ruvnet-brain 4.3.18 → 4.3.20

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.18 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.18-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.20 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.20-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -673,8 +673,8 @@ export async function unzipInto(zipPath, cacheDir, sourceDir = null) {
  * Registry reachability identifies candidates; it is not deletion proof. Claude freezes
  * CLAUDE_PLUGIN_ROOT at session start, so an unregistered generation can remain live until that
  * session exits. Modern roots expose `.in_use` PID-incarnation leases. Live or ambiguous leases
- * retain the complete root; dead leases are collected. Legacy roots without the protocol receive
- * a 14-day compatibility grace.
+ * retain the complete root; dead leases are collected. Legacy roots without the protocol are
+ * retained indefinitely because a frozen host session is not observable without a lease.
  *
  * WHAT MAKES DELETION SAFE HERE, since this removes directories from someone's machine:
  *   • The registry is the ONLY authority. Unreadable, missing, or naming no ruvnet-brain install →
@@ -786,7 +786,11 @@ export function prunePluginGenerations({
       continue;
     }
 
-    if (!leaseCapable && now() - orphanedAt < graceMs) continue;
+    if (!leaseCapable) {
+      if (now() - orphanedAt < graceMs) continue;
+      cleanupBlocked.push({ version: candidate.version, reason: 'legacy generation has no liveness lease; refusing destructive cleanup' });
+      continue;
+    }
     let safeToReap = true;
     for (const leaseName of leaseNames) {
       const leasePath = path.join(leaseDir, leaseName);
@@ -2915,29 +2919,82 @@ function missingUpdaterHelp(kbDir) {
   console.error(`  — the current bundle ships forge-update.mjs; then this command will work.`);
 }
 
-function acquireHostConvergenceLock(lockPath) {
-  try {
-    fs.mkdirSync(lockPath);
-    fs.writeFileSync(path.join(lockPath, 'owner.json'), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
-    return { acquired: true, release: () => fs.rmSync(lockPath, { recursive: true, force: true }) };
-  } catch (error) {
-    if (error?.code !== 'EEXIST') return { acquired: false, error: error.message };
+export function acquireHostConvergenceLock(lockPath, {
+  staleMs = 5 * 60 * 1000,
+  now = () => Date.now(),
+  processAlive = (pid, owner) => {
+    if (owner?.host && owner.host !== os.hostname()) return true;
+    try { process.kill(pid, 0); return true; }
+    catch (error) { return error?.code !== 'ESRCH'; }
+  },
+} = {}) {
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const token = crypto.randomBytes(16).toString('hex');
+  const owner = {
+    pid: process.pid,
+    host: os.hostname(),
+    token,
+    startedAt: new Date(now()).toISOString(),
+  };
+  const publish = () => {
+    try {
+      // mkdir is the exclusive operation. The owner write follows it, but an incomplete
+      // directory is treated as busy until the stale threshold; no contender may reclaim it in
+      // that publication window. This avoids rename-over-empty-directory replacement on macOS.
+      fs.mkdirSync(lockPath, { recursive: false });
+      fs.writeFileSync(path.join(lockPath, 'owner.json'), JSON.stringify(owner), { flag: 'wx', mode: 0o600 });
+      return true;
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+      return false;
+    }
+  };
+  const release = () => {
+    const quarantine = `${lockPath}.release-${process.pid}-${token}`;
     try {
-      const owner = JSON.parse(fs.readFileSync(path.join(lockPath, 'owner.json'), 'utf8'));
-      if (Number.isInteger(owner.pid) && owner.pid !== process.pid) {
-        try { process.kill(owner.pid, 0); return { acquired: false, error: `another host synchronization is running (pid ${owner.pid})` }; }
-        catch (probeError) { if (probeError?.code !== 'ESRCH') return { acquired: false, error: 'another host synchronization owns the lock' }; }
+      const current = JSON.parse(fs.readFileSync(path.join(lockPath, 'owner.json'), 'utf8'));
+      if (current?.token !== token) return false;
+      fs.renameSync(lockPath, quarantine);
+      const moved = JSON.parse(fs.readFileSync(path.join(quarantine, 'owner.json'), 'utf8'));
+      if (moved?.token !== token) {
+        try { fs.renameSync(quarantine, lockPath); } catch { /* preserve evidence if another writer won */ }
+        return false;
       }
-    } catch { /* an incomplete lock is safe to reclaim */ }
-    fs.rmSync(lockPath, { recursive: true, force: true });
+      fs.rmSync(quarantine, { recursive: true, force: true });
+      return true;
+    } catch { return false; }
+  };
+
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      if (publish()) return { acquired: true, release };
+    } catch (error) {
+      return { acquired: false, error: error.message };
+    }
+
+    let existing;
+    let lockAge = 0;
+    try {
+      const stat = fs.statSync(lockPath);
+      lockAge = Math.max(0, now() - stat.mtimeMs);
+      existing = JSON.parse(fs.readFileSync(path.join(lockPath, 'owner.json'), 'utf8'));
+    } catch { /* an incomplete lock is handled below, with a grace period */ }
+    if (existing && Number.isInteger(existing.pid) && processAlive(existing.pid, existing)) {
+      return { acquired: false, error: `another host synchronization is running (pid ${existing.pid})` };
+    }
+    if (!existing && lockAge < staleMs) {
+      return { acquired: false, error: 'another host synchronization is publishing its lock' };
+    }
+    const quarantine = `${lockPath}.reclaim-${process.pid}-${token}-${attempt}`;
     try {
-      fs.mkdirSync(lockPath);
-      fs.writeFileSync(path.join(lockPath, 'owner.json'), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
-      return { acquired: true, release: () => fs.rmSync(lockPath, { recursive: true, force: true }) };
-    } catch (retryError) {
-      return { acquired: false, error: retryError.message };
+      fs.renameSync(lockPath, quarantine);
+      fs.rmSync(quarantine, { recursive: true, force: true });
+    } catch (error) {
+      if (error?.code === 'ENOENT') continue;
+      return { acquired: false, error: `host synchronization lock changed concurrently: ${error.message}` };
     }
   }
+  return { acquired: false, error: 'host synchronization lock changed concurrently' };
 }
 
