release-skill 0.6.3 → 0.7.1

package/src/core/postpublish-projection.mjs

@@ -0,0 +1,210 @@
+/**
+ * Public payload managed projection (F-06 / T6).
+ *
+ * Release-domain orchestration ONLY. Full preflight, path containment,
+ * lexical classification, transactional writes, rollback, and closure
+ * digests all come from the exact Foundation version pinned by
+ * `packages/release-skill/package.json` and `pnpm-lock.yaml`
+ * `compileProjectionPlan()` / `runProjection()` by package import; strict
+ * no-follow source reads come from `skill-family-harness-node`
+ * `readFileStrict()`. This module never reimplements a containment check, a
+ * preflight, a writer, or a rollback — it supplies exactly the release
+ * semantics the Foundation mechanisms do not own:
+ *
+ * - WHAT is projected: the frozen plan's `postPublish.executionBundle.
+ *   publicFiles` mapping (schema- and runtime-validated before the plan was
+ *   frozen). Live project configuration is never read here or downstream —
+ *   the frozen plan is the only authority, per the R1 timing contract.
+ * - WHERE the bytes come from: the detached tag worktree at the frozen
+ *   tagCommit (snapshot layout — public files live at their `to` paths),
+ *   read strictly (no-follow, regular-file identity, digest receipt).
+ * - WHERE the payload lands: a completely fresh `hub-payload` root inside
+ *   the execution worktree. The payload root must not pre-exist; a planted
+ *   symlink or stale directory at that path fails closed before any write.
+ * - HOW authority is bound: the frozen mapping bytes ride the projection
+ *   plan as a `caller-bytes` authority binding (FG-3) — the projection never
+ *   reads authority from the target root and never forges target-local
+ *   authority facts; the Kit re-verifies the digest-bound bytes before every
+ *   mutation.
+ *
+ * Ordering guarantee: mapping shape checks, strict source staging, and the
+ * pure compile step all happen BEFORE the payload root is created — lexical
+ * escapes, duplicates, and collisions refuse with zero writes and leave no
+ * partial `hub-payload` behind.
+ *
+ * @module core/postpublish-projection
+ */
+
+import { chmod, lstat, mkdir, realpath, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+
+import {
+  buildProjectionClosure,
+  compileProjectionPlan,
+  runProjection,
+} from 'skill-family-engineering-kit';
+import { digestBytes, readFileStrict } from 'skill-family-harness-node';
+
+import { ReleaseError, POST_PUBLISH_VERIFY_FAILED } from './errors.mjs';
+
+/** Mechanism identity recorded in the materialize evidence. */
+export const PROJECTION_MECHANISM = 'foundation.engineering-kit.projection';
+
+/** The fresh payload root staged inside the execution worktree. */
+export const PUBLIC_PAYLOAD_DIRNAME = 'hub-payload';
+
+/** Authority identity of the frozen publicFiles mapping. */
+const AUTHORITY_ID = 'frozen-public-files';
+const AUTHORITY_PATH = 'postpublish-public-files.json';
+
+/** Ownership identity recorded for every projected payload file. */
+const OWNER_ID = 'release-skill-postpublish';
+
+function fail(message, details = {}) {
+  throw new ReleaseError(POST_PUBLISH_VERIFY_FAILED, `public payload projection: ${message}`, details);
+}
+
+/**
+ * Stage the frozen public payload into a fresh `hub-payload` root inside the
+ * execution worktree through the Foundation managed projection.
+ *
+ * @param {object} params
+ * @param {string} params.executionWorktreeRoot - Detached tag worktree root
+ *   (frozen tagCommit checkout; snapshot layout).
+ * @param {string} params.candidateRoot - Disposable staging directory for the
+ *   candidate closure (external to the payload root; caller owns cleanup).
+ * @param {object[]} params.publicFiles - Frozen plan publicFiles mapping.
+ * @returns {Promise<{payloadRoot: string, fileCount: number, mechanism: string}>}
+ * @throws {ReleaseError} POST_PUBLISH_VERIFY_FAILED on any refusal — after
+ *   Foundation preflight/rollback semantics, never with a partial payload.
+ */
+export async function projectPublicPayload({ executionWorktreeRoot, candidateRoot, publicFiles } = {}) {
+  if (!executionWorktreeRoot || typeof executionWorktreeRoot !== 'string') {
+    throw new TypeError('projectPublicPayload: executionWorktreeRoot must be a directory path string');
+  }
+  if (!candidateRoot || typeof candidateRoot !== 'string') {
+    throw new TypeError('projectPublicPayload: candidateRoot must be a directory path string');
+  }
+
+  // --- Domain mapping shape (schema-validated upstream; re-checked fail-
+  // closed). Lexical path rejection belongs to Foundation classification. ---
+  if (!Array.isArray(publicFiles) || publicFiles.length === 0) {
+    fail('the frozen plan carries no publicFiles mapping; the payload cannot be staged');
+  }
