ruvnet-brain 4.2.2-dev → 4.3.1-dev

package/scripts/release-transaction-provider.mjs

@@ -3,8 +3,9 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { canonicalJson } from './coverage-integrity.mjs';
 import {
-  pollObservation, RECEIPT_PREFIX, TERMINAL_STATES, transactionIdFor,
+  pollObservation, RECEIPT_PREFIX, receiptDisposition, transactionIdFor,
 } from './release-transaction.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
@@ -94,9 +95,7 @@ export function selectCurrentReleaseBytes({ remoteBytes, localBytes, generatedBy
   return Buffer.from(bytes);
 }
 
-export function liveReleaseProvider({
-  root = process.cwd(), candidateReceipt = null, publicationReceipt = null,
-} = {}) {
+export function liveReleaseProvider({ root = process.cwd() } = {}) {
   let releases = [];
   let activeDraft = null;
   const assetDigestCache = new Map();
@@ -215,7 +214,8 @@ export function liveReleaseProvider({
       const legacySettled = [];
       const pending = [];
       for (const { receipt, release } of latestByTransaction.values()) {
-        if (TERMINAL_STATES.has(receipt.state)) continue;
+        const disposition = receiptDisposition(receipt);
+        if (['verified', 'closed-unsuccessful', 'legacy-closed'].includes(disposition)) continue;
         // CONVERGENCE IS A FACT ABOUT THE CHANNELS, NOT ABOUT THE RECEIPT FORMAT (fixed 2026-08-07).
         //
         // This required `receipt.schemaVersion === 1`. Receipts are written as schemaVersion 2
@@ -230,7 +230,7 @@ export function liveReleaseProvider({
         // all three hold, the transaction reached its goal whatever schema its receipts use. The
         // check is not weakened — the schema clause was never load-bearing for that question, it
         // just silently expired when the schema moved on.
-        const settled = release.draft === false
+        const settled = receipt.schemaVersion <= 2 && release.draft === false
           && receipt.identity?.version === npmLatest && receipt.identity?.tag === githubLatest;
         if (settled) legacySettled.push(receipt.transactionId);
         else pending.push(receipt);
@@ -318,6 +318,43 @@ export function liveReleaseProvider({
       }
     },
 
