ruvnet-brain 4.3.14 → 4.3.16

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.14 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.14-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.16 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.16-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -1722,8 +1722,27 @@ export function wireCodexPlugin({
   }
   if (announce) {
     ok(`Codex Brain plugin installed and enabled (${after.version || 'version unknown'}).`);
+    warn('Existing Codex app-server sessions may retain the previous plugin path; restart Codex before using the updated plugin.');
   }
-  return { host: true, action: before.installed ? 'updated' : 'installed', ...after };
+  return {
+    host: true,
+    action: before.installed ? 'updated' : 'installed',
+    ...after,
+    // Codex currently exposes no generation/session lease API. This explicit guard prevents the
+    // installer from implying that a native cache update is safe for an already-running session.
+    sessionSafety: 'restart-required',
+    restartRequired: true,
+    sessionSafetyReason: 'Codex host cache generations are owned by Codex and have no lease API',
+  };
+}
+
+export function codexSessionSafety(status) {
+  if (status?.restartRequired === true) return status;
+  return {
+    sessionSafety: 'unknown',
+    restartRequired: false,
+    sessionSafetyReason: 'No Codex plugin update occurred',
+  };
 }
 
 function codexHooksList({
@@ -2857,6 +2876,31 @@ function missingUpdaterHelp(kbDir) {
   console.error(`  — the current bundle ships forge-update.mjs; then this command will work.`);
 }
 
+function acquireHostConvergenceLock(lockPath) {
+  try {
+    fs.mkdirSync(lockPath);
+    fs.writeFileSync(path.join(lockPath, 'owner.json'), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
+    return { acquired: true, release: () => fs.rmSync(lockPath, { recursive: true, force: true }) };
+  } catch (error) {
+    if (error?.code !== 'EEXIST') return { acquired: false, error: error.message };
+    try {
+      const owner = JSON.parse(fs.readFileSync(path.join(lockPath, 'owner.json'), 'utf8'));
+      if (Number.isInteger(owner.pid) && owner.pid !== process.pid) {
+        try { process.kill(owner.pid, 0); return { acquired: false, error: `another host synchronization is running (pid ${owner.pid})` }; }
+        catch (probeError) { if (probeError?.code !== 'ESRCH') return { acquired: false, error: 'another host synchronization owns the lock' }; }
+      }
+    } catch { /* an incomplete lock is safe to reclaim */ }
+    fs.rmSync(lockPath, { recursive: true, force: true });
+    try {
+      fs.mkdirSync(lockPath);
+      fs.writeFileSync(path.join(lockPath, 'owner.json'), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
+      return { acquired: true, release: () => fs.rmSync(lockPath, { recursive: true, force: true }) };
+    } catch (retryError) {
+      return { acquired: false, error: retryError.message };
+    }
+  }
+}
+
 export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
   sourceRoot = REPO_ROOT,
   brainHome = process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain'),
@@ -2864,6 +2908,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
   wireClaude = wirePlugin,
   wireCodexHost: detectCodexHost = wireCodexHost,
   wireCodexPlugin: installCodexPlugin = wireCodexPlugin,
+  hostLockPath = path.join(brainHome, 'host-convergence.lock'),
   runStableSpine = (apply) => spawnSync(
     process.execPath,
     [apply, '--auto', '--expected-version', PACKAGE_VERSION],
@@ -2871,14 +2916,18 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
   ),
 } = {}) {
   const results = {};
+  const hostLock = acquireHostConvergenceLock(hostLockPath);
+  if (!hostLock.acquired) return { ok: false, results, error: `host synchronization lock unavailable: ${hostLock.error}` };
   let runtimeTransaction;
   try {
     runtimeTransaction = beginConsoleRuntimeTransaction(cacheDir, sourceRoot);
   } catch (error) {
+    hostLock.release();
     return { ok: false, results, error: `Console runtime staging failed: ${error.message}` };
   }
   const fail = (detail = {}) => {
     runtimeTransaction.rollback();
+    hostLock.release();
     return { ok: false, results, ...detail };
   };
 
@@ -2959,6 +3008,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
     },
     consoleRuntime: results.consoleRuntime,
   });
+  hostLock.release();
   return { ok: convergence.healthy === true, convergence, results, applyStatus: applied.status,
     error: convergence.healthy === true ? null : `host convergence is ${convergence.state}: ${convergence.action}` };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.14",
+  "version": "4.3.16",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
@@ -32,6 +32,7 @@
     "test:regression": "vitest run tests/regression",
     "qe:ux": "node scripts/qe/ux-suite.mjs",
     "test:cov": "vitest run tests/unit --coverage",
+    "coverage:source": "node scripts/source-coverage.mjs --check",
     "test:all": "npm run test:unit && npm run test:mesh && npm run test:mutation && npm run test:regression && npm run test:integration && npm test",
     "metaharness:receipts": "node scripts/metaharness-receipts.mjs",
     "route:cheap": "node scripts/route-cheap.mjs",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships an enforced UserPromptSubmit retrieve-and-inject grounding hook that sharply reduces drift.",
-  "version": "4.3.14",
+  "version": "4.3.16",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.14",
+  "version": "4.3.16",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/mcp/server.mjs

@@ -343,7 +343,7 @@ async function handleClient(msg) {
         });
       }
       if (!c) {
-        return clientOk(id, { content: [{ type: 'text', text: `search_ruvnet error: the brain bundle is not installed at ${KB}. Install it with: npx github:stuinfla/ruvnet-brain  (or set RUVNET_BRAIN_KB to your brain's kb dir).` }], isError: true });
+        return clientOk(id, { content: [{ type: 'text', text: `search_ruvnet error: the brain bundle is unavailable at ${KB}. Diagnose the active installation and KB path before choosing a repair.` }], isError: true });
       }
       pendingCount++;
       try {

package/plugin/skills/ruvnet-brain/SKILL.md

@@ -106,6 +106,11 @@ verification → at most one revision. Both hosts design the ADR, DDD and intend
 Agentic-QE then generates and executes the measurable test artifacts. A host merely completing is
 not an accepted outcome.
 