+  for (const [index, entry] of publicFiles.entries()) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)
+      || typeof entry.from !== 'string' || entry.from.length === 0
+      || typeof entry.to !== 'string' || entry.to.length === 0
+      || entry.mode !== 'preserve') {
+      fail(`frozen publicFiles entry ${index} is not a valid preserve-mode mapping`, { index });
+    }
+  }
+
+  const worktreeReal = await realpath(executionWorktreeRoot).catch(() => null);
+  if (!worktreeReal) {
+    fail('the execution worktree does not resolve to an existing directory', { executionWorktreeRoot });
+  }
+
+  // --- Payload target preflight: the root must not pre-exist. The tag
+  // worktree is disposable and freshly created; a planted symlink or stale
+  // directory at the payload path fails closed BEFORE any write. ---
+  const payloadPath = join(worktreeReal, PUBLIC_PAYLOAD_DIRNAME);
+  const preExisting = await lstat(payloadPath).catch(() => null);
+  if (preExisting) {
+    fail(`the payload root already exists in the tag worktree (${preExisting.isSymbolicLink() ? 'symbolic link' : 'pre-existing entry'})`, {
+      path: PUBLIC_PAYLOAD_DIRNAME,
+    });
+  }
+
+  // --- Candidate staging: strict no-follow reads of every frozen `to` source
+  // from the frozen worktree (never the live workspace). A symlinked source
+  // is refused here — the escape target is never opened. ---
+  const stagedResources = [];
+  for (const entry of publicFiles) {
+    let receipt;
+    try {
+      receipt = await readFileStrict(executionWorktreeRoot, entry.to);
+    } catch (cause) {
+      fail(`cannot strictly read the frozen public file "${entry.to}" from the tag worktree: ${cause?.message ?? cause}`, {
+        path: entry.to,
+        kind: cause?.details?.kind,
+      });
+    }
+    const stagePath = join(candidateRoot, entry.to);
+    await mkdir(dirname(stagePath), { recursive: true });
+    await writeFile(stagePath, receipt.content);
+    await chmod(stagePath, receipt.mode);
+    stagedResources.push({ path: entry.to, sha256: receipt.sha256, mode: receipt.mode });
+  }
+
+  // --- Authority binding: the frozen mapping bytes ride the plan as a
+  // caller-bytes binding — no authority filesystem access, nothing forged
+  // into the target root. ---
+  const authorityBytes = Buffer.from(JSON.stringify(publicFiles), 'utf8');
+
+  // --- Pure compile: containment, duplicates, portable collisions, closure
+  // digests — every refusal happens before the payload root exists. ---
+  let prepared;
+  try {
+    prepared = compileProjectionPlan({
+      rootBinding: payloadPath,
+      authoritySources: [{
+        id: AUTHORITY_ID,
+        path: AUTHORITY_PATH,
+        type: 'file',
+        sha256: digestBytes(authorityBytes),
+        mode: 0o644,
+      }],
+      ownership: publicFiles.map((entry) => ({
+        path: entry.to,
+        authoritySource: AUTHORITY_ID,
+        owner: { kind: 'managed', id: OWNER_ID },
+        expect: { state: 'absent' },
+      })),
+      handwrittenPolicy: { authoritySource: AUTHORITY_ID, patterns: [] },
+      previousOwnedClosure: buildProjectionClosure([]),
+      externalCandidateClosure: buildProjectionClosure(stagedResources),
+      authorityBinding: {
+        kind: 'caller-bytes',
+        bytes: { [AUTHORITY_ID]: authorityBytes.toString('base64') },
+        freshRoot: true,
+      },
+    });
+  } catch (cause) {
+    fail(`the frozen publicFiles mapping cannot be compiled into a projection plan: ${cause?.message ?? cause}`, {
+      kind: cause?.details?.kind,
+    });
+  }
+
+  // --- Create the payload root and re-verify its identity (TOCTOU guard:
+  // the realpath must equal the compiled rootBinding). ---
+  try {
+    await mkdir(payloadPath);
+  } catch (cause) {
+    fail(`cannot create the fresh payload root: ${cause?.message ?? cause}`, { path: PUBLIC_PAYLOAD_DIRNAME });
+  }
+  const payloadReal = await realpath(payloadPath).catch(() => null);
+  if (!payloadReal || payloadReal !== payloadPath) {
+    fail('the payload root identity changed during creation (symbolic-link ancestor refused)', {
+      path: PUBLIC_PAYLOAD_DIRNAME,
+    });
+  }
+
+  // --- Foundation managed projection: complete preflight already passed;
+  // runProjection re-verifies candidate, authority, and target expectations
+  // before every mutation and restores the complete closure on failure. ---
+  try {
+    await runProjection({
+      root: payloadPath,
+      manifest: prepared.manifest,
+      candidateRoot,
+      preparedProjection: prepared,
+    });
+  } catch (cause) {
+    fail(`projection execution refused: ${cause?.message ?? cause}`, {
+      kind: cause?.details?.kind,
+    });
+  }
+
+  return { payloadRoot: payloadReal, fileCount: publicFiles.length, mechanism: PROJECTION_MECHANISM };
+}

