ruvnet-brain 4.3.1 → 4.3.8

package/scripts/prepublication-evidence.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { aggregateEvidence } from './release-evidence-aggregate.mjs';
+import { canonicalJson } from './release-transaction.mjs';
+import { EXCLUSION_POLICY } from './integration-evidence.mjs';
+
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+
+function readJson(file) {
+  const bytes = fs.readFileSync(file);
+  return { value: JSON.parse(bytes), digest: sha256(bytes) };
+}
+
+function requireExactSet(actual, expected, label) {
+  const got = [...actual].sort();
+  const want = [...expected].sort();
+  if (canonicalJson(got) !== canonicalJson(want)) {
+    throw new Error(`${label} differs: expected ${want.join(', ')}, got ${got.join(', ')}`);
+  }
+}
+
+function passLeaf({ name, sha, payloadId, source, receiptSha256, ...details }) {
+  const validated = /^[a-f0-9]{64}$/.test(receiptSha256 || '');
+  return {
+    name,
+    sha,
+    payloadId,
+    status: validated ? 'completed' : 'failed',
+    conclusion: validated ? 'success' : 'failure',
+    verdict: validated ? 'PASS' : 'FAIL',
+    source,
+    receiptSha256,
+    ...details,
+  };
+}
+
+export function buildPrepublicationEvidence({
+  sha,
+  version,
+  runId,
+  manifestFile,
+  payloadProofFile,
+  hostFile,
+  ciFile,
+  integrationFile,
+  uxFiles,
+  strangerFile,
+}) {
+  if (!/^[a-f0-9]{40}$/.test(sha || '') || !/^\d+\.\d+\.\d+$/.test(version || '') || !Number.isSafeInteger(runId) || runId <= 0) {
+    throw new Error('prepublication identity is malformed');
+  }
+
+  const manifestBytes = fs.readFileSync(manifestFile);
+  const manifest = JSON.parse(manifestBytes);
+  const payload = JSON.parse(fs.readFileSync(payloadProofFile));
+  if (manifest.candidateSha !== sha || manifest.version !== version || manifest.tag !== `v${version}`) {
+    throw new Error('candidate manifest identity mismatch');
+  }
+  if (!/^[a-f0-9]{64}$/.test(payload.payloadId || '')) throw new Error('payload identity is malformed');
+
+  const host = readJson(hostFile);
+  if (host.value.schemaVersion !== 1 || host.value.sha !== sha || host.value.payloadId !== payload.payloadId
+    || !/^[a-f0-9]{64}$/.test(host.value.artifactSha256 || '') || host.value.leaves?.length !== 3) {
+    throw new Error('candidate host evidence identity or shape mismatch');
+  }
+  requireExactSet(host.value.leaves.map(({ name }) => name), ['claude-only', 'codex-only', 'dual-host'], 'candidate host leaves');
+  for (const leaf of host.value.leaves) {
+    const grounding = leaf.grounding;
+    const grounded = grounding && ['repo', 'path', 'file', 'storedPath']
+      .every((field) => typeof grounding[field] === 'string' && grounding[field].trim());
+    if (leaf.sha !== sha || leaf.payloadId !== payload.payloadId || leaf.status !== 'completed'
+      || leaf.conclusion !== 'success' || leaf.verdict !== 'PASS'
+      || leaf.functionalSearch !== true || leaf.searchExit !== 0 || !grounded
+      || leaf.artifactSha256 !== host.value.artifactSha256) {
+      throw new Error(`candidate host leaf is not an exact PASS: ${leaf.name || '(missing)'}`);
+    }
+  }
+
+  const ci = readJson(ciFile);
+  const requiredCiJobs = ['candidate-preflight', 'check', 'windows-unit', 'warm-brain', 'release-qe'];