+When the duel returns `learningPersistenceRequest`, pass that request to Ruflo's structured
+`memory_store` tool and verify the exact returned key. The coordinator never starts a second Ruflo
+memory driver itself; without an MCP-aware caller it leaves `learningPersisted: false` and prints
+the pending request so the completed duel is not mistaken for a persisted learning event.
+
 Subscription-only is a billing boundary: verify with `claude auth status --json` and
 `codex login status`, strip provider API-key variables from both child processes, and never fall back
 to an API when a subscription is absent or capacity-limited. Subscription use consumes plan

package/scripts/dream-issue-gate.mjs

@@ -0,0 +1,115 @@
+// Dream Cycle issue disposition gate.
+//
+// The nightly engine may discover hypotheses, failed probes, or already-fixed findings. None of
+// those is sufficient justification for creating a public issue. This module is deliberately pure:
+// the caller supplies the finding and the current open issues, and receives a disposition before
+// invoking any GitHub write operation.
+
+const HEX_SHA = /^[0-9a-f]{7,64}$/i;
+const ISSUE_MARKER = 'dream-fingerprint:';
+
+function text(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+/** Stable identity used by the ledger, issue body, and open-issue deduplication. */
+export function stableFingerprint(finding = {}) {
+  const parts = ['deep', 'scan', 'path', 'signature'].map((key) => text(finding[key]));
+  return parts.every(Boolean) ? parts.join('|') : '';
+}
+
+export function issueBodyMarker(fingerprint) {
+  return fingerprint ? `${ISSUE_MARKER} ${fingerprint}` : '';
+}
+
+function sourceBacked(finding) {
+  const sourceSha = text(finding.sourceSha || finding.sourceCommit || finding.source?.commit);
+  const sourcePaths = finding.sourcePaths || finding.paths || finding.source?.paths;
+  const reproduction = finding.reproduction || finding.repro;
+  const evidence = Array.isArray(finding.evidence) ? finding.evidence : [];
+  if (!HEX_SHA.test(sourceSha)) return false;
+  if (!Array.isArray(sourcePaths) || sourcePaths.length === 0 || sourcePaths.some((p) => !text(p))) return false;
+  if (!reproduction || !text(reproduction.command) || !text(reproduction.output)) return false;
+  return evidence.length > 0 && evidence.every((item) => item && text(item.observed)
+    && (text(item.path) || text(item.source) || text(item.sourcePath)));
+}
+
+function openIssueFor(fingerprint, openIssues) {
+  if (!fingerprint || !Array.isArray(openIssues)) return null;
+  const marker = issueBodyMarker(fingerprint);
+  return openIssues.find((issue) => text(issue.body).includes(marker)
+    || text(issue.title).includes(marker)
+    || text(issue.fingerprint) === fingerprint) || null;
+}
+
+/**
+ * Decide whether a finding may become a GitHub issue.
+ *
+ * `report` is the safe destination for hypotheses, missing evidence, resolved findings, and
+ * findings that are not yet actionable. `dedupe` points at the existing open issue. Only `create`
+ * is permission for the caller to invoke `gh issue create`.
+ */
+export function assessFinding(finding = {}, { openIssues = [] } = {}) {
+  const fingerprint = stableFingerprint(finding);
+  const common = { fingerprint: fingerprint || null };
+  const status = text(finding.status || finding.state).toLowerCase();
+  const skip = new Set((finding.skipIf || []).map((value) => text(value).toLowerCase()));
+
+  if (!fingerprint) return { ...common, action: 'report', reason: 'missing-stable-fingerprint' };
+  if (status === 'hypothesis' || status === 'unreproduced' || status === 'unknown') {
+    return { ...common, action: 'report', reason: 'finding-not-reproduced' };
+  }
+  if (!sourceBacked(finding)) return { ...common, action: 'report', reason: 'missing-source-backed-reproduction' };
+  if (skip.has('already-fixed') || skip.has('verified-local-fix') || skip.has('environment-only')
+    || finding.resolved === true || finding.fixed === true) {
+    return { ...common, action: 'report', reason: 'resolved-or-non-defect' };
+  }
+  if (status !== 'reproduced' && status !== 'reproducible' && status !== 'confirmed') {
+    return { ...common, action: 'report', reason: 'finding-not-confirmed' };
+  }
+  if (finding.actionable !== true || finding.unresolved !== true || finding.boundedFixUnsuccessful !== true) {
+    return { ...common, action: 'report', reason: 'repair-or-actionability-evidence-missing' };
+  }
+  const existing = openIssueFor(fingerprint, openIssues);
+  if (existing) return { ...common, action: 'dedupe', reason: 'duplicate-open-issue', issue: existing };
+  return { ...common, action: 'create', reason: 'reproduced-actionable-unresolved-after-bounded-repair' };
+}
+
+export function buildIssueBody(finding, decision = assessFinding(finding)) {
+  if (decision.action !== 'create') throw new Error(`cannot build issue body for ${decision.action}`);
+  const sourceSha = text(finding.sourceSha || finding.sourceCommit || finding.source?.commit);
+  return [
+    `<!-- ${issueBodyMarker(decision.fingerprint)} -->`,
+    `## ${text(finding.title) || 'Dream Cycle finding'}`,
+    '',
+    text(finding.summary || finding.description),
+    '',
+    `Source: ${sourceSha}`,
+    `Paths: ${(finding.sourcePaths || finding.paths || []).join(', ')}`,
+    `Reproduction: \`${text(finding.reproduction?.command)}\``,
+    '',
+    'Observed output:',
+    '```',
+    text(finding.reproduction?.output),
+    '```',
+  ].join('\n');
+}
+
+// Adapter contract for the Dream Machine runner. Input is JSON on stdin:
+// { "finding": { ... }, "openIssues": [{ "number", "title", "body" }] }
+// Output is the disposition JSON. This command intentionally cannot create or mutate GitHub data.
+if (process.argv[1] === new URL(import.meta.url).pathname) {
+  let input = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (chunk) => { input += chunk; });
+  process.stdin.on('end', () => {
+    try {
+      const payload = JSON.parse(input || '{}');
+      const decision = assessFinding(payload.finding || payload, { openIssues: payload.openIssues || [] });
+      process.stdout.write(`${JSON.stringify(decision)}\n`);
+    } catch (error) {
+      process.stderr.write(`dream-issue-gate: invalid JSON input: ${error.message}\n`);
+      process.exitCode = 2;
+    }
+  });
+}

package/scripts/dual-host-deliberation.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { createHash } from 'node:crypto';
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { probeSubscriptionHosts, subscriptionOnlyEnv } from './subscription-hosts.mjs';
 
