ruvnet-brain 4.3.21 → 4.3.26

package/scripts/build-concepts.mjs

@@ -1,132 +1,52 @@
 #!/usr/bin/env node
-// build-concepts.mjs — assemble the CONCEPTS store: all accepted L2 articles + every per-repo primer,
-// chunked into kb/concepts.passages.jsonl (+ concepts.meta.json) so `forge-big both --name concepts`
-// can embed it into concepts.big.rvf. The cross-repo tool (forge-ask-all / search_ruvnet) then unions
-// this prose layer with the deep-source repos at query time — making code-implemented capabilities
-// retrievable as high-confidence PROSE without re-embedding the 40K-chunk source stores.
+// build-concepts.mjs — thin CLI wrapper around the canonical concepts pipeline (Step 3, 2026-09-13).
 //
-// Each passage path is "<repo>/<kind>/<slug>#<chunk>" so a consumer (and the capability gate) can
-// attribute a concept hit back to its source repo.
+// This used to be an INDEPENDENT concepts transformation with its own chunker, fence helpers, and
+// card handling -- a real duplicate of corpus-aggregates.mjs's buildConceptAggregate. It now owns no
+// chunking/fencing/card logic of its own: materializePublicInputs (scripts/public-inputs.mjs) does
+// the ONE canonical public-prose selection (fencing private repos, resolving topic ownership), and
+// buildConceptAggregate (scripts/corpus-aggregates.mjs) does the ONE canonical passage assembly --
+// exactly the pattern Step 2 established for scripts/seal-gist-receipt.mjs as a thin wrapper over
+// buildGistAggregate.
+//
+// Public prose is materialized into a throwaway temp directory first (never over the live kb/ in
+// place, even though doing so would be safe -- see public-inputs.mjs's own header) so this tool's
+// two responsibilities stay separated: SELECT (temp dir) then ASSEMBLE (writes into kb/ directly,
+// matching this tool's historical behavior).
 //
 //   node scripts/build-concepts.mjs   → writes kb/concepts.passages.jsonl + kb/concepts.meta.json
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { loadPrivateFence, isPrivate as isPrivateIn, loadPrivateSlugs, shouldFenceL2 } from './private-fence.mjs';
+import { observeSourceUniverse } from './source-coverage.mjs';
+import { materializePublicInputs } from './public-inputs.mjs';
+import { buildConceptAggregate } from './corpus-aggregates.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const KB = path.join(ROOT, 'kb');
 