+  if (ci.value.schemaVersion !== 1 || ci.value.kind !== 'ruvnet-brain-candidate-ci-evidence'
+    || ci.value.sourceSha !== sha || ci.value.version !== version || ci.value.payloadId !== payload.payloadId
+    || ci.value.payloadManifestSha256 !== sha256(manifestBytes) || ci.value.workflow !== 'ci'
+    || ci.value.runId !== runId || ci.value.verdict !== 'PASS' || ci.value.skipped !== 0 || ci.value.unknown !== 0) {
+    throw new Error('candidate CI receipt identity or verdict mismatch');
+  }
+  requireExactSet(ci.value.jobs?.map(({ name }) => name) || [], requiredCiJobs, 'candidate CI jobs');
+  if (ci.value.jobs.some(({ conclusion }) => conclusion !== 'success')) throw new Error('candidate CI receipt contains a non-success job');
+
+  const integration = readJson(integrationFile);
+  if (integration.value.schemaVersion !== 1 || integration.value.kind !== 'ruvnet-brain-integration-evidence'
+    || integration.value.sourceSha !== sha || integration.value.workflow !== 'integration-linux'
+    || integration.value.runId !== runId || integration.value.verdict !== 'PASS'
+    || integration.value.total <= 0
+    || integration.value.passed + Number(integration.value.todo || 0) + Number(integration.value.skipped || 0) !== integration.value.total
+    || integration.value.failed !== 0
+    || !Array.isArray(integration.value.skippedTests)
+    || integration.value.skippedTests.length !== integration.value.skipped
+    || integration.value.skippedTests.some((name) => typeof name !== 'string' || !name.trim())) {
+    throw new Error('integration receipt is not an exact, fully accounted PASS');
+  }
+  if (integration.value.exclusionPolicy !== EXCLUSION_POLICY
+    || !Array.isArray(integration.value.todoTests)
+    || integration.value.todoTests.length !== Number(integration.value.todo || 0)
+    || !/^[a-f0-9]{64}$/.test(integration.value.exclusionsSha256 || '')) {
+    throw new Error('integration receipt exclusions are not governed and fully enumerated');
+  }
+
+  if (!Array.isArray(uxFiles) || uxFiles.length !== 3) throw new Error('exactly three UX receipts are required');
+  const ux = uxFiles.map(readJson);
+  requireExactSet(ux.map(({ value }) => value.platform), ['darwin', 'linux', 'win32'], 'UX platforms');
+  for (const receipt of ux) {
+    const value = receipt.value;
+    if (value.schemaVersion !== 1 || value.suite !== 'ruvnet-brain-ux-qe' || value.gitSha !== sha
+      || value.pass !== true || !Array.isArray(value.hardFailures) || value.hardFailures.length !== 0) {
+      throw new Error(`UX receipt is not an exact PASS: ${value.platform || '(missing)'}`);
+    }
+  }
+  const uxDigest = sha256(Buffer.from(canonicalJson(ux.map(({ value, digest }) => ({ platform: value.platform, digest }))
+    .sort((a, b) => a.platform.localeCompare(b.platform)))));
+
+  const stranger = readJson(strangerFile);
+  const strangerJobs = ['ubuntu', 'macos', 'windows-gitbash', 'windows-powershell', 'hostile'];
+  if (stranger.value.schemaVersion !== 1 || stranger.value.sha !== sha || stranger.value.payloadId !== payload.payloadId
+    || Number(stranger.value.sourceCiRunId) !== runId || Number(stranger.value.strangerRunId) !== runId
+    || stranger.value.verdict !== 'PASS') {
+    throw new Error('stranger receipt identity or verdict mismatch');
+  }
+  requireExactSet(stranger.value.jobs || [], strangerJobs, 'stranger jobs');