@@ -67,15 +67,34 @@ function parseHostValue(host, stdout) {
   }
 }
 
-function spawnHost(binary, args, options) {
+function spawnHost(binary, args, options, input = '') {
   return new Promise((resolve) => {
     const child = spawn(binary, args, options);
     let stdout = '';
     let stderr = '';
+    let inputError = null;
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
     child.stdout.on('data', (chunk) => { stdout += chunk; });
     child.stderr.on('data', (chunk) => { stderr += chunk; });
-    child.on('error', (error) => resolve({ status: null, stdout, stderr: error.message }));
-    child.on('close', (status) => resolve({ status, stdout, stderr }));
+    child.stdin.on('error', (error) => {
+      inputError = error;
+      stderr += `${stderr ? '\n' : ''}${error.message}`;
+      try { child.kill(); } catch { /* child may already be gone */ }
+    });
+    child.on('error', (error) => finish({ status: null, stdout, stderr: error.message, error }));
+    try {
+      child.stdin.end(input);
+    } catch (error) {
+      inputError = error;
+      stderr += `${stderr ? '\n' : ''}${error.message}`;
+      try { child.kill(); } catch { /* child may already be gone */ }
+    }
+    child.on('close', (status) => finish({ status, stdout, stderr, error: inputError }));
   });
 }
 
@@ -87,20 +106,21 @@ export async function runSubscriptionHost(host, stage, payload, { cwd = process.
         binary: 'claude',
         args: [
           '-p', '--output-format', 'json', '--permission-mode', 'plan',
-          '--tools', 'Read,Grep,Glob', '--no-session-persistence', '--effort', 'high', prompt,
+          '--tools', 'Read,Grep,Glob', '--no-session-persistence', '--effort', 'high',
         ],
       }
     : {
         binary: 'codex',
         args: [
           'exec', '--ephemeral', '--sandbox', 'read-only', '--color', 'never', '--json',
-          '-m', 'gpt-5.6-sol', '-c', 'model_reasoning_effort="high"', prompt,
+          '-m', 'gpt-5.6-sol', '-c', 'model_reasoning_effort="high"',
         ],
       };
-  const result = await spawnHost(command.binary, command.args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+  const result = await spawnHost(command.binary, command.args, { cwd, env, stdio: ['pipe', 'pipe', 'pipe'] }, prompt);
   if (result.status !== 0) {
     return {
       ok: false,
+      error: result.stderr || `host exited without a status (${result.status})`,
       reason: /limit|quota|capacity|usage/i.test(result.stderr)
         ? 'capacity-limited'
         : 'host-failed',
@@ -109,11 +129,7 @@ export async function runSubscriptionHost(host, stage, payload, { cwd = process.
   return { ok: true, value: parseHostValue(host, result.stdout) };
 }
 
-export async function persistDeliberationReceipt(receipt, {
-  cwd = process.cwd(),
-  now = Date.now,
-  run = spawnSync,
-} = {}) {
+export function deliberationMemoryStoreRequest(receipt, { now = Date.now } = {}) {
   const recordedAt = now();
   const value = {
     protocol: receipt.protocol,
@@ -125,21 +141,28 @@ export async function persistDeliberationReceipt(receipt, {
     recordedAt: new Date(recordedAt).toISOString(),
   };
   const key = `dual-deliberation-${recordedAt}-${receipt.taskHash.slice(0, 12)}`;
-  const result = run('ruflo', [
-    'memory', 'store',
-    '-k', key,
-    '--value', JSON.stringify(value),
-    '--namespace', 'ruvnet-brain',
-    '--path', '.swarm/memory.db',
-    '--no-upsert',
-    '--scan-content',
-  ], {
-    cwd,
-    encoding: 'utf8',
-    env: subscriptionOnlyEnv(),
-    timeout: 15_000,
-  });
-  return result?.status === 0;
+  return {
+    tool: 'memory_store',
+    name: 'memory_store',
+    arguments: { key, value: JSON.stringify(value), namespace: 'ruvnet-brain' },
+  };
+}
+
+function persistenceProof(proof, key) {
+  return proof === true || (proof?.stored === true && proof?.verified === true && proof?.key === key);
+}
+
+export async function persistDeliberationReceipt(receipt, {
+  now = Date.now,
+  memoryStore,
+} = {}) {
+  const request = deliberationMemoryStoreRequest(receipt, { now });
+  if (typeof memoryStore !== 'function') return request;
+  try {
+    return persistenceProof(await memoryStore(request), request.arguments.key);
+  } catch {
+    return false;
+  }
 }
 
 function missingHosts(probes) {
@@ -164,7 +187,6 @@ export async function deliberate(task, options = {}) {
     runSubscriptionHost(host, stage, payload, { cwd: options.cwd })
   ));
   const cwd = options.cwd ?? process.cwd();
-  const persist = options.persist ?? ((receipt) => persistDeliberationReceipt(receipt, { cwd }));
   const eligibleHosts = HOSTS.filter((host) => probes[hostKey(host)]?.eligible);
 
   if (eligibleHosts.length === 0) {
@@ -247,7 +269,18 @@ export async function deliberate(task, options = {}) {
     roles,
     accepted,
   };
-  const learningPersisted = accepted ? Boolean(await persist(receipt)) : false;
+  const learningPersistenceRequest = accepted
+    ? deliberationMemoryStoreRequest(receipt, { now: options.now ?? Date.now })
+    : undefined;
+  let learningPersisted = false;
+  if (accepted && typeof options.persist === 'function') {
+    try {
+      const persisted = await options.persist(learningPersistenceRequest, receipt);
+      learningPersisted = persistenceProof(persisted, learningPersistenceRequest.arguments.key);
+    } catch {
+      learningPersisted = false;
+    }
+  }
   return {
     status: accepted ? 'accepted' : 'unresolved',
     dual: true,
@@ -256,6 +289,7 @@ export async function deliberate(task, options = {}) {
     verification: verification.ok ? verification.value : undefined,
     verifiedOutcome: accepted,
     learningPersisted,
+    ...(learningPersistenceRequest ? { learningPersistenceRequest } : {}),
   };
 }
 

