@runeditrun/rer 0.2.0 → 0.2.1

package/modules/release/verify.mjs

@@ -0,0 +1,27 @@
+import { resolve } from 'node:path';
+import { lstatSync } from 'node:fs';
+import { loadAnchors, verifyRelease } from './signature.mjs';
+import { readArtifact } from './statement.mjs';
+import { SIGNATURE_FILE, readBounded, safePath, refuse } from './signing-io.mjs';
+
+export async function verifyArtifact(artifact, anchors, environment, bytes, highest) {
+  const result = await verifyRelease(bytes, anchors, { environment, expect: artifact.subject,
+    files: artifact.files, highest, unsigned: { project: artifact.subject.project, version: artifact.subject.version } });
+  if (result.verdict !== 'VERIFIED') refuse(result.code ?? 'SIGNATURE_MISSING');
+  return result;
+}
+
+export async function receipt(options) {
+  const environment = options.environment ?? 'production';
+  const anchors = await loadAnchors(readBounded(options.anchors, 4 * 1024 * 1024), environment);
+  const signaturePath = resolve(safePath(options.artifact), SIGNATURE_FILE);
+  let bytes = null;
+  try { lstatSync(signaturePath); bytes = readBounded(signaturePath, 65536); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  // Authenticate before interpreting artifact bytes. Base never accepts a
+  // legacy unsigned floor; the shared verifier refuses null without one.
+  await verifyRelease(bytes, anchors, { environment });
+  const artifact = await readArtifact(options.artifact);
+  const highest = options.after ? { version: options.after.split(':')[0], statementSha256: options.after.split(':')[1] } : undefined;
+  await verifyArtifact(artifact, anchors, environment, bytes, highest);
+}

package/onboarding/production-assets.mjs

@@ -0,0 +1,23 @@
+import { watch } from 'node:fs';
+
+// Miniflare computes its asset manifest (and ETags) at setOptions, not per
+// request. Refresh it when built assets change; keep the same durable state.
+// Workers/modules remain fixed production output: no source build runs here.
+export function watchProductionAssets(runtime, options, convert, onError) {
+ const directories = [...new Set((options.workers ?? [options]).map(worker => worker.assets?.directory).filter(Boolean))];
+ const watchers = [];
+ let timer, pending = Promise.resolve(), closed = false;
+ const refresh = () => {
+  clearTimeout(timer);
+  timer = setTimeout(() => {
+   pending = pending.then(async () => { if (!closed) await runtime.setOptions(convert(options)); }).catch(error => { if (!closed) onError(error); });
+  }, 50);
+ };
+ try {
+  for (const directory of directories) {
+   const watcher = watch(directory,{recursive:true},refresh);
+   watcher.on('error',onError); watchers.push(watcher);
+  }
+ } catch (error) { for (const watcher of watchers) watcher.close(); throw error; }
+ return async () => {closed=true;clearTimeout(timer);for(const watcher of watchers)watcher.close();await pending;};
+}

package/onboarding/production-runtime.mjs

@@ -2,13 +2,14 @@ import {spawn} from 'node:child_process';
 import {fileURLToPath} from 'node:url';
 import {resolve} from 'node:path';
 import {projectMiniflare} from './production-options.mjs';
+import {watchProductionAssets} from './production-assets.mjs';
 
