ruvnet-brain 4.0.7 → 4.0.12

package/plugin/scripts/continuation-gate.mjs

@@ -160,7 +160,47 @@ const nowMs = Date.now();
 // force. This closes the empty-stdin hole that LOOP-SAFETY 1's `__source` check does not cover.
 if (!hookInput.session_id) process.exit(EXIT_ALLOW);
 
-const open = led.items.filter((i) => !i.done);
+/**
+ * ARTIFACT-DERIVED OPEN WORK — the half that cannot be forgotten.
+ *
+ * WHY THIS EXISTS, measured rather than supposed. On 2026-08-04 the owner asked why the model had
+ * gone back to stopping early, and the ledger answered: 25 items, ZERO open, last written 2026-07-25.
+ * The gate had been structurally silent for ten days. Not broken — starved.
+ *
+ * The cause is the design, not the drift. Until now the ONLY source of "is work outstanding" was
+ * `--commit-to`, i.e. the model noticing its own commitment and recording it. So the guard against
+ * the model stopping early depended on the model remembering to arm it, and the failure mode is
+ * silent in exactly the sessions where it matters most. That is this project's oldest rule broken
+ * inside the mechanism meant to enforce it: status must be DERIVED FROM A VERIFIABLE ARTIFACT,
+ * never asserted.
+ *
+ * So the gate now also reads work that exists whether or not anyone remembered to write it down.
+ * `open-issues.json` is produced by the issue-watch pipeline against the real repo; an issue past
+ * its response SLA is outstanding work by definition, and no amount of forgetting can erase it.
+ *
+ * Deliberately narrow: ONLY SLA breaches, never the full backlog — a permanently non-empty backlog
+ * would make this fire forever, which is nagging, not enforcement. And only a FRESH observation
+ * (<6h, the same window session-start-core uses), because a stale file is not evidence of anything.
+ */
+function artifactOpenWork() {
+  try {
+    const file = process.env.RUVNET_OPEN_ISSUES_FILE
+      || path.join(HOME, '.cache', 'ruvnet-brain', 'open-issues.json');
+    const status = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const observedAt = Date.parse(status?.at || '');
+    if (!Number.isFinite(observedAt) || nowMs - observedAt > 6 * 3600_000) return [];
+    return (Array.isArray(status.issues) ? status.issues : [])
+      .filter((issue) => issue?.breach)
+      .map((issue) => ({
+        text: `issue #${issue.number} on ${status.repo} is ${issue.ageHours}h past its response SLA — ${String(issue.title || '').slice(0, 80)}`,
+        done: false,
+        at: new Date(observedAt).toISOString(),
+        derived: true,
+      }));
+  } catch { return []; }
+}
+
+const open = [...led.items.filter((i) => !i.done), ...artifactOpenWork()];
 if (!open.length) process.exit(EXIT_ALLOW);   // nothing outstanding: silence is correct
 
 /**

package/plugin/scripts/learn-flush.mjs

@@ -14,6 +14,13 @@ import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { readStdinBounded } from './hook-input.mjs';
 import { loadRuntimePreferences } from './runtime-preferences.mjs';
+import { resolveRuflo, RUFLO_MISSING } from './ruflo-bin.mjs';
+
+// ONE BOUNDED LINE ON STDERR. stderr because a SessionEnd hook's stdout is not surfaced, and bounded
+// because a hook that prints a stack trace on every `/clear` gets muted — and a muted diagnostic is
+// no diagnostic at all (the same lesson as the session-start line that reported its own defect every
+// session for eight days and went unread).
+const warn = (msg) => { try { process.stderr.write(`learn-flush: ${msg}\n`); } catch { /* stderr gone */ } };
 
 const HOME = os.homedir();
 const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || process.cwd();
@@ -48,7 +55,11 @@ const QUEUE_ROOT = LEARNING_SCOPE === 'user'
   ? path.join(HOME, '.cache', 'ruvnet-brain', 'learn')
   : path.join(PROJECT, '.swarm', 'ruvnet-brain-learn');
 const QUEUE = process.env.LEARN_QUEUE || path.join(QUEUE_ROOT, `session-${SID}.jsonl`);
-const RUFLO = path.join(HOME, '.npm-global/bin/ruflo');
+// Issue #105: this was a hardcoded `path.join(HOME, '.npm-global/bin/ruflo')` — the owner's npm
+// prefix. On any other prefix (Homebrew, nvm, Volta, plain `npm -g`) the path simply did not exist,
+// every feed below threw ENOENT, and every throw landed in a `catch {}` that said nothing. One
+// resolver, shared with distill-project.mjs and health-repair.mjs's original — see ruflo-bin.mjs.
+const RUFLO = resolveRuflo();
 const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
 const MAX_ACTIONS = 8; // bound the work so SessionEnd stays fast
 