+
+  const common = { sha, payloadId: payload.payloadId, runId };
+  const leaves = [
+    passLeaf({ ...common, name: 'source-quality', source: 'candidate-ci-receipt:check', receiptSha256: ci.digest }),
+    passLeaf({ ...common, name: 'ux-qe', source: 'ux-qe-receipts:darwin,linux,win32', receiptSha256: uxDigest }),
+    passLeaf({ ...common, name: 'release-qe', source: 'candidate-ci-receipt:release-qe', receiptSha256: ci.digest }),
+    passLeaf({ ...common, name: 'integration-linux', source: 'integration-receipt', receiptSha256: integration.digest,
+      skipped: integration.value.skipped, todo: integration.value.todo }),
+    passLeaf({ ...common, name: 'stranger-linux', source: 'stranger-receipt:ubuntu', receiptSha256: stranger.digest }),
+    passLeaf({ ...common, name: 'stranger-macos', source: 'stranger-receipt:macos', receiptSha256: stranger.digest }),
+    passLeaf({ ...common, name: 'stranger-windows', source: 'stranger-receipt:windows', receiptSha256: stranger.digest }),
+    ...host.value.leaves.map((leaf) => ({ ...leaf, runId, receiptSha256: host.digest })),
+  ];
+  return { leaves, envelope: aggregateEvidence({ sha, payloadId: payload.payloadId, leaves }) };
+}
+
+const isCli = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isCli) {
+  const arg = (name) => {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? process.argv[index + 1] : null;
+  };
+  const uxDir = path.resolve(arg('--ux-dir'));
+  const uxFiles = fs.readdirSync(uxDir).filter((name) => name.endsWith('.json')).sort().map((name) => path.join(uxDir, name));
+  const result = buildPrepublicationEvidence({
+    sha: arg('--sha'),
+    version: arg('--version'),
+    runId: Number(arg('--run-id')),
+    manifestFile: path.resolve(arg('--manifest')),
+    payloadProofFile: path.resolve(arg('--payload-proof')),
+    hostFile: path.resolve(arg('--hosts')),
+    ciFile: path.resolve(arg('--ci')),
+    integrationFile: path.resolve(arg('--integration')),
+    uxFiles,
+    strangerFile: path.resolve(arg('--stranger')),
+  });
+  const leavesOut = path.resolve(arg('--leaves-out'));
+  const envelopeOut = path.resolve(arg('--envelope-out'));
+  fs.writeFileSync(leavesOut, `${JSON.stringify(result.leaves, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+  fs.writeFileSync(envelopeOut, `${canonicalJson(result.envelope)}\n`, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ verdict: result.envelope.verdict, evidenceDigest: result.envelope.evidenceDigest })}\n`);
+}

package/scripts/protected-release-invocation.mjs

@@ -4,6 +4,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt } from './release-proof.mjs';
 import { getVersion } from './version.mjs';
 
@@ -13,12 +14,27 @@ export const PROTECTED_VERSION = getVersion();
 const hex = (value, length) => new RegExp(`^[0-9a-f]{${length}}$`).test(String(value || ''));
 const digestOf = (receipt) => String(receipt?.artifact?.sha256 || '').replace(/^sha256:/, '');
 
-export function validateProtectedPublishInvocation({ root = process.cwd(), env = process.env } = {}) {
+export function validatePublishableVersion(version) {
+  return /^\d+\.\d+\.\d+$/.test(String(version || ''))
+    ? []
+    : ['development versions cannot be published'];
+}
+
+export function validateProtectedPublishEnvironment(env = process.env) {
