ruvnet-brain 4.3.10 → 4.3.13

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.10 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.10-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.13 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.13-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.10",
+  "version": "4.3.13",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "version:set": "node scripts/set-version.mjs",
     "qa:pr": "node scripts/qa-runner.mjs",
     "maintenance": "node scripts/development-maintenance.mjs",
-    "qa:release": "node scripts/qa-runner.mjs --release",
+    "qa:release": "npm run version:check && npm run release:authority && npm exec -- vitest run --config tests/qe/release/vitest.config.mjs --maxWorkers=1",
     "release:authority": "node scripts/release-authority.mjs",
     "card-from-source": "node scripts/card-from-source.mjs",
     "release-abort-stale": "node scripts/release-abort-stale.mjs",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships an enforced UserPromptSubmit retrieve-and-inject grounding hook that sharply reduces drift.",
-  "version": "4.3.10",
+  "version": "4.3.13",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.10",
+  "version": "4.3.13",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/nightly-scheduler.mjs

@@ -310,6 +310,17 @@ const xmlDecode = value => value.replace(/&#(?:x([a-f0-9]+)|([0-9]+));|&(amp|lt|
     : ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" })[named.toLowerCase()]);
 const onlyXmlMatch = (xml, pattern) => { const hits = [...xml.matchAll(pattern)]; return hits.length === 1 ? hits[0][1] : null; };
 const windowsArguments = record => `"${record.runnerPath}" --registration "${record.recordPath}"`;
+function windowsTaskXml(record) {
+  const boundary = new Date(Date.now() + 60_000).toISOString();
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Author>RuvNet Brain</Author></RegistrationInfo>
+  <Triggers><CalendarTrigger><StartBoundary>${boundary}</StartBoundary><Enabled>true</Enabled><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger></Triggers>
+  <Principals><Principal id="Author"><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><StartWhenAvailable>true</StartWhenAvailable><ExecutionTimeLimit>PT1H</ExecutionTimeLimit></Settings>
+  <Actions Context="Author"><Exec><Command>${xmlEscape(record.nodePath)}</Command><Arguments>${xmlEscape(windowsArguments(record))}</Arguments></Exec></Actions>
+</Task>`;
+}
 function exactWindowsCommand(xml, record) {
   const actions = onlyXmlMatch(xml, /<Actions(?:\s[^>]*)?>([\s\S]*?)<\/Actions>/g);
   if (actions === null || actions.replace(/<Exec(?:\s[^>]*)?>[\s\S]*?<\/Exec>/g, '').trim()) return false;
@@ -393,8 +404,22 @@ export function installScheduler(record, { platform = process.platform, env = pr
     return { ok: true, artifact, already: false };
   }
   const taskCommand = `"${record.nodePath}" ${windowsArguments(record)}`;
-  const created = run('schtasks', ['/Create', '/SC', 'DAILY', '/TN', record.identity, '/TR', taskCommand,
-    '/ST', `${String(NIGHTLY_HOUR).padStart(2, '0')}:${String(NIGHTLY_MINUTE).padStart(2, '0')}`, '/F'], { encoding: 'utf8' });
+  let created;
+  if (testMode) {
+    // The fixture adapter models the legacy /TR call; keep it isolated from the machine path.
+    created = run('schtasks', ['/Create', '/SC', 'DAILY', '/TN', record.identity, '/TR', taskCommand,
+      '/ST', `${String(NIGHTLY_HOUR).padStart(2, '0')}:${String(NIGHTLY_MINUTE).padStart(2, '0')}`, '/F'], { encoding: 'utf8' });
+  } else {
+    // schtasks /TR rejects commands longer than 261 characters. Importing equivalent XML keeps the
+    // exact Node executable and argument identity while allowing long temporary/user paths.
+    const xmlPath = path.join(path.dirname(record.recordPath), `${record.identity}.task.xml`);
+    // schtasks requires a UTF-16LE BOM when importing XML; without it Windows
+    // reports the otherwise valid document as "one root element" malformed.
+    const xmlBytes = Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(windowsTaskXml(record), 'utf16le')]);
+    fs.writeFileSync(xmlPath, xmlBytes, { flag: 'wx' });
+    try { created = run('schtasks', ['/Create', '/XML', xmlPath, '/TN', record.identity, '/F'], { encoding: 'utf8' }); }
+    finally { fs.rmSync(xmlPath, { force: true }); }
+  }
   if (created.error || created.status !== 0) return { ok: false, artifact, why: created.error?.message || String(created.stderr || `exit ${created.status}`).trim() };
   return { ok: true, artifact, already: false };
 }

package/plugin/skills/release-proof/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: release-proof
 description: Fail-closed exact-artifact release and deployment authority. Use before saying a release is ready, pushing a release commit, publishing npm packages, creating GitHub releases, deploying production, closing release-blocking issues, or claiming all gates are green. Requires clean immutable lineage, zero labeled release blockers, exact-SHA GitHub success, nonzero no-skip QE, packed-artifact host tests, installed Brain/RVF proof, and post-publication byte verification.
-updated: 2026-09-04
+updated: 2026-09-07
 ---
 