+    async materializePublicVerificationAggregate({ aggregate }) {
+      const anchor = activeDraft;
+      if (!anchor) throw new Error('no release anchor for public verification aggregate');
+      const release = hydratedRelease(releaseById(anchor.id));
+      const aggregateAsset = Buffer.from(canonicalJson(aggregate));
+      const signatureAsset = Buffer.from(aggregate.signature, 'base64');
+      const expected = {
+        'public-verification-aggregate.json': aggregateAsset,
+        'public-verification-aggregate.sig': signatureAsset,
+      };
+      const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-aggregate-'));
+      try {
+        for (const [name, bytes] of Object.entries(expected)) {
+          const existing = release.assets?.find((asset) => asset.name === name);
+          if (existing) {
+            if (!assetBytes(existing).equals(bytes)) throw new Error(`public verification asset conflict: ${name}`);
+            continue;
+          }
+          const file = path.join(temp, name);
+          fs.writeFileSync(file, bytes, { flag: 'wx', mode: 0o600 });
+          command('gh', ['release', 'upload', anchor.tag, file, '--repo', REPO]);
+        }
+        const observed = hydratedRelease(releaseById(anchor.id));
+        for (const [name, bytes] of Object.entries(expected)) {
+          const asset = observed.assets?.find((item) => item.name === name);
+          if (!asset || !assetBytes(asset).equals(bytes)) throw new Error(`public verification asset readback differs: ${name}`);
+        }
+        return {
+          aggregateSha256: aggregate.aggregateSha256,
+          aggregateAssetSha256: sha256(aggregateAsset),
+          signatureAssetSha256: sha256(signatureAsset),
+        };
+      } finally {
+        fs.rmSync(temp, { recursive: true, force: true });
+      }
+    },
+
     async readReceipt(draft, sequence) {
       const name = `${RECEIPT_PREFIX}${String(sequence).padStart(4, '0')}.json`;
       const release = hydratedRelease(releaseById((draft || activeDraft).id));
@@ -395,101 +432,5 @@ export function liveReleaseProvider({
       if (current !== expected) throw new Error(`refusing compensation: npm latest is ${current}, expected ${expected}`);
       command('npm', ['dist-tag', 'add', `${PACKAGE}@${prior}`, 'latest']);
     },
-    async finalize(identity, receipt, hostVerifier) {
-      if (!candidateReceipt || !publicationReceipt) {
-        throw new Error('final convergence requires candidate and publication receipt paths');
-      }
-      // THE HOST VERDICT IS MEASURED, NOT DECLARED — and it is measured FIRST.
-      //
-      // finalize() used to accept the verifier as `_hostVerifier` and ignore it, then build
-      // `hosts = { verdict: 'PASS', … }` as a literal. Every release therefore asserted host
-      // convergence with no host verified, while tests/helpers/release-transaction-fixture.mjs:153
-      // called the seam faithfully — a fault-injection suite certifying wiring the real publisher
-      // never ran. Fable 5 and GPT-5.6-Sol independently made this their #1 finding.
-      //
-      // It runs BEFORE publication and sealing because the order encodes the meaning: you seal a
-      // release you have verified, not the reverse. It is also the cheapest way to fail — an
-      // unusable artifact stops here instead of after a 20-minute publish.
-      if (!hostVerifier || typeof hostVerifier.verify !== 'function') {
-        return { verdict: 'FAIL', hostVerifierError: 'no host verifier was supplied to finalize' };
-      }
-      // No `assets` override: stagedHostVerifier is constructed in release.mjs:238 with the exact
-      // staged bytes for this candidate and defaults to them (staged-host-verifier.mjs:57), so
-      // passing nothing is what keeps production verifying the artifact actually being shipped.
-      const verified = await hostVerifier.verify({ source: 'final', identity });
-      if (verified.verdict !== 'PASS') {
-        return {
-          verdict: 'FAIL',
-          hosts: { verdict: verified.verdict, verifier: { error: verified.error, fixtures: verified.fixtures } },
-          previousReceiptDigest: receipt.receiptDigest,
-        };
-      }
-      if (!fs.existsSync(path.resolve(root, publicationReceipt))) {
-        const publication = spawnSync(process.execPath, [
-          'scripts/publication-receipt.mjs', '--candidate', candidateReceipt, '--out', publicationReceipt,
-        ], { cwd: root, encoding: 'utf8', timeout: 1_200_000 });
-        if (publication.error || publication.status !== 0) {
-          return { verdict: 'FAIL', publicationError: String(publication.stderr || publication.error?.message) };
-        }
-      }
-      const seal = spawnSync(process.execPath, [
-        'scripts/release-proof.mjs', '--candidate', candidateReceipt, '--publication', publicationReceipt,
-      ], { cwd: root, encoding: 'utf8', timeout: 300_000 });
-      if (seal.error || seal.status !== 0) {
-        return { verdict: 'FAIL', sealError: String(seal.stderr || seal.error?.message) };
-      }
-      const publication = JSON.parse(fs.readFileSync(path.resolve(root, publicationReceipt), 'utf8'));
-
-      // `verified` was measured at the top of finalize, before publication and sealing.
-      const hosts = {
-        verdict: verified.verdict,
-        claudeOnly: publication.installed?.claudeOnly,
-        codexOnly: publication.installed?.codexOnly,
-        dual: publication.installed?.dual,
-        verifier: { artifactSha256: verified.artifactSha256, fixtures: verified.fixtures, error: verified.error },
-      };
-      const observed = publication.postPublicationChecks?.find(({ name }) => name === 'published-surface-probe');
-      const result = {
-        verdict: observed?.status === 'completed' && observed?.conclusion === 'success' ? 'PASS' : 'FAIL',
-        hosts, surface: observed, publicationReceipt, previousReceiptDigest: receipt.receiptDigest,
-      };
-      if (result.verdict === 'PASS') {
-        const currentRelease = path.join(path.dirname(path.resolve(root, publicationReceipt)), 'current-release.json');
-        const generatedCurrentRelease = Buffer.from(`${JSON.stringify({
-          schemaVersion: 1,
-          transactionId: receipt.transactionId,
-          version: identity.version,
-          tag: identity.tag,
-          candidateSha: identity.candidateSha,
-          verdict: 'PASS',
-          publicationReceiptSha256: sha256(fs.readFileSync(path.resolve(root, publicationReceipt))),
-          hosts,
-          surface: observed,
-        }, null, 2)}\n`);
-        let remote = hydratedRelease(releaseById(activeDraft.id)).assets
-          ?.find((asset) => asset.name === 'current-release.json');
-        let currentReleaseBytes;
-        try {
-          currentReleaseBytes = selectCurrentReleaseBytes({
-            remoteBytes: remote ? assetBytes(remote) : null,
-            localBytes: !remote && fs.existsSync(currentRelease) ? fs.readFileSync(currentRelease) : null,
-            generatedBytes: generatedCurrentRelease,
-            identity: { transactionId: receipt.transactionId, version: identity.version, candidateSha: identity.candidateSha },
-          });
-        } catch (error) {
-          return { ...result, verdict: 'FAIL', currentReleaseError: error.message };
-        }
-        if (!fs.existsSync(currentRelease)) fs.writeFileSync(currentRelease, currentReleaseBytes, { flag: 'wx', mode: 0o600 });
-        if (!remote) {
-          command('gh', ['release', 'upload', activeDraft.tag, currentRelease, '--repo', REPO]);
-          remote = hydratedRelease(releaseById(activeDraft.id)).assets
-            ?.find((asset) => asset.name === 'current-release.json');
-        }
-        if (!remote || sha256(assetBytes(remote)) !== sha256(currentReleaseBytes)) {
-          return { ...result, verdict: 'FAIL', currentReleaseError: 'public receipt verification failed' };
-        }
-      }
-      return result;
-    },
   };
 }

