ruvnet-brain 4.0.8 → 4.0.24

package/scripts/release-transaction-provider.mjs

@@ -25,17 +25,54 @@ const tagSha = (tag, root) => {
   return rows.find(([, ref]) => ref?.endsWith('^{}'))?.[0] || rows[0]?.[0] || '';
 };
 
-const assetBytes = (asset) => {
+// THE RELEASE BUNDLE OUTGREW spawnSync's BUFFER, AND THAT IS WHAT BROKE EVERY PUBLISH (#77).
+//
+// This buffered the whole asset in memory via `spawnSync(..., encoding: 'buffer')`. The knowledge
+// bundle is ~529MB, far past spawnSync's maxBuffer, so the download died with
+//     cannot download transaction asset ruvnet-brain.zip: spawnSync gh ENOBUFS
+// and the caller reported it as `staged GitHub payload mismatch` — sending three days of
+// investigation after a corruption that never existed. Every asset actually matched the sealed
+// identity byte-for-byte, GitHub's own digest agreed, and the publish still failed.
+//
+// This was never a digest problem and it was never version drift. It is a size ceiling that the
+// corpus crossed, so it would have broken EVERY release from that moment on regardless of content,
+// and it is why hand-publishing became the only way to ship.
+//
+// Assets now stream to a temp file and are hashed incrementally, so peak memory is one 1MB chunk
+// instead of the whole bundle and there is no ceiling to outgrow. Small assets (receipts) still
+// come back as bytes, because callers parse them as JSON.
+const assetToFile = (asset, destination) => {
   const result = spawnSync('gh', ['api', asset.url, '-H', 'Accept: application/octet-stream'], {
-    encoding: 'buffer', stdio: ['ignore', 'pipe', 'pipe'], timeout: ASSET_DOWNLOAD_TIMEOUT_MS,
+    stdio: ['ignore', fs.openSync(destination, 'w'), 'pipe'], timeout: ASSET_DOWNLOAD_TIMEOUT_MS,
   });
   if (result.error || result.signal || result.status !== 0) {
     throw new Error(`cannot download transaction asset ${asset.name}: ${result.error?.message || result.signal || `exit ${result.status}`}`);
   }
-  return Buffer.from(result.stdout);
+  return destination;
 };
+const withTempAsset = (asset, fn) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-asset-'));
+  const file = path.join(dir, path.basename(asset.name) || 'asset.bin');
+  try { return fn(assetToFile(asset, file)); } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+};
+const assetBytes = (asset) => withTempAsset(asset, (file) => fs.readFileSync(file));
 const assetReceipt = (asset) => JSON.parse(assetBytes(asset).toString('utf8'));
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+// Streamed digest — never materialises the asset in memory, so a bundle of any size can be verified.
+const sha256File = (file) => {
+  const hash = crypto.createHash('sha256');
+  const fd = fs.openSync(file, 'r');
+  try {
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    for (;;) {
+      const read = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (read <= 0) break;
+      hash.update(buffer.subarray(0, read));
+    }
+  } finally { fs.closeSync(fd); }
+  return hash.digest('hex');
+};
+const assetDigest = (asset) => withTempAsset(asset, sha256File);
 const OBSERVATION_POLICY = {
   maxElapsedMs: Number(process.env.RUVNET_NPM_VISIBILITY_TIMEOUT_MS || 180_000),
   maxAttempts: Number(process.env.RUVNET_NPM_VISIBILITY_ATTEMPTS || 14),
@@ -86,7 +123,7 @@ export function liveReleaseProvider({
   const digestAsset = (asset, force = false) => {
     const key = `${asset.id}:${asset.size}`;
     if (!force && assetDigestCache.has(key)) return assetDigestCache.get(key);
-    const digest = sha256(assetBytes(asset));
+    const digest = assetDigest(asset);   // streamed — the 529MB bundle must never be buffered
     assetDigestCache.set(key, digest);
     return digest;
   };
@@ -111,10 +148,13 @@ export function liveReleaseProvider({
         const remote = release.assets?.find((asset) => asset.name === name);
         if (!remote) throw new Error(`staged GitHub asset missing: ${name}`);
         const file = path.join(temp, name);
-        fs.writeFileSync(file, assetBytes(remote), { flag: 'wx', mode: 0o600 });
