ruvnet-brain 4.0.90-dev → 4.3.1-dev

package/scripts/release-projection.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// Build the release-bound coverage projection from an observed corpus ledger and exact bundle bytes.
+// This is intentionally a producer, not a validator: public-verification-inputs.mjs remains the
+// independent consumer that proves the emitted files agree with the archive.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { digest, generationLedgerBytes, projectPublicGenerationLedger,
+  releaseCoverageGenerationFor } from '../plugin/scripts/coverage-integrity.mjs';
+import { validatePublicInventory } from './public-inventory.mjs';
+import { readRvfGenerations } from './rvf-generation.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arg = (name, fallback = null) => { const i = process.argv.indexOf(name); return i >= 0 ? process.argv[i + 1] : fallback; };
+const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const storeName = (value) => String(value || '').toLowerCase().replace(/\.big\.rvf$|\.rvf$/i, '');
+
+export function createReleaseProjection({ corpusCoverage, assetsDir, version, sourceSnapshot,
+  corpusSeed, baselineReceiptSha256, outDir }) {
+  if (!corpusCoverage || corpusCoverage.kind !== 'ruvnet-brain-corpus-coverage') {
+    throw new Error('corpus coverage must be an observed ruvnet-brain-corpus-coverage ledger');
+  }
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version || '')) throw new Error('release version is invalid');
+  if (!/^[a-f0-9]{40}$/.test(sourceSnapshot || '')) throw new Error('release source snapshot is invalid');
+  if (!corpusSeed?.tag || !/^[a-f0-9]{64}$/.test(corpusSeed.archiveSha256 || '')
+    || !Number.isSafeInteger(corpusSeed.archiveBytes) || !/^[a-f0-9]{64}$/.test(baselineReceiptSha256 || '')) {
+    throw new Error('corpus seed identity is incomplete');
+  }
+  const assets = path.resolve(assetsDir);
+  const sourceLedger = readRvfGenerations(assets);
+  // The coverage ledger describes the full upstream universe. A release candidate contains
+  // only the immutable seed's asset set, so absent-but-eligible upstream rows are not release
+  // blockers; shipped stores must still all be CURRENT.
+  const assetStores = fs.readdirSync(assets)
+    .filter((name) => /\.rvf$/i.test(name)).map(storeName);
+  const availableStores = new Set([
+    ...Object.keys(sourceLedger.stores || {}).map(storeName),
+    ...assetStores,
+  ]);
+  const eligible = corpusCoverage.rows.filter((row) => row.disposition === 'eligible'
+    && availableStores.has(storeName(row.artifact?.store)));
+  if (!eligible.length || eligible.some((row) => row.status !== 'CURRENT')) throw new Error('eligible corpus rows are not all CURRENT');
+  const publicStores = [...new Set(eligible.map((row) => String(row.artifact.store).toLowerCase()))];
+  // Derived public stores are not corpus rows, but they are still part of the
+  // exact shipped generation ledger when the candidate asset set contains them.
+  if (sourceLedger.stores?.concepts && !publicStores.includes('concepts')) publicStores.push('concepts');
+  const ledger = projectPublicGenerationLedger({ ledger: sourceLedger, publicStores, version, sourceSnapshot });
+  const releaseBase = {
+    schemaVersion: 1, kind: 'ruvnet-brain-release-coverage', owner: corpusCoverage.owner,
+    observedAt: corpusCoverage.observedAt, generatorSourceSha: corpusCoverage.generatorSourceSha,
+    sourceObservationSha256: corpusCoverage.sourceObservationSha256, snapshotRoot: corpusCoverage.snapshotRoot,
+    releaseIdentity: { version, tag: `v${version}`, sourceSnapshot },
+    corpusSeed: { tag: corpusSeed.tag, archiveSha256: corpusSeed.archiveSha256,
+      archiveBytes: corpusSeed.archiveBytes, receiptSha256: baselineReceiptSha256 },