 export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
@@ -2995,9 +3052,18 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
   if (!fs.existsSync(apply)) return fail({ error: 'Stable Spine updater missing from package' });
   const applied = runStableSpine(apply);
   const okApplied = !applied.error && applied.status === 0;
+  const codexReceipt = {
+    state: results.codex?.action === 'disabled' ? 'disabled' : (results.codexHost?.host ? 'ready' : 'absent'),
+    version: results.codex?.version || null,
+  };
+  if (results.codex?.restartRequired === true) {
+    codexReceipt.restartRequired = true;
+    codexReceipt.sessionSafety = results.codex.sessionSafety || null;
+    codexReceipt.sessionSafetyReason = results.codex.sessionSafetyReason || null;
+  }
   if (okApplied) {
     // ISSUE #153 — a running host may freeze an old plugin root. Reclaim only generations whose
-    // modern leases prove no live consumer, or legacy generations past the compatibility grace.
+    // modern leases prove no live consumer; legacy roots without that proof stay on disk.
     try {
       const gens = prunePluginGenerations({ apply: true });
       if (gens.retired?.length) {
@@ -3028,7 +3094,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
         verifiedAt: new Date().toISOString(),
         hosts: {
           claude: { state: results.claude.host ? 'ready' : 'absent', version: results.claude.version || null },
-          codex: { state: results.codex?.action === 'disabled' ? 'disabled' : (results.codexHost?.host ? 'ready' : 'absent'), version: results.codex?.version || null },
+          codex: codexReceipt,
         },
         consoleRuntime: results.consoleRuntime,
       }, null, 2));
@@ -3043,7 +3109,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
     desiredVersion: PACKAGE_VERSION,
     hosts: {
       claude: { state: results.claude.host ? 'ready' : 'absent', version: results.claude.version || null },
-      codex: { state: results.codex?.action === 'disabled' ? 'disabled' : (results.codexHost?.host ? 'ready' : 'absent'), version: results.codex?.version || null },
+      codex: codexReceipt,
     },
     consoleRuntime: results.consoleRuntime,
   });
@@ -3061,7 +3127,11 @@ export function classifyHostConvergence(receipt, expectedVersion = PACKAGE_VERSI
   }
   const hostStates = Object.values(receipt.hosts || {});
   const badHost = hostStates.find((host) => !['ready', 'disabled', 'absent'].includes(host?.state)
-    || (host.state === 'ready' && !versionSatisfies(host.version, expectedVersion)));
+    || (host.state === 'ready' && !versionSatisfies(host.version, expectedVersion))
+    || (host.state === 'ready' && host.restartRequired === true));
+  if (badHost?.restartRequired === true) {
+    return { healthy: false, state: 'host-restart-required', action: badHost.sessionSafetyReason || 'restart the host, then re-run --doctor' };
+  }
   if (badHost) return { healthy: false, state: 'host-pending', action: 're-run host synchronization' };
   if (receipt.consoleRuntime?.state !== 'ready') {
     return { healthy: false, state: receipt.consoleRuntime?.state || 'console-unproven', action: 'restart Console, then re-run --doctor' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.18",
+  "version": "4.3.20",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships an enforced UserPromptSubmit retrieve-and-inject grounding hook that sharply reduces drift.",
-  "version": "4.3.18",
+  "version": "4.3.20",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.18",
+  "version": "4.3.20",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/session-start-core.mjs

