ruvnet-brain 4.0.7 → 4.0.8

package/scripts/publication-receipt.mjs

@@ -10,6 +10,7 @@ import { Readable } from 'node:stream';
 import { spawn, spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt, evaluatePublicationReceipt } from './release-proof.mjs';
+import { verifyPayload } from './release-payload.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
 const PACKAGE = 'ruvnet-brain';
@@ -28,6 +29,22 @@ function command(name, args, options = {}) {
   return String(result.stdout || '').trim();
 }
 
+function locate(name) {
+  try { return command('which', [name]); } catch { return null; }
+}
+
+function isolatedPath(mode, temp) {
+  const bin = path.join(temp, `bin-${mode}`);
+  fs.mkdirSync(bin);
+  const hosts = mode === 'claudeOnly' ? ['claude'] : mode === 'codexOnly' ? ['codex'] : ['claude', 'codex'];
+  for (const name of ['node', 'npm', ...hosts]) {
+    const target = locate(name);
+    if (!target) throw new Error(`${name} CLI unavailable for ${mode} public host fixture`);
+    fs.symlinkSync(target, path.join(bin, name));
+  }
+  return `${bin}:/usr/bin:/bin`;
+}
+
 async function download(url, destination, headers = {}) {
   const response = await fetch(url, {
     redirect: 'follow',
@@ -66,6 +83,23 @@ function findManifest(root, relative, version) {
   return match;
 }
 
+function findMcpServer(home) {
+  const matches = [];
+  const visit = (directory, depth = 0) => {
+    if (depth > 12 || !fs.existsSync(directory)) return;
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const child = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) visit(child, depth + 1);
+      else if (entry.isFile() && entry.name === 'server.mjs' && child.includes(`${path.sep}mcp${path.sep}`)) matches.push(child);
+    }
+  };
+  visit(home);
+  const server = matches.find((file) => file.includes('ruvnet-brain'));
+  if (!server) throw new Error('installed host registration has no ruvnet-brain MCP server');
+  return server;
+}
+
 export function assertInstalledPayload(sourceRoot, installedRoot) {
   let checked = 0;
   const visit = (source, relative = '') => {
@@ -143,6 +177,7 @@ function rpcSearch(server, env, query, timeoutMs = DEADLINE_MS) {
 
 export function livePublicationAdapter({ root = process.cwd() } = {}) {
   let installContext = null;
+  let installTemp = null;
   return {
     async downloadNpm({ version, destination }) {
       const metadata = JSON.parse(command('npm', ['view', `${PACKAGE}@${version}`, '--json']));
@@ -169,42 +204,66 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
 