   const failures = [];
-  let releaseMode = 'unknown';
-  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_WORKFLOW !== PROTECTED_WORKFLOW) {
-    failures.push('publication is allowed only inside the protected-release GitHub workflow');
+  if (env.GITHUB_ACTIONS !== 'true'
+    || env.GITHUB_WORKFLOW !== PROTECTED_WORKFLOW
+    || env.GITHUB_REPOSITORY !== 'stuinfla/ruvnet-brain'
+    || env.GITHUB_EVENT_NAME !== 'workflow_dispatch'
+    || env.GITHUB_REF_PROTECTED !== 'true') {
+    failures.push('publication is allowed only inside the protected-release GitHub workflow on a protected workflow_dispatch ref');
   }
+  return failures;
+}
+
+export function validateProtectedPublishInvocation({ root = process.cwd(), env = process.env } = {}) {
+  const failures = [...validateProtectedPublishEnvironment(env)];
+  let releaseMode = 'unknown';
 
   const expectedSha = String(env.RUVNET_EXPECTED_SHA || '');
   const expectedDigest = String(env.RUVNET_EXPECTED_ARTIFACT_SHA256 || '').replace(/^sha256:/, '');
@@ -26,6 +42,7 @@ export function validateProtectedPublishInvocation({ root = process.cwd(), env =
   if (!hex(expectedSha, 40)) failures.push('expected candidate SHA is missing or malformed');
   if (!hex(expectedDigest, 64)) failures.push('expected artifact digest is missing or malformed');
   if (expectedVersion !== PROTECTED_VERSION) failures.push(`release generation must be ${PROTECTED_VERSION}`);
+  failures.push(...validatePublishableVersion(expectedVersion));
 
   const receiptRelative = String(env.RUVNET_CANDIDATE_RECEIPT || '');
   const evidenceRoot = path.resolve(root, 'release-evidence');
@@ -74,3 +91,14 @@ export function validateProtectedPublishInvocation({ root = process.cwd(), env =
     failures,
   };
 }
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
+  const result = validateProtectedPublishInvocation();
+  if (result.verdict !== 'PASS') {
+    console.error('[protected-release] publication refused:');
+    for (const failure of result.failures) console.error(`  - ${failure}`);
+    process.exitCode = 1;
+  } else {
+    console.log('[protected-release] exact candidate publication authority verified');
+  }
+}

package/scripts/public-verification-aggregate.mjs

@@ -133,7 +133,7 @@ const identityOf = (leaf) => ({
   releaseTransactionId: leaf.releaseTransactionId,
 });
 
-export function buildPublicVerificationAggregate(leaves, reviews) {
+export function buildPublicVerificationAggregate(leaves) {
   if (!Array.isArray(leaves) || leaves.length !== PUBLIC_VERIFICATION_OS.length * PUBLIC_VERIFICATION_MODES.length) {
     throw new Error('public verification requires exactly nine leaves');
   }
@@ -159,32 +159,20 @@ export function buildPublicVerificationAggregate(leaves, reviews) {
     deltaCases: delta.length,
     deltaHits: delta.filter(({ retrievalHit }) => retrievalHit === true).length,
     recallAt10: retrievalCases.filter(({ retrievalHit }) => retrievalHit === true).length / retrievalCases.length,
-    deltaCitationRate: delta.filter(({ retrievalHit, citationResolved }) => retrievalHit === true && citationResolved === true).length / delta.length,
+    // A release with no corpus delta has no delta citations to score; the sealed
+    // retrieval plan carries noDelta=true and still requires the legacy cohort.