 // Preview's resident process. Wrangler resolves the Worker's options in a
 // short-lived child that exits before serving starts; this process then holds
 // only the pinned Miniflare, which owns one workerd and no bundler or
-// file/config watcher.
-let planner,stopping,runtime;
-const stop=()=>stopping??=(async()=>{planner?.kill('SIGTERM');await runtime?.dispose();})();
+// source/config watcher. Built-asset changes refresh its manifest.
+let planner,stopping,runtime,closeAssets;
+const stop=()=>stopping??=(async()=>{planner?.kill('SIGTERM');await closeAssets?.();await runtime?.dispose();})();
 process.on('SIGINT',()=>void stop());process.on('SIGTERM',()=>void stop());
 async function plan(){
  let text='';
@@ -25,6 +26,9 @@ try{
   const {Miniflare,convertV4MiniflareOptions}=await projectMiniflare(process.cwd());
   runtime=new Miniflare({...convertV4MiniflareOptions(options),resourcePersistencePath:resolve(process.cwd(),'.wrangler/state/v3')});
   if(stopping)await runtime.dispose();
-  else await runtime.ready;
+  else {
+   await runtime.ready;
+   if (!stopping) closeAssets=watchProductionAssets(runtime,options,value=>({...convertV4MiniflareOptions(value),resourcePersistencePath:resolve(process.cwd(),'.wrangler/state/v3')}),error=>{process.stderr.write(`Preview asset refresh failed: ${error.message}\n`);process.exitCode=1;void stop();});
+  }
  }
 }catch(error){await stop();throw error;}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeditrun/rer",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "The rer command: install, set up, run and launch Run Edit Run checkouts.",
   "license": "MIT",
   "type": "module",
@@ -70,6 +70,7 @@
     "./modules/release/export": "./modules/release/export.mjs",
     "./modules/release/publication-scan": "./modules/release/publication-scan.mjs",
     "./modules/release/source": "./modules/release/source.mjs",
+    "./modules/release/signature": "./modules/release/signature.mjs",
     "./modules/operator-auth": "./modules/operator-auth/index.mjs",
     "./modules/operator-auth/accounts/native": "./modules/operator-auth/accounts/native.mjs",
     "./modules/operator-auth/dev": "./modules/operator-auth/dev/index.mjs",

package/scripts/publish-check/README.md

@@ -8,32 +8,42 @@ blob reads to system Git (`rev-parse`, `rev-list`, `ls-tree`, `cat-file --batch`
 its report private until translating it into the value-free v3 envelope.
 Hexadecimal credential assignments also use a Gitleaks rule without generic
 entropy or English stopword filters. Both assignment rules go through the same
-location-bound Source/module identity proof; provider and environment findings
+location-bound Source/module identity classification; provider and environment findings
 remain independent.
 `tree_scan.py` applies the kept text and licence policy. `history_scan.py`
 assigns release, working-tree and historical scopes. The Node entry point bounds
 the whole operation and stops its private process group on timeout/cancellation.
 
+Git message records carry their kind explicitly. Only commit records enable the
+bounded public coauthor address rule described in the command guide; a file named
+`@commit-message` has no special status. `public_hygiene.py` matches complete raw
+`Co-Authored-By` lines in the final trailer paragraph case-insensitively and
+masks only the accepted address for email inspection, leaving names, other
+addresses and every other rule intact.
+
 Binary metadata decoding, Git protocol/object/ref modelling, frozen comparison,
 resumable inspection and their tests have been removed. Tests live in `tests.py`
 and `coverage_tests.py` and construct disposable repositories with actual Git.
 
-`content_identities.py` classifies only exact generic-api-key occurrences at
-proved Source key locations. It requires same-tree edition/lock selections,
-manifest and archive hashes, valid retained file records, and exact native match
-bytes. Retained archive bytes must hash to the maintained Source serializer's
-`hash(json(saved))` as well as the selected pin. `source_hashes.mjs` reuses that
-serializer. Duplicate JSON fields, non-JSON constants (including ignored fields),
-incorrect types, missing preimages, mismatched pins and unrecognized locations keep
-the native finding. Each selection's complete dependency closure must have valid
-archive and pin proofs before any location in that graph is allowed; unrelated
-coherent selections remain eligible. Normal origin repositories obey the maintained
-Source schema, including rejection of strings starting with `-`.
-Original/private keys and arbitrary copies of a known digest
-are not proofs. Provider and environment findings are unaffected. Native git/dir
-matches are held only in the private temporary report and memory for this proof;
-matched values are never added to the public report. This classification does not
-replace or relax the edition-authoring check.
+`content_identities.py` binds generic-api-key and hex-api-key occurrences to
+exact JSON value locations. `source_metadata.py` enumerates digest fields in the
+formats emitted by `edition-authoring/cli.mjs` and `sources.mjs`: lock manifest,
+toolchain, parent/baseline pins and file SHA-256 values; retained archive keys,
+content digests and dependency pins; and the source origins' revision or
+projection identities. These are format classifications independent of selected
+graphs, canonical serialization, archive preimages and authoring freshness.
+`source_shapes.py` first checks the documented local record types, immutable
+origin identity, source selections and file/pin records. A malformed archive or
+lock grants no identity roles; unknown extra fields never gain a role.
+`provenance_pins.py` keeps the existing module revision classification.
+
+`json_identity.py` rejects duplicate members and non-JSON constants and binds
+native findings to exact string byte spans. Only documented structural fields
+with the declared digest length qualify. An extra credential field, arbitrary
+nested field or copy of the digest on the same minified line remains a finding.
+Provider and known environment findings are independent. Native git/dir matches
+stay in the private temporary report and memory; values are never added to the
+public report. Authoring's integrity checks remain unchanged.
 
