ruvnet-brain 4.0.2 → 4.0.4

package/scripts/self-update.mjs

@@ -8,6 +8,10 @@
 //   node scripts/self-update.mjs --apply --tier T0   # limit scope
 //   node scripts/self-update.mjs --apply --repo ruflo
 //
+// Publication is intentionally NOT supported here. A scheduled or local rebuild may prepare
+// candidate bytes, but only the protected release workflow may publish them after release-proof
+// seals the exact clean SHA and packed-artifact digest.
+//
 // Designed to be invoked by deploy/com.ruvnet.brain-nightly.plist (LaunchAgent — NOT auto-installed).
 import fs from 'node:fs';
 import os from 'node:os';
@@ -48,6 +52,11 @@ const arg = (f, d) => { const i = process.argv.indexOf(f); return i >= 0 && proc
 const APPLY = has('--apply');
 const TIER = arg('--tier', null);
 const ONLY = arg('--repo', null);
+if (has('--publish')) {
+  console.error('[release-authority] DENIED: self-update is rebuild-only; --publish cannot create a GitHub Release, publish npm, move a dist-tag, push a release commit, or label anything shipped.');
+  console.error('[release-authority] Use the protected release workflow after release-proof seals the exact clean SHA and packed-artifact digest.');
+  process.exit(2);
+}
 // --publish's whole job is to end this run with `git commit` + `git push origin main` (see the
 // PUBLISH block far below) — and those two commands operate on whatever branch is CURRENTLY
 // CHECKED OUT in this working tree, not necessarily main. Real failure (2026-07-19): the nightly
@@ -259,14 +268,12 @@ for (const p of todo) {
   } catch (e) { console.error(`[FAIL] ${p.name}: ${e.message}`); failures.push({ name: p.name, error: e.message }); }
 }
 
-// A per-repo build failure used to be logged and swallowed — the run then re-stamped, re-bundled and (with
-// --publish) cut a Release + git push based on todo.length alone, shipping a half-rebuilt brain (stale or
-// missing stores) under a fresh version. Fail loud instead: if ANY repo failed, abort BEFORE stamp/bundle
-// and the publish block (gh release create / git push) with a non-zero exit, so the nightly log surfaces it
-// and nothing partial is released.
+// A per-repo build failure used to be logged and swallowed before the run re-stamped and re-bundled
+// partial data. Fail loud: if ANY repo failed, abort before stamp/bundle. This rebuild process has no
+// publication authority; a later protected release may consume only a fully prepared candidate.
 if (failures.length) {
-  NOTIFY('🔴 Nightly brain publish ABORTED', `${failures.length} repo build(s) failed — nothing released. See logs/nightly.log`, 'urgent');
-  console.error(`\n[FATAL] ${failures.length} repo build(s) failed this run — aborting before stamp/bundle/publish. NOTHING released (no re-stamp, no Release, no version bump, no push):`);
+  NOTIFY('🔴 Nightly brain rebuild ABORTED', `${failures.length} repo build(s) failed — no candidate prepared. See logs/nightly.log`, 'urgent');
+  console.error(`\n[FATAL] ${failures.length} repo build(s) failed this run — aborting before stamp/bundle. No candidate prepared:`);
   for (const f of failures) console.error(`  - ${f.name}: ${f.error}`);
   console.error('Fix the failing repo(s) and re-run.');
   process.exit(1);
@@ -279,226 +286,7 @@ console.log('[bundle] re-assembling dist/ruvnet-brain');
 execFileSync(NODE, ['scripts/build-bundle.mjs'], { cwd: ROOT, env: { ...process.env, KB_MODEL_CACHE: MODEL_CACHE }, stdio: 'inherit' });
 console.log('self-update done. (Deep-source refreshed + bundle re-assembled. Primer/L2/concepts + grading are supervised steps — re-run them when a repo materially changes.)');
 
-// ── PUBLISH (the last mile): local rebuild → users, automatically. ─────────────────────────────
-// Without this, the nightly makes the LOCAL brain smarter while releases/latest never advances —
-// users' auto-updaters correctly report "up to date" against a stale Release forever. Gated on
-// --publish (the LaunchAgent passes it; ad-hoc manual runs don't publish by accident) and on
-// something having actually been rebuilt this run. ONE product version: plugin.json's version is
-// bumped (patch) and shipped in the same Release tag, so brain content and plugin always move
-// under a single user-visible number. Fail-loud: any error here exits non-zero into the nightly
-// log; nothing is half-published silently (release create is atomic per-tag; the version-bump
-// commit only pushes after the Release exists).