package/scripts/nightly-package-observation.mjs

@@ -37,9 +37,15 @@ export function observeNpxPackage(npmCache, expected) {
 export function validateNpxObservations(proof) {
   const expected = proof.packageExecution?.expected;
   const observations = proof.packageExecution?.observations;
-  if (proof.packageExecution?.policy !== 'production-latest-exact-cache-v1'
-    || proof.registration?.packageTarget?.spec !== 'ruvnet-brain@latest'
-    || proof.registration.packageTarget.sha256 !== null
+  const policy = proof.packageExecution?.policy;
+  const target = proof.registration?.packageTarget;
+  const productionLatest = policy === 'production-latest-exact-cache-v1'
+    && target?.spec === 'ruvnet-brain@latest' && target.sha256 === null;
+  const sealedCandidate = policy === 'sealed-candidate-exact-cache-v1'
+    && typeof target?.spec === 'string' && target.spec.endsWith('.tgz')
+    && /^[a-f0-9]{64}$/.test(String(target.sha256 || ''))
+    && target.sha256 === proof.candidate?.sha256;
+  if ((!productionLatest && !sealedCandidate)
     || expected?.packageSha256 !== proof.candidate?.sha256
     || expected?.name !== 'ruvnet-brain' || expected.version !== proof.candidate?.version
     || !/^[a-f0-9]{64}$/.test(expected.treeSha256 || '') || !Number.isSafeInteger(expected.fileCount)

package/scripts/nightly-two-run-proof.mjs

@@ -180,6 +180,127 @@ export async function triggerNativeRun({ scheduler, registration, platform, env,
   }
 }
 
