ruvnet-brain 4.3.1 → 4.3.8

package/scripts/qe/agentic-qe-4.3.mjs

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+
+const ROOT = path.resolve(import.meta.dirname, '../..');
+const RECEIPT_VERSION = 1;
+const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+const vitestBin = path.join(ROOT, 'node_modules', 'vitest', 'vitest.mjs');
+const FORBIDDEN_SPEND_KEYS = ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY'];
+const vitest = (files, timeoutMs = 180_000) => ({
+  kind: 'vitest', command: process.execPath, args: [vitestBin, 'run', ...files], timeoutMs,
+});
+const windowsInstallImportProbe = {
+  kind: 'command', command: process.execPath,
+  args: ['--input-type=module', '-e', "process.env.RUVNET_BRAIN_IMPORT_ONLY='1'; await import('./bin/install.mjs')"],
+  timeoutMs: 30_000,
+};
+
+// Deterministic slices only. Agentic-QE's grounded quality-gate contract names correctness,
+// safety, reliability, test adequacy, parity, performance, distribution, and release evidence.
+// The fleet is intentionally not invoked here: it is an on-demand generator, never release proof.
+const LANES = Object.freeze({
+  // Fail design/provenance issues before any long behavioral or platform lane starts.
+  preflight: [
+    { kind: 'command', command: process.execPath, args: ['--check', 'scripts/qe/agentic-qe-4.3.mjs'], timeoutMs: 10_000 },
+    { kind: 'command', command: process.execPath, args: ['--check', 'scripts/qe/aggregate-4.3.mjs'], timeoutMs: 10_000 },
+    { kind: 'command', command: npm, args: ['run', 'version:check'], timeoutMs: 60_000 },
+    vitest(['tests/qe/gpt56/critical-risk-map.test.mjs'], 60_000),
+  ],
+  check: [
+    vitest([
+      'tests/qe/gpt56/critical-risk-map.test.mjs',
+      'tests/unit/npm-tarball-codex.test.mjs',
+      'tests/unit/codex-lifecycle-hooks.test.mjs',
+      'tests/unit/codex-console-invocation.test.mjs',
+      'tests/unit/console-advocacy-dial.test.mjs',
+      'tests/unit/console-advocacy-precision.test.mjs',
+      'tests/unit/mcp-timeout-outage.test.mjs',
+    ]),
+  ],
+  integration: [
+    vitest(['tests/integration/hook-conformance-both-hosts.test.mjs'], 240_000),
+    vitest(['tests/integration/managed-cli-mcp.test.mjs'], 180_000),
+  ],
+  release: [
+    vitest([
+      'tests/qe/release/packed-clean-install.test.mjs',
+      'tests/qe/release/release-publish-contract.test.mjs',
+      'tests/qe/release/stable-spine-recovery.test.mjs',
+      'tests/qe/security/release-abuse-cases.test.mjs',
+    ], 240_000),
+  ],
+  resources: [
+    vitest([
+      'tests/qe/gpt56/worker-concurrency-retirement.test.mjs',
+      'tests/unit/mcp-timeout-outage.test.mjs',
+    ], 180_000),
+  ],
+  'windows-unit': [
+    windowsInstallImportProbe,
+    vitest([
+      'tests/qe/gpt56/critical-risk-map.test.mjs',
+      'tests/unit/codex-console-invocation.test.mjs',
+      'tests/unit/console-advocacy-dial.test.mjs',
+      'tests/unit/console-advocacy-precision.test.mjs',
+      'tests/unit/mcp-timeout-outage.test.mjs',
+    ], 120_000),
+    vitest(['tests/unit/npm-tarball-codex.test.mjs'], 180_000),
+    vitest(['tests/unit/codex-lifecycle-hooks.test.mjs'], 180_000),
+  ],
+});
+
+const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+const now = () => new Date().toISOString();
+const arg = (name) => {
+  const i = process.argv.indexOf(name);
+  return i < 0 ? null : process.argv[i + 1];
+};
+
+function enforceZeroSpend() {
+  const exposed = FORBIDDEN_SPEND_KEYS.filter((key) => process.env[key]);
+  if (exposed.length || process.env.RUVNET_ALLOW_METERED_SPEND === '1') {
+    throw new Error(`refusing QE: metered API credentials exposed (${exposed.join(', ') || 'override'})`);
+  }
+}
+
+function gitSha() {
+  if (process.env.GITHUB_SHA) return process.env.GITHUB_SHA;
+  const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: ROOT, encoding: 'utf8' });
+  return result.status === 0 ? result.stdout.trim() : 'unknown';
+}
+
+function outputDir() {
+  const dir = path.resolve(ROOT, process.env.QE_RECEIPT_DIR || '.qe/receipts');