+    corpusCoverage: { sha256: sha256(Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`)), coverageGeneration: corpusCoverage.coverageGeneration },
+    generationLedger: { file: 'PUBLIC-RVF-GENERATIONS.json', sha256: sha256(generationLedgerBytes(ledger)),
+      bytes: generationLedgerBytes(ledger).length, storeCount: Object.keys(ledger.stores).length },
+    installedProjectionSchema: 2, policy: corpusCoverage.policy, enumerationReceipt: corpusCoverage.enumerationReceipt,
+    rows: corpusCoverage.rows, totals: corpusCoverage.totals,
+  };
+  const inventory = validatePublicInventory({ assetsDir: assets, coverage: releaseBase, ledger });
+  releaseBase.publicInventoryPartitionSha256 = inventory.partitionSha256;
+  releaseBase.releaseCoverageGeneration = releaseCoverageGenerationFor(releaseBase);
+  const out = path.resolve(outDir);
+  fs.mkdirSync(out, { recursive: true });
+  const corpusBytes = Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`);
+  const coverageBytes = Buffer.from(`${JSON.stringify(releaseBase, null, 2)}\n`);
+  fs.writeFileSync(path.join(out, 'CORPUS-COVERAGE.json'), corpusBytes);
+  fs.writeFileSync(path.join(out, 'COVERAGE.json'), coverageBytes);
+  fs.writeFileSync(path.join(out, 'PUBLIC-RVF-GENERATIONS.json'), generationLedgerBytes(ledger));
+  return releaseBase;
+}
+
+if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+  try {
+    const corpusFile = path.resolve(arg('--corpus', path.join(ROOT, 'data', 'source-coverage.json')));
+    const corpus = readJson(corpusFile);
+    const projection = createReleaseProjection({ corpusCoverage: corpus,
+      assetsDir: arg('--assets'), outDir: arg('--out', 'release-evidence'), version: arg('--version'),
+      sourceSnapshot: arg('--source-snapshot'), baselineReceiptSha256: arg('--baseline-receipt-sha256'),
+      corpusSeed: { tag: arg('--seed-tag'), archiveSha256: arg('--seed-sha256'), archiveBytes: Number(arg('--seed-bytes')) } });
+    console.log(JSON.stringify({ ok: true, releaseCoverageGeneration: projection.releaseCoverageGeneration }));
+  } catch (error) { console.error(`[release-projection] ${error.message}`); process.exitCode = 1; }
+}

package/scripts/release-transaction-provider.mjs

@@ -3,8 +3,9 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { canonicalJson } from './coverage-integrity.mjs';
 import {
-  pollObservation, RECEIPT_PREFIX, TERMINAL_STATES, transactionIdFor,
+  pollObservation, RECEIPT_PREFIX, receiptDisposition, transactionIdFor,
 } from './release-transaction.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
@@ -94,9 +95,7 @@ export function selectCurrentReleaseBytes({ remoteBytes, localBytes, generatedBy
   return Buffer.from(bytes);
 }
 
-export function liveReleaseProvider({
-  root = process.cwd(), candidateReceipt = null, publicationReceipt = null,
-} = {}) {
+export function liveReleaseProvider({ root = process.cwd() } = {}) {
   let releases = [];
   let activeDraft = null;
   const assetDigestCache = new Map();
@@ -215,7 +214,8 @@ export function liveReleaseProvider({
       const legacySettled = [];
       const pending = [];
       for (const { receipt, release } of latestByTransaction.values()) {
-        if (TERMINAL_STATES.has(receipt.state)) continue;
+        const disposition = receiptDisposition(receipt);
+        if (['verified', 'closed-unsuccessful', 'legacy-closed'].includes(disposition)) continue;
         // CONVERGENCE IS A FACT ABOUT THE CHANNELS, NOT ABOUT THE RECEIPT FORMAT (fixed 2026-08-07).
         //
         // This required `receipt.schemaVersion === 1`. Receipts are written as schemaVersion 2
@@ -230,7 +230,7 @@ export function liveReleaseProvider({
         // all three hold, the transaction reached its goal whatever schema its receipts use. The
         // check is not weakened — the schema clause was never load-bearing for that question, it
         // just silently expired when the schema moved on.
