ruvnet-brain 4.0.36 → 4.2.2-dev

package/scripts/rvf-generation.mjs

@@ -119,3 +119,47 @@ export function verifyRvfGenerations(dir, {
   }
   return { manifest, failures };
 }
+
+// Release-time closure check for the exact public roots selected for a bundle. Unlike the
+// source-only verifier above, this rejects every ambiguity in the byte-bearing asset directory.
+export function validateSelectedRvfGenerations(dir, {
+  selectedStores = canonicalRvfStores(dir),
+  privateStores = [],
+  version,
+  releaseTag,
+} = {}) {
+  const manifest = readRvfGenerations(dir);
+  const failures = [];
+  const selected = [...new Set(selectedStores)].sort();
+  const selectedLower = new Map(selected.map((name) => [name.toLowerCase(), name]));
+  const privateLower = new Set(privateStores.map((name) => String(name).toLowerCase()));
+  if (version !== undefined && manifest.brainVersion !== version) failures.push(`brainVersion=${manifest.brainVersion}, expected ${version}`);
+  if (releaseTag !== undefined && manifest.releaseTag !== releaseTag) failures.push(`releaseTag=${manifest.releaseTag}, expected ${releaseTag}`);
+  for (const name of selected) if (privateLower.has(name.toLowerCase())) failures.push(`${name}: private store selected`);
+  for (const [store, row] of Object.entries(manifest.stores || {})) {
+    const canonical = selectedLower.get(store.toLowerCase());
+    if (!canonical) {
+      if (!privateLower.has(store.toLowerCase())) failures.push(`${store}: extra generation record`);
+      continue;
+    }
+    if (canonical !== store) failures.push(`${store}: alias differs from selected store ${canonical}`);
+    const expectedFile = `${canonical}.big.rvf`;
+    if (row?.file !== expectedFile) failures.push(`${store}: file=${row?.file}, expected ${expectedFile}`);
+    const file = path.join(dir, expectedFile);
+    if (!fs.existsSync(file)) failures.push(`${store}: missing ${expectedFile}`);
+    else {
+      const stat = fs.statSync(file);
+      if (row?.bytes !== stat.size) failures.push(`${store}: bytes=${row?.bytes}, actual ${stat.size}`);
+      const digest = sha256File(file);
+      if (row?.sha256 !== digest) failures.push(`${store}: sha256=${digest}, recorded ${row?.sha256}`);
+    }
+    if (typeof row?.model !== 'string' || !row.model.trim()) failures.push(`${store}: invalid model`);
+    if (!Number.isInteger(row?.dimensions) || row.dimensions <= 0) failures.push(`${store}: invalid dimensions`);
+    if (row?.sourceCommit !== null && (typeof row?.sourceCommit !== 'string' || !/^[a-f0-9]{7,64}$/i.test(row.sourceCommit))) failures.push(`${store}: invalid sourceCommit`);
+    if (typeof row?.builtUtc !== 'string' || !Number.isFinite(Date.parse(row.builtUtc))) failures.push(`${store}: invalid builtUtc`);
+  }
+  for (const name of selected) if (!manifest.stores?.[name]) failures.push(`${name}: no exact generation record`);
+  const publicRows = Object.keys(manifest.stores || {}).filter((name) => !privateLower.has(name.toLowerCase()));
+  if (publicRows.length !== selected.length) failures.push(`store count=${publicRows.length}, selected ${selected.length}`);
+  return { manifest, selectedStores: selected, failures };
+}

package/scripts/selfcheck.mjs

@@ -532,7 +532,15 @@ export async function runBattery({ home = os.homedir(), repo = null, cwd = os.tm
 export async function checkCoexistence({ home = os.homedir(), repo = null } = {}) {
   const reg = await loadRegistry();
   const registry = reg.buildRegistry({ repo: repo ?? reg.REPO, home, includeMachine: true });
-  const ours = registry.records.filter((r) => r.layer === 'plugin' || r.layer === 'plugin-installed' || r.layer === 'marketplace-clone');
+  // 'codex' joined hook-registry.mjs's mesh 2026-08-20 (Dream Cycle cross-host-conformance) — it is
+  // OURS (plugin/hooks/codex-hooks.json, shipped in package.json's "files" tree same as plugin/),
+  // never a foreign registration. Omitting it here silently undercounted `ourCount` and dropped all
+  // 16 Codex registrations from both buckets — caught by an independent critique before this shipped.
+  // 'codex' joined hook-registry.mjs's mesh 2026-08-20 (Dream Cycle cross-host-conformance) — it is
+  // OURS (plugin/hooks/codex-hooks.json, shipped in package.json's "files" tree same as plugin/),
+  // never a foreign registration. Omitting it here silently undercounted `ourCount` and dropped all
+  // 16 Codex registrations from both buckets — caught by an independent critique before this shipped.
+  const ours = registry.records.filter((r) => r.layer === 'plugin' || r.layer === 'codex' || r.layer === 'plugin-installed' || r.layer === 'marketplace-clone');
   const foreign = registry.records.filter((r) => r.layer === 'user' || r.layer.startsWith('third-party:') || r.layer === 'project');
 
