ruvnet-brain 4.2.2-dev → 4.3.1

package/scripts/ingest-gists.mjs

@@ -42,6 +42,7 @@ const DRY = argv.includes('--dry-run');
 // and ship via Release, so nightly CI can keep the INDEX fresh even though it cannot commit vectors.
 const INDEX_ONLY = argv.includes('--index-only');
 const INDEX_PATH = path.join(ROOT, 'docs', 'RUV-GISTS.md');
+const FETCH_TIMEOUT_MS = Number(process.env.RUVNET_GISTS_FETCH_TIMEOUT_MS || 30_000);
 
 // Markdown/text only. A gist's code files are better read from the repo they land in; prose is the
 // thing repos don't carry.
@@ -49,8 +50,17 @@ const TEXT_EXT = new Set(['.md', '.markdown', '.txt', '.rst']);
 
 /** Authenticated GitHub calls via `gh` — 5000 req/hr instead of 60, and no token handling here. */
 function gh(endpointArgs) {
-  const r = spawnSync('gh', endpointArgs, { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
-  if (r.status !== 0) throw new Error(`gh ${endpointArgs.join(' ')} failed: ${(r.stderr || '').trim().slice(0, 200)}`);
+  const r = spawnSync('gh', endpointArgs, {
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: FETCH_TIMEOUT_MS,
+  });
+  if (r.status !== 0) {
+    const detail = r.error?.code === 'ETIMEDOUT' || r.signal
+      ? `timed out after ${FETCH_TIMEOUT_MS}ms`
+      : (r.stderr || '').trim().slice(0, 200);
+    throw new Error(`gh ${endpointArgs.join(' ')} failed: ${detail}`);
+  }
   return r.stdout;
 }
 
@@ -187,11 +197,23 @@ async function main() {
   for (const [i, stub] of gists.entries()) {
     if (i % 25 === 0) process.stdout.write(`\r  fetching ${i}/${gists.length}…`);
     let g;
-    try { g = fetchGist(stub.id); } catch { skipped++; continue; }
+    try {
+      g = fetchGist(stub.id);
+    } catch (err) {
+      skipped++;
+      console.error(`\n  fetch failed for gist ${stub.id}: ${err.message}`);
+      continue;
+    }
     for (const [fname, f] of Object.entries(g.files || {})) {
       if (!TEXT_EXT.has(path.extname(fname).toLowerCase())) continue;
-      const body = f.truncated && f.raw_url ? '' : (f.content || '');
-      if (!body.trim()) { skipped++; continue; }
+      // JSONL readers treat U+2028/U+2029 as physical line separators on some runtimes. Normalize
+      // them before serialization so one JSON object always remains one physical passage line.
+      const body = (f.truncated && f.raw_url ? '' : (f.content || '')).replace(/[\u2028\u2029]/g, '\n');
+      if (!body.trim()) {
+        skipped++;
+        console.error(`\n  empty or truncated text file: ${stub.id}/${fname}`);
+        continue;
+      }
       const title = (g.description || fname).replace(/\s+/g, ' ').trim().slice(0, 180) || fname;
       const head = banner(g, fname);
       // Banner on EVERY chunk, not just the first. Retrieval returns ONE chunk — if the provenance
@@ -212,6 +234,13 @@ async function main() {
   }
   process.stdout.write('\r');
 
+  // A receipt-only or partial corpus is more dangerous than a failed run: its RVF idmap can look
+  // healthy while silently omitting live source. Preserve the previous complete corpus and make
+  // the nightly job retry instead of publishing incomplete search data.
+  if (skipped > 0) {
+    throw new Error(`ingest-gists: refusing to write partial corpus (${skipped} fetch/content failures)`);
+  }
+
   fs.writeFileSync(path.join(KB, `${NAME}.passages.jsonl`), passages.map((p) => JSON.stringify(p)).join('\n') + '\n');
   fs.writeFileSync(path.join(KB, `${NAME}.meta.json`), JSON.stringify({
     model: NAME, dimensions: 0, metric: 'cosine', name: NAME,

package/scripts/ingest-new-repos.mjs

@@ -34,6 +34,7 @@ import { execFileSync, spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { storeRoot, storesAt, darkStores } from '../kb/store-root.mjs';
+import { assertIsolatedMutationWorktree } from './worktree-integrity.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const OWNER = process.env.RUVNET_ORG_OWNER || 'ruvnet';
@@ -81,6 +82,10 @@ const isMain = (() => {
 })();
 
 if (isMain) {
+  if (APPLY) {
+    try { assertIsolatedMutationWorktree(ROOT, 'ingest-new-repos --apply'); }
+    catch (error) { console.error(error?.message || String(error)); process.exit(2); }
+  }
   const repos = liveOrgRepos();
   if (!Array.isArray(repos)) {
     // A LIST WE COULD NOT FETCH IS NOT AN EMPTY LIST. Reporting "0 new repos" here would read as