@@ -98,7 +109,16 @@ for (const line of lines) {
 const actions = allDistinct.slice(0, MAX_ACTIONS);
 const deferred = allDistinct.slice(MAX_ACTIONS);
 
+// ruflo is genuinely not on this machine. SAY SO — once — and keep the queue. Exiting 0 keeps the
+// best-effort contract (an absent optional learner must never break SessionEnd); saying nothing at
+// all is what turned #105 into eight invisible ENOENTs and a queue that never drained.
+if (!RUFLO && actions.length) {
+  warn(`0/${actions.length} fed — ${RUFLO_MISSING}. The queue is KEPT for retry.`);
+  process.exit(0);
+}
+
 let fed = 0;
+const failures = [];              // WHY each feed failed — the thing `catch {}` used to destroy
 let stoppedAt = actions.length;   // how far the feed actually got before the deadline
 for (let i = 0; i < actions.length; i++) {
   const remaining = DEADLINE - Date.now();
@@ -120,7 +140,22 @@ for (let i = 0; i < actions.length; i++) {
       timeout: Math.min(6000, remaining),
     });
     fed++;
-  } catch { /* best-effort — one slow/failed record must not stall session end */ }
+  } catch (e) {
+    // BEST-EFFORT, NOT SILENT. The old `catch { /* best-effort */ }` swallowed the reason, so a
+    // machine where every call failed looked exactly like one where every call worked: exit 0,
+    // no output, and the only trace a queue that never shrank. "Reports success while doing
+    // nothing" is the defect class this project treats as the worst thing it can ship. Keep going
+    // (one bad record must not stall session end), but keep the reason.
+    failures.push(String(e?.message || e).split('\n')[0].slice(0, 120));
+  }
+}
+// SURFACE IT. Distinct reasons only, at most two: eight copies of the same ENOENT is noise, and the
+// second distinct reason is usually where the real information is.
+if (failures.length) {
+  const distinct = [...new Set(failures)];
+  warn(`${failures.length}/${actions.length} feed call(s) FAILED via ${RUFLO}`
+    + ` — ${distinct.slice(0, 2).join(' | ')}${distinct.length > 2 ? ` (+${distinct.length - 2} more kind(s))` : ''}`
+    + (fed === 0 ? '. Nothing was learned; the queue is KEPT for retry.' : `. ${fed} succeeded.`));
 }
 // Whatever the deadline cut off is WORK, not waste: it goes back on the front of the queue so the
 // next flush continues from there. Dropping it would turn a time limit into the same silent data

