ruvnet-brain 4.2.2-dev → 4.3.1-dev

package/plugin/scripts/capability-registry.mjs

@@ -70,6 +70,7 @@
  * Everything here is READ-ONLY. It observes; it never installs, enables, or writes.
  */
 import fs from 'node:fs';
+import crypto from 'node:crypto';
 import path from 'node:path';
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
@@ -967,6 +968,7 @@ export function auditAll({ project = process.cwd() } = {}) {
   // The default is the CALLER'S directory, not this package's. See the note on REPO: taking no
   // argument at all is what made every project-scoped row describe the wrong folder.
   const ctx = { project: path.resolve(project), home: HOME };
+  const observedAt = new Date().toISOString();
   return CAPABILITIES.map((c) => {
     let r;
     try { r = c.detect(ctx); }
@@ -984,6 +986,10 @@ export function auditAll({ project = process.cwd() } = {}) {
       turnOn: c.turnOn,
       state,
       evidence,
+      // A digest binds proactive routing to this audit invocation's observed bytes. Synthetic test
+      // registries do not carry it and remain compatible with the delivery seam.
+      evidenceDigest: crypto.createHash('sha256').update(evidence).digest('hex'),
+      evidenceObservedAt: observedAt,
       // WHICH project a project-scoped row is about, named rather than assumed. "no memory store
       // exists for this project" is only checkable by a reader who can see which folder was read.
       ...(c.scope === SCOPE.PROJECT ? { project: ctx.project } : {}),

package/plugin/scripts/capability-routing.mjs

@@ -0,0 +1,70 @@
+// capability-routing.mjs — evidence-bound routing for proactive recommendations.
+//
+// This is deliberately a small policy layer over goal-match + capability-registry. It does not
+// invent a second capability catalogue: every recommendation must name a row from the live audit,
+// and every row must carry the audit's observation digest. The tool family is a routing preference,
+// not a claim that the tool is installed or healthy.
+import crypto from 'node:crypto';
+
+const sha256 = (value) => crypto.createHash('sha256').update(String(value)).digest('hex');
+
+// These are the existing RuvNet building blocks for the capability's job. A route is only metadata
+// for the receipt and copy; execution remains the row's verified turnOn command.
+export const TOOL_PREFERENCES = Object.freeze({
+  'learning-hooks': ['ruflo'],
+  'memory-distillation': ['agentdb', 'ruflo'],
+  'workflow-pattern-learning': ['agentdb'],
+  'cheap-model-routing': ['agentic-flow'],
+  'cross-project-lessons': ['ruflo', 'agentdb'],
+  'lessons-in-force': ['ruflo'],
+  'harness-evolution': ['sparc', 'ruflo'],
+  'write-gates': ['ruflo'],
+  'session-capture': ['agentdb', 'ruflo'],
+  'mcp-servers': ['ruflo'],
+  'nightly-refresh': ['rvf', 'ruflo'],
+});
+
+export const hasToolPreference = (key) => Array.isArray(TOOL_PREFERENCES[key]) && TOOL_PREFERENCES[key].length > 0;
+
+const evidenceDigest = (row) => row?.evidenceDigest || sha256(row?.evidence || '');
+
+export function buildCapabilityRoutingReceipt({ prompt, matches, capabilities, observedAt = new Date().toISOString() } = {}) {
+  if (typeof prompt !== 'string' || !prompt.trim() || !Array.isArray(matches) || !Array.isArray(capabilities)) return null;
+  const byKey = new Map(capabilities.filter((row) => row && typeof row.key === 'string').map((row) => [row.key, row]));
+  const routes = [];
+  for (const match of matches) {
+    const key = typeof match?.capability === 'string' ? match.capability : match?.capability?.key;
+    const row = byKey.get(key);
+    const tools = TOOL_PREFERENCES[key];
+    // No row, no digest, or no known RuvNet route means UNKNOWN — never a hand-rolled fallback.
+    if (!row || !Array.isArray(tools) || !tools.length || typeof row.evidence !== 'string' || !row.evidence.trim()) continue;
+    routes.push({ capability: key, tools, state: row.state, evidenceDigest: evidenceDigest(row), confidence: match.confidence });
+  }
+  if (!routes.length) return null;
+  const payload = {
+    schemaVersion: 1,
+    kind: 'ruvnet-brain-capability-routing',
+    observedAt,
+    promptDigest: sha256(prompt.trim().toLowerCase()),
+    routes,
+    verdict: 'PASS',
+  };
+  return { ...payload, receiptSha256: sha256(JSON.stringify(payload)) };
+}
+
+export function validateCapabilityRoutingReceipt(receipt) {
+  if (receipt?.schemaVersion !== 1 || receipt?.kind !== 'ruvnet-brain-capability-routing'
+    || !Array.isArray(receipt.routes) || !receipt.routes.length || receipt.verdict !== 'PASS'
+    || !/^[a-f0-9]{64}$/.test(String(receipt.promptDigest || ''))
+    || !/^[a-f0-9]{64}$/.test(String(receipt.receiptSha256 || ''))) {
+    throw new Error('capability routing receipt is malformed');
+  }
+  const { receiptSha256: _digest, ...payload } = receipt;
+  if (sha256(JSON.stringify(payload)) !== receipt.receiptSha256) throw new Error('capability routing receipt digest mismatch');
+  for (const route of receipt.routes) {
+    if (!TOOL_PREFERENCES[route.capability] || !Array.isArray(route.tools)
+      || route.tools.some((tool) => !TOOL_PREFERENCES[route.capability].includes(tool))
+      || !/^[a-f0-9]{64}$/.test(String(route.evidenceDigest || ''))) throw new Error('capability routing route is not evidence-bound');
+  }
+  return receipt;
+}

