ruvnet-brain 4.0.8 → 4.0.12

package/scripts/onboarding-console.mjs

@@ -32,6 +32,7 @@ import { buildStackRecommendations, buildWiringRecommendations, summarizeWiring,
 import { planFor } from './remedy-registry.mjs';
 import { auditAll as capabilityAuditAll } from './capability-registry.mjs';
 import { getVersion } from './version.mjs';
+import { consoleRuntimeDigest } from './console-runtime-identity.mjs';
 // L5 (ADR-028): the audit is the one place that observes live capability state, so it is where an
 // OFFERED-then-now-`on` transition becomes an APPLIED — the numerator of the precision metric that
 // tells the owner whether advocacy is landing or nagging. Both are pure reads/appends and never throw.
@@ -67,6 +68,9 @@ import {
   saveOpenRouterCredential,
 } from '../plugin/scripts/runtime-preferences.mjs';
 import { applyNightlyChoice, nightlyStatus } from './nightly-controller.mjs';
+// One canonical answer to "which directory is this, and have I counted it already?" — shared with
+// the PreCompact snapshot producer (#85) and with memory-doctor's root scan (#107).
+import { canonicalPath, pathIdentity, projectDirectory } from '../plugin/scripts/project-identity.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.dirname(__dirname);
@@ -103,14 +107,19 @@ const RUNTIME_PRODUCT = 'ruvnet-brain-console';
 const RUNTIME_SCHEMA = 1;
 const RUNTIME_API_CONTRACT = 1;
 const RUNTIME_SCRIPT = fs.realpathSync(fileURLToPath(import.meta.url));
-const RUNTIME_SOURCE_SHA256 = crypto.createHash('sha256').update(fs.readFileSync(RUNTIME_SCRIPT)).digest('hex');
+// The generation this process IS, derived from every byte it executes and serves — not from this one
+// file. #79: a Console whose entrypoint was unchanged but whose imported modules and frontend had been
+// replaced reported the same identity as the candidate that replaced it, so the launcher reused a
+// pre-update router behind a post-update page. Same function, same surface, same list as the installer
+// stages (scripts/console-runtime-identity.mjs), so the two halves of this fact cannot drift.
+const RUNTIME_SOURCE_SHA256 = consoleRuntimeDigest(REPO);
 
 function consoleCandidateRoots() {
   return candidateRoots({ home: CONSOLE_ROOT, configPath: CONFIG_PATH });
 }
 
 function canonicalScope(cwd = process.cwd()) {
-  try { return fs.realpathSync(cwd); } catch { return path.resolve(cwd); }
+  return canonicalPath(cwd) ?? path.resolve(cwd);
 }
 