 # Release Proof
@@ -23,7 +23,11 @@ green.
 7. Require the source package, Claude manifest, Codex manifest, packed npm version, bundle
    `brainVersion`/`releaseTag`, and both installed host versions to identify one exact generation.
 8. Require the active Brain registry to contain the `ruvnet-brain` RVF store and require narrow,
-   broad, and concurrent cited searches to complete within 80% of their deadline.
+   broad, and concurrent cited candidate searches to complete within 80% of their deadline.
+   For fresh public stabilization verification, `stabilization-public-deadline-v1` requires the
+   first cited search in every host mode and the Brain probe within the enforced 30-second
+   deadline. The 24-second headroom target remains a performance follow-up, not promotion authority.
+   Receipts without this named policy retain the legacy 80% rule; failed runs are not relabeled.
 9. Publish only through the protected release workflow. Never run `npm publish` or `gh release
    create` locally.
 10. After publication, download npm and GitHub artifacts, compare their bytes with the seal, install

package/plugin/skills/release-proof/references/receipt-contract.md

@@ -1,6 +1,6 @@
 # Receipt contract
 
-Updated: 2026-09-04
+Updated: 2026-09-07
 
 The authority accepts only typed receipt schemas. The candidate receipts are emitted by
 `release-candidate-preflight` and imported by `protected-release`; publication receipts are emitted
@@ -38,9 +38,38 @@ Required bindings:
   and installed Claude/Codex versions
 - npm and GitHub release bytes matching the candidate digest
 - clean installed Claude and Codex results from the public package
-- installed Brain self-RVF and broad search within 80 percent of deadline
+- installed Brain self-RVF and measured first cited searches within the declared acceptance policy
+- `acceptancePolicy: stabilization-public-deadline-v1` requires a fixed 30,000ms deadline and
+  finite, nonnegative host and Brain timings at or below it; larger budgets are rejected
+- receipts without that policy retain the legacy 80-percent margin; unknown policies fail
 - successful exact-SHA `published-surface-probe`
 
+Stuart authorized a materially improved stabilization release on September 7, rather than
+requiring every historical performance goal for promotion. The public runtime already enforces
+a 30-second deadline. The new policy removes only the additional 24-second promotion margin.
+It does not replace first-search timings with warm timings or reduce retrieval, citation,
+artifact-integrity, native-update, or host-installation requirements. Fresh signed evidence is
+required; prior failed workflows remain failed.
+
+Native update verification suppresses optional npm command shims only during the initial
+reader installation (`npm_config_bin_links=false`). The scheduler retains npm's default
+command-shim behavior, which `npx` requires. The receipt records this installation configuration.
+The default reader install creates a `semver` symlink that 4.3.10's updater rejects; fixing that
+default-install compatibility remains a follow-up. Symlink rejection is not bypassed.
+
+The native scheduler executes its actual production target, `ruvnet-brain@latest`. A fresh isolated
+npm cache is prepared and its package files must match the verified public tarball installation.
+Exactly one cached Brain package is allowed. Full package tree observations before and after each
+of two scheduled runs, plus each run's actual desired version, bind the execution evidence to the
+published package. The consumer validates these observations and their time bounds. A changed
+latest version or changed package bytes fails the proof. Dependencies are outside the package-tree
+comparison. The two runs verify the already-current update path; they do not establish fallback
+reinstallation or new upstream corpus generation. Only empty installer-created preserved
+directories are removed in the disposable fixture; populated or linked entries are retained and
+still fail duplicate-copy acceptance. Storage observations wait for the refresh owner to exit
+and its lock to be removed. The second run may add only measured receipt and bounded log bytes;
+any other managed-storage growth remains a failure.
+
 Before provider mutation, `protected-release` revalidates the imported candidate receipt, package
 payload, source binding, and digest against current `origin/main`. It consumes the long-lane proof;
 it does not rerun CI, integration, UX, or stranger qualification.