+    deltaCitationRate: delta.length === 0 ? 1 : delta.filter(({ retrievalHit, citationResolved }) => retrievalHit === true && citationResolved === true).length / delta.length,
     skipped: leaves.reduce((sum, leaf) => sum + leaf.skipped + leaf.retrieval.metrics.skipped, 0),
     unknown: leaves.reduce((sum, leaf) => sum + leaf.unknown + leaf.retrieval.metrics.unknown, 0),
   };
   if (metrics.recallAt10 < 0.98 || metrics.deltaCitationRate !== 1 || metrics.skipped || metrics.unknown) {
     throw new Error('public verification aggregate retrieval acceptance failed');
   }
-  if (!Array.isArray(reviews) || reviews.length !== REQUIRED_REVIEW_MODELS.length) {
-    throw new Error('public verification aggregate requires exactly two independent reviews');
-  }
-  reviews.forEach(validateIndependentReviewReceipt);
-  const byModel = new Map(reviews.map((review) => [review.model, review]));
-  if (byModel.size !== REQUIRED_REVIEW_MODELS.length || REQUIRED_REVIEW_MODELS.some((model) => !byModel.has(model))) {
-    throw new Error('required independent review models are missing or duplicated');
-  }
-  const firstReview = byModel.get(REQUIRED_REVIEW_MODELS[0]);
-  const semanticIdentity = validateReviewOracleAgainstPlan(firstReview, first.retrievalPlan);
-  for (const model of REQUIRED_REVIEW_MODELS) {
-    const review = byModel.get(model);
-    const semantic = validateReviewOracleAgainstPlan(review, first.retrievalPlan);
-    if (review.sourceSha !== identity.sourceSha || review.artifactSha256 !== identity.artifactSha256
-      || review.payloadId !== identity.payloadId || review.productContractSha256 !== firstReview.productContractSha256
-      || review.rubricSha256 !== firstReview.rubricSha256
-      || semantic.recordSetSha256 !== semanticIdentity.recordSetSha256) {
-      throw new Error(`${model} review identity, rubric, or oracle identity differs`);
-    }
+  const oracle = first.retrievalPlan.oracle;
+  if (!oracle || !HEX64.test(String(oracle.receiptSha256 || ''))
+    || !HEX64.test(String(oracle.queryStoreSetSha256 || ''))
+    || oracle.queryStoreSetSha256 !== digest(first.retrievalPlan.denominator.eligibleStores)) {
+    throw new Error('sealed retrieval oracle identity is incomplete');
   }
   return {
     schemaVersion: 1,
@@ -192,17 +180,11 @@ export function buildPublicVerificationAggregate(leaves, reviews) {
     identity,
     coverage: first.coverage,
     lanes: required.map((lane) => ({ lane, leafSha256: byLane.get(lane).leafSha256 })),
-    reviews: REQUIRED_REVIEW_MODELS.map((model) => ({ model, receiptSha256: byModel.get(model).receiptSha256,
-      score: byModel.get(model).score })),
-    evidence: { leaves: required.map((lane) => structuredClone(byLane.get(lane))),
-      reviews: REQUIRED_REVIEW_MODELS.map((model) => structuredClone(byModel.get(model))) },
-    productContractSha256: firstReview.productContractSha256,
-    rubricSha256: firstReview.rubricSha256,
+    evidence: { leaves: required.map((lane) => structuredClone(byLane.get(lane))) },
     retrievalOracle: {
-      oracleReceiptSha256: semanticIdentity.oracleReceiptSha256,
-      queryStoreSetSha256: semanticIdentity.queryStoreSetSha256,
-      recordCount: semanticIdentity.recordCount,
-      recordSetSha256: semanticIdentity.recordSetSha256,
+      oracleReceiptSha256: oracle.receiptSha256,
+      queryStoreSetSha256: oracle.queryStoreSetSha256,
+      recordCount: first.retrievalPlan.denominator.eligibleStores.length,
     },
     metrics,
     verdict: 'PASS',
@@ -210,8 +192,8 @@ export function buildPublicVerificationAggregate(leaves, reviews) {
   };
 }
 
-export function signPublicVerificationAggregate({ leaves, reviews }, privateKey) {
-  const payload = buildPublicVerificationAggregate(leaves, reviews);