-        const settled = release.draft === false
+        const settled = receipt.schemaVersion <= 2 && release.draft === false
           && receipt.identity?.version === npmLatest && receipt.identity?.tag === githubLatest;
         if (settled) legacySettled.push(receipt.transactionId);
         else pending.push(receipt);
@@ -318,6 +318,43 @@ export function liveReleaseProvider({
       }
     },
 
+    async materializePublicVerificationAggregate({ aggregate }) {
+      const anchor = activeDraft;
+      if (!anchor) throw new Error('no release anchor for public verification aggregate');
+      const release = hydratedRelease(releaseById(anchor.id));
+      const aggregateAsset = Buffer.from(canonicalJson(aggregate));
+      const signatureAsset = Buffer.from(aggregate.signature, 'base64');
+      const expected = {
+        'public-verification-aggregate.json': aggregateAsset,
+        'public-verification-aggregate.sig': signatureAsset,
+      };
+      const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-aggregate-'));
+      try {
+        for (const [name, bytes] of Object.entries(expected)) {
+          const existing = release.assets?.find((asset) => asset.name === name);
+          if (existing) {
+            if (!assetBytes(existing).equals(bytes)) throw new Error(`public verification asset conflict: ${name}`);
+            continue;
+          }
+          const file = path.join(temp, name);
+          fs.writeFileSync(file, bytes, { flag: 'wx', mode: 0o600 });
+          command('gh', ['release', 'upload', anchor.tag, file, '--repo', REPO]);
+        }
+        const observed = hydratedRelease(releaseById(anchor.id));
+        for (const [name, bytes] of Object.entries(expected)) {
+          const asset = observed.assets?.find((item) => item.name === name);
+          if (!asset || !assetBytes(asset).equals(bytes)) throw new Error(`public verification asset readback differs: ${name}`);
+        }
+        return {
+          aggregateSha256: aggregate.aggregateSha256,
+          aggregateAssetSha256: sha256(aggregateAsset),
+          signatureAssetSha256: sha256(signatureAsset),
+        };
+      } finally {
+        fs.rmSync(temp, { recursive: true, force: true });
+      }
+    },
+
     async readReceipt(draft, sequence) {
       const name = `${RECEIPT_PREFIX}${String(sequence).padStart(4, '0')}.json`;
       const release = hydratedRelease(releaseById((draft || activeDraft).id));
@@ -395,101 +432,5 @@ export function liveReleaseProvider({
       if (current !== expected) throw new Error(`refusing compensation: npm latest is ${current}, expected ${expected}`);
       command('npm', ['dist-tag', 'add', `${PACKAGE}@${prior}`, 'latest']);
     },
-    async finalize(identity, receipt, hostVerifier) {
-      if (!candidateReceipt || !publicationReceipt) {
-        throw new Error('final convergence requires candidate and publication receipt paths');
-      }
-      // THE HOST VERDICT IS MEASURED, NOT DECLARED — and it is measured FIRST.
-      //
-      // finalize() used to accept the verifier as `_hostVerifier` and ignore it, then build
-      // `hosts = { verdict: 'PASS', … }` as a literal. Every release therefore asserted host
-      // convergence with no host verified, while tests/helpers/release-transaction-fixture.mjs:153
-      // called the seam faithfully — a fault-injection suite certifying wiring the real publisher
-      // never ran. Fable 5 and GPT-5.6-Sol independently made this their #1 finding.
-      //
-      // It runs BEFORE publication and sealing because the order encodes the meaning: you seal a
-      // release you have verified, not the reverse. It is also the cheapest way to fail — an
-      // unusable artifact stops here instead of after a 20-minute publish.
-      if (!hostVerifier || typeof hostVerifier.verify !== 'function') {
-        return { verdict: 'FAIL', hostVerifierError: 'no host verifier was supplied to finalize' };
-      }
-      // No `assets` override: stagedHostVerifier is constructed in release.mjs:238 with the exact
-      // staged bytes for this candidate and defaults to them (staged-host-verifier.mjs:57), so
-      // passing nothing is what keeps production verifying the artifact actually being shipped.
-      const verified = await hostVerifier.verify({ source: 'final', identity });
-      if (verified.verdict !== 'PASS') {
-        return {
-          verdict: 'FAIL',
-          hosts: { verdict: verified.verdict, verifier: { error: verified.error, fixtures: verified.fixtures } },
-          previousReceiptDigest: receipt.receiptDigest,
-        };
-      }
-      if (!fs.existsSync(path.resolve(root, publicationReceipt))) {
-        const publication = spawnSync(process.execPath, [
-          'scripts/publication-receipt.mjs', '--candidate', candidateReceipt, '--out', publicationReceipt,
-        ], { cwd: root, encoding: 'utf8', timeout: 1_200_000 });
-        if (publication.error || publication.status !== 0) {
-          return { verdict: 'FAIL', publicationError: String(publication.stderr || publication.error?.message) };
-        }
-      }
-      const seal = spawnSync(process.execPath, [
-        'scripts/release-proof.mjs', '--candidate', candidateReceipt, '--publication', publicationReceipt,
-      ], { cwd: root, encoding: 'utf8', timeout: 300_000 });
-      if (seal.error || seal.status !== 0) {
-        return { verdict: 'FAIL', sealError: String(seal.stderr || seal.error?.message) };
-      }
-      const publication = JSON.parse(fs.readFileSync(path.resolve(root, publicationReceipt), 'utf8'));
-
-      // `verified` was measured at the top of finalize, before publication and sealing.
