ruvnet-brain 4.0.7 → 4.0.12

package/scripts/onboarding-console.mjs

@@ -32,6 +32,7 @@ import { buildStackRecommendations, buildWiringRecommendations, summarizeWiring,
 import { planFor } from './remedy-registry.mjs';
 import { auditAll as capabilityAuditAll } from './capability-registry.mjs';
 import { getVersion } from './version.mjs';
+import { consoleRuntimeDigest } from './console-runtime-identity.mjs';
 // L5 (ADR-028): the audit is the one place that observes live capability state, so it is where an
 // OFFERED-then-now-`on` transition becomes an APPLIED — the numerator of the precision metric that
 // tells the owner whether advocacy is landing or nagging. Both are pure reads/appends and never throw.
@@ -67,6 +68,9 @@ import {
   saveOpenRouterCredential,
 } from '../plugin/scripts/runtime-preferences.mjs';
 import { applyNightlyChoice, nightlyStatus } from './nightly-controller.mjs';
+// One canonical answer to "which directory is this, and have I counted it already?" — shared with
+// the PreCompact snapshot producer (#85) and with memory-doctor's root scan (#107).
+import { canonicalPath, pathIdentity, projectDirectory } from '../plugin/scripts/project-identity.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.dirname(__dirname);
@@ -103,14 +107,19 @@ const RUNTIME_PRODUCT = 'ruvnet-brain-console';
 const RUNTIME_SCHEMA = 1;
 const RUNTIME_API_CONTRACT = 1;
 const RUNTIME_SCRIPT = fs.realpathSync(fileURLToPath(import.meta.url));
-const RUNTIME_SOURCE_SHA256 = crypto.createHash('sha256').update(fs.readFileSync(RUNTIME_SCRIPT)).digest('hex');
+// The generation this process IS, derived from every byte it executes and serves — not from this one
+// file. #79: a Console whose entrypoint was unchanged but whose imported modules and frontend had been
+// replaced reported the same identity as the candidate that replaced it, so the launcher reused a
+// pre-update router behind a post-update page. Same function, same surface, same list as the installer
+// stages (scripts/console-runtime-identity.mjs), so the two halves of this fact cannot drift.
+const RUNTIME_SOURCE_SHA256 = consoleRuntimeDigest(REPO);
 
 function consoleCandidateRoots() {
   return candidateRoots({ home: CONSOLE_ROOT, configPath: CONFIG_PATH });
 }
 
 function canonicalScope(cwd = process.cwd()) {
-  try { return fs.realpathSync(cwd); } catch { return path.resolve(cwd); }
+  return canonicalPath(cwd) ?? path.resolve(cwd);
 }
 