 function runtimeReceiptPath(cwd = process.cwd()) {
@@ -381,7 +390,7 @@ function wiringSurvey() {
   const projects = [];
   for (const root of consoleCandidateRoots()) {
     for (const proj of findProjects(root)) {
-      const resolved = path.resolve(proj);
+      const resolved = pathIdentity(proj) ?? path.resolve(proj);
       if (seenProjects.has(resolved)) continue;
       seenProjects.add(resolved);
       projects.push({ proj, root });
@@ -494,8 +503,12 @@ function scanFleet() {
   return fleet;
 }
 function gatherMemory(cwd, { fleet = true } = {}) {
-  // health = for the project the console was launched from (fall back to this repo)
-  const project = fs.existsSync(path.join(cwd, '.swarm/memory.db')) ? cwd : REPO;
+  // health = for the project the console was launched from (fall back to this repo). The scope is
+  // resolved through projectDirectory() — the same call the PreCompact producer makes — so a console
+  // launched from a subdirectory probes the project root the hook actually wrote to, instead of
+  // warning that a snapshot it can see on disk does not exist (#85).
+  const scope = projectDirectory({ cwd });
+  const project = fs.existsSync(path.join(scope, '.swarm/memory.db')) ? scope : REPO;
   const projName = project.replace(CONSOLE_ROOT + '/Code/', '').replace(CONSOLE_ROOT + '/', '~/');
   const health = scoreMemoryHealth({ project: projName, probes: probeMemory(project) });
   return { fleet: fleet ? scanFleet() : null, health };
@@ -1588,8 +1601,11 @@ function refreshFleetCache() {
   // machine whose projects live under ~/source instead of ~/Code.
   for (const root of consoleCandidateRoots()) {
     for (const s of findMemoryStores(root)) {
-      const resolved = path.resolve(s.project);
-      if (seen.has(resolved)) continue; // a project visible under two roots (e.g. a symlink) counts once
+      // pathIdentity, not path.resolve: resolve() normalises `.`/`..` and nothing else, so a project
+      // reached through a symlink OR through the other capitalisation of a case-insensitive volume
+      // was two distinct strings for one directory, and its memories were summed twice (#107).
+      const resolved = pathIdentity(s.project) ?? path.resolve(s.project);
+      if (seen.has(resolved)) continue; // a project visible under two roots counts once
       seen.add(resolved);
       const n = Number(robustRead(s.db, "SELECT COUNT(*) FROM memory_entries WHERE status='active'").value || 0);
       if (n > 0) {
@@ -1726,7 +1742,12 @@ function gatherRouterEngine() {
   const subscriptions = detectSubscriptions();
   let house;
   let providerKeys = providerAvailability(null, subscriptions);
-  let providerCatalog = { status: 'degraded', detail: 'provider catalog was not loaded; native boolean detections are shown' };
+  // `keysVerified` is the machine-readable half of `status`, and it is the field every consumer must
+  // consult BEFORE presenting `keys` as a fact about the user's machine (issue #86). `status` alone
+  // was published and then ignored: the Console rendered a confident "✗ no API key found" per
+  // provider straight off `keys`, so a missing catalog asset — an internal packaging failure — was
+  // shown to the user as a verified finding about their credentials. Unknown outranks off.
+  let providerCatalog = { status: 'degraded', keysVerified: false, detail: 'provider catalog was not loaded; native boolean detections are shown' };
   try {
     const hcat = loadCatalog();
     house = detectProvider(hcat, { provider: cfg.provider });
@@ -1736,10 +1757,10 @@ function gatherRouterEngine() {
     // run-context markers (which are not credentials), exactly as detectProvider() itself filters them —
     // so the UI's "key found / not found" is now true instead of decorative.
     providerKeys = providerAvailability(hcat, subscriptions);
-    providerCatalog = { status: 'ok', detail: 'verified provider catalog loaded' };
+    providerCatalog = { status: 'ok', keysVerified: true, detail: 'verified provider catalog loaded' };
   } catch (error) {
     house = { provider: cfg.provider && cfg.provider !== 'auto' ? cfg.provider : 'anthropic', source: 'default' };
-    providerCatalog = { status: 'degraded', detail: `provider catalog unavailable: ${String(error?.message || error)}` };
+    providerCatalog = { status: 'degraded', keysVerified: false, detail: `provider catalog unavailable: ${String(error?.message || error)}` };
   }
   return {
     engine: {
@@ -2211,7 +2232,7 @@ function currentValidIds(onlyId = null) {
   // offering nothing to do about it — detection without a remedy, which ADR-027 prohibits.
   if (validateAll || healthOnly) {
     try {
-      const project = process.cwd();
+      const project = projectDirectory();
       const health = scoreMemoryHealth({ project: path.basename(project), probes: probeMemory(project) });
       for (const r of buildHealthRecommendations({ memory: health, learning: observeLearning() })) ids.add(r.id);
     } catch { /* an advisory surface must never break the apply path */ }
@@ -2923,7 +2944,8 @@ if (process.argv[1] && path.resolve(process.argv[1]).endsWith('onboarding-consol
       const fleet = scanFleet();
       let recommendations = [];
       try {
-        const health = scoreMemoryHealth({ project: path.basename(process.cwd()), probes: probeMemory(process.cwd()) });
+        const project = projectDirectory();
+        const health = scoreMemoryHealth({ project: path.basename(project), probes: probeMemory(project) });
         recommendations = buildHealthRecommendations({ memory: health, learning: { ...observeLearning(), fleet } });
       } catch { /* advisory only */ }
       writeCache(MEMORY_CACHE, new Date().toISOString(), { fleet, recommendations }, process.cwd());