+/**
+ * Fast release proof for the native scheduler boundary. This deliberately checks only the
+ * scheduler's real registration, load, trigger dispatch, and cleanup. The expensive two-run
+ * updater lifecycle remains a scheduled/post-publication soak and must not block every release.
+ */
+export async function runNativeSchedulerSmoke({ packageRoot, packagePath, bundlePath, sourceSha, workflowRunId,
+  scheduler, env, brainHome, kbDir, now = Date.now, command = run } = {}) {
+  if (!['darwin', 'linux', 'win32'].includes(process.platform)) {
+    throw new Error(`unsupported native scheduler platform: ${process.platform}`);
+  }
+  if (!packageRoot) throw new Error('scheduler smoke package root is missing');
+  const packageRootStat = fs.lstatSync(packageRoot);
+  if (!packageRootStat.isDirectory() || packageRootStat.isSymbolicLink()) {
+    throw new Error('scheduler smoke package root is not a regular directory');
+  }
+  const packageArchive = path.resolve(packagePath || '');
+  const packageStat = fs.lstatSync(packageArchive);
+  if (!packageStat.isFile() || packageStat.isSymbolicLink() || !packageArchive.endsWith('.tgz')) {
+    throw new Error('scheduler smoke package archive is not a regular file');
+  }
+  const bundle = path.resolve(bundlePath || '');
+  const stat = fs.lstatSync(bundle);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('scheduler smoke bundle is not a regular file');
+  if (!/^[a-f0-9]{40}$/.test(String(sourceSha || ''))) throw new Error('scheduler smoke source SHA is invalid');
+  if (!/^\d+$/.test(String(workflowRunId || ''))) throw new Error('scheduler smoke workflow run ID is invalid');
+  if (!scheduler || typeof scheduler.installNightlyRunner !== 'function'
+    || typeof scheduler.installScheduler !== 'function' || typeof scheduler.schedulerStatus !== 'function'
+    || typeof scheduler.removeScheduler !== 'function') throw new Error('scheduler smoke adapter is incomplete');
+
+  const identity = `com.ruvnet.brain-update.proof-smoke-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  const packageSha256 = sha256(fs.readFileSync(packageArchive));
+  const bundleSha256 = sha256(fs.readFileSync(bundle));
+  const registration = scheduler.installNightlyRunner({ brainHome,
+    source: path.join(packageRoot, 'bin', 'nightly-refresh.mjs'), nodePath: process.execPath, identity, env,
+    packageTarget: { spec: packageArchive, sha256: packageSha256 },
+    bundleTarget: { spec: bundle, sha256: bundleSha256 } });
+  // A hosted runner can expose a native scheduler binary whose IPC endpoint is unavailable.
+  // Every scheduler operation is therefore bounded independently; a stuck launchd/schtasks
+  // call must become a typed failure, never consume the entire release job timeout.
+  const schedulerRun = (name, args, options = {}) => spawnSync(name, args, {
+    encoding: 'utf8', timeout: 30_000, ...options,
+  });
+  const options = { platform: process.platform, env, brainHome, kbDir, identity, run: schedulerRun,
+    proofTick: process.platform === 'linux', proofAt: process.platform === 'linux' ? now() + 60_000 : undefined,
+    pathValue: env.PATH };
+  const before = scheduler.schedulerStatus(options);
+  if (before.state !== 'off') throw new Error(`scheduler smoke identity is not absent: ${before.evidence}`);
+  let installed = false;
+  let cleaned = false;
+  try {
+    const result = scheduler.installScheduler(registration, options);
+    if (!result.ok) throw new Error(`native scheduler smoke install failed: ${result.why}`);
+    installed = true;
+    const loaded = scheduler.schedulerStatus(options);
+    if (loaded.state !== 'on') throw new Error(`native scheduler smoke was not loaded: ${loaded.evidence}`);
+    if (process.platform === 'darwin') {
+      const uid = typeof process.getuid === 'function' ? process.getuid() : 0;
+      command('launchctl', ['kickstart', '-k', `gui/${uid}/${identity}`], { timeout: 30_000 });
+    } else if (process.platform === 'win32') {
+      command('schtasks', ['/Run', '/TN', identity], { timeout: 30_000 });
+    }
+    const removed = scheduler.removeScheduler({ ...options, platform: process.platform, env, identity });
+    if (!removed.ok) throw new Error(`native scheduler smoke cleanup failed: ${removed.why}`);
+    cleaned = true;
+    const absent = scheduler.schedulerStatus(options);
+    if (absent.state !== 'off') throw new Error(`native scheduler smoke absence was not verified: ${absent.evidence}`);
+    return {
+      schemaVersion: 1,
+      kind: 'ruvnet-brain-native-scheduler-smoke',
+      scope: 'public-release-scheduler-boundary',
+      platform: process.platform,
+      sourceSha: String(sourceSha),
+      workflowRunId: String(workflowRunId),
+      identity,
+      registration: {
+        recordPath: registration.recordPath, nodePath: registration.nodePath,
+        runnerPath: registration.runnerPath, runnerSha256: registration.runnerSha256,
+        packageTarget: registration.packageTarget, bundleTarget: registration.bundleTarget,
+      },
+      trigger: { kind: { darwin: 'launchctl-kickstart', linux: 'cron-registration', win32: 'schtasks-run' }[process.platform], identity },
+      loaded: true,
+      cleaned: true,
+      observedAt: new Date().toISOString(),
+    };
+  } finally {
+    if (installed && !cleaned) {
+      try { scheduler.removeScheduler({ ...options, platform: process.platform, env, identity }); } catch { /* preserve original failure */ }
+    }
+  }
+}
+
+export function validateNativeSchedulerSmoke(smoke, { platform, sourceSha, workflowRunId,
+  bundleSha256, packageSha256 } = {}) {
+  if (!smoke || typeof smoke !== 'object') {
+    return { ok: false, failures: ['invalid native nightly proof: scheduler smoke receipt is missing'] };
+  }
+  const failures = [];
+  if (smoke?.schemaVersion !== 1 || smoke?.kind !== 'ruvnet-brain-native-scheduler-smoke'
+    || smoke.scope !== 'public-release-scheduler-boundary') failures.push('scheduler smoke envelope is invalid');
+  if (smoke.platform !== platform || smoke.sourceSha !== sourceSha
+    || String(smoke.workflowRunId || '') !== String(workflowRunId || '')) failures.push('scheduler smoke identity differs');
+  if (!/^com\.ruvnet\.brain-update\.proof-smoke-[A-Za-z0-9._-]+$/.test(smoke.identity || '')) failures.push('scheduler smoke identity is not isolated');
+  if (smoke.loaded !== true || smoke.cleaned !== true || smoke.trigger?.identity !== smoke.identity) failures.push('scheduler smoke did not prove load, trigger, and cleanup');
+  const expectedTrigger = { darwin: 'launchctl-kickstart', linux: 'cron-registration', win32: 'schtasks-run' }[platform];
+  if (smoke.trigger?.kind !== expectedTrigger) failures.push('scheduler smoke trigger differs');
+  const registration = smoke.registration;
+  // Receipts from a Windows runner are finalized on Ubuntu.  Validate the path syntax emitted by
+  // the producing OS instead of applying the verifier host's POSIX rules to drive-letter paths.
+  const nativePath = platform === 'win32' ? path.win32 : path;
+  if (!registration || !/^[a-f0-9]{64}$/.test(registration.runnerSha256 || '')
+    || !/^[a-f0-9]{64}$/.test(registration.bundleTarget?.sha256 || '')
+    || registration.bundleTarget.sha256 !== bundleSha256
+    || !/^[a-f0-9]{64}$/.test(registration.packageTarget?.sha256 || '')
+    || (packageSha256 !== undefined && registration.packageTarget.sha256 !== packageSha256)
+    || !nativePath.isAbsolute(registration.packageTarget?.spec || '') || !registration.packageTarget.spec.endsWith('.tgz')
+    || !nativePath.isAbsolute(registration.recordPath || '') || !nativePath.isAbsolute(registration.nodePath || '')
+    || !nativePath.isAbsolute(registration.runnerPath || '')) failures.push('scheduler smoke registration identity is incomplete');
+  if (!Number.isFinite(Date.parse(smoke.observedAt)) || Date.parse(smoke.observedAt) > Date.now() + 60_000) failures.push('scheduler smoke observation time is invalid');
+  return { ok: failures.length === 0, failures };
+}
+
 export function validateTwoRunEvidence({ first, second, inventoryBefore, inventoryAfterFirst,
   inventoryAfterSecond, retention, validateEnvelope, identity }) {
   const failures = [];
@@ -385,8 +506,15 @@ export async function runNightlyTwoRunProof({ packagePath, bundlePath, out, time
     const packageRoot = path.join(prefix, 'node_modules', 'ruvnet-brain');
     const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
     const expectedPackage = packageTreeObservation(packageRoot);
-    // Exercise the production target, not npx's ambiguous positional local-tarball path.
-    const prepare = npmInvocation(['exec', '--yes', '--package=ruvnet-brain@latest', '--', 'ruvnet-brain', '--help']);
+    // Release verification already downloaded and hashed the exact npm bytes above. Reusing
+    // those bytes keeps the per-release scheduler smoke deterministic and avoids a second
+    // registry/latest resolution. The unattended production nightly still uses @latest.
+    const packageTarget = {
+      spec: candidate,
+      sha256: packageSha256,
+      policy: 'sealed-candidate-exact-cache-v1',
+    };
+    const prepare = npmInvocation(['exec', '--yes', `--package=${packageTarget.spec}`, '--', 'ruvnet-brain', '--help']);
     run(prepare.executable, prepare.args, { env, cwd: home });
     const packageObservations = [observeNpxPackage(npmCache, expectedPackage)];
     // Register the exact public package's plugin in this fresh home. GitHub shorthand can
@@ -400,7 +528,7 @@ export async function runNightlyTwoRunProof({ packagePath, bundlePath, out, time
     scheduler = await import(`${pathToFileURL(path.join(packageRoot, 'plugin', 'scripts', 'nightly-scheduler.mjs')).href}?proof=${Date.now()}`);
     registration = scheduler.installNightlyRunner({ brainHome,
       source: path.join(packageRoot, 'bin', 'nightly-refresh.mjs'), nodePath: process.execPath, identity, env,
-      packageTarget: { spec: 'ruvnet-brain@latest', sha256: null },
+      packageTarget: { spec: packageTarget.spec, sha256: packageTarget.sha256 },
       bundleTarget: { spec: stagedBundle.sourcePath, sha256: stagedBundle.sha256 } });
     const inventoryBefore = managedStorageInventory(kbDir);
     const kick = () => triggerNativeRun({ scheduler, registration, platform: process.platform,
@@ -431,7 +559,7 @@ export async function runNightlyTwoRunProof({ packagePath, bundlePath, out, time
       kind: 'ruvnet-brain-native-two-run-nightly-proof',
       scope: 'installed-update',
       installationConfiguration: { npmBinLinks: false, source: 'initial-reader-install-only', removedEmptyScaffolds },
-      packageExecution: { policy: 'production-latest-exact-cache-v1',
+      packageExecution: { policy: packageTarget.policy,
         expected: { ...expectedPackage, packageSha256 }, observations: packageObservations },
       upstreamFreshness: 'UNKNOWN',
       observedAt: new Date().toISOString(),