-// PRIVATE fence (SEC-0010 #5) — the concepts store folds in primers + L2 PROSE, so it must honor the
-// same fence as the raw .rvf stores, or a private repo's write-up could ship even though its vectors
-// are excluded. FAIL-CLOSED, same contract as build-bundle.mjs: a present-but-corrupt fence aborts.
-// The decisions live in scripts/private-fence.mjs (pure, unit-tested); this script owns the exit.
-const fence = loadPrivateFence(KB, { allowNoFence: process.env.ALLOW_NO_PRIVATE_FENCE === '1' });
-if (!fence.ok) {
-  console.error(`[build-concepts] FATAL: ${fence.reason}. Refusing to build the shipped concepts store ` +
-    `without a verified fence. Set ALLOW_NO_PRIVATE_FENCE=1 only for a no-private fork.`);
-  process.exit(1);
-}
-const PRIVATE = fence.privateSet;
-const isPrivate = (repo) => isPrivateIn(PRIVATE, repo);
-
-// PRIVATE SLUG set (QE-0011 security#1) — a private repo's L2 article is keyed by SLUG, not repo, and
-// an unknown slug used to default to 'ruvnet' (fail-OPEN → it shipped). Read each private repo's own
-// l2-topics.<repo>.json to learn its slugs, so an L2 article whose slug belongs to a private repo is
-// fenced out even when its repo attribution is unknown. Fail-closed: if a private topics file exists
-// but can't be parsed, abort rather than ship.
-const slugFence = loadPrivateSlugs(KB, PRIVATE);
-if (!slugFence.ok) {
-  console.error(`[build-concepts] FATAL: ${slugFence.reason}. Refusing to build.`);
-  process.exit(1);
-}
-const PRIVATE_SLUGS = slugFence.slugs;
-
-// Auto-discover every repo that has a primer (skip PRIVATE ones — their prose must not ship).
-const REPOS = fs.readdirSync(KB)
-  .filter((f) => f.endsWith('-primer.md'))
-  .map((f) => f.replace(/-primer\.md$/, ''))
-  .filter((r) => !isPrivate(r))
-  .sort();
-
-// slug -> repo, from the per-repo l2-topics files (+ ruflo defaults that predate them)
-const slugRepo = new Map([['guidance-mechanism', 'ruflo'], ['memory-end-to-end', 'ruflo'], ['adr-coverage', 'ruflo']]);
-for (const r of REPOS) {
-  const tf = path.join(KB, `l2-topics.${r}.json`);
-  if (fs.existsSync(tf)) for (const t of JSON.parse(fs.readFileSync(tf, 'utf8'))) slugRepo.set(t.slug, r);
-}
-
-// ~3200-char paragraph-aligned chunks
-function chunk(text, size = 3200) {
-  const out = []; const paras = text.split(/\n\n+/); let buf = '';
-  for (const p of paras) {
-    if (buf && (buf.length + p.length + 2) > size) { out.push(buf); buf = ''; }
-    buf += (buf ? '\n\n' : '') + p;
+export async function main() {
+  const observation = observeSourceUniverse({ owner: 'ruvnet', externalSources: [] });
+  const publicInputDir = fs.mkdtempSync(path.join(os.tmpdir(), 'build-concepts-public-inputs-'));
+  try {
+    const publicInputs = materializePublicInputs({ builderRoot: ROOT, outDir: publicInputDir });
+    const result = buildConceptAggregate({
+      publicInputDir,
+      selectionReceipt: publicInputs.selectionReceipt,
+      observationSha256: observation.observationSha256,
+      outDir: KB,
+    });
+    console.log(`concepts: ${result.passages} passages → kb/concepts.passages.jsonl`);
+    console.log('next: node kb/forge-big.mjs both --dir kb --name concepts   (builds concepts.big.rvf)');
+  } finally {
+    fs.rmSync(publicInputDir, { recursive: true, force: true });
   }
-  if (buf.trim()) out.push(buf);
-  return out.length ? out : [text];
 }
 