package/scripts/metaharness-gate.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+/** Compose measured MetaHarness read surfaces into one fail-closed gate. */
+import crypto from 'node:crypto';
+
+const REQUIRED_SCORE_FIELDS = Object.freeze(['harnessFit', 'compileConfidence', 'taskCoverage', 'toolSafety', 'memoryUsefulness']);
+function unwrap(value) { return value && value.data && typeof value.data === 'object' ? value.data : value; }
+function finite(value) { return typeof value === 'number' && Number.isFinite(value) ? value : null; }
+function severity(value) { const key = String(value ?? '').toLowerCase(); return ['clean', 'low', 'medium', 'high'].includes(key) ? key : null; }
+function digest(value) { return crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex'); }
+
+export function summarizeScore(input) {
+  const score = unwrap(input);
+  if (!score || score.degraded === true) return { status: 'unmeasured', degraded: true, reason: score?.reason || 'score unavailable' };
+  const dimensions = Object.fromEntries(REQUIRED_SCORE_FIELDS.map((key) => [key, finite(score[key])]));
+  const missing = REQUIRED_SCORE_FIELDS.filter((key) => dimensions[key] === null);
+  return { status: missing.length ? 'unmeasured' : 'measured', dimensions, missing, costPerRunUsd: finite(score.estCostPerRunUsd), recommendedMode: typeof score.recommendedMode === 'string' ? score.recommendedMode : null, scaffoldReady: typeof score.scaffoldReady === 'boolean' ? score.scaffoldReady : null };
+}
+
+export function summarizeAudit(input) {
+  const audit = unwrap(input);
+  const worst = severity(audit?.composite?.worst ?? audit?.worst);
+  const degraded = audit?.degraded === true || Object.values(audit?.components || {}).some((v) => v?.degraded === true);
+  return { status: worst ? 'measured' : 'unmeasured', worst, degraded, fingerprint: typeof audit?.fingerprint === 'string' ? audit.fingerprint : null };
+}
+
+export function summarizeDrift(input) {
+  const drift = unwrap(input);
+  const alert = typeof drift?.alert === 'boolean' ? drift.alert : null;
+  const verdict = typeof drift?.verdict === 'string' ? drift.verdict : null;
+  return { status: alert === null && !verdict ? 'unmeasured' : 'measured', alert, verdict, similarity: finite(drift?.similarity), reason: drift?.reason || null };
+}
+
+export function summarizeRoutingReceipts(rows = []) {
+  if (!Array.isArray(rows)) return { status: 'unmeasured', count: 0, costUsd: null, savedUsd: null };
+  const valid = rows.filter((r) => r && typeof r === 'object' && typeof r.model === 'string');
+  const withCost = valid.filter((r) => finite(r.est_cost) !== null);
+  const withSaved = valid.filter((r) => finite(r.saved) !== null);
+  return { status: valid.length ? 'measured' : 'unmeasured', count: valid.length, costUsd: withCost.length ? withCost.reduce((sum, r) => sum + r.est_cost, 0) : null, savedUsd: withSaved.length ? withSaved.reduce((sum, r) => sum + r.saved, 0) : null, unpriced: valid.length - withCost.length };
+}
+
+/** Read-only composition. `allowMetered` defaults false: readiness never authorizes spend. */
+export function buildGateReceipt({ score, audit, drift, routingReceipts = [], candidate = null, allowMetered = false, now = new Date().toISOString() } = {}) {
+  const measuredScore = summarizeScore(score), measuredAudit = summarizeAudit(audit), measuredDrift = summarizeDrift(drift), routing = summarizeRoutingReceipts(routingReceipts);
+  const reasons = [];
+  if (measuredScore.status !== 'measured') reasons.push('score is missing required measured dimensions');
+  if (measuredAudit.status !== 'measured') reasons.push('OIA audit has no measured composite severity');
+  if (measuredAudit.degraded) reasons.push('OIA audit is degraded');
+  if (measuredDrift.status !== 'measured') reasons.push('drift result is unmeasured');
+  if (measuredDrift.alert === true || /major|high|regress/i.test(measuredDrift.verdict || '')) reasons.push('drift is alerting');
+  if (measuredAudit.worst === 'high') reasons.push('OIA audit is high severity');
+  const ready = reasons.length === 0;
+  const candidateVerified = candidate?.bundle_verified === true && candidate?.data_source === 'SYNTHETIC';
+  const receipt = { schemaVersion: 1, kind: 'metaharness-gate', ts: now, score: measuredScore, audit: measuredAudit, drift: measuredDrift, routing, readiness: ready ? 'ready' : 'blocked', evolution: { allowed: ready && allowMetered === true, reason: ready ? (allowMetered ? 'measured preflight passed and metered spend explicitly allowed' : 'metered spend is disabled') : reasons.join('; ') }, promotion: { allowed: ready && candidateVerified, reason: !ready ? reasons.join('; ') : candidateVerified ? 'verified synthetic replay candidate' : 'candidate is absent or not a verified synthetic replay' } };
+  return { ...receipt, evidenceDigest: digest(receipt) };
+}
+
+export function assertEvolutionAllowed(receipt) { if (!receipt?.evolution?.allowed) throw new Error(`MetaHarness evolution blocked: ${receipt?.evolution?.reason || 'missing gate receipt'}`); return receipt; }
+export function assertPromotionAllowed(receipt) { if (!receipt?.promotion?.allowed) throw new Error(`MetaHarness promotion blocked: ${receipt?.promotion?.reason || 'missing gate receipt'}`); return receipt; }

package/scripts/nightly-gists.sh

@@ -10,9 +10,9 @@
 #   3. re-embed        — the expensive step (~18 min, 8 shards). SKIPPED ENTIRELY when step 2
 #                        reports "nothing to do". A quiet night costs seconds, not minutes.
 #
-# PATH is set explicitly: launchd does not inherit a login shell's environment, which is why the
-# sibling agent com.ruvnet.brain-nightly has been dying on `spawnSync gh ENOENT` — gh lives in
-# /opt/homebrew/bin and launchd never saw it.
+# PATH is set explicitly because launchd does not inherit a login shell's environment. The retired
+# com.ruvnet.brain-nightly source writer previously exposed this exact failure mode: gh lived in
+# /opt/homebrew/bin and launchd could not see it.
 