-      const hosts = {
-        verdict: verified.verdict,
-        claudeOnly: publication.installed?.claudeOnly,
-        codexOnly: publication.installed?.codexOnly,
-        dual: publication.installed?.dual,
-        verifier: { artifactSha256: verified.artifactSha256, fixtures: verified.fixtures, error: verified.error },
-      };
-      const observed = publication.postPublicationChecks?.find(({ name }) => name === 'published-surface-probe');
-      const result = {
-        verdict: observed?.status === 'completed' && observed?.conclusion === 'success' ? 'PASS' : 'FAIL',
-        hosts, surface: observed, publicationReceipt, previousReceiptDigest: receipt.receiptDigest,
-      };
-      if (result.verdict === 'PASS') {
-        const currentRelease = path.join(path.dirname(path.resolve(root, publicationReceipt)), 'current-release.json');
-        const generatedCurrentRelease = Buffer.from(`${JSON.stringify({
-          schemaVersion: 1,
-          transactionId: receipt.transactionId,
-          version: identity.version,
-          tag: identity.tag,
-          candidateSha: identity.candidateSha,
-          verdict: 'PASS',
-          publicationReceiptSha256: sha256(fs.readFileSync(path.resolve(root, publicationReceipt))),
-          hosts,
-          surface: observed,
-        }, null, 2)}\n`);
-        let remote = hydratedRelease(releaseById(activeDraft.id)).assets
-          ?.find((asset) => asset.name === 'current-release.json');
-        let currentReleaseBytes;
-        try {
-          currentReleaseBytes = selectCurrentReleaseBytes({
-            remoteBytes: remote ? assetBytes(remote) : null,
-            localBytes: !remote && fs.existsSync(currentRelease) ? fs.readFileSync(currentRelease) : null,
-            generatedBytes: generatedCurrentRelease,
-            identity: { transactionId: receipt.transactionId, version: identity.version, candidateSha: identity.candidateSha },
-          });
-        } catch (error) {
-          return { ...result, verdict: 'FAIL', currentReleaseError: error.message };
-        }
-        if (!fs.existsSync(currentRelease)) fs.writeFileSync(currentRelease, currentReleaseBytes, { flag: 'wx', mode: 0o600 });
-        if (!remote) {
-          command('gh', ['release', 'upload', activeDraft.tag, currentRelease, '--repo', REPO]);
-          remote = hydratedRelease(releaseById(activeDraft.id)).assets
-            ?.find((asset) => asset.name === 'current-release.json');
-        }
-        if (!remote || sha256(assetBytes(remote)) !== sha256(currentReleaseBytes)) {
-          return { ...result, verdict: 'FAIL', currentReleaseError: 'public receipt verification failed' };
-        }
-      }
-      return result;
-    },
   };
 }

package/scripts/release-transaction.mjs

@@ -1,12 +1,30 @@
 #!/usr/bin/env node
 import crypto from 'node:crypto';
+import { canonicalJson } from './coverage-integrity.mjs';
+import { verifyPublicVerificationAggregate } from './public-verification-aggregate.mjs';
+
+export { canonicalJson };
 
 export const RECEIPT_PREFIX = 'release-transaction-';
-export const TERMINAL_STATES = new Set(['channels-converged', 'aborted']);
+export const CURRENT_RECEIPT_SCHEMA_VERSION = 3;
+export const SUCCESS_CLOSED_STATES = new Set(['install-verified']);
+export const UNSUCCESSFUL_CLOSED_STATES = new Set(['aborted', 'abandoned', 'superseded']);
+
+export function receiptDisposition(receipt) {
+  if (!receipt || !Number.isInteger(receipt.schemaVersion)) return 'invalid';
+  if (receipt.schemaVersion <= 2 && receipt.state === 'channels-converged') return 'legacy-closed';
+  if (receipt.schemaVersion >= 3 && SUCCESS_CLOSED_STATES.has(receipt.state)) return 'verified';
+  if (UNSUCCESSFUL_CLOSED_STATES.has(receipt.state)) return 'closed-unsuccessful';
+  if (receipt.schemaVersion >= 3 && receipt.state === 'channels-converged') return 'pending-public-verification';
+  return 'pending';
+}
+
+export const isClosedReceipt = (receipt) => ['verified', 'closed-unsuccessful', 'legacy-closed']
+  .includes(receiptDisposition(receipt));
 
 // `aborted` WAS UNREACHABLE, AND THAT BRICKED THE RELEASE RAIL (found 2026-08-07, issue #77).