package/plugin/skills/release-proof/scripts/release-proof.mjs

@@ -169,15 +169,24 @@ export function evaluatePublicationReceipt(candidate, publication) {
     const item = publication?.[surface];
     if (item?.sha !== sha || item?.artifactSha256 !== digest) failures.push(fail('PUBLIC_ARTIFACT_MISMATCH', `${surface} differs from candidate seal`));
   }
+  const stabilization = publication?.acceptancePolicy === 'stabilization-public-deadline-v1';
+  const deadline = Number(publication?.brain?.deadlineMs);
+  if (publication?.acceptancePolicy !== undefined && !stabilization) {
+    failures.push(fail('PUBLIC_ACCEPTANCE_POLICY', 'unknown public acceptance policy'));
+  }
+  const withinDeadline = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0
+    && Number.isFinite(deadline) && deadline > 0
+    && (!stabilization || deadline === 30_000)
+    && value <= deadline * (stabilization ? 1 : 0.8);
   for (const hostName of ['claudeOnly', 'codexOnly', 'dual']) {
     const host = publication?.installed?.[hostName];
     if (host?.status !== 'PASS' || host?.doctorExit !== 0 || host?.artifactSha256 !== digest
-      || host?.functionalSearch !== true || !(host?.searchMs <= Number(publication?.brain?.deadlineMs) * 0.8)) {
+      || host?.functionalSearch !== true || !withinDeadline(host?.searchMs)) {
       failures.push(fail('PUBLIC_HOST_NOT_PASS', `${hostName} is not running a doctor-clean functional sealed public artifact`));
     }
   }
   const brain = publication?.brain || {};
-  if (brain.status !== 'PASS' || brain.selfStore !== true || !(brain.broadMs <= Number(brain.deadlineMs) * 0.8)) failures.push(fail('PUBLIC_BRAIN_NOT_PASS', 'public installed Brain acceptance failed'));
+  if (brain.status !== 'PASS' || brain.selfStore !== true || !withinDeadline(brain.broadMs)) failures.push(fail('PUBLIC_BRAIN_NOT_PASS', 'public installed Brain acceptance failed'));
   const probes = Array.isArray(publication?.postPublicationChecks) ? publication.postPublicationChecks : [];
   const probe = probes.find((check) => check?.name === 'published-surface-probe' && check?.sha === sha);
   if (probe?.status !== 'completed' || probe?.conclusion !== 'success') failures.push(fail('POST_PUBLICATION_CHECK_NOT_GREEN', 'published-surface-probe is not green'));

package/scripts/nightly-package-observation.mjs

@@ -0,0 +1,67 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const hash = (value) => crypto.createHash('sha256').update(value).digest('hex');
+
+// npm dependencies are separately installed outside the immutable package payload.
+export function packageTreeObservation(root) {
+  const files = [];
+  const visit = (dir, prefix = '') => {
+    for (const name of fs.readdirSync(dir).sort()) {
+      if (!prefix && name === 'node_modules') continue;
+      const file = path.join(dir, name);
+      const relative = prefix ? `${prefix}/${name}` : name;
+      const stat = fs.lstatSync(file);
+      if (stat.isDirectory()) visit(file, relative);
+      else if (stat.isFile()) files.push({ path: relative, sha256: hash(fs.readFileSync(file)) });
+      else throw new Error(`npm package contains an unsupported entry: ${relative}`);
+    }
+  };
+  visit(root);
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+  return { name: manifest.name, version: manifest.version, fileCount: files.length,
+    treeSha256: hash(JSON.stringify(files)) };
+}
+
+export function observeNpxPackage(npmCache, expected) {
+  const base = path.join(npmCache, '_npx');
+  const roots = fs.existsSync(base) ? fs.readdirSync(base).map((name) =>
+    path.join(base, name, 'node_modules', 'ruvnet-brain')).filter((root) => fs.existsSync(root)) : [];
+  if (roots.length !== 1) throw new Error(`expected exactly one isolated npx Brain package, found ${roots.length}`);
+  const observed = packageTreeObservation(roots[0]);
+  if (JSON.stringify(observed) !== JSON.stringify(expected)) throw new Error('npx package bytes differ from verified public package');
+  return { ...observed, path: roots[0], observedAt: new Date().toISOString() };
+}
+
+export function validateNpxObservations(proof) {
+  const expected = proof.packageExecution?.expected;
+  const observations = proof.packageExecution?.observations;
+  if (proof.packageExecution?.policy !== 'production-latest-exact-cache-v1'
+    || proof.registration?.packageTarget?.spec !== 'ruvnet-brain@latest'
+    || proof.registration.packageTarget.sha256 !== null
+    || expected?.packageSha256 !== proof.candidate?.sha256
+    || expected?.name !== 'ruvnet-brain' || expected.version !== proof.candidate?.version
+    || !/^[a-f0-9]{64}$/.test(expected.treeSha256 || '') || !Number.isSafeInteger(expected.fileCount)
+    || expected.fileCount <= 0 || !Array.isArray(observations) || observations.length !== 3) {
+    return ['native production package execution evidence is incomplete'];
+  }
+  const failures = [];
+  for (const observed of observations) {
+    if (observed.name !== expected.name || observed.version !== expected.version
+      || observed.treeSha256 !== expected.treeSha256 || observed.fileCount !== expected.fileCount
+      || typeof observed.path !== 'string' || !observed.path
+      || !Number.isFinite(Date.parse(observed.observedAt))) failures.push('native npx package identity differs');
+  }
+  if (!Array.isArray(proof.runs) || proof.runs.length !== 2) return [...failures, 'native package run evidence is missing'];
+  for (let i = 0; i < 2; i++) {
+    const run = proof.runs[i].receipt;
+    if (run?.desiredVersion !== expected.version
+      || Date.parse(observations[i].observedAt) > Date.parse(run?.startedAt)
+      || Date.parse(observations[i + 1].observedAt) < Date.parse(run?.finishedAt)
+      || Date.parse(observations[i + 1].observedAt) > Date.parse(proof.observedAt)) {
+      failures.push('native package observation does not bound the exact-version run');
+    }
+  }
+  return failures;
+}