-if (has('--publish')) {
-  // Packaging gap (issue #29, found by Jan Lafko): the bundle carries EXECUTABLE reader scripts
-  // (kb/*.mjs) — so a reader fix could exist in git while releases/latest kept shipping the stale
-  // copy FOREVER whenever no corpus rebuild happened to come along (he caught the #27 fix present
-  // in source but absent from his installed plugin). A Release is now ALSO cut when any shipped
-  // script drifted vs the last release tag, even with zero corpus changes.
-  let scriptDrift = [];
-  try {
-    const lastTag = execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: ROOT, encoding: 'utf8' }).trim();
-    const out = execFileSync('git', ['diff', '--name-only', `${lastTag}..HEAD`, '--', 'kb/*.mjs', 'kb/package.json', 'bin/install.mjs'], { cwd: ROOT, encoding: 'utf8' }).trim();
-    scriptDrift = out ? out.split('\n') : [];
-  } catch { scriptDrift = ['(no release tag baseline — treating shipped scripts as drifted)']; }
-  if (todo.length === 0 && scriptDrift.length === 0) {
-    console.log('[publish] nothing was rebuilt and no shipped script changed since the last Release — no new Release needed. Done.');
-  } else {
-    if (todo.length === 0) console.log(`[publish] no corpus rebuild, but ${scriptDrift.length} shipped script(s) drifted since the last Release (issue #29 class) — cutting a Release so reader fixes actually reach users:\n${scriptDrift.map((f) => '    · ' + f).join('\n')}`);
-    const PLUGIN_JSON = path.join(ROOT, 'plugin', '.claude-plugin', 'plugin.json');
-    const pj = JSON.parse(fs.readFileSync(PLUGIN_JSON, 'utf8'));
-    const m = pj.version.match(/^(\d+)\.(\d+)\.(\d+)(-dev)?$/);
-    if (!m) { console.error(`[publish] FAIL: cannot parse plugin version "${pj.version}"`); process.exit(1); }
-    const next = `${m[1]}.${m[2]}.${Number(m[3]) + 1}${m[4] || ''}`;
-    const tag = `v${next}`;
-    pj.version = next;
-    pj.updated = new Date().toISOString().slice(0, 10);
-    fs.writeFileSync(PLUGIN_JSON, JSON.stringify(pj, null, 2) + '\n');
-    console.log(`[publish] product version → ${next} (${tag})`);
-
-    // Keep the README's bright-blue version badge in lockstep (Stuart's rule: version + updated
-    // timestamp with timezone, bright blue, first thing anyone sees). GitHub strips color from
-    // markdown text, so the line is a shields.io for-the-badge image — colors guaranteed.
