ruvnet-brain 4.0.5 → 4.0.7

package/scripts/onboarding-console.mjs

@@ -41,6 +41,8 @@ import { loadCatalog as engineCatalog, catalogSource as engineCatalogSource, loa
 import { effectivePrices, loadLabelledRows, MIN_LABELS, OUTCOMES } from './metaharness-router.mjs';
 import { utilization } from './router-utilization.mjs';
 import { loadCatalog, detectProvider, frontierFor } from './model-catalog.mjs';
+import { providerAvailability } from './provider-availability.mjs';
+import { inspectSessionSnapshots } from './session-snapshot-contract.mjs';
 import { learnings } from './learnings.mjs';
 import { gatesSurvey } from './gates.mjs';
 // The write-safety primitives, borrowed rather than re-implemented. See saveConfig for why.
@@ -59,7 +61,7 @@ import {
 } from '../kb/brain-profile.mjs';
 // Lessons: read model + the two user verbs. Every mutation goes through lesson-store's own
 // updateLessons/ratify/demote/restore — this file adds a SURFACE, never a second writer.
-import { loadLessons, updateLessons, ratify, demote, restore, pending, weightOf, TRIGGERS, ENFORCEMENT, ORIGIN, STATUS } from './lesson-store.mjs';
+import { loadLessons, updateLessons, ratify, demote, restore, pending, weightOf, TRIGGERS, ENFORCEMENT, ORIGIN, SOURCE_CLASS, STATUS } from './lesson-store.mjs';
 import {
   openRouterCredentialStatus,
   saveOpenRouterCredential,
@@ -421,8 +423,19 @@ function probeMemory(projectDir) {
   const db = path.join(projectDir, '.swarm/memory.db');
   const probes = {};
   // compaction survival + session surfacing are filesystem facts, always checkable
-  const snap = fs.existsSync(path.join(projectDir, 'agentdb-sessions.jsonl')) || fs.existsSync(path.join(projectDir, '.swarm/agentdb-sessions.jsonl'));
-  probes.compactionSurvival = snap ? { status: 'ok', detail: 'a PreCompact snapshot file is present' } : { status: 'warn', detail: 'no PreCompact snapshot found for this project yet' };
+  const snapshot = inspectSessionSnapshots(projectDir);
+  const snapshotDetail = snapshot.kind === 'canonical'
+    ? 'a fresh versioned PreCompact snapshot is present in .swarm/agentdb-sessions.jsonl'
+    : snapshot.kind === 'legacy'
+      ? 'a fresh supported Ruflo session snapshot is present (legacy path; migration recommended)'
+      : snapshot.kind === 'malformed'
+        ? 'snapshot files were found but none matched the supported schema'
+        : snapshot.kind !== 'absent'
+          ? 'the newest supported snapshot is stale'
+          : 'no supported PreCompact snapshot found for this project yet';
+  probes.compactionSurvival = snapshot.fresh
+    ? { status: 'ok', detail: snapshotDetail, artifact: snapshot.kind }
+    : { status: 'warn', detail: snapshotDetail, artifact: snapshot.kind };
   probes.sessionSurfacing = sessionHookExists() ? { status: 'ok', detail: 'the global SessionStart hook surfaces project state at launch' } : { status: 'warn', detail: 'no SessionStart recall hook found' };
   // recall quality: honestly NOT probed at render (a true probe needs an embedding query; left for an explicit deep test)
   probes.recallQuality = { status: 'notTested', detail: 'not checked this session — a real recall probe needs an embedding round-trip, which render deliberately avoids' };
@@ -989,7 +1002,15 @@ function gatherLessons() {
   const lessons = all.map((l) => {
     const trig = TRIGGER_BY_KEY.get(l.trigger);
     const meaning = ENFORCEMENT_MEANING[l.enforcement] || { label: l.enforcement, detail: '' };
-    const userStated = l.origin === ORIGIN.USER_STATED;
+    const userStated = l.origin === ORIGIN.USER_STATED && l.sourceClass === SOURCE_CLASS.CURRENT_USER;
+    const quarantined = l.sourceClass === SOURCE_CLASS.IMPORTED_OWNER || l.sourceClass === SOURCE_CLASS.DEMONSTRATION;
+    const origin = l.sourceClass === SOURCE_CLASS.CURRENT_USER
+      ? 'you taught me this'
+      : l.sourceClass === SOURCE_CLASS.IMPORTED_OWNER
+        ? 'imported maintainer history — not yours'
+        : l.sourceClass === SOURCE_CLASS.DEMONSTRATION
+          ? 'demonstration data — not personal policy'
+          : 'I inferred this from what happened';
     return {
       id: l.id,
       statement: l.statement,
@@ -1001,8 +1022,10 @@ function gatherLessons() {
       enforcementLabel: meaning.label,
       enforcementDetail: meaning.detail,
       // Provenance drives trust, so it is stated plainly and never flattened into a badge colour.
-      origin: userStated ? 'you taught me this' : 'I inferred this from what happened',
+      origin,
+      sourceClass: l.sourceClass,
       userStated,
+      quarantined,
       taughtCount: l.repeatCount || 0,
       projects: Array.isArray(l.projects) ? l.projects : [],
       evidence: l.evidence || null,
@@ -1011,10 +1034,11 @@ function gatherLessons() {
       ratified: l.status === STATUS.RATIFIED || l.status === STATUS.ACTIVE,
       demoted: !!l.demoted,
       // The one thing the user is being ASKED, as opposed to merely shown.
-      awaitingYou: l.status === STATUS.CANDIDATE && !l.demoted,
+      awaitingYou: l.status === STATUS.CANDIDATE && !l.demoted && !quarantined,
       // Honest ceiling: ratifying a model-inferred lesson can NOT raise it to block
       // (lesson-store.mjs:380). Say so before they click, not after.
       canReachBlock: userStated,
+      canRatify: !quarantined,
       intendedEnforcement: l.intendedEnforcement || null,
     };
   });
@@ -1038,6 +1062,7 @@ function gatherLessons() {
       active: lessons.filter((l) => l.ratified && !l.demoted).length,
       awaitingYou: lessons.filter((l) => l.awaitingYou).length,
       off: lessons.filter((l) => l.demoted).length,
+      quarantined: lessons.filter((l) => l.quarantined).length,
       blocking: lessons.filter((l) => l.enforcement === 'block' && l.ratified && !l.demoted).length,
     },
     // TASK 2: this endpoint bypasses serveCached entirely and had NO timestamp of any kind. It is
@@ -1068,6 +1093,9 @@ function setLesson(body) {
   }
   const before = loadLessons().find((l) => l.id === id);
   if (!before) return { ok: false, log: `nothing changed — no lesson with id ${id}` };
+  if (action === 'ratify' && (before.sourceClass === SOURCE_CLASS.IMPORTED_OWNER || before.sourceClass === SOURCE_CLASS.DEMONSTRATION)) {
+    return { ok: false, log: 'nothing changed — imported or demonstration history cannot become personal policy' };
+  }
 