package/plugin/scripts/project-identity.mjs

@@ -0,0 +1,89 @@
+// project-identity.mjs — ONE answer to "which directory is this, and have I seen it already?"
+//
+// WHY THIS EXISTS. Two user-filed bugs, #85 and #107, are the same defect: the product derives a
+// project's location independently at each site and the sites then disagree.
+//
+//   #85  The PreCompact producer wrote its receipt under `CLAUDE_PROJECT_DIR`; the Console probe
+//        that reports whether a receipt exists looked under `process.cwd()`. Launch the Console
+//        from a subdirectory of the project and it warns "no supported PreCompact snapshot found"
+//        about a snapshot it had itself just written. Nothing was broken except the agreement.
+//
+//   #107 `candidateRoots()` returned BOTH `~/Code` and `~/code`, which on APFS are one directory
+//        with one inode. Every project under them was scanned, counted and summed twice, so the
+//        machine-wide memory total read exactly 2x — silently, confidently, in the one figure the
+//        Console exists to make trustworthy. `path.resolve()` was the guard, and it normalises
+//        `.`/`..` only: it case-folds nothing and resolves no symlinks, which the guard's own
+//        comment ("e.g. a symlink") shows it was believed to do.
+//
+// WHY DEVICE+INODE RATHER THAN LOWER-CASING. Lower-casing is a guess about the filesystem, and it
+// is wrong on the machines that would suffer most: Linux, and case-sensitive APFS volumes, where
+// `Code` and `code` really are two projects and folding them would DELETE one from the report.
+// `st_dev` + `st_ino` is not a guess — it is the filesystem's own answer, correct in both
+// directions on every volume, and it settles symlinks and bind mounts in the same stroke. The
+// case-insensitivity probe the reporter suggested (write a temp file, stat the other spelling)
+// would also work, but it writes to the user's disk to learn something `stat` already knows.
+//
+// `fs.realpathSync.native` is the OS canonicaliser: it resolves symlinks AND returns the case as
+// stored on disk. Plain `fs.realpathSync` is a JavaScript reimplementation that does symlinks only
+// — measured on this repo's own machine, `realpathSync('~/code')` stays `~/code` while
+// `realpathSync.native('~/code')` returns `~/Code`. That one missing word is the whole of #107.
+import fs from 'node:fs';
+import path from 'node:path';
+
+const defaultRealpath = (value) => fs.realpathSync.native(value);
+const defaultStat = (value) => fs.statSync(value, { bigint: true });
+
+/** The operating system's own spelling of an existing path, or null when it cannot be resolved. */
+export function canonicalPath(value, { realpath = defaultRealpath } = {}) {
+  if (typeof value !== 'string' || !value) return null;
+  try { return realpath(value); } catch { return null; }
+}
+
+/**
+ * A key that is equal for two names of one directory and different for two directories.
+ * Falls back to the canonical path when the volume reports no usable inode (some Windows and
+ * network mounts report 0) — never worse than the raw string compare it replaces.
+ */
+export function pathIdentity(value, { realpath = defaultRealpath, stat = defaultStat } = {}) {
+  const canonical = canonicalPath(value, { realpath });
+  if (!canonical) return null;
+  try {
+    const info = stat(canonical);
+    if (info?.ino) return `${info.dev}:${info.ino}`;
+  } catch { /* unreadable — the canonical spelling is still a better key than the raw one */ }
+  return canonical;
+}
+
+/** True when both names denote the same existing directory or file. */
+export function sameLocation(a, b, options = {}) {
+  const left = pathIdentity(a, options);
+  return left !== null && left === pathIdentity(b, options);
+}
+
+/** True when `child` is `root` or lies beneath it, compared canonically rather than by raw string. */
+export function contains(root, child, options = {}) {
+  const canonicalRoot = canonicalPath(root, options);
+  const canonicalChild = canonicalPath(child, options);
+  if (!canonicalRoot || !canonicalChild) return false;
+  if (sameLocation(canonicalRoot, canonicalChild, options)) return true;
+  const relative = path.relative(canonicalRoot, canonicalChild);
+  return Boolean(relative) && !relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative);
+}
+
+/**
+ * THE project directory. The PreCompact snapshot producer and the Console probe that detects the
+ * snapshot both call this, so they cannot disagree about where the project is (#85).
+ *
+ * `CLAUDE_PROJECT_DIR` wins only when the current directory actually lies inside it. Containment,
+ * not mere presence, is what makes the two sides agree by construction: a hook and a Console
+ * launched anywhere within one project resolve to that project's root, while a caller that hands
+ * over an unrelated directory (a test fixture, an explicit `--project`) is never overruled by an
+ * environment variable it knows nothing about.
+ */
+export function projectDirectory({ env = process.env, cwd = process.cwd(), ...options } = {}) {
+  const here = canonicalPath(cwd, options) || path.resolve(cwd);
+  const declared = typeof env.CLAUDE_PROJECT_DIR === 'string' && env.CLAUDE_PROJECT_DIR.trim()
+    ? canonicalPath(env.CLAUDE_PROJECT_DIR, options)
+    : null;
+  return declared && contains(declared, here, options) ? declared : here;
+}