 `copy_identities.py` proves the maintained `base-copies.json` and portable
 `base/PROVENANCE.json` copy-inventory SHA-256 values

package/scripts/publish-check/content_identities.py

@@ -1,249 +1,30 @@
-"""Classify module Git pins and prove Source keys at specific JSON locations.
-
-This is classification, not Source authoring validation. A stale lock still
-fails the authoring check. Missing original preimages remain ordinary findings.
-"""
-import base64
-import hashlib
-import re
-import json
-from pathlib import Path
-import subprocess
-from json_identity import Document, HEX
+"""Classify documented JSON identities at exact native-match locations."""
+from json_identity import Document
 from provenance_pins import module_pins
 from copy_identities import copy_pointers
-
-ARCHIVE = re.compile(r'\.edition/sources/([a-f0-9]{64})\.json\Z')
+from source_metadata import ARCHIVE, source_pointers
 
 
 def candidate(path):
     return path in ('edition.json', 'sources.lock.json', 'base-copies.json', 'base/PROVENANCE.json') or bool(ARCHIVE.fullmatch(path))
 
 
-def safe_path(value):
-    return (isinstance(value, str) and value and not re.search(r'[\\\x00-\x1f\x7f]', value)
-            and all(part not in ('', '.', '..', '.git') for part in value.split('/')))
-
-
-def valid_files(files):
-    if not isinstance(files, dict) or not files:
-        return False
-    for name, file in files.items():
-        if (not safe_path(name) or not isinstance(file, dict) or not isinstance(file.get('data'), str)
-                or type(file.get('executable')) is not bool):
-            return False
-        try:
-            if base64.b64encode(base64.b64decode(file['data'], validate=True)).decode() != file['data']:
-                return False
-        except ValueError:
-            return False
-    return True
-
-
-def same_json(left, right):
-    # Python equates booleans and numbers; Source JSON identities do not.
-    return json.dumps(left, sort_keys=True) == json.dumps(right, sort_keys=True)
-
-
 class ContentIdentities:
     def __init__(self, files, read_regular=None):
-        self.documents, self.allowed, self.archives, self.hashes = {}, {}, {}, {}
+        self.documents, self.allowed = {}, {}
         for path, data in files.items():
-            if candidate(path):
-                try:
-                    self.documents[path] = Document(data)
-                except (ValueError, TypeError, IndexError, RecursionError, UnicodeError):
-                    pass
-        if not self.documents:
-            return
-        for path, document in self.documents.items():
-            for pointer in module_pins(path, document.value):
-                self.allow(path, pointer)
-            if path in ('base-copies.json', 'base/PROVENANCE.json') and read_regular is not None:
-                for pointer in copy_pointers(document.value, read_regular):
-                    self.allow(path, pointer)
-        recipe = self.document('edition.json')
-        origins = [self.origin(recipe.get('parent'), True)]
-        components = recipe.get('components', [])
-        if isinstance(components, list):
-            for component in components:
-                source = component.get('source') if isinstance(component, dict) else None
-                if isinstance(source, dict):
-                    origins.append(self.origin(source if source.get('kind') == 'git' else source.get('origin')))
-        values = [recipe, *(v for v in origins if v is not None)]
-        for path, document in self.documents.items():
-            saved = document.value
-            if ARCHIVE.fullmatch(path) and isinstance(saved, dict):
-                values.extend([saved, saved.get('origin'), saved.get('files')])
-        self.hashes = {}
-        if values:
-            try:
-                result = subprocess.run(['node', str(Path(__file__).with_name('source_hashes.mjs'))],
-                                        input=json.dumps(values).encode(), capture_output=True, timeout=60, check=True)
-                hashes = json.loads(result.stdout)
-                if len(hashes) != len(values) or not all(isinstance(h, str) and HEX.fullmatch(h) for h in hashes):
-                    return
-                self.hashes = {json.dumps(v): h for v, h in zip(values, hashes)}
-            except (OSError, ValueError, subprocess.SubprocessError):
-                return
-        # Authoring pins hash(json(saved)); a raw-byte pin alone cannot prove a