   try {
     updateLessons((fresh) => spec.fn(id, fresh));
@@ -1695,7 +1723,10 @@ function gatherRouterEngine() {
   // user's Settings choice is now the single source of truth, via the SAME detectProvider() the
   // savings.utilization frontier calc already uses (config → env → catalog default) — so this and
   // the frontier calc can never disagree either.
-  let house, providerKeys = {};
+  const subscriptions = detectSubscriptions();
+  let house;
+  let providerKeys = providerAvailability(null, subscriptions);
+  let providerCatalog = { status: 'degraded', detail: 'provider catalog was not loaded; native boolean detections are shown' };
   try {
     const hcat = loadCatalog();
     house = detectProvider(hcat, { provider: cfg.provider });
@@ -1704,11 +1735,12 @@ function gatherRouterEngine() {
     // key found". Read each provider's real detect_env vars — minus the CLAUDECODE / CLAUDE_CODE_ENTRYPOINT
     // run-context markers (which are not credentials), exactly as detectProvider() itself filters them —
     // so the UI's "key found / not found" is now true instead of decorative.
-    const IGNORE_ENV = new Set(['CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT']);
-    for (const [name, p] of Object.entries(hcat.providers || {})) {
-      providerKeys[name] = (p.detect_env || []).some((k) => !IGNORE_ENV.has(k) && !!process.env[k]);
-    }
-  } catch { house = { provider: cfg.provider && cfg.provider !== 'auto' ? cfg.provider : 'anthropic', source: 'default' }; }
+    providerKeys = providerAvailability(hcat, subscriptions);
+    providerCatalog = { status: 'ok', detail: 'verified provider catalog loaded' };
+  } catch (error) {
+    house = { provider: cfg.provider && cfg.provider !== 'auto' ? cfg.provider : 'anthropic', source: 'default' };
+    providerCatalog = { status: 'degraded', detail: `provider catalog unavailable: ${String(error?.message || error)}` };
+  }
   return {
     engine: {
       package: '@metaharness/router', installed,
@@ -1717,12 +1749,13 @@ function gatherRouterEngine() {
       outcomesLog: OUTCOMES.replace(os.homedir(), '~'),
     },
     keys: { openrouter: openrouterKey, ...providerKeys },
+    providerCatalog,
     // Paid seats, found at USER level. `keys` above is env-var API keys only, which is exactly why a
     // user with ChatGPT Max and Claude Max read as "auto" — neither plan puts a key in the
     // environment. These two fields are what let the UI say "you already have this" instead of
     // asking someone to paste a credential they are already paying not to need.
-    subscriptions: detectSubscriptions(),
-    preferredSeat: preferredSeat(detectSubscriptions()),
+    subscriptions,
+    preferredSeat: preferredSeat(subscriptions),
     profile: { present: !!profile, path: PROFILE_PATH.replace(os.homedir(), '~') },
     catalogSource: engineCatalogSource(),   // 'catalog' | 'built-in-fallback' — so the UI never calls the stub a real catalog
     house,
@@ -1833,6 +1866,10 @@ async function fetchReleaseDigest() {
 // in the heading of the console"). Plugin-cache dir first — the truth on installed machines — then
 // the repo's plugin.json for dev checkouts. null hides the chip rather than guessing.
 function brainVersionOnDisk() {
+  const runtimeIdentity = readJSON(path.join(REPO, 'runtime-identity.json'));
+  if (typeof runtimeIdentity?.runtimeVersion === 'string' && runtimeIdentity.runtimeVersion) {
+    return runtimeIdentity.runtimeVersion.replace(/^v/, '');
+  }
   try { const v = readInstallChannel().version; if (v) return String(v).replace(/^v/, ''); } catch { /* fall through */ }
   try { return getVersion(); } catch { return null; }
 }
@@ -2948,6 +2985,7 @@ export {
   saveBrainPower,
   gatherBrainProfile,
   saveBrainProfile,
+  gatherRouterEngine,
   autoEligibleIds,
 };
 // Exported for the cross-project cache-isolation test (console-cache-scope.test.mjs). serveCached's