-    const fmt = new Intl.DateTimeFormat('en-CA', {
-      timeZone: 'America/New_York', year: 'numeric', month: '2-digit', day: '2-digit',
-      hour: '2-digit', minute: '2-digit', hour12: false, timeZoneName: 'short',
-    }).formatToParts(new Date());
-    const g = (t) => fmt.find((p) => p.type === t)?.value || '';
-    const human = `${g('year')}-${g('month')}-${g('day')} ${g('hour')}:${g('minute')} ${g('timeZoneName')}`;
-    const badgeStamp = human.replace(/-/g, '--').replace(/ /g, '_');
-    const badgeVer = next.replace(/-/g, '--');
-    const badge = `https://img.shields.io/badge/version_${badgeVer}-updated_${badgeStamp}-1E90FF?style=for-the-badge&labelColor=0757BA`;
-    const README = path.join(ROOT, 'README.md');
-    const readme = fs.readFileSync(README, 'utf8').replace(
-      /^### 🧠 RuvNet Brain — \[!\[.*$/m,
-      `### 🧠 RuvNet Brain — [![RuvNet Brain version ${next} — updated ${human}](${badge})](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)`,
-    );
-    fs.writeFileSync(README, readme);
-
-    // FAN THE BUMP OUT ACROSS ROOT'S OTHER SURFACES — the step whose absence deadlocked publishing.
-    //
-    // The two writes above bump ROOT's plugin.json and README because the BUNDLE has to be stamped
-    // with its own release tag (issue #35). The other five surfaces — package.json, kb/package.json,
-    // data/manifest.json, primer/ruvnet-primer.md, explainer/index.html — were left behind, because
-    // sync-version.mjs was only ever run inside the publish worktree.
-    //
-    // That is fine for the COMMIT (the worktree is self-consistent and its version:check passes) and
-    // fatal for the PUSH. Git hooks are shared across worktrees and the pre-push gate resolves the
-    // repo it checks to ROOT — so it read ROOT, found plugin.json at the new version and five
-    // surfaces one behind, and refused: "5 surface(s) drifted from the source of truth".
-    //
-    // MEASURED 2026-07-24, after a ~3h rebuild: the worktree commit 899ed8d was correct and complete,
-    // version:check inside it passed cleanly, and the push was still rejected by a gate reading a
-    // directory the commit had nothing to do with. The whole night's work was thrown away at the last
-    // step by an inconsistency in a tree that was never going to be pushed.
-    //
-    // The gate is RIGHT — those five surfaces really were inconsistent, and a user reading ROOT would
-    // have seen a version that does not exist. The bug is that we made ROOT inconsistent and never
-    // repaired it. One line, in the same place the bump happens, so the two can never drift again.
-    execFileSync(NODE, ['scripts/sync-version.mjs'], { cwd: ROOT, stdio: 'inherit' });
-
-    // ── RE-STAMP THE BUNDLE WITH ITS OWN RELEASE TAG (issue #35, Dr. Mark Allen) ────────────────
-    //
-    // EVERY nightly release shipped a bundle stamped ONE VERSION BEHIND its own tag. build-bundle
-    // runs far above (it assembles dist/ before the publish block), and it stamps
-    // SOURCE.json.releaseTag = getVersionTag() — which at that moment is still the PREVIOUS version,
-    // because `next` is not computed until line ~284. Proven on the live release: the v3.4.21-dev
-    // asset (uploaded 07:21:52Z) carries releaseTag "v3.4.20-dev", one second before the version
-    // bump commit at 07:21:53Z.
-    //
-    // The consequence is not cosmetic. It is exactly the "my version says X but my knowledge base
-    // is older" confusion users reported: every installed brain misidentifies itself, --doctor's
-    // drift check compares against a wrong number, and forge-update's own behind/current logic
-    // reads a tag that never matches the release it came from.
-    //
-    // build-bundle.mjs already anticipated this fix in its own comment ("a release workflow that
-    // knows the exact git tag may overwrite this with the bundle's own Release tag") — it was just
-    // never written. Here it is, at the only point in the pipeline where the final tag is known and
-    // the bytes have not yet been zipped.
-    const bundleSource = path.join(ROOT, 'dist', 'ruvnet-brain', 'SOURCE.json');
-    try {
-      const doc = JSON.parse(fs.readFileSync(bundleSource, 'utf8'));
-      const before = doc.releaseTag;
-      doc.releaseTag = tag;
-      fs.writeFileSync(bundleSource, JSON.stringify(doc, null, 2) + '\n');
-      console.log(`[publish] bundle releaseTag ${before || '(none)'} → ${tag}`);
-    } catch (e) {
-      // Fail LOUD. Shipping a mis-stamped bundle is precisely the defect this block exists to end,
-      // and a silent skip here would restore it invisibly.