package/scripts/public-verification-aggregate.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { canonicalJson, digest } from './coverage-integrity.mjs';
 import { retrievalOracleExpectationFromPlan, validateRetrievalOracleReview } from './independent-review-receipt.mjs';
 import { validateRetrievalCanaryPlan, validateRetrievalCanaryReceipt } from './retrieval-canary.mjs';
-import { validateNightlyProofReceipt } from './nightly-two-run-proof.mjs';
+import { validateNightlyProofReceipt, validateNativeSchedulerSmoke } from './nightly-two-run-proof.mjs';
 
 export const PUBLIC_VERIFICATION_OS = Object.freeze(['linux', 'macos', 'windows']);
 export const PUBLIC_VERIFICATION_MODES = Object.freeze(['claude', 'codex', 'dual']);
@@ -63,12 +63,21 @@ export function validatePublicVerificationLeaf(leaf, { publicKey } = {}) {
   }
   if (leaf.mode === 'dual') {
     if (!/^[1-9][0-9]*$/.test(String(leaf.workflowRunId || ''))) throw new Error('native nightly workflow run identity is missing');
-    const native = validateNightlyProofReceipt(leaf.nativeNightly, {
-      platform: { linux: 'linux', macos: 'darwin', windows: 'win32' }[leaf.os],
-      version: leaf.version, sourceSha: leaf.sourceSha, workflowRunId: leaf.workflowRunId,
-      packageSha256: leaf.artifactSha256, bundleSha256: leaf.bundleSha256, publicKey,
-    });
-    if (!native.ok) throw new Error(`${leaf.os}/dual native nightly proof failed: ${native.failures.join('; ')}`);
+    if (leaf.nativeNightly !== undefined) {
+      const native = validateNightlyProofReceipt(leaf.nativeNightly, {
+        platform: { linux: 'linux', macos: 'darwin', windows: 'win32' }[leaf.os],
+        version: leaf.version, sourceSha: leaf.sourceSha, workflowRunId: leaf.workflowRunId,
+        packageSha256: leaf.artifactSha256, bundleSha256: leaf.bundleSha256, publicKey,
+      });
+      if (!native.ok) throw new Error(`${leaf.os}/dual native nightly proof failed: ${native.failures.join('; ')}`);
+    } else {
+      const smoke = validateNativeSchedulerSmoke(leaf.nativeSchedulerSmoke, {
+        platform: { linux: 'linux', macos: 'darwin', windows: 'win32' }[leaf.os],
+        sourceSha: leaf.sourceSha, workflowRunId: leaf.workflowRunId, bundleSha256: leaf.bundleSha256,
+        packageSha256: leaf.artifactSha256,
+      });
+      if (!smoke.ok) throw new Error(`${leaf.os}/dual native scheduler smoke failed: ${smoke.failures.join('; ')}`);
+    }
   } else if (leaf.nativeNightly !== undefined) {
     throw new Error('native nightly proof belongs only to the dual-host leaf');
   }

package/scripts/public-verification-lane.mjs

@@ -178,18 +178,26 @@ export async function createPublicVerificationLane({
       failures.push({ mode, reason: error.message, retrieval });
       continue;
     }
-    // Native scheduler lifecycle is qualified in the reviewed cross-platform
-    // release suite. The live public adapter opts out because that proof relies
-    // on maintainer-only host tooling; test adapters still exercise the seam.
+    // Native scheduler lifecycle is part of the accepted release contract. Keep
+    // the public lane bound to the same proof required by the leaf/aggregate
+    // validators; an adapter cannot silently downgrade a dual-host leaf.
     let nativeNightly;
-    if (mode === 'dual' && adapter.publicNativeNightly !== false) {
-      if (typeof adapter.runNativeNightly !== 'function') throw new Error('native nightly proof adapter is required');
-      nativeNightly = await adapter.runNativeNightly({ identity, workflowRunId: String(workflowRunId) });
+    let nativeSchedulerSmoke;
+    if (mode === 'dual') {
+      const schedulerMode = process.env.RUVNET_PUBLIC_SCHEDULER_MODE || 'full';
+      if (schedulerMode === 'smoke') {
+        if (typeof adapter.runNativeNightlySmoke !== 'function') throw new Error('native scheduler smoke adapter is required');
+        nativeSchedulerSmoke = await adapter.runNativeNightlySmoke({ identity, workflowRunId: String(workflowRunId) });
+      } else {
+        if (typeof adapter.runNativeNightly !== 'function') throw new Error('native nightly proof adapter is required');
+        nativeNightly = await adapter.runNativeNightly({ identity, workflowRunId: String(workflowRunId) });
+      }
     }
     leaves.push(createPublicVerificationLeaf({
       ...common,
       ...(publication.acceptancePolicy ? { acceptancePolicy: publication.acceptancePolicy, searchTiming: { firstSearchMs: installed.searchMs, broadMs: publication.brain.broadMs, deadlineMs: publication.brain.deadlineMs } } : {}),
       ...(nativeNightly === undefined ? {} : { nativeNightly }),
+      ...(nativeSchedulerSmoke === undefined ? {} : { nativeSchedulerSmoke }),
       os,
       mode,
       status: verifiedRetrieval.receiptSha256 === retrieval.receiptSha256 ? 'completed' : 'failed',