package/scripts/release-transaction.mjs

@@ -1,12 +1,30 @@
 #!/usr/bin/env node
 import crypto from 'node:crypto';
+import { canonicalJson } from './coverage-integrity.mjs';
+import { verifyPublicVerificationAggregate } from './public-verification-aggregate.mjs';
+
+export { canonicalJson };
 
 export const RECEIPT_PREFIX = 'release-transaction-';
-export const TERMINAL_STATES = new Set(['channels-converged', 'aborted']);
+export const CURRENT_RECEIPT_SCHEMA_VERSION = 3;
+export const SUCCESS_CLOSED_STATES = new Set(['install-verified']);
+export const UNSUCCESSFUL_CLOSED_STATES = new Set(['aborted', 'abandoned', 'superseded']);
+
+export function receiptDisposition(receipt) {
+  if (!receipt || !Number.isInteger(receipt.schemaVersion)) return 'invalid';
+  if (receipt.schemaVersion <= 2 && receipt.state === 'channels-converged') return 'legacy-closed';
+  if (receipt.schemaVersion >= 3 && SUCCESS_CLOSED_STATES.has(receipt.state)) return 'verified';
+  if (UNSUCCESSFUL_CLOSED_STATES.has(receipt.state)) return 'closed-unsuccessful';
+  if (receipt.schemaVersion >= 3 && receipt.state === 'channels-converged') return 'pending-public-verification';
+  return 'pending';
+}
+
+export const isClosedReceipt = (receipt) => ['verified', 'closed-unsuccessful', 'legacy-closed']
+  .includes(receiptDisposition(receipt));
 
 // `aborted` WAS UNREACHABLE, AND THAT BRICKED THE RELEASE RAIL (found 2026-08-07, issue #77).
 //
-// `aborted` has always been in TERMINAL_STATES, but no state below listed it as a target — so it
+// `aborted` was historically declared terminal, but no state below listed it as a target — so it
 // was a terminal state nothing could ever enter. Combined with `manual-intervention-required`
 // (which has NO outgoing transitions and is NOT terminal), an interrupted release had exactly two
 // destinations and both were permanent non-terminal dead ends.
@@ -33,7 +51,7 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
   'npm-candidate-staged': ['remote-materialization-intent', 'manual-intervention-required', ...ABORTABLE],
   'remote-materialization-intent': ['prepared', 'manual-intervention-required', ...ABORTABLE],
   prepared: ['github-promote-intent', 'manual-intervention-required', ...ABORTABLE],
-  'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required', ...ABORTABLE],
+  'github-promote-intent': ['github-promoted-nonlatest', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
   'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
   'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
   // `defaults-promoted` added 2026-08-07: when GitHub is ALREADY latest at the moment npm is
@@ -51,7 +69,10 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
   'defaults-promoted': ['finalize-intent', 'manual-intervention-required', ...ABORTABLE],
   'finalize-intent': ['channels-converged', 'manual-intervention-required', ...ABORTABLE],
   'manual-intervention-required': [],
-  'channels-converged': [],
+  'channels-converged': ['install-verified', 'abandoned', 'superseded'],
+  'install-verified': [],
+  abandoned: [],
+  superseded: [],
   aborted: [],
 });
 