+        // Streamed straight to disk. Buffering here would reintroduce the ENOBUFS ceiling the
+        // 529MB bundle already crossed once — the defect that broke every publish (#77).
+        assetToFile(remote, file);
+        fs.chmodSync(file, 0o600);
         assets[key] = file;
       }
-      if (sha256(fs.readFileSync(assets.bundlePath)) !== identity.bundleSha256) {
+      if (sha256File(assets.bundlePath) !== identity.bundleSha256) {
         throw new Error('staged GitHub bundle digest does not match transaction identity');
       }
       if (identity.bundleSignatureSha256
@@ -341,10 +381,35 @@ export function liveReleaseProvider({
       if (current !== expected) throw new Error(`refusing compensation: npm latest is ${current}, expected ${expected}`);
       command('npm', ['dist-tag', 'add', `${PACKAGE}@${prior}`, 'latest']);
     },
-    async finalize(identity, receipt, _hostVerifier) {
+    async finalize(identity, receipt, hostVerifier) {
       if (!candidateReceipt || !publicationReceipt) {
         throw new Error('final convergence requires candidate and publication receipt paths');
       }
+      // THE HOST VERDICT IS MEASURED, NOT DECLARED — and it is measured FIRST.
+      //
+      // finalize() used to accept the verifier as `_hostVerifier` and ignore it, then build
+      // `hosts = { verdict: 'PASS', … }` as a literal. Every release therefore asserted host
+      // convergence with no host verified, while tests/helpers/release-transaction-fixture.mjs:153
+      // called the seam faithfully — a fault-injection suite certifying wiring the real publisher
+      // never ran. Fable 5 and GPT-5.6-Sol independently made this their #1 finding.
+      //
+      // It runs BEFORE publication and sealing because the order encodes the meaning: you seal a
+      // release you have verified, not the reverse. It is also the cheapest way to fail — an
+      // unusable artifact stops here instead of after a 20-minute publish.
+      if (!hostVerifier || typeof hostVerifier.verify !== 'function') {
+        return { verdict: 'FAIL', hostVerifierError: 'no host verifier was supplied to finalize' };
+      }
+      // No `assets` override: stagedHostVerifier is constructed in release.mjs:238 with the exact
+      // staged bytes for this candidate and defaults to them (staged-host-verifier.mjs:57), so
+      // passing nothing is what keeps production verifying the artifact actually being shipped.
+      const verified = await hostVerifier.verify({ source: 'final', identity });
+      if (verified.verdict !== 'PASS') {
+        return {
+          verdict: 'FAIL',
+          hosts: { verdict: verified.verdict, verifier: { error: verified.error, fixtures: verified.fixtures } },
+          previousReceiptDigest: receipt.receiptDigest,
+        };
+      }
       if (!fs.existsSync(path.resolve(root, publicationReceipt))) {
         const publication = spawnSync(process.execPath, [
           'scripts/publication-receipt.mjs', '--candidate', candidateReceipt, '--out', publicationReceipt,
@@ -360,11 +425,14 @@ export function liveReleaseProvider({
         return { verdict: 'FAIL', sealError: String(seal.stderr || seal.error?.message) };
       }
       const publication = JSON.parse(fs.readFileSync(path.resolve(root, publicationReceipt), 'utf8'));
+
+      // `verified` was measured at the top of finalize, before publication and sealing.
       const hosts = {
-        verdict: 'PASS',
+        verdict: verified.verdict,
         claudeOnly: publication.installed?.claudeOnly,
         codexOnly: publication.installed?.codexOnly,
         dual: publication.installed?.dual,
+        verifier: { artifactSha256: verified.artifactSha256, fixtures: verified.fixtures, error: verified.error },
       };
       const observed = publication.postPublicationChecks?.find(({ name }) => name === 'published-surface-probe');
       const result = {

package/scripts/release-transaction.mjs

@@ -4,22 +4,44 @@ import crypto from 'node:crypto';
 export const RECEIPT_PREFIX = 'release-transaction-';
 export const TERMINAL_STATES = new Set(['channels-converged', 'aborted']);
 