-        # differently encoded retained archive, even when its fields agree.
-        for path, document in self.documents.items():
-            saved, match = document.value, ARCHIVE.fullmatch(path)
-            if (match and isinstance(saved, dict) and saved.get('key') == match[1]
-                    and isinstance(saved.get('origin'), dict) and saved['origin']
-                    and valid_files(saved.get('files'))
-                    and isinstance(saved.get('dependencies', []), list)
-                    and saved['key'] == self.digest(saved['origin'])
-                    and saved.get('digest') == self.digest(saved['files'])
-                    and hashlib.sha256(document.data).hexdigest() == self.digest(saved)):
-                self.archives[saved['key']] = (saved, hashlib.sha256(document.data).hexdigest())
-        self.references()
-
-    def digest(self, value):
-        return self.hashes.get(json.dumps(value))
-
-    def allow(self, path, pointer):
-        self.allowed.setdefault(path, set()).add(pointer)
-
-    def document(self, path):
-        doc = self.documents.get(path)
-        return doc.value if doc and isinstance(doc.value, dict) else {}
-
-    def pin(self, pin, key):
-        if not isinstance(pin, dict) or not isinstance(key, str) or key not in self.archives:
-            return False
-        archive, raw_sha = self.archives[key]
-        return (pin.get('key') == key and pin.get('digest') == archive['digest']
-                and pin.get('sha256') == raw_sha)
-
-    def reference(self, ref, parent=False):
-        if not isinstance(ref, dict):
-            return None
-        if not self.valid_selection(ref):
-            return None
-        selection = dict(path=ref.get('path') or '.', paths=ref.get('paths') or None,
-                         excludeSnapshots=True if parent else bool(ref.get('excludeSnapshots')))
-        projection = ref.get('projection')
-        if isinstance(projection, dict) and set(projection) == {'key', 'sha256'}:
-            key = projection['key']
-            if not isinstance(key, str) or key not in self.archives:
-                return None
-            saved, raw_sha = self.archives[key]
-            if (projection['sha256'] == raw_sha and same_json(saved['origin'].get('selection'), selection)):
-                return key
-            return None
-        origin = self.origin(ref, parent)
-        key = self.digest(origin)
-        if key in self.archives and same_json(self.archives[key][0]['origin'], origin):
-            return key
-        return None
-
-    @staticmethod
-    def valid_selection(ref):
-        return (ref.get('path', '.') == '.' or safe_path(ref.get('path'))) and (
-            ref.get('paths') is None or isinstance(ref['paths'], list) and bool(ref['paths'])
-            and all(safe_path(p) for p in ref['paths'])) and (
-            'excludeSnapshots' not in ref or type(ref['excludeSnapshots']) is bool)
-
-    @staticmethod
-    def origin(ref, parent=False):
-        if not isinstance(ref, dict) or not ContentIdentities.valid_selection(ref):
-            return None
-        projection = ref.get('projection')
-        if (not isinstance(ref.get('repository'), str) or not ref['repository']
-                or ref['repository'].startswith('-')):
-            return None
-        if 'projection' in ref:
-            if ('revision' in ref or not isinstance(projection, dict) or set(projection) != {'schemaVersion', 'originalSha256', 'recipeSha256'}
-                    or type(projection['schemaVersion']) is not int or projection['schemaVersion'] != 1
-                    or not all(isinstance(projection[k], str) and HEX.fullmatch(projection[k])
-                               for k in ('originalSha256', 'recipeSha256'))):
-                return None
-            identity = dict(projection=projection)
-        elif isinstance(ref.get('revision'), str) and re.fullmatch(r'[a-f0-9]{40}', ref['revision']):
-            identity = dict(revision=ref['revision'])
-        else:
-            return None
-        return dict(repository=ref['repository'], **identity, path=ref.get('path') or '.',
-                    paths=ref.get('paths') or None,
-                    excludeSnapshots=True if parent else bool(ref.get('excludeSnapshots')))
-
-    def dependency_locations(self, key):
-        # Stage the entire selected closure before granting any of its locations.
-        # An unresolved later edge must not leave the root or earlier edges allowed.