@@ -79,16 +100,6 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
  * here. This does not change the digest of any receipt that never held an undefined value, which is
  * every receipt that currently verifies.
  */
-export const canonicalJson = (value) => {
-  if (Array.isArray(value)) return `[${value.map((item) => (item === undefined ? 'null' : canonicalJson(item))).join(',')}]`;
-  if (value && typeof value === 'object') {
-    return `{${Object.keys(value).sort()
-      .filter((key) => value[key] !== undefined)
-      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
-  }
-  return JSON.stringify(value);
-};
-
 export const receiptPayload = (receipt) => {
   const { signature: _signature, receiptDigest: _digest, ...payload } = receipt;
   return canonicalJson(payload);
@@ -125,7 +136,8 @@ export function signReceipt(receipt, privateKey) {
 }
 
 export function verifyReceipt(receipt, publicKey) {
-  if (!receipt || ![1, 2].includes(receipt.schemaVersion) || !/^[a-f0-9]{64}$/.test(receipt.transactionId || '')) {
+  if (!receipt || ![1, 2, CURRENT_RECEIPT_SCHEMA_VERSION].includes(receipt.schemaVersion)
+    || !/^[a-f0-9]{64}$/.test(receipt.transactionId || '')) {
     throw new Error('invalid release transaction receipt');
   }
   const { signature, receiptDigest, ...unsigned } = receipt;
@@ -149,13 +161,20 @@ export function validateReceiptChain(receipts, identity, publicKey) {
     if ((receipt.previousReceiptDigest || null) !== (previous?.receiptDigest || null)) {
       throw new Error('release receipt chain conflict');
     }
+    if (previous && receipt.schemaVersion >= 3 && receiptDisposition(previous) === 'legacy-closed') {
+      throw new Error('legacy-closed release receipt cannot be promoted into schema 3');
+    }
+    if (previous && receipt.schemaVersion >= 3
+      && !ALLOWED_TRANSITIONS[previous.state]?.includes(receipt.state)) {
+      throw new Error(`illegal release transition ${previous.state} -> ${receipt.state}`);
+    }
     previous = receipt;
   }
   return sorted;
 }
 
 const stateReceipt = ({ identity, prior, state, observation = {}, privateKey }) => signReceipt({
-  schemaVersion: 2,
+  schemaVersion: CURRENT_RECEIPT_SCHEMA_VERSION,
   transactionId: transactionIdFor(identity),
   sequence: prior ? prior.sequence + 1 : 0,
   previousReceiptDigest: prior?.receiptDigest || null,
@@ -203,11 +222,15 @@ export function reduceReleaseState({ lastReceipt, snapshot, identity, prior }) {
   }
   if (npmB && snapshot.github?.draft === true) return { action: 'compensate-npm' };
   if (npmB && githubLatest) {
-    if (lastReceipt.state === 'channels-converged') {
+    if (lastReceipt.state === 'install-verified') {
       return githubPublished && assetsExact && candidateExact
-        && snapshot.publicReceiptExact && snapshot.publicHostsExact
         ? { action: 'complete' }
-        : { action: 'manual', reason: 'terminal public state drifted' };
+        : { action: 'manual', reason: 'verified public channels drifted' };
+    }
+    if (lastReceipt.state === 'channels-converged') {
+      return githubPublished && assetsExact && candidateExact
+        ? { action: 'await-install-verification' }
+        : { action: 'manual', reason: 'channel-converged state drifted' };
     }
     return { action: 'finalize' };
   }
@@ -257,7 +280,7 @@ export async function pollObservation(read, predicate, {
   throw new Error(`visibility deadline exceeded after ${now() - started}ms: ${detail}`);
 }
 