-const passages = [];           // {id, text, path, title}
-const entries = {};            // id -> {path, kind, title, chunk, preview}
-let id = 0;
-function add(repo, kind, slug, title, text) {
-  const chunks = chunk(text);
-  chunks.forEach((c, i) => {
-    const sid = String(id++);
-    const p = `${repo}/${kind}/${slug}${chunks.length > 1 ? `#${i}` : ''}`;
-    passages.push({ id: sid, text: c, path: p, title });
-    entries[sid] = { path: p, kind: kind === 'PRIMER' ? 'doc' : 'doc', title, chunk: i, preview: c.slice(0, 200) };
+if (((() => { try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })())) {
+  main().catch((error) => {
+    console.error(`[build-concepts] ${error.message}`);
+    process.exitCode = 1;
   });
 }
-
-// 1) accepted L2 articles (skip kb/l2/rejected/)
-let l2n = 0;
-for (const f of fs.readdirSync(path.join(KB, 'l2'))) {
-  if (!f.endsWith('.md')) continue;
-  const slug = f.replace(/\.md$/, '');
-  const repo = slugRepo.get(slug) || 'ruvnet';
-  // Fence a private repo's L2 prose whether it's attributed by repo OR only recognizable by slug
-  // (QE-0011 security#1 — closes the fail-open 'ruvnet' default for unknown attribution).
-  if (shouldFenceL2({ repo, slug }, PRIVATE, PRIVATE_SLUGS)) continue;
-  const text = fs.readFileSync(path.join(KB, 'l2', f), 'utf8');
-  const title = (text.match(/^#\s+(.+)/m) || [, slug])[1];
-  add(repo, 'L2', slug, title, text); l2n++;
-}
-
-// 2) per-repo primers
-let pn = 0;
-for (const r of REPOS) {
-  const pf = path.join(KB, `${r}-primer.md`);
-  if (!fs.existsSync(pf)) { console.log(`  (no primer for ${r})`); continue; }
-  add(r, 'PRIMER', `${r}-primer`, `${r} — Primer`, fs.readFileSync(pf, 'utf8')); pn++;
-}
-
-// 3) capability cards — short, capability-phrased, one per building block. These are the high-signal
-// passages that let a BY-DESCRIPTION query ("what caches vector queries?") rerank to the right repo
-// even when the user never names it. Each card is attributed to its repo via the path prefix.
-let cn = 0;
-const cardsFile = path.join(KB, 'capability-cards.md');
-if (fs.existsSync(cardsFile)) {
-  const raw = fs.readFileSync(cardsFile, 'utf8');
-  for (const sec of raw.split(/^##\s+/m).slice(1)) {
-    const nl = sec.indexOf('\n');
-    if (nl < 0) continue;
-    const repo = sec.slice(0, nl).trim();
-    const body = sec.slice(nl + 1).trim();
-    if (!repo || !body) continue;
-    if (isPrivate(repo)) continue; // QE-0011 security#1: fence a private repo's capability card too
-    add(repo, 'CARD', `${repo}-card`, `${repo} — Capability`, `${repo} — ${body}`);
-    cn++;
-  }
-}
-
-fs.writeFileSync(path.join(KB, 'concepts.passages.jsonl'), passages.map((p) => JSON.stringify(p)).join('\n') + '\n');
-fs.writeFileSync(path.join(KB, 'concepts.meta.json'), JSON.stringify({
-  model: 'concepts', dimensions: 0, metric: 'cosine', name: 'concepts',
-  generated: new Date().toISOString(), repo: 'ruvnet-concepts',
-  note: 'L2 synthesis + per-repo primers; embedded into concepts.big.rvf via forge-big.',
-  entries,
-}, null, 2));
-console.log(`concepts: ${l2n} L2 articles + ${pn} primers + ${cn} capability cards → ${passages.length} passages → kb/concepts.passages.jsonl`);
-console.log('next: node kb/forge-big.mjs both --dir kb --name concepts   (builds concepts.big.rvf)');

package/scripts/console-engine.test.mjs

@@ -69,19 +69,20 @@ t('memory score: nothing probed → null (never a number we did not measure)', (
   assert.equal(scoreMemoryHealth({ probes: {} }).score, null);
 });
 
-t('buildCapabilityRecommendations: OFF + verified command + evidence -> one rec, bound to enable:<key>', () => {
+t('buildCapabilityRecommendations: memory-distillation OFF + verified command + evidence -> NO rec while its inverse is unavailable', () => {
+  // Until 6a6ba72f (2026-09-07) this asserted ONE rec: distill-project's 2026-07-24 restore round-trip
+  // (644→648→644→648) was taken as a proven inverse. That commit emptied CAPABILITY_ELIGIBLE with the
+  // reason "a historical restore demonstration is not proof of a currently available inverse —
+  // distill-project --restore now refuses unsafe database replacement". A recommendation without a
+  // live undo is exactly what makeRecommendation exists to forbid, so the stronger invariant wins and
+  // this test was the stale side (red from 2026-09-07 until re-measured 2026-09-11).
   const recs = buildCapabilityRecommendations({ capabilities: [{
     key: 'memory-distillation', label: 'Memory distillation', scope: 'project', state: 'off',
     whatItBuysYou: 'Loose notes get mined into reusable patterns.',
     turnOn: { human: "Mine this project's stored memories into reusable patterns", cmd: 'node /x/distill-project.mjs' },
     evidence: '10 memories stored and 80.0% embedded, but 0 have been distilled into patterns',
   }] });
-  assert.equal(recs.length, 1);
-  assert.equal(recs[0].id, 'enable:memory-distillation');
-  assert.equal(recs[0].scope, 'project');
-  assert.equal(recs[0].touchesMachine, false);          // project scope -> never the machine-touch banner
-  assert.ok(recs[0].undo.human.length > 0);              // schema gate: undo always present
-  assert.ok(recs[0].evidence[0].observed.includes('80.0% embedded'));
+  assert.equal(recs.length, 0, 'no proven inverse today => never offered, however complete the row looks');
 });
 t('buildCapabilityRecommendations: ON, IDLE, UNKNOWN, and ABSENT are never offered', () => {
   for (const state of ['on', 'idle', 'unknown', 'absent']) {