-        pending, visited, locations = [key], set(), []
-        while pending:
-            key = pending.pop()
-            if key in visited:
+            if not candidate(path):
                 continue
-            visited.add(key)
-            saved, _ = self.archives[key]
-            path = '.edition/sources/' + key + '.json'
-            locations.append((path, ('key',)))
-            for i, pin in enumerate(saved.get('dependencies', [])):
-                if not isinstance(pin, dict) or not self.pin(pin, pin.get('key')):
-                    return None
-                locations.append((path, ('dependencies', i, 'key')))
-                pending.append(pin['key'])
-        return locations
-
-    def references(self):
-        recipe = self.document('edition.json')
-        lock = self.document('sources.lock.json')
-        if type(recipe.get('schemaVersion')) is not int or recipe['schemaVersion'] != 1 or not isinstance(recipe.get('components'), list):
-            return
-        components = lock.get('components')
-        locked = (type(lock.get('schemaVersion')) is int and lock['schemaVersion'] == 1
-                  and isinstance(recipe.get('id'), str) and lock.get('edition') == recipe['id']
-                  and lock.get('manifest') == self.digest(recipe) and isinstance(components, list))
-        if not locked:
-            return
-        def identifiers(entries):
-            ids = [entry.get('id') for entry in entries if isinstance(entry, dict)]
-            return (len(ids) == len(entries) and all(isinstance(i, str) and i for i in ids)
-                    and len(set(ids)) == len(ids))
-        if not identifiers(recipe['components']) or not identifiers(components):
-            return
-        by_id = {c['id']: c for c in components}
-        if (len(components) != len(recipe['components']) or any(
-                c['id'] not in by_id or not same_json(c.get('source'), by_id[c['id']].get('source'))
-                for c in recipe['components'])):
-            return
-        selected = []
-        key = self.reference(recipe.get('parent'), parent=True)
-        if key and locked and self.pin(lock.get('parent'), key):
-            selected.append((key, [
-                ('edition.json', ('parent', 'projection', 'key')),
-                ('sources.lock.json', ('parent', 'key')),
-            ]))
-        for index, component in enumerate(recipe['components']):
-            if not isinstance(component, dict):
-                continue
-            source = component.get('source')
-            if not isinstance(source, dict):
-                continue
-            suffix = () if source.get('kind') == 'git' else ('origin',) if source.get('kind') == 'local' else None
-            if suffix is None:
-                continue
-            key = self.reference(source if not suffix else source.get('origin'))
-            if not key:
+            try:
+                document = Document(data)
+            except (ValueError, TypeError, IndexError, RecursionError, UnicodeError):
                 continue
-            for i, entry in enumerate(components):
-                if (isinstance(entry, dict) and entry.get('id') == component.get('id')
-                        and same_json(entry.get('source'), source) and self.pin(entry.get('baseline'), key)):
-                    selected.append((key, [
-                        ('edition.json', ('components', index, 'source', *suffix, 'projection', 'key')),
-                        ('sources.lock.json', ('components', i, 'baseline', 'key')),
-                        ('sources.lock.json', ('components', i, 'source', *suffix, 'projection', 'key')),
-                    ]))
-        # Validate each selection independently: unselected archives and unrelated
-        # coherent selections cannot invalidate this graph's proof.
-        for key, locations in selected:
-            dependencies = self.dependency_locations(key)
-            if dependencies is not None:
-                for path, pointer in locations + dependencies:
-                    self.allow(path, pointer)
+            self.documents[path] = document
+            pointers = set(module_pins(path, document.value))
+            pointers.update(source_pointers(path, document.value))
+            if path in ('base-copies.json', 'base/PROVENANCE.json') and read_regular is not None:
+                pointers.update(copy_pointers(document.value, read_regular))
+            self.allowed[path] = pointers
 