-export async function runReleaseTransaction({ identity, assets, adapter, privateKey, publicKey, hostVerifier }) {
+export async function runReleaseTransaction({ identity, assets, adapter, privateKey, publicKey }) {
   const expectedId = transactionIdFor(identity);
   const discovered = await adapter.discover(identity);
   const competing = discovered.pending?.filter((item) => item.transactionId !== expectedId) || [];
@@ -269,7 +292,8 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
   const draft = discovered.matchingDrafts?.[0] || await adapter.createDraft(identity);
   const append = async (state, observation = {}) => {
     const recoveryCompensation = state === 'compensation-intent' && current
-      && !TERMINAL_STATES.has(current.state) && current.state !== 'manual-intervention-required';
+      && !isClosedReceipt(current) && current.state !== 'manual-intervention-required'
+      && current.state !== 'channels-converged';
     if (current && !ALLOWED_TRANSITIONS[current.state]?.includes(state) && current.state !== state
       && !recoveryCompensation) {
       throw new Error(`illegal release transition ${current.state} -> ${state}`);
@@ -298,10 +322,10 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
     const snapshot = await adapter.observeSnapshot(identity, draft, {
       forceAssets: current.state === 'finalize-intent' || current.state === 'channels-converged',
     });
-    if (current.state === 'channels-converged') {
-      const terminal = reduceReleaseState({ lastReceipt: current, snapshot, identity, prior });
-      if (terminal.action === 'complete') return current;
-      throw new Error(`terminal release drift: ${terminal.reason || terminal.action}`);
+    if (current.state === 'channels-converged' || current.state === 'install-verified') {
+      const disposition = reduceReleaseState({ lastReceipt: current, snapshot, identity, prior });
+      if (['complete', 'await-install-verification'].includes(disposition.action)) return current;
+      throw new Error(`release state drift: ${disposition.reason || disposition.action}`);
     }
     // A process may die after the provider side effect and before its observation receipt. Rebuild
     // that missing receipt from fresh state before asking the reducer for the next command.
@@ -332,11 +356,11 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       await transition('compensated', { npm: snapshot.npm, github: snapshot.github, recovered: true });
       throw new Error('npm compensation recovered; resume the same transaction');
     }
-    if (current.state === 'finalize-intent' && snapshot.publicReceiptExact && snapshot.publicHostsExact
-      && npmCandidateExact(snapshot, identity) && npmLatestIsB(snapshot, identity)
+    if (current.state === 'finalize-intent' && npmCandidateExact(snapshot, identity) && npmLatestIsB(snapshot, identity)
       && githubIsB(snapshot, identity) && snapshot.github?.published && snapshot.github?.latest
       && snapshot.github?.assetsExact) {
-      return append('channels-converged', { verdict: 'PASS', recovered: true });
+      return append('channels-converged', { verdict: 'PUBLISHED_NOT_VERIFIED', recovered: true,
+        npm: snapshot.npm, github: snapshot.github });
     }
     const decision = reduceReleaseState({ lastReceipt: current, snapshot, identity, prior });
     const stageRecord = {
@@ -351,6 +375,7 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       ? `::notice title=Release stage ${decision.action}::${JSON.stringify(stageRecord)}`
       : JSON.stringify(stageRecord));
     if (decision.action === 'complete') return current;
+    if (decision.action === 'await-install-verification') return current;
     if (decision.action === 'manual') {
       await transition('manual-intervention-required', { reason: decision.reason, snapshot });
       throw new Error(`release requires manual intervention: ${decision.reason}`);
@@ -443,32 +468,15 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
         await transition('defaults-promoted', { npm: snapshot.npm, github: snapshot.github });
       }
       await transition('finalize-intent');
-      const final = await adapter.finalize(identity, current, hostVerifier);
-      // SAY WHICH CONVERGENCE FAILED, AND WHY (2026-08-07). This threw the bare sentence
-      // `final release convergence failed` while `finalize` had already returned exactly the reason
-      // — hostVerifierError, hosts.verifier.error, publicationError or sealError — and the throw
-      // discarded every one of them. That is the same defect that let `spawnSync ENOBUFS` masquerade
-      // as `staged GitHub payload mismatch` for three days: an error that reports its category and
-      // withholds its evidence. Publication had ALREADY succeeded on both channels here, so the
-      // operator is reading this line while npm and GitHub are correct, with nothing to act on.
-      if (final.verdict !== 'PASS') {
-        const why = final.hostVerifierError
-          || final.hosts?.verifier?.error
-          || final.publicationError
-          || final.sealError
-          || `verdict=${final.verdict ?? '(none)'}`;
-        const fixtures = final.hosts?.verifier?.fixtures;
-        const detail = fixtures ? ` | fixtures: ${JSON.stringify(fixtures).slice(0, 400)}` : '';
-        throw new Error(`final release convergence failed: ${why}${detail}`);
-      }
       const reobserved = await adapter.observeSnapshot(identity, draft, { forceAssets: true });
       if (!(npmLatestIsB(reobserved, identity) && reobserved.github?.latest && githubIsB(reobserved, identity))) {
-        throw new Error('provider defaults drifted during finalization');
