Never a second signer.
   await runCommand(target.prePackage, root);
   // Raw payload scan BEFORE the package is packed (a packed MSIX is only readable through its ZIP directory).
-  assertNoQaControlBinaries("msix staged payload", [path.resolve(root, target.msix.stageDir)], { requireBinary: true, prePack: true });
+  assertNoQaControlBinaries("msix staged payload", [resolveDeclaredPath(root, target.msix.stageDir)], { requireBinary: true, prePack: true });
   const options = msixBuildOptions({ root, target, app: config.app, dryRun: opts.dryRun, receipts: {
     pe: windowsReceiptPath(root, "raw-exe"), msix: windowsReceiptPath(root, "installer"),
     dir: path.dirname(windowsReceiptPath(root, "raw-exe")) } });
@@ -644,7 +660,7 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   // Second layer: read the finished package through its ZIP central directory (stored and deflate entries).
   if (!built.dryRun) assertNoQaControlBinaries("msix package", [options.out], { requireBinary: true });
 } else if (opts.platform === "win") {
-  const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
+  const rawFiles = target.sign.prePackageFiles.map((p) => resolveDeclaredPath(root, p));
   const sidecarPlan = await prepareMediaSidecar(root);
   const externalPlan = await prepareExternalBin(root);
   await runCommand(target.prePackage, root);
@@ -893,15 +909,25 @@ function assertNoWebBundleMocksInFrontend(phase, { required }) {
   } catch (error) { fail(error.message); }
 }
 
+// Row 7.04c (R-T2): one resolver for every declared artifact path. Checkout mode is the historical rule, byte for byte (the app root, then
+// RIGHT_RELEASE_ARTIFACT_DIR); a door split maps a target-prefixed path to its bound Cargo target and never reads the checkout.
+function artifactContext() {
+  artifactPathContext ??= splitArtifactContext({
+    cwd: root, env: process.env, nativeLayout, config, target: config.targets?.[opts.platform],
+    ...(workerSource?.mode === "snapshot" ? { snapshotRoot: workerSource.snapshot } : {}),
+  });
+  return artifactPathContext;
+}
+
 function resolveReleaseArtifactPath(root, declared) {
-  const local = path.resolve(root, declared);
-  if (existsSync(local)) return local;
-  const managed = process.env.RIGHT_RELEASE_ARTIFACT_DIR;
-  if (managed) {
-    const candidate = path.join(path.resolve(managed), path.basename(declared));
-    if (existsSync(candidate)) return candidate;
-  }
-  return local;
+  try { return resolveArtifactPath(declared, artifactContext()); }
+  catch (error) { if (error instanceof ArtifactPathError) fail(error.message); throw error; }
+}
+
+/** A declared path that never fell back to the managed artifact directory (a staged payload, a raw EXE): the app root, or in a split the same resolver. */
+function resolveDeclaredPath(root, declared) {
+  const context = artifactContext();
+  return context.mode === "split" ? resolveReleaseArtifactPath(root, declared) : path.resolve(root, declared);
 }
 
 function fail(message) {
@@ -1041,11 +1067,13 @@ function nativeSignedArtifacts(files, root) {
   return values.map((value) => {
     const declared = typeof value === "string" ? value : value?.path ?? value?.file;
     if (!declared) fail("native finalizer signed artifact path is missing");
-    const absolute = path.resolve(root, declared);
-    if (opts.dryRun) return { path: path.relative(root, absolute).replaceAll("\\", "/") };
+    const absolute = resolveDeclaredPath(root, declared);
+    // A split's bound target lies outside the app: its absolute path is the evidence there.
+    const evidencePath = () => { const relative = path.relative(root, absolute).replaceAll("\\", "/"); return relative.startsWith("..") ? absolute.replaceAll("\\", "/") : relative; };
+    if (opts.dryRun) return { path: evidencePath() };
     if (!existsSync(absolute)) fail(`native finalizer signed artifact missing: ${absolute}`);
     return {
-      path: path.relative(root, absolute).replaceAll("\\", "/"),
+      path: evidencePath(),
       sha256: createHash("sha256").update(readFileSync(absolute)).digest("hex"),
       sizeBytes: readFileSync(absolute).length,
     };
@@ -1079,7 +1107,7 @@ function nativeArchiveCandidates({ root, target, nativeAssembly }) {
     ...(target.installer?.artifacts ?? []).map((artifact) => artifact.file),
     ...(target.updater?.artifacts ?? []).map((artifact) => artifact.file),
   ].filter((value) => typeof value === "string" && value.trim());
-  return [...new Set(declared.map((value) => path.resolve(root, value)))];
+  return [...new Set(declared.map((value) => resolveDeclaredPath(root, value)))];
 }
 