package/scripts/publication-receipt.mjs

@@ -20,7 +20,12 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt, evaluatePublicationReceipt } from './release-proof.mjs';
 import { verifyPayload } from './release-payload.mjs';
 import { resolveInstalledCanaryCitation } from './retrieval-canary.mjs';
-import { runNightlyTwoRunProof, validateNightlyProofReceipt } from './nightly-two-run-proof.mjs';
+import {
+  runNativeSchedulerSmoke,
+  runNightlyTwoRunProof,
+  validateNativeSchedulerSmoke,
+  validateNightlyProofReceipt,
+} from './nightly-two-run-proof.mjs';
 import { parseRetrievalResult } from '../kb/retrieval-result.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
@@ -59,6 +64,39 @@ function command(name, args, options = {}) {
   }
   return String(result.stdout || '').trim();
 }
+
+// The public host matrix owns three independent install fixtures.  Keep their long-running
+// installer/doctor processes asynchronous: a synchronous child here would block Node's event loop,
+// freezing an already-started MCP deadline while the next host is being installed.  That was the
+// concrete reason the macOS recovery lane reported a false 30-second Brain timeout after all three
+// installs had succeeded.  Short metadata probes still use command() above; only the host work uses
+// this bounded async boundary.
+function commandAsync(name, args, options = {}) {
+  const { platform = process.platform, timeout, ...spawnOptions } = options;
+  const invocation = commandInvocation(name, args, { platform, env: spawnOptions.env || process.env });
+  return new Promise((resolve, reject) => {
+    const child = spawn(invocation.executable, invocation.args, spawnOptions);
+    let settled = false;
+    let timer;
+    const finish = (error, value = '') => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      error ? reject(error) : resolve(value);
+    };
+    if (timeout !== undefined) {
+      timer = setTimeout(() => {
+        child.kill('SIGTERM');
+        finish(new Error(`${name} ${args.join(' ')} exceeded ${timeout}ms deadline`));
+      }, timeout);
+    }
+    child.once('error', (error) => finish(error));
+    child.once('close', (code, signal) => {
+      if (code === 0) finish(null);
+      else finish(new Error(`${name} ${args.join(' ')} failed: ${signal || `exit ${code}`}`));
+    });
+  });
+}
 export function validateCandidateSource(root, { sha, version }) {
   const candidateRoot = fs.realpathSync(root);
   const options = { cwd: candidateRoot };
@@ -302,8 +340,9 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
   const mcpSessions = new Map();
   const passageFileDigests = new Map();
   let installTemp = null;
+  let installedPackageRoot = null;
+  let installedBundlePath = null;
   return {
-    publicNativeNightly: false,
     async downloadNpm({ version, destination }) {
       const metadata = JSON.parse(command('npm', ['view', `${PACKAGE}@${version}`, '--json']));
       if (metadata.version !== version || !metadata.dist?.tarball) {
@@ -340,8 +379,12 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
         if (sha256(npm.path) !== identity.packageSha256 || sha256(bundle.path) !== identity.bundleSha256
           || npm.version !== identity.version || bundle.sha !== identity.candidateSha
           || signature.sha !== identity.candidateSha) throw new Error('nightly public artifact identity mismatch');
+        const timeoutMs = Number(process.env.RUVNET_PUBLIC_NATIVE_TIMEOUT_MS || 10 * 60 * 1000);
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 60_000) {
+          throw new Error('RUVNET_PUBLIC_NATIVE_TIMEOUT_MS must be an integer of at least 60000ms');
+        }
         const proof = await runNightlyTwoRunProof({ packagePath: npm.path, bundlePath: bundle.path,
-          signaturePath: signature.path, sourceSha: identity.candidateSha, workflowRunId,
+          signaturePath: signature.path, sourceSha: identity.candidateSha, workflowRunId, timeoutMs,
           out: path.join(temp, 'nightly-proof.json') });
         const validation = validateNightlyProofReceipt(proof, { platform: process.platform, version: identity.version,
           packageSha256: identity.packageSha256, bundleSha256: identity.bundleSha256,
@@ -355,6 +398,44 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
       }
     },
 