package/scripts/provider-availability.mjs

@@ -0,0 +1,12 @@
+const IGNORED_ENV = new Set(['CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT']);
+
+// Boolean-only by construction: no credential value can cross the Console API boundary.
+export function providerAvailability(catalog, subscriptions = {}, env = process.env) {
+  if (catalog?.providers && typeof catalog.providers === 'object') {
+    return Object.fromEntries(Object.entries(catalog.providers).map(([name, provider]) => [
+      name,
+      (provider?.detect_env || []).some((key) => !IGNORED_ENV.has(key) && Boolean(env[key])),
+    ]));
+  }
+  return Object.fromEntries(Object.entries(subscriptions).map(([name, value]) => [name, Boolean(value?.apiKey)]));
+}

package/scripts/release-authority.mjs

@@ -7,7 +7,10 @@ import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const CANONICAL_PUBLISHER = 'scripts/release.mjs';
+const CANONICAL_PUBLISHERS = new Set([
+  'scripts/release.mjs',
+  'scripts/release-transaction-provider.mjs',
+]);
 const SOURCE_EXTENSIONS = new Set(['.mjs', '.js', '.cjs', '.sh']);
 
 function executableSource(source) {
@@ -27,6 +30,14 @@ const ACTIONS = [
     ],
     shellPatterns: [/^\s*gh\s+release\s+create\b/m],
   },
+  {
+    action: 'github-release-update',
+    jsPatterns: [
+      /['"]PATCH['"][\s\S]{0,120}releases\//,
+      /\[\s*['"]release['"]\s*,\s*['"]edit['"]/,
+    ],
+    shellPatterns: [/^\s*gh\s+(?:release\s+edit|api\s+.*releases\/.*PATCH)\b/m],
+  },
   {
     action: 'npm-publish',
     jsPatterns: [
@@ -47,7 +58,7 @@ const ACTIONS = [
 