 set -eu
 

package/scripts/nightly-wrapper.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
-# nightly-wrapper.sh — the ONLY thing launchd invokes for the nightly. Per Stuart's standing order
+# nightly-wrapper.sh — author-side maintenance, intentionally NOT a primary-checkout scheduler.
+# The old com.ruvnet.brain-nightly LaunchAgent invoked this in the primary checkout and accumulated
+# generated source changes beside active human work. That job is retired. The supported scheduled
+# updater is com.ruvnet.brain-update and mutates only the installed cache. If this author harness is
+# run manually, every source-writing command below requires a clean linked worktree.
 # (2026-07-12): no noise for success or no-op — only ACTIVE alerts for real failure, and the system
 # must attempt to self-heal before escalating, then make failure impossible to miss next session.
 #
@@ -34,22 +38,42 @@ set -u
 # kb/models-cache (the fallback) starts cold every time -> every nightly re-downloads the ONNX
 # embedder from HuggingFace. Point at the already-warm cache instead (verified present).
 export KB_MODEL_CACHE="/Users/stuartkerr/Code/PowerPlatePulse/scripts/models-cache"
-cd /Users/stuartkerr/Code/ruvnet-brain 2>/dev/null || {
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" 2>/dev/null && pwd)
+WORKTREE_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." 2>/dev/null && pwd)
+cd "$WORKTREE_ROOT" 2>/dev/null || {
   curl -sS --max-time 10 -H "Title: 🔴 Nightly CRASHED before it could even start" \
     -H "Priority: urgent" -H "Tags: rotating_light" \
     -d "cd into the repo failed — filesystem or mount problem. Investigate the machine directly." \
     "https://ntfy.sh/$(grep -m1 '^NTFY_TOPIC=' /Users/stuartkerr/Code/ruvnet-brain/.env 2>/dev/null | cut -d= -f2)" >/dev/null 2>&1
   exit 1
 }
-mkdir -p logs .ruvnet-brain
-LOG=logs/nightly.log
-MARKER=.ruvnet-brain/nightly-failure.json
-LOCK=.ruvnet-brain/nightly.lock
-
-# Single-instance guard (2026-07-12): the plist has no built-in one. The updater is incremental now,
-# but a very large upstream change, a slow model, or a stalled gate can still outlive the window and
-# overlap the NEXT scheduled 3:15am fire. A stale lock from a crashed run (PID no longer alive) is
-# treated as no lock.
+GIT_COMMON_DIR=$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null) || exit 1
+PRIMARY_ROOT=$(dirname "$GIT_COMMON_DIR")
+export RUVNET_PROJECT_MEMORY_DB="$PRIMARY_ROOT/.swarm/memory.db"
+mkdir -p "$PRIMARY_ROOT/logs" "$PRIMARY_ROOT/.ruvnet-brain"
+LOG="$PRIMARY_ROOT/logs/nightly.log"
+MARKER="$PRIMARY_ROOT/.ruvnet-brain/nightly-failure.json"
+LOCK="$PRIMARY_ROOT/.ruvnet-brain/nightly.lock"
+PRIMARY_SNAPSHOT=$(mktemp "${TMPDIR:-/tmp}/ruvnet-brain-primary-snapshot.XXXXXX") || exit 1
+if ! "$NODE_BIN" scripts/worktree-integrity.mjs snapshot "$WORKTREE_ROOT" > "$PRIMARY_SNAPSHOT"; then
+  rm -f "$PRIMARY_SNAPSHOT"
+  exit 2
+fi
+
+finish() {
+  rc=$?
+  trap - EXIT
+  rm -f "$LOCK"
+  if ! "$NODE_BIN" scripts/worktree-integrity.mjs verify "$WORKTREE_ROOT" "$PRIMARY_SNAPSHOT" >> "$LOG" 2>&1; then
+    echo "===== FATAL: primary checkout changed during isolated author maintenance =====" >> "$LOG"
+    rc=3
+  fi
+  rm -f "$PRIMARY_SNAPSHOT"
+  exit "$rc"
+}
+
+# Single-instance guard for explicit author invocations. A stale lock from a crashed run (PID no
+# longer alive) is treated as no lock.
 if [ -f "$LOCK" ]; then
   OLD_PID=$(cat "$LOCK" 2>/dev/null)
   if [ -n "$OLD_PID" ] && kill -0 "$OLD_PID" 2>/dev/null; then
@@ -61,17 +85,13 @@ if [ -f "$LOCK" ]; then
   echo "===== $(date -u +%FT%TZ) — stale lock from pid $OLD_PID (not running) — clearing =====" >> "$LOG"
 fi
 echo $$ > "$LOCK"
-trap 'rm -f "$LOCK"' EXIT
-
-# NIGHTLY_SMOKE=1 — prove this whole chain (launchd -> heartbeat wrapper -> here -> node -> the repo
-# scan -> the log) WITHOUT a multi-hour rebuild. self-update.mjs is dry-run by default, so dropping
-# --apply exercises every link except the build itself. Publication is never part of this job.
-# WHY IT EXISTS (2026-07-13): the 03:15 fire on 07-12 died before it could even write its own log
-# ("/bin/bash: logs/nightly.log: No such file or directory" — relative path, no working directory) and
-# NOBODY KNEW, because the only way to test this chain was to wait until 03:15 and hope. A scheduled job
-# you can only test by waiting for it is a job you are not testing. Now: `NIGHTLY_SMOKE=1 <the exact
-# plist command>` proves it on demand, any time, in seconds.
+trap finish EXIT
+
+# NIGHTLY_SMOKE=1 exercises the author harness and source planner without a multi-hour rebuild. It
+# still requires an isolated clean linked worktree: a diagnostic escape hatch must not reopen the
+# primary-checkout writer. Publication is never part of this job.
 SMOKE="${NIGHTLY_SMOKE:-0}"
+"$NODE_BIN" scripts/worktree-integrity.mjs "$WORKTREE_ROOT" "nightly author maintenance" >> "$LOG" 2>&1 || exit 2
 