   // DOUBLE REGISTRATION — reused wholesale from hook-registry (ADR-055 M1): one handler, an

package/scripts/stabilization-receipt.mjs

@@ -52,7 +52,12 @@ export function createStabilizationReceipt({ root, artifactPath, qe, audit }) {
     scoreClaimed: false,
     sha,
     tree: git('rev-parse', 'HEAD^{tree}'),
+    // NAME WHAT IS DIRTY, or the failure is unactionable. `release-qe` has failed on EVERY main run
+    // with a bare `INVALID_LINEAGE`, which says a clean tree is required and not one word about what
+    // made it unclean — so the release chain has been blocked with no way to see why from the log.
+    // The receipt now carries the offending paths; the seal is unchanged, only its evidence is.
     dirty: Boolean(git('status', '--porcelain')),
+    dirtyPaths: String(git('status', '--porcelain') || '').split('\n').filter(Boolean).slice(0, 40),
     version: manifest.version,
     tag: `v${manifest.version}`,
     sourceVersions: { package: manifest.version, claudePlugin: claude.version, codexPlugin: codex.version },
@@ -75,7 +80,12 @@ export function createStabilizationReceipt({ root, artifactPath, qe, audit }) {
     ],
   };
   const result = evaluateStabilizationCandidateReceipt(receipt);
-  if (result.verdict !== 'PASS') throw new Error(`stabilization seal failed: ${result.failures.map(({ code }) => code).join(',')}`);
+  if (result.verdict !== 'PASS') {
+    const detail = receipt.dirty && receipt.dirtyPaths?.length
+      ? `\n  working tree is dirty (${receipt.dirtyPaths.length} path(s)):\n    ${receipt.dirtyPaths.join('\n    ')}`
+      : '';
+    throw new Error(`stabilization seal failed: ${result.failures.map(({ code }) => code).join(',')}${detail}`);
+  }
   return receipt;
 }
 