package/plugin/scripts/ruflo-bin.mjs

@@ -0,0 +1,81 @@
+/**
+ * ruflo-bin.mjs — the ONE place this repo decides WHERE the global `ruflo` binary is.
+ *
+ * WHY THIS FILE EXISTS. Issues #99 and #105 are one defect filed twice: `scripts/distill-project.mjs`
+ * and `plugin/scripts/learn-flush.mjs` each hardcoded `~/.npm-global/bin/ruflo` — the owner's npm
+ * prefix, nobody else's. On a Homebrew, nvm, Volta, or plain `npm -g` install that path does not
+ * exist, so #99 died with "ruflo is not at ~/.npm-global/bin/ruflo" and #105 failed every feed
+ * silently — both on machines where ruflo was installed and sitting on PATH the whole time.
+ *
+ * `health-repair.mjs` had already fixed exactly this, and its header says why: "Telling someone their
+ * tool is missing when it is on their PATH is the product lying, and it is unfalsifiable from their
+ * side: they cannot see why we looked in one place." That fix lived as a private function inside one
+ * file, so its two siblings kept the bug — the identical shape ADR-021 was written about ("One class,
+ * fixed in one file, regenerated in the sibling"). So the resolver moves here instead of being pasted
+ * a third time.
+ *
+ * MECHANISM — the hardened form, not the first draft. Two resolvers already existed in this repo:
+ *   • health-repair.mjs      (2026-07-21)  preferred path, then `sh -lc 'command -v ruflo'`
+ *   • capability-registry.mjs (2026-07-22)  preferred path, then a plain PATH walk, NO shell
+ * The second IS the first one, hardened, and it says so in place: `-l` sources the user's entire
+ * profile — every export, shim, and one-off line anyone has ever pasted into .profile — as the price
+ * of answering "where is ruflo?". Resolving a name against directories is all `command -v` was ever
+ * wanted for here, and it needs no shell at all. This module takes that version. Adopting the older
+ * mechanism would mean re-introducing, in a shared module, a bug the repo had already fixed one file
+ * over.
+ *
+ * ORDER, and each step earns its place:
+ *   1. RUFLO_BIN, if set, is AUTHORITATIVE — returned as given, whether or not it exists. An explicit
+ *      override that quietly falls back to some other ruflo is not an override, and the caller's
+ *      "not at <path>" message has to name the path the user actually asked for.
+ *   2. ~/.npm-global/bin/ruflo — Rule 21's ONE global binary, checked first so a machine that has it
+ *      never depends on PATH ordering.
+ *   3. A PATH walk — the entire point of #99/#105: an installed ruflo living anywhere else.
+ *   4. null — "I could not find it", said plainly. Never guess a path and then blame the user for it.
+ *
+ * Rule 21 is untouched by this: still ONE ruflo, still the global one, never `npx ruflo@latest`. This
+ * resolves WHERE that one global binary is rather than assuming everyone's prefix matches the owner's.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+/**
+ * Locate the global ruflo. LOCATES, NEVER EXECUTES — no shell, no daemon, no side effects.
+ *
+ * @param {{ env?: Record<string, string|undefined>, home?: string }} [opts]
+ * @returns {string|null} path to ruflo, or null when it is genuinely not on this machine.
+ */
+export function resolveRuflo({ env = process.env, home = os.homedir() } = {}) {
+  if (env.RUFLO_BIN) return env.RUFLO_BIN;
+
+  // On Windows a global npm ruflo is `ruflo.cmd`; the extensionless sibling is a POSIX shell wrapper
+  // that Node cannot exec (and refuses to spawn without a shell since CVE-2024-27980).
+  const exts = process.platform === 'win32' ? ['.cmd', '.exe', ''] : [''];
+
+  // The preferred path needs that SAME rule. It first checked a bare `ruflo` only, so on Windows it
+  // either missed the real `ruflo.cmd` entirely or returned the POSIX wrapper the comment above
+  // says is unrunnable — and the caller then reported "ruflo is not at ~/.npm-global/bin/ruflo" to
+  // someone who had ruflo installed. That is the exact complaint #99 and #105 were filed about,
+  // reintroduced one platform over.
+  const preferredDir = path.join(home, '.npm-global', 'bin');
+  for (const ext of exts) {
+    const cand = path.join(preferredDir, `ruflo${ext}`);
+    try { if (fs.existsSync(cand) && fs.statSync(cand).isFile()) return cand; } catch { /* unreadable */ }
+  }
+  for (const dir of String(env.PATH || '').split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const cand = path.join(dir, `ruflo${ext}`);
+      try { if (fs.existsSync(cand) && fs.statSync(cand).isFile()) return cand; } catch { /* unreadable PATH entry */ }
+    }
+  }
+  return null;
+}
+
+/**
+ * What to say when resolveRuflo() returns null. ONE wording, so every caller reports the same thing
+ * and names both places it looked — the diagnostic #99 and #105 never gave anyone.
+ */
+export const RUFLO_MISSING = 'ruflo was not found in ~/.npm-global/bin or anywhere on your PATH'
+  + ' — install it with `npm i -g ruflo@latest`, or set RUFLO_BIN to its full path';

package/plugin/scripts/session-snapshot-hook.mjs

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createSessionSnapshot } from './session-snapshot-contract.mjs';
+import { projectDirectory } from './project-identity.mjs';
 
 function regularOrAbsent(file) {
   try {
@@ -30,5 +31,7 @@ export function writeSessionSnapshot(projectDir, event) {
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]).endsWith('session-snapshot-hook.mjs')) {
-  writeSessionSnapshot(process.env.CLAUDE_PROJECT_DIR || process.cwd(), process.argv[2] || 'SessionEnd');
+  // projectDirectory() is the SAME derivation the Console's detector uses. Deriving it here
+  // independently is what let this hook write a receipt the Console then reported as missing (#85).
+  writeSessionSnapshot(projectDirectory(), process.argv[2] || 'SessionEnd');
 }