+export function signPublicVerificationAggregate({ leaves }, privateKey) {
+  const payload = buildPublicVerificationAggregate(leaves);
   const aggregateSha256 = digest(payload);
   const signed = { ...payload, aggregateSha256 };
   return { ...signed, signature: crypto.sign(null, Buffer.from(canonicalJson(signed)), privateKey).toString('base64') };
@@ -225,10 +207,10 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
   }
   const payload = aggregatePayload(aggregate);
   if (digest(payload) !== aggregate.aggregateSha256) throw new Error('public verification aggregate digest mismatch');
-  if (!Array.isArray(aggregate.evidence?.leaves) || !Array.isArray(aggregate.evidence?.reviews)) {
-    throw new Error('public verification aggregate lacks raw leaf or review evidence');
+  if (!Array.isArray(aggregate.evidence?.leaves)) {
+    throw new Error('public verification aggregate lacks raw leaf evidence');
   }
-  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves, aggregate.evidence.reviews);
+  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves);
   if (canonicalJson(rebuilt) !== canonicalJson(payload)) {
     throw new Error('public verification aggregate differs from rebuilt raw evidence');
   }
@@ -247,17 +229,10 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
     || aggregate.coverage.gistCurrent !== aggregate.coverage.gistTotal) {
     throw new Error('public verification aggregate evidence is incomplete');
   }
-  if (aggregate.reviews?.length !== REQUIRED_REVIEW_MODELS.length
-    || REQUIRED_REVIEW_MODELS.some((model) => !aggregate.reviews.some((row) => row.model === model
-      && Number.isInteger(row.score) && row.score >= 95 && HEX64.test(String(row.receiptSha256 || ''))))
-    || !HEX64.test(String(aggregate.productContractSha256 || '')) || !HEX64.test(String(aggregate.rubricSha256 || ''))) {
-    throw new Error('public verification aggregate reviews are incomplete');
-  }
   if (aggregate.retrievalOracle?.oracleReceiptSha256 !== aggregate.evidence.leaves[0].retrievalPlan.oracle.receiptSha256
     || aggregate.retrievalOracle?.queryStoreSetSha256 !== aggregate.evidence.leaves[0].retrievalPlan.oracle.queryStoreSetSha256
-    || aggregate.retrievalOracle?.recordCount !== aggregate.evidence.leaves[0].retrievalPlan.denominator.eligibleStores.length
-    || !HEX64.test(String(aggregate.retrievalOracle?.recordSetSha256 || ''))) {
-    throw new Error('public verification aggregate retrieval oracle review is incomplete');
+    || aggregate.retrievalOracle?.recordCount !== aggregate.evidence.leaves[0].retrievalPlan.denominator.eligibleStores.length) {
+    throw new Error('public verification aggregate retrieval oracle identity is incomplete');
   }
   if (expectedIdentity && canonicalJson(aggregate.identity) !== canonicalJson(expectedIdentity)) {
     throw new Error('public verification aggregate identity differs from the release transaction');
@@ -270,13 +245,13 @@ function parseCliArgs(argv) {
   for (let index = 0; index < argv.length; index += 2) {
     const flag = argv[index];
     const value = argv[index + 1];
-    if (!['--lanes', '--reviews', '--out'].includes(flag) || !value) {
-      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --reviews <dir> --out <file>');
+    if (!['--lanes', '--out'].includes(flag) || !value) {
+      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
     }
     parsed[flag.slice(2)] = value;
   }
-  if (!parsed.lanes || !parsed.reviews || !parsed.out || Object.keys(parsed).length !== 3) {
-    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --reviews <dir> --out <file>');
+  if (!parsed.lanes || !parsed.out || Object.keys(parsed).length !== 2) {
+    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
   }
   return parsed;
 }
