Release Clearance Gate · Rust CLI + Multi-Tenant Web Control Plane

Does this build still match the last shipped artifact and the claims we made to users and stores?

Chrome extension zips drift. A teammate adds an undeclared analytics host, eval(), or broad *://*/* permissions while your store listing still promises strict opt-in privacy. Preflight gates every build before Chrome Web Store submission — in the browser or from your terminal.

Structured 5-Agent Static Analysis Pipeline

Out-of-process Rust binary · Zero JS execution

Every review runs five deterministic analysis agents and streams structured logs explaining what was inspected and why a verdict was reached:

AGENT 01 · src/artifact.rs

Artifact Gate & Hasher

Unpacks .zip and .crx v3 archives in memory, computes cryptographic SHA-256 digests, and confines files to the tenant's isolated storage partition.

AGENT 02 · src/extract.rs

Static Evidence Extractor

Walks manifest.json, HTML, and JS tokens without ever calling eval. Extracts permissions, network sockets, sensitive APIs, consent checks, and kill switches.

AGENT 03 · src/diff.rs

Baseline Capability Diff

Automatically diffs the candidate build against the project's last shipped artifact to flag newly added permissions (DIFF-01) and hosts (DIFF-02).

AGENT 04 · src/rules.rs

Policy & Claims Auditor

Evaluates cws-2026.1 (MV3, CSP, missing files, cleartext) and node-client-2026.1 (host allowlist vs. claims.json, consent gate, loopback protection).

AGENT 05 · src/review.rs

Release Clearance Arbiter

Emits block, needs_human, or ship_with_conditions. Enforces ADR-0003: auto_ship is hardcoded to false; a human signs off.

UNIFIED KEY · pf_live_…

Browser + Rust CLI Bridge

Your pf_live_… API key works in the Web Console AND directly in your terminal via preflight review --key and preflight push.

For Organizations & Teams

accountType: organization

Create an organization workspace, manage multiple extension projects with isolated baselines, and invite team members with scoped RBAC keys (admin, reviewer, or ci).

For Independent Developers

accountType: individual

Shipping your own Chrome extension solo? Sign up as an Independent Developer to get a personal isolated workspace, project claims storage, and a pf_live_… key for your terminal and browser.

Preflight Documentation & Reference

OpenAPI / Swagger UI (/docs) →

How to use Preflight across the Web Console, the Rust CLI in your terminal, and CI/CD pipelines.

1. Using Your API Key with the Rust CLI in Terminal

Every Organization member and Individual user gets a pf_live_<prefix>_<secret> key. You can use that exact same key in the browser console OR in your terminal:

Local static scan with key provenance or push directly to your web project:

# 1. Run deterministic local scan with your API key:
cargo run -- review fixtures/harbor-node/clean-relay \
  --claims fixtures/harbor-node/claims.json \
  --key pf_live_yourprefix_yoursecret \
  --out reviews/clean

# 2. Push local build + claims from terminal straight to your Web Console project:
cargo run -- push fixtures/harbor-node/clean-relay.zip \
  --project <YOUR_PROJECT_ID> \
  --claims fixtures/harbor-node/claims.json \
  --key pf_live_yourprefix_yoursecret \
  --api http://localhost:3080

2. Structured Scanner Agents & Policy Packs (cws-2026.1 & node-client-2026.1)

The scanner evaluates two built-in rule packs against your extension artifact and claims.json:

Control	Pack	Severity	What It Verifies
CWS-01	cws-2026.1	blocker	`manifest_version` must be `3`.
CWS-02	cws-2026.1	high	Every file referenced in `manifest.json` exists in the archive.
CWS-03 / CWS-07	cws-2026.1	high	Blocks broad host patterns (`:///*`, `<all_urls>`) and cleartext `http://` or `ws://` endpoints.
CWS-05 / CWS-06	cws-2026.1	high	Requires an `https://` privacy URL and a declared purpose for every manifest permission.
CWS-08	cws-2026.1	blocker	Blocks `eval()`, `new Function()`, remote script imports, and `unsafe-eval` CSP.
NODE-01 / NODE-02	node-client-2026.1	blocker	Every manifest host permission and JS network destination must match `claims.allowed_hosts`.
NODE-03 / NODE-04	node-client-2026.1	blocker/high	Networked extensions must enforce an explicit consent check and a runtime kill switch.
NODE-06 / NODE-07	node-client-2026.1	high	Blocks private/loopback network targets (`127.0.0.1`, `192.168.x.x`) and third-party `update_url` hosts.

3. Account Types (Organization vs. Individual) & RBAC Roles

Preflight isolates every workspace at the database, API key, and filesystem levels:

Organizations (accountType: "organization"): Designed for teams. Admins can invite team members (POST /v1/members/invite) and assign each person a dedicated pf_live_… key with role admin, reviewer, or ci.
Individuals (accountType: "individual"): Designed for solo developers. Creates a personal workspace with zero team-management overhead while still supporting additional personal CLI/CI keys.
Separation of Duties (ADR-0003): Keys with the ci role can upload builds and poll verdicts, but are cryptographically blocked from signing off human release decisions.

4. HTTP REST API Endpoints

Method	Endpoint	Auth	Description
POST	`/v1/signup`	Public	Create an `organization` or `individual` workspace and mint initial admin key.
POST	`/v1/sandbox/evaluate`	Public	Run ephemeral sandbox scan on Harbor Node fixtures with live agent console logs.
GET	`/v1/me`	Bearer `pf_live_…`	Retrieve active workspace, account type, current key role, and projects.
POST	`/v1/members/invite`	Admin Key	Invite a user under an Organization with their own `admin`, `reviewer`, or `ci` key.
POST	`/v1/projects/:id/reviews`	Any Key	Upload `artifact` (.zip/.crx) and optional `claims` JSON for review.
POST	`/v1/reviews/:id/sign-off`	Admin / Reviewer	Record mandatory human release decision (`ship`, `hold`, `reject`).

ORG key: —

Latest Project Verdict

—

Gate: auto_ship = false

Isolated Projects

Active: —

Project Reviews

0 cleared · 0 blocked

Scanner Engine & Packs

5 Agents

cws-2026.1 · node-client-2026.1

Release Build Submission

POST /v1/projects/:id/reviews

Simulate Harbor Node Drops in Active Project

Scanner Agent Console Logs & CLI Bridge

no review selected

Upload an extension build or trigger a simulation to stream the 5 structured scanner agent logs.

Use Your API Key in Terminal (Rust CLI)

cargo run -- push ./build.zip --project <project-id> --claims ./claims.json --key <pf_live_key>

Review Verdict, Findings & Mandatory Human Sign-Off

ADR-0003: Human Sign-Off Required

Select or run a review to inspect findings and sign off.

Project Review History

scoped to active project

No reviews for this project yet.

Team Members & API Keys

RBAC + Zero-Downtime Rotation

Invite User Under Organization (Mints Personal Member Key)

Member Name

Member Email

Member Role

reviewer — can submit builds, edit claims & sign off releases admin — full organization, project & member management ci — automated pipeline (submit & read only)