package/plugin/scripts/session-start-core.mjs

@@ -472,11 +472,28 @@ export async function runSessionStart({
         emit(`[RuvNet Brain v${bannerVersion} — active this session, RETRIEVAL DOWN]`);
         emit(`The plugin and its hooks are running, but the brain itself is broken (see the alarm above). Do not claim grounding works. If you mention it at all: "🧠 RuvNet Brain active (v${bannerVersion}) — but its search is down right now."`);
       } else {
-        emit(`[RuvNet Brain v${bannerVersion} — active this session${updated ? ` · updated ${updated}` : ''}${kbVersion ? ` · knowledge bundle ${kbVersion}` : ''}]`);
+        // ONE VERSION, CUSTOMER-FACING (issue #77, restated from the customer's side).
+        //
+        // This printed the plugin version and the knowledge bundle's tag side by side —
+        // "RuvNet Brain active (v4.0.8, brain v4.0.7)". Those are two internal artefacts of ONE
+        // product. Showing both makes every user adjudicate whether their install is out of sync,
+        // a question they cannot answer and should never have been asked. Keeping the two in
+        // lockstep is this project's job; printing the seam is an admission leaking into the UI.
+        //
+        // The divergence is NOT hidden — when the tags differ it goes to the maintainer on the
+        // same private entitlement that gates open-issue alerts, because a bundle behind its
+        // plugin is a RELEASE defect to fix, not a banner to annotate.
+        emit(`[RuvNet Brain v${bannerVersion} — active this session${updated ? ` · updated ${updated}` : ''}]`);
+        const bundleTag = String(kbVersion).replace(/^v/, '');
+        if (bundleTag && bannerVersion !== 'unknown' && bundleTag !== bannerVersion
+            && maintainerIssueEntitlement(env, home, 'stuinfla/ruvnet-brain')) {
+          emit('[RuvNet Brain — MAINTAINER ONLY: the shipped generation is split. Do NOT surface this to the user.]');
+          emit(`Plugin is ${bannerVersion}; the knowledge bundle on this machine is ${kbVersion}. Per issue #77 these ship as ONE generation, so a split means a release published the plugin without its matching bundle asset. The user is correctly shown a single version (${bannerVersion}) — fix the release, never annotate the banner.`);
+        }
         let confidenceInstruction;
         if (readiness.state === 'ready') {
           emit('USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is ready and live; the grounding hooks are active.');
-          confidenceInstruction = `Open your FIRST response with ONE short, warm confirmation in your own words (2-3 lines, then move on; never repeat it this session). It must say "🧠 RuvNet Brain active (v${bannerVersion}${kbVersion ? `, brain ${kbVersion}` : ''})" — that version, in parentheses, always — and convey: it grounds rUv's stack (RVF, Ruflo, AgentDB, SPARC, agentic-flow…) in his real source rather than guessing; npx github:stuinfla/ruvnet-brain --doctor checks it; ${consoleInvoke} opens a visual settings page.`;
+          confidenceInstruction = `Open your FIRST response with ONE short, warm confirmation in your own words (2-3 lines, then move on; never repeat it this session). It must say "🧠 RuvNet Brain active (v${bannerVersion})" — ONE version, in parentheses, always; never a second number, never a bundle tag beside it — and convey: it grounds rUv's stack (RVF, Ruflo, AgentDB, SPARC, agentic-flow…) in his real source rather than guessing; npx github:stuinfla/ruvnet-brain --doctor checks it; ${consoleInvoke} opens a visual settings page.`;
         } else if (readiness.state === 'degraded') {
           const receipt = readiness.receipt || {};
           emit(`USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is registered but degraded (${receipt.phase || 'startup'}: ${receipt.error || 'readiness failed'}); the grounding hooks remain active.`);