@@ -312,12 +287,11 @@ function readLaneLeaves(directory) {
   return PUBLIC_VERIFICATION_OS.flatMap((osName) => byOs.get(osName));
 }
 
-export function generatePublicVerificationAggregate({ lanesDirectory, reviewsDirectory, outputFile, privateKey }) {
+export function generatePublicVerificationAggregate({ lanesDirectory, outputFile, privateKey }) {
   if (!privateKey) throw new Error('RUVNET_SIGNING_KEY is required');
   if (fs.existsSync(outputFile)) throw new Error(`refusing to overwrite existing aggregate: ${outputFile}`);
   const leaves = readLaneLeaves(lanesDirectory);
-  const reviews = readExactJsonFiles(reviewsDirectory, REQUIRED_REVIEW_MODELS.length, 'review');
-  const aggregate = signPublicVerificationAggregate({ leaves, reviews }, privateKey);
+  const aggregate = signPublicVerificationAggregate({ leaves }, privateKey);
   fs.writeFileSync(outputFile, `${JSON.stringify(aggregate, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   return aggregate;
 }
@@ -326,12 +300,11 @@ async function main() {
   const options = parseCliArgs(process.argv.slice(2));
   const aggregate = generatePublicVerificationAggregate({
     lanesDirectory: options.lanes,
-    reviewsDirectory: options.reviews,
     outputFile: options.out,
     privateKey: process.env.RUVNET_SIGNING_KEY,
   });
   process.stdout.write(`${JSON.stringify({ ok: true, aggregateSha256: aggregate.aggregateSha256,
-    leaves: aggregate.metrics.leaves, reviews: aggregate.reviews.length })}\n`);
+    leaves: aggregate.metrics.leaves })}\n`);
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/scripts/public-verification-inputs.mjs

@@ -148,7 +148,7 @@ function validateCandidate({ root, bundleFile, packageFile }) {
   const inventory = validatePublicInventory({ assetsDir: root, coverage, ledger });
   if (inventory.publicStores.length !== storeCount
     || inventory.partitionSha256 !== coverage.publicInventoryPartitionSha256) {
-    fail('candidate public inventory partition differs from release coverage');
+    fail(`candidate public inventory partition differs from release coverage (inventory=${inventory.partitionSha256}, coverage=${coverage.publicInventoryPartitionSha256}, stores=${inventory.publicStores.length}/${storeCount})`);
   }
   const coverageIdentity = { sha256: crypto.createHash('sha256').update(coverageBytes).digest('hex'), bytes: coverageBytes.length };
   const candidate = {
@@ -412,10 +412,12 @@ export async function createPublicVerificationInputs({ baselineBundle, candidate
       stores: baselineStores, storeCount: baselineStores.length };
     const { value: queryEvidence } = readJson(oraclePath, 'independent strict-ancestor query oracle');
     validateRetrievalQueryEvidence(queryEvidence);
-    verifyQueryOracleSource(queryEvidence, candidateResult.candidate.sourceSha, { cwd: path.resolve(repo) });
+  verifyQueryOracleSource(queryEvidence, candidateResult.candidate.sourceSha, {
+    cwd: path.resolve(repo), allowSquashedSource: true,
+  });
     const plan = buildRetrievalCanaryPlan({ coverage: candidateResult.coverage, baseline,
       candidate: candidateResult.candidate, coverageIdentity: candidateResult.coverageIdentity,
-      queryEvidence, assetsDir: candidateTree.root });
+      queryEvidence, assetsDir: candidateTree.root, allowNoDelta: true });
     writeExactOutputs(outDir, {
       [baselineMode === 'observed' ? 'baseline-observation-receipt.json' : 'baseline-verification-receipt.json']: baselineProof.bytes,
       'COVERAGE.json': candidateResult.coverageBytes,

package/scripts/qa-runner.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// Canonical bounded QA runner. Local and CI use the same lanes, command order, timeout policy,
+// and machine-readable receipt; a human log is never the release verdict.