package/scripts/nightly-two-run-proof.mjs

@@ -8,8 +8,9 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { assessLifecycleEvidence } from '../kb/lifecycle-evidence-retention.mjs';
 import { managedStorageInventory } from '../kb/update-storage-transaction.mjs';
-import { REQUIRED_REFRESH_PHASES, validateCurrentRunPhaseExecution } from '../kb/refresh-run.mjs';
+import { REQUIRED_REFRESH_PHASES, validateCurrentRunPhaseExecution, inspectRefreshOwner, refreshLockPath } from '../kb/refresh-run.mjs';
 import { npmInvocation } from './npm-invocation.mjs';
+import { packageTreeObservation, observeNpxPackage, validateNpxObservations } from './nightly-package-observation.mjs';
 import { validateRefreshReceiptEnvelope } from '../plugin/scripts/nightly-scheduler.mjs';
 import { validateCoverageDirectory, validateCoverageLedger } from '../plugin/scripts/coverage-integrity.mjs';
 
@@ -67,6 +68,29 @@ export function stageExactBundle({ bundlePath, packageRoot } = {}) {
   return { sourcePath, stagedPath, bytes: bytes.length, sha256: sha256(bytes) };
 }
 
+export function removeEmptyInstallerScaffolds(kbDir) {
+  const parent = path.dirname(kbDir);
+  const prefix = `${path.basename(kbDir)}.install-preserved-`;
+  const removed = [];
+  for (const name of fs.readdirSync(parent)) {
+    if (!name.startsWith(prefix)) continue;
+    const file = path.join(parent, name);
+    const stat = fs.lstatSync(file);
+    if (stat.isDirectory() && !stat.isSymbolicLink() && fs.readdirSync(file).length === 0) {
+      fs.rmdirSync(file); removed.push(file);
+    }
+  }
+  return removed;
+}
+
+function observeUpdateLog(file) {
+  if (!fs.existsSync(file)) return { bytes: 0, sha256: sha256(Buffer.alloc(0)) };
+  const stat = fs.lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('native update log is not a regular file');
+  const bytes = fs.readFileSync(file);
+  return { bytes: bytes.length, sha256: sha256(bytes) };
+}
+
 function nightlyReceipts(brainHome, identity) {
   const dir = path.join(brainHome, 'refresh-runs');
   if (!fs.existsSync(dir)) return [];
@@ -80,10 +104,18 @@ function nightlyReceipts(brainHome, identity) {
     && receipt.action === 'nightly' && receipt.schedulerIdentity === identity);
 }
 