-      console.error(`[publish] FATAL: could not stamp the bundle's releaseTag (${e.message}). Refusing to publish a bundle that would misidentify its own version.`);
-      process.exit(1);
-    }
-
-    const zipPath = path.join(ROOT, 'dist', 'ruvnet-brain.zip');
-    console.log('[publish] zipping bundle (private stores already fenced out at assembly)');
-    try { fs.unlinkSync(zipPath); } catch {}
-    execFileSync('ditto', ['-c', '-k', '--sequesterRsrc', path.join(ROOT, 'dist', 'ruvnet-brain'), zipPath], { stdio: 'inherit' });
-
-    // Sign the bundle (SEC-0010 #6) so the installer can verify-before-extract. Transitional: if no
-    // signing key is available in this env yet (RUVNET_SIGNING_KEY / .secrets/…key.pem), warn and ship
-    // unsigned rather than break the nightly — once the key is wired in, every release ships signed and
-    // install.mjs's SIGNING_REQUIRED can flip to true. sign-bundle emits <zip>.sig + <zip>.sha256.
-    const sigAssets = [];
-    try {
-      execFileSync(NODE, ['scripts/sign-bundle.mjs', '--bundle', zipPath], { cwd: ROOT, stdio: 'inherit' });
-      for (const a of [`${zipPath}.sig`, `${zipPath}.sha256`]) if (fs.existsSync(a)) sigAssets.push(a);
-      console.log(`[publish] signed bundle (${sigAssets.length} signature asset(s) will be uploaded)`);
-    } catch (e) {
-      console.warn(`[publish] WARNING: bundle NOT signed (${e.message.split('\n')[0]}). Shipping unsigned (transitional). Set RUVNET_SIGNING_KEY in the nightly env to enable signing.`);
-    }
-
-    console.log(`[publish] creating GitHub Release ${tag} + uploading bundle (~this can take minutes)`);
-    execFileSync(GH, ['release', 'create', tag, zipPath, ...sigAssets,
-      '--title', `${tag} — nightly brain refresh`,
-      '--notes', `Automated nightly: ${todo.length ? `re-ingested upstream changes in: ${todo.map((p) => p.name).join(', ')}` : `shipped reader-script fixes (no corpus change — issue #29 class)`}. One product version — plugin ${next} + this knowledge bundle ship together; user installs pick both up automatically.`,
-    ], { cwd: ROOT, stdio: 'inherit' });
-
-    console.log('[publish] syncing version to EVERY surface, committing, pushing');
-    // Propagate `next` to package.json / kb/package.json / manifest / primer / explainer — NOT just the
-    // four files this block used to add. Otherwise those surfaces drift behind plugin.json (the exact
-    // 2026-07-19 3.4.19-vs-3.4.20 split that reddened repo-count + version gates).
-    //
-    // ── THE VERSION COMMIT RUNS IN A MAIN-PINNED WORKTREE, NEVER IN ROOT ────────────────────────────
-    //
-    // WHY (measured, twice). These four git commands operate on whatever branch ROOT happens to have
-    // checked out. On 2026-07-19 that produced commit 4a10833 "Nightly brain refresh v3.4.21-dev"
-    // stranded on feat/meta-proxy-passthrough. The guard at the top of this file was added in
-    // response and is CORRECT — it aborts rather than checking out main under a developer's
-    // uncommitted work, which would be unrecoverable.
-    //
-    // But an abort has a cost nobody was watching. This file is the ONLY thing that cuts GitHub
-    // Releases; `release.mjs --publish` does npm and contains zero `gh release` calls. So on
-    // 2026-07-23 the nightly aborted (repo was on branch 4.0), releases froze at v3.9.18-dev, npm kept
-    // advancing, and the channel verifier could not see it because it only checked the bundle was
-    // REACHABLE, never that it was CURRENT. A correct guard, a real abort, and 32 versions of drift.