+// `aborted` WAS UNREACHABLE, AND THAT BRICKED THE RELEASE RAIL (found 2026-08-07, issue #77).
+//
+// `aborted` has always been in TERMINAL_STATES, but no state below listed it as a target — so it
+// was a terminal state nothing could ever enter. Combined with `manual-intervention-required`
+// (which has NO outgoing transitions and is NOT terminal), an interrupted release had exactly two
+// destinations and both were permanent non-terminal dead ends.
+//
+// That is not theoretical. The v4.0.7 transaction (b2ac9b69…) stopped at `npm-stage-intent` and
+// stayed there. `runReleaseTransaction` treats every non-terminal receipt from another transaction
+// as competing, so it refused EVERY later release with
+//     `pending release b2ac9b69… blocks <new>`
+// and there was no legal move that could clear it. npm was then hand-moved to 4.0.12, which also
+// disqualified the provider's `settled` escape hatch (it requires receipt.version === npmLatest).
+// So the rail deadlocked itself, hand-publishing became the only way to ship, and hand-publishing
+// is precisely how npm and GitHub came to name different generations — the whole of #77.
+//
+// The fix is to give abandonment a legal move, which is what `aborted` was declared for. Any
+// non-terminal state may now abort. This LOOSENS nothing about a live release: `aborted` is
+// terminal, so a transaction that aborts can never resume and claim to have shipped, and the
+// competing-transaction guard still refuses two genuinely in-flight releases.
+const ABORTABLE = ['aborted'];
+
 export const ALLOWED_TRANSITIONS = Object.freeze({
-  'remote-prepared': ['asset-upload-intent', 'manual-intervention-required'],
-  'asset-upload-intent': ['npm-stage-intent', 'manual-intervention-required'],
-  'npm-stage-intent': ['npm-candidate-staged', 'manual-intervention-required'],
-  'npm-candidate-staged': ['remote-materialization-intent', 'manual-intervention-required'],
-  'remote-materialization-intent': ['prepared', 'manual-intervention-required'],
-  prepared: ['github-promote-intent', 'manual-intervention-required'],
-  'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required'],
-  'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required'],
-  'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required'],
-  'npm-promoted': ['github-latest-intent', 'compensation-intent', 'manual-intervention-required'],
-  'github-latest-intent': ['defaults-promoted', 'compensation-intent', 'manual-intervention-required'],
-  'compensation-intent': ['compensated', 'manual-intervention-required'],
-  compensated: ['github-promote-intent', 'npm-promote-intent', 'manual-intervention-required'],
-  'defaults-promoted': ['finalize-intent', 'manual-intervention-required'],
-  'finalize-intent': ['channels-converged', 'manual-intervention-required'],
+  'remote-prepared': ['asset-upload-intent', 'manual-intervention-required', ...ABORTABLE],
+  'asset-upload-intent': ['npm-stage-intent', 'manual-intervention-required', ...ABORTABLE],
+  'npm-stage-intent': ['npm-candidate-staged', 'manual-intervention-required', ...ABORTABLE],
+  'npm-candidate-staged': ['remote-materialization-intent', 'manual-intervention-required', ...ABORTABLE],
+  'remote-materialization-intent': ['prepared', 'manual-intervention-required', ...ABORTABLE],
+  prepared: ['github-promote-intent', 'manual-intervention-required', ...ABORTABLE],
+  'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required', ...ABORTABLE],
+  'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
+  'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  'npm-promoted': ['github-latest-intent', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  'github-latest-intent': ['defaults-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  'compensation-intent': ['compensated', 'manual-intervention-required', ...ABORTABLE],
+  compensated: ['github-promote-intent', 'npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
+  'defaults-promoted': ['finalize-intent', 'manual-intervention-required', ...ABORTABLE],
+  'finalize-intent': ['channels-converged', 'manual-intervention-required', ...ABORTABLE],
   'manual-intervention-required': [],
   'channels-converged': [],
   aborted: [],
@@ -300,8 +322,24 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
     if (decision.action === 'upload-assets') {
       await transition('asset-upload-intent', { payloadId: identity.payloadId || null });
       await adapter.uploadAssets(draft, assets, identity);
-      const observed = await adapter.observeSnapshot(identity, draft);
-      if (!observed.github?.assetsExact) throw new Error('staged GitHub payload mismatch');
+      // FORCE the digests, and never report a read failure as a mismatch (2026-08-07, #77).
+      //
+      // This read `observeSnapshot(identity, draft)` then `if (!observed.github?.assetsExact)`.
+      // Two distinct failures collapsed into one misleading sentence:
+      //   · the snapshot's own catch returns `{ readError }`, leaving `github` UNDEFINED — so a
+      //     transient API error or an OOM hashing the ~529MB bundle reported "payload mismatch",
+      //     which sends you hunting a corruption that never happened. Verified against the real
+      //     staged draft: all four assets (zip, .sig, .sha256, .tgz) matched the sealed identity
+      //     byte-for-byte, and GitHub's own asset digest agreed — yet this line still threw.
+      //   · digests are memoised by `${asset.id}:${asset.size}`, so a value computed BEFORE the
+      //     upload finished could satisfy a later check from cache. Immediately after uploading is
+      //     exactly when that cache must not be trusted, so this observation forces a re-read.
+      const observed = await adapter.observeSnapshot(identity, draft, { forceAssets: true });
+      if (observed.readError) {
+        throw new Error(`could not read the staged GitHub payload (this is NOT a digest mismatch): ${observed.readError}`);
+      }
+      if (!observed.github) throw new Error('staged GitHub draft not observable after upload');
+      if (!observed.github.assetsExact) throw new Error('staged GitHub payload mismatch');
       await transition('npm-stage-intent', { github: observed.github });
       continue;
     }