+function refreshExecutionStopped(receipt, kbDir) {
+  if (inspectRefreshOwner(receipt.ownerToken) !== 'dead') return false;
+  const lock = refreshLockPath(kbDir);
+  const parent = path.dirname(lock);
+  return !fs.existsSync(lock) && (!fs.existsSync(parent) || !fs.readdirSync(parent)
+    .some((name) => name.startsWith(`${path.basename(lock)}.release-`)));
+}
+
 // Dependency seams here exercise orchestration without touching a developer's native scheduler.
 // Only runNightlyTwoRunProof writes proof, and it supplies the real installed adapter and commands.
 export async function triggerNativeRun({ scheduler, registration, platform, env, brainHome, kbDir,
-  timeoutMs, command = run, receipts = nightlyReceipts, pause = sleep, now = Date.now }) {
+  timeoutMs, command = run, receipts = nightlyReceipts, pause = sleep, now = Date.now, stopped = refreshExecutionStopped }) {
   const identity = registration.identity;
   if (!/^com\.ruvnet\.brain-update\.proof-[A-Za-z0-9._-]+$/.test(identity || '')) {
     throw new Error('native proof requires a unique proof scheduler identity');
@@ -110,7 +142,13 @@ export async function triggerNativeRun({ scheduler, registration, platform, env,
     if (!installed.ok) throw new Error(`native scheduler unavailable: ${installed.why}`);
     const status = scheduler.schedulerStatus(options);
     if (status.state !== 'on') throw new Error(`proof scheduler is not on: ${status.evidence}`);
-    if (platform === 'darwin') command('launchctl', ['kickstart', '-k', `gui/${process.getuid()}/${identity}`]);
+    if (platform === 'darwin') {
+      // Darwin has getuid, but the qualification suite also exercises the Darwin
+      // branch from Windows. Keep that simulation portable without changing the
+      // real launchctl identity on macOS.
+      const uid = typeof process.getuid === 'function' ? process.getuid() : 0;
+      command('launchctl', ['kickstart', '-k', `gui/${uid}/${identity}`]);
+    }
     if (platform === 'win32') command('schtasks', ['/Run', '/TN', identity]);
     // Cron itself must deliver the Linux trigger. Never execute its command directly as proof.
     const startedAt = now();
@@ -124,8 +162,12 @@ export async function triggerNativeRun({ scheduler, registration, platform, env,
         // Stop the minute cadence at the first receipt, including RUNNING, so long updates do
         // not launch again. Removing a cron row does not kill its already running child.
         if (platform === 'linux' && !removed) remove();
-        if (['SUCCEEDED', 'FAILED', 'ABANDONED'].includes(created[0].receipt.status)) return { ...created[0],
+        if (['SUCCEEDED', 'FAILED', 'ABANDONED'].includes(created[0].receipt.status)
+          && stopped(created[0].receipt, kbDir)) {
+          await pause(250); // Let the exited child's npm parent finish flushing its log.
+          return { ...created[0],
           trigger: { kind: { darwin: 'launchctl-kickstart', linux: 'cron-tick', win32: 'schtasks-run' }[platform], identity } };
+        }
       }
       if (platform === 'linux' && !observedStart && now() - startedAt >= 120_000) {
         throw new Error('cron did not start the owned proof job within two minutes; check that the cron service is running');
@@ -170,8 +212,17 @@ function validateStorageEvidence({ first, second, inventoryBefore, inventoryAfte
     if (inventory.additionalFullCorpusCopyCount !== 0) failures.push(`${label} inventory has redundant corpus copies`);
     if (!Number.isSafeInteger(inventory.totalManagedBytes) || inventory.totalManagedBytes < 0) failures.push(`${label} inventory has no measured byte count`);
   }
+  let logGrowth = 0;
+  if (retention.updateLog !== undefined) {
+    const { before, after } = retention.updateLog;
+    if (![before, after].every((row) => Number.isSafeInteger(row?.bytes) && row.bytes >= 0
+      && /^[a-f0-9]{64}$/.test(row.sha256 || '')) || !Number.isSafeInteger(retention.policy?.maxEvidenceBytes)
+      || retention.policy.maxEvidenceBytes <= 0 || after.bytes > retention.policy.maxEvidenceBytes) {
+      failures.push('native log byte measurements are invalid or exceed the evidence budget');
+    } else logGrowth = Math.max(0, after.bytes - before.bytes);
+  }
   if (inventoryAfterSecond.totalManagedBytes > inventoryAfterFirst.totalManagedBytes
-    + Math.max(0, retention.after?.bytes - retention.before?.bytes)) {
+    + Math.max(0, retention.after?.bytes - retention.before?.bytes) + logGrowth) {
     failures.push('second no-op increased managed storage outside retained lifecycle evidence');
   }
   if (retention.withinBudget !== true || retention.unsafe?.length) failures.push('lifecycle evidence is not within policy');
@@ -253,6 +304,9 @@ export function validateNightlyProofReceipt(receipt, { platform, version, packag
   if (!/^[a-f0-9]{40}$/.test(sourceSha || '') || receipt.sourceSha !== sourceSha) failures.push('native proof source SHA differs');
   if (!/^\d+$/.test(String(workflowRunId || '')) || String(receipt.workflowRunId || '') !== String(workflowRunId)) failures.push('native proof workflow run differs');
   if (!/^com\.ruvnet\.brain-update\.proof-[A-Za-z0-9._-]+$/.test(receipt.identity || '')) failures.push('native proof identity is not isolated');
+  if (receipt.packageExecution !== undefined || receipt.registration?.packageTarget?.spec === 'ruvnet-brain@latest') {
+    failures.push(...validateNpxObservations(receipt));
+  }
   const observedAt = Date.parse(receipt.observedAt);
   if (!Number.isFinite(observedAt) || observedAt > Date.now() + 60_000) failures.push('native proof observation time is invalid');
   if (!Array.isArray(receipt.runs) || receipt.runs.length !== 2) failures.push('native proof requires exactly two runs');
@@ -330,14 +384,23 @@ export async function runNightlyTwoRunProof({ packagePath, bundlePath, out, time
     run(npm.executable, npm.args, { env });
     const packageRoot = path.join(prefix, 'node_modules', 'ruvnet-brain');
     const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+    const expectedPackage = packageTreeObservation(packageRoot);
+    // Exercise the production target, not npx's ambiguous positional local-tarball path.
+    const prepare = npmInvocation(['exec', '--yes', '--package=ruvnet-brain@latest', '--', 'ruvnet-brain', '--help']);
+    run(prepare.executable, prepare.args, { env, cwd: home });
+    const packageObservations = [observeNpxPackage(npmCache, expectedPackage)];
+    // Register the exact public package's plugin in this fresh home. GitHub shorthand can
+    // select SSH on Windows and leave no staged plugin for the first scheduled activation.
+    env.RUVNET_CLAUDE_MARKETPLACE_SOURCE = packageRoot;
     const stagedBundle = stageExactBundle({ bundlePath: bundle, packageRoot });
     run(process.execPath, [path.join(packageRoot, 'bin', 'install.mjs'), '--yes', '--no-nightly-prompt'], {
-      env, stdio: 'inherit', encoding: undefined,
+      env: { ...env, npm_config_bin_links: 'false' }, stdio: 'inherit', encoding: undefined,
     });
+    const removedEmptyScaffolds = removeEmptyInstallerScaffolds(kbDir);
     scheduler = await import(`${pathToFileURL(path.join(packageRoot, 'plugin', 'scripts', 'nightly-scheduler.mjs')).href}?proof=${Date.now()}`);
     registration = scheduler.installNightlyRunner({ brainHome,
       source: path.join(packageRoot, 'bin', 'nightly-refresh.mjs'), nodePath: process.execPath, identity, env,
-      packageTarget: { spec: candidate, sha256: packageSha256 },
+      packageTarget: { spec: 'ruvnet-brain@latest', sha256: null },
       bundleTarget: { spec: stagedBundle.sourcePath, sha256: stagedBundle.sha256 } });
     const inventoryBefore = managedStorageInventory(kbDir);
     const kick = () => triggerNativeRun({ scheduler, registration, platform: process.platform,
@@ -351,14 +414,25 @@ export async function runNightlyTwoRunProof({ packagePath, bundlePath, out, time
     const firstEntry = await kick();
     firstEntry.installedCoverage = observeCoverage();
     const inventoryAfterFirst = managedStorageInventory(kbDir);
+    packageObservations.push(observeNpxPackage(npmCache, expectedPackage));
+    const retentionAfterFirst = assessLifecycleEvidence({ brainHome, kbDir });
+    const logAfterFirst = observeUpdateLog(logPath);
     const secondEntry = await kick();
     secondEntry.installedCoverage = observeCoverage();
     const inventoryAfterSecond = managedStorageInventory(kbDir);
-    const retention = assessLifecycleEvidence({ brainHome, kbDir });
+    packageObservations.push(observeNpxPackage(npmCache, expectedPackage));
+    const retentionAfterSecond = assessLifecycleEvidence({ brainHome, kbDir });
+    const retention = { ...retentionAfterSecond, before: retentionAfterFirst.after,
+      withinBudget: retentionAfterFirst.withinBudget && retentionAfterSecond.withinBudget,
+      unsafe: [...retentionAfterFirst.unsafe, ...retentionAfterSecond.unsafe],
+      updateLog: { before: logAfterFirst, after: observeUpdateLog(logPath) } };
     const receipt = {
       schemaVersion: 1,
       kind: 'ruvnet-brain-native-two-run-nightly-proof',
       scope: 'installed-update',
+      installationConfiguration: { npmBinLinks: false, source: 'initial-reader-install-only', removedEmptyScaffolds },
+      packageExecution: { policy: 'production-latest-exact-cache-v1',
+        expected: { ...expectedPackage, packageSha256 }, observations: packageObservations },
       upstreamFreshness: 'UNKNOWN',
       observedAt: new Date().toISOString(),
       platform: process.platform,

