ruvnet-brain 4.3.21 → 4.3.25

package/scripts/release-abort-stale.mjs

@@ -36,6 +36,7 @@ import path from 'node:path';
 import {
   RECEIPT_PREFIX, isClosedReceipt, ALLOWED_TRANSITIONS, canonicalJson, digestReceipt, signReceipt,
 } from './release-transaction.mjs';
+import { latestCodeReleaseTag } from './release-channel-kind.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
 const arg = (n) => { const i = process.argv.indexOf(n); return i >= 0 ? process.argv[i + 1] : null; };
@@ -75,7 +76,10 @@ if (!(ALLOWED_TRANSITIONS[last.state] || []).includes('aborted')) {
 
 // Never abort something that actually shipped and simply failed to record it.
 const npmLatest = execFileSync('npm', ['view', 'ruvnet-brain@latest', 'version'], { encoding: 'utf8' }).trim();
-const ghLatest = JSON.parse(gh(['api', `repos/${REPO}/releases/latest`])).tag_name;
+// ADR-086 S1: latest may be a corpus generation, which never equals a code tag. Comparing against
+// it would say "this is not the live generation" about a release that genuinely shipped, and then
+// abort it — the exact mistake this check exists to prevent.
+const ghLatest = latestCodeReleaseTag(JSON.parse(gh(['api', `repos/${REPO}/releases?per_page=30`])));
 if (last.identity?.version === npmLatest && last.identity?.tag === ghLatest) {
   die(`${TAG} IS the currently published generation on both channels — that is a converged release, not an abandoned one`);
 }

package/scripts/release-authority.mjs

@@ -4,7 +4,7 @@
 // move an npm dist-tag. CI and the canonical release path both execute this check.
 import fs from 'node:fs';
 import path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const CANONICAL_PUBLISHERS = new Set([
@@ -12,13 +12,59 @@ const CANONICAL_PUBLISHERS = new Set([
   'scripts/release-transaction-provider.mjs',
 ]);
 const SOURCE_EXTENSIONS = new Set(['.mjs', '.js', '.cjs', '.sh', '.yml', '.yaml']);
+const SCANNED_DIRECTORIES = Object.freeze([
+  'scripts', 'deploy', 'bin', '.github/workflows', 'plugin', 'kb', 'console',
+]);
+
+// Cut a trailing line comment WITHOUT touching a `//` that lives inside a string literal. The old
+// form was `line.replace(/\/\/.*$/, '')`, which cuts at the FIRST `//` on the line with no idea
+// what it is inside: a single line carrying a URL ahead of the call — say
+//   const registry = 'https://registry.npmjs.org'; execFileSync('npm', ['publish']);
+// had the publish call deleted before any detector saw it, so the gate reported PASS on a file
+// that plainly publishes. Quote-aware scan, escape-aware, no parser needed.
+function stripLineComment(line) {
+  let quote = null;
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index];
+    if (quote) {
+      if (character === '\\') { index += 1; continue; }
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === '`') { quote = character; continue; }
+    if (character === '/' && line[index + 1] === '/') return line.slice(0, index);
+  }
+  return line;
+}
+
+// A heredoc body is DATA, not executable source — the same reason comments are stripped. Widening
+// this gate to plugin/ immediately proved why it matters: plugin/scripts/ground-ruvnet.sh writes an
+// instruction block containing the words "npm publish" inside `cat <<EOF`, and the gate reported it
+// as an unauthorized publisher. A gate that rejects a compliant file is as broken as one that
+// accepts a violating file; both get fixed, neither gets shipped.
+function stripHeredocBodies(source) {
+  const lines = source.split('\n');
+  const kept = [];
+  let terminator = null;
+  for (const line of lines) {
+    if (terminator !== null) {
+      if (line.trim() === terminator) terminator = null;
+      kept.push('');
+      continue;
+    }
+    const opener = /<<-?\s*(?:'([A-Za-z_][A-Za-z0-9_]*)'|"([A-Za-z_][A-Za-z0-9_]*)"|([A-Za-z_][A-Za-z0-9_]*))/.exec(line);
+    kept.push(line);
+    if (opener) terminator = opener[1] || opener[2] || opener[3];
+  }
+  return kept.join('\n');
+}
 
 function executableSource(source) {
   const withoutBlocks = source.replace(/\/\*[\s\S]*?\*\//g, '');
-  return withoutBlocks
+  return stripHeredocBodies(withoutBlocks)
     .split('\n')
     .filter((line) => !line.trimStart().startsWith('#'))
-    .map((line) => line.replace(/\/\/.*$/, ''))
+    .map(stripLineComment)
     .join('\n');
 }
 
