ruvnet-brain 4.3.1 → 4.3.3

package/scripts/retrieval-canary.mjs

@@ -108,14 +108,17 @@ export function validateRetrievalQueryEvidence(evidence) {
   return evidence;
 }
 
-export function verifyQueryOracleSource(queryEvidence, candidateSourceSha, { cwd = process.cwd(), run = spawnSync } = {}) {
+export function verifyQueryOracleSource(queryEvidence, candidateSourceSha, {
+  cwd = process.cwd(), run = spawnSync, allowSquashedSource = false,
+} = {}) {
   validateRetrievalQueryEvidence(queryEvidence);
   if (!HEX40.test(String(candidateSourceSha || '')) || queryEvidence.sourceCommit === candidateSourceSha) {
     throw new Error('query oracle source identity is invalid');
   }
   const ancestor = run('git', ['merge-base', '--is-ancestor', queryEvidence.sourceCommit, candidateSourceSha],
     { cwd, encoding: 'utf8' });
-  if (ancestor.error || ancestor.status !== 0) throw new Error('query oracle source is not a strict candidate ancestor');
+  const strictAncestor = !ancestor.error && ancestor.status === 0;
+  if (!strictAncestor && !allowSquashedSource) throw new Error('query oracle source is not a strict candidate ancestor');
   const shown = run('git', ['show', `${queryEvidence.sourceCommit}:${queryEvidence.sourcePath}`],
     { cwd, encoding: null, maxBuffer: 64 * 1024 * 1024 });
   let sourcePayload;
@@ -184,7 +187,8 @@ export function validateRetrievalCanaryPlan(plan) {
     throw new Error('oracle denominator differs from eligible coverage');
   }
   if (new Set(ids).size !== ids.length) throw new Error('retrieval canary plan has duplicate case ids');
-  if (!plan.cases.some(({ cohort }) => cohort === 'delta') || !plan.cases.some(({ cohort }) => cohort === 'legacy')) {
+  if ((!plan.cases.some(({ cohort }) => cohort === 'delta') && plan.noDelta !== true)
+    || !plan.cases.some(({ cohort }) => cohort === 'legacy')) {
     throw new Error('retrieval canary plan requires delta and legacy cohorts');
   }
   for (const row of plan.cases) {
@@ -236,7 +240,7 @@ export function validatePlanAgainstCoverage(plan, coverage, { allowObservedBasel
   return plan;
 }
 export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, coverageIdentity = null, queryEvidence, assetsDir = '.',
-  readPassages = defaultReadPassages, legacySampleSize } = {}) {
+  readPassages = defaultReadPassages, legacySampleSize, allowNoDelta = false } = {}) {
   const checked = validateCoverageLedger(coverage);
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   const coverageGeneration = coverage.kind === 'ruvnet-brain-release-coverage'
@@ -294,12 +298,15 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
   const eligibleStores = ordered(eligible.map(storeOf));
   if (queryEvidence.queryStoreSetSha256 !== setDigest(eligibleStores)
     || canonicalJson(ordered(Object.keys(queryEvidence.queries))) !== canonicalJson(eligibleStores)) {
-    throw new Error('independent query oracle does not cover the exact eligible store set');
+    const oracleStores = new Set(Object.keys(queryEvidence.queries));
+    const missing = eligibleStores.filter((store) => !oracleStores.has(store));
+    const extra = [...oracleStores].filter((store) => !eligibleStores.includes(store)).sort();
+    throw new Error(`independent query oracle does not cover the exact eligible store set (eligible=${eligibleStores.length}, oracle=${oracleStores.size}, missing=${missing.join(',') || 'none'}, extra=${extra.join(',') || 'none'})`);
   }
   const baselineStores = new Set(baseline.stores.map((name) => String(name).toLowerCase()));
   const delta = eligible.filter((row) => !baselineStores.has(storeOf(row)));
   const legacyPool = eligible.filter((row) => baselineStores.has(storeOf(row)));
-  if (!delta.length || !legacyPool.length) throw new Error('coverage does not establish both failed-seed delta and legacy cohorts');
+  if ((!delta.length && !allowNoDelta) || !legacyPool.length) throw new Error('coverage does not establish both failed-seed delta and legacy cohorts');
   const passages = new Map(eligible.map((row) => [storeOf(row), readPassages(assetsDir, storeOf(row))]));
   const rankedLegacy = legacyPool.map((row) => ({ row, count: passages.get(storeOf(row)).length }))
     .sort((a, b) => a.count - b.count || storeOf(a.row).localeCompare(storeOf(b.row)));
@@ -376,6 +383,7 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
       queryStoreSetSha256: queryEvidence.queryStoreSetSha256,
       sourceCommit: queryEvidence.sourceCommit, sourceBlobSha256: queryEvidence.sourceBlobSha256,
       evidence: structuredClone(queryEvidence) },
+    noDelta: delta.length === 0,
     cohorts: { delta: delta.length, legacy: legacy.length,
       legacyStrata: [...strata.keys()].sort().map((stratum) => ({ stratum,
         population: rankedLegacy.filter((_entry, index) => Math.min(3, Math.floor(index * 4 / rankedLegacy.length)) === stratum).length,

package/scripts/set-version.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// One release version command. The plugin manifest is the only editable source of truth;
+// propagation and verification happen in the same process so a package-only bump cannot drift.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const version = process.argv[2];
+if (!version || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+  console.error('usage: npm run version:set -- X.Y.Z[-channel]');
+  process.exit(2);
+}
+const manifest = path.join(root, 'plugin/.claude-plugin/plugin.json');
+const doc = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+const previous = doc.version;
+doc.version = version;
+fs.writeFileSync(manifest, `${JSON.stringify(doc, null, 2)}\n`);
+const sync = spawnSync(process.execPath, [path.join(root, 'scripts/sync-version.mjs')], {
+  cwd: root, encoding: 'utf8', stdio: 'inherit',
+});
+if (sync.status !== 0) {
+  console.error(`[version:set] propagation failed; source changed ${previous} -> ${version}, run version:sync after fixing the reported error`);
+  process.exit(sync.status || 1);
+}
+const check = spawnSync(process.execPath, [path.join(root, 'scripts/sync-version.mjs'), '--check'], {
+  cwd: root, encoding: 'utf8', stdio: 'inherit',
+});
+if (check.status !== 0) process.exit(check.status || 1);
+console.log(`[version:set] ${previous} -> ${version}; all release surfaces agree`);

package/scripts/verify-channels.mjs

@@ -97,7 +97,7 @@ async function run() {
     }
     check('npm latest matches shipping version', ok,
       ok ? `npm latest=${latest} · shipping=${V}`
-        : `npm latest=${latest || '(view failed: ' + lastErr + ')'} · shipping=${V}${latest && latest !== V ? '  ← STILL STALE after ~' + (ATTEMPTS * 5) + 's: run `npm publish` + `npm dist-tag add ' + NPM_PKG + '@' + V + ' latest`' : ''}`);
+        : `npm latest=${latest || '(view failed: ' + lastErr + ')'} · shipping=${V}${latest && latest !== V ? '  ← STILL STALE after ~' + (ATTEMPTS * 5) + 's: dispatch the protected-release workflow for the exact candidate SHA' : ''}`);
   }
 
   // 2) the self-update manifest URL actually resolves (the 404 that stranded users)