ruvnet-brain 4.3.1 → 4.3.8

package/scripts/release-transaction.mjs

@@ -565,7 +565,7 @@ export async function finalizeReleaseTransaction({
         lanes: aggregate.metrics.leaves,
         recallAt10: aggregate.metrics.recallAt10,
         deltaCitationRate: aggregate.metrics.deltaCitationRate,
-        reviewReceipts: aggregate.reviews,
+        reviewReceipts: aggregate.reviews || [],
       },
       npm: snapshot.npm,
       github: snapshot.github,

package/scripts/release.mjs

@@ -29,13 +29,13 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import crypto from 'node:crypto';
-import { validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
+import { validateProtectedPublishEnvironment, validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
 import { runReleaseTransaction } from './release-transaction.mjs';
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
+import { stagedHostVerifier } from './staged-host-verifier.mjs';
 import { verifyPayload } from './release-payload.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const IS_MAIN = path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url);
 const PUBLISH = process.argv.includes('--publish');
 const CORPUS_SEED = process.argv.includes('--corpus-seed');
 let protectedCandidate = null;
@@ -87,9 +87,9 @@ export function runProtectedCorpusSeed({
   root = ROOT,
   run = (command, args, options) => spawnSync(command, args, { encoding: 'utf8', ...options }),
 } = {}) {
-  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_WORKFLOW !== 'protected-release'
-    || env.GITHUB_REPOSITORY !== 'stuinfla/ruvnet-brain') {
-    corpusFailure('publication is allowed only inside the protected-release GitHub workflow for stuinfla/ruvnet-brain');
+  const environmentFailures = validateProtectedPublishEnvironment(env);
+  if (environmentFailures.length) {
+    corpusFailure(environmentFailures.join('; '));
   }
 
   const tag = cliArg(argv, '--corpus-tag');
@@ -190,7 +190,7 @@ export function runProtectedCorpusSeed({
   return { tag, target, repository: repo, archiveSha256, receiptSha256: sha256File(receiptFile) };
 }
 
-if (IS_MAIN && CORPUS_SEED) {
+if (CORPUS_SEED) {
   try {
     const result = runProtectedCorpusSeed();
     console.log(JSON.stringify({ ok: true, mode: 'corpus-seed', ...result }, null, 2));
@@ -198,7 +198,7 @@ if (IS_MAIN && CORPUS_SEED) {
     console.error(error.message);
     process.exitCode = 1;
   }
-} else if (IS_MAIN) {
+} else {
 
 console.log(`\n${c.b('RuvNet Brain — release / definition-of-done')} ${c.dim('· ' + (PUBLISH ? 'PUBLISH' : 'check-only') + ' · shipping ' + V())}\n`);
 
@@ -373,9 +373,6 @@ if (PUBLISH) {
     corpusSeedSha256: crypto.createHash('sha256').update(fs.readFileSync(assets.corpusSeedPath)).digest('hex'),
     generationLedgerSha256: crypto.createHash('sha256').update(fs.readFileSync(assets.generationLedgerPath)).digest('hex'),
   };
-  const identityPath = path.resolve(ROOT, process.env.RUVNET_RELEASE_IDENTITY || 'release-evidence/release-identity.json');
-  if (fs.existsSync(identityPath)) throw new Error(`refusing to overwrite release identity: ${identityPath}`);
-  fs.writeFileSync(identityPath, `${JSON.stringify(identity, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   const privatePem = process.env.RUVNET_SIGNING_KEY;
   if (!privatePem) throw new Error('RUVNET_SIGNING_KEY is required for signed transaction receipts');
   const finalReceipt = await runReleaseTransaction({
@@ -386,12 +383,9 @@ if (PUBLISH) {
     }),
     privateKey: crypto.createPrivateKey(privatePem),
     publicKey: crypto.createPublicKey(fs.readFileSync(path.join(ROOT, 'keys/ruvnet-brain-signing.pub.pem'), 'utf8')),
+    hostVerifier: stagedHostVerifier({ assets, identity }),
   });
   if (finalReceipt.state !== 'channels-converged') throw new Error(`release transaction stopped at ${finalReceipt.state}`);
-  const channelReceiptPath = path.resolve(ROOT,
-    process.env.RUVNET_CHANNEL_RECEIPT || 'release-evidence/channels-converged-receipt.json');
-  if (fs.existsSync(channelReceiptPath)) throw new Error(`refusing to overwrite channel receipt: ${channelReceiptPath}`);
-  fs.writeFileSync(channelReceiptPath, `${JSON.stringify(finalReceipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
 } else {
   step('D', 'remote staged release transaction — SKIPPED (check-only; pass --publish to publish)');
 }
@@ -404,7 +398,7 @@ if (!PUBLISH) {
 }
 