package/src/core/postpublish.mjs

@@ -29,6 +29,7 @@ import {
   validatePresetHook,
   resolvePresetRequiresApproval,
 } from './presets.mjs';
+import { checkGitRemoteUrl, describeGitRemoteUrlFailure } from './git-url-policy.mjs';
 
 /** Secret-ish environment variable denylist (R3 credential hygiene). */
 export const ENV_ALLOWLIST_DENYLIST = /TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|CREDENTIAL/i;
@@ -39,9 +40,6 @@ const ENV_KEY_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
 /** Safe target/step id and step name pattern. */
 const SAFE_ID_RE = /^[a-z0-9][a-z0-9._-]*$/;
 
-/** Remote URL pattern: http(s) or file (test transport) and .git-suffixed. */
-const REMOTE_URL_RE = /^(?:https?|file):\/\/.+\.git$/;
-
 /** Branch pattern (leading alphanumeric blocks option-like names). */
 const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 
@@ -121,10 +119,13 @@ function validateTarget(target, index) {
   if (target.kind !== 'payload-mirror' && target.kind !== 'marketplace-index') {
     fail(`${where}.kind must be "payload-mirror" or "marketplace-index"`, { kind: target.kind });
   }
-  if (typeof target.remoteUrl !== 'string' || !REMOTE_URL_RE.test(target.remoteUrl)) {
-    fail(`${where}.remoteUrl must be an http(s)/file URL ending in .git`, { remoteUrl: target.remoteUrl });
+  const remoteUrlVerdict = checkGitRemoteUrl(target.remoteUrl);
+  if (!remoteUrlVerdict.ok) {
+    fail(
+      `${where}.remoteUrl ${describeGitRemoteUrlFailure(remoteUrlVerdict.reason)}`,
+      { reason: remoteUrlVerdict.reason },
+    );
   }
-  assertNoControlChars(`${where}.remoteUrl`, target.remoteUrl);
   if (target.visibility !== 'internal' && target.visibility !== 'public') {
     fail(`${where}.visibility must be "internal" or "public"`, { visibility: target.visibility });
   }
@@ -366,19 +367,25 @@ export function validatePostPublishDeclaration(postPublish, options = {}) {
     fail(`${unitLabel}postPublish must be a non-null object`);
   }
 