@@ -79,13 +125,47 @@ function sourceFiles(root) {
       else if (entry.isFile() && SOURCE_EXTENSIONS.has(path.extname(entry.name))) files.push(child);
     }
   };
-  visit(path.join(root, 'scripts'));
-  visit(path.join(root, 'deploy'));
-  visit(path.join(root, 'bin'));
-  visit(path.join(root, '.github', 'workflows'));
+  // Every directory that ships executable code, not just the four this gate started with. `plugin/`
+  // and `kb/` were invisible here while both contain real, shipped, executable files — kb/ holds one
+  // of the three trust-root copies checked below, and plugin/skills/*/scripts/ holds genuine release
+  // machinery (plugin/skills/release-proof/scripts/release-proof.mjs). A one-publisher gate that
+  // cannot see half the publishers is a gate in name only.
+  for (const directory of SCANNED_DIRECTORIES) visit(path.join(root, ...directory.split('/')));
   return files;
 }
 
+// The Ed25519 trust root is EMBEDDED in the shipped executables deliberately (SEC-0010 #6): it has
+// to travel with the code, or an attacker who swaps the downloaded bundle could swap the key it is
+// checked against too. rUv's ADR-174 helper-signing bakes RUFLO_HELPERS_PUBKEY in for exactly this
+// reason. Because bin/install.mjs and kb/forge-update.mjs ship standalone across a packaging
+// boundary they cannot import one shared constant, so the copies are reconciled HERE — which is the
+// gate kb/forge-update.mjs's own comment has always promised ("the release gate checks that
+// identity") and which nothing has ever actually performed. Without it, a PR that edits an embedded
+// key to an attacker's, leaving keys/*.pem untouched, ships to every installer and self-updating
+// client with no test and no gate objecting.
+const TRUST_ROOT_FILE = 'keys/ruvnet-brain-signing.pub.pem';
+const TRUST_ROOT_HOLDERS = Object.freeze(['bin/install.mjs', 'kb/forge-update.mjs']);
+const EMBEDDED_TRUST_ROOT = /const SIGNING_PUBKEY_PEM = `(-----BEGIN PUBLIC KEY-----[\s\S]*?-----END PUBLIC KEY-----)`/;
+
+const normalizeKey = (pem) => String(pem).replace(/\r\n/g, '\n').trim();
+
+export function findTrustRootDrift(root = ROOT) {
+  const drift = [];
+  const canonicalFile = path.join(root, TRUST_ROOT_FILE);
+  if (!fs.existsSync(canonicalFile)) return [{ file: TRUST_ROOT_FILE, reason: 'canonical trust root is missing' }];
+  const canonical = normalizeKey(fs.readFileSync(canonicalFile, 'utf8'));
+  for (const holder of TRUST_ROOT_HOLDERS) {
+    const absolute = path.join(root, ...holder.split('/'));
+    if (!fs.existsSync(absolute)) { drift.push({ file: holder, reason: 'trust-root holder is missing' }); continue; }
+    const match = EMBEDDED_TRUST_ROOT.exec(fs.readFileSync(absolute, 'utf8'));
+    if (!match) { drift.push({ file: holder, reason: 'embedded SIGNING_PUBKEY_PEM not found' }); continue; }
+    if (normalizeKey(match[1]) !== canonical) {
+      drift.push({ file: holder, reason: `embedded trust root differs from ${TRUST_ROOT_FILE}` });
+    }
+  }
+  return drift;
+}
+
 export function findUnauthorizedPublishers(root = ROOT) {
   const findings = sourceFiles(root).flatMap((absolute) => {
     const relative = path.relative(root, absolute).split(path.sep).join('/');
@@ -103,15 +183,27 @@ export function findUnauthorizedPublishers(root = ROOT) {
 
 export function main(root = ROOT) {
   const findings = findUnauthorizedPublishers(root);
-  if (findings.length === 0) {
-    console.log('[release-authority] PASS: scripts/release.mjs is the only publisher');
+  const drift = findTrustRootDrift(root);
+  if (findings.length === 0 && drift.length === 0) {
+    console.log('[release-authority] PASS: scripts/release.mjs is the only publisher; trust root is identical in all copies');
     return 0;
   }
-  console.error('[release-authority] FAIL: publication action found outside scripts/release.mjs');
-  for (const finding of findings) console.error(`  ${finding.file}: ${finding.action}`);
+  if (findings.length) {
+    console.error('[release-authority] FAIL: publication action found outside scripts/release.mjs');
+    for (const finding of findings) console.error(`  ${finding.file}: ${finding.action}`);
+  }
+  if (drift.length) {
+    console.error('[release-authority] FAIL: the embedded Ed25519 trust root drifted from its canonical copy');
+    for (const entry of drift) console.error(`  ${entry.file}: ${entry.reason}`);
+  }
   return 1;
 }
 