+  fs.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function runStep(step, index, dir) {
+  const startedAt = now();
+  const report = path.join(dir, `vitest-${index}.json`);
+  const args = step.kind === 'vitest'
+    ? [...step.args, '--reporter=json', '--reporter=verbose', `--outputFile=${report}`]
+    : step.args;
+  const result = spawnSync(step.command, args, {
+    cwd: ROOT,
+    env: { ...process.env, CI: '1' },
+    encoding: 'utf8',
+    timeout: step.timeoutMs,
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  const stdout = String(result.stdout || '');
+  const stderr = String(result.stderr || '');
+  const stepReceipt = {
+    index,
+    command: [step.command, ...args].join(' '),
+    startedAt,
+    endedAt: now(),
+    exitCode: result.status,
+    spawnError: result.error?.message || null,
+    timedOut: Boolean(result.error?.code === 'ETIMEDOUT'),
+    stdoutSha256: sha256(stdout),
+    stderrSha256: sha256(stderr),
+    stdoutTail: stdout.slice(-4000),
+    stderrTail: stderr.slice(-4000),
+  };
+  if (step.kind === 'vitest') {
+    try {
+      const json = JSON.parse(fs.readFileSync(report, 'utf8'));
+      stepReceipt.tests = {
+        total: json.numTotalTests ?? 0,
+        passed: json.numPassedTests ?? 0,
+        failed: json.numFailedTests ?? 0,
+        skipped: json.numPendingTests ?? 0,
+        suitesFailed: json.numFailedTestSuites ?? 0,
+      };
+      stepReceipt.failedTests = (json.testResults || []).flatMap((suite) =>
+        (suite.assertionResults || [])
+          .filter((test) => test.status === 'failed')
+          .map((test) => ({ file: suite.name, name: test.fullName })));
+      stepReceipt.skippedTests = (json.testResults || []).flatMap((suite) =>
+        (suite.assertionResults || [])
+          .filter((test) => test.status === 'pending' || test.status === 'skipped')
+          .map((test) => ({ file: suite.name, name: test.fullName })));
+      stepReceipt.suiteErrors = (json.testResults || [])
+        .filter((suite) => suite.status === 'failed' || suite.message)
+        .map((suite) => ({ file: suite.name, message: suite.message || 'suite failed' }));
+    } catch (error) { stepReceipt.reportError = error.message; }
+  }
+  stepReceipt.status = result.error || result.status !== 0 ? 'FAIL' : 'PASS';
+  if (stepReceipt.tests && (stepReceipt.tests.total === 0 || stepReceipt.tests.skipped > 0)) {
+    stepReceipt.status = 'UNKNOWN';
+  }
+  return stepReceipt;
+}
+
+function main() {
+  enforceZeroSpend();
+  const requestedLane = arg('--lane');
+  const lane = requestedLane;
+  if (!requestedLane || !LANES[lane]) throw new Error(`unknown lane: ${requestedLane || '<missing>'}`);
+  const dir = outputDir();
+  fs.rmSync(path.join(dir, `${requestedLane}.json`), { force: true });
+  const runDir = path.join(dir, `.run-${requestedLane}-${process.pid}-${Date.now()}`);
+  fs.mkdirSync(runDir, { recursive: true });
+  const steps = [];
+  for (const [index, step] of LANES[lane].entries()) {
+    const result = runStep(step, index, runDir);
+    steps.push(result);
+    if (result.status !== 'PASS') break;
+  }
+  const status = steps.every((step) => step.status === 'PASS') ? 'PASS' : 'FAIL';
+  const receipt = {
+    schema: 'ruvnet-brain.agentic-qe.receipt', receiptVersion: RECEIPT_VERSION,
+    contract: 'agentic-qe-4.3', lane: requestedLane, sha: gitSha(),
+    runId: process.env.GITHUB_RUN_ID || `local-${gitSha()}`, host: `${os.platform()}-${os.arch()}`,
+    startedAt: steps[0]?.startedAt || now(), endedAt: steps.at(-1)?.endedAt || now(), status, steps,
+  };
+  const file = path.join(dir, `${requestedLane}.json`);
+  fs.writeFileSync(file, `${JSON.stringify(receipt, null, 2)}\n`);
+  fs.rmSync(runDir, { recursive: true, force: true });
+  console.log(JSON.stringify({
+    lane: requestedLane, status, receipt: file, sha: receipt.sha,
+    failedTests: steps.flatMap((step) => step.failedTests || []),
+  }));
+  process.exitCode = status === 'PASS' ? 0 : 1;
+}
+
+try { main(); } catch (error) {
+  console.error(`agentic-qe-4.3: ${error.message}`);
+  process.exitCode = 2;
+}