@@ -248,6 +248,19 @@ const announceVersion = ({ running, off, stateDir, consoleInvoke, emit }) => {
   write(announced, `${running}\n`);
 };
 
+const compareVersions = (a, b) => {
+  const left = String(a).split(/[.-]/).map((part) => (/^\d+$/.test(part) ? Number(part) : part));
+  const right = String(b).split(/[.-]/).map((part) => (/^\d+$/.test(part) ? Number(part) : part));
+  for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+    const x = left[i] ?? 0;
+    const y = right[i] ?? 0;
+    if (x === y) continue;
+    if (typeof x === 'number' && typeof y === 'number') return x - y;
+    return String(x) < String(y) ? -1 : 1;
+  }
+  return 0;
+};
+
 const stableSpine = ({ env, hookDir, stateDir, home, pluginVersion, emit, now }) => {
   const activeFile = path.join(stateDir, 'active.json');
   const stamp = path.join(stateDir, '.last-update-check');
@@ -270,7 +283,11 @@ const stableSpine = ({ env, hookDir, stateDir, home, pluginVersion, emit, now })
     }
   } else {
     const active = json(activeFile);
-    if (active?.shellChanged && pluginVersion && active.version && active.version !== pluginVersion) {
+    const shellBoundary = active?.shellChangedAtVersion;
+    const shellChangedBeforeHost = shellBoundary && pluginVersion
+      ? compareVersions(pluginVersion, shellBoundary) < 0
+      : false;
+    if ((active?.shellChanged || shellChangedBeforeHost) && pluginVersion && active.version && active.version !== pluginVersion) {
       emit(`[RuvNet Brain — v${active.version} changed boot-level declarations (the rare case); this session booted v${pluginVersion}'s]`);
       const host = env.RUVNET_HOOK_HOST || 'claude';
       const convergence = json(path.join(stateDir, 'host-convergence.json'));
@@ -371,6 +388,8 @@ export async function runSessionStart({
       || s.startsWith('[RuvNet Brain — grounding not yet PROVEN')
       || s.startsWith('The last check (')
       || s.startsWith('[RuvNet Brain — update available')
+      || s.startsWith('[RuvNet Brain — v')
+      || s.startsWith('Tell the user ONE line: "🧠 RuvNet Brain v')
       || s.startsWith('[RuvNet Brain — brain OFF by your setting')
       || s.startsWith('[RuvNet Brain — new in v')
       || s.startsWith('[RuvNet Brain — first session initialized]')