+    async runNativeNightlySmoke({ identity, workflowRunId }) {
+      const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-scheduler-smoke-'));
+      try {
+        const npm = await this.downloadNpm({ version: identity.version,
+          destination: path.join(temp, 'package.tgz') });
+        const bundle = await this.downloadGithub({ tag: identity.tag, assetName: 'ruvnet-brain.zip',
+          destination: path.join(temp, 'ruvnet-brain.zip') });
+        if (sha256(npm.path) !== identity.packageSha256 || sha256(bundle.path) !== identity.bundleSha256
+          || npm.version !== identity.version || bundle.sha !== identity.candidateSha) {
+          throw new Error('scheduler smoke public artifact identity mismatch');
+        }
+        const packageRoot = installedPackageRoot || path.join(temp, 'package');
+        if (!installedPackageRoot) {
+          const extraction = tarExtractionInvocation(npm.path, temp);
+          command('tar', extraction.args, { cwd: extraction.cwd });
+          if (!fs.existsSync(packageRoot)) throw new Error('scheduler smoke package extraction failed');
+        }
+        const brainHome = path.join(temp, 'brain');
+        const smokeHome = path.join(temp, 'home');
+        fs.mkdirSync(smokeHome, { recursive: true });
+        const smokeEnv = { ...process.env, HOME: smokeHome, USERPROFILE: smokeHome,
+          RUVNET_BRAIN_HOME: brainHome, RUVNET_BRAIN_KB: path.join(brainHome, 'kb'),
+          PATH: process.env.PATH || '' };
+        const smoke = await runNativeSchedulerSmoke({ packageRoot, packagePath: npm.path,
+          bundlePath: installedBundlePath || bundle.path, sourceSha: identity.candidateSha,
+          workflowRunId, env: smokeEnv, brainHome, kbDir: path.join(brainHome, 'kb'),
+          scheduler: await import(`${pathToFileURL(path.join(packageRoot, 'plugin', 'scripts', 'nightly-scheduler.mjs')).href}?smoke=${Date.now()}`) });
+        const validation = validateNativeSchedulerSmoke(smoke, {
+          platform: process.platform, sourceSha: identity.candidateSha,
+          workflowRunId, bundleSha256: identity.bundleSha256, packageSha256: identity.packageSha256,
+        });
+        if (!validation.ok) throw new Error(`scheduler smoke failed: ${validation.failures.join('; ')}`);
+        return smoke;
+      } finally {
+        fs.rmSync(temp, { recursive: true, force: true });
+      }
+    },
+
     async installHosts({ artifactPath, artifactSha256, bundlePath, bundleSha256, version }) {
       const temp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-install-')));
       installTemp = temp;
@@ -362,14 +443,20 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
       const extraction = tarExtractionInvocation(artifactPath, temp);
       command('tar', extraction.args, { cwd: extraction.cwd });
       stageVerifiedBundle({ bundlePath, bundleSha256, packageRoot });
+      installedPackageRoot = packageRoot;
+      installedBundlePath = path.join(packageRoot, 'dist', 'ruvnet-brain.zip');
       const sealedPlugin = path.join(packageRoot, 'plugin');
       const results = {};
       let bundle = null;
       const sharedModelCache = path.join(temp, 'models-cache');
       fs.mkdirSync(sharedModelCache, { recursive: true });
-      // Derived from HOST_MODES, so a fourth host shape is added in ONE place and this loop
-      // cannot fall behind the staged-side check the way it did.
-      for (const mode of HOST_MODES.map((m) => RECEIPT_MODE_NAMES[m])) {
+      // Derived from HOST_MODES, so a fourth host shape is added in ONE place and this matrix
+      // cannot fall behind the staged-side check the way it did. Each host owns its HOME and
+      // mutable state, so installation runs concurrently rather than adding three cold-start
+      // durations together on slower runners. Search is deliberately a second phase: one real
+      // query warms the shared model cache before the other two hosts start their MCP workers.
+      const hostResults = await Promise.all(HOST_MODES.map(async (hostMode) => {
+        const mode = RECEIPT_MODE_NAMES[hostMode];
         console.log(`Public verification: installing ${mode} on ${process.platform}`);
         const home = path.join(temp, `home-${mode}`);
         const codexHome = path.join(home, '.codex');
@@ -398,12 +485,12 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
             ? { CODEX_BIN: nativeCodexExecutable() } : {}),
         };
         if (mode !== 'claudeOnly') {
-          command(env.CODEX_BIN || 'codex', ['--version'], { env, timeout: 30_000, stdio: 'inherit' });
-          command(env.CODEX_BIN || 'codex', ['plugin', 'list', '--json'], { env, timeout: 30_000, stdio: 'inherit' });
+          await commandAsync(env.CODEX_BIN || 'codex', ['--version'], { env, timeout: 30_000, stdio: 'inherit' });
+          await commandAsync(env.CODEX_BIN || 'codex', ['plugin', 'list', '--json'], { env, timeout: 30_000, stdio: 'inherit' });
         }
-        if (process.platform === 'win32') command('git', ['--version'], { env, timeout: 30_000, stdio: 'inherit' });
+        if (process.platform === 'win32') await commandAsync('git', ['--version'], { env, timeout: 30_000, stdio: 'inherit' });
         const installer = path.join(packageRoot, 'bin', 'install.mjs');
-        command(process.execPath, [
+        await commandAsync(process.execPath, [
           installer, '--yes', '--force', '--version', `v${version}`,
           '--no-nightly-prompt', '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline',
           '--no-selfcheck', '--no-verify',
@@ -425,21 +512,44 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
           throw new Error(`${mode} installed public Brain bundle version mismatch`);
         }
         bundle ||= { brainVersion: source.brainVersion, releaseTag: source.releaseTag };
-        const searched = await rpcSearch(findMcpServer(home), env,
-          'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS);
-        command(process.execPath, [installer, '--doctor', '--hooks'], {
-          env, cwd: packageRoot, timeout: 300_000, stdio: 'inherit',
+        return {
+          mode,
+          verified,
+          context: { temp, home, codexHome, brainHome, kb, env, packageRoot },
+          installer,
+          bundle: { brainVersion: source.brainVersion, releaseTag: source.releaseTag },
+        };
+      }));
+
+      // Warm one installed worker before opening the other two. Concurrent first-run model loads
+      // contend for the same cache and can exceed the public 30-second search acceptance window;
+      // this keeps the window strict while making the expensive work bounded and parallel.
+      const searched = new Map();
+      const first = hostResults[0];
+      searched.set(first.mode, await rpcSearch(findMcpServer(first.context.home), first.context.env,
+        'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS));
+      await Promise.all(hostResults.slice(1).map(async ({ mode, context }) => {
+        searched.set(mode, await rpcSearch(findMcpServer(context.home), context.env,
+          'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS));
+      }));
+      await Promise.all(hostResults.map(async ({ context, installer }) => {
+        await commandAsync(process.execPath, [installer, '--doctor', '--hooks'], {
+          env: context.env, cwd: packageRoot, timeout: 300_000, stdio: 'inherit',
         });
+      }));
+
+      for (const { mode, verified, context } of hostResults) {
+        const search = searched.get(mode);
         results[mode] = {
           status: 'PASS', doctorExit: 0, version, artifactSha256,
-          functionalSearch: true, searchMs: searched.broadMs, hostsOnPath: mode,
+          functionalSearch: true, searchMs: search.broadMs, hostsOnPath: mode,
           ...verified,
         };
-        installContexts.set(MODE_FROM_RECEIPT_NAME[mode], { temp, home, codexHome, brainHome, kb, env, packageRoot });
+        installContexts.set(MODE_FROM_RECEIPT_NAME[mode], context);
       }
       return {
         ...results,
-        bundle,
+        bundle: hostResults[0]?.bundle || bundle,
       };
     },
 

package/scripts/qe/agentic-qe-4.3.mjs

@@ -30,6 +30,17 @@ const LANES = Object.freeze({
     { kind: 'command', command: npm, args: ['run', 'version:check'], timeoutMs: 60_000 },
     vitest(['tests/qe/gpt56/critical-risk-map.test.mjs'], 60_000),
   ],
+  // Early public-artifact smoke: exercise the exact packed installer and host convergence on
+  // every OS before publication. This is deliberately smaller than terminal public verification:
+  // it proves the candidate package boundary early, while the protected post-publication matrix
+  // still owns public bytes, retrieval canaries, and native scheduled-update proof.
+  'early-public': [
+    vitest([
+      'tests/qe/release/packed-clean-install.test.mjs',
+      'tests/qe/release/issue-64-host-convergence.test.mjs',
+      'tests/unit/npm-tarball-codex.test.mjs',
+    ], 180_000),
+  ],
   check: [
     vitest([
       'tests/qe/gpt56/critical-risk-map.test.mjs',

package/scripts/release-transaction-provider.mjs

@@ -202,6 +202,12 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
         ? receiptsFor(hydratedRelease(releaseById(matchingDrafts[0].id))) : [];
       const latestByTransaction = new Map();
       for (const release of all) {
+        // Draft-release assets are not readable through the public GitHub API (they return 404
+        // even though the release metadata is visible).  The matching candidate above is read
+        // explicitly because the publisher owns it; unrelated drafts are not public channel
+        // state and must not make every subsequent release fail while scanning history. Published
+        // releases remain fully receipt-gated and continue to block competing transactions.
+        if (release.draft && release.tag_name !== identity.tag) continue;
         for (const receipt of receiptsFor(hydratedRelease(release))) {
           const prior = latestByTransaction.get(receipt.transactionId);
           if (!prior || receipt.sequence > prior.receipt.sequence) {