     def matches(self, path, hit):
         document = self.documents.get(path)

package/scripts/publish-check/git_history.py

@@ -96,12 +96,12 @@ class History:
         records = self.run('log', '-z', '--format=%H%x00%B', *self.revisions).split(b'\0')
         for index in range(0, len(records) - 1, 2):
             if records[index]:
-                yield '@commit-message', records[index].decode().strip(), records[index + 1]
+                yield 'commit', records[index].decode().strip(), records[index + 1]
         for record in self.run('for-each-ref', '--format=%(objecttype) %(objectname)', 'refs/tags').splitlines():
             kind, oid = record.decode().split()
             if kind == 'tag':
                 raw = self.run('cat-file', 'tag', oid)
-                yield '@tag-message', oid, raw.partition(b'\n\n')[2]
+                yield 'tag', oid, raw.partition(b'\n\n')[2]
 
     def close(self):
         if self.reader:

package/scripts/publish-check/gitleaks.toml

@@ -29,7 +29,7 @@ regexes = ['''\.(?:test|fixture|fake|example|dummy|placeholder|synthetic)[_-][a-
 
 # SHA-shaped credentials must not disappear because their random bytes contain
 # an English stopword (for example dead/feed) or fall below generic entropy.
-# Source/module identities still require the location-bound proof in Python.
+# Source/module identities still require exact structural JSON locations in Python.
 [[rules]]
 id = "hex-api-key"
 description = "Hexadecimal credential assignment"

package/scripts/publish-check/history_scan.py

@@ -128,7 +128,7 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
                         if identities[identity_scope].matches(path, hit):
                             continue
                     else:
-                        # Content-identity documents keep their own stricter proof.
+                        # Identity documents use their own exact structural locations.
                         held = working_regular(Path(history.repo), path) if mode == 'dir' else read_regular(path)
                         if held and checksums[identity_scope].matches(held[0], hit):
                             continue
@@ -146,9 +146,11 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
             scope = 'working-tree' if path in working_paths else 'pre-existing' if commit in history.public_commits else 'newly-public'
             lines.append((count, count + length, path, commit, scope))
             count += length
-        for path, commit, data in history.messages():
-            report['history']['tagMessages' if path == '@tag-message' else 'commitMessages'] += 1
-            rules, _ = text_rules(data, path, selected_context, resolver, hashes)
+        for message_type, commit, data in history.messages():
+            path = '@' + message_type + '-message'
+            report['history']['tagMessages' if message_type == 'tag' else 'commitMessages'] += 1
+            rules, _ = text_rules(data, path, selected_context, resolver, hashes,
+                                  commit_message=message_type == 'commit')
             scope = 'release-tree' if commit == history.commit else 'pre-existing' if commit in history.public_commits else 'newly-public'
             for rule in rules:
                 add(rule, path, commit, scope=scope)