 if (PUBLISH) {
-  console.log(`\n${c.y(c.b('PUBLISHED, NOT VERIFIED'))} — npm and GitHub expose the sealed candidate; public install verification is still required.\n`);
+  console.log(`\n${c.y(c.b('PUBLISHED, NOT VERIFIED'))}`);
 } else {
   console.log(`\n${c.g(c.b('✓✓✓ PREFLIGHT PASS — NOT PUBLISHED'))} — the committed candidate passed every check-only gate.\n`);
 }

package/scripts/retrieval-canary.mjs

@@ -108,14 +108,17 @@ export function validateRetrievalQueryEvidence(evidence) {
   return evidence;
 }
 
-export function verifyQueryOracleSource(queryEvidence, candidateSourceSha, { cwd = process.cwd(), run = spawnSync } = {}) {
+export function verifyQueryOracleSource(queryEvidence, candidateSourceSha, {
+  cwd = process.cwd(), run = spawnSync, allowSquashedSource = false,
+} = {}) {
   validateRetrievalQueryEvidence(queryEvidence);
   if (!HEX40.test(String(candidateSourceSha || '')) || queryEvidence.sourceCommit === candidateSourceSha) {
     throw new Error('query oracle source identity is invalid');
   }
   const ancestor = run('git', ['merge-base', '--is-ancestor', queryEvidence.sourceCommit, candidateSourceSha],
     { cwd, encoding: 'utf8' });
-  if (ancestor.error || ancestor.status !== 0) throw new Error('query oracle source is not a strict candidate ancestor');
+  const strictAncestor = !ancestor.error && ancestor.status === 0;
+  if (!strictAncestor && !allowSquashedSource) throw new Error('query oracle source is not a strict candidate ancestor');
   const shown = run('git', ['show', `${queryEvidence.sourceCommit}:${queryEvidence.sourcePath}`],
     { cwd, encoding: null, maxBuffer: 64 * 1024 * 1024 });
   let sourcePayload;
@@ -184,7 +187,8 @@ export function validateRetrievalCanaryPlan(plan) {
     throw new Error('oracle denominator differs from eligible coverage');
   }
   if (new Set(ids).size !== ids.length) throw new Error('retrieval canary plan has duplicate case ids');
-  if (!plan.cases.some(({ cohort }) => cohort === 'delta') || !plan.cases.some(({ cohort }) => cohort === 'legacy')) {
+  if ((!plan.cases.some(({ cohort }) => cohort === 'delta') && plan.noDelta !== true)
+    || !plan.cases.some(({ cohort }) => cohort === 'legacy')) {
     throw new Error('retrieval canary plan requires delta and legacy cohorts');
   }
   for (const row of plan.cases) {
@@ -236,7 +240,7 @@ export function validatePlanAgainstCoverage(plan, coverage, { allowObservedBasel
   return plan;
 }
 export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, coverageIdentity = null, queryEvidence, assetsDir = '.',
-  readPassages = defaultReadPassages, legacySampleSize } = {}) {
+  readPassages = defaultReadPassages, legacySampleSize, allowNoDelta = false } = {}) {
   const checked = validateCoverageLedger(coverage);
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   const coverageGeneration = coverage.kind === 'ruvnet-brain-release-coverage'
@@ -294,12 +298,15 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
   const eligibleStores = ordered(eligible.map(storeOf));
   if (queryEvidence.queryStoreSetSha256 !== setDigest(eligibleStores)
     || canonicalJson(ordered(Object.keys(queryEvidence.queries))) !== canonicalJson(eligibleStores)) {
-    throw new Error('independent query oracle does not cover the exact eligible store set');
+    const oracleStores = new Set(Object.keys(queryEvidence.queries));
+    const missing = eligibleStores.filter((store) => !oracleStores.has(store));
+    const extra = [...oracleStores].filter((store) => !eligibleStores.includes(store)).sort();
+    throw new Error(`independent query oracle does not cover the exact eligible store set (eligible=${eligibleStores.length}, oracle=${oracleStores.size}, missing=${missing.join(',') || 'none'}, extra=${extra.join(',') || 'none'})`);
   }
   const baselineStores = new Set(baseline.stores.map((name) => String(name).toLowerCase()));
   const delta = eligible.filter((row) => !baselineStores.has(storeOf(row)));
   const legacyPool = eligible.filter((row) => baselineStores.has(storeOf(row)));
-  if (!delta.length || !legacyPool.length) throw new Error('coverage does not establish both failed-seed delta and legacy cohorts');
+  if ((!delta.length && !allowNoDelta) || !legacyPool.length) throw new Error('coverage does not establish both failed-seed delta and legacy cohorts');
   const passages = new Map(eligible.map((row) => [storeOf(row), readPassages(assetsDir, storeOf(row))]));
   const rankedLegacy = legacyPool.map((row) => ({ row, count: passages.get(storeOf(row)).length }))
     .sort((a, b) => a.count - b.count || storeOf(a.row).localeCompare(storeOf(b.row)));
@@ -376,6 +383,7 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
       queryStoreSetSha256: queryEvidence.queryStoreSetSha256,
       sourceCommit: queryEvidence.sourceCommit, sourceBlobSha256: queryEvidence.sourceBlobSha256,
       evidence: structuredClone(queryEvidence) },
+    noDelta: delta.length === 0,
     cohorts: { delta: delta.length, legacy: legacy.length,
       legacyStrata: [...strata.keys()].sort().map((stratum) => ({ stratum,
         population: rankedLegacy.filter((_entry, index) => Math.min(3, Math.floor(index * 4 / rankedLegacy.length)) === stratum).length,