-if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
+// realpath BOTH sides. `path.resolve` alone leaves a symlinked invocation comparing two different
+// spellings of one file, so the guard silently reads false and the CLI exits 0 having done nothing —
+// the same defect 6eead7bc fixed in release-projection.mjs, which is a gate this repo relies on.
+if (((() => {
+  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
+})())) {
   process.exitCode = main();
 }

package/scripts/release-channel-kind.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// scripts/release-channel-kind.mjs — "what KIND of release is this?", stated once.
+//
+// THE CONFLICT THIS RESOLVES. ADR-086's C4 resolution (S1) requires customer corpus releases to be
+// promoted to `releases/latest`, because kb/forge-update.mjs discovers updates by polling exactly
+// that pointer. But six author-side tools were written when `releases/latest` could only ever be a
+// code release, and each of them independently assumes its tag is a semver `vX.Y.Z`:
+//
+//   scripts/verify-channels.mjs            compares latest's tag to the shipping version — and
+//                                          release.mjs:547-548 runs it as `runOrDie` in step E, so a
+//                                          corpus release on latest BRICKS the owner's own preflight
+//   scripts/published-surface-probe.mjs    asserts npm version == GitHub tag
+//   scripts/github-health-watch.mjs        same equality, nightly — a corpus tag fires a false
+//                                          "issue #77 recurring" alert
+//   scripts/release-transaction-provider.mjs  reads latest mid-transaction, and refuses promotion
+//                                          when latest is not the tag it expected
+//   scripts/release-convergence-watchdog.mjs  would read "not converged" forever and keep dispatching
+//   scripts/release-abort-stale.mjs        would call a genuinely-shipped release abandoned
+//
+// Patching six call sites six ways would leave six subtly different answers to one question. The
+// question is shared, so the answer is shared: `releases/latest` means "what a customer downloads"
+// and may legitimately be EITHER kind; every check about the CODE generation must ask for the latest
+// CODE release instead of assuming latest is one.
+//
+// This module is deliberately PURE — no network, no `gh`, no fetch. Each consumer already has its own
+// transport; handing them a predicate keeps this testable and keeps the transports theirs.
+
+/** Content-addressed corpus generation: the tag IS the archive's sha256. */
+export const CORPUS_TAG_PATTERN = /^corpus-sha256-[0-9a-f]{64}$/;
+/** Owner-approved product release: a plain semver tag. */
+export const CODE_TAG_PATTERN = /^v\d+\.\d+\.\d+$/;
+
+export function releaseKind(tag) {
+  const value = String(tag ?? '');
+  if (CORPUS_TAG_PATTERN.test(value)) return 'corpus';
+  if (CODE_TAG_PATTERN.test(value)) return 'code';
+  return 'other';
+}
+
+export const isCorpusReleaseTag = (tag) => releaseKind(tag) === 'corpus';
+export const isCodeReleaseTag = (tag) => releaseKind(tag) === 'code';
+
+const timeOf = (release) => {
+  const parsed = Date.parse(release?.published_at || release?.created_at || release?.publishedAt || release?.createdAt || '');
+  return Number.isFinite(parsed) ? parsed : null;
+};
+const tagOf = (release) => String(release?.tag_name ?? release?.tagName ?? '');
+const isDraft = (release) => release?.draft === true || release?.isDraft === true;
+
+/**
+ * The newest published CODE release from a `GET /repos/{owner}/{repo}/releases` page (or a
+ * `gh release list --json` page — both spellings are accepted).
+ *
+ * Drafts are excluded: a draft has no tag a customer or a channel check can resolve. Prereleases are
+ * NOT excluded — the repo genuinely ships stabilization generations, and treating one as invisible
+ * would reintroduce the "latest is stale" blindness from the other direction.
+ *
+ * Ordering is by publication time when the API supplies it, falling back to list order, which the
+ * GitHub releases API already returns newest-first.
+ */
+export function pickLatestCodeRelease(releases) {
+  const rows = (Array.isArray(releases) ? releases : [])
+    .filter((release) => release && !isDraft(release) && isCodeReleaseTag(tagOf(release)));
+  if (rows.length === 0) return null;
+  const dated = rows.filter((release) => timeOf(release) !== null);
+  if (dated.length === rows.length) {
+    return [...rows].sort((left, right) => timeOf(right) - timeOf(left))[0];
+  }
+  return rows[0];
+}
+
+export function latestCodeReleaseTag(releases) {
+  const release = pickLatestCodeRelease(releases);
+  return release ? tagOf(release) : null;
+}
+
+/**
+ * One sentence a consumer can print when `releases/latest` is NOT a code release, so the situation
+ * reads as designed rather than as a defect someone must chase.
+ */
+export function describeLatestPointer(latestTag) {
+  const kind = releaseKind(latestTag);
+  if (kind === 'corpus') return `releases/latest is corpus generation ${latestTag} (by design — that is the customer download)`;
+  if (kind === 'code') return `releases/latest is code release ${latestTag}`;
+  return `releases/latest is ${latestTag || '(none)'} — neither a code release nor a corpus generation`;
+}

package/scripts/release-convergence-watchdog.mjs

@@ -25,6 +25,7 @@
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { latestCodeReleaseTag } from './release-channel-kind.mjs';
 
 const ROOT = path.dirname(path.dirname(new URL(import.meta.url).pathname));
 const DISPATCH = process.argv.includes('--dispatch');
@@ -44,11 +45,15 @@ function stand_down(reason) {
 