package/scripts/rvf-generation.mjs

@@ -83,14 +83,31 @@ export function verifyRvfGenerations(dir, {
   releaseTag = getVersionTag(),
   requiredStores = [],
   allowMissingFiles = false,
+  verifyBytes = true,
 } = {}) {
   const manifest = readRvfGenerations(dir);
   const failures = [];
   if (manifest.brainVersion !== version) failures.push(`brainVersion=${manifest.brainVersion}, expected ${version}`);
   if (manifest.releaseTag !== releaseTag) failures.push(`releaseTag=${manifest.releaseTag}, expected ${releaseTag}`);
+  // `verifyBytes: false` verifies ONLY the committed ledger fields above.
+  //
+  // WHY: the `.rvf` binaries are gitignored (.gitignore:28 `kb/*.rvf`), so a byte comparison is a
+  // statement about the machine running the check, not about the commit being pushed. This ledger
+  // records 72 stores; a working checkout routinely has a different set — the nightly rebuilds RVFs
+  // and regenerates the ledger together (kb/forge-refresh.mjs:242), so between those two moments any
+  // developer tree disagrees. Wired into the pre-push gate this was unsatisfiable: it blocked EVERY
+  // push, including tags, and its own remedy line ("Run: node scripts/sync-version.mjs") could not
+  // clear it because the byte check lives under `if (CHECK)` and write mode never regenerates. That
+  // is what forced the 4.0.7 emergency promotion.
+  //
+  // release.mjs:100 already states the governing principle for this repo: "A verdict is only about
+  // the exact committed candidate." Bytes are verified where they are actually present and actually
+  // shipped — scripts/build-bundle.mjs:204-214, at bundle assembly — which is exactly what the
+  // deferral comment in sync-version.mjs promised but never had a caller for.
   for (const store of requiredStores) {
     if (!manifest.stores[store]) failures.push(`${store}: no generation record`);
   }
+  if (!verifyBytes) return { manifest, failures };
   for (const [store, generation] of Object.entries(manifest.stores)) {
     const file = path.join(dir, generation.file || `${store}.big.rvf`);
     if (!fs.existsSync(file)) {