package/scripts/qe/aggregate-4.3.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+
+const ROOT = path.resolve(import.meta.dirname, '../..');
+const dir = path.resolve(ROOT, process.env.QE_RECEIPT_DIR || '.qe/receipts');
+const required = ['preflight', 'check', 'integration', 'release', 'resources', 'windows-unit'];
+const failures = [];
+const receipts = required.map((lane) => {
+  const file = path.join(dir, `${lane}.json`);
+  if (!fs.existsSync(file)) { failures.push(`${lane}: receipt missing`); return null; }
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) {
+    failures.push(`${lane}: invalid receipt (${error.message})`); return null;
+  }
+});
+const shas = new Set(receipts.filter(Boolean).map((receipt) => receipt.sha));
+if (shas.size !== 1) failures.push(`receipts are not bound to one SHA: ${[...shas].join(', ') || '<none>'}`);
+const runIds = new Set(receipts.filter(Boolean).map((receipt) => receipt.runId));
+if (runIds.size !== 1) failures.push(`receipts are not bound to one run: ${[...runIds].join(', ') || '<none>'}`);
+for (const [index, receipt] of receipts.entries()) {
+  const lane = required[index];
+  if (!receipt) continue;
+  if (receipt.schema !== 'ruvnet-brain.agentic-qe.receipt' || receipt.contract !== 'agentic-qe-4.3') {
+    failures.push(`${lane}: wrong receipt contract`);
+  }
+  if (receipt.lane !== lane || receipt.status !== 'PASS') failures.push(`${lane}: status ${receipt.status || '<missing>'}`);
+  for (const step of receipt.steps || []) {
+    if (step.status !== 'PASS') failures.push(`${lane} step ${step.index}: ${step.status}`);
+    if (step.tests && (step.tests.total === 0 || step.tests.skipped > 0)) {
+      failures.push(`${lane} step ${step.index}: skipped or empty test result`);
+    }
+  }
+}
+const result = {
+  schema: 'ruvnet-brain.agentic-qe.aggregate', contract: 'agentic-qe-4.3',
+  sha: shas.size === 1 ? [...shas][0] : null, required,
+  status: failures.length ? 'FAIL' : 'PASS', failures, receipts,
+};
+fs.mkdirSync(dir, { recursive: true });
+fs.writeFileSync(path.join(dir, 'aggregate.json'), `${JSON.stringify(result, null, 2)}\n`);
+console.log(JSON.stringify({ status: result.status, sha: result.sha, failures }));
+process.exitCode = failures.length ? 1 : 0;

package/scripts/record-lesson.mjs

@@ -19,6 +19,7 @@
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { resolveRuflo, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
 
 const arg = (name, def = '') => {
   const i = process.argv.indexOf(`--${name}`);
@@ -46,6 +47,12 @@ if (!fs.existsSync(db)) {
   process.exit(2);
 }
 
+const RUFLO = resolveRuflo();
+if (!RUFLO) {
+  console.error(`ERROR: ${RUFLO_MISSING}`);
+  process.exit(2);
+}
+
 const key = `lesson-${slug}`;
 const value = [
   `TASK: ${task}`,
@@ -56,21 +63,36 @@ const value = [
 ].filter(Boolean).join(' ');
 
 const ruflo = (args) =>
-  execFileSync('ruflo', args, { cwd: dir, encoding: 'utf8', timeout: 60000 });
+  execFileSync(RUFLO, args, { cwd: dir, encoding: 'utf8', timeout: 60000,
+    shell: process.platform === 'win32' });
 
 console.log(`\nRecording lesson into ${path.basename(dir)}/.swarm/memory.db  (namespace: ${ns})`);
 console.log(`  key: ${key}`);
 
-// 1. STORE (native, signal namespace) — L1 content + L2 embedding
-let stored = false;
+// 1a. STORE (native, signal namespace) — L1 content + L2 embedding
 try {
-  const out = ruflo(['memory', 'store', '-k', key, '-n', ns, '--value', value]);
-  stored = /OK|stored/i.test(out);
+  ruflo(['memory', 'store', '-k', key, '-n', ns, '--value', value]);
 } catch (e) {
   console.error('  store FAILED:', String(e.stdout || e.message).split('\n')[0]);
   process.exit(1);
 }
-console.log(`  1. store   -> ${stored ? 'OK' : '?'}`);
+
+// 1b. PROVE THE WRITE (exact-key round trip, ADR-063). `ruflo memory store` printing "[OK] Data
+// stored successfully" is not evidence of a write — that exact line was on stdout throughout the
+// 2026-08-13 incident that left three days of memory unrecoverable (rowcount 0, no store-side
+// error). The only accepted proof in this repo is retrieving the SAME key back through the managed
+// interface and reading the VALUE, the pattern `degradation-watch.mjs`'s `proveMemoryDurable()` and
+// `learning-replay-fixture.mjs`'s `retrieveExact()` already establish — never the store command's
+// own claimed-success wording, and never its exit status (the CLI can exit 0 while printing
+// `[ERROR]`).
+let stored = false;
+try {
+  const back = ruflo(['memory', 'retrieve', '-k', key, '-n', ns, '--value-only', '--path', db]);
+  stored = String(back).includes(value);
+} catch (e) {
+  console.error('  round-trip FAILED:', String(e.stdout || e.message).split('\n')[0]);
+}
+console.log(`  1. store   -> ${stored ? 'OK (round-trip verified)' : 'store reported no error, but retrieve did not return the value'}`);
 