 function runtimeReceiptPath(cwd = process.cwd()) {
@@ -381,7 +390,7 @@ function wiringSurvey() {
   const projects = [];
   for (const root of consoleCandidateRoots()) {
     for (const proj of findProjects(root)) {
-      const resolved = path.resolve(proj);
+      const resolved = pathIdentity(proj) ?? path.resolve(proj);
       if (seenProjects.has(resolved)) continue;
       seenProjects.add(resolved);
       projects.push({ proj, root });
@@ -494,8 +503,12 @@ function scanFleet() {
   return fleet;
 }
 function gatherMemory(cwd, { fleet = true } = {}) {
-  // health = for the project the console was launched from (fall back to this repo)
-  const project = fs.existsSync(path.join(cwd, '.swarm/memory.db')) ? cwd : REPO;
+  // health = for the project the console was launched from (fall back to this repo). The scope is
+  // resolved through projectDirectory() — the same call the PreCompact producer makes — so a console
+  // launched from a subdirectory probes the project root the hook actually wrote to, instead of
+  // warning that a snapshot it can see on disk does not exist (#85).
+  const scope = projectDirectory({ cwd });
+  const project = fs.existsSync(path.join(scope, '.swarm/memory.db')) ? scope : REPO;
   const projName = project.replace(CONSOLE_ROOT + '/Code/', '').replace(CONSOLE_ROOT + '/', '~/');
   const health = scoreMemoryHealth({ project: projName, probes: probeMemory(project) });
   return { fleet: fleet ? scanFleet() : null, health };
@@ -1588,8 +1601,11 @@ function refreshFleetCache() {
   // machine whose projects live under ~/source instead of ~/Code.
   for (const root of consoleCandidateRoots()) {
     for (const s of findMemoryStores(root)) {
-      const resolved = path.resolve(s.project);
-      if (seen.has(resolved)) continue; // a project visible under two roots (e.g. a symlink) counts once
+      // pathIdentity, not path.resolve: resolve() normalises `.`/`..` and nothing else, so a project
+      // reached through a symlink OR through the other capitalisation of a case-insensitive volume
+      // was two distinct strings for one directory, and its memories were summed twice (#107).
+      const resolved = pathIdentity(s.project) ?? path.resolve(s.project);
+      if (seen.has(resolved)) continue; // a project visible under two roots counts once
       seen.add(resolved);
       const n = Number(robustRead(s.db, "SELECT COUNT(*) FROM memory_entries WHERE status='active'").value || 0);
       if (n > 0) {
@@ -1726,7 +1742,12 @@ function gatherRouterEngine() {
   const subscriptions = detectSubscriptions();
   let house;
   let providerKeys = providerAvailability(null, subscriptions);
-  let providerCatalog = { status: 'degraded', detail: 'provider catalog was not loaded; native boolean detections are shown' };
+  // `keysVerified` is the machine-readable half of `status`, and it is the field every consumer must
+  // consult BEFORE presenting `keys` as a fact about the user's machine (issue #86). `status` alone
+  // was published and then ignored: the Console rendered a confident "✗ no API key found" per
+  // provider straight off `keys`, so a missing catalog asset — an internal packaging failure — was
+  // shown to the user as a verified finding about their credentials. Unknown outranks off.
+  let providerCatalog = { status: 'degraded', keysVerified: false, detail: 'provider catalog was not loaded; native boolean detections are shown' };
   try {
     const hcat = loadCatalog();
     house = detectProvider(hcat, { provider: cfg.provider });
@@ -1736,10 +1757,10 @@ function gatherRouterEngine() {
     // run-context markers (which are not credentials), exactly as detectProvider() itself filters them —
     // so the UI's "key found / not found" is now true instead of decorative.
     providerKeys = providerAvailability(hcat, subscriptions);
-    providerCatalog = { status: 'ok', detail: 'verified provider catalog loaded' };
+    providerCatalog = { status: 'ok', keysVerified: true, detail: 'verified provider catalog loaded' };
   } catch (error) {
     house = { provider: cfg.provider && cfg.provider !== 'auto' ? cfg.provider : 'anthropic', source: 'default' };
-    providerCatalog = { status: 'degraded', detail: `provider catalog unavailable: ${String(error?.message || error)}` };
+    providerCatalog = { status: 'degraded', keysVerified: false, detail: `provider catalog unavailable: ${String(error?.message || error)}` };
   }
   return {
     engine: {
@@ -2211,7 +2232,7 @@ function currentValidIds(onlyId = null) {
   // offering nothing to do about it — detection without a remedy, which ADR-027 prohibits.
   if (validateAll || healthOnly) {
     try {
-      const project = process.cwd();
+      const project = projectDirectory();
       const health = scoreMemoryHealth({ project: path.basename(project), probes: probeMemory(project) });
       for (const r of buildHealthRecommendations({ memory: health, learning: observeLearning() })) ids.add(r.id);
     } catch { /* an advisory surface must never break the apply path */ }
@@ -2923,7 +2944,8 @@ if (process.argv[1] && path.resolve(process.argv[1]).endsWith('onboarding-consol
       const fleet = scanFleet();
       let recommendations = [];
       try {
-        const health = scoreMemoryHealth({ project: path.basename(process.cwd()), probes: probeMemory(process.cwd()) });
+        const project = projectDirectory();
+        const health = scoreMemoryHealth({ project: path.basename(project), probes: probeMemory(project) });
         recommendations = buildHealthRecommendations({ memory: health, learning: { ...observeLearning(), fleet } });
       } catch { /* advisory only */ }
       writeCache(MEMORY_CACHE, new Date().toISOString(), { fleet, recommendations }, process.cwd());