 run_once() {
   local rc
@@ -98,13 +118,42 @@ run_once() {
   return 0
 }
 
+# Prepare the source candidate before any optional evidence refresh that writes tracked artifacts.
+# Otherwise learning-replay dirties the isolated lane first and self-update correctly refuses it.
+if run_once 1; then
+  if [ "$SMOKE" = "1" ]; then exit 0; fi
+else
+  echo "===== first attempt failed — waiting 3 min, retrying once (self-heal for transient issues) =====" >> "$LOG"
+  sleep 180
+  if run_once 2; then
+    echo "===== SELF-HEALED on retry — no escalation needed =====" >> "$LOG"
+  else
+    # Both attempts genuinely failed. Escalate loudly AND leave a marker the next session cannot miss.
+    AFTER=$(gh release view --json tagName -q .tagName 2>/dev/null || echo "unknown")
+    TAIL=$(tail -25 "$LOG" | tr '\n' ' ' | cut -c1-2000)
+    mkdir -p "$(dirname "$MARKER")"
+    python3 -c "
+import json, datetime
+json.dump({
+  'at': datetime.datetime.utcnow().isoformat() + 'Z',
+  'last_release_tag_observed': '$AFTER',
+  'tail': '''$TAIL''',
+  'note': 'Author candidate rebuild failed twice (immediate + 3min retry). See logs/nightly.log.'
+}, open('$MARKER', 'w'), indent=2)
+"
+    sh scripts/notify.sh "🔴 Author candidate rebuild FAILED twice" "candidate rebuild failed; last release remains $AFTER. Last: $TAIL" urgent "rotating_light"
+    echo "===== ESCALATED: marker written at $MARKER =====" >> "$LOG"
+    exit 1
+  fi
+fi
+
 # Memory distillation (ADR-174) had gone stale 3 days — same silent-death pattern as everything
 # else tonight. Independent of rebuild success/failure: mine raw memory_entries into structured
 # episodes/reasoning_patterns on every nightly run. Best-effort, never blocks the real job.
-RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory distill run --path .swarm/memory.db >> "$LOG" 2>&1 || true
+RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory distill run --path "$RUVNET_PROJECT_MEMORY_DB" >> "$LOG" 2>&1 || true
 # Durability: was a one-off manual snapshot before tonight. Now recurring — WAL-safe, rotates
 # automatically (keeps last 14), zero risk to the live DB (reads only).
-RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory backup --db .swarm/memory.db --keep 14 >> "$LOG" 2>&1 || true
+RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory backup --db "$RUVNET_PROJECT_MEMORY_DB" --keep 14 >> "$LOG" 2>&1 || true
 
 # LESSON BRIDGE (ADR-066, 2026-08-10) — carry newly-tagged machine-wide lessons into the store the
 # hooks actually read. Without this the bridge is a command someone has to remember, and a learning
@@ -124,7 +173,7 @@ echo "===== lesson-bridge — $(date -u +%FT%TZ) =====" >> "$LOG"
 # while in WAL mode. Best-effort, same shape as its brain-health/key-health siblings below: never
 # blocks the real rebuild, just makes a WAL-mode/integrity regression loud instead of silent.
 echo "===== memdb-health canary — $(date -u +%FT%TZ) =====" >> "$LOG"
-sh scripts/memdb-health.sh .swarm/memory.db >> "$LOG" 2>&1 \
+sh scripts/memdb-health.sh "$RUVNET_PROJECT_MEMORY_DB" >> "$LOG" 2>&1 \
   && echo "===== memdb-health canary: OK =====" >> "$LOG" \
   || echo "===== memdb-health canary: UNHEALTHY (see line above) =====" >> "$LOG"
 
@@ -164,18 +213,6 @@ sh scripts/memdb-health.sh .swarm/memory.db >> "$LOG" 2>&1 \
 # REPORTS ONLY. It cannot push, merge, close or publish (asserted by test). Exit 1 means a human
 # needs to look, and the reasons print in full rather than as a count.
 echo "===== GITHUB-HEALTH watch — $(date -u +%FT%TZ) =====" >> "$LOG"
-# LOAD WHAT rUv SHIPPED, WITHOUT BEING ASKED (added 2026-08-20).
-#
-# The owner: "aren't you loading everything Ruv creates every day?????" The answer was no — this
-# file had ZERO ingestion, so new repos only entered the brain when a human typed the command.
-# Measured the day this landed: 181 live repos, 69 ingested, 125 missing. `brain-stamp.mjs` had
-# been COMPUTING that gap nightly and nothing acted on it.
-#
-# Bounded to 3/night on purpose: ingestion embeds a whole repository, and 125 in one run would
-# starve everything after it here. The corpus converges over days and the run says how many
-# remain rather than implying it finished. A failed repo is left missing so the next night retries.
-"$NODE_BIN" scripts/ingest-new-repos.mjs --apply --max 3 >> "$LOG" 2>&1 || true
-
 "$NODE_BIN" scripts/github-health-watch.mjs >> "$LOG" 2>&1 \
   || echo "[github-health] findings above need attention" >> "$LOG"
 