package/scripts/console-runtime-identity.mjs

@@ -44,6 +44,10 @@ export const CONSOLE_RUNTIME_SURFACE = Object.freeze([
   'kb/lifecycle-evidence-retention.mjs',
   'kb/model-requirements.mjs',
   'kb/zip-extract.mjs',
+  // install.mjs imports this STATICALLY (corpus transport identity + approved-runtime stamping,
+  // ADR-086 step 16). A copied installer whose sibling is missing does not degrade — it throws
+  // ERR_MODULE_NOT_FOUND on import, before a single line runs.
+  'kb/corpus-release-identity.mjs',
   'bin/install.mjs',
   'package.json',
 ]);

package/scripts/corpus-aggregates.mjs

@@ -1,33 +1,25 @@
 // Rebuild the two source-derived public aggregate stores as one atomic artifact set.
 
-import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { promoteArtifactSet } from '../kb/incremental-refresh.mjs';
-import { reconstructGists, writeReconstruction } from './rebuild-gists-from-receipts.mjs';
+import { buildGistAggregate } from './rebuild-gists-from-receipts.mjs';
 import { writeRvfGeneration } from './rvf-generation.mjs';
+import { digest, sha256File } from './coverage-integrity.mjs';
+import { materializePublicInputs, SELECTION_RECEIPT_KIND, SELECTION_RECEIPT_SCHEMA,
+  validateSelectionReceipt } from './public-inputs.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HEX64 = /^[a-f0-9]{64}$/;
 const MODEL = 'Xenova/bge-base-en-v1.5';
 const DIMENSIONS = 768;
-const AGGREGATES = ['ruv-gists', 'concepts'];
 
 function fail(message) {
   throw new Error(`[corpus-aggregates] ${message}`);
 }
 
-function readJson(file, label) {
-  try { return JSON.parse(fs.readFileSync(file, 'utf8')); }
-  catch (error) { fail(`${label} is missing or unreadable (${error.message})`); }
-}
-
-function sha256File(file) {
-  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-}
-
 function chunks(text, size = 3200) {
   const result = [];
   let buffer = '';
@@ -42,46 +34,51 @@ function chunks(text, size = 3200) {
   return result;
 }
 
-export function buildConceptAggregate({ inputDir, outDir, sourceObservationSha256,
+// buildConceptAggregate — Step 3 (2026-09-13): this used to be a SECOND, independently-fenced
+// concepts transformation (its own privateStores/privateSlugs re-derivation from
+// PRIVATE-STORES.json/l2-topics.*.json, duplicating scripts/build-concepts.mjs's separate copy of
+// the same logic). Fencing now happens EXACTLY ONCE, upstream, in materializePublicInputs
+// (scripts/public-inputs.mjs) -- `publicInputDir` is trusted to already contain ONLY public prose,
+// so this function does no fencing of its own; it just assembles passages from what is actually
+// there. `selectionReceipt` is the PublicInputSet's own receipt (proves what was excluded, by
+// digest, without carrying private content) and `observationSha256` must be the corpus coverage's
+// own observation identity -- callers assert that equality (rebuildCorpusAggregates does, below),
+// not this pure function.
+export function buildConceptAggregate({ publicInputDir, selectionReceipt, observationSha256, outDir,
   now = () => new Date().toISOString() } = {}) {
-  const input = path.resolve(inputDir || '');
+  const input = path.resolve(publicInputDir || '');
   const output = path.resolve(outDir || '');
-  if (!HEX64.test(String(sourceObservationSha256 || ''))) fail('concepts require an exact source observation');
-  const fenceFile = path.join(input, 'PRIVATE-STORES.json');
-  const fence = readJson(fenceFile, 'private fence');
-  if (!Array.isArray(fence.privateStores)) fail('private fence has no privateStores array');
-  const privateStores = new Set(fence.privateStores.map((store) => String(store).toLowerCase()));
-  const privateSlugs = new Set();
-  for (const store of privateStores) {
-    const file = path.join(input, `l2-topics.${store}.json`);
-    if (!fs.existsSync(file)) continue;
-    const topics = readJson(file, `${store} private topic fence`);
-    if (!Array.isArray(topics)) fail(`${store} private topic fence is malformed`);
-    for (const topic of topics) if (topic?.slug) privateSlugs.add(String(topic.slug));
+  if (!HEX64.test(String(observationSha256 || ''))) fail('concepts require an exact source observation');
+  // Step 5 remediation (2026-09-13): the receipt is schema 2 (byte-bound `files[]`); the exact
+  // kind/schema constants are the producer's own exports, never restated here.
+  if (!selectionReceipt || selectionReceipt.schemaVersion !== SELECTION_RECEIPT_SCHEMA
+    || selectionReceipt.kind !== SELECTION_RECEIPT_KIND) {
+    fail('concepts require a valid public input selection receipt');
+  }
+  // P2 (Dual, 2026-09-14): "checks kind/schema only, then enumerates disk primers". Kind and schema
+  // are a label, not a proof — this function then reads whatever prose happens to be on disk under
+  // `publicInputDir` and embeds it permanently into concepts.passages.jsonl, where no later file
+  // deletion can remove it. So the receipt is VERIFIED against that exact directory first, by the
+  // producer's own fail-closed validator: every sealed file present with exact bytes, every included
+  // name backed, and NO unsealed managed prose riding along. Both callers
+  // (scripts/build-concepts.mjs and rebuildCorpusAggregates) hand in the producer's own receipt, so
+  // this is a cheap re-read, not a second policy.
+  try {
+    validateSelectionReceipt({ receipt: selectionReceipt, dir: input });
+  } catch (error) {
+    fail(`concepts refuse to read prose that its selection receipt does not prove (${error.message})`);
   }
+  const ownership = new Map(Object.entries(selectionReceipt.ownership || {}));
 