package/scripts/publish-check/hygiene_config.py

@@ -9,7 +9,9 @@ LOCAL_PATH = re.compile(r'''(?x)(?<![^\s("'`=:\[<>{|])(?:[*_]|~~)*(?:(?:(?i:(?a:
 CONFIG = '.publish-check/config.json'
 # An alphabetic top-level label ends before a following digit, such as the DER
 # tag after a certificate's email value; other labels keep the full extent.
-EMAIL = re.compile(r"(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)*[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.(?:[A-Za-z]{2,63}(?![A-Za-z.-])|[A-Za-z][A-Za-z0-9-]{1,62}(?![A-Za-z0-9.-]))|(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:example|test|invalid)(?![A-Za-z0-9.-])", re.I)
+# A period is punctuation unless it starts another host label; never shorten
+# a suffixed host into a reserved/public domain.
+EMAIL = re.compile(r"(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)*[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.(?:[A-Za-z]{2,63}(?![A-Za-z-]|\.[A-Za-z0-9-])|[A-Za-z][A-Za-z0-9-]{1,62}(?![A-Za-z0-9-]|\.[A-Za-z0-9-]))|(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:example|test|invalid)(?![A-Za-z0-9-]|\.[A-Za-z0-9-])", re.I)
 RULES = {'hygiene.local-path', 'hygiene.github-private', 'hygiene.github-missing',
          'hygiene.email', 'hygiene.internal-reference'}
 

package/scripts/publish-check/public_hygiene.py

@@ -9,6 +9,29 @@ from hygiene_config import EMAIL, LOCAL_PATH, public_email
 from font_licence import without_required_notices
 from trust_bundle import anchor_values
 URI_AUTHORITY = re.compile(r'''(?i)(?a:(?P<scheme>[a-z][a-z0-9+.-]*:))?//(?P<authority>[^/?#\s<>"']+)''')
+# Match raw, complete commit trailer lines; decoded or embedded prose cannot
+# acquire trailer privileges. Only the address span is omitted from email checks.
+COAUTHOR = re.compile(
+    rb'^Co-Authored-By:[ \t]+[^<>\r\n]*[^<>\s][ \t]+<(?P<address>'
+    rb'noreply@(?:anthropic|github)\.com|'
+    rb'[0-9]+\+[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}@users\.noreply\.github\.com'
+    rb')>[ \t]*\r?$', re.I | re.M)
+
+
+def without_public_coauthor_addresses(data):
+    # A trailer block is the final paragraph and contains only trailer lines.
+    # A quoted attribution followed by ordinary prose stays ordinary body text.
+    tail = data.rstrip(b' \t\r\n')
+    block = re.split(rb'\r?\n[ \t]*\r?\n', tail)[-1]
+    if not all(re.fullmatch(rb'[A-Za-z0-9-]+:[ \t]+[^\r\n]+\r?', line)
+               for line in block.split(b'\n')):
+        return data
+    offset = len(tail) - len(block)
+    result = bytearray(data)
+    for match in COAUTHOR.finditer(block):
+        start, end = match.span('address')
+        result[offset + start:offset + end] = b' ' * (end - start)
+    return bytes(result)
 
 
 def email_userinfo(match):
@@ -25,7 +48,7 @@ def private_emails(text, config):
     # URL paths, queries and fragments remain visible to email inspection.
     email_text = URI_AUTHORITY.sub(email_userinfo, without_required_notices(text))
     email_text = re.sub(r'(?i)\b(?a:git@github\.com:)(?=[A-Za-z0-9])', '', email_text)
-    # A package manager's patch file is named name@version.patch.
+    # A package manager's patch filename joins the name and version with an at sign.
     version = r'(?:v?[0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9-]+)?|[a-f0-9]{40})(?:\.patch)?(?![A-Za-z0-9_.-])'
     email_text = re.sub(r'(?m)^\s*-?\s*uses:\s*[\"\']?[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@[^\s\"\']+', '', email_text)
     email_text = re.sub(r'(?<![A-Za-z0-9])(?:@[A-Za-z0-9_.-]+/)?[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)?@' + version, '', email_text)
@@ -69,11 +92,11 @@ def certificate_metadata(data, bundle, emails, config):
     return not Counter(emails) - inside
 