     async installHosts({ artifactPath, artifactSha256, version }) {
       const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-install-'));
+      installTemp = temp;
       const packageRoot = path.join(temp, 'package');
       command('tar', ['-xzf', artifactPath, '-C', temp]);
-      const home = path.join(temp, 'home');
-      const codexHome = path.join(home, '.codex');
-      const brainHome = path.join(home, '.cache', 'ruvnet-brain');
-      const kb = path.join(brainHome, 'kb');
-      fs.mkdirSync(codexHome, { recursive: true });
-      const env = {
-        ...process.env,
-        HOME: home,
-        CODEX_HOME: codexHome,
-        RUVNET_BRAIN_HOME: brainHome,
-        RUVNET_BRAIN_KB: kb,
-        RUVNET_STRICT_INSTALL: '1',
-        RUVNET_BRAIN_PROFILE: 'complete',
-        CI: 'true',
-      };
-      command(process.execPath, [
-        path.join(packageRoot, 'bin', 'install.mjs'), '--yes', '--force', '--version', `v${version}`,
-        '--no-nightly-prompt', '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline',
-      ], { env, cwd: packageRoot, timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024 });
-
-      const claudeManifest = findManifest(path.join(home, '.claude'), path.join('.claude-plugin', 'plugin.json'), version);
-      const codexManifest = findManifest(path.join(home, '.codex'), path.join('.codex-plugin', 'plugin.json'), version);
       const sealedPlugin = path.join(packageRoot, 'plugin');
-      const claudeFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(claudeManifest)));
-      const codexFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(codexManifest)));
-      const config = fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
-      if (!/\[mcp_servers\.ruvnet-brain\]/.test(config)) throw new Error('virgin Codex home is not wired to ruvnet-brain');
-      const source = readJson(path.join(kb, 'SOURCE.json'));
-      if (source.brainVersion !== version || source.releaseTag !== `v${version}`) throw new Error('installed public Brain bundle version mismatch');
-      installContext = { temp, home, codexHome, brainHome, kb, env, packageRoot };
+      const results = {};
+      let bundle = null;
+      for (const mode of ['claudeOnly', 'codexOnly', 'dual']) {
+        const home = path.join(temp, `home-${mode}`);
+        const codexHome = path.join(home, '.codex');
+        const brainHome = path.join(home, '.cache', 'ruvnet-brain');
+        const kb = path.join(brainHome, 'kb');
+        fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
+        if (mode !== 'claudeOnly') fs.mkdirSync(codexHome, { recursive: true });
+        const env = {
+          ...process.env,
+          HOME: home,
+          CODEX_HOME: codexHome,
+          RUVNET_BRAIN_HOME: brainHome,
+          RUVNET_BRAIN_KB: kb,
+          RUVNET_STRICT_INSTALL: '1',
+          RUVNET_BRAIN_PROFILE: 'complete',
+          CI: 'true',
+          PATH: isolatedPath(mode, temp),
+        };
+        const installer = path.join(packageRoot, 'bin', 'install.mjs');
+        command(process.execPath, [
+          installer, '--yes', '--force', '--version', `v${version}`,
+          '--no-nightly-prompt', '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline',
+        ], { env, cwd: packageRoot, timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024 });
+        command(process.execPath, [installer, '--doctor', '--hooks'], {
+          env, cwd: packageRoot, timeout: 300_000, maxBuffer: 32 * 1024 * 1024,
+        });
+
+        const verified = {};
+        if (mode !== 'codexOnly') {
+          const manifest = findManifest(path.join(home, '.claude'), path.join('.claude-plugin', 'plugin.json'), version);
+          verified.claudeFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(manifest)));
+        }
+        if (mode !== 'claudeOnly') {
+          const manifest = findManifest(codexHome, path.join('.codex-plugin', 'plugin.json'), version);
+          verified.codexFiles = assertInstalledPayload(sealedPlugin, path.dirname(path.dirname(manifest)));
+          const config = fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
+          if (!/\[mcp_servers\.ruvnet-brain\]/.test(config)) throw new Error(`${mode} virgin Codex home is not wired to ruvnet-brain`);
+        }
+        const source = readJson(path.join(kb, 'SOURCE.json'));
+        if (source.brainVersion !== version || source.releaseTag !== `v${version}`) {
+          throw new Error(`${mode} installed public Brain bundle version mismatch`);
+        }
+        bundle ||= { brainVersion: source.brainVersion, releaseTag: source.releaseTag };
+        const searched = await rpcSearch(findMcpServer(home), env, 'How does RuvNet Brain prove a public release artifact?', DEADLINE_MS);
+        results[mode] = {
+          status: 'PASS', doctorExit: 0, version, artifactSha256,
+          functionalSearch: true, searchMs: searched.broadMs, hostsOnPath: mode,
+          ...verified,
+        };
+        if (mode === 'dual') installContext = { temp, home, codexHome, brainHome, kb, env, packageRoot };
+      }
       return {
-        claude: { status: 'PASS', version, artifactSha256, payloadFilesVerified: claudeFiles },
-        codex: { status: 'PASS', version, artifactSha256, payloadFilesVerified: codexFiles },
-        bundle: { brainVersion: source.brainVersion, releaseTag: source.releaseTag },
+        ...results,
+        bundle,
       };
     },
 
