ruvnet-brain 4.0.12 → 4.0.28

package/scripts/release-transaction.mjs

@@ -4,22 +4,52 @@ import crypto from 'node:crypto';
 export const RECEIPT_PREFIX = 'release-transaction-';
 export const TERMINAL_STATES = new Set(['channels-converged', 'aborted']);
 
+// `aborted` WAS UNREACHABLE, AND THAT BRICKED THE RELEASE RAIL (found 2026-08-07, issue #77).
+//
+// `aborted` has always been in TERMINAL_STATES, but no state below listed it as a target — so it
+// was a terminal state nothing could ever enter. Combined with `manual-intervention-required`
+// (which has NO outgoing transitions and is NOT terminal), an interrupted release had exactly two
+// destinations and both were permanent non-terminal dead ends.
+//
+// That is not theoretical. The v4.0.7 transaction (b2ac9b69…) stopped at `npm-stage-intent` and
+// stayed there. `runReleaseTransaction` treats every non-terminal receipt from another transaction
+// as competing, so it refused EVERY later release with
+//     `pending release b2ac9b69… blocks <new>`
+// and there was no legal move that could clear it. npm was then hand-moved to 4.0.12, which also
+// disqualified the provider's `settled` escape hatch (it requires receipt.version === npmLatest).
+// So the rail deadlocked itself, hand-publishing became the only way to ship, and hand-publishing
+// is precisely how npm and GitHub came to name different generations — the whole of #77.
+//
+// The fix is to give abandonment a legal move, which is what `aborted` was declared for. Any
+// non-terminal state may now abort. This LOOSENS nothing about a live release: `aborted` is
+// terminal, so a transaction that aborts can never resume and claim to have shipped, and the
+// competing-transaction guard still refuses two genuinely in-flight releases.
+const ABORTABLE = ['aborted'];
+
 export const ALLOWED_TRANSITIONS = Object.freeze({
-  'remote-prepared': ['asset-upload-intent', 'manual-intervention-required'],
-  'asset-upload-intent': ['npm-stage-intent', 'manual-intervention-required'],
-  'npm-stage-intent': ['npm-candidate-staged', 'manual-intervention-required'],
-  'npm-candidate-staged': ['remote-materialization-intent', 'manual-intervention-required'],
-  'remote-materialization-intent': ['prepared', 'manual-intervention-required'],
-  prepared: ['github-promote-intent', 'manual-intervention-required'],
-  'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required'],
-  'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required'],
-  'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required'],
-  'npm-promoted': ['github-latest-intent', 'compensation-intent', 'manual-intervention-required'],
-  'github-latest-intent': ['defaults-promoted', 'compensation-intent', 'manual-intervention-required'],
-  'compensation-intent': ['compensated', 'manual-intervention-required'],
-  compensated: ['github-promote-intent', 'npm-promote-intent', 'manual-intervention-required'],
-  'defaults-promoted': ['finalize-intent', 'manual-intervention-required'],
-  'finalize-intent': ['channels-converged', 'manual-intervention-required'],
+  'remote-prepared': ['asset-upload-intent', 'manual-intervention-required', ...ABORTABLE],
+  'asset-upload-intent': ['npm-stage-intent', 'manual-intervention-required', ...ABORTABLE],
+  'npm-stage-intent': ['npm-candidate-staged', 'manual-intervention-required', ...ABORTABLE],
+  'npm-candidate-staged': ['remote-materialization-intent', 'manual-intervention-required', ...ABORTABLE],
+  'remote-materialization-intent': ['prepared', 'manual-intervention-required', ...ABORTABLE],
+  prepared: ['github-promote-intent', 'manual-intervention-required', ...ABORTABLE],
+  'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required', ...ABORTABLE],
+  'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
+  'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  // `defaults-promoted` added 2026-08-07: when GitHub is ALREADY latest at the moment npm is
+  // promoted, the reducer correctly chooses `finalize` and the finalize path moves straight to
+  // `defaults-promoted` (release-transaction.mjs:406) — there is no `github-latest-intent` to pass
+  // through, because there is nothing left to intend. The table assumed that hop was mandatory, so
+  // the 4.0.24 publish promoted BOTH channels successfully and then died on its own bookkeeping
+  // with `illegal release transition npm-promoted -> defaults-promoted`. The publication was real;
+  // only the ledger entry was refused. Both defaults genuinely are promoted in that state, so this
+  // records what happened rather than permitting anything new.
+  'npm-promoted': ['github-latest-intent', 'defaults-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  'github-latest-intent': ['defaults-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  'compensation-intent': ['compensated', 'manual-intervention-required', ...ABORTABLE],
+  compensated: ['github-promote-intent', 'npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
+  'defaults-promoted': ['finalize-intent', 'manual-intervention-required', ...ABORTABLE],
+  'finalize-intent': ['channels-converged', 'manual-intervention-required', ...ABORTABLE],
   'manual-intervention-required': [],
   'channels-converged': [],
   aborted: [],
@@ -300,8 +330,24 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
     if (decision.action === 'upload-assets') {
       await transition('asset-upload-intent', { payloadId: identity.payloadId || null });
       await adapter.uploadAssets(draft, assets, identity);
-      const observed = await adapter.observeSnapshot(identity, draft);
-      if (!observed.github?.assetsExact) throw new Error('staged GitHub payload mismatch');
+      // FORCE the digests, and never report a read failure as a mismatch (2026-08-07, #77).
+      //
+      // This read `observeSnapshot(identity, draft)` then `if (!observed.github?.assetsExact)`.
+      // Two distinct failures collapsed into one misleading sentence:
+      //   · the snapshot's own catch returns `{ readError }`, leaving `github` UNDEFINED — so a
+      //     transient API error or an OOM hashing the ~529MB bundle reported "payload mismatch",
+      //     which sends you hunting a corruption that never happened. Verified against the real
+      //     staged draft: all four assets (zip, .sig, .sha256, .tgz) matched the sealed identity
+      //     byte-for-byte, and GitHub's own asset digest agreed — yet this line still threw.
+      //   · digests are memoised by `${asset.id}:${asset.size}`, so a value computed BEFORE the
+      //     upload finished could satisfy a later check from cache. Immediately after uploading is
+      //     exactly when that cache must not be trusted, so this observation forces a re-read.
+      const observed = await adapter.observeSnapshot(identity, draft, { forceAssets: true });
+      if (observed.readError) {
+        throw new Error(`could not read the staged GitHub payload (this is NOT a digest mismatch): ${observed.readError}`);
+      }
+      if (!observed.github) throw new Error('staged GitHub draft not observable after upload');
+      if (!observed.github.assetsExact) throw new Error('staged GitHub payload mismatch');
       await transition('npm-stage-intent', { github: observed.github });
       continue;
     }