 //
-// `aborted` has always been in TERMINAL_STATES, but no state below listed it as a target — so it
+// `aborted` was historically declared terminal, but no state below listed it as a target — so it
 // was a terminal state nothing could ever enter. Combined with `manual-intervention-required`
 // (which has NO outgoing transitions and is NOT terminal), an interrupted release had exactly two
 // destinations and both were permanent non-terminal dead ends.
@@ -33,7 +51,7 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
   'npm-candidate-staged': ['remote-materialization-intent', 'manual-intervention-required', ...ABORTABLE],
   'remote-materialization-intent': ['prepared', 'manual-intervention-required', ...ABORTABLE],
   prepared: ['github-promote-intent', 'manual-intervention-required', ...ABORTABLE],
-  'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required', ...ABORTABLE],
+  'github-promote-intent': ['github-promoted-nonlatest', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
   'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
   'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
   // `defaults-promoted` added 2026-08-07: when GitHub is ALREADY latest at the moment npm is
@@ -51,18 +69,37 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
   'defaults-promoted': ['finalize-intent', 'manual-intervention-required', ...ABORTABLE],
   'finalize-intent': ['channels-converged', 'manual-intervention-required', ...ABORTABLE],
   'manual-intervention-required': [],
-  'channels-converged': [],
+  'channels-converged': ['install-verified', 'abandoned', 'superseded'],
+  'install-verified': [],
+  abandoned: [],
+  superseded: [],
   aborted: [],
 });
 
-export const canonicalJson = (value) => {
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
-  if (value && typeof value === 'object') {
-    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
-  }
-  return JSON.stringify(value);
-};
-
+/**
+ * THE DIGEST SERIALISER MUST AGREE WITH THE ONE THAT WRITES THE FILE.
+ *
+ * It did not, and it silently corrupted the terminal receipt of EVERY successful release. Measured
+ * 2026-08-20 on v4.0.36 and v4.0.90-dev — both `channels-converged` receipts, both digest=BAD, both
+ * with the same missing key:
+ *
+ *     canonicalJson({a: undefined})  ->  {"a":undefined}      key KEPT (and not even valid JSON)
+ *     JSON.stringify({a: undefined}) ->  {}                   key DROPPED
+ *
+ * The converge observation carries optional fields — `hosts.verifier.error`, `claudeOnly`,
+ * `codexOnly`, `dual` — and on a clean run `verified.error` is `undefined`. So the digest was
+ * computed over `…"error":undefined…` while the bytes written omitted `error` entirely: a digest
+ * over a shape that can never be read back. `runReleaseTransaction` appends a receipt, reads it
+ * back and verifies it, so the publish then died with `release receipt digest mismatch` AFTER npm
+ * and GitHub had both been promoted — the release shipped and the rail reported failure.
+ *
+ * Proven by reconstruction: restoring `observation.hosts.verifier.error = undefined` on the stored
+ * receipt makes `digestReceipt` reproduce the stored digest exactly.
+ *
+ * Arrays have the same asymmetry (`JSON.stringify([undefined])` is `[null]`), so both are matched
+ * here. This does not change the digest of any receipt that never held an undefined value, which is
+ * every receipt that currently verifies.