-    //
-    // A worktree dissolves the dilemma instead of trading one failure for the other: a separate
-    // directory pinned to origin/main, so the developer's tree is never touched AND the release is
-    // never blocked by what they have checked out. Git refuses the same BRANCH in two worktrees, so it
-    // is DETACHED at origin/main and pushed as HEAD:main.
-    //
-    // The build artifacts stay in ROOT — only the version-bump commit moves. Convention follows
-    // scripts/issue-fix.mjs's WORKTREE_ROOT rather than inventing a second one.
-    const PUBLISH_WT = process.env.RUVNET_PUBLISH_WORKTREE
-      || path.join(os.homedir(), '.cache', 'ruvnet-brain', 'publish-worktree');
-    const git = (args, cwd) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
-
-    let wt = null;
-    try {
-      git(['fetch', 'origin', 'main'], ROOT);
-      // Reuse a healthy worktree; rebuild it if a prior run left it wedged. `prune` first so a
-      // manually-deleted directory does not leave a stale registration that blocks `add`.
-      git(['worktree', 'prune'], ROOT);
-      if (!fs.existsSync(path.join(PUBLISH_WT, '.git'))) {
-        fs.mkdirSync(path.dirname(PUBLISH_WT), { recursive: true });
-        try { git(['worktree', 'remove', '--force', PUBLISH_WT], ROOT); } catch { /* not registered */ }
-        fs.rmSync(PUBLISH_WT, { recursive: true, force: true });
-        git(['worktree', 'add', '--detach', PUBLISH_WT, 'origin/main'], ROOT);
-      } else {
-        // Existing worktree: hard-reset to the real origin/main so a half-finished prior run cannot
-        // contribute stale files to this release.
-        git(['reset', '--hard', 'origin/main'], PUBLISH_WT);
-        git(['clean', '-fd'], PUBLISH_WT);
-      }
-      wt = PUBLISH_WT;
-      console.log(`[publish] version commit will run in ${PUBLISH_WT} (detached at origin/main) — ROOT is untouched`);
-    } catch (e) {
-      console.error(`[publish] FATAL: could not prepare the main-pinned publish worktree (${String(e.message || e).split('\n')[0]}).`);
-      console.error('[publish] Refusing to fall back to committing in ROOT — that is the exact stranded-commit bug this replaces.');
-      process.exit(1);
-    }
-
-    // Seed the worktree with the new version, then let sync-version.mjs fan it out from its single
-    // source of truth exactly as it does in ROOT.
-    const wtPlugin = path.join(wt, 'plugin', '.claude-plugin', 'plugin.json');
-    const wtDoc = JSON.parse(fs.readFileSync(wtPlugin, 'utf8'));
-    wtDoc.version = next;
-    fs.writeFileSync(wtPlugin, JSON.stringify(wtDoc, null, 2) + '\n');
-    execFileSync(NODE, ['scripts/sync-version.mjs'], { cwd: wt, stdio: 'inherit' });
-    execFileSync('git', ['add', 'README.md', 'plugin/.claude-plugin/plugin.json', 'plugin/.codex-plugin/plugin.json',
-      'package.json', 'kb/package.json',
-      'data/manifest.json', 'primer/ruvnet-primer.md', 'explainer/index.html'], { cwd: wt, stdio: 'inherit' });
-    execFileSync('git', ['commit', '-m', `Nightly brain refresh ${tag}: ${todo.map((p) => p.name).join(', ')}\n\nAutomated by scripts/self-update.mjs --publish (launchd com.ruvnet.brain-nightly).`], { cwd: wt, stdio: 'inherit' });
-    execFileSync('git', ['push', 'origin', 'HEAD:main'], { cwd: wt, stdio: 'inherit' });
-    // npm publish — ATOMIC with the GitHub Release so npm `latest` can NEVER lag behind it. This block
-    // previously shipped GitHub + plugin but never touched npm, so every nightly left npm further behind
-    // (the 2026-07-19 npm 3.4.18 / GitHub 3.4.20 drift). Fail LOUD if npm cannot be published — GitHub
-    // being ahead of npm must abort the run visibly, never pass silently. One product version, every channel.