@@ -216,39 +253,8 @@ fi
 # The canary itself handles urgent pushes on alive->DEAD transitions (and recovery notices), so a
 # known-dead key doesn't re-alarm every night; here we only log.
 echo "===== key-health canary — $(date -u +%FT%TZ) =====" >> "$LOG"
-zsh -lc 'cd /Users/stuartkerr/Code/ruvnet-brain && "$NODE_BIN" scripts/key-canary.mjs --notify' >> "$LOG" 2>&1 \
+zsh -lc 'cd "$1" && "$2" scripts/key-canary.mjs --notify' _ "$WORKTREE_ROOT" "$NODE_BIN" >> "$LOG" 2>&1 \
   && echo "===== key-health canary: all present keys alive =====" >> "$LOG" \
   || echo "===== key-health canary: at least one key DEAD (push sent on new deaths) =====" >> "$LOG"
 
-if run_once 1; then
-  exit 0
-fi
-
-echo "===== first attempt failed — waiting 3 min, retrying once (self-heal for transient issues) =====" >> "$LOG"
-sleep 180
-
-if run_once 2; then
-  echo "===== SELF-HEALED on retry — no escalation needed =====" >> "$LOG"
-  exit 0
-fi
-
-# Both attempts genuinely failed. Escalate loudly AND leave a marker the next session cannot miss.
-AFTER=$(gh release view --json tagName -q .tagName 2>/dev/null || echo "unknown")
-# Was `tail -8 | cut -c1-600`. self-update's [FATAL] block is 4+ lines on its own and now carries a
-# 'reason:' line per failed repo, so 8 lines / 600 chars truncated the alert mid-argv — every one of
-# the six identical 2026-08-03..08-06 failures escalated with no reason in it. Widen enough that the
-# whole [FATAL] block, reasons included, reaches the marker file and the push.
-TAIL=$(tail -25 "$LOG" | tr '\n' ' ' | cut -c1-2000)
-mkdir -p .ruvnet-brain
-python3 -c "
-import json, datetime
-json.dump({
-  'at': datetime.datetime.utcnow().isoformat() + 'Z',
-  'last_release_tag_observed': '$AFTER',
-  'tail': '''$TAIL''',
-  'note': 'Nightly failed twice (immediate + 3min retry). Needs a live session to diagnose — see logs/nightly.log.'
-}, open('$MARKER', 'w'), indent=2)
-"
-sh scripts/notify.sh "🔴 Nightly FAILED twice — needs you" "candidate rebuild failed; last release remains $AFTER. Last: $TAIL" urgent "rotating_light"
-echo "===== ESCALATED: marker written at $MARKER =====" >> "$LOG"
-exit 1
+exit 0