package/scripts/publication-receipt.mjs

@@ -8,8 +8,16 @@ import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
 import { spawn, spawnSync } from 'node:child_process';
+// ONE doctor rule and ONE mode vocabulary, shared with the staged-side check in
+// scripts/staged-host-verifier.mjs. This file kept its own copies, spelled claudeOnly/
+// codexOnly/dual against the other's claude/codex/dual, so `hosts.claudeOnly` and
+// `fixtures.claude` described the same fixture and nothing could tell. The richer
+// post-publication proofs below (payload assertions, MCP wiring, SOURCE.json, rpcSearch)
+// stay here — they are this side's job, not duplication.
+import { HOST_MODES, RECEIPT_MODE_NAMES, MODE_FROM_RECEIPT_NAME, classifyDoctor } from './host-install-matrix.mjs';
 import { pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt, evaluatePublicationReceipt } from './release-proof.mjs';
+import { verifyPayload } from './release-payload.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
 const PACKAGE = 'ruvnet-brain';
@@ -28,6 +36,22 @@ function command(name, args, options = {}) {
   return String(result.stdout || '').trim();
 }
 
+function locate(name) {
+  try { return command('which', [name]); } catch { return null; }
+}
+
+function isolatedPath(mode, temp) {
+  const bin = path.join(temp, `bin-${mode}`);
+  fs.mkdirSync(bin);
+  const hosts = mode === 'claudeOnly' ? ['claude'] : mode === 'codexOnly' ? ['codex'] : ['claude', 'codex'];
+  for (const name of ['node', 'npm', ...hosts]) {
+    const target = locate(name);
+    if (!target) throw new Error(`${name} CLI unavailable for ${mode} public host fixture`);
+    fs.symlinkSync(target, path.join(bin, name));
+  }
+  return `${bin}:/usr/bin:/bin`;
+}
+
 async function download(url, destination, headers = {}) {
   const response = await fetch(url, {
     redirect: 'follow',
@@ -66,6 +90,23 @@ function findManifest(root, relative, version) {
   return match;
 }
 
+function findMcpServer(home) {
+  const matches = [];
+  const visit = (directory, depth = 0) => {
+    if (depth > 12 || !fs.existsSync(directory)) return;
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const child = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) visit(child, depth + 1);
+      else if (entry.isFile() && entry.name === 'server.mjs' && child.includes(`${path.sep}mcp${path.sep}`)) matches.push(child);
+    }
+  };
+  visit(home);
+  const server = matches.find((file) => file.includes('ruvnet-brain'));
+  if (!server) throw new Error('installed host registration has no ruvnet-brain MCP server');
+  return server;
+}
+
 export function assertInstalledPayload(sourceRoot, installedRoot) {
   let checked = 0;
   const visit = (source, relative = '') => {
@@ -143,6 +184,7 @@ function rpcSearch(server, env, query, timeoutMs = DEADLINE_MS) {
 
 export function livePublicationAdapter({ root = process.cwd() } = {}) {
   let installContext = null;
+  let installTemp = null;
   return {
     async downloadNpm({ version, destination }) {
       const metadata = JSON.parse(command('npm', ['view', `${PACKAGE}@${version}`, '--json']));
@@ -169,42 +211,68 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
 