 function nativeFinalizerOutputPath({ finalizer, target, root }) {
@@ -1141,14 +1169,16 @@ function sweepStaleRustArtifacts() {
 }
 
 async function runInstall(pm, cwd) {
-  if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd, {}, { install: true });
-  else if (pm === "npm") await run("npm", ["ci"], cwd, {}, { install: true });
+  if (pm === "pnpm") { const t = buildLaunch("pnpm", ["install", "--frozen-lockfile"], { cwd, exists: existsSync }); await run(t.command, t.args, cwd, t.env ?? {}, { install: true }); }
+  else if (pm === "npm") { const t = buildLaunch("npm", ["ci"], { cwd, exists: existsSync }); await run(t.command, t.args, cwd, t.env ?? {}, { install: true }); }
   else fail(`unsupported package manager: ${pm}`);
 }
 
 async function runPackageScript(pm, script, cwd) {
   if (script === false) return;
-  await run(pm, ["run", script], cwd);
+  // A package script (a check or a web build) goes through the one door (build-launch.mjs): a broker job on a managed host.
+  const target = buildLaunch(pm, ["run", script], { cwd, exists: existsSync });
+  await run(target.command, target.args, cwd, target.env ?? {});
 }
 
 // A hook may be one command object or an ordered array of them (e.g. create-mac-updater then lsclean).
@@ -1162,9 +1192,16 @@ async function runCommands(value, root, options) {
   for (const command of commandList(value)) await runCommand(command, root, options);
 }
 
+// Every configured hook (prePackage, the package command and hook, sidecar stages, gradle, the finalizer, postSign, publish) is
+// arbitrary code that can build, so it goes through the one door (build-launch.mjs): this package's own right-release steps run as
+// they are (their builds come back through the door), node, pnpm, cargo and rightkit-qa are broker jobs, and anything else is refused
+// on a broker-managed host (rightkit#1241).
 async function runCommand(command, root, { env = {}, captureStdout = false } = {}) {
   const cwd = path.resolve(root, command.cwd ?? ".");
-  return run(command.cmd, command.args ?? [], cwd, { ...(await commandEnv(command, root)), ...env }, {
+  const commandEnvironment = { ...(await commandEnv(command, root)), ...env };
+  const target = buildLaunch(command.cmd, command.args ?? [], { env: { ...process.env, ...commandEnvironment }, cwd, exists: existsSync });
+  // A direct (Linux) launch carries PATH without RustRight shim directories (build-launch `env`).
+  return run(target.command, target.args, cwd, { ...commandEnvironment, ...(target.env ?? {}) }, {
     ...command,
     captureStdout,
     timeoutMs: commandTimeoutMs(command),
@@ -1896,7 +1933,7 @@ async function verifyWindowsEmbedding({ root, target, files, markers }) {
     console.log("dry-run: verify installer embeds the signed raw EXE");
     return;
   }
-  const rawFile = path.resolve(root, target.sign.prePackageFiles[0]);
+  const rawFile = resolveDeclaredPath(root, target.sign.prePackageFiles[0]);
   const rawReceiptPath = windowsReceiptPath(root, "raw-exe");
   let rawReceipt;
   try { rawReceipt = JSON.parse(readFileSync(rawReceiptPath, "utf8")); } catch { fail(`missing raw EXE signing receipt: ${rawReceiptPath}`); }