package/scripts/product-integrity-contract.mjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  buildSourceScopeReceipt,
+  canonicalJson,
+  digest,
+  validateSourceScopeReceipt,
+} from './source-scope-receipt.mjs';
+
+export const PRODUCT_INTEGRITY_SCHEMA_VERSION = 1;
+export const PRODUCT_INTEGRITY_TEST_CLASSES = Object.freeze(['essential', 'supporting', 'obsolete']);
+export const PRODUCT_INTEGRITY_PROOF_STRENGTH = Object.freeze(['unit', 'integration', 'packed-artifact', 'candidate-host', 'public-byte']);
+export const PRODUCT_INTEGRITY_PROCESSES = Object.freeze([
+  { id: 'SourceCoverage', upstream: [] }, { id: 'CorpusGeneration', upstream: ['SourceCoverage'] },
+  { id: 'ReleaseProjection', upstream: ['CorpusGeneration'] }, { id: 'RefreshLifecycle', upstream: ['ReleaseProjection'] },
+  { id: 'HostConvergence', upstream: ['ReleaseProjection'] }, { id: 'ReleaseTransaction', upstream: ['ReleaseProjection'] },
+  { id: 'PublicVerification', upstream: ['ReleaseTransaction', 'HostConvergence'] },
+  { id: 'ProductIntegrityCase', upstream: ['RefreshLifecycle', 'PublicVerification'] },
+]);
+export const PRODUCT_INTEGRITY_CONTEXTS = Object.freeze(PRODUCT_INTEGRITY_PROCESSES.map(({ id }) => id));
+const ARCHITECTURE = Object.freeze([
+  { id: 'ADR-072', path: 'docs/adr/0072-whole-product-integrity-conformance.md', status: 'Accepted' },
+  { id: 'DDD-0018', path: 'docs/ddd/0018-product-integrity-context.md', status: 'Accepted' },
+  { id: 'ADR-073', path: 'docs/adr/0073-agentdb-perennial-project-continuity.md', status: 'Accepted' },
+  { id: 'DDD-0019', path: 'docs/ddd/0019-project-continuity-context.md', status: 'Accepted' },
+  { id: 'ADR-074', path: 'docs/adr/0074-ruvnet-capability-claim-integrity.md', status: 'Accepted' },
+  { id: 'DDD-0020', path: 'docs/ddd/0020-capability-claim-integrity-context.md', status: 'Accepted' },
+]);
+const proofStrength = (file) => file.startsWith('tests/acceptance/') ? 'packed-artifact'
+  : file.startsWith('tests/integration/') ? 'integration' : file.startsWith('tests/qe/') ? 'candidate-host' : 'unit';
+const make = (id, statement, owner, contributors, implementation, tests, receiptKinds, supportingArchitecture = []) => Object.freeze({
+  id, statement, owner, contributors: Object.freeze(contributors),
+  architecture: Object.freeze(['ADR-072', 'DDD-0018', ...supportingArchitecture]),
+  implementation: Object.freeze(implementation), behaviors: Object.freeze([Object.freeze({
+    id: `${id}.essential`, class: 'essential', commands: Object.freeze(tests.map((file) => `npx vitest run ${file}`)),
+    positive: Object.freeze(tests.map((file) => Object.freeze({ file, strength: proofStrength(file) }))),
+    adversarial: Object.freeze(tests.map((file) => Object.freeze({ file, strength: proofStrength(file) }))),
+    receiptKinds: Object.freeze(receiptKinds),
+  })]),
+});
+export const PRODUCT_INTEGRITY_OBLIGATIONS = Object.freeze([
+  make('S-1', 'One complete public corpus', 'CorpusGeneration', ['SourceCoverage'], ['scripts/source-coverage.mjs', 'scripts/corpus-reconcile.mjs', 'scripts/corpus-candidate.mjs'], ['tests/unit/source-coverage.test.mjs', 'tests/unit/corpus-reconcile.test.mjs'], ['ruvnet-brain-source-observation', 'ruvnet-brain-corpus-candidate']),
+  make('S-2', 'One immutable public release projection', 'ReleaseProjection', ['CorpusGeneration'], ['scripts/build-bundle.mjs', 'scripts/coverage-integrity.mjs', 'scripts/public-inventory.mjs'], ['tests/integration/build-bundle-fence.test.mjs', 'tests/unit/public-inventory.test.mjs'], ['ruvnet-brain-release-coverage']),
+  make('S-3', 'Recall at 10 is at least 98 percent and delta citations are complete', 'PublicVerification', ['SourceCoverage', 'CorpusGeneration'], ['scripts/retrieval-canary.mjs', 'scripts/packed-retrieval-canary.mjs'], ['tests/unit/retrieval-canary.test.mjs', 'tests/unit/packed-retrieval-canary.test.mjs'], ['ruvnet-brain-retrieval-canary-plan', 'ruvnet-brain-retrieval-canary-receipt']),
+  make('S-4', 'Native nightly runs are ordered, idempotent, and retained within budget', 'RefreshLifecycle', [], ['bin/nightly-refresh.mjs', 'plugin/scripts/nightly-scheduler.mjs', 'scripts/nightly-two-run-proof.mjs', 'kb/refresh-run.mjs'], ['tests/unit/nightly-scheduler.test.mjs', 'tests/unit/nightly-two-run-proof.test.mjs'], ['ruvnet-brain-refresh-run', 'ruvnet-brain-native-two-run-nightly-proof']),
+  make('S-5', 'One active corpus preserves private stores and bounded recovery', 'RefreshLifecycle', ['CorpusGeneration'], ['kb/update-storage-transaction.mjs', 'kb/forge-update.mjs', 'kb/brain-profile.mjs', 'bin/install.mjs'], ['tests/unit/update-storage-transaction.test.mjs', 'tests/unit/brain-profile.test.mjs'], ['ruvnet-brain-update-storage-transaction', 'ruvnet-brain-installed-profile']),
+  make('S-6', 'Every supported OS and host loader converges on exact public bytes', 'HostConvergence', ['PublicVerification'], ['scripts/host-registry.mjs', 'scripts/host-install-matrix.mjs', 'scripts/public-verification-aggregate.mjs'], ['tests/unit/host-registry.test.mjs', 'tests/integration/dual-host-install.test.mjs'], ['ruvnet-brain-host-registry', 'ruvnet-brain-public-verification-leaf']),
+  make('S-7', 'Publication ends only after signed public verification', 'PublicVerification', ['ReleaseTransaction'], ['scripts/release-transaction.mjs', 'scripts/public-verification-finalizer.mjs', '.github/workflows/protected-release.yml'], ['tests/qe/release/release-transaction-faults.test.mjs', 'tests/unit/public-verification-finalizer.test.mjs'], ['ruvnet-brain-release-transaction-receipt', 'ruvnet-brain-public-verification-aggregate']),
+  make('S-8', 'Accepted architecture has one executable owner and source-bound trace', 'ProductIntegrityCase', [], ['scripts/product-integrity-contract.mjs', 'scripts/source-scope-receipt.mjs'], ['tests/unit/product-integrity-contract.test.mjs', 'tests/unit/source-scope-receipt.test.mjs'], ['ruvnet-brain-product-integrity-contract', 'ruvnet-brain-product-integrity-trace']),