     async installHosts({ artifactPath, artifactSha256, version }) {
       const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-install-'));
+      installTemp = temp;
       const packageRoot = path.join(temp, 'package');
       command('tar', ['-xzf', artifactPath, '-C', temp]);
-      const home = path.join(temp, 'home');
-      const codexHome = path.join(home, '.codex');
-      const brainHome = path.join(home, '.cache', 'ruvnet-brain');
-      const kb = path.join(brainHome, 'kb');
-      fs.mkdirSync(codexHome, { recursive: true });
-      const env = {
-        ...process.env,
-        HOME: home,
-        CODEX_HOME: codexHome,
-        RUVNET_BRAIN_HOME: brainHome,
-        RUVNET_BRAIN_KB: kb,
-        RUVNET_STRICT_INSTALL: '1',
-        RUVNET_BRAIN_PROFILE: 'complete',
-        CI: 'true',
-      };
-      command(process.execPath, [
-        path.join(packageRoot, 'bin', 'install.mjs'), '--yes', '--force', '--version', `v${version}`,
-        '--no-nightly-prompt', '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline',
-      ], { env, cwd: packageRoot, timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024 });
-
-      const claudeManifest = findManifest(path.join(home, '.claude'), path.join('.claude-plugin', 'plugin.json'), version);
-      const codexManifest = findManifest(path.join(home, '.codex'), path.join('.codex-plugin', 'plugin.json'), version);
       const sealedPlugin = path.join(packageRoot, 'plugin');
-      const claudeFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(claudeManifest)));
-      const codexFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(codexManifest)));
-      const config = fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
-      if (!/\[mcp_servers\.ruvnet-brain\]/.test(config)) throw new Error('virgin Codex home is not wired to ruvnet-brain');
-      const source = readJson(path.join(kb, 'SOURCE.json'));
-      if (source.brainVersion !== version || source.releaseTag !== `v${version}`) throw new Error('installed public Brain bundle version mismatch');
-      installContext = { temp, home, codexHome, brainHome, kb, env, packageRoot };
+      const results = {};
+      let bundle = null;
+      // Derived from HOST_MODES, so a fourth host shape is added in ONE place and this loop
+      // cannot fall behind the staged-side check the way it did.
+      for (const mode of HOST_MODES.map((m) => RECEIPT_MODE_NAMES[m])) {
+        const home = path.join(temp, `home-${mode}`);
+        const codexHome = path.join(home, '.codex');
+        const brainHome = path.join(home, '.cache', 'ruvnet-brain');
+        const kb = path.join(brainHome, 'kb');
+        fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
+        if (mode !== 'claudeOnly') fs.mkdirSync(codexHome, { recursive: true });
+        const env = {
+          ...process.env,
+          HOME: home,
+          CODEX_HOME: codexHome,
+          RUVNET_BRAIN_HOME: brainHome,
+          RUVNET_BRAIN_KB: kb,
+          RUVNET_STRICT_INSTALL: '1',
+          RUVNET_BRAIN_PROFILE: 'complete',
+          CI: 'true',
+          PATH: isolatedPath(mode, temp),
+        };
+        const installer = path.join(packageRoot, 'bin', 'install.mjs');
+        command(process.execPath, [
+          installer, '--yes', '--force', '--version', `v${version}`,
+          '--no-nightly-prompt', '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline',
+        ], { env, cwd: packageRoot, timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024 });
+        command(process.execPath, [installer, '--doctor', '--hooks'], {
+          env, cwd: packageRoot, timeout: 300_000, maxBuffer: 32 * 1024 * 1024,
+        });
+
+        const verified = {};
+        if (mode !== 'codexOnly') {
+          const manifest = findManifest(path.join(home, '.claude'), path.join('.claude-plugin', 'plugin.json'), version);
+          verified.claudeFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(manifest)));
+        }
+        if (mode !== 'claudeOnly') {
+          const manifest = findManifest(codexHome, path.join('.codex-plugin', 'plugin.json'), version);
+          verified.codexFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(manifest)));
+          const config = fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
+          if (!/\[mcp_servers\.ruvnet-brain\]/.test(config)) throw new Error(`${mode} virgin Codex home is not wired to ruvnet-brain`);
+        }
+        const source = readJson(path.join(kb, 'SOURCE.json'));
+        if (source.brainVersion !== version || source.releaseTag !== `v${version}`) {
+          throw new Error(`${mode} installed public Brain bundle version mismatch`);
+        }
+        bundle ||= { brainVersion: source.brainVersion, releaseTag: source.releaseTag };
+        const searched = await rpcSearch(findMcpServer(home), env, 'How does RuvNet Brain prove a public release artifact?', DEADLINE_MS);
+        results[mode] = {
+          status: 'PASS', doctorExit: 0, version, artifactSha256,
+          functionalSearch: true, searchMs: searched.broadMs, hostsOnPath: mode,
+          ...verified,
+        };
+        if (mode === 'dual') installContext = { temp, home, codexHome, brainHome, kb, env, packageRoot };
+      }
       return {
-        claude: { status: 'PASS', version, artifactSha256, payloadFilesVerified: claudeFiles },
-        codex: { status: 'PASS', version, artifactSha256, payloadFilesVerified: codexFiles },
-        bundle: { brainVersion: source.brainVersion, releaseTag: source.releaseTag },
+        ...results,
+        bundle,
       };
     },
 