package/scripts/self-update.mjs

@@ -16,7 +16,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { FULL_HINTS, KEEP_DIRS } from './full-hints.mjs';
 import { withSubmoduleSymlinksDetached } from './git-clone-refresh.mjs';
@@ -228,6 +228,42 @@ if (!APPLY) {
 }
 
 const NOTIFY = (t, m, p) => { try { execFileSync('sh', [path.join(ROOT, 'scripts/notify.sh'), t, m, p || 'default']); } catch { /* alerting never breaks the pipeline */ } };
+
+// ---- child steps that can explain themselves -------------------------------------------------
+// With stdio:'inherit' a failing child's Error carries NO output: e.stdout and e.stderr are both
+// null and e.message is only "Command failed: <argv>" (verified 2026-08-06). That empty reason is
+// what propagated into the [FATAL] summary, which is in turn what nightly-wrapper.sh samples for
+// the escalation — so six identical nightly failures escalated saying nothing, while the log had
+// the answer the whole time.
+//
+// Capture, then RE-EMIT verbatim so the log is byte-identical to what stdio:'inherit' produced,
+// and keep a tail for the failure record.
+//   captureStdout=false (clone/fetch/reset/symbols): stdout stays inherited so those steps stream
+//     live and survive a kill; only stderr is buffered (small: stacks and warnings).
+//   captureStdout=true  (every step that carries a corpus-QA verdict — [refresh] and [qa]): BOTH
+//     streams, because corpus-qa prints its verdict table and every '↳ <reason>' line via
+//     console.log — i.e. on STDOUT. Capturing stderr alone would have captured nothing for the
+//     exact failure this exists to explain. Measured output is ~34 lines/step, so it costs nothing.
+const STEP_TAIL_LINES = 14;
+function runStep(label, file, args, opts = {}, { captureStdout = false } = {}) {
+  const r = spawnSync(file, args, {
+    ...opts,
+    stdio: ['inherit', captureStdout ? 'pipe' : 'inherit', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (r.stdout?.length) process.stdout.write(r.stdout);
+  if (r.stderr?.length) process.stderr.write(r.stderr);
+  if (r.error) { r.error.step = label; throw r.error; }
+  if (r.status !== 0) {
+    const tail = Buffer.concat([r.stdout || Buffer.alloc(0), r.stderr || Buffer.alloc(0)]).toString()
+      .split('\n').map((l) => l.trim()).filter(Boolean).slice(-STEP_TAIL_LINES).join(' | ');
+    const err = new Error(`${label} exited ${r.status}${tail ? ` — ${tail}` : ' — (child produced no output)'}`);
+    err.step = label;
+    err.status = r.status;
+    err.output = tail;
+    throw err;
+  }
+}
 const failures = []; // per-repo build failures collected here; ANY failure aborts before publish (see below)
 for (const p of todo) {
   const dir = clonePath(p.name);
@@ -235,15 +271,15 @@ for (const p of todo) {
     if (!fs.existsSync(path.join(dir, '.git'))) {
       console.log(`[clone] ${p.name}`);
       fs.mkdirSync(CLONE_DIR, { recursive: true });
-      execFileSync('git', ['clone', '--depth', '1', `https://github.com/${p.owner || p.org || 'ruvnet'}/${p.repo || p.name}`, dir], { stdio: 'inherit' });
+      runStep(`[clone] ${p.name}`, 'git', ['clone', '--depth', '1', `https://github.com/${p.owner || p.org || 'ruvnet'}/${p.repo || p.name}`, dir]);