 export function detectPublisherActions(file, source) {
   const relative = file.split(path.sep).join('/');
-  if (relative === CANONICAL_PUBLISHER) return [];
+  if (CANONICAL_PUBLISHERS.has(relative)) return [];
   const executable = executableSource(source);
   const kind = path.extname(relative) === '.sh' ? 'shellPatterns' : 'jsPatterns';
   return ACTIONS
@@ -67,6 +78,7 @@ function sourceFiles(root) {
   };
   visit(path.join(root, 'scripts'));
   visit(path.join(root, 'deploy'));
+  visit(path.join(root, 'bin'));
   return files;
 }
 

package/scripts/release-transaction-provider.mjs

@@ -0,0 +1,236 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { RECEIPT_PREFIX, TERMINAL_STATES } from './release-transaction.mjs';
+
+const REPO = 'stuinfla/ruvnet-brain';
+const PACKAGE = 'ruvnet-brain';
+
+const command = (name, args, options = {}) => execFileSync(name, args, {
+  encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], ...options,
+}).trim();
+const json = (name, args, options) => JSON.parse(command(name, args, options));
+const maybe = (callback, fallback = null) => {
+  try { return callback(); } catch { return fallback; }
+};
+
+const tagSha = (tag, root) => {
+  const rows = command('git', ['ls-remote', 'origin', `refs/tags/${tag}`, `refs/tags/${tag}^{}`], { cwd: root })
+    .split('\n').filter(Boolean).map((line) => line.split(/\s+/));
+  return rows.find(([, ref]) => ref?.endsWith('^{}'))?.[0] || rows[0]?.[0] || '';
+};
+
+const assetBytes = (asset) => {
+  const result = spawnSync('gh', ['api', asset.url, '-H', 'Accept: application/octet-stream'], {
+    encoding: 'buffer', stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (result.error || result.status !== 0) throw new Error(`cannot download transaction asset ${asset.name}`);
+  return Buffer.from(result.stdout);
+};
+const assetReceipt = (asset) => JSON.parse(assetBytes(asset).toString('utf8'));
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+
+export function liveReleaseProvider({
+  root = process.cwd(), candidateReceipt = null, publicationReceipt = null,
+} = {}) {
+  let releases = [];
+  let activeDraft = null;
+  const refresh = () => {
+    releases = json('gh', ['api', `repos/${REPO}/releases?per_page=100`]);
+    return releases;
+  };
+  const releaseById = (id) => json('gh', ['api', `repos/${REPO}/releases/${id}`]);
+  const receiptsFor = (release) => (release?.assets || [])
+    .filter(({ name }) => name.startsWith(RECEIPT_PREFIX) && name.endsWith('.json'))
+    .map(assetReceipt);
+  const materializeRemoteAssets = (draft, identity) => {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-release-staged-'));
+    try {
+      const release = releaseById(draft.id);
+      const required = [
+        ['bundlePath', 'ruvnet-brain.zip'],
+        ['bundleSignaturePath', 'ruvnet-brain.zip.sig'],
+        ['bundleDigestPath', 'ruvnet-brain.zip.sha256'],
+      ];
+      const assets = {};
+      for (const [key, name] of required) {
+        const remote = release.assets?.find((asset) => asset.name === name);
+        if (!remote) throw new Error(`staged GitHub asset missing: ${name}`);
+        const file = path.join(temp, name);
+        fs.writeFileSync(file, assetBytes(remote), { flag: 'wx', mode: 0o600 });
+        assets[key] = file;
+      }
+      if (sha256(fs.readFileSync(assets.bundlePath)) !== identity.bundleSha256) {
+        throw new Error('staged GitHub bundle digest does not match transaction identity');
+      }
+      const packed = json('npm', [
+        'pack', `${PACKAGE}@candidate-v${identity.version}`, '--json', '--pack-destination', temp,
+      ]);
+      if (!Array.isArray(packed) || packed.length !== 1 || !packed[0].filename) {
+        throw new Error('npm candidate pack did not return exactly one artifact');
+      }
+      assets.packagePath = path.join(temp, packed[0].filename);
+      const integrity = `sha512-${crypto.createHash('sha512').update(fs.readFileSync(assets.packagePath)).digest('base64')}`;