+ */
 export const receiptPayload = (receipt) => {
   const { signature: _signature, receiptDigest: _digest, ...payload } = receipt;
   return canonicalJson(payload);
@@ -86,6 +123,8 @@ export const transactionIdFor = (identity) => crypto.createHash('sha256').update
   bundleSha256: identity.bundleSha256,
   bundleSignatureSha256: identity.bundleSignatureSha256 || null,
   bundleDigestSha256: identity.bundleDigestSha256 || null,
+  ...(identity.corpusSeedSha256 ? { corpusSeedSha256: identity.corpusSeedSha256 } : {}),
+  ...(identity.generationLedgerSha256 ? { generationLedgerSha256: identity.generationLedgerSha256 } : {}),
 })).digest('hex');
 
 export function signReceipt(receipt, privateKey) {
@@ -97,7 +136,8 @@ export function signReceipt(receipt, privateKey) {
 }
 
 export function verifyReceipt(receipt, publicKey) {
-  if (!receipt || ![1, 2].includes(receipt.schemaVersion) || !/^[a-f0-9]{64}$/.test(receipt.transactionId || '')) {
+  if (!receipt || ![1, 2, CURRENT_RECEIPT_SCHEMA_VERSION].includes(receipt.schemaVersion)
+    || !/^[a-f0-9]{64}$/.test(receipt.transactionId || '')) {
     throw new Error('invalid release transaction receipt');
   }
   const { signature, receiptDigest, ...unsigned } = receipt;
@@ -121,13 +161,20 @@ export function validateReceiptChain(receipts, identity, publicKey) {
     if ((receipt.previousReceiptDigest || null) !== (previous?.receiptDigest || null)) {
       throw new Error('release receipt chain conflict');
     }
+    if (previous && receipt.schemaVersion >= 3 && receiptDisposition(previous) === 'legacy-closed') {
+      throw new Error('legacy-closed release receipt cannot be promoted into schema 3');
+    }
+    if (previous && receipt.schemaVersion >= 3
+      && !ALLOWED_TRANSITIONS[previous.state]?.includes(receipt.state)) {
+      throw new Error(`illegal release transition ${previous.state} -> ${receipt.state}`);
+    }
     previous = receipt;
   }
   return sorted;
 }
 
 const stateReceipt = ({ identity, prior, state, observation = {}, privateKey }) => signReceipt({
-  schemaVersion: 2,
+  schemaVersion: CURRENT_RECEIPT_SCHEMA_VERSION,
   transactionId: transactionIdFor(identity),
   sequence: prior ? prior.sequence + 1 : 0,
   previousReceiptDigest: prior?.receiptDigest || null,
@@ -175,11 +222,15 @@ export function reduceReleaseState({ lastReceipt, snapshot, identity, prior }) {
   }
   if (npmB && snapshot.github?.draft === true) return { action: 'compensate-npm' };
   if (npmB && githubLatest) {
-    if (lastReceipt.state === 'channels-converged') {
+    if (lastReceipt.state === 'install-verified') {
       return githubPublished && assetsExact && candidateExact
-        && snapshot.publicReceiptExact && snapshot.publicHostsExact
         ? { action: 'complete' }
-        : { action: 'manual', reason: 'terminal public state drifted' };
+        : { action: 'manual', reason: 'verified public channels drifted' };
+    }
+    if (lastReceipt.state === 'channels-converged') {
+      return githubPublished && assetsExact && candidateExact
+        ? { action: 'await-install-verification' }
+        : { action: 'manual', reason: 'channel-converged state drifted' };
     }
     return { action: 'finalize' };
   }
@@ -229,7 +280,7 @@ export async function pollObservation(read, predicate, {
   throw new Error(`visibility deadline exceeded after ${now() - started}ms: ${detail}`);
 }
 
-export async function runReleaseTransaction({ identity, assets, adapter, privateKey, publicKey, hostVerifier }) {
+export async function runReleaseTransaction({ identity, assets, adapter, privateKey, publicKey }) {
   const expectedId = transactionIdFor(identity);
   const discovered = await adapter.discover(identity);
   const competing = discovered.pending?.filter((item) => item.transactionId !== expectedId) || [];
@@ -241,7 +292,8 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
   const draft = discovered.matchingDrafts?.[0] || await adapter.createDraft(identity);
   const append = async (state, observation = {}) => {
     const recoveryCompensation = state === 'compensation-intent' && current
-      && !TERMINAL_STATES.has(current.state) && current.state !== 'manual-intervention-required';
+      && !isClosedReceipt(current) && current.state !== 'manual-intervention-required'
+      && current.state !== 'channels-converged';
     if (current && !ALLOWED_TRANSITIONS[current.state]?.includes(state) && current.state !== state
       && !recoveryCompensation) {
       throw new Error(`illegal release transition ${current.state} -> ${state}`);
@@ -270,10 +322,10 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
     const snapshot = await adapter.observeSnapshot(identity, draft, {
       forceAssets: current.state === 'finalize-intent' || current.state === 'channels-converged',
     });
-    if (current.state === 'channels-converged') {
-      const terminal = reduceReleaseState({ lastReceipt: current, snapshot, identity, prior });
-      if (terminal.action === 'complete') return current;
-      throw new Error(`terminal release drift: ${terminal.reason || terminal.action}`);
+    if (current.state === 'channels-converged' || current.state === 'install-verified') {
+      const disposition = reduceReleaseState({ lastReceipt: current, snapshot, identity, prior });
+      if (['complete', 'await-install-verification'].includes(disposition.action)) return current;
+      throw new Error(`release state drift: ${disposition.reason || disposition.action}`);
     }
     // A process may die after the provider side effect and before its observation receipt. Rebuild
     // that missing receipt from fresh state before asking the reducer for the next command.