package/scripts/publication-receipt.mjs

@@ -8,6 +8,13 @@ import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
 import { spawn, spawnSync } from 'node:child_process';
+// ONE doctor rule and ONE mode vocabulary, shared with the staged-side check in
+// scripts/staged-host-verifier.mjs. This file kept its own copies, spelled claudeOnly/
+// codexOnly/dual against the other's claude/codex/dual, so `hosts.claudeOnly` and
+// `fixtures.claude` described the same fixture and nothing could tell. The richer
+// post-publication proofs below (payload assertions, MCP wiring, SOURCE.json, rpcSearch)
+// stay here — they are this side's job, not duplication.
+import { HOST_MODES, RECEIPT_MODE_NAMES, MODE_FROM_RECEIPT_NAME, classifyDoctor } from './host-install-matrix.mjs';
 import { pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt, evaluatePublicationReceipt } from './release-proof.mjs';
 import { verifyPayload } from './release-payload.mjs';
@@ -210,7 +217,9 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
       const sealedPlugin = path.join(packageRoot, 'plugin');
       const results = {};
       let bundle = null;
-      for (const mode of ['claudeOnly', 'codexOnly', 'dual']) {
+      // Derived from HOST_MODES, so a fourth host shape is added in ONE place and this loop
+      // cannot fall behind the staged-side check the way it did.
+      for (const mode of HOST_MODES.map((m) => RECEIPT_MODE_NAMES[m])) {
         const home = path.join(temp, `home-${mode}`);
         const codexHome = path.join(home, '.codex');
         const brainHome = path.join(home, '.cache', 'ruvnet-brain');

package/scripts/release-transaction-provider.mjs

@@ -341,10 +341,35 @@ export function liveReleaseProvider({
       if (current !== expected) throw new Error(`refusing compensation: npm latest is ${current}, expected ${expected}`);
       command('npm', ['dist-tag', 'add', `${PACKAGE}@${prior}`, 'latest']);
     },
-    async finalize(identity, receipt, _hostVerifier) {
+    async finalize(identity, receipt, hostVerifier) {
       if (!candidateReceipt || !publicationReceipt) {
         throw new Error('final convergence requires candidate and publication receipt paths');
       }
+      // THE HOST VERDICT IS MEASURED, NOT DECLARED — and it is measured FIRST.
+      //
+      // finalize() used to accept the verifier as `_hostVerifier` and ignore it, then build
+      // `hosts = { verdict: 'PASS', … }` as a literal. Every release therefore asserted host
+      // convergence with no host verified, while tests/helpers/release-transaction-fixture.mjs:153
+      // called the seam faithfully — a fault-injection suite certifying wiring the real publisher
+      // never ran. Fable 5 and GPT-5.6-Sol independently made this their #1 finding.
+      //
+      // It runs BEFORE publication and sealing because the order encodes the meaning: you seal a
+      // release you have verified, not the reverse. It is also the cheapest way to fail — an
+      // unusable artifact stops here instead of after a 20-minute publish.
+      if (!hostVerifier || typeof hostVerifier.verify !== 'function') {
+        return { verdict: 'FAIL', hostVerifierError: 'no host verifier was supplied to finalize' };
+      }
+      // No `assets` override: stagedHostVerifier is constructed in release.mjs:238 with the exact
+      // staged bytes for this candidate and defaults to them (staged-host-verifier.mjs:57), so
+      // passing nothing is what keeps production verifying the artifact actually being shipped.
+      const verified = await hostVerifier.verify({ source: 'final', identity });
+      if (verified.verdict !== 'PASS') {
+        return {
+          verdict: 'FAIL',
+          hosts: { verdict: verified.verdict, verifier: { error: verified.error, fixtures: verified.fixtures } },
+          previousReceiptDigest: receipt.receiptDigest,
+        };
+      }
       if (!fs.existsSync(path.resolve(root, publicationReceipt))) {
         const publication = spawnSync(process.execPath, [
           'scripts/publication-receipt.mjs', '--candidate', candidateReceipt, '--out', publicationReceipt,
@@ -360,11 +385,14 @@ export function liveReleaseProvider({
         return { verdict: 'FAIL', sealError: String(seal.stderr || seal.error?.message) };
       }
       const publication = JSON.parse(fs.readFileSync(path.resolve(root, publicationReceipt), 'utf8'));
+
+      // `verified` was measured at the top of finalize, before publication and sealing.
       const hosts = {
-        verdict: 'PASS',
+        verdict: verified.verdict,
         claudeOnly: publication.installed?.claudeOnly,
         codexOnly: publication.installed?.codexOnly,
         dual: publication.installed?.dual,
+        verifier: { artifactSha256: verified.artifactSha256, fixtures: verified.fixtures, error: verified.error },
       };
       const observed = publication.postPublicationChecks?.find(({ name }) => name === 'published-surface-probe');
       const result = {