package/plugin/scripts/continuation-gate.mjs

@@ -38,6 +38,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { readStdinBounded } from './hook-input.mjs';
+import {
+  auditCapabilityClaims,
+  buildCapabilityInventoryReceipt,
+} from './capability-inventory-receipt.mjs';
+import { auditCurrentCapabilityEvidence } from './capability-claim-evidence.mjs';
 
 const HOME = os.homedir();
 
@@ -251,6 +256,59 @@ const nowMs = Date.now();
 // force. This closes the empty-stdin hole that LOOP-SAFETY 1's `__source` check does not cover.
 if (!hookInput.session_id) process.exit(EXIT_ALLOW);
 
+/**
+ * FINAL-ANSWER CAPABILITY TRUTH — the Stop boundary is the only place that can inspect the answer
+ * the user is about to receive. The concrete failure this closes was an assistant saying
+ * "Ruflo ADR Verify is not installed" while `ruflo-adr:adr-verify` was present in that host's own
+ * installed skill inventory. A rule in the prompt did not prevent it; a byte-bound inventory does.
+ *
+ * This first receipt class is intentionally narrow: installed/registered/present claims about
+ * RuvNet skills. It does not pretend to prove arbitrary natural-language capability claims. A
+ * present source byte disproves an absence claim. A COMPLETE enumeration can disprove a presence
+ * claim. An incomplete enumeration can prove neither, so the only allowed verdict is UNKNOWN.
+ */
+function capabilityClaimWork() {
+  const message = String(hookInput.last_assistant_message || '');
+  if (!message) return [];
+  try {
+    const receipt = buildCapabilityInventoryReceipt();
+    const audit = auditCapabilityClaims(message, receipt);
+    const evidenceAudit = auditCurrentCapabilityEvidence(message, { now: new Date(nowMs).toISOString() });
+    const evidenceWork = [...evidenceAudit.contradictions, ...evidenceAudit.unresolved].map((finding) => ({
+      text: evidenceAudit.contradictions.includes(finding)
+        ? `RuvNet ${finding.class} claim "${finding.text}" contradicts fresh typed evidence: ${finding.reason || 'claim mismatch'}`
+        : `RuvNet ${finding.class} claim "${finding.text}" is UNKNOWN: ${finding.reason}; verify the exact live/source surface before asserting it`,
+      done: false,
+      at: new Date(nowMs).toISOString(),
+      derived: true,
+      kind: 'capability-claim-integrity',
+    }));
+    if (audit.verdict === 'PASS') return evidenceWork;
+    if (audit.verdict === 'FAIL') {
+      return [...audit.contradictions.map((finding) => ({
+        text: finding.matchedRef
+          ? `RuvNet capability claim "${finding.text}" contradicts the sealed ${audit.host} inventory: ${finding.matchedRef} is present at ${finding.sourcePath}`
+          : `RuvNet capability claim "${finding.text}" contradicts the complete sealed ${audit.host} inventory: no matching installed capability exists`,
+        done: false,
+        at: new Date(nowMs).toISOString(),
+        derived: true,