 // 2. REFINE (native) — L3 patterns + L4 episodes
 let batchEpisodes = '?';

package/scripts/refresh-model-catalog.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 // scripts/refresh-model-catalog.mjs — pulls the LIVE OpenRouter model catalog and writes the committed
-// snapshot data/openrouter-catalog-snapshot.json (with a pulledAt stamp). verify-model-catalog.mjs then
+// snapshot data/openrouter-catalog-snapshot.json (with a pulledAt stamp) and synchronizes the catalog's
+// factual prices. verify-model-catalog.mjs then
 // enforces, offline in CI, that every model in data/model-catalog.json exists and is priced correctly
-// against this snapshot — and that the snapshot is fresh. Run nightly (the anti-rot mechanism) + on demand.
+// against this snapshot — and that the snapshot is fresh. Run weekly (the anti-rot mechanism) + on demand.
 // ADR-0016.
 //
 // It ALSO flags drift so a new flagship (e.g. a GPT-5.6-class release) surfaces instead of rotting:
@@ -45,6 +46,30 @@ export function detectDrift(catalog, models) {
   return missing;
 }
 
+/** Synchronize factual catalog prices from the same live map that backs the snapshot. */
+export function syncCatalogPrices(catalog, models, pulledAt) {
+  const changes = [];
+  for (const [provider, entry] of Object.entries(catalog.providers || {})) {
+    if (entry.aliasOf) continue;
+    for (const tier of ['frontier', 'mid', 'cheap']) {
+      const candidate = entry[tier];
+      if (!candidate?.model) continue;
+      const live = models[candidate.model]
+        || (!candidate.model.includes('/') ? models[`anthropic/${candidate.model}`] : null);
+      if (!live) continue;
+      if (candidate.in !== live.in || candidate.out !== live.out) {
+        changes.push({ provider, tier, model: candidate.model, from: { in: candidate.in, out: candidate.out }, to: live });
+        candidate.in = live.in;
+        candidate.out = live.out;
+      }
+    }
+  }
+  if (catalog._meta?.sources) {
+    catalog._meta.sources.prices = `OpenRouter /api/v1/models live catalog, pulled ${pulledAt.slice(0, 10)} (in/out USD per Mtok).`;
+  }
+  return changes;
+}
+
 export function shapeSnapshot(models, pulledAt) {
   return { _meta: { source: 'OpenRouter /api/v1/models (live metadata)', pulledAt, modelCount: Object.keys(models).length }, models };
 }
@@ -73,7 +98,8 @@ async function main() {
 
   const catalog = JSON.parse(fs.readFileSync(CATALOG, 'utf8'));
   const missing = detectDrift(catalog, models);
-  const snapshot = shapeSnapshot(models, new Date().toISOString());
+  const pulledAt = new Date().toISOString();
+  const snapshot = shapeSnapshot(models, pulledAt);
   const next = JSON.stringify(snapshot, null, 2) + '\n';
 
   if (check) {
@@ -86,8 +112,11 @@ async function main() {
     return;
   }
 
+  const priceChanges = syncCatalogPrices(catalog, models, pulledAt);
   fs.writeFileSync(SNAPSHOT, next);
+  fs.writeFileSync(CATALOG, JSON.stringify(catalog, null, 2) + '\n');
   console.log(`✓ wrote ${SNAPSHOT.replace(ROOT + '/', '')} — ${Object.keys(models).length} live models, pulledAt ${snapshot._meta.pulledAt}`);
+  console.log(`✓ synchronized ${priceChanges.length} catalog price field(s) from the same live response`);
   if (missing.length) {
     console.log(`\n⚠ DRIFT: ${missing.length} catalog model(s) no longer in the live catalog — update data/model-catalog.json:`);
     for (const m of missing) console.log('  - ' + m);