     } else {
       // Some cached clones deduplicate large submodules with symlinks to another clone. Git refuses
       // even a fetch when a gitlink path is a symlink ("expected submodule path ... not to be a
       // symbolic link"). Detach only those declared submodule symlinks for fetch/reset, then restore
       // them in finally so a network/reset failure cannot strand the cache in a half-repaired state.
       withSubmoduleSymlinksDetached(dir, () => {
-        execFileSync('git', ['-C', dir, 'fetch', '--depth', '1', 'origin'], { stdio: 'inherit' });
-        execFileSync('git', ['-C', dir, 'reset', '--hard', 'origin/HEAD'], { stdio: 'inherit' });
+        runStep(`[fetch] ${p.name}`, 'git', ['-C', dir, 'fetch', '--depth', '1', 'origin']);
+        runStep(`[reset] ${p.name}`, 'git', ['-C', dir, 'reset', '--hard', 'origin/HEAD']);
       });
     }
     const env = { ...process.env, KB_MODEL_CACHE: MODEL_CACHE };
@@ -255,26 +291,43 @@ for (const p of todo) {
     if (full) buildArgs.push('--full', full);
     if (keep) buildArgs.push('--keep', keep);
     console.log(`[refresh] ${kb}`);
-    execFileSync(NODE, buildArgs, { cwd: path.join(ROOT, 'kb'), env, stdio: 'inherit' });
+    // captureStdout: forge-refresh runs corpus-qa against its CANDIDATE dir and refuses to promote
+    // on a FAIL — so this step, not the [qa] step below, is where the six 2026-08-03..08-06 nightly
+    // failures actually died, and the verdict table naming the offending chunk is on ITS stdout.
+    // Steps produce ~34 lines at most (largest measured [refresh] section in logs/nightly.log), so
+    // buffering costs nothing; the tradeoff is that the log flushes at step end rather than live.
+    runStep(`[refresh] ${kb}`, NODE, buildArgs, { cwd: path.join(ROOT, 'kb'), env }, { captureStdout: true });
     console.log(`[symbols] ${kb}`);
-    execFileSync(NODE, ['scripts/build-symbols.mjs', '--name', kb], { cwd: ROOT, env, stdio: 'inherit' });
+    runStep(`[symbols] ${kb}`, NODE, ['scripts/build-symbols.mjs', '--name', kb], { cwd: ROOT, env });
     // Corpus QA gate (scripts/corpus-qa.mjs): structural (passages>0, full-bodies>0 where
     // FULL_HINTS demands them, vectors==passages, embed.json present) + deterministic
     // self-retrieval round trip on every canonical store. Non-zero exit throws -> failures[] ->
     // the run aborts before stamp/bundle/publish. This is the machine version of the
     // 2026-07-10 hand-verification: a store that embeds wrong or reads wrong cannot ship.
     console.log(`[qa] ${kb}`);
-    execFileSync(NODE, ['scripts/corpus-qa.mjs', '--store', kb], { cwd: ROOT, env, stdio: 'inherit' });
-  } catch (e) { console.error(`[FAIL] ${p.name}: ${e.message}`); failures.push({ name: p.name, error: e.message }); }
+    // captureStdout: corpus-qa's verdict table and its '↳ <reason>' lines go to stdout.
+    runStep(`[qa] ${kb}`, NODE, ['scripts/corpus-qa.mjs', '--store', kb], { cwd: ROOT, env }, { captureStdout: true });
+  } catch (e) {
+    console.error(`[FAIL] ${p.name}: ${e.message}`);
+    failures.push({ name: p.name, step: e.step || '(unknown step)', error: e.message, reason: e.output || '' });
+  }
 }
 