@@ -304,11 +356,11 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       await transition('compensated', { npm: snapshot.npm, github: snapshot.github, recovered: true });
       throw new Error('npm compensation recovered; resume the same transaction');
     }
-    if (current.state === 'finalize-intent' && snapshot.publicReceiptExact && snapshot.publicHostsExact
-      && npmCandidateExact(snapshot, identity) && npmLatestIsB(snapshot, identity)
+    if (current.state === 'finalize-intent' && npmCandidateExact(snapshot, identity) && npmLatestIsB(snapshot, identity)
       && githubIsB(snapshot, identity) && snapshot.github?.published && snapshot.github?.latest
       && snapshot.github?.assetsExact) {
-      return append('channels-converged', { verdict: 'PASS', recovered: true });
+      return append('channels-converged', { verdict: 'PUBLISHED_NOT_VERIFIED', recovered: true,
+        npm: snapshot.npm, github: snapshot.github });
     }
     const decision = reduceReleaseState({ lastReceipt: current, snapshot, identity, prior });
     const stageRecord = {
@@ -323,6 +375,7 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       ? `::notice title=Release stage ${decision.action}::${JSON.stringify(stageRecord)}`
       : JSON.stringify(stageRecord));
     if (decision.action === 'complete') return current;
+    if (decision.action === 'await-install-verification') return current;
     if (decision.action === 'manual') {
       await transition('manual-intervention-required', { reason: decision.reason, snapshot });
       throw new Error(`release requires manual intervention: ${decision.reason}`);
@@ -415,32 +468,15 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
         await transition('defaults-promoted', { npm: snapshot.npm, github: snapshot.github });
       }
       await transition('finalize-intent');
-      const final = await adapter.finalize(identity, current, hostVerifier);
-      // SAY WHICH CONVERGENCE FAILED, AND WHY (2026-08-07). This threw the bare sentence
-      // `final release convergence failed` while `finalize` had already returned exactly the reason
-      // — hostVerifierError, hosts.verifier.error, publicationError or sealError — and the throw
-      // discarded every one of them. That is the same defect that let `spawnSync ENOBUFS` masquerade
-      // as `staged GitHub payload mismatch` for three days: an error that reports its category and
-      // withholds its evidence. Publication had ALREADY succeeded on both channels here, so the
-      // operator is reading this line while npm and GitHub are correct, with nothing to act on.
-      if (final.verdict !== 'PASS') {
-        const why = final.hostVerifierError
-          || final.hosts?.verifier?.error
-          || final.publicationError
-          || final.sealError
-          || `verdict=${final.verdict ?? '(none)'}`;
-        const fixtures = final.hosts?.verifier?.fixtures;
-        const detail = fixtures ? ` | fixtures: ${JSON.stringify(fixtures).slice(0, 400)}` : '';
-        throw new Error(`final release convergence failed: ${why}${detail}`);
-      }
       const reobserved = await adapter.observeSnapshot(identity, draft, { forceAssets: true });
       if (!(npmLatestIsB(reobserved, identity) && reobserved.github?.latest && githubIsB(reobserved, identity))) {
-        throw new Error('provider defaults drifted during finalization');
+        throw new Error('provider defaults drifted before channel convergence');
       }
-      if (!reobserved.github?.assetsExact || !reobserved.publicReceiptExact || !reobserved.publicHostsExact) {
-        throw new Error('public receipt, host, or artifact evidence drifted during finalization');
+      if (!reobserved.github?.assetsExact || !npmCandidateExact(reobserved, identity)) {
+        throw new Error('provider artifacts drifted before channel convergence');
       }
-      return append('channels-converged', final);
+      return append('channels-converged', { verdict: 'PUBLISHED_NOT_VERIFIED',
+        npm: reobserved.npm, github: reobserved.github });
     }
   }
   throw new Error('release reducer exceeded its bounded transition count');
@@ -450,7 +486,9 @@ export async function abortReleaseTransaction({ identity, receipts, reason, auth
   if (!authorized) throw new Error('release abort requires explicit human authorization');
   const chain = validateReceiptChain(receipts, identity, publicKey);
   const current = chain.at(-1);
-  if (!current || TERMINAL_STATES.has(current.state)) throw new Error('release transaction is not abortable');