-  validateHookCommand(`${unitLabel}materialize`, postPublish.materialize);
-  if (typeof postPublish.materialize.outputMarker !== 'string'
-    || postPublish.materialize.outputMarker.length === 0) {
-    fail(`${unitLabel}materialize.outputMarker must be a non-empty string`);
-  }
-  assertNoControlChars(`${unitLabel}materialize.outputMarker`, postPublish.materialize.outputMarker);
-  if (postPublish.materialize.requireReport !== undefined) {
-    const { parse, equals } = postPublish.materialize.requireReport ?? {};
-    if (parse !== 'stdout-first-json') {
-      fail(`${unitLabel}materialize.requireReport.parse must be "stdout-first-json"`);
-    }
-    if (equals !== undefined && (typeof equals !== 'object' || Array.isArray(equals) || equals === null)) {
-      fail(`${unitLabel}materialize.requireReport.equals must be a plain object`);
+  // materialize is optional since F-06/T6: a declaration without a consumer
+  // materialize hook stages the payload through the frozen publicFiles
+  // managed projection (Foundation Engineering Kit). When present, the hook
+  // fields stay fail-closed exactly as before.
+  if (postPublish.materialize !== undefined) {
+    validateHookCommand(`${unitLabel}materialize`, postPublish.materialize);
+    if (typeof postPublish.materialize.outputMarker !== 'string'
+      || postPublish.materialize.outputMarker.length === 0) {
+      fail(`${unitLabel}materialize.outputMarker must be a non-empty string`);
+    }
+    assertNoControlChars(`${unitLabel}materialize.outputMarker`, postPublish.materialize.outputMarker);
+    if (postPublish.materialize.requireReport !== undefined) {
+      const { parse, equals } = postPublish.materialize.requireReport ?? {};
+      if (parse !== 'stdout-first-json') {
+        fail(`${unitLabel}materialize.requireReport.parse must be "stdout-first-json"`);
+      }
+      if (equals !== undefined && (typeof equals !== 'object' || Array.isArray(equals) || equals === null)) {
+        fail(`${unitLabel}materialize.requireReport.equals must be a plain object`);
+      }
     }
   }
 

package/src/core/preset-executor.mjs

@@ -35,6 +35,16 @@ import { executeDocsRefreshHook } from './docs-refresh-preset.mjs';
 /**
  * Execute one preset hook end-to-end.
  *
+ * F-04 root split: this seam receives `releaseWorkspaceRoot` — the real
+ * project root the user releases from. It is forwarded to proposal-inbox
+ * (local-file), marketplace-registry-entry, docs-refresh and the shared
+ * workspace preflight (§2.6) as the ONLY `target.workspace` resolution basis
+ * and release-workspace write-exclusion basis. The detached frozen-tag
+ * worktree is the execution worktree (materialize/steps/custom command
+ * hooks) and is NEVER accepted here: the legacy ambiguous `root` option is
+ * rejected fail-closed, and neither root falls back onto the other through
+ * defaults.
+ *
  * @param {object} params
  * @param {object} params.hook - Declared hook entry (preset + config).
  * @param {object} params.contextProjection - The §2.3 context projection of
@@ -43,8 +53,8 @@ import { executeDocsRefreshHook } from './docs-refresh-preset.mjs';
  *   projection for proposal documents (byte-deterministic redelivery);
  *   defaults to contextProjection.
  * @param {object} params.commitIdentity - Frozen postPublish commitIdentity.
- * @param {string} params.root - Release workspace root (preset workspace
- *   resolution; hooks run inside the frozen tag worktree).
+ * @param {string} params.releaseWorkspaceRoot - Release workspace root (the
+ *   real project root; preset workspace resolution + write exclusion).
  * @param {string} [params.evidencePath] - This run's evidence path
  *   (notify-handoff checklist rendering).
  * @param {Function} [params.exec] - Injectable git exec (tests).
@@ -59,7 +69,7 @@ export async function executePresetHook(params) {
     contextProjection,
     proposalContextProjection,
     commitIdentity,
-    root,
+    releaseWorkspaceRoot,
     evidencePath,
     exec,
     hookRunner,
@@ -68,6 +78,15 @@ export async function executePresetHook(params) {
   if (!hook || typeof hook.preset !== 'string') {
     throw new ReleaseError(POST_PUBLISH_VERIFY_FAILED, 'preset execution requires a preset hook entry');
   }
+  if (params?.root !== undefined) {
+    // F-04: the ambiguous `root` is gone. Silently honoring it would let the
+    // detached execution worktree impersonate the release workspace again.
+    throw new ReleaseError(
+      POST_PUBLISH_VERIFY_FAILED,
+      'executePresetHook no longer accepts the ambiguous "root" option; pass releaseWorkspaceRoot (the real project root) explicitly — the detached tag worktree is the execution worktree for materialize/steps/custom command hooks and is never the release workspace',
+      {},
+    );
+  }
   const proposalProjection = proposalContextProjection ?? contextProjection;
 