 // ── 1. Is there anything to converge? ────────────────────────────────────────────────────────────
 const npmLatest = tryShy(() => sh('npm', ['view', 'ruvnet-brain', 'dist-tags.latest']));
-const ghLatest = tryShy(() => sh('gh', ['release', 'view', '--repo', REPO, '--json', 'tagName', '-q', '.tagName']));
+// ADR-086 S1: `gh release view` with no tag resolves `releases/latest`, which is a corpus
+// generation on any night a corpus round shipped. Comparing npm against a corpus digest would read
+// "never converged" forever and keep dispatching the publisher — a guard that silently disarms into
+// a loop is worse than one that breaks loudly.
+const ghLatest = tryShy(() => latestCodeReleaseTag(JSON.parse(sh('gh', ['api', `repos/${REPO}/releases?per_page=30`]))));
 if (!npmLatest || !ghLatest) stand_down(`could not read published surfaces (npm=${npmLatest} github=${ghLatest})`);
 
 const ghVersion = ghLatest.replace(/^v/, '');
-log(`npm dist-tags.latest = ${npmLatest} · GitHub releases/latest = ${ghLatest}`);
+log(`npm dist-tags.latest = ${npmLatest} · GitHub latest code release = ${ghLatest}`);
 if (npmLatest === ghVersion) {
   log(`CONVERGED — both surfaces name ${npmLatest}. Issue #77's invariant holds; nothing to do.`);
   process.exit(0);

package/scripts/release-projection.mjs

@@ -1,74 +1,182 @@
 #!/usr/bin/env node
-// Build the release-bound coverage projection from an observed corpus ledger and exact bundle bytes.
-// This is a producer; public-verification-inputs.mjs independently proves the emitted files.
+// Build the release-bound coverage projection from an ALREADY-SEALED corpus coverage ledger and the
+// exact selected generation ledger/inventory an assembly pass just computed.
+//
+// Step 5 of the corpus-seed/release pipeline consolidation (2026-09-13). Before this, the projection
+// re-read `RVF-GENERATIONS.json` from an assets directory on its own, re-derived the public store set
+// from disk, and — because the corpus coverage handed to it could have been observed at a DIFFERENT
+// moment than the one the seed was actually sealed against — filtered rows to "seeded" ones and
+// rewrote every surviving eligible row to `status: 'CURRENT'`. That entire class of drift is now
+// impossible: `corpusCoverage` reaching this function is Step 4's own sealed measurement of the
+// EXACT corpus directory being assembled (reconciliation only terminates once every eligible row is
+// already CURRENT and artifact-bound against that same directory), so there is nothing left to
+// reconcile here. `createReleaseProjection` is now a pure function: it never touches disk, never
+// re-derives the ledger or the public store set, and never changes a row, a status, a reason, the
+// enumeration, or a per-gist version — it only wraps the sealed measurement in a release identity.
+// The caller (scripts/build-bundle.mjs's assembleBundle) is the ONE place that reads inputs from
+// disk and the ONE place that writes the resulting files, exactly once, alongside everything else it
+// assembles in the same pass.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { digest, generationLedgerBytes, projectPublicGenerationLedger,
+import { PUBLIC_GENERATIONS_FILE, generationLedgerBytes, projectPublicGenerationLedger,
   releaseCoverageGenerationFor, validateCoverageDirectory } from '../plugin/scripts/coverage-integrity.mjs';
 import { validatePublicInventory } from './public-inventory.mjs';
 import { readRvfGenerations } from './rvf-generation.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const arg = (name, fallback = null) => { const i = process.argv.indexOf(name); return i >= 0 ? process.argv[i + 1] : fallback; };
-const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const HEX40 = /^[a-f0-9]{40}$/;
+const HEX64 = /^[a-f0-9]{64}$/;
 
-// The first assembly supplies seed bytes to the projection producer. Only the final, projected
-// assembly has a release-bound public ledger; its runtime ledger must describe that same set.
+// Validation-only (Step 5 compatibility note): the assembled directory's RVF-GENERATIONS.json is now
+// written exactly once, by assembleBundle -> projectStoreViews, already in its final, correctly-bound
+// shape. There is nothing left for this function to derive or write — it only proves the finished
+// assembly is internally consistent and bound to the exact release identity being published. Kept
+// (rather than deleted and its callers repointed) because it is the one place every consumer already
+// calls for this proof: scripts/build-bundle.mjs's assembleBundle, and the release-qualification test
+// suite (tests/unit/assembled-release-projection.test.mjs).
 export function bindAssembledReleaseProjection({ assetsDir, version, sourceSnapshot }) {
-  const ledger = readJson(path.join(assetsDir, 'PUBLIC-RVF-GENERATIONS.json'));
-  if (!/^[a-f0-9]{40}$/.test(sourceSnapshot || '') || ledger.schemaVersion !== 2
-    || ledger.kind !== 'ruvnet-brain-public-generation-ledger'
-    || ledger.brainVersion !== version || ledger.releaseTag !== `v${version}`
-    || ledger.sourceSnapshot !== sourceSnapshot) {
-    throw new Error('assembled public ledger does not bind this release source');
-  }
-  fs.writeFileSync(path.join(assetsDir, 'RVF-GENERATIONS.json'), `${JSON.stringify({
-    ...ledger, kind: 'ruvnet-brain-runtime-generation-ledger',
-  }, null, 2)}\n`);
-  const result = validateCoverageDirectory(assetsDir, { expectedVersion: version,
-    expectedSourceSnapshot: sourceSnapshot, requireCompleteProfile: true });
+  const result = validateCoverageDirectory(assetsDir, {
+    expectedVersion: version, expectedSourceSnapshot: sourceSnapshot, requireCompleteProfile: true,
+  });
   if (!result.valid) throw new Error(`assembled release projection rejected: ${result.failures.join('; ')}`);
   return result;
 }
 