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const release = process.argv.includes('--release');
+const timeoutMs = Number(process.env.QA_TIMEOUT_MS || (release ? 15 * 60_000 : 8 * 60_000));
+const lanes = [
+  ['version', 'npm', ['run', 'version:check']],
+  ['convergence', 'npm', ['run', 'convergence:check']],
+  ['execution-policy', 'npm', ['run', 'execution-policy:check']],
+  ['docs', 'npm', ['run', 'doc:currency']],
+  ['wiring', 'npm', ['run', 'wired:check']],
+  ['substitution', 'npm', ['run', 'substitution:check']],
+  ['catalog', 'npm', ['run', 'catalog:verify']],
+  ['contract', 'npx', ['vitest', 'run',
+    'tests/unit/brain-off.test.mjs',
+    'tests/unit/hook-hardening.test.mjs',
+    'tests/unit/hook-battery.test.mjs',
+    'tests/unit/session-start-core-parity.test.mjs',
+    'tests/unit/lesson-gate.test.mjs',
+    'tests/unit/wired-check.test.mjs',
+    'tests/unit/no-restated-truth.test.mjs',
+    'tests/unit/verify-citation.test.mjs',
+    'tests/unit/eval-brain-gate.test.mjs',
+    'tests/unit/distill-project.test.mjs',
+    'tests/unit/record-lesson.test.mjs',
+    'tests/unit/learn-capture-project-root.test.mjs',
+    'tests/unit/codex-claude-hook-parity.test.mjs',
+    'tests/unit/brain-stamp-resolve-built-from-sha.test.mjs',
+    'tests/unit/qa-runner-concurrency.test.mjs',
+    'tests/unit/execution-preflight.test.mjs',
+    '--reporter=dot']],
+  ['mesh', 'npm', ['run', 'test:mesh']],
+  ['plugin', 'npm', ['test']],
+  ...(release ? [['mutation', 'npm', ['run', 'test:mutation']], ['claims', 'npm', ['run', 'claims:verify']], ['integration', 'npm', ['run', 'test:integration']]] : []),
+];
+const receiptDir = path.join(root, '.qa');
+fs.mkdirSync(receiptDir, { recursive: true });
+const started = new Date().toISOString();
+const sha = (() => {
+  try { return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim(); }
+  catch { return null; }
+})();
+const run = ([name, command, args]) => new Promise((resolve) => {
+  const begin = Date.now();
+  const child = spawn(command, args, { cwd: root, env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false });
+  let stdout = '', stderr = '', timedOut = false;
+  child.stdout.on('data', (chunk) => { stdout += chunk; process.stdout.write(chunk); });
+  child.stderr.on('data', (chunk) => { stderr += chunk; process.stderr.write(chunk); });
+  const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); setTimeout(() => child.kill('SIGKILL'), 2000).unref(); }, timeoutMs);
+  child.on('close', (code, signal) => {
+    clearTimeout(timer);
+    resolve({ name, command: [command, ...args].join(' '), status: timedOut ? 'TIMEOUT' : code === 0 ? 'PASS' : 'FAIL', exitCode: code, signal, elapsedMs: Date.now() - begin, stdoutTail: stdout.slice(-4000), stderrTail: stderr.slice(-4000) });
+  });
+});
+// Every lane is independent. Run the complete set concurrently so one failure does not hide
+// later failures and force a serial fix-rerun cycle. The aggregate receipt remains the single
+// verdict, while each lane keeps its own evidence for targeted repair.
+const results = await Promise.all(lanes.map(async (lane) => {
+  const result = await run(lane);
+  fs.writeFileSync(path.join(receiptDir, `${result.name}.json`), `${JSON.stringify({ schema: 'ruvnet-brain.qa.lane', sha, ...result }, null, 2)}\n`);
+  return result;
+}));
+const receipt = { schema: 'ruvnet-brain.qa.aggregate', contract: release ? 'release' : 'pr', sha, started, ended: new Date().toISOString(), status: results.every((r) => r.status === 'PASS') && results.length === lanes.length ? 'PASS' : 'FAIL', requiredLanes: lanes.map(([name]) => name), results };
+fs.writeFileSync(path.join(receiptDir, 'aggregate.json'), `${JSON.stringify(receipt, null, 2)}\n`);
+console.log(JSON.stringify({ status: receipt.status, sha, lanes: results.map(({ name, status, elapsedMs }) => ({ name, status, elapsedMs })) }));
+process.exit(receipt.status === 'PASS' ? 0 : 1);