   switch (hook.preset) {
@@ -108,7 +127,7 @@ export async function executePresetHook(params) {
           hook,
           contextProjection: proposalProjection,
           commitIdentity,
-          root,
+          releaseWorkspaceRoot,
           ...(exec !== undefined ? { exec } : {}),
         });
       }
@@ -124,7 +143,7 @@ export async function executePresetHook(params) {
         hook,
         contextProjection,
         commitIdentity,
-        root,
+        releaseWorkspaceRoot,
         ...(exec !== undefined ? { exec } : {}),
         ...(hookRunner !== undefined ? { hookRunner } : {}),
       });
@@ -136,7 +155,7 @@ export async function executePresetHook(params) {
         contextProjection,
         commitIdentity,
         payloadDir,
-        root,
+        releaseWorkspaceRoot,
         ...(exec !== undefined ? { exec } : {}),
         ...(hookRunner !== undefined ? { hookRunner } : {}),
       });

package/src/core/preset-gitwrite.mjs

@@ -41,6 +41,12 @@ import {
 } from './errors.mjs';
 import { preflightPresetWorkspace, assertPresetWorkspaceExecution } from './presets.mjs';
 import { POSTPUBLISH_CONTEXT_ENV } from './postpublish.mjs';
+import {
+  checkGitRemoteUrl,
+  describeGitRemoteUrlFailure,
+  isAllowedGitRemoteUrl,
+  redactUrlCredentialsIfPresent,
+} from './git-url-policy.mjs';
 
 const execFileAsync = promisify(execFileCb);
 
@@ -49,7 +55,6 @@ const TRANSFER_TIMEOUT_MS = 300_000;
 const PROBE_TIMEOUT_MS = 30_000;
 const TMP_PREFIX = 'release-skill-preset-write-';
 
-const SAFE_REMOTE_URL_RE = /^(?:https?|file):\/\/.+\.git$/;
 const SAFE_BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const SHA_RE = /^[a-f0-9]{40}$/;
 
@@ -94,8 +99,13 @@ function hasControlChars(value) {
 }
 
 function assertSafeRemoteUrl(remoteUrl) {
-  if (typeof remoteUrl !== 'string' || !SAFE_REMOTE_URL_RE.test(remoteUrl) || hasControlChars(remoteUrl)) {
-    throw new ReleaseError(GATE_FAILED, 'preset downstream remoteUrl must be an http(s)/file URL ending in .git', { remoteUrl });
+  const verdict = checkGitRemoteUrl(remoteUrl);
+  if (!verdict.ok) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `preset downstream remoteUrl ${describeGitRemoteUrlFailure(verdict.reason)}`,
+      { reason: verdict.reason },
+    );
   }
 }
 