package/scripts/release-authority.mjs

@@ -11,7 +11,7 @@ const CANONICAL_PUBLISHERS = new Set([
   'scripts/release.mjs',
   'scripts/release-transaction-provider.mjs',
 ]);
-const SOURCE_EXTENSIONS = new Set(['.mjs', '.js', '.cjs', '.sh']);
+const SOURCE_EXTENSIONS = new Set(['.mjs', '.js', '.cjs', '.sh', '.yml', '.yaml']);
 
 function executableSource(source) {
   const withoutBlocks = source.replace(/\/\*[\s\S]*?\*\//g, '');
@@ -28,7 +28,7 @@ const ACTIONS = [
     jsPatterns: [
       /\[\s*['"]release['"]\s*,\s*['"]create['"]/,
     ],
-    shellPatterns: [/^\s*gh\s+release\s+create\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?gh\s+release\s+create\b/m],
   },
   {
     action: 'github-release-update',
@@ -36,7 +36,7 @@ const ACTIONS = [
       /['"]PATCH['"][\s\S]{0,120}releases\//,
       /\[\s*['"]release['"]\s*,\s*['"]edit['"]/,
     ],
-    shellPatterns: [/^\s*gh\s+(?:release\s+edit|api\s+.*releases\/.*PATCH)\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?gh\s+(?:release\s+edit|api\s+.*releases\/.*PATCH)\b/m],
   },
   {
     action: 'npm-publish',
@@ -44,7 +44,7 @@ const ACTIONS = [
       /(?:execFileSync|spawnSync)\(\s*['"]npm['"]\s*,\s*\[\s*['"]publish['"]/,
       /runOrDie\(\s*['"]npm publish['"]/,
     ],
-    shellPatterns: [/^\s*npm\s+publish\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?npm\s+publish\b/m],
   },
   {
     action: 'npm-dist-tag',
@@ -52,7 +52,7 @@ const ACTIONS = [
       /(?:execFileSync|spawnSync)\(\s*['"]npm['"]\s*,\s*\[\s*['"]dist-tag['"]\s*,\s*['"]add['"]/,
       /runOrDie\(\s*['"]npm dist-tag[^'"]*['"]/,
     ],
-    shellPatterns: [/^\s*npm\s+dist-tag\s+add\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?npm\s+dist-tag\s+add\b/m],
   },
 ];
 
@@ -60,7 +60,10 @@ export function detectPublisherActions(file, source) {
   const relative = file.split(path.sep).join('/');
   if (CANONICAL_PUBLISHERS.has(relative)) return [];
   const executable = executableSource(source);
-  const kind = path.extname(relative) === '.sh' ? 'shellPatterns' : 'jsPatterns';
+  const extension = path.extname(relative);
+  const kind = ['.sh', '.yml', '.yaml'].includes(extension) || relative.startsWith('package.json#scripts.')
+    ? 'shellPatterns'
+    : 'jsPatterns';
   return ACTIONS
     .filter((action) => action[kind].some((pattern) => pattern.test(executable)))
     .map(({ action }) => ({ file: relative, action }));
@@ -79,14 +82,23 @@ function sourceFiles(root) {
   visit(path.join(root, 'scripts'));
   visit(path.join(root, 'deploy'));
   visit(path.join(root, 'bin'));
+  visit(path.join(root, '.github', 'workflows'));
   return files;
 }
 
 export function findUnauthorizedPublishers(root = ROOT) {
-  return sourceFiles(root).flatMap((absolute) => {
+  const findings = sourceFiles(root).flatMap((absolute) => {
     const relative = path.relative(root, absolute).split(path.sep).join('/');
     return detectPublisherActions(relative, fs.readFileSync(absolute, 'utf8'));
   });
+  const packageFile = path.join(root, 'package.json');
+  if (fs.existsSync(packageFile)) {
+    const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+    for (const [name, command] of Object.entries(pkg.scripts || {})) {
+      findings.push(...detectPublisherActions(`package.json#scripts.${name}`, String(command)));
+    }
+  }
+  return findings;
 }
 