   const repositories = fs.readdirSync(input)
     .filter((file) => file.endsWith('-primer.md'))
     .map((file) => file.slice(0, -'-primer.md'.length))
-    .filter((store) => !privateStores.has(store.toLowerCase()))
     .sort();
-  const slugRepository = new Map([
-    ['guidance-mechanism', 'ruflo'], ['memory-end-to-end', 'ruflo'], ['adr-coverage', 'ruflo'],
-  ]);
-  const inputFiles = new Set(['PRIVATE-STORES.json']);
-  for (const repository of repositories) {
-    const relative = `l2-topics.${repository}.json`;
-    const file = path.join(input, relative);
-    if (!fs.existsSync(file)) continue;
-    const topics = readJson(file, `${repository} topics`);
-    if (!Array.isArray(topics)) fail(`${repository} topics are malformed`);
-    inputFiles.add(relative);
-    for (const topic of topics) if (topic?.slug) slugRepository.set(String(topic.slug), repository);
-  }
 
   const passages = [];
   const entries = {};
   let nextId = 0;
+  const inputFiles = new Set();
   const add = (repository, kind, slug, title, body) => {
     const parts = chunks(body);
     for (const [index, text] of parts.entries()) {
@@ -93,15 +90,15 @@ export function buildConceptAggregate({ inputDir, outDir, sourceObservationSha25
   };
 