-function seedCompatibleGistReceipt() {
-  const source = readJson(path.join(ROOT, 'kb', 'ruv-gists.sources.json'));
-  const gists = {};
-  for (const [id, row] of Object.entries(source.gists || {})) {
-    const files = row.files;
-    gists[id] = { versionSha: row.versionSha, files,
-      contentDigest: crypto.createHash('sha256').update(JSON.stringify(files)).digest('hex') };
+/**
+ * createReleaseProjection({ corpusCoverage, selectedLedger, identity, seedIdentity, inventory })
+ *   -> ReleaseProjection
+ *
+ * `corpusCoverage`   — the exact ruvnet-brain-corpus-coverage object Step 4 sealed for the directory
+ *                       being assembled. Every row, status, reason, and the enumeration receipt are
+ *                       carried through UNCHANGED (algorithm step 9) — this function reads them, it
+ *                       never rewrites them.
+ * `selectedLedger`   — the PUBLIC generation ledger view assembleBundle's projectStoreViews already
+ *                       derived once from the selected records (schemaVersion 2, kind
+ *                       'ruvnet-brain-public-generation-ledger', carrying `identity`'s version/
+ *                       sourceSnapshot). Never independently re-read from disk here.
+ * `identity`         — { version, sourceSnapshot }: the exact release this projection is bound to.
+ * `seedIdentity`     — { tag, archiveSha256, archiveBytes, baselineReceiptSha256 }: the immutable
+ *                       corpus seed this assembly started from, and the sha256 of the baseline
+ *                       observation receipt proving that seed was not silently substituted.
+ * `inventory`         — the ValidatePublicInventory() result assembleBundle already computed once
+ *                       while validating the finalized corpus (its `partitionSha256` is the evidence
+ *                       digest bound into the release ledger).
+ *
+ * Returns `{ releaseCoverage, corpusCoverageBytes, publicGenerationLedgerBytes }` — plain data; this
+ * function performs no I/O of its own.
+ */
+export function createReleaseProjection({ corpusCoverage, selectedLedger, identity, seedIdentity, inventory }) {
+  if (!corpusCoverage || corpusCoverage.kind !== 'ruvnet-brain-corpus-coverage' || !Array.isArray(corpusCoverage.rows)) {
+    throw new Error('corpus coverage must be an observed ruvnet-brain-corpus-coverage ledger');
+  }
+  const version = identity?.version;
+  const sourceSnapshot = identity?.sourceSnapshot;
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version || '')) throw new Error('release version is invalid');
+  if (!HEX40.test(sourceSnapshot || '')) throw new Error('release source snapshot is invalid');
+  if (!seedIdentity?.tag || !HEX64.test(seedIdentity.archiveSha256 || '')
+    || !Number.isSafeInteger(seedIdentity.archiveBytes) || !HEX64.test(seedIdentity.baselineReceiptSha256 || '')) {
+    throw new Error('corpus seed identity is incomplete');
+  }
+  if (!selectedLedger || selectedLedger.kind !== 'ruvnet-brain-public-generation-ledger'
+    || !selectedLedger.stores || typeof selectedLedger.stores !== 'object' || Array.isArray(selectedLedger.stores)
+    || Object.keys(selectedLedger.stores).length === 0) {
+    throw new Error('selected public generation ledger is malformed or empty');
+  }
+  if (selectedLedger.brainVersion !== version || selectedLedger.sourceSnapshot !== sourceSnapshot) {
+    throw new Error('selected public generation ledger does not bind this release identity');
   }
-  // The v4.2.1 seed predates the schema-3 source-byte binding. Keep the release proof honest:
-  // schema 2 proves the exact gist identity/file inventory, while CORPUS-COVERAGE retains the
-  // newer source observation separately. Do not relabel the old seed as current-source evidence.
-  return { schemaVersion: 2, owner: source.owner, generated: source.generated, gists };
+  if (!inventory || typeof inventory.partitionSha256 !== 'string' || !HEX64.test(inventory.partitionSha256)) {
+    throw new Error('public inventory evidence is required');
+  }
+
+  const ledgerBytes = generationLedgerBytes(selectedLedger);
+  const corpusBytes = Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`);
+  const releaseCoverage = {
+    schemaVersion: 1,
+    kind: 'ruvnet-brain-release-coverage',
+    owner: corpusCoverage.owner,
+    observedAt: corpusCoverage.observedAt,
+    generatorSourceSha: corpusCoverage.generatorSourceSha,
+    sourceObservationSha256: corpusCoverage.sourceObservationSha256,
+    snapshotRoot: corpusCoverage.snapshotRoot,
+    releaseIdentity: { version, tag: `v${version}`, sourceSnapshot },
+    corpusSeed: { tag: seedIdentity.tag, archiveSha256: seedIdentity.archiveSha256,
+      archiveBytes: seedIdentity.archiveBytes, receiptSha256: seedIdentity.baselineReceiptSha256 },
+    corpusCoverage: { sha256: sha256(corpusBytes), coverageGeneration: corpusCoverage.coverageGeneration },
+    generationLedger: { file: PUBLIC_GENERATIONS_FILE, sha256: sha256(ledgerBytes),
+      bytes: ledgerBytes.length, storeCount: Object.keys(selectedLedger.stores).length },
+    installedProjectionSchema: 2,
+    policy: corpusCoverage.policy,
+    // UNCHANGED from the sealed measurement (algorithm step 9): no row, status, reason, or
+    // enumeration count is ever rewritten here.
+    enumerationReceipt: corpusCoverage.enumerationReceipt,
+    rows: corpusCoverage.rows,
+    totals: corpusCoverage.totals,
+    publicInventoryPartitionSha256: inventory.partitionSha256,
+  };
+  releaseCoverage.releaseCoverageGeneration = releaseCoverageGenerationFor(releaseCoverage);
+  return { releaseCoverage, corpusCoverageBytes: corpusBytes, publicGenerationLedgerBytes: ledgerBytes };
 }
 