package/scripts/self-update.mjs

@@ -16,7 +16,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { FULL_HINTS, KEEP_DIRS } from './full-hints.mjs';
 import { withSubmoduleSymlinksDetached } from './git-clone-refresh.mjs';
@@ -228,6 +228,42 @@ if (!APPLY) {
 }
 
 const NOTIFY = (t, m, p) => { try { execFileSync('sh', [path.join(ROOT, 'scripts/notify.sh'), t, m, p || 'default']); } catch { /* alerting never breaks the pipeline */ } };
+
+// ---- child steps that can explain themselves -------------------------------------------------
+// With stdio:'inherit' a failing child's Error carries NO output: e.stdout and e.stderr are both
+// null and e.message is only "Command failed: <argv>" (verified 2026-08-06). That empty reason is
+// what propagated into the [FATAL] summary, which is in turn what nightly-wrapper.sh samples for
+// the escalation — so six identical nightly failures escalated saying nothing, while the log had
+// the answer the whole time.
+//
+// Capture, then RE-EMIT verbatim so the log is byte-identical to what stdio:'inherit' produced,
+// and keep a tail for the failure record.
+//   captureStdout=false (clone/fetch/reset/symbols): stdout stays inherited so those steps stream
+//     live and survive a kill; only stderr is buffered (small: stacks and warnings).
+//   captureStdout=true  (every step that carries a corpus-QA verdict — [refresh] and [qa]): BOTH
+//     streams, because corpus-qa prints its verdict table and every '↳ <reason>' line via
+//     console.log — i.e. on STDOUT. Capturing stderr alone would have captured nothing for the
+//     exact failure this exists to explain. Measured output is ~34 lines/step, so it costs nothing.
+const STEP_TAIL_LINES = 14;
+function runStep(label, file, args, opts = {}, { captureStdout = false } = {}) {
+  const r = spawnSync(file, args, {
+    ...opts,
+    stdio: ['inherit', captureStdout ? 'pipe' : 'inherit', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (r.stdout?.length) process.stdout.write(r.stdout);
+  if (r.stderr?.length) process.stderr.write(r.stderr);
+  if (r.error) { r.error.step = label; throw r.error; }
+  if (r.status !== 0) {
+    const tail = Buffer.concat([r.stdout || Buffer.alloc(0), r.stderr || Buffer.alloc(0)]).toString()
+      .split('\n').map((l) => l.trim()).filter(Boolean).slice(-STEP_TAIL_LINES).join(' | ');
+    const err = new Error(`${label} exited ${r.status}${tail ? ` — ${tail}` : ' — (child produced no output)'}`);
+    err.step = label;
+    err.status = r.status;
+    err.output = tail;
+    throw err;
+  }
+}
 const failures = []; // per-repo build failures collected here; ANY failure aborts before publish (see below)
 for (const p of todo) {
   const dir = clonePath(p.name);
@@ -235,15 +271,15 @@ for (const p of todo) {
     if (!fs.existsSync(path.join(dir, '.git'))) {
       console.log(`[clone] ${p.name}`);
       fs.mkdirSync(CLONE_DIR, { recursive: true });
-      execFileSync('git', ['clone', '--depth', '1', `https://github.com/${p.owner || p.org || 'ruvnet'}/${p.repo || p.name}`, dir], { stdio: 'inherit' });
+      runStep(`[clone] ${p.name}`, 'git', ['clone', '--depth', '1', `https://github.com/${p.owner || p.org || 'ruvnet'}/${p.repo || p.name}`, dir]);
     } else {
       // Some cached clones deduplicate large submodules with symlinks to another clone. Git refuses
       // even a fetch when a gitlink path is a symlink ("expected submodule path ... not to be a
       // symbolic link"). Detach only those declared submodule symlinks for fetch/reset, then restore
       // them in finally so a network/reset failure cannot strand the cache in a half-repaired state.
       withSubmoduleSymlinksDetached(dir, () => {
-        execFileSync('git', ['-C', dir, 'fetch', '--depth', '1', 'origin'], { stdio: 'inherit' });
-        execFileSync('git', ['-C', dir, 'reset', '--hard', 'origin/HEAD'], { stdio: 'inherit' });