   const l2Dir = path.join(input, 'l2');
-  if (!fs.existsSync(l2Dir) || !fs.statSync(l2Dir).isDirectory()) fail('concept L2 input directory is missing');
-  for (const name of fs.readdirSync(l2Dir).filter((file) => file.endsWith('.md')).sort()) {
-    const slug = name.slice(0, -3);
-    const repository = slugRepository.get(slug) || 'ruvnet';
-    if (privateStores.has(repository.toLowerCase()) || privateSlugs.has(slug)) continue;
-    const relative = `l2/${name}`;
-    const body = fs.readFileSync(path.join(input, relative), 'utf8');
-    inputFiles.add(relative);
-    add(repository, 'L2', slug, body.match(/^#\s+(.+)/m)?.[1] || slug, body);
+  if (fs.existsSync(l2Dir)) {
+    for (const name of fs.readdirSync(l2Dir).filter((file) => file.endsWith('.md')).sort()) {
+      const slug = name.slice(0, -3);
+      const repository = ownership.get(slug) || 'ruvnet';
+      const relative = `l2/${name}`;
+      const body = fs.readFileSync(path.join(input, relative), 'utf8');
+      inputFiles.add(relative);
+      add(repository, 'L2', slug, body.match(/^#\s+(.+)/m)?.[1] || slug, body);
+    }
   }
   for (const repository of repositories) {
     const relative = `${repository}-primer.md`;
@@ -119,7 +116,7 @@ export function buildConceptAggregate({ inputDir, outDir, sourceObservationSha25
       if (newline < 0) continue;
       const repository = section.slice(0, newline).trim();
       const body = section.slice(newline + 1).trim();
-      if (!repository || !body || privateStores.has(repository.toLowerCase())) continue;
+      if (!repository || !body) continue;
       add(repository, 'CARD', `${repository}-card`, `${repository} — Capability`, `${repository} — ${body}`);
     }
   }
@@ -136,19 +133,19 @@ export function buildConceptAggregate({ inputDir, outDir, sourceObservationSha25
     schemaVersion: 1,
     kind: 'ruvnet-brain-derived-store-receipt',
     store: 'concepts',
-    sourceObservationSha256,
+    observationSha256,
+    selectionReceiptSha256: selectionReceipt.receiptSha256,
     inputs: [...inputFiles].sort().map((relative) => ({ path: relative, sha256: sha256File(path.join(input, relative)) })),
-    passagesSha256: crypto.createHash('sha256').update(passageBody).digest('hex'),
+    passagesSha256: digest(passageBody),
   };
   fs.writeFileSync(path.join(output, 'concepts.sources.json'), `${JSON.stringify(receipt, null, 2)}\n`);
-  const classesFile = path.join(input, 'public-store-classes.json');
-  const classes = fs.existsSync(classesFile) ? readJson(classesFile, 'public store classes') : { schemaVersion: 1, derived: [] };
-  if (classes.schemaVersion !== 1 || !Array.isArray(classes.derived)) fail('public store classes are malformed');
-  classes.derived = [...classes.derived.filter((entry) => String(entry?.store || '').toLowerCase() !== 'concepts'),
-    { store: 'concepts', receipt: 'concepts.sources.json' }]
-    .sort((a, b) => String(a.store).localeCompare(String(b.store)));
+  // Rule 9: the store-classes registry is generated FRESH from the derived stores this call actually
+  // produced -- never merged with a stale checkout copy of public-store-classes.json. Concepts is
+  // the only derived store this pipeline builds today; ruv-gists is a repository/gist-class store,
+  // classified separately (scripts/build-bundle.mjs's own discovery), not through this registry.
+  const classes = { schemaVersion: 1, derived: [{ store: 'concepts', receipt: 'concepts.sources.json' }] };
   fs.writeFileSync(path.join(output, 'public-store-classes.json'), `${JSON.stringify(classes, null, 2)}\n`);
-  return { passages: passages.length, receipt };
+  return { store: 'concepts', kind: 'derived-store-aggregate', passages: passages.length, receipt };
 }
 
 function defaultBuildVector({ root, assetsDir, store }) {
@@ -159,35 +156,55 @@ function defaultBuildVector({ root, assetsDir, store }) {
   if (result.error || result.status !== 0) fail(`${store} vector build failed (${result.error?.message || `exit ${result.status}`})`);
 }
 