package/scripts/rvf-generation.mjs

@@ -83,14 +83,31 @@ export function verifyRvfGenerations(dir, {
   releaseTag = getVersionTag(),
   requiredStores = [],
   allowMissingFiles = false,
+  verifyBytes = true,
 } = {}) {
   const manifest = readRvfGenerations(dir);
   const failures = [];
   if (manifest.brainVersion !== version) failures.push(`brainVersion=${manifest.brainVersion}, expected ${version}`);
   if (manifest.releaseTag !== releaseTag) failures.push(`releaseTag=${manifest.releaseTag}, expected ${releaseTag}`);
+  // `verifyBytes: false` verifies ONLY the committed ledger fields above.
+  //
+  // WHY: the `.rvf` binaries are gitignored (.gitignore:28 `kb/*.rvf`), so a byte comparison is a
+  // statement about the machine running the check, not about the commit being pushed. This ledger
+  // records 72 stores; a working checkout routinely has a different set — the nightly rebuilds RVFs
+  // and regenerates the ledger together (kb/forge-refresh.mjs:242), so between those two moments any
+  // developer tree disagrees. Wired into the pre-push gate this was unsatisfiable: it blocked EVERY
+  // push, including tags, and its own remedy line ("Run: node scripts/sync-version.mjs") could not
+  // clear it because the byte check lives under `if (CHECK)` and write mode never regenerates. That
+  // is what forced the 4.0.7 emergency promotion.
+  //
+  // release.mjs:100 already states the governing principle for this repo: "A verdict is only about
+  // the exact committed candidate." Bytes are verified where they are actually present and actually
+  // shipped — scripts/build-bundle.mjs:204-214, at bundle assembly — which is exactly what the
+  // deferral comment in sync-version.mjs promised but never had a caller for.
   for (const store of requiredStores) {
     if (!manifest.stores[store]) failures.push(`${store}: no generation record`);
   }
+  if (!verifyBytes) return { manifest, failures };
   for (const [store, generation] of Object.entries(manifest.stores)) {
     const file = path.join(dir, generation.file || `${store}.big.rvf`);
     if (!fs.existsSync(file)) {

package/scripts/staged-host-verifier.mjs

@@ -3,6 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { runHostMatrix } from './host-install-matrix.mjs';
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const locate = (name) => {
@@ -18,11 +19,9 @@ const run = (name, args, options) => {
   return result;
 };
 
-export function classifyDoctorResult(result) {
-  const output = `${result.stdout || ''}\n${result.stderr || ''}`;
-  if (!result.error && result.status === 0) return { accepted: true, status: 'PASS', output };
-  return { accepted: false, status: 'FAIL', output };
-}
+// The doctor verdict has ONE rule, in host-install-matrix.mjs. This name is kept because
+// tests/unit/staged-host-verifier.test.mjs pins it, but it is now an alias, not a second copy.
+export { classifyDoctor as classifyDoctorResult } from './host-install-matrix.mjs';
 
 const preparePackage = ({ packagePath, bundlePath }) => {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-staged-host-'));
@@ -39,62 +38,36 @@ const preparePackage = ({ packagePath, bundlePath }) => {
   return { temp, packageRoot };
 };
 