package/plugin/skills/release-proof/scripts/release-proof.mjs

@@ -145,8 +145,11 @@ export function evaluatePublicationReceipt(candidate, publication) {
   const failures = [...candidateResult.failures];
   const sha = candidateResult.sha;
   const digest = candidateResult.artifactSha256;
-  if (publication?.schemaVersion !== 1 || publication?.phase !== 'publication') failures.push(fail('INVALID_PUBLICATION_RECEIPT', 'schemaVersion=1 and phase=publication are required'));
+  if (publication?.schemaVersion !== 2 || publication?.phase !== 'publication') failures.push(fail('INVALID_PUBLICATION_RECEIPT', 'schemaVersion=2 and phase=publication are required'));
   if (publication?.sha !== sha || publication?.artifactSha256 !== digest) failures.push(fail('PUBLICATION_SEAL_MISMATCH', 'publication does not reference candidate seal'));
+  if (!cleanHex(publication?.payloadId, 64) || !cleanHex(publication?.bundleArtifactSha256, 64)) {
+    failures.push(fail('PUBLIC_PAYLOAD_BINDING_MISSING', 'signed payload and public bundle digests are required'));
+  }
   const version = versionField(candidate?.version);
   const tag = version ? `v${version}` : null;
   const identityMismatches = versionIdentityFailures(version, candidate?.tag, [
@@ -155,8 +158,9 @@ export function evaluatePublicationReceipt(candidate, publication) {
     ['GitHub release tag', publication?.githubRelease?.tag, tag],
     ['bundle brainVersion', publication?.bundle?.brainVersion],
     ['bundle releaseTag', publication?.bundle?.releaseTag, tag],
-    ['installed Claude host', publication?.installed?.claude?.version],
-    ['installed Codex host', publication?.installed?.codex?.version],
+    ['Claude-only host', publication?.installed?.claudeOnly?.version],
+    ['Codex-only host', publication?.installed?.codexOnly?.version],
+    ['dual host', publication?.installed?.dual?.version],
   ]);
   if (identityMismatches.length > 0) {
     failures.push(fail('PUBLIC_VERSION_IDENTITY_MISMATCH', `public surfaces must identify candidate ${version ?? 'UNKNOWN'}: ${identityMismatches.join(', ')}`));
@@ -165,9 +169,12 @@ export function evaluatePublicationReceipt(candidate, publication) {
     const item = publication?.[surface];
     if (item?.sha !== sha || item?.artifactSha256 !== digest) failures.push(fail('PUBLIC_ARTIFACT_MISMATCH', `${surface} differs from candidate seal`));
   }
-  for (const hostName of ['claude', 'codex']) {
+  for (const hostName of ['claudeOnly', 'codexOnly', 'dual']) {
     const host = publication?.installed?.[hostName];
-    if (host?.status !== 'PASS' || host?.artifactSha256 !== digest) failures.push(fail('PUBLIC_HOST_NOT_PASS', `${hostName} is not running sealed public artifact`));
+    if (host?.status !== 'PASS' || host?.doctorExit !== 0 || host?.artifactSha256 !== digest
+      || host?.functionalSearch !== true || !(host?.searchMs <= Number(publication?.brain?.deadlineMs) * 0.8)) {
+      failures.push(fail('PUBLIC_HOST_NOT_PASS', `${hostName} is not running a doctor-clean functional sealed public artifact`));
+    }
   }
   const brain = publication?.brain || {};
   if (brain.status !== 'PASS' || brain.selfStore !== true || !(brain.broadMs <= Number(brain.deadlineMs) * 0.8)) failures.push(fail('PUBLIC_BRAIN_NOT_PASS', 'public installed Brain acceptance failed'));

package/scripts/candidate-host-evidence.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { stagedHostVerifier } from './staged-host-verifier.mjs';
+import { payloadIdFor } from './release-payload.mjs';
+
+const arg = (name) => {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : null;
+};
+const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+
+const manifestPath = path.resolve(arg('--manifest'));
+const packagePath = path.resolve(arg('--package'));
+const bundlePath = path.resolve(arg('--bundle'));
+const out = path.resolve(arg('--out'));
+const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+const payloadId = payloadIdFor(manifest);
+const identity = { version: manifest.version, candidateSha: manifest.candidateSha, payloadId };
+const result = await stagedHostVerifier({ assets: { packagePath, bundlePath }, identity })
+  .verify({ source: 'candidate', assets: { packagePath, bundlePath } });
+if (result.verdict !== 'PASS') throw new Error(`candidate host matrix failed: ${result.error || 'unknown'}`);
+
+const modeNames = { claude: 'claude-only', codex: 'codex-only', dual: 'dual-host' };
+const leaves = Object.entries(modeNames).map(([mode, name]) => {
+  const fixture = result.fixtures?.[mode];
+  if (fixture?.status !== 'PASS' || fixture?.doctorExit !== 0) throw new Error(`${name} did not produce a clean doctor receipt`);
+  return {
+    name,
+    sha: manifest.candidateSha,
+    payloadId,
+    status: fixture.status === 'PASS' ? 'completed' : 'failed',
+    conclusion: 'success',
+    verdict: 'PASS',
+    source: 'candidate-host-evidence',
+    mode,
+    doctorExit: fixture.doctorExit,
+    artifactSha256: sha256(packagePath),
+  };
+});
+fs.writeFileSync(out, `${JSON.stringify({
+  schemaVersion: 1,
+  sha: manifest.candidateSha,
+  payloadId,
+  artifactSha256: sha256(packagePath),
+  leaves,
+}, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+console.log(JSON.stringify({ verdict: 'PASS', payloadId, leaves: leaves.map(({ name }) => name) }));