+        throw new Error('provider defaults drifted before channel convergence');
       }
-      if (!reobserved.github?.assetsExact || !reobserved.publicReceiptExact || !reobserved.publicHostsExact) {
-        throw new Error('public receipt, host, or artifact evidence drifted during finalization');
+      if (!reobserved.github?.assetsExact || !npmCandidateExact(reobserved, identity)) {
+        throw new Error('provider artifacts drifted before channel convergence');
       }
-      return append('channels-converged', final);
+      return append('channels-converged', { verdict: 'PUBLISHED_NOT_VERIFIED',
+        npm: reobserved.npm, github: reobserved.github });
     }
   }
   throw new Error('release reducer exceeded its bounded transition count');
@@ -478,7 +486,9 @@ export async function abortReleaseTransaction({ identity, receipts, reason, auth
   if (!authorized) throw new Error('release abort requires explicit human authorization');
   const chain = validateReceiptChain(receipts, identity, publicKey);
   const current = chain.at(-1);
-  if (!current || TERMINAL_STATES.has(current.state)) throw new Error('release transaction is not abortable');
+  if (!current || isClosedReceipt(current) || !ALLOWED_TRANSITIONS[current.state]?.includes('aborted')) {
+    throw new Error('release transaction is not abortable');
+  }
   const snapshot = await adapter.observeSnapshot(identity);
   const prior = chain[0]?.observation?.prior;
   if (!prior || snapshot.npm?.latestVersion === identity.version || snapshot.github?.latest === true
@@ -492,3 +502,81 @@ export async function abortReleaseTransaction({ identity, receipts, reason, auth
   await adapter.appendReceipt(null, receipt, `${RECEIPT_PREFIX}${String(receipt.sequence).padStart(4, '0')}.json`);
   return receipt;
 }
+
+export async function finalizeReleaseTransaction({
+  identity,
+  aggregate,
+  adapter,
+  privateKey,
+  publicKey,
+  aggregatePublicKey,
+} = {}) {
+  if (!adapter || typeof adapter.discover !== 'function' || typeof adapter.observeSnapshot !== 'function'
+    || typeof adapter.materializePublicVerificationAggregate !== 'function'
+    || typeof adapter.appendReceipt !== 'function' || typeof adapter.readReceipt !== 'function') {
+    throw new Error('public verification finalizer adapter is incomplete');
+  }
+  const expectedAggregateIdentity = {
+    ...aggregate?.identity,
+    sourceSha: identity?.candidateSha,
+    version: identity?.version,
+    tag: identity?.tag,
+    artifactSha256: identity?.packageSha256,
+    bundleSha256: identity?.bundleSha256,
+    payloadId: identity?.payloadId,
+    releaseTransactionId: transactionIdFor(identity),
+  };
+  verifyPublicVerificationAggregate(aggregate, aggregatePublicKey, expectedAggregateIdentity);
+  const discovered = await adapter.discover(identity);
+  const chain = validateReceiptChain(discovered.receipts || [], identity, publicKey);
+  const current = chain.at(-1);
+  if (!current) throw new Error('release transaction has no receipt chain');
+  if (current.state === 'install-verified') {
+    if (current.observation?.publicVerification?.aggregateSha256 !== aggregate.aggregateSha256) {
+      throw new Error('release is already install-verified by a different aggregate');
+    }
+    return current;
+  }
+  if (current.schemaVersion < 3 || current.state !== 'channels-converged') {
+    throw new Error(`public verification finalizer requires schema-3 channels-converged, found ${current.state}`);
+  }
+  const snapshot = await adapter.observeSnapshot(identity, discovered.matchingDrafts?.[0], { forceAssets: true });
+  if (snapshot.readError || !npmLatestIsB(snapshot, identity) || !npmCandidateExact(snapshot, identity)
+    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || snapshot.github?.latest !== true
+    || snapshot.github?.assetsExact !== true) throw new Error('public channels drifted before install verification');
+  const materialized = await adapter.materializePublicVerificationAggregate({ identity, aggregate });
+  const aggregateAssetSha256 = crypto.createHash('sha256').update(canonicalJson(aggregate)).digest('hex');
+  const signatureAssetSha256 = crypto.createHash('sha256').update(Buffer.from(aggregate.signature, 'base64')).digest('hex');
+  if (materialized?.aggregateSha256 !== aggregate.aggregateSha256
+    || materialized?.aggregateAssetSha256 !== aggregateAssetSha256
+    || materialized?.signatureAssetSha256 !== signatureAssetSha256) {
+    throw new Error('materialized public verification aggregate differs from signed evidence');
+  }
+  const receipt = stateReceipt({
+    identity,
+    prior: current,
+    state: 'install-verified',
+    observation: {
+      verdict: 'INSTALL_VERIFIED',
+      publicVerification: {
+        aggregateSha256: aggregate.aggregateSha256,
+        aggregateAssetSha256,
+        signatureAssetSha256,
+        lanes: aggregate.metrics.leaves,
+        recallAt10: aggregate.metrics.recallAt10,
+        deltaCitationRate: aggregate.metrics.deltaCitationRate,
+        reviewReceipts: aggregate.reviews,
+      },
+      npm: snapshot.npm,
+      github: snapshot.github,
+    },
+    privateKey,
+  });
+  const name = `${RECEIPT_PREFIX}${String(receipt.sequence).padStart(4, '0')}.json`;
+  await adapter.appendReceipt(discovered.matchingDrafts?.[0] || null, receipt, name);
+  const persisted = await adapter.readReceipt(discovered.matchingDrafts?.[0] || null, receipt.sequence);
+  verifyReceipt(persisted, publicKey);
+  if (canonicalJson(persisted) !== canonicalJson(receipt)) throw new Error('install-verified receipt readback differs');
+  validateReceiptChain([...chain, persisted], identity, publicKey);
+  return persisted;
+}