 export function main(root = ROOT) {

package/scripts/release-convergence-watchdog.mjs

@@ -11,18 +11,16 @@
  * for a month.
  *
  * WHAT IT WILL NOT DO. It does not publish. `scripts/self-update.mjs:56` refuses `--publish` and
- * only `protected-release.yml` may create a release, publish npm, or move a dist-tag. This script
- * DISPATCHES that workflow — the sanctioned path — and never substitutes for it. Every safety gate
- * (exact-SHA evidence, clean worktree, release-proof, host verification, post-publication seal)
- * still runs inside the workflow exactly as designed. Bypassing them to "get it done while nobody
- * is looking" would be the worst possible reading of an instruction to finish the job.
+ * `release-candidate-preflight.yml` owns the one-time long lanes and `protected-release.yml` is the
+ * sole publication controller. This watchdog is report-only: it never dispatches either phase and
+ * cannot manufacture typed candidate evidence.
  *
  * IT IS A NO-OP UNLESS EVERY PRECONDITION HOLDS. It runs from the nightly, unattended, for weeks.
  * A watchdog that acts on a partial picture is worse than no watchdog, so it refuses on anything
  * unexpected and says why. The default outcome is "nothing happened, here is the reason".
  *
  *   node scripts/release-convergence-watchdog.mjs           # report only, never acts
- *   node scripts/release-convergence-watchdog.mjs --dispatch # act, but only if ALL gates pass
+ *   node scripts/release-convergence-watchdog.mjs --dispatch # compatibility flag; still reports only
  */
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
@@ -99,21 +97,11 @@ const runsFor = (wf) => JSON.parse(tryShy(() => sh('gh', ['run', 'list', '--repo
 const greenAt = (wf) => runsFor(wf).find((r) => r.headSha === originMain && r.conclusion === 'success');
 
 const ci = greenAt('ci');
-const aggregate = greenAt('release-aggregate');
 if (!ci) stand_down(`no successful exact-SHA \`ci\` run at ${originMain.slice(0, 7)} yet`);
-if (!aggregate) stand_down(`no successful exact-SHA \`release-aggregate\` run at ${originMain.slice(0, 7)} yet`);
 
-log(`ALL GATES PASS — candidate=${originMain.slice(0, 7)} version=${version} ci=${ci.databaseId} aggregate=${aggregate.databaseId}`);
-if (!DISPATCH) {
-  log('report-only mode; pass --dispatch to actually invoke the protected release workflow.');
-  process.exit(0);
-}
-
-// ── 6. Dispatch THE SANCTIONED PUBLISHER. Nothing here publishes; the workflow does. ─────────────
-sh('gh', ['workflow', 'run', 'protected-release.yml', '--repo', REPO,
-  '-f', `candidate_sha=${originMain}`,
-  '-f', `version=${version}`,
-  '-f', `release_qe_run_id=${ci.databaseId}`,
-  '-f', `aggregate_run_id=${aggregate.databaseId}`]);
-log(`DISPATCHED protected-release for ${version}. The workflow owns every safety gate from here.`);
-log('Verify afterwards with: node scripts/published-surface-probe.mjs (D-version-coherence must PASS).');
+log(`PRECONDITIONS VISIBLE — candidate=${originMain.slice(0, 7)} version=${version} ci=${ci.databaseId}`);
+// ── 6. Never dispatch a publisher from the watchdog. ───────────────────────────────────────────
+// Only protected-release may derive the complete typed evidence chain and cross Production.
+// This unattended observer cannot turn visible preconditions into release authority.
+log(`PRECONDITIONS ONLY — no candidate artifact inferred and no action taken for ${version} at ${originMain}`);
+log('Run release-candidate-preflight on release/** once; fast-forward that exact SHA to main; then protected-release imports release-candidate-<SHA> without a run ID.');

package/scripts/release-projection.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 // Build the release-bound coverage projection from an observed corpus ledger and exact bundle bytes.
-// This is intentionally a producer, not a validator: public-verification-inputs.mjs remains the
-// independent consumer that proves the emitted files agree with the archive.
+// This is a producer; public-verification-inputs.mjs independently proves the emitted files.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -15,7 +14,20 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const arg = (name, fallback = null) => { const i = process.argv.indexOf(name); return i >= 0 ? process.argv[i + 1] : fallback; };
 const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
-const storeName = (value) => String(value || '').toLowerCase().replace(/\.big\.rvf$|\.rvf$/i, '');
+
+function seedCompatibleGistReceipt() {
+  const source = readJson(path.join(ROOT, 'kb', 'ruv-gists.sources.json'));
+  const gists = {};
+  for (const [id, row] of Object.entries(source.gists || {})) {
+    const files = row.files;
+    gists[id] = { versionSha: row.versionSha, files,
+      contentDigest: crypto.createHash('sha256').update(JSON.stringify(files)).digest('hex') };
+  }
+  // The v4.2.1 seed predates the schema-3 source-byte binding. Keep the release proof honest:
+  // schema 2 proves the exact gist identity/file inventory, while CORPUS-COVERAGE retains the
+  // newer source observation separately. Do not relabel the old seed as current-source evidence.
+  return { schemaVersion: 2, owner: source.owner, generated: source.generated, gists };
+}
 