+        kind: 'capability-claim-integrity',
+      })), ...evidenceWork];
+    }
+    return [...audit.unresolved.map((finding) => ({
+      text: `RuvNet capability claim "${finding.text}" is UNKNOWN because the ${audit.host} inventory is incomplete; verify the live host before asserting absence`,
+      done: false,
+      at: new Date(nowMs).toISOString(),
+      derived: true,
+      kind: 'capability-claim-integrity',
+    })), ...evidenceWork];
+  } catch {
+    // The Stop hook remains fail-open on machinery failure. The receipt builder represents
+    // ordinary incomplete enumeration as UNKNOWN; reaching this catch means the gate itself broke.
+    return [];
+  }
+}
+
 /**
  * ARTIFACT-DERIVED OPEN WORK — the half that cannot be forgotten.
  *
@@ -423,6 +481,7 @@ function securityAlertWork() {
 }
 
 const open = [
+  ...capabilityClaimWork(),
   ...led.items.filter((i) => !i.done),
   ...artifactOpenWork(), ...redCiOpenWork(), ...openPrWork(), ...securityAlertWork(),
 ];
@@ -511,11 +570,15 @@ if (!claimCooldown(nowMs, COOLDOWN_MS)) process.exit(EXIT_ALLOW);
  */
 const committed = forceable.filter((i) => !i.derived);
 const observed = forceable.filter((i) => i.derived);
+const capabilityClaims = forceable.filter((i) => i.kind === 'capability-claim-integrity');
 // Every derived item names its own repo in its text; this is for the header, where the ONE repo
 // this tree points at is the honest thing to say.
 const repoLabel = [...OWNED_REPOS][0] || 'this repository';
 
-const header = committed.length && observed.length
+const header = capabilityClaims.length
+  ? ['Your proposed final answer contains a RuvNet capability claim that is contradicted or not provable.',
+     'Do NOT deliver it unchanged — continue now and correct the claim from the sealed live-host inventory.']
+  : committed.length && observed.length
   ? [`You have unfinished work you committed to, and ${repoLabel} has open work of its own.`,
      'Do NOT end the turn — continue now.']
   : committed.length
@@ -539,7 +602,10 @@ const lines = [
   // build, answer the issue, patch the advisory) and the next watcher run stops reporting it —
   // which is the point of deriving it rather than remembering it. Offering --done for one would be
   // offering a way to mark a red build finished without fixing it.
-  ...(committed.length
+  ...(capabilityClaims.length
+    ? ['Replace every contradicted claim with the observed capability and source path. Replace every',
+       'unresolved absence claim with UNKNOWN until a complete live inventory proves it.']
+    : committed.length
     ? ['Mark each item done as you complete it:  node plugin/scripts/continuation-gate.mjs --done "<exact item text>"']
     : ['These clear by being done, not by being marked: merge or fix the PR, get the build green,',
        'answer the issue, patch the advisory. The next observation stops listing them.']),