+      if (integrity !== identity.packageIntegrity) throw new Error('staged npm package integrity mismatch');
+      return { assets, cleanup: () => fs.rmSync(temp, { recursive: true, force: true }) };
+    } catch (error) {
+      fs.rmSync(temp, { recursive: true, force: true });
+      throw error;
+    }
+  };
+
+  return {
+    async discover(identity) {
+      const all = refresh();
+      const matchingDrafts = all.filter((release) => release.tag_name === identity.tag
+        && release.target_commitish === identity.candidateSha).map((release) => ({
+        id: release.id, tag: release.tag_name, sha: release.target_commitish, draft: release.draft,
+      }));
+      activeDraft = matchingDrafts[0] || null;
+      const receipts = matchingDrafts.length === 1 ? receiptsFor(releaseById(matchingDrafts[0].id)) : [];
+      const latestByTransaction = new Map();
+      for (const receipt of all.flatMap((release) => receiptsFor(release))) {
+        const prior = latestByTransaction.get(receipt.transactionId);
+        if (!prior || receipt.sequence > prior.sequence) latestByTransaction.set(receipt.transactionId, receipt);
+      }
+      const pending = [...latestByTransaction.values()]
+        .filter((receipt) => !TERMINAL_STATES.has(receipt.state));
+      const npmLatest = maybe(() => command('npm', ['view', `${PACKAGE}@latest`, 'version']), null);
+      const githubLatest = maybe(() => json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name, null);
+      return { matchingDrafts, receipts, pending, prior: { npmLatest, githubLatest } };
+    },
+
+    async createDraft(identity) {
+      const release = json('gh', [
+        'api', '-X', 'POST', `repos/${REPO}/releases`,
+        '-f', `tag_name=${identity.tag}`, '-f', `target_commitish=${identity.candidateSha}`,
+        '-f', `name=${identity.tag} staged candidate`, '-F', 'draft=true', '-F', 'prerelease=false',
+      ]);
+      activeDraft = { id: release.id, tag: release.tag_name, sha: release.target_commitish };
+      return activeDraft;
+    },
+
+    async appendReceipt(draft, receipt, name) {
+      const anchor = draft || activeDraft;
+      if (!anchor) throw new Error('no draft anchor for transaction receipt');
+      const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-release-receipt-'));
+      const file = path.join(temp, name);
+      try {
+        fs.writeFileSync(file, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+        command('gh', ['release', 'upload', anchor.tag, file, '--repo', REPO]);
+      } finally {
+        fs.rmSync(temp, { recursive: true, force: true });
+      }
+    },
+
+    async readReceipt(draft, sequence) {
+      const name = `${RECEIPT_PREFIX}${String(sequence).padStart(4, '0')}.json`;
+      const release = releaseById((draft || activeDraft).id);
+      const asset = release.assets?.find((item) => item.name === name);
+      if (!asset) throw new Error(`remote receipt ${name} is missing after upload`);
+      return assetReceipt(asset);
+    },
+
+    async uploadAssets(draft, assets) {
+      const paths = [assets.bundlePath, assets.bundleSignaturePath, assets.bundleDigestPath, assets.packagePath];
+      for (const file of paths) {
+        const release = releaseById(draft.id);
+        const existing = release.assets?.find(({ name }) => name === path.basename(file));
+        if (existing) {
+          if (sha256(assetBytes(existing)) !== sha256(fs.readFileSync(file))) {
+            throw new Error(`refusing to replace staged asset with different bytes: ${existing.name}`);
+          }
+          continue;
+        }
+        command('gh', ['release', 'upload', draft.tag, file, '--repo', REPO]);
+      }
+    },
+
+    async materializeStagedAssets(draft, identity) {
+      return materializeRemoteAssets(draft, identity);
+    },
+
+    async stageNpm(identity, packagePath) {
+      const existing = maybe(() => command('npm', ['view', `${PACKAGE}@${identity.version}`, 'dist.integrity']), null);
+      if (existing) return;