-const fixturePath = (mode, temp) => {
-  const bin = path.join(temp, `bin-${mode}`);
-  fs.mkdirSync(bin);
-  const hosts = mode === 'claude' ? ['claude'] : mode === 'codex' ? ['codex'] : ['claude', 'codex'];
-  const desired = ['node', 'npm', ...hosts];
-  for (const name of desired) {
-    const target = locate(name);
-    if (!target) throw new Error(`${name} CLI unavailable for ${mode} host fixture`);
-    fs.symlinkSync(target, path.join(bin, name));
-  }
-  return `${bin}:/usr/bin:/bin`;
-};
-
 export function stagedHostVerifier({ assets, identity }) {
   return {
     async verify({ source, assets: observedAssets = assets }) {
       const prepared = preparePackage(observedAssets);
-      const results = {};
       try {
-        for (const mode of ['claude', 'codex', 'dual']) {
-          const home = path.join(prepared.temp, `home-${mode}`);
-          const brainHome = path.join(home, '.cache', 'ruvnet-brain');
-          fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
-          if (mode !== 'claude') fs.mkdirSync(path.join(home, '.codex'), { recursive: true });
-          const env = {
-            ...process.env,
-            HOME: home,
-            CODEX_HOME: path.join(home, '.codex'),
-            RUVNET_BRAIN_HOME: brainHome,
-            RUVNET_BRAIN_KB: path.join(brainHome, 'kb'),
-            RUVNET_CLAUDE_MARKETPLACE_SOURCE: prepared.packageRoot,
-            RUVNET_CODEX_HOOK_TRUST_MODE: 'bypass',
-            CI: 'true',
-            PATH: fixturePath(mode, prepared.temp),
-          };
-          const installer = path.join(prepared.packageRoot, 'bin', 'install.mjs');
-          run(process.execPath, [installer, '--local', '--yes', '--force', '--no-nightly-prompt',
-            '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline', '--no-selfcheck'], {
-            cwd: prepared.packageRoot, env, timeout: 1_200_000,
-          });
-          const doctor = spawnSync(process.execPath, [installer, '--doctor', '--hooks'], {
-            cwd: prepared.packageRoot, env, timeout: 180_000,
-          });
-          const classified = classifyDoctorResult(doctor);
-          if (!classified.accepted) {
-            throw new Error(`doctor failed for ${mode}: ${classified.output.slice(-5000) || doctor.error?.message}`);
-          }
-          results[mode] = {
-            status: classified.status,
-            doctorExit: doctor.status,
-            version: identity.version,
-          };
+        // The loop, the mode names, the env and the doctor verdict all live in
+        // scripts/host-install-matrix.mjs, shared with the published-side check in
+        // publication-receipt.mjs. This file used to carry its own copy, which had drifted to
+        // different mode names (claude/codex/dual vs claudeOnly/codexOnly/dual) and a different
+        // install shape than the one that runs after publication — so the two halves of a release
+        // were judging different things and could not be compared. Only the STAGED-vs-PUBLISHED
+        // difference is real, and it is now a named variant rather than a second implementation.
+        const matrix = runHostMatrix({
+          packageRoot: prepared.packageRoot,
+          version: identity.version,
+          variant: 'staged',
+          locate,
+          temp: prepared.temp,
+        });
+        if (matrix.verdict !== 'PASS') {
+          return { verdict: 'FAIL', source, error: matrix.error, fixtures: matrix.fixtures };
         }
-        return { verdict: 'PASS', source, artifactSha256: sha256(observedAssets.packagePath), fixtures: results };
+        return {
+          verdict: 'PASS',
+          source,
+          artifactSha256: sha256(observedAssets.packagePath),
+          fixtures: matrix.fixtures,
+        };
       } catch (error) {
-        return { verdict: 'FAIL', error: error.message, fixtures: results };
+        return { verdict: 'FAIL', source, error: error.message, fixtures: {} };
       } finally {
         fs.rmSync(prepared.temp, { recursive: true, force: true });
       }

package/scripts/sync-version.mjs

@@ -113,16 +113,16 @@ for (const rel of ['kb/RVF-GENERATIONS.json']) {
 
 if (CHECK && fs.existsSync(path.join(ROOT, 'kb/RVF-GENERATIONS.json'))) {
   const kbDir = path.join(ROOT, 'kb');
-  const requiredStores = fs.readdirSync(kbDir)
-    .filter((file) => file.endsWith('.big.rvf'))
-    .map((file) => file.slice(0, -'.big.rvf'.length));
-  // CI/source-only clones intentionally omit the gitignored RVF binaries. In that shape, validate
-  // the committed ledger's version fields but defer byte checks to bundle assembly, where the RVFs
-  // are present. A checkout containing any canonical RVF remains fail-closed for every ledger row.
-  const { failures } = verifyRvfGenerations(kbDir, {
-    requiredStores,
-    allowMissingFiles: requiredStores.length === 0,
-  });
+  // Validate the committed ledger's version fields ONLY. The previous form scanned the working
+  // directory for `*.big.rvf` and byte-compared every ledger row against whatever this machine
+  // happened to have — but those binaries are gitignored, so the verdict described the machine, not
+  // the commit. It was unsatisfiable in practice (ledger: 72 stores; a real checkout: 71, because
+  // the nightly rebuilds RVFs and regenerates the ledger as one step) and it blocked every push,
+  // tags included, while pointing at a remedy that cannot clear it. Byte verification now happens
+  // where the bytes are genuinely present and genuinely shipped: scripts/build-bundle.mjs:204-214.
+  // This is the same rule release.mjs:100 already applies — a verdict is only about the committed
+  // candidate.
+  const { failures } = verifyRvfGenerations(kbDir, { verifyBytes: false });
   for (const failure of failures) {
     console.error(`[version] RVF GENERATION DRIFT: ${failure}`);
     drift++;