package/scripts/release.mjs

@@ -32,10 +32,10 @@ import crypto from 'node:crypto';
 import { validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
 import { runReleaseTransaction } from './release-transaction.mjs';
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
-import { stagedHostVerifier } from './staged-host-verifier.mjs';
 import { verifyPayload } from './release-payload.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const IS_MAIN = path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url);
 const PUBLISH = process.argv.includes('--publish');
 const CORPUS_SEED = process.argv.includes('--corpus-seed');
 let protectedCandidate = null;
@@ -159,7 +159,9 @@ export function runProtectedCorpusSeed({
   if (digestMatch[1] !== archiveSha256) corpusFailure('corpus tag digest does not match the receipt and archive');
 
   const viewArgs = ['release', 'view', tag, '--json', 'tagName', '--repo', repo];
-  const view = run('gh', viewArgs, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  const ghCommand = env.RUVNET_GH_COMMAND || 'gh';
+  const ghPrefix = env.RUVNET_GH_SCRIPT ? [env.RUVNET_GH_SCRIPT] : [];
+  const view = run(ghCommand, [...ghPrefix, ...viewArgs], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
   if (!view.error && view.status === 0) corpusFailure(`release ${tag} already exists; refusing to overwrite immutable corpus seed`);
   const viewError = String(view.error?.message || view.stderr || view.stdout || '');
   if (!/(release not found|no release found)/i.test(viewError)) corpusFailure(`cannot prove ${tag} is absent (${viewError.trim() || `gh exited ${view.status}`})`);
@@ -181,14 +183,14 @@ export function runProtectedCorpusSeed({
     '--notes', notes,
     bundleFile, receiptFile,
   ];
-  const create = run('gh', createArgs, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  const create = run(ghCommand, [...ghPrefix, ...createArgs], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
   if (create.error || create.status !== 0) {
     corpusFailure(`protected corpus publication failed (${String(create.error?.message || create.stderr || create.stdout || '').trim()})`);
   }
   return { tag, target, repository: repo, archiveSha256, receiptSha256: sha256File(receiptFile) };
 }
 