-export async function rebuildCorpusAggregates({ assetsDir, observation, root = ROOT,
-  fetchFn = globalThis.fetch, buildVector = defaultBuildVector, now = () => new Date().toISOString() } = {}) {
+// Gists and concepts are independent derived stores (concepts never reads gist content), so each is
+// now built and promoted through its OWN atomic step rather than one shared stage+promotion:
+//   1. buildGistAggregate owns the ENTIRE gist lifecycle -- capture, render, embed, seal, validate,
+//      and promote -- as one atomic unit (see gist-receipts.mjs). A failed gist build/embed leaves
+//      `assets` completely untouched and concepts is never attempted.
+//   2. concepts is then rebuilt from the (now gist-updated) `assets` tree, exactly as before.
+// This trades the OLD single joint promotion of both stores for two independently-atomic ones; each
+// store's own artifact set can never be left half-written, which the joint promotion could not
+// promise for gists specifically once gist capture/render/seal became a single multi-step pipeline.
+export async function rebuildCorpusAggregates({ assetsDir, observation, coverage, root = ROOT, cache = null,
+  transport = {}, buildVector = defaultBuildVector, builderSha = null, allowNoPrivateFence = false,
+  now = () => new Date().toISOString() } = {}) {
   const assets = path.resolve(assetsDir || '');
   const observationSha256 = String(observation?.observationSha256 || '');
   if (!HEX64.test(observationSha256)) fail('aggregate rebuild requires an exact source observation');
-  const sourceFile = path.join(assets, 'ruv-gists.sources.json');
-  const source = readJson(sourceFile, 'gist source receipt');
-  if (source.sourceObservationSha256 !== observationSha256) fail('gist source receipt observation differs from the stable observation');
   if (typeof buildVector !== 'function') fail('aggregate vector builder is unavailable');
+  // Rule 8: the concepts receipt's observation identity must EXACTLY EQUAL corpus coverage's own
+  // observation identity, not merely happen to be fed the same value by an accident of call order.
+  if (!coverage || coverage.sourceObservationSha256 !== observationSha256) {
+    fail('concepts observation identity does not exactly equal the corpus coverage observation identity');
+  }
+
+  const gistAggregate = await buildGistAggregate({
+    observation, cache, outDir: assets, root, transport, buildVector, sourceCommit: observationSha256, now,
+  });
+
+  // Public prose selection (rule 1-3, 5): a fresh, positively-selected, already-fenced tree, rebuilt
+  // every round directly into `assets` -- never an overlay onto whatever a prior round left behind.
+  const publicInputs = materializePublicInputs({
+    builderRoot: root, outDir: assets, policy: { allowNoFence: allowNoPrivateFence }, builderSha, now,
+  });
 
   const stage = fs.mkdtempSync(path.join(path.dirname(assets), '.corpus-aggregates-'));
   try {
-    const gists = await reconstructGists(source, { fetchFn });
-    writeReconstruction(gists, { outDir: stage });
-    buildConceptAggregate({ inputDir: assets, outDir: stage, sourceObservationSha256: observationSha256, now });
-    for (const store of AGGREGATES) await buildVector({ root, assetsDir: stage, store });
-    writeRvfGeneration({ dir: stage, previousDir: assets, store: 'ruv-gists', model: MODEL,
-      dimensions: DIMENSIONS, sourceCommit: observationSha256, builtUtc: now() });
-    writeRvfGeneration({ dir: stage, previousDir: stage, store: 'concepts', model: MODEL,
+    buildConceptAggregate({
+      publicInputDir: assets, selectionReceipt: publicInputs.selectionReceipt,
+      observationSha256, outDir: stage, now,
+    });
+    await buildVector({ root, assetsDir: stage, store: 'concepts' });
+    writeRvfGeneration({ dir: stage, previousDir: assets, store: 'concepts', model: MODEL,
       dimensions: DIMENSIONS, sourceCommit: observationSha256, builtUtc: now() });
     const files = [
-      ...AGGREGATES.flatMap((store) => [
-        `${store}.passages.jsonl`, `${store}.meta.json`, `${store}.big.rvf`,
-        `${store}.big.rvf.idmap.json`, `${store}.big.rvf.embed.json`,
-      ]),
-      'ruv-gists.sources.json', 'concepts.sources.json', 'public-store-classes.json', 'RVF-GENERATIONS.json',
+      'concepts.passages.jsonl', 'concepts.meta.json', 'concepts.big.rvf',
+      'concepts.big.rvf.idmap.json', 'concepts.big.rvf.embed.json',
+      'concepts.sources.json', 'public-store-classes.json', 'RVF-GENERATIONS.json',
     ];
     promoteArtifactSet({ liveDir: assets, candidateDir: stage, files });
-    return { rebuilt: [...AGGREGATES].sort(), sourceObservationSha256: observationSha256 };
+    const rebuilt = gistAggregate.omitted ? ['concepts'] : ['concepts', 'ruv-gists'];
+    return { rebuilt: rebuilt.sort(), sourceObservationSha256: observationSha256, gistAggregate, publicInputs };
   } finally {
     fs.rmSync(stage, { recursive: true, force: true });
   }