-export function createReleaseProjection({ corpusCoverage, assetsDir, version, sourceSnapshot,
+/**
+ * projectReleaseFromAssets(...) — TEMPORARY COMPATIBILITY PATH. RETIRES AT PLAN STEP 11.
+ *
+ * P1-c (Dual, 2026-09-14): the step-5 consolidation replaced this file's CLI with an unconditional
+ * `process.exitCode = 1`, while .github/workflows/ci.yml's release-qe job still invoked it and then
+ * passed `--coverage`/`--projection` to a build-bundle CLI that rejected both. A release gate that
+ * can only exit 1 is not a gate, and documenting that it is expected to fail does not repair it.
+ * The consumer sequence and the scripts now AGREE again: ci.yml declares the legacy rail explicitly
+ * with `--legacy-seed-projection`, this CLI produces the projection it did before the consolidation,
+ * and build-bundle.mjs's legacySeedProjection branch consumes it.
+ *
+ * This is NOT a return to the pre-consolidation semantics for new work: `createReleaseProjection`
+ * above remains the single-pass, pure, in-process producer every step-11 consumer will call. This
+ * function exists ONLY because `data/corpus-seed.json` still pins v4.2.1-dev, a PRE-Step-3/4 seed
+ * whose contents (measured 2026-09-14: 186 stores, no sealed public-input selection, no
+ * public-store-classes.json, no ruv-gists.sources.json) cannot satisfy the sealed-corpus contract.
+ * Steps 8-11 publish and re-pin a Step-4-produced seed; this function is deleted with that switch.
+ *
+ * Unchanged from the pre-consolidation producer in the one respect that matters: rows are SCOPED to
+ * what the immutable seed actually carries (a repository whose store is absent, or a gist the sealed
+ * receipt does not carry, is dropped — never rewritten CURRENT), and the complete observation is
+ * preserved untouched in CORPUS-COVERAGE.json.
+ */
+export function projectReleaseFromAssets({ corpusCoverage, assetsDir, version, sourceSnapshot,
   corpusSeed, baselineReceiptSha256, outDir }) {
   if (!corpusCoverage || corpusCoverage.kind !== 'ruvnet-brain-corpus-coverage') {
     throw new Error('corpus coverage must be an observed ruvnet-brain-corpus-coverage ledger');
   }
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version || '')) throw new Error('release version is invalid');
-  if (!/^[a-f0-9]{40}$/.test(sourceSnapshot || '')) throw new Error('release source snapshot is invalid');
-  if (!corpusSeed?.tag || !/^[a-f0-9]{64}$/.test(corpusSeed.archiveSha256 || '')
-    || !Number.isSafeInteger(corpusSeed.archiveBytes) || !/^[a-f0-9]{64}$/.test(baselineReceiptSha256 || '')) {
+  if (!HEX40.test(sourceSnapshot || '')) throw new Error('release source snapshot is invalid');
+  if (!corpusSeed?.tag || !HEX64.test(corpusSeed.archiveSha256 || '')
+    || !Number.isSafeInteger(corpusSeed.archiveBytes) || !HEX64.test(baselineReceiptSha256 || '')) {
     throw new Error('corpus seed identity is incomplete');
   }
-  const assets = path.resolve(assetsDir);
+  const assets = path.resolve(assetsDir || '');
   const sourceLedger = readRvfGenerations(assets);
-  // Source observation and release assets are different evidence planes. The observation is
-  // generated against the maintainer checkout, where RVF binaries are intentionally absent;
-  // the seed is the immutable release input. Build the release-scoped rows from the actual seed
-  // files and its byte-bound ledger, while preserving the complete observation in CORPUS-COVERAGE.
   const availableStores = new Set(fs.readdirSync(assets)
     .filter((name) => /^.+\.big\.rvf$/.test(name)).map((name) => name.slice(0, -'.big.rvf'.length).toLowerCase()));
-  const seededRows = corpusCoverage.rows.filter((row) => row.disposition === 'eligible'
-    && availableStores.has(String(row.artifact?.store || '').toLowerCase()));
+  // The seed is the truth for gists too, at GIST granularity: `ruv-gists.big.rvf` being present says
+  // the aggregate shipped, not that every gist rUv has published since the seal is inside it. A gist
+  // the sealed receipt does not carry is unseeded exactly like a repository whose store is absent.
+  // NO FALLBACK to the maintainer's checkout copy of the receipt (the 2026-09-13 divergence bug): a
+  // receipt that is not in the assembled candidate simply does not exist for this projection.
+  const receiptFile = path.join(assets, 'ruv-gists.sources.json');
+  let gistReceipt = null;
+  if (fs.existsSync(receiptFile)) {
+    gistReceipt = JSON.parse(fs.readFileSync(receiptFile, 'utf8'));
+    if (gistReceipt.schemaVersion !== 3 || gistReceipt.kind !== 'ruvnet-brain-gist-source-receipts') {
+      throw new Error('the assembled candidate carries a downgraded gist receipt (ruv-gists.sources.json) '
+        + '-- refusing to project a release from an unreconciled or schema-downgraded receipt');
+    }
+  }
+  const seededGistIds = new Set(gistReceipt ? Object.keys(gistReceipt.gists) : []);
+  const seeded = (row) => availableStores.has(String(row.artifact?.store || '').toLowerCase())
+    && (row.kind !== 'gist' || seededGistIds.has(String(row.key || '').replace(/^gist:/, '')));
+  const seededRows = corpusCoverage.rows.filter((row) => row.disposition === 'eligible' && seeded(row));
   if (!seededRows.length) throw new Error('immutable seed contains no eligible corpus stores');
   const seededExcludedRows = corpusCoverage.rows.filter((row) => row.disposition !== 'eligible'
     && availableStores.has(String(row.artifact?.store || '').toLowerCase()));
@@ -80,26 +188,21 @@ export function createReleaseProjection({ corpusCoverage, assetsDir, version, so