@@ -177,7 +187,7 @@ export async function crossCheckBranchTip(exec, remoteUrl, branch, pushedCommit)
     throw new ReleaseError(
       POST_PUBLISH_VERIFY_FAILED,
       `post-push cross-check failed: downstream branch ${branch} is at ${observed ?? '<missing>'}, which disagrees with the pushed commit ${pushedCommit}`,
-      { remoteUrl, branch, pushedCommit, observed },
+      { remoteUrl: redactUrlCredentialsIfPresent(remoteUrl), branch, pushedCommit, observed },
     );
   }
   return observed;
@@ -198,7 +208,8 @@ export async function crossCheckBranchTip(exec, remoteUrl, branch, pushedCommit)
  *   preset's files into the worktree.
  * @param {object[]} [params.gates] - Downstream gates (argument arrays).
  * @param {object} [params.contextProjection] - Injected into gate env.
- * @param {string} params.root - Release workspace root (workspace addressing).
+ * @param {string} params.releaseWorkspaceRoot - Release workspace root (the
+ *   real project root; workspace addressing resolution + write exclusion).
  * @param {Function} [params.exec] - Injectable git exec (tests).
  * @param {Function} [params.hookRunner] - Injectable gate runner (tests).
  * @returns {Promise<{ status: 'EXECUTED'|'NO_CHANGE', observation: object }>}
@@ -215,7 +226,7 @@ export async function applyDownstreamGitChange(params) {
     mutate,
     gates = [],
     contextProjection,
-    root,
+    releaseWorkspaceRoot,
     exec: execOpt,
     hookRunner,
   } = params ?? {};
@@ -258,12 +269,13 @@ export async function applyDownstreamGitChange(params) {
     } catch (error) {
       await rm(worktree, { recursive: true, force: true }).catch(() => {});
       const classification = classifyNetFailure(stderrText(error));
+      const safeRemoteUrl = redactUrlCredentialsIfPresent(target.remoteUrl);
       throw new ReleaseError(
         classification === 'auth' ? REMOTE_CONFLICT : REMOTE_UNAVAILABLE,
         classification === 'auth'
-          ? `preset downstream remote refused authentication for ${target.remoteUrl}; the host keychain credential is reused and never prompted, read, or retried`
-          : `cannot reach preset downstream remote ${target.remoteUrl} — start VPN / check network; delivery fails closed and never retries with credentials`,
-        { remoteUrl: target.remoteUrl, stderrTail: stderrTail(error) },
+          ? `preset downstream remote refused authentication for ${safeRemoteUrl}; the host keychain credential is reused and never prompted, read, or retried`
+          : `cannot reach preset downstream remote ${safeRemoteUrl} — start VPN / check network; delivery fails closed and never retries with credentials`,
+        { remoteUrl: safeRemoteUrl, stderrTail: stderrTail(error) },
       );
     }
     // Continue the declared branch when it exists; start a root commit otherwise.
@@ -281,9 +293,17 @@ export async function applyDownstreamGitChange(params) {
   } else {
     // Workspace addressing: §2.6 execution checks + a branch guard. The
     // checkout is used in place (no clone); the branch is never switched.
-    const preflight = await preflightPresetWorkspace(target.workspace, { root });
+    // F-04: the resolution basis is the release workspace root — never the
+    // detached execution worktree.
+    if (typeof releaseWorkspaceRoot !== 'string' || releaseWorkspaceRoot.length === 0) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        'preset downstream workspace addressing requires the release workspace root (releaseWorkspaceRoot); the detached execution worktree is never the release workspace',
+      );
+    }
+    const preflight = await preflightPresetWorkspace(target.workspace, { releaseWorkspaceRoot });
     const execution = await assertPresetWorkspaceExecution(target.workspace, {
-      root,
+      releaseWorkspaceRoot,
       preflightRealpath: preflight.realpath,
     });
     worktree = execution.realpath;
@@ -403,11 +423,12 @@ export async function applyDownstreamGitChange(params) {
       });
     } catch (error) {
       const classification = classifyNetFailure(stderrText(error));
+      const safeTargetAddress = redactUrlCredentialsIfPresent(target.remoteUrl ?? target.workspace);
       throw new ReleaseError(
         classification === 'auth' ? REMOTE_CONFLICT : REMOTE_UNAVAILABLE,
         classification === 'auth'
-          ? `preset downstream push refused authentication for ${target.remoteUrl ?? target.workspace}; the host keychain credential is reused and never prompted, read, or retried`
-          : `preset downstream push to ${target.remoteUrl ?? target.workspace} failed — start VPN / check network; delivery fails closed and never retries with credentials`,
+          ? `preset downstream push refused authentication for ${safeTargetAddress}; the host keychain credential is reused and never prompted, read, or retried`
+          : `preset downstream push to ${safeTargetAddress} failed — start VPN / check network; delivery fails closed and never retries with credentials`,
         { branch: target.branch, stderrTail: stderrTail(error) },
       );
     }
@@ -429,12 +450,12 @@ export async function applyDownstreamGitChange(params) {
       if (!crossCheckUrl) {
         crossCheckSkipReason =
           'workspace checkout declares no origin remote; the post-push ls-remote cross-check needs a remote URL';
-      } else if (!SAFE_REMOTE_URL_RE.test(crossCheckUrl)) {
+      } else if (!isAllowedGitRemoteUrl(crossCheckUrl)) {
         crossCheckSkipReason =
-          'workspace origin URL is not an http(s)/file URL (SSH and other transports are outside the ls-remote cross-check policy); post-push cross-check skipped';
+          'workspace origin URL is not a policy-allowed http(s)/file URL (SSH and other transports, or credential-embedded forms, are outside the ls-remote cross-check policy); post-push cross-check skipped';
       }
     }
-    if (crossCheckUrl && SAFE_REMOTE_URL_RE.test(crossCheckUrl)) {
+    if (crossCheckUrl && isAllowedGitRemoteUrl(crossCheckUrl)) {
       await crossCheckBranchTip(exec, crossCheckUrl, target.branch, localCommit);
     }
 