+        runStep(`[fetch] ${p.name}`, 'git', ['-C', dir, 'fetch', '--depth', '1', 'origin']);
+        runStep(`[reset] ${p.name}`, 'git', ['-C', dir, 'reset', '--hard', 'origin/HEAD']);
       });
     }
     const env = { ...process.env, KB_MODEL_CACHE: MODEL_CACHE };
@@ -255,26 +291,43 @@ for (const p of todo) {
     if (full) buildArgs.push('--full', full);
     if (keep) buildArgs.push('--keep', keep);
     console.log(`[refresh] ${kb}`);
-    execFileSync(NODE, buildArgs, { cwd: path.join(ROOT, 'kb'), env, stdio: 'inherit' });
+    // captureStdout: forge-refresh runs corpus-qa against its CANDIDATE dir and refuses to promote
+    // on a FAIL — so this step, not the [qa] step below, is where the six 2026-08-03..08-06 nightly
+    // failures actually died, and the verdict table naming the offending chunk is on ITS stdout.
+    // Steps produce ~34 lines at most (largest measured [refresh] section in logs/nightly.log), so
+    // buffering costs nothing; the tradeoff is that the log flushes at step end rather than live.
+    runStep(`[refresh] ${kb}`, NODE, buildArgs, { cwd: path.join(ROOT, 'kb'), env }, { captureStdout: true });
     console.log(`[symbols] ${kb}`);
-    execFileSync(NODE, ['scripts/build-symbols.mjs', '--name', kb], { cwd: ROOT, env, stdio: 'inherit' });
+    runStep(`[symbols] ${kb}`, NODE, ['scripts/build-symbols.mjs', '--name', kb], { cwd: ROOT, env });
     // Corpus QA gate (scripts/corpus-qa.mjs): structural (passages>0, full-bodies>0 where
     // FULL_HINTS demands them, vectors==passages, embed.json present) + deterministic
     // self-retrieval round trip on every canonical store. Non-zero exit throws -> failures[] ->
     // the run aborts before stamp/bundle/publish. This is the machine version of the
     // 2026-07-10 hand-verification: a store that embeds wrong or reads wrong cannot ship.
     console.log(`[qa] ${kb}`);
-    execFileSync(NODE, ['scripts/corpus-qa.mjs', '--store', kb], { cwd: ROOT, env, stdio: 'inherit' });
-  } catch (e) { console.error(`[FAIL] ${p.name}: ${e.message}`); failures.push({ name: p.name, error: e.message }); }
+    // captureStdout: corpus-qa's verdict table and its '↳ <reason>' lines go to stdout.
+    runStep(`[qa] ${kb}`, NODE, ['scripts/corpus-qa.mjs', '--store', kb], { cwd: ROOT, env }, { captureStdout: true });
+  } catch (e) {
+    console.error(`[FAIL] ${p.name}: ${e.message}`);
+    failures.push({ name: p.name, step: e.step || '(unknown step)', error: e.message, reason: e.output || '' });
+  }
 }
 
 // A per-repo build failure used to be logged and swallowed before the run re-stamped and re-bundled
 // partial data. Fail loud: if ANY repo failed, abort before stamp/bundle. This rebuild process has no
 // publication authority; a later protected release may consume only a fully prepared candidate.
 if (failures.length) {
-  NOTIFY('🔴 Nightly brain rebuild ABORTED', `${failures.length} repo build(s) failed — no candidate prepared. See logs/nightly.log`, 'urgent');
+  // Carry the REASON, not just the count. The wrapper samples this block's tail for the push
+  // escalation, so whatever is not printed here is not in the alert either.
+  const first = failures[0];
+  NOTIFY('🔴 Nightly brain rebuild ABORTED',
+    `${failures.length} repo build(s) failed — no candidate prepared. First: ${first.name} ${first.step} — ${first.reason || first.error}`,
+    'urgent');
   console.error(`\n[FATAL] ${failures.length} repo build(s) failed this run — aborting before stamp/bundle. No candidate prepared:`);
-  for (const f of failures) console.error(`  - ${f.name}: ${f.error}`);
+  for (const f of failures) {
+    console.error(`  - ${f.name} ${f.step}: ${f.error}`);
+    if (f.reason) console.error(`      reason: ${f.reason}`);
+  }
   console.error('Fix the failing repo(s) and re-run.');
   process.exit(1);
 }