package/scripts/ci/learning-replay-codex-adapter.mjs

@@ -23,8 +23,20 @@ const probe = process.env.RUVNET_REPLAY_LESSON_PROBE || '';
 if (event === 'PreToolUse') {
   const recorder = process.env.RUVNET_REPLAY_RECORDER || '';
   if (!recorder) process.exit(2);
+  // Codex emits exec_command with tool_input.cmd; the shared Claude/Ruflo boundary consumes
+  // Bash with tool_input.command. Normalize the real host envelope before the recorder parses it.
+  const recorderInput = Buffer.from(JSON.stringify({
+    ...input,
+    tool_name: /^(?:functions[._]{1,2})?exec_command$/.test(String(input.tool_name || ''))
+      ? 'Bash'
+      : input.tool_name,
+    tool_input: {
+      ...(input.tool_input || {}),
+      command: input.tool_input?.command ?? input.tool_input?.cmd ?? input.command ?? '',
+    },
+  }));
   const result = spawnSync(process.execPath, [recorder, attemptsFile, sequenceFile], {
-    input: raw,
+    input: recorderInput,
     encoding: 'utf8',
     env: process.env,
   });

package/scripts/console-runtime-identity.mjs

@@ -0,0 +1,74 @@
+// ONE definition of "what the persistent Console runtime is" and "which generation is running".
+//
+// #79 reported a Console that survived an update: the browser was served the new frontend from disk
+// while the Node process kept its pre-update router in memory, and every relaunch said "already
+// running". The reuse check compared a `sourceSha256` computed from a SINGLE file —
+// scripts/onboarding-console.mjs — while the runtime the server actually executes is this whole
+// surface: ~230 modules it imports plus the frontend it serves. Two genuinely different candidates
+// whose entrypoint bytes happened to match produced byte-identical identities, so an update that
+// changed console-engine.mjs, capability-registry.mjs or console/app.js was invisible to the
+// launcher. The identity has to derive from something an update cannot leave behind, which is the
+// installed bytes themselves — all of them.
+//
+// #76 reported the same disease at the asset boundary: the runtime copied plugin/scripts without
+// the sibling docs/ and manifest that plugin/scripts/whats-new.mjs reads, so the executable
+// travelled and its assets did not. The copy list and the identity list were two separate
+// enumerations of one payload; they are one list now, so an asset added to the runtime is part of
+// its generation by construction.
+//
+// The installer hashes the staged tree with this function and the running server hashes its own
+// root with this function, over this list. Neither side can define the fact differently.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+/**
+ * Every path the persistent Console runtime carries, relative to both the candidate source root and
+ * the installed runtime root (they are laid out identically). This is simultaneously the installer's
+ * copy list and the generation's digest input — one enumeration, so they cannot drift.
+ */
+export const CONSOLE_RUNTIME_SURFACE = Object.freeze([
+  'console',
+  'scripts',
+  'plugin/scripts',
+  // whats-new.mjs resolves its version manifest and curated notes relative to its own plugin root
+  // (#76). Shipping the executable without them is how the installed skill lost its release notes.
+  'plugin/docs',
+  'plugin/.claude-plugin',
+  'data/model-catalog.json',
+  'kb/brain-profile.mjs',
+  'bin/install.mjs',
+  'package.json',
+]);
+
+/** The runtime's own identity file, written by the installer INTO the tree — never part of its own digest. */
+export const CONSOLE_RUNTIME_IDENTITY_FILE = 'runtime-identity.json';
+
+/**
+ * Deterministic content digest of the runtime surface under `root`.
+ *
+ * A path that is absent is hashed as absent rather than skipped: a runtime that lost a file is a
+ * different generation, not the same one, and a launcher must be able to see that.
+ *
+ * @param {string} root runtime root (an installed `.console-runtime`, a marketplace clone, or a checkout)
+ * @returns {string} hex sha256
+ */
+export function consoleRuntimeDigest(root) {
+  const hash = crypto.createHash('sha256');
+  const visit = (absolute, relative) => {
+    let stat;
+    try { stat = fs.lstatSync(absolute); } catch { hash.update(`absent\0${relative}\0`); return; }
+    if (stat.isDirectory()) {
+      hash.update(`d\0${relative}\0`);
+      let entries = [];
+      try { entries = fs.readdirSync(absolute).sort(); } catch { hash.update(`unreadable\0${relative}\0`); return; }
+      for (const entry of entries) visit(path.join(absolute, entry), `${relative}/${entry}`);
+      return;
+    }
+    hash.update(`f\0${relative}\0`);
+    try { hash.update(fs.readFileSync(absolute)); } catch { hash.update(`unreadable\0${relative}\0`); }
+  };
+  for (const relative of CONSOLE_RUNTIME_SURFACE) visit(path.join(root, relative), relative);
+  return hash.digest('hex');
+}