package/scripts/public-verification-aggregate.mjs

@@ -37,6 +37,14 @@ export function validatePublicVerificationLeaf(leaf, { publicKey } = {}) {
   if (leaf.publicBytes?.npmExact !== true || leaf.publicBytes?.githubExact !== true
     || leaf.publicBytes?.bundleExact !== true || leaf.installed?.version !== leaf.version
     || leaf.installed?.loaderVerified !== true) throw new Error(`${leaf.os}/${leaf.mode} public bytes or loader are unverified`);
+  if (leaf.acceptancePolicy !== undefined || leaf.searchTiming !== undefined) {
+    const timing = leaf.searchTiming;
+    if (leaf.acceptancePolicy !== 'stabilization-public-deadline-v1' || timing?.deadlineMs !== 30_000
+      || ![timing.firstSearchMs, timing.broadMs].every((value) => typeof value === 'number'
+        && Number.isFinite(value) && value >= 0 && value <= timing.deadlineMs)) {
+      throw new Error(`${leaf.os}/${leaf.mode} public search acceptance policy or timing is invalid`);
+    }
+  }
   if (leaf.coverage?.verified !== true || leaf.coverage.eligibleCurrent !== leaf.coverage.eligibleTotal
     || leaf.coverage.gistCurrent !== leaf.coverage.gistTotal) throw new Error(`${leaf.os}/${leaf.mode} coverage is incomplete`);
   if (!Array.isArray(leaf.untested) || leaf.untested.length || leaf.skipped !== 0 || leaf.unknown !== 0) {

package/scripts/public-verification-lane.mjs

@@ -178,13 +178,17 @@ export async function createPublicVerificationLane({
       failures.push({ mode, reason: error.message, retrieval });
       continue;
     }
+    // Native scheduler lifecycle is qualified in the reviewed cross-platform
+    // release suite. The live public adapter opts out because that proof relies
+    // on maintainer-only host tooling; test adapters still exercise the seam.
     let nativeNightly;
-    if (mode === 'dual') {
+    if (mode === 'dual' && adapter.publicNativeNightly !== false) {
       if (typeof adapter.runNativeNightly !== 'function') throw new Error('native nightly proof adapter is required');
       nativeNightly = await adapter.runNativeNightly({ identity, workflowRunId: String(workflowRunId) });
     }
     leaves.push(createPublicVerificationLeaf({
       ...common,
+      ...(publication.acceptancePolicy ? { acceptancePolicy: publication.acceptancePolicy, searchTiming: { firstSearchMs: installed.searchMs, broadMs: publication.brain.broadMs, deadlineMs: publication.brain.deadlineMs } } : {}),
       ...(nativeNightly === undefined ? {} : { nativeNightly }),
       os,
       mode,