@@ -231,6 +290,12 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
       if (result.status !== 0 || parsed.verdict !== 'PASS') throw new Error(`published-surface-probe is ${parsed.verdict || `exit ${result.status}`}`);
       return { name: 'published-surface-probe', status: 'completed', conclusion: 'success', sha };
     },
+
+    async dispose() {
+      if (installTemp) fs.rmSync(installTemp, { recursive: true, force: true });
+      installTemp = null;
+      installContext = null;
+    },
   };
 }
 
@@ -246,15 +311,35 @@ export async function generatePublicationReceipt({
   const candidateResult = evaluateCandidateReceipt(candidate);
   if (candidateResult.verdict !== 'PASS') throw new Error(`candidate seal failed: ${candidateResult.failures.map(({ code }) => code).join(',')}`);
   const digest = receiptDigest(candidate);
+  const evidenceRoot = path.dirname(path.resolve(candidatePath));
+  const payloadManifestPath = path.join(evidenceRoot, 'payload-manifest.json');
+  const payloadSignaturePath = path.join(evidenceRoot, 'payload-manifest.sig');
+  const payloadManifest = readJson(payloadManifestPath);
+  const payloadProof = verifyPayload({
+    manifest: payloadManifest,
+    signature: fs.readFileSync(payloadSignaturePath, 'utf8'),
+    publicKey: crypto.createPublicKey(fs.readFileSync(path.join(root, 'keys', 'ruvnet-brain-signing.pub.pem'), 'utf8')),
+    root: evidenceRoot,
+  });
+  if (payloadManifest.version !== candidate.version || payloadManifest.tag !== candidate.tag
+    || payloadManifest.candidateSha !== candidate.sha) throw new Error('signed payload identity differs from candidate seal');
+  const npmMember = payloadManifest.members.find(({ role }) => role === 'npm');
+  const bundleMember = payloadManifest.members.find(({ role }) => role === 'bundle');
+  if (!npmMember || !bundleMember || npmMember.sha256 !== digest) throw new Error('signed payload member set differs from candidate artifact');
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-evidence-'));
   try {
     const assetName = path.basename(candidate.artifact.path);
     const npm = await adapter.downloadNpm({ version: candidate.version, destination: path.join(temp, `npm-${assetName}`) });
     const github = await adapter.downloadGithub({ tag: candidate.tag, assetName, destination: path.join(temp, `github-${assetName}`) });
+    const githubBundle = await adapter.downloadGithub({
+      tag: candidate.tag, assetName: bundleMember.name, destination: path.join(temp, `github-${bundleMember.name}`),
+    });
     const npmDigest = sha256(npm.path);
     const githubDigest = sha256(github.path);
     if (npmDigest !== digest) throw new Error(`npm public byte mismatch: ${npmDigest} != ${digest}`);
     if (githubDigest !== digest) throw new Error(`GitHub public byte mismatch: ${githubDigest} != ${digest}`);
+    const githubBundleDigest = sha256(githubBundle.path);
+    if (githubBundleDigest !== bundleMember.sha256) throw new Error(`GitHub public bundle byte mismatch: ${githubBundleDigest} != ${bundleMember.sha256}`);
     if (npm.version !== candidate.version || (npm.sha && npm.sha !== candidate.sha)) throw new Error('npm public identity mismatch');
     if (github.tag !== candidate.tag || github.sha !== candidate.sha) throw new Error('GitHub public identity mismatch');
 