     return { ...row, status: 'CURRENT', artifact: { ...row.artifact,
       sourceCommit: generation.sourceCommit, rvfSha256: generation.sha256 } };
   });
-  // The release ledger is the shipped public set, not a catalog of policy-excluded rows.
-  // Excluded rows remain in COVERAGE.json as auditable policy evidence, but must not be
-  // inserted into PUBLIC-RVF-GENERATIONS.json or counted as installed public stores.
   const publicStores = [...new Set(rows.filter((row) => row.disposition === 'eligible')
     .map((row) => String(row.artifact.store).toLowerCase()))];
   const classesFile = path.join(assets, 'public-store-classes.json');
   const derivedStores = fs.existsSync(classesFile)
-    ? readJson(classesFile).derived.map((entry) => String(entry.store).toLowerCase()) : [];
+    ? (JSON.parse(fs.readFileSync(classesFile, 'utf8')).derived || []).map((entry) => String(entry.store).toLowerCase())
+    : [];
   const ledgerStores = [...new Set([...publicStores, ...derivedStores])];
-  const projectedCoverage = { ...corpusCoverage, rows,
-    totals: { ...corpusCoverage.totals, rows: rows.length,
-      repositories: rows.filter((row) => row.kind === 'repository').length,
-      gists: rows.filter((row) => row.kind === 'gist').length,
-      byStatus: Object.fromEntries([...new Set(rows.map((row) => row.status))].sort()
-        .map((status) => [status, rows.filter((row) => row.status === status).length])) } };
-  const projectedEnumerationReceipt = { ...corpusCoverage.enumerationReceipt,
-    repositories: { ...corpusCoverage.enumerationReceipt.repositories,
-      expected: projectedCoverage.totals.repositories },
-    gists: { ...corpusCoverage.enumerationReceipt.gists,
-      expected: projectedCoverage.totals.gists } };
+  const totals = { ...corpusCoverage.totals, rows: rows.length,
+    repositories: rows.filter((row) => row.kind === 'repository').length,
+    gists: rows.filter((row) => row.kind === 'gist').length,
+    byStatus: Object.fromEntries([...new Set(rows.map((row) => row.status))].sort()
+      .map((status) => [status, rows.filter((row) => row.status === status).length])) };
+  const enumerationReceipt = { ...corpusCoverage.enumerationReceipt,
+    repositories: { ...corpusCoverage.enumerationReceipt.repositories, expected: totals.repositories },
+    gists: { ...corpusCoverage.enumerationReceipt.gists, expected: totals.gists } };
   const ledger = projectPublicGenerationLedger({ ledger: sourceLedger, publicStores: ledgerStores, version, sourceSnapshot });
   const ledgerBytes = generationLedgerBytes(ledger);
   const corpusBytes = Buffer.from(`${JSON.stringify(corpusCoverage, null, 2)}\n`);
@@ -111,39 +214,41 @@ export function createReleaseProjection({ corpusCoverage, assetsDir, version, so
     corpusSeed: { tag: corpusSeed.tag, archiveSha256: corpusSeed.archiveSha256,
       archiveBytes: corpusSeed.archiveBytes, receiptSha256: baselineReceiptSha256 },
     corpusCoverage: { sha256: sha256(corpusBytes), coverageGeneration: corpusCoverage.coverageGeneration },
-    generationLedger: { file: 'PUBLIC-RVF-GENERATIONS.json', sha256: sha256(ledgerBytes),
+    generationLedger: { file: PUBLIC_GENERATIONS_FILE, sha256: sha256(ledgerBytes),
       bytes: ledgerBytes.length, storeCount: Object.keys(ledger.stores).length },
-    installedProjectionSchema: 2, policy: corpusCoverage.policy, enumerationReceipt: projectedEnumerationReceipt,
-    rows: projectedCoverage.rows, totals: projectedCoverage.totals,
+    installedProjectionSchema: 2, policy: corpusCoverage.policy, enumerationReceipt, rows, totals,
   };
-  const gistReceipt = seedCompatibleGistReceipt();
-  // Keep the projected receipt in the same asset root that the final archive
-  // validator reads, so both partition hashes include identical evidence.
-  fs.writeFileSync(path.join(assets, 'ruv-gists.sources.json'), `${JSON.stringify(gistReceipt, null, 2)}\n`);
+  // Re-read from disk (never the object handed in): validatePublicInventory's partition digest omits
+  // a directly-supplied receipt's own evidence identity, which would then permanently disagree with
+  // the independent digest bindAssembledReleaseProjection computes from the same file moments later.
   const inventory = validatePublicInventory({ assetsDir: assets, coverage: releaseBase, ledger });
   releaseBase.publicInventoryPartitionSha256 = inventory.partitionSha256;
   releaseBase.releaseCoverageGeneration = releaseCoverageGenerationFor(releaseBase);
-  const out = path.resolve(outDir);
+  const out = path.resolve(outDir || '');
   fs.mkdirSync(out, { recursive: true });
   fs.writeFileSync(path.join(out, 'CORPUS-COVERAGE.json'), corpusBytes);
   fs.writeFileSync(path.join(out, 'COVERAGE.json'), `${JSON.stringify(releaseBase, null, 2)}\n`);
-  fs.writeFileSync(path.join(out, 'PUBLIC-RVF-GENERATIONS.json'), ledgerBytes);
-  fs.writeFileSync(path.join(out, 'ruv-gists.sources.json'), `${JSON.stringify(gistReceipt, null, 2)}\n`);
-  for (const file of ['public-store-classes.json', 'concepts.sources.json']) {
+  fs.writeFileSync(path.join(out, PUBLIC_GENERATIONS_FILE), ledgerBytes);
+  // Any derived/aggregate evidence the candidate carried travels WITH the projection; nothing is
+  // synthesized for a file the candidate did not have.
+  for (const file of ['ruv-gists.sources.json', 'public-store-classes.json', 'concepts.sources.json']) {
     const source = path.join(assets, file);
     if (fs.existsSync(source)) fs.copyFileSync(source, path.join(out, file));
   }
   return releaseBase;
 }
 