package/scripts/publication-receipt.mjs

@@ -7,6 +7,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
+import { createRequire } from 'node:module';
 import { spawn, spawnSync } from 'node:child_process';
 // ONE doctor rule and ONE mode vocabulary, shared with the staged-side check in
 // scripts/staged-host-verifier.mjs. This file kept its own copies, spelled claudeOnly/
@@ -14,7 +15,7 @@ import { spawn, spawnSync } from 'node:child_process';
 // `fixtures.claude` described the same fixture and nothing could tell. The richer
 // post-publication proofs below (payload assertions, MCP wiring, SOURCE.json, rpcSearch)
 // stay here — they are this side's job, not duplication.
-import { HOST_MODES, RECEIPT_MODE_NAMES, MODE_FROM_RECEIPT_NAME, classifyDoctor, VARIANTS } from './host-install-matrix.mjs';
+import { HOST_MODES, RECEIPT_MODE_NAMES, MODE_FROM_RECEIPT_NAME, classifyDoctor, VARIANTS, createInstalledMcpSession } from './host-install-matrix.mjs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt, evaluatePublicationReceipt } from './release-proof.mjs';
 import { verifyPayload } from './release-payload.mjs';
@@ -30,6 +31,11 @@ const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file
 const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
 const receiptDigest = (candidate) => String(candidate?.artifact?.sha256 || '').replace(/^sha256:/, '');
 export function commandInvocation(name, args, { platform = process.platform, env = process.env } = {}) {
+  // Git Bash's GNU tar cannot consume native drive-letter extraction destinations.
+  // Select the Windows system tar explicitly so PATH order cannot change path semantics.
+  if (platform === 'win32' && name === 'tar') return {
+    executable: path.win32.join(env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe'), args,
+  };
   if (platform === 'win32' && /^(?:npm|npx)$/i.test(name)) return {
     executable: env.ComSpec || 'cmd.exe', args: ['/d', '/c', `${name}.cmd`, ...args],
   };
@@ -79,12 +85,24 @@ export function validateCandidateSource(root, { sha, version }) {
   return candidateRoot;
 }
 function locate(name, { platform = process.platform } = {}) {
-  const query = platform === 'win32' ? (name === 'node' ? 'node.exe' : `${name}.cmd`) : name;
+  const query = platform === 'win32' ? (['node', 'git'].includes(name) ? `${name}.exe` : `${name}.cmd`) : name;
   try {
     return command(platform === 'win32' ? 'where.exe' : 'which', [query], { platform })
       .split(/\r?\n/).find(Boolean) || null;
   } catch { return null; }
 }
+export function nativeCodexExecutable({ platform = process.platform, arch = process.arch,
+  wrapper = platform === 'win32' ? locate('codex') : null } = {}) {
+  if (platform !== 'win32') return null;
+  if (!wrapper || !['x64', 'arm64'].includes(arch)) throw new Error('native Windows Codex CLI unavailable');
+  const require = createRequire(import.meta.url);
+  const packageFile = require.resolve('@openai/codex/package.json', { paths: [path.dirname(wrapper)] });
+  const platformFile = require.resolve(`@openai/codex-win32-${arch}/package.json`, { paths: [path.dirname(packageFile)] });
+  const target = arch === 'x64' ? 'x86_64' : 'aarch64';
+  const executable = path.join(path.dirname(platformFile), 'vendor', `${target}-pc-windows-msvc`, 'bin', 'codex.exe');
+  if (!fs.statSync(executable).isFile()) throw new Error('native Windows Codex executable missing');
+  return executable;
+}
 export function createIsolatedPath(mode, temp, { platform = process.platform, env = process.env,
   resolve = (name) => locate(name, { platform }) } = {}) {
   const bin = path.join(temp, `bin-${mode}`);
@@ -103,7 +121,10 @@ export function createIsolatedPath(mode, temp, { platform = process.platform, en
   if (platform !== 'win32') return `${bin}:/usr/bin:/bin`;
   const node = resolve('node');
   if (!node) throw new Error(`node CLI unavailable for ${mode} public host fixture`);
+  const git = resolve('git');
+  if (!git) throw new Error(`git CLI unavailable for ${mode} public host fixture`);
   return [bin, path.dirname(node), path.join(env.SystemRoot || 'C:\\Windows', 'System32'),
+    path.dirname(git),
     path.join(env.ProgramFiles || 'C:\\Program Files', 'Git', 'usr', 'bin')].join(path.win32.delimiter);
 }
 export function stageVerifiedBundle({ bundlePath, bundleSha256, packageRoot }) {
@@ -205,6 +226,9 @@ export function rpcSearch(server, env, query, k = 5, timeoutMs = DEADLINE_MS, {
   if (!Number.isSafeInteger(k) || k < 1 || k > 50) throw new Error(`invalid search result count: ${k}`);
   return new Promise((resolve, reject) => {
     const child = spawn(process.execPath, [server], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    // Preserve multibyte characters across pipe chunks before checking source-content hashes.
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
     let stdout = '';
     let stderr = '';
     let timer;
@@ -275,9 +299,11 @@ export function rpcSearch(server, env, query, k = 5, timeoutMs = DEADLINE_MS, {
 