package/plugin/scripts/update-apply.mjs

@@ -212,18 +212,34 @@ function promote(staging, version) {
 // the update is fully live with no restart and session-start stays silent; if any did, the ONE
 // honest nag fires (the release classifier computes the same thing publish-side; this is the
 // client-side truth for locally-applied generations). Red-team finding 18's client half.
-const SHELL_PATHS = ['hooks/hooks.json', 'scripts/hook-shim.mjs', 'mcp/server.mjs', '.mcp.json'];
-function shellDiff(prevRootAbs, nextRootAbs) {
+export const SHELL_PATHS = [
+  'hooks/hooks.json',
+  'scripts/hook-shim.mjs',
+  'scripts/hook-shim-bash.mjs',
+  'scripts/development-maintenance.mjs',
+  'mcp/server.mjs',
+  '.mcp.json',
+];
+
+function treeDigest(root, relative) {
+  const target = path.join(root, relative);
+  let stat;
+  try { stat = fs.lstatSync(target); } catch { return '<missing>'; }
+  if (stat.isSymbolicLink()) return '<symlink>';
+  if (stat.isFile()) return `file:${crypto.createHash('sha256').update(fs.readFileSync(target)).digest('hex')}`;
+  if (!stat.isDirectory()) return `<special:${stat.mode}>`;
+  const entries = fs.readdirSync(target, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  return `dir:${entries.map((entry) => `${entry.name}:${treeDigest(target, entry.name)}`).join('|')}`;
+}
+
+export function shellDiff(prevRootAbs, nextRootAbs) {
   const changed = [];
   for (const rel of SHELL_PATHS) {
-    const a = (() => { try { return fs.readFileSync(path.join(prevRootAbs, rel), 'utf8'); } catch { return null; } })();
-    const b = (() => { try { return fs.readFileSync(path.join(nextRootAbs, rel), 'utf8'); } catch { return null; } })();
-    if (a !== b) changed.push(rel);
+    if (treeDigest(prevRootAbs, rel) !== treeDigest(nextRootAbs, rel)) changed.push(rel);
   }
   // skills/ and commands/ are boot-loaded markdown: any file-set or content difference counts.
   for (const dir of ['skills', 'commands']) {
-    const list = (root) => { try { return fs.readdirSync(path.join(root, dir), { recursive: true }).sort().join('|'); } catch { return ''; } };
-    if (list(prevRootAbs) !== list(nextRootAbs)) changed.push(`${dir}/`);
+    if (treeDigest(prevRootAbs, dir) !== treeDigest(nextRootAbs, dir)) changed.push(`${dir}/`);
   }
   return changed;
 }
@@ -239,6 +255,15 @@ function flip(version, codeRootAbs, why) {
     previous: prev ? { generation: prev.generation, version: prev.version, codeRoot: prev.codeRoot } : null,
     shellChanged: shellChanged.length > 0,
     shellChangedPaths: shellChanged,
+    // Keep the first boot-level change attached to subsequent body-only generations. A host that
+    // still booted the pre-change generation must not lose the restart signal merely because a
+    // later update changed only implementation code.
+    shellChangedSinceVersion: shellChanged.length > 0
+      ? (prev?.version || version)
+      : (prev?.shellChangedSinceVersion || null),
+    shellChangedAtVersion: shellChanged.length > 0
+      ? version
+      : (prev?.shellChangedAtVersion || null),
     flippedAt: new Date().toISOString(),
   };
   writeAtomic(TXN, JSON.stringify({ state: 'flipping', from: prev?.version ?? null, to: version }));
@@ -446,4 +471,4 @@ function main() {
   }
 }
 
-process.exit(main());
+if (process.env.RUVNET_BRAIN_IMPORT_ONLY !== 'update-shell-test') process.exit(main());

package/scripts/eval-brain.mjs

@@ -80,10 +80,11 @@ export function wilson(k, n, z = 1.96) {
  * answers "does the query reach the store that actually holds the answer" (brain-score.mjs's own
  * wording for this metric) — that store is the one named in `receipt`, when one was verified.
  */
-export function gradeQuestion(q, { grounded, citations, bannerPresent, receipt }) {
+export function gradeQuestion(q, { grounded, citations, bannerPresent, receipt, repoAliases = {} }) {
   const top = citations?.[0] ?? null;
   const routedRepo = receipt?.repo ?? top?.repo ?? null;
-  const routed = !!(grounded && q.expectRepo?.length && routedRepo && q.expectRepo.includes(routedRepo));
+  const routed = !!(grounded && q.expectRepo?.length && routedRepo
+    && repoMatchesExpected(routedRepo, q.expectRepo, repoAliases));
   const abstained = !top || (typeof top.ce === 'number' && top.ce < ABSTAIN_CE);
   switch (q.stratum) {
     case 'adversarial':
@@ -97,6 +98,16 @@ export function gradeQuestion(q, { grounded, citations, bannerPresent, receipt }
   }
 }
 