@@ -262,17 +347,23 @@ export async function generatePublicationReceipt({
     const brain = await adapter.probeBrain({ sha: candidate.sha, artifactSha256: digest, version: candidate.version });
     const surface = await adapter.probePublishedSurface({ sha: candidate.sha, artifactSha256: digest, version: candidate.version });
     const publication = {
-      schemaVersion: 1,
+      schemaVersion: 2,
       phase: 'publication',
       sha: candidate.sha,
       artifactSha256: digest,
       version: candidate.version,
+      payloadId: payloadProof.payloadId,
+      bundleArtifactSha256: githubBundleDigest,
       // npm does not guarantee gitHead metadata. Exact public-byte equality with the candidate's
       // SHA-bound sealed artifact is the identity proof; a present but conflicting gitHead is red.
       npm: { version: npm.version, sha: candidate.sha, artifactSha256: npmDigest },
       githubRelease: { tag: github.tag, sha: github.sha, artifactSha256: githubDigest },
       bundle: installed.bundle,
-      installed: { claude: installed.claude, codex: installed.codex },
+      installed: {
+        claudeOnly: installed.claudeOnly,
+        codexOnly: installed.codexOnly,
+        dual: installed.dual,
+      },
       brain,
       postPublicationChecks: [surface],
     };
@@ -282,6 +373,7 @@ export async function generatePublicationReceipt({
     fs.writeFileSync(outPath, `${JSON.stringify(publication, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
     return result;
   } finally {
+    await adapter.dispose?.();
     fs.rmSync(temp, { recursive: true, force: true });
   }
 }

package/scripts/release-evidence-aggregate.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { canonicalJson } from './release-transaction.mjs';
+
+export const REQUIRED_RELEASE_LEAVES = Object.freeze([
+  'source-quality',
+  'ux-qe',
+  'release-qe',
+  'integration-linux',
+  'stranger-linux',
+  'stranger-macos',
+  'stranger-windows',
+  'claude-only',
+  'codex-only',
+  'dual-host',
+]);
+
+export function aggregateEvidence({ sha, payloadId, leaves }) {
+  if (!/^[a-f0-9]{40}$/.test(sha || '') || !/^[a-f0-9]{64}$/.test(payloadId || '')) {
+    throw new Error('aggregate identity is malformed');
+  }
+  const byName = new Map();
+  for (const leaf of leaves || []) {
+    if (!leaf?.name || byName.has(leaf.name)) throw new Error(`duplicate or unnamed evidence leaf: ${leaf?.name || '(missing)'}`);
+    if (leaf.sha !== sha || leaf.payloadId !== payloadId) throw new Error(`evidence identity mismatch: ${leaf.name}`);
+    if (leaf.status !== 'completed' || leaf.conclusion !== 'success' || leaf.verdict !== 'PASS') {
+      throw new Error(`evidence leaf is not fail-closed PASS: ${leaf.name}`);
+    }
+    byName.set(leaf.name, leaf);
+  }
+  const missing = REQUIRED_RELEASE_LEAVES.filter((name) => !byName.has(name));
+  if (missing.length) throw new Error(`required evidence leaves missing: ${missing.join(', ')}`);
+  const normalized = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const envelope = { schemaVersion: 1, sha, payloadId, verdict: 'PASS', leaves: normalized };
+  return { ...envelope, evidenceDigest: crypto.createHash('sha256').update(canonicalJson(envelope)).digest('hex') };
+}
+
+const isCli = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isCli) {
+  const arg = (name) => {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? process.argv[index + 1] : null;
+  };
+  const out = path.resolve(arg('--out') || 'release-evidence/aggregate-envelope.json');
+  const envelope = aggregateEvidence({
+    sha: arg('--sha'),
+    payloadId: arg('--payload-id'),
+    leaves: JSON.parse(fs.readFileSync(path.resolve(arg('--leaves')), 'utf8')),
+  });
+  fs.writeFileSync(out, `${canonicalJson(envelope)}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ verdict: 'PASS', evidenceDigest: envelope.evidenceDigest, out })}\n`);
+}