-    try {
-      let onNpm = '';
-      try { onNpm = execFileSync('npm', ['view', `ruvnet-brain@${next}`, 'version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { /* not yet on npm — fine */ }
-      if (onNpm !== next) execFileSync('npm', ['publish', '--tag', 'latest'], { cwd: ROOT, stdio: 'inherit' });
-      execFileSync('npm', ['dist-tag', 'add', `ruvnet-brain@${next}`, 'latest'], { cwd: ROOT, stdio: 'inherit' });
-      console.log(`[publish] npm ${next} + \`latest\` — channels IN SYNC (npm == GitHub == plugin)`);
-    } catch (e) {
-      console.error(`[publish] FATAL: npm publish/dist-tag FAILED (${e.message.split('\n')[0]}). GitHub is now AHEAD of npm — the exact drift this guards against. The nightly aborts here; republish npm manually (\`npm publish --tag latest && npm dist-tag add ruvnet-brain@${next} latest\`) and check npm auth in the launchd env.`);
-      process.exit(1);
-    }
-    NOTIFY('🟢 Nightly brain published', `${tag} is live on releases/latest + npm — ${todo.length ? `rebuilt: ${todo.map((p) => p.name).join(', ')}` : `reader-script fixes only`}`);
-    console.log(`[publish] DONE — ${tag} live. Users' heartbeats will pick up plugin + brain automatically.`);
-  }
-}
-
-// Sol amendment to F4 (end of run): the verified rebuilds/publish above are real work and were NOT
+// Sol amendment to F4 (end of run): the verified rebuilds above are real work and were NOT
 // skipped — but if any freshness probe failed, this run still may not report clean. Exit 1 AFTER the
 // work so the wrapper's retry re-probes (rebuilds are change-gated, so the retry is cheap) and a
 // persistent blind spot escalates instead of hiding inside a green "no-op".

package/scripts/stabilization-receipt.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// Produce the explicit maintenance-release seal used when the owner chooses to publish a
+// stabilization build before the separate >=95 promotion program is complete. This receipt never
+// claims 95 and cannot satisfy the strict candidate schema by accident.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
+import { evaluateStabilizationCandidateReceipt } from './release-proof.mjs';
+
+const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
+const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+
+function argument(args, name) {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : null;
+}
+
+function packedVersion(artifact) {
+  const result = spawnSync('tar', ['-xOf', artifact, 'package/package.json'], { encoding: 'utf8' });
+  if (result.status !== 0) throw new Error(`cannot read packed package.json: ${String(result.stderr || '').trim()}`);
+  return JSON.parse(result.stdout).version;
+}
+
+export function createStabilizationReceipt({ root, artifactPath, qe, audit }) {
+  const git = (...args) => {
+    const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+    if (result.status !== 0) throw new Error(`git ${args.join(' ')} failed`);
+    return result.stdout.trim();
+  };
+  const manifest = readJson(path.join(root, 'package.json'));
+  const claude = readJson(path.join(root, 'plugin/.claude-plugin/plugin.json'));
+  const codex = readJson(path.join(root, 'plugin/.codex-plugin/plugin.json'));
+  const sha = git('rev-parse', 'HEAD');
+  const digest = sha256(artifactPath);
+  const total = Number(qe?.numTotalTests ?? qe?.testResults?.reduce((sum, file) => sum + (file.assertionResults?.length || 0), 0) ?? 0);
+  const failed = Number(qe?.numFailedTests ?? 0);
+  const skipped = Number(qe?.numPendingTests ?? 0);
+  const passed = Number(qe?.numPassedTests ?? Math.max(0, total - failed - skipped));
+  const vulnerabilities = audit?.metadata?.vulnerabilities;
+  if (!vulnerabilities || !Number.isFinite(Number(vulnerabilities.critical))