+  if (!current || isClosedReceipt(current) || !ALLOWED_TRANSITIONS[current.state]?.includes('aborted')) {
+    throw new Error('release transaction is not abortable');
+  }
   const snapshot = await adapter.observeSnapshot(identity);
   const prior = chain[0]?.observation?.prior;
   if (!prior || snapshot.npm?.latestVersion === identity.version || snapshot.github?.latest === true
@@ -464,3 +502,81 @@ export async function abortReleaseTransaction({ identity, receipts, reason, auth
   await adapter.appendReceipt(null, receipt, `${RECEIPT_PREFIX}${String(receipt.sequence).padStart(4, '0')}.json`);
   return receipt;
 }
+
+export async function finalizeReleaseTransaction({
+  identity,
+  aggregate,
+  adapter,
+  privateKey,
+  publicKey,
+  aggregatePublicKey,
+} = {}) {
+  if (!adapter || typeof adapter.discover !== 'function' || typeof adapter.observeSnapshot !== 'function'
+    || typeof adapter.materializePublicVerificationAggregate !== 'function'
+    || typeof adapter.appendReceipt !== 'function' || typeof adapter.readReceipt !== 'function') {
+    throw new Error('public verification finalizer adapter is incomplete');
+  }
+  const expectedAggregateIdentity = {
+    ...aggregate?.identity,
+    sourceSha: identity?.candidateSha,
+    version: identity?.version,
+    tag: identity?.tag,
+    artifactSha256: identity?.packageSha256,
+    bundleSha256: identity?.bundleSha256,
+    payloadId: identity?.payloadId,
+    releaseTransactionId: transactionIdFor(identity),
+  };
+  verifyPublicVerificationAggregate(aggregate, aggregatePublicKey, expectedAggregateIdentity);
+  const discovered = await adapter.discover(identity);
+  const chain = validateReceiptChain(discovered.receipts || [], identity, publicKey);
+  const current = chain.at(-1);
+  if (!current) throw new Error('release transaction has no receipt chain');
+  if (current.state === 'install-verified') {
+    if (current.observation?.publicVerification?.aggregateSha256 !== aggregate.aggregateSha256) {
+      throw new Error('release is already install-verified by a different aggregate');
+    }
+    return current;
+  }
+  if (current.schemaVersion < 3 || current.state !== 'channels-converged') {
+    throw new Error(`public verification finalizer requires schema-3 channels-converged, found ${current.state}`);
+  }
+  const snapshot = await adapter.observeSnapshot(identity, discovered.matchingDrafts?.[0], { forceAssets: true });
+  if (snapshot.readError || !npmLatestIsB(snapshot, identity) || !npmCandidateExact(snapshot, identity)
+    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || snapshot.github?.latest !== true
+    || snapshot.github?.assetsExact !== true) throw new Error('public channels drifted before install verification');
+  const materialized = await adapter.materializePublicVerificationAggregate({ identity, aggregate });
+  const aggregateAssetSha256 = crypto.createHash('sha256').update(canonicalJson(aggregate)).digest('hex');
+  const signatureAssetSha256 = crypto.createHash('sha256').update(Buffer.from(aggregate.signature, 'base64')).digest('hex');
+  if (materialized?.aggregateSha256 !== aggregate.aggregateSha256
+    || materialized?.aggregateAssetSha256 !== aggregateAssetSha256
+    || materialized?.signatureAssetSha256 !== signatureAssetSha256) {
+    throw new Error('materialized public verification aggregate differs from signed evidence');
+  }
+  const receipt = stateReceipt({
+    identity,
+    prior: current,
+    state: 'install-verified',
+    observation: {
+      verdict: 'INSTALL_VERIFIED',
+      publicVerification: {
+        aggregateSha256: aggregate.aggregateSha256,
+        aggregateAssetSha256,
+        signatureAssetSha256,
+        lanes: aggregate.metrics.leaves,
+        recallAt10: aggregate.metrics.recallAt10,
+        deltaCitationRate: aggregate.metrics.deltaCitationRate,
+        reviewReceipts: aggregate.reviews,
+      },
+      npm: snapshot.npm,
+      github: snapshot.github,
+    },
+    privateKey,
+  });
+  const name = `${RECEIPT_PREFIX}${String(receipt.sequence).padStart(4, '0')}.json`;
+  await adapter.appendReceipt(discovered.matchingDrafts?.[0] || null, receipt, name);
+  const persisted = await adapter.readReceipt(discovered.matchingDrafts?.[0] || null, receipt.sequence);
+  verifyReceipt(persisted, publicKey);
+  if (canonicalJson(persisted) !== canonicalJson(receipt)) throw new Error('install-verified receipt readback differs');
+  validateReceiptChain([...chain, persisted], identity, publicKey);
+  return persisted;
+}