package/scripts/set-version.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// One release version command. The plugin manifest is the only editable source of truth;
+// propagation and verification happen in the same process so a package-only bump cannot drift.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const version = process.argv[2];
+if (!version || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+  console.error('usage: npm run version:set -- X.Y.Z[-channel]');
+  process.exit(2);
+}
+const manifest = path.join(root, 'plugin/.claude-plugin/plugin.json');
+const doc = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+const previous = doc.version;
+doc.version = version;
+fs.writeFileSync(manifest, `${JSON.stringify(doc, null, 2)}\n`);
+const sync = spawnSync(process.execPath, [path.join(root, 'scripts/sync-version.mjs')], {
+  cwd: root, encoding: 'utf8', stdio: 'inherit',
+});
+if (sync.status !== 0) {
+  console.error(`[version:set] propagation failed; source changed ${previous} -> ${version}, run version:sync after fixing the reported error`);
+  process.exit(sync.status || 1);
+}
+const check = spawnSync(process.execPath, [path.join(root, 'scripts/sync-version.mjs'), '--check'], {
+  cwd: root, encoding: 'utf8', stdio: 'inherit',
+});
+if (check.status !== 0) process.exit(check.status || 1);
+console.log(`[version:set] ${previous} -> ${version}; all release surfaces agree`);

package/scripts/source-coverage.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { readRvfGenerations, sha256File } from './rvf-generation.mjs';
 import { canonicalJson, coverageGenerationFor, digest, validateGistAggregateReceipt } from './coverage-integrity.mjs';
+import { repositoryNames } from '../kb/card-lane.mjs';
 
 export { canonicalJson, digest } from './coverage-integrity.mjs';
 