 // A per-repo build failure used to be logged and swallowed before the run re-stamped and re-bundled
 // partial data. Fail loud: if ANY repo failed, abort before stamp/bundle. This rebuild process has no
 // publication authority; a later protected release may consume only a fully prepared candidate.
 if (failures.length) {
-  NOTIFY('🔴 Nightly brain rebuild ABORTED', `${failures.length} repo build(s) failed — no candidate prepared. See logs/nightly.log`, 'urgent');
+  // Carry the REASON, not just the count. The wrapper samples this block's tail for the push
+  // escalation, so whatever is not printed here is not in the alert either.
+  const first = failures[0];
+  NOTIFY('🔴 Nightly brain rebuild ABORTED',
+    `${failures.length} repo build(s) failed — no candidate prepared. First: ${first.name} ${first.step} — ${first.reason || first.error}`,
+    'urgent');
   console.error(`\n[FATAL] ${failures.length} repo build(s) failed this run — aborting before stamp/bundle. No candidate prepared:`);
-  for (const f of failures) console.error(`  - ${f.name}: ${f.error}`);
+  for (const f of failures) {
+    console.error(`  - ${f.name} ${f.step}: ${f.error}`);
+    if (f.reason) console.error(`      reason: ${f.reason}`);
+  }
   console.error('Fix the failing repo(s) and re-run.');
   process.exit(1);
 }

package/scripts/staged-host-verifier.mjs

@@ -3,6 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { runHostMatrix } from './host-install-matrix.mjs';
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const locate = (name) => {
@@ -18,11 +19,9 @@ const run = (name, args, options) => {
   return result;
 };
 
-export function classifyDoctorResult(result) {
-  const output = `${result.stdout || ''}\n${result.stderr || ''}`;
-  if (!result.error && result.status === 0) return { accepted: true, status: 'PASS', output };
-  return { accepted: false, status: 'FAIL', output };
-}
+// The doctor verdict has ONE rule, in host-install-matrix.mjs. This name is kept because
+// tests/unit/staged-host-verifier.test.mjs pins it, but it is now an alias, not a second copy.
+export { classifyDoctor as classifyDoctorResult } from './host-install-matrix.mjs';
 
 const preparePackage = ({ packagePath, bundlePath }) => {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-staged-host-'));
@@ -39,62 +38,36 @@ const preparePackage = ({ packagePath, bundlePath }) => {
   return { temp, packageRoot };
 };
 