@@ -231,6 +299,12 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
       if (result.status !== 0 || parsed.verdict !== 'PASS') throw new Error(`published-surface-probe is ${parsed.verdict || `exit ${result.status}`}`);
       return { name: 'published-surface-probe', status: 'completed', conclusion: 'success', sha };
     },
+
+    async dispose() {
+      if (installTemp) fs.rmSync(installTemp, { recursive: true, force: true });
+      installTemp = null;
+      installContext = null;
+    },
   };
 }
 
@@ -246,15 +320,35 @@ export async function generatePublicationReceipt({
   const candidateResult = evaluateCandidateReceipt(candidate);
   if (candidateResult.verdict !== 'PASS') throw new Error(`candidate seal failed: ${candidateResult.failures.map(({ code }) => code).join(',')}`);
   const digest = receiptDigest(candidate);
+  const evidenceRoot = path.dirname(path.resolve(candidatePath));
+  const payloadManifestPath = path.join(evidenceRoot, 'payload-manifest.json');
+  const payloadSignaturePath = path.join(evidenceRoot, 'payload-manifest.sig');
+  const payloadManifest = readJson(payloadManifestPath);
+  const payloadProof = verifyPayload({
+    manifest: payloadManifest,
+    signature: fs.readFileSync(payloadSignaturePath, 'utf8'),
+    publicKey: crypto.createPublicKey(fs.readFileSync(path.join(root, 'keys', 'ruvnet-brain-signing.pub.pem'), 'utf8')),
+    root: evidenceRoot,
+  });
+  if (payloadManifest.version !== candidate.version || payloadManifest.tag !== candidate.tag
+    || payloadManifest.candidateSha !== candidate.sha) throw new Error('signed payload identity differs from candidate seal');
+  const npmMember = payloadManifest.members.find(({ role }) => role === 'npm');
+  const bundleMember = payloadManifest.members.find(({ role }) => role === 'bundle');
+  if (!npmMember || !bundleMember || npmMember.sha256 !== digest) throw new Error('signed payload member set differs from candidate artifact');
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-evidence-'));
   try {
     const assetName = path.basename(candidate.artifact.path);
     const npm = await adapter.downloadNpm({ version: candidate.version, destination: path.join(temp, `npm-${assetName}`) });
     const github = await adapter.downloadGithub({ tag: candidate.tag, assetName, destination: path.join(temp, `github-${assetName}`) });
+    const githubBundle = await adapter.downloadGithub({
+      tag: candidate.tag, assetName: bundleMember.name, destination: path.join(temp, `github-${bundleMember.name}`),
+    });
     const npmDigest = sha256(npm.path);
     const githubDigest = sha256(github.path);
     if (npmDigest !== digest) throw new Error(`npm public byte mismatch: ${npmDigest} != ${digest}`);
     if (githubDigest !== digest) throw new Error(`GitHub public byte mismatch: ${githubDigest} != ${digest}`);
+    const githubBundleDigest = sha256(githubBundle.path);
+    if (githubBundleDigest !== bundleMember.sha256) throw new Error(`GitHub public bundle byte mismatch: ${githubBundleDigest} != ${bundleMember.sha256}`);
     if (npm.version !== candidate.version || (npm.sha && npm.sha !== candidate.sha)) throw new Error('npm public identity mismatch');
     if (github.tag !== candidate.tag || github.sha !== candidate.sha) throw new Error('GitHub public identity mismatch');
 