+    || !Number.isFinite(Number(vulnerabilities.high))) {
+    throw new Error('dependency audit evidence is missing critical/high counts');
+  }
+  const receipt = {
+    schemaVersion: 1,
+    phase: 'stabilization-candidate',
+    mode: 'stabilization',
+    reason: 'Owner-authorized 4.0.4 stabilization release; >=95 promotion remains open work',
+    targetScore: 95,
+    scoreClaimed: false,
+    sha,
+    tree: git('rev-parse', 'HEAD^{tree}'),
+    dirty: Boolean(git('status', '--porcelain')),
+    version: manifest.version,
+    tag: `v${manifest.version}`,
+    sourceVersions: { package: manifest.version, claudePlugin: claude.version, codexPlugin: codex.version },
+    artifact: {
+      path: `release-evidence/${path.basename(artifactPath)}`,
+      sha256: digest,
+      sourceSha: sha,
+      version: packedVersion(artifactPath),
+    },
+    security: {
+      status: Number(vulnerabilities.critical || 0) === 0 && Number(vulnerabilities.high || 0) === 0 ? 'PASS' : 'FAIL',
+      critical: Number(vulnerabilities.critical || 0),
+      high: Number(vulnerabilities.high || 0),
+    },
+    qe: { status: total > 0 && failed === 0 && skipped === 0 ? 'PASS' : 'FAIL', total, passed, failed, skipped },
+    limitations: [
+      'No >=95 score claimed',
+      'Strict promotion receipt remains unsatisfied',
+      'Clean-host and installed-Brain acceptance are required after publication',
+    ],
+  };
+  const result = evaluateStabilizationCandidateReceipt(receipt);
+  if (result.verdict !== 'PASS') throw new Error(`stabilization seal failed: ${result.failures.map(({ code }) => code).join(',')}`);
+  return receipt;
+}
+
+export function main(args = process.argv.slice(2)) {
+  try {
+    const rootArg = argument(args, '--root');
+    const artifactArg = argument(args, '--artifact');
+    const outArg = argument(args, '--out');
+    if (!artifactArg || !outArg) throw new Error('--artifact and --out are required');
+    const root = path.resolve(rootArg || process.cwd());
+    const artifactPath = path.resolve(artifactArg);
+    const outPath = path.resolve(outArg);
+    if (fs.existsSync(outPath)) throw new Error(`refusing to overwrite existing receipt: ${outPath}`);
+    const receipt = createStabilizationReceipt({
+      root,
+      artifactPath,
+      qe: readJson(argument(args, '--qe')),
+      audit: readJson(argument(args, '--audit')),
+    });
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    fs.writeFileSync(outPath, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    console.log(JSON.stringify({ verdict: 'PASS', sha: receipt.sha, artifactSha256: receipt.artifact.sha256, version: receipt.version }));
+    return 0;
+  } catch (error) {
+    console.error(`stabilization-receipt: ${error.message}`);
+    return 1;
+  }
+}
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) process.exitCode = main();

package/scripts/wired-check.mjs

@@ -95,6 +95,9 @@ const STANDALONE = [
     + 'RVFs to RVF-GENERATIONS.json and optionally prunes legacy sidecars; build-bundle.mjs consumes '
     + 'and validates the resulting manifest, so scheduling this destructive migration would be wrong'],
   ['release', 'the ship path, run by a human'],
+  ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
+    + 'isolated writing agent to start and hand off a fix lane. Scheduling it would violate its safety '
+    + 'boundary: it prepares evidence but never merges, pushes, publishes, deletes, or cleans worktrees'],
   // Run by the launchd nightly, which lives OUTSIDE this repo — so no in-repo caller can exist.
   // This is the one category the scanner genuinely cannot reach, and saying so is the honest form.
   ['self-update', 'launchd nightly (out-of-repo scheduler)'],