 
-def inspect(data, path, config, resolver):
-    return inspect_text(data, path, config, resolver)
+def inspect(data, path, config, resolver, *, commit_message=False):
+    return inspect_text(data, path, config, resolver, commit_message=commit_message)
 
 
-def inspect_text(data, path, config, resolver):
+def inspect_text(data, path, config, resolver, *, commit_message=False):
     # NUL removal covers UTF-16/32 ASCII content, matching the secret scanner.
     text = decoded_text(data)
     rules = set()
@@ -82,7 +105,8 @@ def inspect_text(data, path, config, resolver):
     if any(pattern.search(text) for pattern in config['internalReferencePatterns']):
         rules.add('hygiene.internal-reference')
     if '@' in text:
-        emails = private_emails(text, config)
+        email_text = decoded_text(without_public_coauthor_addresses(data)) if commit_message else text
+        emails = private_emails(email_text, config)
         bundle = config.get('trustBundles', {}).get(path)
         if emails and not (bundle and certificate_metadata(data, bundle, emails, config)):
             # Inside binary data a mailbox is judged by its own shape: a host

package/scripts/publish-check/publication-config.json

@@ -20,6 +20,8 @@
     { "repository": "just-every/run-nook", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
     { "repository": "just-every/run-orbit", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
     { "repository": "just-every/run-oncall", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
-    { "repository": "just-every/run-spool", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
+    { "repository": "just-every/run-spool", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-happytohelp", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-auth", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
   ]
 }

package/scripts/publish-check/source_metadata.py

@@ -0,0 +1,62 @@
+"""Digest fields in the formats emitted by edition-authoring cli/sources.mjs.
+
+This recognizes metadata, not its freshness or integrity. Authoring's check
+owns those validations; a retained, unselected archive is still metadata.
+Only enumerated JSON value locations qualify, never arbitrary nested names.
+"""
+import re
+from json_identity import HEX, GIT_REVISION
+import source_shapes
+
+ARCHIVE = re.compile(r'\.edition/sources/([a-f0-9]{64})\.json\Z')
+
+
+def fields(value, pointer, names, pattern=HEX):
+    if isinstance(value, dict):
+        for name in names:
+            if isinstance(value.get(name), str) and pattern.fullmatch(value[name]):
+                yield (*pointer, name)
+
+
+def pin(value, pointer):
+    # sources.mjs and cli.mjs emit this same three-digest reference shape.
+    if source_shapes.pin(value):
+        yield from fields(value, pointer, ('key', 'digest', 'sha256'))
+
+
+def origin(value, pointer):
+    # snapshotOrigin in projection-lock.mjs copies one immutable identity.
+    if not source_shapes.reference(value):
+        return
+    if 'projection' not in value:
+        yield from fields(value, pointer, ('revision',), GIT_REVISION)
+    else:
+        yield from fields(value['projection'], (*pointer, 'projection'), ('originalSha256', 'recipeSha256'))
+
+
+def source_pointers(path, value):
+    if not isinstance(value, dict):
+        return
+    if path == 'sources.lock.json':
+        if not source_shapes.lock(value):
+            return
+        yield from fields(value, (), ('manifest',))
+        yield from fields(value['toolchain'], ('toolchain',), ('sha256',))
+        yield from pin(value.get('parent'), ('parent',))
+        for index, component in enumerate(value['components']):
+            pointer = ('components', index)
+            yield from pin(component.get('baseline'), (*pointer, 'baseline'))
+            source = component['source']
+            if source['kind'] == 'git':
+                yield from origin(source, (*pointer, 'source'))
+            else:
+                yield from origin(source.get('origin'), (*pointer, 'source', 'origin'))
+        for name, entry in value['files'].items():
+            yield from fields(entry, ('files', name), ('sha256',))
+    elif ARCHIVE.fullmatch(path):
+        if not source_shapes.archive(value):
+            return
+        yield from fields(value, (), ('key', 'digest'))
+        yield from origin(value['origin'], ('origin',))
+        for index, dependency in enumerate(value.get('dependencies', [])):
+            yield from pin(dependency, ('dependencies', index))