@@ -262,17 +356,23 @@ export async function generatePublicationReceipt({
     const brain = await adapter.probeBrain({ sha: candidate.sha, artifactSha256: digest, version: candidate.version });
     const surface = await adapter.probePublishedSurface({ sha: candidate.sha, artifactSha256: digest, version: candidate.version });
     const publication = {
-      schemaVersion: 1,
+      schemaVersion: 2,
       phase: 'publication',
       sha: candidate.sha,
       artifactSha256: digest,
       version: candidate.version,
+      payloadId: payloadProof.payloadId,
+      bundleArtifactSha256: githubBundleDigest,
       // npm does not guarantee gitHead metadata. Exact public-byte equality with the candidate's
       // SHA-bound sealed artifact is the identity proof; a present but conflicting gitHead is red.
       npm: { version: npm.version, sha: candidate.sha, artifactSha256: npmDigest },
       githubRelease: { tag: github.tag, sha: github.sha, artifactSha256: githubDigest },
       bundle: installed.bundle,
-      installed: { claude: installed.claude, codex: installed.codex },
+      installed: {
+        claudeOnly: installed.claudeOnly,
+        codexOnly: installed.codexOnly,
+        dual: installed.dual,
+      },
       brain,
       postPublicationChecks: [surface],
     };
@@ -282,6 +382,7 @@ export async function generatePublicationReceipt({
     fs.writeFileSync(outPath, `${JSON.stringify(publication, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
     return result;
   } finally {
+    await adapter.dispose?.();
     fs.rmSync(temp, { recursive: true, force: true });
   }
 }

package/scripts/release-evidence-aggregate.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { canonicalJson } from './release-transaction.mjs';
+
+export const REQUIRED_RELEASE_LEAVES = Object.freeze([
+  'source-quality',
+  'ux-qe',
+  'release-qe',
+  'integration-linux',
+  'stranger-linux',
+  'stranger-macos',
+  'stranger-windows',
+  'claude-only',
+  'codex-only',
+  'dual-host',
+]);
+
+export function aggregateEvidence({ sha, payloadId, leaves }) {
+  if (!/^[a-f0-9]{40}$/.test(sha || '') || !/^[a-f0-9]{64}$/.test(payloadId || '')) {
+    throw new Error('aggregate identity is malformed');
+  }
+  const byName = new Map();
+  for (const leaf of leaves || []) {
+    if (!leaf?.name || byName.has(leaf.name)) throw new Error(`duplicate or unnamed evidence leaf: ${leaf?.name || '(missing)'}`);
+    if (leaf.sha !== sha || leaf.payloadId !== payloadId) throw new Error(`evidence identity mismatch: ${leaf.name}`);
+    if (leaf.status !== 'completed' || leaf.conclusion !== 'success' || leaf.verdict !== 'PASS') {
+      throw new Error(`evidence leaf is not fail-closed PASS: ${leaf.name}`);
+    }
+    byName.set(leaf.name, leaf);
+  }
+  const missing = REQUIRED_RELEASE_LEAVES.filter((name) => !byName.has(name));
+  if (missing.length) throw new Error(`required evidence leaves missing: ${missing.join(', ')}`);
+  const normalized = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const envelope = { schemaVersion: 1, sha, payloadId, verdict: 'PASS', leaves: normalized };
+  return { ...envelope, evidenceDigest: crypto.createHash('sha256').update(canonicalJson(envelope)).digest('hex') };
+}
+
+const isCli = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isCli) {
+  const arg = (name) => {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? process.argv[index + 1] : null;
+  };
+  const out = path.resolve(arg('--out') || 'release-evidence/aggregate-envelope.json');
+  const envelope = aggregateEvidence({
+    sha: arg('--sha'),
+    payloadId: arg('--payload-id'),
+    leaves: JSON.parse(fs.readFileSync(path.resolve(arg('--leaves')), 'utf8')),
+  });
+  fs.writeFileSync(out, `${canonicalJson(envelope)}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ verdict: 'PASS', evidenceDigest: envelope.evidenceDigest, out })}\n`);
+}