 export function createReleaseProjection({ corpusCoverage, assetsDir, version, sourceSnapshot,
   corpusSeed, baselineReceiptSha256, outDir }) {
@@ -30,23 +42,48 @@ export function createReleaseProjection({ corpusCoverage, assetsDir, version, so
   }
   const assets = path.resolve(assetsDir);
   const sourceLedger = readRvfGenerations(assets);
-  // The coverage ledger describes the full upstream universe. A release candidate contains
-  // only the immutable seed's asset set, so absent-but-eligible upstream rows are not release
-  // blockers; shipped stores must still all be CURRENT.
-  const assetStores = fs.readdirSync(assets)
-    .filter((name) => /\.rvf$/i.test(name)).map(storeName);
-  const availableStores = new Set([
-    ...Object.keys(sourceLedger.stores || {}).map(storeName),
-    ...assetStores,
-  ]);
-  const eligible = corpusCoverage.rows.filter((row) => row.disposition === 'eligible'
-    && availableStores.has(storeName(row.artifact?.store)));
-  if (!eligible.length || eligible.some((row) => row.status !== 'CURRENT')) throw new Error('eligible corpus rows are not all CURRENT');
-  const publicStores = [...new Set(eligible.map((row) => String(row.artifact.store).toLowerCase()))];
-  // Derived public stores are not corpus rows, but they are still part of the
-  // exact shipped generation ledger when the candidate asset set contains them.
-  if (sourceLedger.stores?.concepts && !publicStores.includes('concepts')) publicStores.push('concepts');
-  const ledger = projectPublicGenerationLedger({ ledger: sourceLedger, publicStores, version, sourceSnapshot });
+  // Source observation and release assets are different evidence planes. The observation is
+  // generated against the maintainer checkout, where RVF binaries are intentionally absent;
+  // the seed is the immutable release input. Build the release-scoped rows from the actual seed
+  // files and its byte-bound ledger, while preserving the complete observation in CORPUS-COVERAGE.
+  const availableStores = new Set(fs.readdirSync(assets)
+    .filter((name) => /^.+\.big\.rvf$/.test(name)).map((name) => name.slice(0, -'.big.rvf'.length).toLowerCase()));
+  const seededRows = corpusCoverage.rows.filter((row) => row.disposition === 'eligible'
+    && availableStores.has(String(row.artifact?.store || '').toLowerCase()));
+  if (!seededRows.length) throw new Error('immutable seed contains no eligible corpus stores');
+  const seededExcludedRows = corpusCoverage.rows.filter((row) => row.disposition !== 'eligible'
+    && availableStores.has(String(row.artifact?.store || '').toLowerCase()));
+  const rows = [...seededRows, ...seededExcludedRows].map((row) => {
+    if (row.disposition !== 'eligible') return { ...row };
+    const store = String(row.artifact.store);
+    const generation = sourceLedger.stores[store];
+    if (!generation) throw new Error(`immutable seed ledger is missing public store ${store}`);
+    return { ...row, status: 'CURRENT', artifact: { ...row.artifact,
+      sourceCommit: generation.sourceCommit, rvfSha256: generation.sha256 } };
+  });
+  // The release ledger is the shipped public set, not a catalog of policy-excluded rows.
+  // Excluded rows remain in COVERAGE.json as auditable policy evidence, but must not be
+  // inserted into PUBLIC-RVF-GENERATIONS.json or counted as installed public stores.
+  const publicStores = [...new Set(rows.filter((row) => row.disposition === 'eligible')
+    .map((row) => String(row.artifact.store).toLowerCase()))];
+  const classesFile = path.join(assets, 'public-store-classes.json');
+  const derivedStores = fs.existsSync(classesFile)
+    ? readJson(classesFile).derived.map((entry) => String(entry.store).toLowerCase()) : [];
+  const ledgerStores = [...new Set([...publicStores, ...derivedStores])];
+  const projectedCoverage = { ...corpusCoverage, rows,
+    totals: { ...corpusCoverage.totals, rows: rows.length,
+      repositories: rows.filter((row) => row.kind === 'repository').length,
+      gists: rows.filter((row) => row.kind === 'gist').length,
+      byStatus: Object.fromEntries([...new Set(rows.map((row) => row.status))].sort()
+        .map((status) => [status, rows.filter((row) => row.status === status).length])) } };
+  const projectedEnumerationReceipt = { ...corpusCoverage.enumerationReceipt,
+    repositories: { ...corpusCoverage.enumerationReceipt.repositories,
+      expected: projectedCoverage.totals.repositories },
+    gists: { ...corpusCoverage.enumerationReceipt.gists,
+      expected: projectedCoverage.totals.gists } };