package/src/core/presets.mjs

@@ -57,10 +57,10 @@
 import { realpath, stat } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
 
-import { ReleaseError, GATE_FAILED, POSTPUBLISH_HOOK_INVALID } from './errors.mjs';
+import { classifyPathInput } from 'skill-family-harness-node';
 
-/** Remote URL pattern shared with core/postpublish.mjs target validation. */
-const REMOTE_URL_RE = /^(?:https?|file):\/\/.+\.git$/;
+import { ReleaseError, GATE_FAILED, POSTPUBLISH_HOOK_INVALID } from './errors.mjs';
+import { checkGitRemoteUrl, describeGitRemoteUrlFailure } from './git-url-policy.mjs';
 
 /** Branch pattern (leading alphanumeric blocks option-like names). */
 const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
@@ -160,12 +160,13 @@ function validateDownstreamTarget(where, target, { targetOptional }) {
     );
   }
   if (hasRemoteUrl) {
-    if (typeof target.remoteUrl !== 'string' || !REMOTE_URL_RE.test(target.remoteUrl)) {
-      failHook(`${where}.config.target.remoteUrl must be an http(s)/file URL ending in .git`, {
-        remoteUrl: target.remoteUrl,
-      });
+    const remoteUrlVerdict = checkGitRemoteUrl(target.remoteUrl);
+    if (!remoteUrlVerdict.ok) {
+      failHook(
+        `${where}.config.target.remoteUrl ${describeGitRemoteUrlFailure(remoteUrlVerdict.reason)}`,
+        { reason: remoteUrlVerdict.reason },
+      );
     }
-    assertNoControlChars(`${where}.config.target.remoteUrl`, target.remoteUrl);
   } else {
     if (typeof target.workspace !== 'string' || target.workspace.length === 0) {
       failHook(`${where}.config.target.workspace must be a non-empty string`);
@@ -632,24 +633,61 @@ export function validatePresetHook(hook, where) {
 
 // ---------------------------------------------------------------------------
 // Workspace preflight + execution checks (§2.6, three execution rules)
+//
+// F-04 root split: these checks receive `releaseWorkspaceRoot` — the real
+// project root the user releases from. It is the ONLY resolution basis for
+// preset `config.target.workspace` and the ONLY basis for the release-
+// workspace write exclusion. The detached frozen-tag worktree is the
+// execution worktree (materialize/steps/custom command hooks) and must never
+// be passed here: the two roots never fall back onto each other.
 // ---------------------------------------------------------------------------
 
 function failWorkspace(message, details = {}) {
   throw new ReleaseError(GATE_FAILED, `preset workspace invalid: ${message}`, details);
 }
 