-if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+if (((() => { try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })())) {
+  const arg = (name, fallback = null) => { const i = process.argv.indexOf(name); return i >= 0 ? process.argv[i + 1] : fallback; };
   try {
     const corpusFile = path.resolve(arg('--corpus', path.join(ROOT, 'data', 'source-coverage.json')));
-    const corpus = readJson(corpusFile);
-    const projection = createReleaseProjection({ corpusCoverage: corpus, assetsDir: arg('--assets'),
-      outDir: arg('--out', 'release-evidence'), version: arg('--version'), sourceSnapshot: arg('--source-snapshot'),
+    const projection = projectReleaseFromAssets({
+      corpusCoverage: JSON.parse(fs.readFileSync(corpusFile, 'utf8')),
+      assetsDir: arg('--assets'), outDir: arg('--out', 'release-evidence'),
+      version: arg('--version'), sourceSnapshot: arg('--source-snapshot'),
       baselineReceiptSha256: arg('--baseline-receipt-sha256'),
-      corpusSeed: { tag: arg('--seed-tag'), archiveSha256: arg('--seed-sha256'), archiveBytes: Number(arg('--seed-bytes')) } });
+      corpusSeed: { tag: arg('--seed-tag'), archiveSha256: arg('--seed-sha256'), archiveBytes: Number(arg('--seed-bytes')) },
+    });
     console.log(JSON.stringify({ ok: true, releaseCoverageGeneration: projection.releaseCoverageGeneration }));
   } catch (error) { console.error(`[release-projection] ${error.message}`); process.exitCode = 1; }
 }