+      command('npm', ['publish', packagePath, '--tag', `candidate-v${identity.version}`]);
+    },
+
+    async observeNpmCandidate(identity) {
+      const metadata = json('npm', ['view', `${PACKAGE}@candidate-v${identity.version}`, '--json']);
+      return { version: metadata.version, integrity: metadata.dist?.integrity, tag: `candidate-v${identity.version}` };
+    },
+
+    async publishDraftNonLatest(draft) {
+      command('gh', ['api', '-X', 'PATCH', `repos/${REPO}/releases/${draft.id}`, '-F', 'draft=false', '-f', 'make_latest=false']);
+    },
+
+    async observeGithub(identity) {
+      const release = json('gh', ['api', `repos/${REPO}/releases/tags/${identity.tag}`]);
+      const latest = maybe(() => json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name, null);
+      return { tag: release.tag_name, sha: tagSha(identity.tag, root), latest: latest === identity.tag };
+    },
+
+    async promoteNpm(identity) {
+      command('npm', ['dist-tag', 'add', `${PACKAGE}@${identity.version}`, 'latest']);
+    },
+    async observeNpmLatest() {
+      return { version: command('npm', ['view', `${PACKAGE}@latest`, 'version']) };
+    },
+    async makeGithubLatest(draft) {
+      command('gh', ['api', '-X', 'PATCH', `repos/${REPO}/releases/${draft.id}`, '-f', 'make_latest=true']);
+    },
+    async observeGithubLatest() {
+      return { tag: json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name };
+    },
+    async restoreNpmLatest(prior, expected) {
+      const current = command('npm', ['view', `${PACKAGE}@latest`, 'version']);
+      if (current !== expected) throw new Error(`refusing compensation: npm latest is ${current}, expected ${expected}`);
+      command('npm', ['dist-tag', 'add', `${PACKAGE}@${prior}`, 'latest']);
+    },
+    async finalize(identity, receipt, hostVerifier) {
+      const staged = materializeRemoteAssets(activeDraft, identity);
+      let hosts;
+      try {
+        hosts = await hostVerifier.verify({ source: 'final', identity, assets: staged.assets });
+      } finally {
+        staged.cleanup();
+      }
+      if (hosts.verdict !== 'PASS') return { verdict: 'FAIL', hosts };
+      if (!candidateReceipt || !publicationReceipt) {
+        throw new Error('final convergence requires candidate and publication receipt paths');
+      }
+      if (!fs.existsSync(path.resolve(root, publicationReceipt))) {
+        const publication = spawnSync(process.execPath, [
+          'scripts/publication-receipt.mjs', '--candidate', candidateReceipt, '--out', publicationReceipt,
+        ], { cwd: root, encoding: 'utf8', timeout: 1_200_000 });
+        if (publication.error || publication.status !== 0) {
+          return { verdict: 'FAIL', hosts, publicationError: String(publication.stderr || publication.error?.message) };
+        }
+      }
+      const seal = spawnSync(process.execPath, [
+        'scripts/release-proof.mjs', '--candidate', candidateReceipt, '--publication', publicationReceipt,
+      ], { cwd: root, encoding: 'utf8', timeout: 300_000 });
+      if (seal.error || seal.status !== 0) {
+        return { verdict: 'FAIL', hosts, sealError: String(seal.stderr || seal.error?.message) };
+      }
+      const channels = spawnSync(process.execPath, ['scripts/verify-channels.mjs'], {
+        cwd: root, encoding: 'utf8', timeout: 600_000,
+      });
+      if (channels.error || channels.status !== 0) {
+        return { verdict: 'FAIL', hosts, channelError: String(channels.stderr || channels.error?.message) };
+      }
+      const probe = spawnSync(process.execPath, ['scripts/published-surface-probe.mjs', '--json'], {
+        cwd: root, encoding: 'utf8', timeout: 600_000,
+      });
+      let observed = null;
+      try { observed = JSON.parse(probe.stdout || ''); } catch {}
+      return {
+        verdict: probe.status === 0 && observed?.verdict === 'PASS' ? 'PASS' : 'FAIL',
+        hosts, surface: observed, publicationReceipt, previousReceiptDigest: receipt.receiptDigest,
+      };
+    },
+  };
+}