package/scripts/release-payload.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { canonicalJson } from './release-transaction.mjs';
+
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const digestFile = (file) => sha256(fs.readFileSync(file));
+
+export function createPayloadManifest({ version, tag, candidateSha, producer, members }) {
+  const normalized = members.map(({ name, file, role }) => {
+    const stat = fs.statSync(file);
+    if (!stat.isFile() || stat.size === 0) throw new Error(`payload member is absent or empty: ${file}`);
+    return { name, role, size: stat.size, sha256: digestFile(file) };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  const names = new Set(normalized.map(({ name }) => name));
+  if (names.size !== normalized.length) throw new Error('payload member names must be unique');
+  return { schemaVersion: 1, version, tag, candidateSha, producer, members: normalized };
+}
+
+export const payloadIdFor = (manifest) => sha256(Buffer.from(canonicalJson(manifest)));
+
+export function signPayloadManifest(manifest, privateKey) {
+  return crypto.sign(null, Buffer.from(canonicalJson(manifest)), privateKey).toString('base64');
+}
+
+export function verifyPayloadMembers({ manifest, root }) {
+  if (!manifest || manifest.schemaVersion !== 1 || !Array.isArray(manifest.members)) {
+    throw new Error('invalid payload manifest');
+  }
+  for (const member of manifest.members) {
+    if (!member.name || path.basename(member.name) !== member.name) throw new Error(`unsafe payload member name: ${member.name}`);
+    const file = path.join(root, member.name);
+    const stat = fs.statSync(file);
+    if (stat.size !== member.size || digestFile(file) !== member.sha256) {
+      throw new Error(`payload member mismatch: ${member.name}`);
+    }
+  }
+  return { payloadId: payloadIdFor(manifest), manifest, root };
+}
+
+export function verifyPayload({ manifest, signature, publicKey, root }) {
+  if (!crypto.verify(null, Buffer.from(canonicalJson(manifest)), publicKey, Buffer.from(signature.trim(), 'base64'))) {
+    throw new Error('payload manifest signature mismatch');
+  }
+  return verifyPayloadMembers({ manifest, root });
+}
+
+const arg = (name) => {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : null;
+};
+const command = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+  ? process.argv[2]
+  : null;
+
+if (command === 'create') {
+  const out = path.resolve(arg('--out') || 'release-evidence/payload-manifest.json');
+  const memberArgs = process.argv.filter((value, index) => process.argv[index - 1] === '--member');
+  const members = memberArgs.map((entry) => {
+    const [role, file] = entry.split('=', 2);
+    if (!role || !file) throw new Error(`invalid --member ${entry}; expected role=path`);
+    return { role, file: path.resolve(file), name: path.basename(file) };
+  });
+  const manifest = createPayloadManifest({
+    version: arg('--version'),
+    tag: arg('--tag'),
+    candidateSha: arg('--sha'),
+    producer: {
+      workflow: process.env.GITHUB_WORKFLOW || 'local',
+      runId: process.env.GITHUB_RUN_ID || 'local',
+      runAttempt: process.env.GITHUB_RUN_ATTEMPT || '1',
+    },
+    members,
+  });
+  fs.writeFileSync(out, `${canonicalJson(manifest)}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ payloadId: payloadIdFor(manifest), manifest: out })}\n`);
+} else if (command === 'sign') {
+  const manifestPath = path.resolve(arg('--manifest'));
+  const out = path.resolve(arg('--out'));
+  if (fs.existsSync(out)) throw new Error(`refusing to overwrite persisted payload signature: ${out}`);
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const pem = process.env.RUVNET_SIGNING_KEY;
+  if (!pem) throw new Error('RUVNET_SIGNING_KEY is required');
+  fs.writeFileSync(out, `${signPayloadManifest(manifest, crypto.createPrivateKey(pem))}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ payloadId: payloadIdFor(manifest), signature: out })}\n`);
+} else if (command === 'verify' || command === 'verify-members') {
+  const manifestPath = path.resolve(arg('--manifest'));
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const result = command === 'verify'
+    ? verifyPayload({
+      manifest,
+      signature: fs.readFileSync(path.resolve(arg('--signature')), 'utf8'),
+      publicKey: crypto.createPublicKey(fs.readFileSync(path.resolve(arg('--public-key')), 'utf8')),
+      root: path.dirname(manifestPath),
+    })
+    : verifyPayloadMembers({ manifest, root: path.dirname(manifestPath) });
+  process.stdout.write(`${JSON.stringify({ verdict: 'PASS', payloadId: result.payloadId })}\n`);
+}