@@ -272,7 +273,15 @@ export function classifyGist(gist, evidence) {
   };
 }
 
-function artifactEvidence(kbDir, ledger, cardStores, name) {
+// ALIAS-AWARE, BECAUSE THE ROUTER IS. `cardStores` holds card HEADINGS; a store reachable only
+// under an alias (e.g. `metaharness` via its `## agent-harness-generator` card) has no heading of
+// its own, so a direct `cardStores.has(store)` reports it card-absent even though the router finds
+// it. `kb/store-root.mjs`'s `darkStores()` and `scripts/brain-score.mjs`'s `readCoverage()` were
+// already fixed for this exact conflation (ADR-058; metaharness is the standing example in both);
+// this sibling computation, which feeds the committed `data/source-coverage.json` and
+// `docs/RUVNET-COVERAGE.md` (ADR-069), never received it. `repositoryNames` is the router's own
+// resolver (kb/card-lane.mjs), imported rather than reimplemented.
+export function artifactEvidence(kbDir, ledger, cardStores, name) {
   const store = storeName(name);
   const receipt = Object.entries(ledger.stores).find(([key]) => key.toLowerCase() === store)?.[1] || null;
   const rvfFile = receipt?.file || `${store}.big.rvf`;
@@ -284,7 +293,7 @@ function artifactEvidence(kbDir, ledger, cardStores, name) {
     bytesVerified: Boolean(rvfPresent && receipt?.sha256 && sha256File(rvfPath) === receipt.sha256),
     passagesPresent: fs.existsSync(path.join(kbDir, `${store}.passages.jsonl`))
       && fs.statSync(path.join(kbDir, `${store}.passages.jsonl`)).size > 0,
-    cardPresent: cardStores.has(store),
+    cardPresent: repositoryNames(store, kbDir).some((alias) => cardStores.has(storeName(alias))),
   };
 }
 

package/scripts/staged-host-verifier.mjs

@@ -3,7 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { runHostMatrix } from './host-install-matrix.mjs';
+import { runHostMatrixAsync } from './host-install-matrix.mjs';
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const locate = (name) => {
@@ -50,7 +50,7 @@ export function stagedHostVerifier({ assets, identity }) {
         // install shape than the one that runs after publication — so the two halves of a release
         // were judging different things and could not be compared. Only the STAGED-vs-PUBLISHED
         // difference is real, and it is now a named variant rather than a second implementation.
-        const matrix = runHostMatrix({
+        const matrix = await runHostMatrixAsync({
           packageRoot: prepared.packageRoot,
           version: identity.version,
           variant: 'staged',

package/scripts/verify-channels.mjs

@@ -97,7 +97,7 @@ async function run() {
     }
     check('npm latest matches shipping version', ok,
       ok ? `npm latest=${latest} · shipping=${V}`
-        : `npm latest=${latest || '(view failed: ' + lastErr + ')'} · shipping=${V}${latest && latest !== V ? '  ← STILL STALE after ~' + (ATTEMPTS * 5) + 's: run `npm publish` + `npm dist-tag add ' + NPM_PKG + '@' + V + ' latest`' : ''}`);
+        : `npm latest=${latest || '(view failed: ' + lastErr + ')'} · shipping=${V}${latest && latest !== V ? '  ← STILL STALE after ~' + (ATTEMPTS * 5) + 's: dispatch the protected-release workflow for the exact candidate SHA' : ''}`);
   }
 
   // 2) the self-update manifest URL actually resolves (the 404 that stranded users)

package/scripts/wired-check.mjs

@@ -95,6 +95,7 @@ const STANDALONE = [
     + 'RVFs to RVF-GENERATIONS.json and optionally prunes legacy sidecars; build-bundle.mjs consumes '
     + 'and validates the resulting manifest, so scheduling this destructive migration would be wrong'],
   ['release', 'the ship path, run by a human'],
+  ['execution-preflight', 'external orchestration boundary — invoked by the host before consequential Ruflo/Codex execution; no in-repo caller exists because the host supplies the live Brain and AgentDB receipts'],
   ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
     + 'isolated writing agent to start and hand off a fix lane. Scheduling it would violate its safety '
     + 'boundary: it prepares evidence but never merges, pushes, publishes, deletes, or cleans worktrees'],