+// Ground truth names the logical repository, while the deployed corpus may use a documented
+// store alias (for example agent-harness-generator -> metaharness).  Credit only aliases present
+// in the shipped registry; never turn an arbitrary similarly named store into a pass.
+export function repoMatchesExpected(actual, expected, aliases = {}) {
+  if (!actual || !Array.isArray(expected)) return false;
+  if (expected.includes(actual)) return true;
+  return expected.some((canonical) => Array.isArray(aliases?.[canonical])
+    && aliases[canonical].includes(actual));
+}
+
 /** Aggregate graded rows into the four gated metrics, each with its Wilson interval. */
 export function aggregate(rows) {
   const by = (pred) => rows.filter(pred);
@@ -145,6 +156,11 @@ async function main() {
   const die = (msg) => { console.error(`eval-brain: ${msg}`); process.exit(2); };
 
   if (!fs.existsSync(path.join(KB, 'forge-ask-all.mjs'))) die(`no brain at ${KB} — run: npx ruvnet-brain`);
+  let repoAliases = {};
+  try {
+    const aliasesFile = path.join(KB, 'repo-aliases.json');
+    if (fs.existsSync(aliasesFile)) repoAliases = JSON.parse(fs.readFileSync(aliasesFile, 'utf8'));
+  } catch { /* a legacy bundle simply has no alias normalization to apply */ }
   const verifierPath = path.join(KB, 'verify-citation.mjs');
   if (!fs.existsSync(verifierPath)) die('this bundle predates verify-citation.mjs — refusing to score grounding without a way to check it');
   const { verifyGrounding } = await import(pathToFileURL(verifierPath).href);
@@ -161,7 +177,13 @@ async function main() {
   // serial cost was ~13.5s/question ≈ 27 min for 120; at concurrency 6 the wall drops ~6×.
   const { execFile } = await import('node:child_process');
   const ask = (query) => new Promise((resolve) => {
-    execFile('node', ['forge-ask-all.mjs', '--dir', KB, '--q', query, '--k', '3'],
+    // The evaluator must exercise the same bounded source-routing path used by the production
+    // MCP host.  The old CLI default widened every routed miss to the entire corpus, which turned
+    // a 120-question quality check into a multi-hour cross-encoder run and measured a path no user
+    // actually takes.  Set EVAL_FULL_CORPUS=1 only for an explicit historical fan-out experiment.
+    const args = ['forge-ask-all.mjs', '--dir', KB, '--q', query, '--k', '3'];
+    if (process.env.EVAL_FULL_CORPUS !== '1') args.push('--bounded');
+    execFile('node', args,
       { cwd: KB, timeout: 240000, env: process.env, maxBuffer: 64 * 1024 * 1024 },
       (err, stdout) => resolve(err ? '' : String(stdout || '')));
   });
@@ -190,7 +212,13 @@ async function main() {
         continue;
       }
       const v = await verifyGrounding(out, KB);
-      const graded = gradeQuestion(q, { grounded: v.grounded, citations: v.citations, receipt: v.receipt, bannerPresent: /GIST STATUS/.test(out) });
+      const graded = gradeQuestion(q, {
+        grounded: v.grounded,
+        citations: v.citations,
+        receipt: v.receipt,
+        bannerPresent: /GIST STATUS/.test(out),
+        repoAliases,
+      });
       const top = v.citations?.[0] ?? null;
       rows[i] = {
         id: q.id, stratum: q.stratum, query: q.query,