package/scripts/distill-project.mjs

@@ -37,9 +37,13 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { execFileSync, spawnSync } from 'node:child_process';
+import { resolveRuflo, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
 
 const HOME = os.homedir();
-const RUFLO = process.env.RUFLO_BIN || path.join(HOME, '.npm-global/bin/ruflo');
+// Issue #99: this was `process.env.RUFLO_BIN || path.join(HOME, '.npm-global/bin/ruflo')`, so every
+// install whose npm prefix is not the owner's (Homebrew, nvm, Volta, plain `npm -g`) was told its
+// tool was missing while ruflo sat on their PATH. One resolver, shared — see ruflo-bin.mjs.
+const RUFLO = resolveRuflo();
 const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
 
 const argv = process.argv.slice(2);
@@ -126,6 +130,10 @@ if (has('--restore')) {
 }
 
 // ── PRE-FLIGHT ─────────────────────────────────────────────────────────────────────────────────────
+// Two different facts, so two different sentences. `null` means we looked everywhere and found
+// nothing; a path that does not exist means the user pointed RUFLO_BIN somewhere empty, and naming
+// that exact path back to them is the whole value of the message.
+if (!RUFLO) die(RUFLO_MISSING);
 if (!fs.existsSync(RUFLO)) die(`ruflo is not at ${RUFLO.replace(HOME, '~')} — install it with \`npm i -g ruflo@latest\``);
 if (!fs.existsSync(DB)) die(`no memory store at ${DB.replace(HOME, '~')} — nothing to distill for this project`);
 

package/scripts/doc-currency.mjs

@@ -408,6 +408,7 @@ export function evaluateDoc(root, rel, opts = {}) {
     status: k.status ?? null,
     date: k.date ?? null,
     updated: k.updated ?? null,
+    updatedPinned: k.updated_pinned === true || k.updated_pinned === 'true',
     implStored: k.impl ?? null,
     verifiedStamp: k.verified ?? null,
     verifiedDigestStored: k.verified_digest ?? null,
@@ -455,7 +456,19 @@ export function evaluateDoc(root, rel, opts = {}) {
     if (Number.isFinite(d) && Number.isFinite(g)) {
       const deltaDays = Math.round((g - d) / 86400000);
       if (deltaDays >= 1) {
-        add(BLOCK, 'stamp-lags-doc',
+        // `updated_pinned: true` — the date is a HISTORICAL RECORD, not a currency stamp.
+        //
+        // Some documents record WHEN SOMETHING HAPPENED, not when the file was last edited.
+        // ADR-050's `updated: 2026-08-02` is an incident cutoff and is asserted by
+        // tests/unit/fix-workstream-guidance. A blanket "make the stamp match the last commit"
+        // rule cannot tell those apart, so it silently rewrote the pinned date — putting two gates
+        // into direct contradiction, one demanding the pinned value and one demanding the commit
+        // date, with no way to satisfy both. The document itself is the only thing that knows
+        // which kind of date it carries, so it now says so, and --fix must never overwrite it.
+        if (doc.updatedPinned) {
+          add(WARN, 'stamp-pinned',
+            `updated: ${doc.updated} is PINNED (updated_pinned: true) and deliberately does not track the last commit ${docCommit.date} — it records an event, not the edit`);
+        } else add(BLOCK, 'stamp-lags-doc',
           `updated: ${doc.updated} but the document's own last commit is ${docCommit.date} (${docCommit.sha.slice(0, 8)}) — edited without touching its own stamp`);
       } else if (deltaDays <= -1) {
         // Typed ahead. WARN only: a stamp dated today on a change not yet committed is CORRECT, and
@@ -610,7 +623,7 @@ export function planFix(root, doc) {
     if (doc.dirty) blocked.push({ code: 'missing-updated', why: 'working tree is modified — the last commit date is not the date of the current contents' });
     else if (doc.docCommit) changes.push({ key: 'updated', value: doc.docCommit.date, source: 'derived-from-git', evidence: `git log -1 ${doc.file} → ${doc.docCommit.sha.slice(0, 8)}` });
     else blocked.push({ code: 'missing-updated', why: 'git reports no commit touching this path' });
-  } else if (doc.findings.some((f) => f.code === 'stamp-lags-doc') && doc.docCommit && !doc.dirty) {
+  } else if (!doc.updatedPinned && doc.findings.some((f) => f.code === 'stamp-lags-doc') && doc.docCommit && !doc.dirty) {
     changes.push({ key: 'updated', value: doc.docCommit.date, source: 'derived-from-git', replaces: doc.updated, evidence: `git log -1 ${doc.file} → ${doc.docCommit.sha.slice(0, 8)}` });
   }
   return { changes, blocked };