+/**
+ * Resolve a declared workspace path against the release workspace root
+ * (F-04). Absolute workspaces pass through (preset-level exception); relative
+ * workspaces are lexically classified through Foundation `classifyPathInput`
+ * (ambiguous cross-platform shapes fail closed; no parallel path regex here)
+ * and resolved from `releaseWorkspaceRoot`.
+ *
+ * @param {string} workspace - Declared workspace path.
+ * @param {string} releaseWorkspaceRoot - The real release workspace root.
+ * @returns {string} The resolved (not yet realpathed) workspace path.
+ */
+function resolvePresetWorkspace(workspace, releaseWorkspaceRoot) {
+  if (typeof releaseWorkspaceRoot !== 'string' || releaseWorkspaceRoot.length === 0) {
+    failWorkspace(
+      'preset workspace checks require the release workspace root (releaseWorkspaceRoot); the detached execution worktree is never the release workspace',
+      {},
+    );
+  }
+  if (isAbsolute(workspace)) return workspace;
+  const classification = classifyPathInput(workspace);
+  if (!classification.ok) {
+    failWorkspace('workspace is not an unambiguous path input', {
+      workspace,
+      kind: classification.kind,
+    });
+  }
+  return resolve(releaseWorkspaceRoot, workspace);
+}
+
 /**
  * Preflight a `config.target.workspace` before any write: the path must
  * exist and be a git worktree (a `.git` entry), otherwise fail closed.
  * Returns the resolved realpath for evidence and the TOCTOU re-check.
  *
- * @param {string} workspace - Declared workspace path (relative to `root`
- *   or absolute; may leave the repository root by preset-level exception).
- * @param {object} options - { root: string }
+ * @param {string} workspace - Declared workspace path (relative to
+ *   `releaseWorkspaceRoot` or absolute; may leave the release workspace root
+ *   by preset-level exception).
+ * @param {object} options - { releaseWorkspaceRoot: string }
  * @returns {Promise<{ realpath: string }>}
  */
-export async function preflightPresetWorkspace(workspace, { root }) {
-  const resolved = isAbsolute(workspace) ? workspace : resolve(root, workspace);
+export async function preflightPresetWorkspace(workspace, { releaseWorkspaceRoot }) {
+  const resolved = resolvePresetWorkspace(workspace, releaseWorkspaceRoot);
   let real;
   try {
     real = await realpath(resolved);
@@ -674,14 +712,16 @@ export async function preflightPresetWorkspace(workspace, { root }) {
  * 2. it MUST equal the preflight realpath (TOCTOU: the path may not have
  *    been swapped for a symlink since preflight);
  * 3. it must be neither the release workspace itself nor inside the
- *    `.release-skill/` runtime directory.
+ *    `.release-skill/` runtime directory. The release-workspace comparison
+ *    uses `releaseWorkspaceRoot` (F-04): comparing against the detached
+ *    execution worktree would let a preset write into the real project.
  *
  * @param {string} workspace - Declared workspace path.
- * @param {object} options - { root, preflightRealpath }
+ * @param {object} options - { releaseWorkspaceRoot, preflightRealpath }
  * @returns {Promise<{ realpath: string }>}
  */
-export async function assertPresetWorkspaceExecution(workspace, { root, preflightRealpath }) {
-  const resolved = isAbsolute(workspace) ? workspace : resolve(root, workspace);
+export async function assertPresetWorkspaceExecution(workspace, { releaseWorkspaceRoot, preflightRealpath }) {
+  const resolved = resolvePresetWorkspace(workspace, releaseWorkspaceRoot);
   let real;
   try {
     real = await realpath(resolved);
@@ -694,8 +734,16 @@ export async function assertPresetWorkspaceExecution(workspace, { root, prefligh
       { workspace, preflightRealpath, observedRealpath: real },
     );
   }
-  const rootReal = await realpath(root).catch(() => null);
-  if (rootReal && real === rootReal) {
+  let rootReal;
+  try {
+    rootReal = await realpath(releaseWorkspaceRoot);
+  } catch {
+    failWorkspace(
+      'release workspace root does not resolve to an existing directory; the release-workspace write exclusion fails closed',
+      {},
+    );
+  }
+  if (real === rootReal) {
     failWorkspace('workspace must not be the release workspace itself', { workspace });
   }
   const segments = real.split(/[\\/]+/);