package/scripts/host-install-matrix.mjs

@@ -395,12 +395,13 @@ export function createInstalledMcpSession({ serverPath, env, timeout = 300_000,
     pending.set(id, { resolve, reject });
     child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
   });
-  const execute = async ({ query = 'How does RuvNet Brain prove a public release artifact?', k = 5 } = {}) => {
+  const execute = async ({ query = 'How does RuvNet Brain prove a public release artifact?', k = 5,
+    timeoutMs = timeout } = {}) => {
     if (terminalError) return { status: null, error: terminalError, signal: exitSignal, stdout: '', stderr };
     stderr = '';
     const timer = setTimeout(() => {
       void close(Object.assign(new Error('MCP search timed out'), { code: 'ETIMEDOUT' }));
-    }, timeout);
+    }, timeoutMs);
     try {
       if (!initialized) {
         const ready = await call('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'release-host-matrix', version: '1' } });
@@ -409,10 +410,12 @@ export function createInstalledMcpSession({ serverPath, env, timeout = 300_000,
         if (!listed.result?.tools?.some((tool) => tool.name === 'search_ruvnet')) throw new Error('installed MCP does not advertise search_ruvnet');
         initialized = true;
       }
+      const started = performance.now();
       const searched = await call('tools/call', { name: 'search_ruvnet', arguments: { query, k } });
+      const broadMs = Math.round(performance.now() - started);
       const stdout = (searched.result?.content || []).map((item) => item.text || '').join('\n');
       if (searched.error || searched.result?.isError) throw new Error(`installed Brain search failed: ${stdout.slice(0, 400)}`);
-      return { status: 0, signal: null, error: null, stdout, stderr, mcpResult: searched.result };
+      return { status: 0, signal: null, error: null, stdout, stderr, broadMs, mcpResult: searched.result };
     } catch (error) {
       await close(error);
       return { status: null, signal: exitSignal, error: terminalError, stdout: '', stderr };

package/scripts/publication-receipt.mjs

@@ -31,6 +31,7 @@ import { parseRetrievalResult } from '../kb/retrieval-result.mjs';
 const REPO = 'stuinfla/ruvnet-brain';
 const PACKAGE = 'ruvnet-brain';
 const DEADLINE_MS = 30_000;
+const WARMUP_TIMEOUT_MS = 300_000;
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -453,8 +454,10 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
       // Derived from HOST_MODES, so a fourth host shape is added in ONE place and this matrix
       // cannot fall behind the staged-side check the way it did. Each host owns its HOME and
       // mutable state, so installation runs concurrently rather than adding three cold-start
-      // durations together on slower runners. Search is deliberately a second phase: one real
-      // query warms the shared model cache before the other two hosts start their MCP workers.
+      // durations together on slower runners. The MCP workers are opened once after installation
+      // and retained through the complete proof. Reusing those workers keeps the model warm for
+      // probeBrain and every retrieval canary; starting a fresh process there caused a real
+      // macOS false negative when cold model startup crossed the 30-second public deadline.
       const hostResults = await Promise.all(HOST_MODES.map(async (hostMode) => {
         const mode = RECEIPT_MODE_NAMES[hostMode];
         console.log(`Public verification: installing ${mode} on ${process.platform}`);
@@ -521,16 +524,39 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
         };
       }));
 