-if (CORPUS_SEED) {
+if (IS_MAIN && CORPUS_SEED) {
   try {
     const result = runProtectedCorpusSeed();
     console.log(JSON.stringify({ ok: true, mode: 'corpus-seed', ...result }, null, 2));
@@ -196,7 +198,7 @@ if (CORPUS_SEED) {
     console.error(error.message);
     process.exitCode = 1;
   }
-} else {
+} else if (IS_MAIN) {
 
 console.log(`\n${c.b('RuvNet Brain — release / definition-of-done')} ${c.dim('· ' + (PUBLISH ? 'PUBLISH' : 'check-only') + ' · shipping ' + V())}\n`);
 
@@ -371,6 +373,9 @@ if (PUBLISH) {
     corpusSeedSha256: crypto.createHash('sha256').update(fs.readFileSync(assets.corpusSeedPath)).digest('hex'),
     generationLedgerSha256: crypto.createHash('sha256').update(fs.readFileSync(assets.generationLedgerPath)).digest('hex'),
   };
+  const identityPath = path.resolve(ROOT, process.env.RUVNET_RELEASE_IDENTITY || 'release-evidence/release-identity.json');
+  if (fs.existsSync(identityPath)) throw new Error(`refusing to overwrite release identity: ${identityPath}`);
+  fs.writeFileSync(identityPath, `${JSON.stringify(identity, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   const privatePem = process.env.RUVNET_SIGNING_KEY;
   if (!privatePem) throw new Error('RUVNET_SIGNING_KEY is required for signed transaction receipts');
   const finalReceipt = await runReleaseTransaction({
@@ -381,9 +386,12 @@ if (PUBLISH) {
     }),
     privateKey: crypto.createPrivateKey(privatePem),
     publicKey: crypto.createPublicKey(fs.readFileSync(path.join(ROOT, 'keys/ruvnet-brain-signing.pub.pem'), 'utf8')),
-    hostVerifier: stagedHostVerifier({ assets, identity }),
   });
   if (finalReceipt.state !== 'channels-converged') throw new Error(`release transaction stopped at ${finalReceipt.state}`);
+  const channelReceiptPath = path.resolve(ROOT,
+    process.env.RUVNET_CHANNEL_RECEIPT || 'release-evidence/channels-converged-receipt.json');
+  if (fs.existsSync(channelReceiptPath)) throw new Error(`refusing to overwrite channel receipt: ${channelReceiptPath}`);
+  fs.writeFileSync(channelReceiptPath, `${JSON.stringify(finalReceipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
 } else {
   step('D', 'remote staged release transaction — SKIPPED (check-only; pass --publish to publish)');
 }
@@ -396,7 +404,7 @@ if (!PUBLISH) {
 }
 
 if (PUBLISH) {
-  console.log(`\n${c.g(c.b('✓✓✓ SHIPPED'))} — every gate passed and every live channel is current. ${c.dim('A user on any path (npm, npx, explainer, --update) gets the working, current build.')}\n`);
+  console.log(`\n${c.y(c.b('PUBLISHED, NOT VERIFIED'))} — npm and GitHub expose the sealed candidate; public install verification is still required.\n`);
 } else {
   console.log(`\n${c.g(c.b('✓✓✓ PREFLIGHT PASS — NOT PUBLISHED'))} — the committed candidate passed every check-only gate.\n`);
 }

package/scripts/restore-local-ingests.mjs

@@ -42,7 +42,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { storeRoot, storesAt } from '../kb/store-root.mjs';
+import { storeRoot, storesAt, rootNeverMaterialized } from '../kb/store-root.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const LEDGER = path.join(ROOT, 'kb', 'local-ingests.json');
@@ -71,7 +71,7 @@ export function missingIngests({ ledgerFile = LEDGER, root = storeRoot() } = {})
 export function classify({ ledgerFile = LEDGER, root = storeRoot() } = {}) {
   const missing = missingIngests({ ledgerFile, root });
   if (!missing.length) return { state: OK, missing };
-  if (!fs.existsSync(root)) return { state: NEVER_MATERIALIZED, missing };
+  if (rootNeverMaterialized(root)) return { state: NEVER_MATERIALIZED, missing };
   return { state: WIPED, missing };
 }