+  make('S-9', 'Every essential behavior has positive and adversarial proof', 'ProductIntegrityCase', [], ['scripts/product-integrity-contract.mjs', 'scripts/adr-072-completion.mjs'], ['tests/unit/product-integrity-contract.test.mjs', 'tests/unit/adr-072-completion.test.mjs'], ['ruvnet-brain-product-integrity-trace', 'ruvnet-brain-adr-072-completion']),
+  make('S-10', 'Fable 5 and GPT-5.6-Sol review identical immutable inputs', 'ProductIntegrityCase', ['PublicVerification'], ['scripts/public-verification-aggregate.mjs', '.github/workflows/protected-release.yml'], ['tests/unit/public-verification-aggregate.test.mjs', 'tests/unit/protected-release-workflow.test.mjs'], ['ruvnet-brain-independent-review', 'ruvnet-brain-public-verification-aggregate']),
+  make('S-11', 'Project continuity is complete and host-neutral', 'ProductIntegrityCase', ['HostConvergence', 'RefreshLifecycle'], ['plugin/scripts/project-progression-contract.mjs', 'plugin/scripts/project-progression-hook.mjs'], ['tests/unit/project-progression-contract.test.mjs', 'tests/acceptance/cross-host-project-resume.test.mjs'], ['ruvnet-brain-project-progression', 'ruvnet-brain-cross-host-resume'], ['ADR-073', 'DDD-0019']),
+  make('S-12', 'RuvNet capability claims are bound to live evidence before delivery', 'ProductIntegrityCase', ['HostConvergence', 'PublicVerification'], [
+    'plugin/scripts/capability-inventory-receipt.mjs',
+    'plugin/scripts/capability-claim-evidence.mjs',
+    'plugin/scripts/continuation-gate.mjs',
+    'plugin/mcp/managed-cli-interface.mjs',
+    'kb/forge-evidence.mjs',
+  ], [
+    'tests/unit/capability-inventory-receipt.test.mjs',
+    'tests/unit/capability-claim-evidence.test.mjs',
+    'tests/unit/continuation-gate-capability-truth.test.mjs',
+    'tests/unit/managed-cli-interface.test.mjs',
+    'tests/unit/grounding-receipt-lanes.test.mjs',
+    'tests/acceptance/adr-074-packed-capability-claims.acceptance.test.mjs',
+  ], [
+    'ruvnet-brain-capability-inventory',
+    'ruvnet-brain-capability-claim-audit',
+    'ruvnet-brain-source-claim',
+    'ruvnet-brain-live-surface',
+    'ruvnet-brain-capability-claim-aggregate',
+  ], ['ADR-074', 'DDD-0020']),
+]);
+const IDS = Object.freeze(Array.from({ length: 12 }, (_, index) => `S-${index + 1}`));
+const safePath = (value) => typeof value === 'string' && value.length > 0 && !path.isAbsolute(value) && !value.split(/[\\/]/).includes('..');
+
+function validateProcesses(processes) {
+  if (!Array.isArray(processes) || canonicalJson(processes.map(({ id }) => id)) !== canonicalJson(PRODUCT_INTEGRITY_CONTEXTS)) throw new Error('product integrity contract must contain the exact eight processes');
+  const ids = new Set(processes.map(({ id }) => id)); const visiting = new Set(); const visited = new Set();
+  const visit = (id) => { if (visiting.has(id)) throw new Error('product integrity process graph contains a cycle'); if (visited.has(id)) return;
+    visiting.add(id); const row = processes.find((entry) => entry.id === id);
+    if (!Array.isArray(row?.upstream) || new Set(row.upstream).size !== row.upstream.length || row.upstream.some((upstream) => !ids.has(upstream) || upstream === id)) throw new Error(`${id} has invalid upstream processes`);
+    row.upstream.forEach(visit); visiting.delete(id); visited.add(id); };
+  processes.forEach(({ id }) => visit(id));
+}
+
+export function validateProductIntegrityContract(input = {}) {
+  const processes = Array.isArray(input) ? PRODUCT_INTEGRITY_PROCESSES : input.processes || PRODUCT_INTEGRITY_PROCESSES;
+  const obligations = Array.isArray(input) ? input : input.obligations || PRODUCT_INTEGRITY_OBLIGATIONS;
+  const architecture = input.architecture || ARCHITECTURE;
+  validateProcesses(processes);
+  if (!Array.isArray(architecture) || new Set(architecture.map(({ id }) => id)).size !== architecture.length || architecture.some((row) => row.status !== 'Accepted' || !safePath(row.path))) throw new Error('governing architecture is missing or not Accepted');
+  if (!Array.isArray(obligations) || canonicalJson(obligations.map(({ id }) => id)) !== canonicalJson(IDS)) throw new Error('product integrity obligations are missing, duplicated, or out of order');
+  const contexts = new Set(processes.map(({ id }) => id)); const architectureIds = new Set(architecture.map(({ id }) => id)); const behaviorIds = new Set();
+  for (const row of obligations) {
+    if (!contexts.has(row.owner)) throw new Error(`${row.id} has no valid sole owner`);
+    if (!Array.isArray(row.contributors) || new Set(row.contributors).size !== row.contributors.length || row.contributors.some((context) => !contexts.has(context)) || row.contributors.includes(row.owner)) throw new Error(`${row.id} has an invalid contributor`);
+    if (!Array.isArray(row.architecture) || row.architecture.some((id) => !architectureIds.has(id))) throw new Error(`${row.id} has missing architecture`);
+    if (!Array.isArray(row.implementation) || !row.implementation.length || row.implementation.some((file) => !safePath(file))) throw new Error(`${row.id} has no implementation`);
+    if (!Array.isArray(row.behaviors) || !row.behaviors.length) throw new Error(`${row.id} has no behaviors`);
+    for (const behavior of row.behaviors) {
+      if (!behavior.id || behaviorIds.has(behavior.id)) throw new Error(`${row.id} has duplicate behavior identity`); behaviorIds.add(behavior.id);
+      if (!PRODUCT_INTEGRITY_TEST_CLASSES.includes(behavior.class)) throw new Error(`${behavior.id} has invalid test class`);
+      if (behavior.class === 'essential') {
+        for (const field of ['commands', 'positive', 'adversarial', 'receiptKinds']) if (!Array.isArray(behavior[field]) || !behavior[field].length) throw new Error(`${behavior.id} has no ${field}`);
+        for (const proof of [...behavior.positive, ...behavior.adversarial]) if (!safePath(proof.file) || !PRODUCT_INTEGRITY_PROOF_STRENGTH.includes(proof.strength)) throw new Error(`${behavior.id} has invalid proof`);