 export function livePublicationAdapter({ root = process.cwd(), candidateRoot = root } = {}) {
   const installContexts = new Map();
+  const mcpSessions = new Map();
   const passageFileDigests = new Map();
   let installTemp = null;
   return {
+    publicNativeNightly: false,
     async downloadNpm({ version, destination }) {
       const metadata = JSON.parse(command('npm', ['view', `${PACKAGE}@${version}`, '--json']));
       if (metadata.version !== version || !metadata.dist?.tarball) {
@@ -344,6 +370,7 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
       // Derived from HOST_MODES, so a fourth host shape is added in ONE place and this loop
       // cannot fall behind the staged-side check the way it did.
       for (const mode of HOST_MODES.map((m) => RECEIPT_MODE_NAMES[m])) {
+        console.log(`Public verification: installing ${mode} on ${process.platform}`);
         const home = path.join(temp, `home-${mode}`);
         const codexHome = path.join(home, '.codex');
         const brainHome = path.join(home, '.cache', 'ruvnet-brain');
@@ -367,13 +394,20 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
           RUVNET_STRICT_INSTALL: '0',
           CI: 'true',
           PATH: createIsolatedPath(mode, temp),
+          ...(process.platform === 'win32' && mode !== 'claudeOnly'
+            ? { CODEX_BIN: nativeCodexExecutable() } : {}),
         };
+        if (mode !== 'claudeOnly') {
+          command(env.CODEX_BIN || 'codex', ['--version'], { env, timeout: 30_000, stdio: 'inherit' });
+          command(env.CODEX_BIN || 'codex', ['plugin', 'list', '--json'], { env, timeout: 30_000, stdio: 'inherit' });
+        }
+        if (process.platform === 'win32') command('git', ['--version'], { env, timeout: 30_000, stdio: 'inherit' });
         const installer = path.join(packageRoot, 'bin', 'install.mjs');
         command(process.execPath, [
           installer, '--yes', '--force', '--version', `v${version}`,
           '--no-nightly-prompt', '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline',
           '--no-selfcheck', '--no-verify',
-        ], { env, cwd: packageRoot, timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024 });
+        ], { env, cwd: packageRoot, timeout: 1_200_000, stdio: 'inherit' });
 
         const verified = {};
         if (mode !== 'codexOnly') {
@@ -394,7 +428,7 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
         const searched = await rpcSearch(findMcpServer(home), env,
           'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS);
         command(process.execPath, [installer, '--doctor', '--hooks'], {
-          env, cwd: packageRoot, timeout: 300_000, maxBuffer: 32 * 1024 * 1024,
+          env, cwd: packageRoot, timeout: 300_000, stdio: 'inherit',
         });
         results[mode] = {
           status: 'PASS', doctorExit: 0, version, artifactSha256,
@@ -426,9 +460,15 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
     async searchInstalled({ mode, query, k }) {
       const context = installContexts.get(mode);
       if (!context) throw new Error(`${mode} public host is not installed`);
-      // Each canary's exact expected repository/path/passage is checked by the canary validator.
-      const result = await rpcSearch(findMcpServer(context.home), context.env, query, k, DEADLINE_MS,
-        { requiredRepo: null });
+      // Keep one MCP worker per installed host. Starting a fresh worker for every canary reloads
+      // the local embedding model repeatedly and can exceed the fixed 30-second public deadline
+      // on macOS, even when the installed Brain itself is healthy.
+      let session = mcpSessions.get(mode);
+      if (!session) {
+        session = createInstalledMcpSession({ serverPath: findMcpServer(context.home), env: context.env, timeout: DEADLINE_MS });
+        mcpSessions.set(mode, session);
+      }
+      const result = await session.search({ query, k });
       return parseRetrievalResult(result.mcpResult, { query, k });
     },
 
@@ -453,6 +493,8 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
     },
 
     async dispose() {
+      await Promise.all([...mcpSessions.values()].map((session) => session.close()));
+      mcpSessions.clear();
       if (installTemp) fs.rmSync(installTemp, { recursive: true, force: true });
       installTemp = null;
       installContexts.clear();
@@ -513,6 +555,7 @@ export async function generatePublicationReceipt({
     const publication = {
       schemaVersion: 2,
       phase: 'publication',
+      acceptancePolicy: 'stabilization-public-deadline-v1',
       sha: candidate.sha,
       artifactSha256: digest,
       version: candidate.version,
@@ -532,7 +575,7 @@ export async function generatePublicationReceipt({
       postPublicationChecks: [surface],
     };
     const result = evaluatePublicationReceipt(candidate, publication);
-    if (result.verdict !== 'PASS') throw new Error(`publication seal failed: ${result.failures.map(({ code }) => code).join(',')}`);
+    if (result.verdict !== 'PASS') throw new Error(`publication seal failed: ${JSON.stringify({ failures: result.failures, installed: publication.installed, brain: publication.brain })}`);
     fs.mkdirSync(path.dirname(outPath), { recursive: true });
     fs.writeFileSync(outPath, `${JSON.stringify(publication, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
     return result;