package/scripts/release-payload.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { canonicalJson } from './release-transaction.mjs';
+
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const digestFile = (file) => sha256(fs.readFileSync(file));
+
+export function createPayloadManifest({ version, tag, candidateSha, producer, members }) {
+  const normalized = members.map(({ name, file, role }) => {
+    const stat = fs.statSync(file);
+    if (!stat.isFile() || stat.size === 0) throw new Error(`payload member is absent or empty: ${file}`);
+    return { name, role, size: stat.size, sha256: digestFile(file) };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  const names = new Set(normalized.map(({ name }) => name));
+  if (names.size !== normalized.length) throw new Error('payload member names must be unique');
+  return { schemaVersion: 1, version, tag, candidateSha, producer, members: normalized };
+}
+
+export const payloadIdFor = (manifest) => sha256(Buffer.from(canonicalJson(manifest)));
+
+export function signPayloadManifest(manifest, privateKey) {
+  return crypto.sign(null, Buffer.from(canonicalJson(manifest)), privateKey).toString('base64');
+}
+
+export function verifyPayloadMembers({ manifest, root }) {
+  if (!manifest || manifest.schemaVersion !== 1 || !Array.isArray(manifest.members)) {
+    throw new Error('invalid payload manifest');
+  }
+  for (const member of manifest.members) {
+    if (!member.name || path.basename(member.name) !== member.name) throw new Error(`unsafe payload member name: ${member.name}`);
+    const file = path.join(root, member.name);
+    const stat = fs.statSync(file);
+    if (stat.size !== member.size || digestFile(file) !== member.sha256) {
+      throw new Error(`payload member mismatch: ${member.name}`);
+    }
+  }
+  return { payloadId: payloadIdFor(manifest), manifest, root };
+}
+
+export function verifyPayload({ manifest, signature, publicKey, root }) {
+  if (!crypto.verify(null, Buffer.from(canonicalJson(manifest)), publicKey, Buffer.from(signature.trim(), 'base64'))) {
+    throw new Error('payload manifest signature mismatch');
+  }
+  return verifyPayloadMembers({ manifest, root });
+}
+
+const arg = (name) => {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : null;
+};
+const command = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+  ? process.argv[2]
+  : null;
+
+if (command === 'create') {
+  const out = path.resolve(arg('--out') || 'release-evidence/payload-manifest.json');
+  const memberArgs = process.argv.filter((value, index) => process.argv[index - 1] === '--member');
+  const members = memberArgs.map((entry) => {
+    const [role, file] = entry.split('=', 2);
+    if (!role || !file) throw new Error(`invalid --member ${entry}; expected role=path`);
+    return { role, file: path.resolve(file), name: path.basename(file) };
+  });
+  const manifest = createPayloadManifest({
+    version: arg('--version'),
+    tag: arg('--tag'),
+    candidateSha: arg('--sha'),
+    producer: {
+      workflow: process.env.GITHUB_WORKFLOW || 'local',
+      runId: process.env.GITHUB_RUN_ID || 'local',
+      runAttempt: process.env.GITHUB_RUN_ATTEMPT || '1',
+    },
+    members,
+  });
+  fs.writeFileSync(out, `${canonicalJson(manifest)}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ payloadId: payloadIdFor(manifest), manifest: out })}\n`);
+} else if (command === 'sign') {
+  const manifestPath = path.resolve(arg('--manifest'));
+  const out = path.resolve(arg('--out'));
+  if (fs.existsSync(out)) throw new Error(`refusing to overwrite persisted payload signature: ${out}`);
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const pem = process.env.RUVNET_SIGNING_KEY;
+  if (!pem) throw new Error('RUVNET_SIGNING_KEY is required');
+  fs.writeFileSync(out, `${signPayloadManifest(manifest, crypto.createPrivateKey(pem))}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ payloadId: payloadIdFor(manifest), signature: out })}\n`);
+} else if (command === 'verify' || command === 'verify-members') {
+  const manifestPath = path.resolve(arg('--manifest'));
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const result = command === 'verify'
+    ? verifyPayload({
+      manifest,
+      signature: fs.readFileSync(path.resolve(arg('--signature')), 'utf8'),
+      publicKey: crypto.createPublicKey(fs.readFileSync(path.resolve(arg('--public-key')), 'utf8')),
+      root: path.dirname(manifestPath),
+    })
+    : verifyPayloadMembers({ manifest, root: path.dirname(manifestPath) });
+  process.stdout.write(`${JSON.stringify({ verdict: 'PASS', payloadId: result.payloadId })}\n`);
+}