+      }
+    }
+  }
+  return { schemaVersion: 1, kind: 'ruvnet-brain-product-integrity-contract', architecture,
+    processes: processes.map((row) => ({ ...row, owns: obligations.filter(({ owner }) => owner === row.id).map(({ id }) => id), contributes: obligations.filter(({ contributors }) => contributors.includes(row.id)).map(({ id }) => id) })), obligations };
+}
+
+export function productIntegrityGovernedPaths(contract = validateProductIntegrityContract()) {
+  return [...new Set([...contract.architecture.map(({ path: file }) => file), ...contract.obligations.flatMap(({ implementation, behaviors }) => [...implementation, ...behaviors.flatMap(({ positive, adversarial }) => [...positive, ...adversarial].map(({ file }) => file))])])].sort();
+}
+export function buildProductIntegrityTrace({ root = '.', sourceSha, contract = validateProductIntegrityContract(), inventory } = {}) {
+  if (!/^[a-f0-9]{40}$/.test(String(sourceSha || ''))) throw new Error('product integrity trace requires an exact source SHA');
+  const validated = validateProductIntegrityContract(contract);
+  const unsigned = { schemaVersion: 1, kind: 'ruvnet-brain-product-integrity-trace', sourceSha, contractSha256: digest(validated), sourceScope: buildSourceScopeReceipt({ root, sourceSha, governedPaths: productIntegrityGovernedPaths(validated), inventory }), contract: validated, verdict: 'PASS', untested: [] };
+  return { ...unsigned, traceSha256: digest(unsigned) };
+}
+export function validateProductIntegrityTrace(trace, { root = '.', sourceSha = trace?.sourceSha, inventory } = {}) {
+  const { traceSha256, ...unsigned } = trace || {};
+  if (trace?.schemaVersion !== 1 || trace?.kind !== 'ruvnet-brain-product-integrity-trace' || trace.sourceSha !== sourceSha || trace.verdict !== 'PASS' || canonicalJson(trace.untested) !== '[]' || trace.contractSha256 !== digest(trace.contract) || traceSha256 !== digest(unsigned)) throw new Error('product integrity trace identity is invalid');
+  validateSourceScopeReceipt(trace.sourceScope, { root, inventory });
+  const rebuilt = buildProductIntegrityTrace({ root, sourceSha, contract: trace.contract, inventory });
+  if (canonicalJson(rebuilt) !== canonicalJson(trace)) throw new Error('product integrity trace differs from the exact source');
+  return trace;
+}
+export function renderProductIntegrityTraceMarkdown(contract = validateProductIntegrityContract()) {
+  const lines = ['# ADR-072 generated traceability', '', '> Generated from `scripts/product-integrity-contract.mjs`; do not hand-edit.', '', '## Processes', '', '| Process | Upstream | Owns | Contributes |', '|---|---|---|---|'];
+  for (const row of contract.processes) lines.push(`| ${row.id} | ${row.upstream.join(', ') || '—'} | ${row.owns.join(', ') || '—'} | ${row.contributes.join(', ') || '—'} |`);
+  lines.push('', '## Obligations', '', '| ID | Statement | Owner | Contributors |', '|---|---|---|---|');
+  for (const row of contract.obligations) lines.push(`| ${row.id} | ${row.statement} | ${row.owner} | ${row.contributors.join(', ') || '—'} |`);
+  lines.push('', '## Essential behavior proofs', '', '| Behavior | Positive | Adversarial | Receipts |', '|---|---|---|---|');
+  for (const row of contract.obligations) for (const behavior of row.behaviors.filter(({ class: type }) => type === 'essential')) lines.push(`| ${behavior.id} | ${behavior.positive.map(({ file, strength }) => `${file} (${strength})`).join('<br>')} | ${behavior.adversarial.map(({ file, strength }) => `${file} (${strength})`).join('<br>')} | ${behavior.receiptKinds.join('<br>')} |`);
+  return `${lines.join('\n')}\n`;
+}
+const valueAfter = (argv, flag) => { const index = argv.indexOf(flag); return index >= 0 ? argv[index + 1] : null; };
+export function runProductIntegrityCli(argv = process.argv.slice(2), io = { stdout: process.stdout }) {
+  const known = new Set(['--markdown', '--check-markdown', '--trace', '--source-sha', '--out', '--verify-trace']);
+  if (argv.some((arg) => arg.startsWith('--') && !known.has(arg))) throw new Error('unknown product integrity argument');
+  if (!argv.length) { io.stdout.write(`${canonicalJson(validateProductIntegrityContract())}\n`); return 0; }
+  if (argv.length === 1 && argv[0] === '--markdown') { io.stdout.write(renderProductIntegrityTraceMarkdown()); return 0; }
+  const check = valueAfter(argv, '--check-markdown');
+  if (check) { if (fs.readFileSync(path.resolve(check), 'utf8') !== renderProductIntegrityTraceMarkdown()) throw new Error('generated traceability Markdown differs'); io.stdout.write('product integrity Markdown: PASS\n'); return 0; }
+  const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); const sourceSha = valueAfter(argv, '--source-sha'); const out = valueAfter(argv, '--out');
+  if (argv.includes('--trace') && sourceSha && out) { fs.writeFileSync(path.resolve(out), `${canonicalJson(buildProductIntegrityTrace({ root, sourceSha }))}\n`, { flag: 'wx', mode: 0o600 }); return 0; }
+  const verify = valueAfter(argv, '--verify-trace');
+  if (verify && sourceSha) { const trace = JSON.parse(fs.readFileSync(path.resolve(verify), 'utf8')); validateProductIntegrityTrace(trace, { root, sourceSha }); io.stdout.write(`${canonicalJson({ verdict: 'PASS', traceSha256: trace.traceSha256 })}\n`); return 0; }
+  throw new Error('invalid product integrity argument combination');
+}
+if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) { try { process.exitCode = runProductIntegrityCli(); } catch (error) { console.error(`[product-integrity-contract] ${error.message}`); process.exitCode = 1; } }

package/scripts/public-inventory.mjs

@@ -0,0 +1,4 @@
+// One validator for build, archive, install, update, Console, and public proof.
+// The implementation ships with the plugin so installed activation boundaries execute the exact
+// same byte/inventory checks as release assembly.
+export { validatePublicInventory } from '../plugin/scripts/coverage-integrity.mjs';