-      // Warm one installed worker before opening the other two. Concurrent first-run model loads
-      // contend for the same cache and can exceed the public 30-second search acceptance window;
-      // this keeps the window strict while making the expensive work bounded and parallel.
+      // Keep one MCP worker per host. The first search on each worker may load the local model,
+      // but all later proofs reuse the initialized process instead of paying that startup cost
+      // again. The fixed deadline remains strict for each actual search operation.
+      for (const { mode, context } of hostResults) {
+        const publicMode = MODE_FROM_RECEIPT_NAME[mode];
+        mcpSessions.set(publicMode, createInstalledMcpSession({
+          serverPath: findMcpServer(context.home), env: context.env, timeout: WARMUP_TIMEOUT_MS,
+        }));
+      }
       const searched = new Map();
-      const first = hostResults[0];
-      searched.set(first.mode, await rpcSearch(findMcpServer(first.context.home), first.context.env,
-        'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS));
-      await Promise.all(hostResults.slice(1).map(async ({ mode, context }) => {
-        searched.set(mode, await rpcSearch(findMcpServer(context.home), context.env,
-          'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS));
+      const searchInstalledHost = async ({ mode }, timeoutMs) => {
+        const publicMode = MODE_FROM_RECEIPT_NAME[mode];
+        const session = mcpSessions.get(publicMode);
+        const result = await session.search({
+          query: 'How does RuvNet Brain prove a public release artifact?', k: 5,
+          timeoutMs,
+        });
+        if (result.error || !result.mcpResult || (Object.hasOwn(result, 'status') && result.status !== 0)) {
+          throw new Error(`installed Brain search failed for ${mode}: ${result.error?.message || 'no MCP result'}`);
+        }
+        if (!/repo=/i.test(result.stdout) || !/path\s*:/i.test(result.stdout)) {
+          throw new Error(`installed Brain search returned no source citation for ${mode}`);
+        }
+        return result;
+      };
+      // Warm each worker serially. The model cache is shared, but simultaneous first-loads can
+      // contend on slower runners (the macOS Codex-only timeout that motivated this path). The
+      // warm-up is bounded generously and is never used as the release latency measurement.
+      for (const host of hostResults) await searchInstalledHost(host, WARMUP_TIMEOUT_MS);
+      // Once initialized, the three steady-state checks can run in parallel and are each held to
+      // the strict public deadline that the receipt and aggregate validators enforce.
+      await Promise.all(hostResults.map(async (host) => {
+        searched.set(host.mode, await searchInstalledHost(host, DEADLINE_MS));
       }));
       await Promise.all(hostResults.map(async ({ context, installer }) => {
         await commandAsync(process.execPath, [installer, '--doctor', '--hooks'], {
@@ -560,8 +586,16 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
       if (rvfs.length === 0) throw new Error('installed public Brain has no ruvnet-brain self RVF');
       const server = path.join(installContext.home, '.claude', 'ruvnet-brain', 'mcp', 'server.mjs');
       if (!fs.existsSync(server)) throw new Error('installed persistent MCP server is missing');
-      const result = await rpcSearch(server, installContext.env,
-        'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS);
+      // installHosts keeps this mode's worker alive, so this probe exercises the same warmed
+      // installed process that passed the host canary instead of starting a cold verifier child.
+      const session = mcpSessions.get(mode);
+      const result = session
+        ? await session.search({ query: 'How does RuvNet Brain prove a public release artifact?', k: 5, timeoutMs: DEADLINE_MS })
+        : await rpcSearch(server, installContext.env,
+          'How does RuvNet Brain prove a public release artifact?', 5, DEADLINE_MS);
+      if (result.error || !result.mcpResult || (Object.hasOwn(result, 'status') && result.status !== 0)) {
+        throw new Error(`installed Brain search failed for ${mode}: ${result.error?.message || 'no MCP result'}`);
+      }
       const readiness = readJson(path.join(installContext.brainHome, 'mcp-readiness.json'));
       if (readiness.state !== 'ready') throw new Error(`installed Brain readiness is ${readiness.state || 'missing'}`);
       return { status: 'PASS', selfStore: true, broadMs: result.broadMs, deadlineMs: DEADLINE_MS };
@@ -578,7 +612,7 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
         session = createInstalledMcpSession({ serverPath: findMcpServer(context.home), env: context.env, timeout: DEADLINE_MS });
         mcpSessions.set(mode, session);
       }
-      const result = await session.search({ query, k });
+      const result = await session.search({ query, k, timeoutMs: DEADLINE_MS });
       return parseRetrievalResult(result.mcpResult, { query, k });
     },
 

package/scripts/wired-check.mjs

@@ -70,7 +70,7 @@ const argv = process.argv.slice(2);
  * every entry on every run, below, so they cannot rot unseen.
  */
 const STANDALONE = [
-  ['gate', 'retired automatic-hook helper retained for explicit use and tests'],
+  ['gate', 'retired automatic-hook helper and manual benchmark retained for explicit human use; no workflow or scheduler invokes this expensive command'],
   ['dream-issue-gate', 'pure Dream Cycle disposition policy; invoked by the external issue adapter, never a GitHub writer'],
   ['sync-census', 'explicit maintainer census writer; a destructive source-to-surface refresh is never scheduled'],
   ['sync-commands', 'explicit maintainer alias synchronizer; run deliberately before release, never from a lifecycle hook'],
@@ -105,8 +105,6 @@ const STANDALONE = [
     + 'stops at sealed preparation with contents:read. This entry validates receipt/archive inputs '
     + 'and delegates mutation to release.mjs protected authority. No operational caller is registered; '
     + 'classification does not claim publication works or has occurred'],
-  ['gate', 'manual benchmark harness: rebuilds concepts and runs three routing proof batteries; '
-    + 'no workflow or scheduler invokes this expensive command'],
   ['execution-preflight', 'external orchestration boundary — invoked by the host before consequential Ruflo/Codex execution; no in-repo caller exists because the host supplies the live Brain and AgentDB receipts'],
   ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
     + 'isolated writing agent to start and hand off a fix lane. Scheduling it would violate its safety '