-const fixturePath = (mode, temp) => {
-  const bin = path.join(temp, `bin-${mode}`);
-  fs.mkdirSync(bin);
-  const hosts = mode === 'claude' ? ['claude'] : mode === 'codex' ? ['codex'] : ['claude', 'codex'];
-  const desired = ['node', 'npm', ...hosts];
-  for (const name of desired) {
-    const target = locate(name);
-    if (!target) throw new Error(`${name} CLI unavailable for ${mode} host fixture`);
-    fs.symlinkSync(target, path.join(bin, name));
-  }
-  return `${bin}:/usr/bin:/bin`;
-};
-
 export function stagedHostVerifier({ assets, identity }) {
   return {
     async verify({ source, assets: observedAssets = assets }) {
       const prepared = preparePackage(observedAssets);
-      const results = {};
       try {
-        for (const mode of ['claude', 'codex', 'dual']) {
-          const home = path.join(prepared.temp, `home-${mode}`);
-          const brainHome = path.join(home, '.cache', 'ruvnet-brain');
-          fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
-          if (mode !== 'claude') fs.mkdirSync(path.join(home, '.codex'), { recursive: true });
-          const env = {
-            ...process.env,
-            HOME: home,
-            CODEX_HOME: path.join(home, '.codex'),
-            RUVNET_BRAIN_HOME: brainHome,
-            RUVNET_BRAIN_KB: path.join(brainHome, 'kb'),
-            RUVNET_CLAUDE_MARKETPLACE_SOURCE: prepared.packageRoot,
-            RUVNET_CODEX_HOOK_TRUST_MODE: 'bypass',
-            CI: 'true',
-            PATH: fixturePath(mode, prepared.temp),
-          };
-          const installer = path.join(prepared.packageRoot, 'bin', 'install.mjs');
-          run(process.execPath, [installer, '--local', '--yes', '--force', '--no-nightly-prompt',
-            '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline', '--no-selfcheck'], {
-            cwd: prepared.packageRoot, env, timeout: 1_200_000,
-          });
-          const doctor = spawnSync(process.execPath, [installer, '--doctor', '--hooks'], {
-            cwd: prepared.packageRoot, env, timeout: 180_000,
-          });
-          const classified = classifyDoctorResult(doctor);
-          if (!classified.accepted) {
-            throw new Error(`doctor failed for ${mode}: ${classified.output.slice(-5000) || doctor.error?.message}`);
-          }
-          results[mode] = {
-            status: classified.status,
-            doctorExit: doctor.status,
-            version: identity.version,
-          };
+        // The loop, the mode names, the env and the doctor verdict all live in
+        // scripts/host-install-matrix.mjs, shared with the published-side check in
+        // publication-receipt.mjs. This file used to carry its own copy, which had drifted to
+        // different mode names (claude/codex/dual vs claudeOnly/codexOnly/dual) and a different
+        // install shape than the one that runs after publication — so the two halves of a release
+        // were judging different things and could not be compared. Only the STAGED-vs-PUBLISHED
+        // difference is real, and it is now a named variant rather than a second implementation.
+        const matrix = runHostMatrix({
+          packageRoot: prepared.packageRoot,
+          version: identity.version,
+          variant: 'staged',
+          locate,
+          temp: prepared.temp,
+        });
+        if (matrix.verdict !== 'PASS') {
+          return { verdict: 'FAIL', source, error: matrix.error, fixtures: matrix.fixtures };
         }
-        return { verdict: 'PASS', source, artifactSha256: sha256(observedAssets.packagePath), fixtures: results };
+        return {
+          verdict: 'PASS',
+          source,
+          artifactSha256: sha256(observedAssets.packagePath),
+          fixtures: matrix.fixtures,
+        };
       } catch (error) {
-        return { verdict: 'FAIL', error: error.message, fixtures: results };
+        return { verdict: 'FAIL', source, error: error.message, fixtures: {} };
       } finally {
         fs.rmSync(prepared.temp, { recursive: true, force: true });
       }

package/scripts/sync-version.mjs

@@ -113,16 +113,16 @@ for (const rel of ['kb/RVF-GENERATIONS.json']) {
 
 if (CHECK && fs.existsSync(path.join(ROOT, 'kb/RVF-GENERATIONS.json'))) {
   const kbDir = path.join(ROOT, 'kb');
-  const requiredStores = fs.readdirSync(kbDir)
-    .filter((file) => file.endsWith('.big.rvf'))
-    .map((file) => file.slice(0, -'.big.rvf'.length));
-  // CI/source-only clones intentionally omit the gitignored RVF binaries. In that shape, validate
-  // the committed ledger's version fields but defer byte checks to bundle assembly, where the RVFs
-  // are present. A checkout containing any canonical RVF remains fail-closed for every ledger row.
-  const { failures } = verifyRvfGenerations(kbDir, {
-    requiredStores,
-    allowMissingFiles: requiredStores.length === 0,
-  });
+  // Validate the committed ledger's version fields ONLY. The previous form scanned the working
+  // directory for `*.big.rvf` and byte-compared every ledger row against whatever this machine
+  // happened to have — but those binaries are gitignored, so the verdict described the machine, not
+  // the commit. It was unsatisfiable in practice (ledger: 72 stores; a real checkout: 71, because
+  // the nightly rebuilds RVFs and regenerates the ledger as one step) and it blocked every push,
+  // tags included, while pointing at a remedy that cannot clear it. Byte verification now happens
+  // where the bytes are genuinely present and genuinely shipped: scripts/build-bundle.mjs:204-214.
+  // This is the same rule release.mjs:100 already applies — a verdict is only about the committed
+  // candidate.
+  const { failures } = verifyRvfGenerations(kbDir, { verifyBytes: false });
   for (const failure of failures) {
     console.error(`[version] RVF GENERATION DRIFT: ${failure}`);
     drift++;