package/scripts/sync-commands.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/**
+ * sync-commands.mjs — four spellings of one command share ONE body, generated, never hand-copied.
+ *
+ * ISSUE #135. `/rvbc`, `/rvcb`, `/brain-console` and `/ruvnet-brain:configure` each declare, in their
+ * own words, that every spelling is equally valid and the user must never be corrected. Their BODIES
+ * had drifted into four independent hand-written specs, measured on 4.0.36:
+ *
+ *     rvbc.md  4116 B      rvcb.md  976 B      brain-console.md  985 B      configure.md  1680 B
+ *
+ * Four rules lived only in `rvbc.md`: speak first before any tool call; the "Things NOT to do before
+ * the page is open" list; the emphatic `run_in_background: true, ALWAYS` *with its reason*; and
+ * "already running is success, not an error." So which spelling a user happened to type changed how
+ * the assistant behaved — on the one command whose entire promise is that spelling does not matter.
+ *
+ * Two of those cost real silence. Without the "no knowledge search first" prohibition, grounding
+ * before opening the page is a legal move and a cold embedding-model load is allowed up to 180
+ * seconds. And `rvcb.md` kept the `run_in_background` RULE but dropped the REASON — that a foreground
+ * run hangs the call until the 120-second timeout — and a rule whose reason is missing is a rule that
+ * gets traded away.
+ *
+ * THE FIX IS NOT "COPY THE FOUR RULES ACROSS." That is what produced this: four copies of one fact,
+ * drifting the moment anyone edits one. It is ADR-065's rule applied to prompts instead of values —
+ * a fact that appears in more than one place gets exactly ONE producer, and every other occurrence is
+ * written from it. `rvbc.md` is the producer; the other three are generated.
+ *
+ * WHAT EACH ALIAS KEEPS: its own `description:`. That is not duplicated knowledge — it is what the
+ * user reads in the command picker, and each spelling legitimately introduces itself differently.
+ * Everything below the frontmatter is byte-identical by construction.
+ *
+ *   node scripts/sync-commands.mjs           # rewrite the aliases from the canonical body
+ *   node scripts/sync-commands.mjs --check   # fail if any alias has drifted (CI / pre-push)
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const DIR = path.join(ROOT, 'plugin', 'commands');
+const CANONICAL = 'rvbc.md';
+const ALIASES = ['rvcb.md', 'brain-console.md', 'configure.md'];
+const CHECK = process.argv.includes('--check');
+
+/** Split `---\n…\n---\n` frontmatter from the body. Both are returned verbatim. */
+export function splitFrontmatter(text) {
+  const m = /^---\n([\s\S]*?)\n---\n/.exec(text);
+  if (!m) return { frontmatter: null, body: text };
+  return { frontmatter: m[1], body: text.slice(m[0].length) };
+}
+
+/** The alias's own description line, kept; everything else in the frontmatter comes from canonical. */
+function rebuild(aliasText, canonicalFrontmatter, canonicalBody) {
+  const { frontmatter } = splitFrontmatter(aliasText);
+  const desc = /^description:.*(?:\n[ \t]+.*)*$/m.exec(frontmatter || '');
+  const rest = canonicalFrontmatter
+    .split('\n')
+    .filter((l) => !/^description:/.test(l))
+    .join('\n');
+  const head = [desc ? desc[0] : null, rest].filter(Boolean).join('\n');
+  return `---\n${head}\n---\n${canonicalBody}`;
+}
+
+// RUN THE CLI ONLY WHEN INVOKED AS ONE. Without this guard, `import { splitFrontmatter }` from a test
+// executed the whole generator — measured: importing this file printed "[commands] synced 0 alias(es)"
+// inside the test runner, and had vitest's argv contained `--check` it would have called process.exit
+// and taken the runner down with it. The identical defect was fixed in tests/unit/nightly-convergence
+// one commit earlier (importing bin/install.mjs ran the installer main); it recurred here because that
+// fix was applied to the CALLER instead of to the module. Fixing it at the module is what makes it
+// stop recurring — same reasoning as ADR-066: one producer, not a rule every caller must remember.
+// realpathSync THROWS on a path that does not resolve, and under vitest on Windows `process.argv[1]`
+// is not a real file — measured in CI as `ENOENT: lstat 'D:\D:'`, which failed the whole SUITE at
+// import time rather than any assertion. A guard that decides "am I the entrypoint" must never be
+// able to crash the caller that merely imported this module: not-resolvable means not-main.
+function resolvedIsMain() {
+  try {
+    return Boolean(process.argv[1])
+      && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch { return false; }
+}
+if (!resolvedIsMain()) { /* imported for its exports — do nothing else */ } else {
+
+const canonicalText = fs.readFileSync(path.join(DIR, CANONICAL), 'utf8');
+const { frontmatter: canonicalFrontmatter, body: canonicalBody } = splitFrontmatter(canonicalText);
+if (!canonicalFrontmatter) {
+  process.stderr.write(`[commands] ${CANONICAL} has no frontmatter — refusing to generate from it\n`);
+  process.exit(2);
+}
+
+const drift = [];
+let wrote = 0;
+for (const alias of ALIASES) {
+  const file = path.join(DIR, alias);
+  if (!fs.existsSync(file)) { drift.push(`${alias} (missing)`); continue; }
+  const before = fs.readFileSync(file, 'utf8');
+  const after = rebuild(before, canonicalFrontmatter, canonicalBody);
+  if (after === before) continue;
+  if (CHECK) { drift.push(alias); continue; }
+  fs.writeFileSync(file, after);
+  process.stdout.write(`[commands] ${alias}: body regenerated from ${CANONICAL}\n`);
+  wrote += 1;
+}
+
+if (CHECK) {
+  if (drift.length) {
+    process.stderr.write(
+      `[commands] DRIFT: ${drift.length} alias(es) disagree with ${CANONICAL}. A user who types one\n`
+      + '           spelling would get different behaviour from one who types another, on the command\n'
+      + '           that promises spelling does not matter. Run: node scripts/sync-commands.mjs\n',
+    );
+    for (const d of drift) process.stderr.write(`    ${d}\n`);
+    process.exit(1);
+  }
+  process.stdout.write(`[commands] all ${ALIASES.length} alias(es) share ${CANONICAL}'s body\n`);
+  process.exit(0);
+}
+process.stdout.write(`[commands] synced ${wrote} alias(es) to ${CANONICAL}\n`);
+}