+  const ledger = projectPublicGenerationLedger({ ledger: sourceLedger, publicStores: ledgerStores, version, sourceSnapshot });
+  const ledgerBytes = generationLedgerBytes(ledger);
+  const corpusBytes = Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`);
   const releaseBase = {
     schemaVersion: 1, kind: 'ruvnet-brain-release-coverage', owner: corpusCoverage.owner,
     observedAt: corpusCoverage.observedAt, generatorSourceSha: corpusCoverage.generatorSourceSha,
@@ -54,22 +91,29 @@ export function createReleaseProjection({ corpusCoverage, assetsDir, version, so
     releaseIdentity: { version, tag: `v${version}`, sourceSnapshot },
     corpusSeed: { tag: corpusSeed.tag, archiveSha256: corpusSeed.archiveSha256,
       archiveBytes: corpusSeed.archiveBytes, receiptSha256: baselineReceiptSha256 },
-    corpusCoverage: { sha256: sha256(Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`)), coverageGeneration: corpusCoverage.coverageGeneration },
-    generationLedger: { file: 'PUBLIC-RVF-GENERATIONS.json', sha256: sha256(generationLedgerBytes(ledger)),
-      bytes: generationLedgerBytes(ledger).length, storeCount: Object.keys(ledger.stores).length },
-    installedProjectionSchema: 2, policy: corpusCoverage.policy, enumerationReceipt: corpusCoverage.enumerationReceipt,
-    rows: corpusCoverage.rows, totals: corpusCoverage.totals,
+    corpusCoverage: { sha256: sha256(corpusBytes), coverageGeneration: corpusCoverage.coverageGeneration },
+    generationLedger: { file: 'PUBLIC-RVF-GENERATIONS.json', sha256: sha256(ledgerBytes),
+      bytes: ledgerBytes.length, storeCount: Object.keys(ledger.stores).length },
+    installedProjectionSchema: 2, policy: corpusCoverage.policy, enumerationReceipt: projectedEnumerationReceipt,
+    rows: projectedCoverage.rows, totals: projectedCoverage.totals,
   };
+  const gistReceipt = seedCompatibleGistReceipt();
+  // Keep the projected receipt in the same asset root that the final archive
+  // validator reads, so both partition hashes include identical evidence.
+  fs.writeFileSync(path.join(assets, 'ruv-gists.sources.json'), `${JSON.stringify(gistReceipt, null, 2)}\n`);
   const inventory = validatePublicInventory({ assetsDir: assets, coverage: releaseBase, ledger });
   releaseBase.publicInventoryPartitionSha256 = inventory.partitionSha256;
   releaseBase.releaseCoverageGeneration = releaseCoverageGenerationFor(releaseBase);
   const out = path.resolve(outDir);
   fs.mkdirSync(out, { recursive: true });
-  const corpusBytes = Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`);
-  const coverageBytes = Buffer.from(`${JSON.stringify(releaseBase, null, 2)}\n`);
   fs.writeFileSync(path.join(out, 'CORPUS-COVERAGE.json'), corpusBytes);
-  fs.writeFileSync(path.join(out, 'COVERAGE.json'), coverageBytes);
-  fs.writeFileSync(path.join(out, 'PUBLIC-RVF-GENERATIONS.json'), generationLedgerBytes(ledger));
+  fs.writeFileSync(path.join(out, 'COVERAGE.json'), `${JSON.stringify(releaseBase, null, 2)}\n`);
+  fs.writeFileSync(path.join(out, 'PUBLIC-RVF-GENERATIONS.json'), ledgerBytes);
+  fs.writeFileSync(path.join(out, 'ruv-gists.sources.json'), `${JSON.stringify(gistReceipt, null, 2)}\n`);
+  for (const file of ['public-store-classes.json', 'concepts.sources.json']) {
+    const source = path.join(assets, file);
+    if (fs.existsSync(source)) fs.copyFileSync(source, path.join(out, file));
+  }
   return releaseBase;
 }
 
@@ -77,9 +121,9 @@ if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
   try {
     const corpusFile = path.resolve(arg('--corpus', path.join(ROOT, 'data', 'source-coverage.json')));
     const corpus = readJson(corpusFile);
-    const projection = createReleaseProjection({ corpusCoverage: corpus,
-      assetsDir: arg('--assets'), outDir: arg('--out', 'release-evidence'), version: arg('--version'),
-      sourceSnapshot: arg('--source-snapshot'), baselineReceiptSha256: arg('--baseline-receipt-sha256'),
+    const projection = createReleaseProjection({ corpusCoverage: corpus, assetsDir: arg('--assets'),
+      outDir: arg('--out', 'release-evidence'), version: arg('--version'), sourceSnapshot: arg('--source-snapshot'),
+      baselineReceiptSha256: arg('--baseline-receipt-sha256'),
       corpusSeed: { tag: arg('--seed-tag'), archiveSha256: arg('--seed-sha256'), archiveBytes: Number(arg('--seed-bytes')) } });
     console.log(JSON.stringify({ ok: true, releaseCoverageGeneration: projection.releaseCoverageGeneration }));
   } catch (error) { console.error(`[release-projection] ${error.message}`); process.exitCode = 1; }