ruvnet-brain 4.3.21 → 4.3.26

package/scripts/release-transaction-provider.mjs

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { canonicalJson } from './coverage-integrity.mjs';
+import { isCorpusReleaseTag, latestCodeReleaseTag } from './release-channel-kind.mjs';
 import {
   pollObservation, RECEIPT_PREFIX, receiptDisposition, transactionIdFor,
 } from './release-transaction.mjs';
@@ -16,6 +17,15 @@ const command = (name, args, options = {}) => execFileSync(name, args, {
   encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 30_000, ...options,
 }).trim();
 const json = (name, args, options) => JSON.parse(command(name, args, options));
+// ADR-086 S1: `releases/latest` is the customer download pointer and is a corpus generation on any
+// night a corpus round shipped. Every question this provider asks is about the CODE generation, so
+// it must resolve the latest CODE release rather than read a pointer that now answers differently.
+const latestCodeTag = () => latestCodeReleaseTag(json('gh', ['api', `repos/${REPO}/releases?per_page=30`]));
+// Two DIFFERENT questions, deliberately: latestCodeTag() is "which CODE generation is newest" (a
+// corpus generation may hold the pointer — designed steady state); githubPointerTag() is "what does
+// GitHub's releases/latest actually point at right now". The publish-github-nonlatest gate needs the
+// second and was reading the first, which made it unsatisfiable for every freshly published release.
+const githubPointerTag = () => maybe(() => json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name, null);
 const maybe = (callback, fallback = null) => {
   try { return callback(); } catch { return fallback; }
 };
@@ -74,14 +84,26 @@ const sha256File = (file) => {
   return hash.digest('hex');
 };
 const assetDigest = (asset) => withTempAsset(asset, sha256File);
+// 4.3.25 run 35056636514: `npm publish` succeeded at ~04:47:31Z and the registry first showed the
+// version at 04:53:40Z (time.modified) — roughly six minutes. The poll gave up at 156s, the job
+// reported FAILURE, and an already-published release was left half-promoted with npm and GitHub
+// naming different generations (the exact #77 split). The action was never the problem; the
+// deadline was shorter than npm's propagation for this package. Ten minutes covers the observed
+// ~6 with margin; the env overrides remain for a runner that knows better.
 const OBSERVATION_POLICY = {
-  maxElapsedMs: Number(process.env.RUVNET_NPM_VISIBILITY_TIMEOUT_MS || 180_000),
-  maxAttempts: Number(process.env.RUVNET_NPM_VISIBILITY_ATTEMPTS || 14),
+  maxElapsedMs: Number(process.env.RUVNET_NPM_VISIBILITY_TIMEOUT_MS || 600_000),
+  maxAttempts: Number(process.env.RUVNET_NPM_VISIBILITY_ATTEMPTS || 40),
   initialDelayMs: 1_000,
   maxDelayMs: 15_000,
   multiplier: 1.8,
   jitter: (delay) => Math.floor(Math.random() * Math.min(1_000, delay * 0.2)),
 };
+// The one command in this file that mutates a public channel gets its stderr in the job log and a
+// timeout sized for a real registry upload. command()'s defaults — stderr piped and dropped, 30s —
+// meant 4.3.25's first run left NO diagnostic between "stage-npm" and the deadline error, and a slow
+// registry would have killed a legitimate publish mid-upload. Named, so the publish call stays one
+// pinnable line for tests/unit/release-lineage + publication-receipt-wiring (one publisher, one tag).
+const PUBLISH_COMMAND_OPTIONS = Object.freeze({ stdio: ['ignore', 'pipe', 'inherit'], timeout: 600_000 });
 
 export function selectCurrentReleaseBytes({ remoteBytes, localBytes, generatedBytes, identity }) {
   const bytes = remoteBytes || localBytes || generatedBytes;
@@ -216,7 +238,7 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
         }
       }
       const npmLatest = command('npm', ['view', `${PACKAGE}@latest`, 'version']);
-      const githubLatest = json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name;
+      const githubLatest = latestCodeTag();
       const legacySettled = [];
       const pending = [];
       for (const { receipt, release } of latestByTransaction.values()) {
@@ -257,7 +279,8 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
     async observeSnapshot(identity, draft = activeDraft, { forceAssets = false } = {}) {
       try {
         const release = draft?.id ? hydratedRelease(releaseById(draft.id)) : null;
-        const latestTag = json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name;
+        const latestTag = latestCodeTag();
+        const pointerTag = githubPointerTag();
         const candidate = maybe(() => json('npm', ['view', `${PACKAGE}@candidate-v${identity.version}`, '--json']), null);
         const exactVersion = maybe(() => json('npm', ['view', `${PACKAGE}@${identity.version}`, '--json']), null);
         const latestVersion = command('npm', ['view', `${PACKAGE}@latest`, 'version']);
@@ -290,8 +313,10 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
             published: release.draft === false,
             latest: latestTag === identity.tag,
             latestTag,
+            // What releases/latest actually points at — distinct from `latest` (code recency) above.
+            pointerTag,
             assetsExact: assetsExactFor(release, identity, forceAssets),
-          } : { tag: null, sha: null, draft: false, published: false, latest: false, assetsExact: false },
+          } : { tag: null, sha: null, draft: false, published: false, latest: false, pointerTag, assetsExact: false },
           publicReceiptExact,
           publicHostsExact,
         };
@@ -395,7 +420,7 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
         command('npm', ['dist-tag', 'add', `${PACKAGE}@${identity.version}`, `candidate-v${identity.version}`]);
         return;
       }
-      command('npm', ['publish', packagePath, '--tag', `candidate-v${identity.version}`]);
+      command('npm', ['publish', packagePath, '--tag', `candidate-v${identity.version}`], PUBLISH_COMMAND_OPTIONS);
     },
 
     async observeNpmCandidate(identity) {
@@ -409,7 +434,10 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
 
     async observeGithub(identity) {
       const release = json('gh', ['api', `repos/${REPO}/releases/tags/${identity.tag}`]);
-      const latest = maybe(() => json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name, null);
+      // "Is this release the current CODE generation", not "does it hold the latest pointer". Once a
+      // corpus generation takes the pointer — which is the designed steady state — a genuinely
+      // published code release would otherwise start observing itself as no longer latest.
+      const latest = maybe(() => latestCodeTag(), null);
       return { tag: release.tag_name, sha: tagSha(identity.tag, root), latest: latest === identity.tag };
     },
 
@@ -424,14 +452,23 @@ export function liveReleaseProvider({ root = process.cwd() } = {}) {
       return { version: command('npm', ['view', `${PACKAGE}@latest`, 'version']) };
     },
     async makeGithubLatest(draft, identity, expectedPrior) {
-      const current = json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name;
+      // The prior-generation check is about the CODE lineage: it exists to catch "someone promoted a
+      // different product generation while this transaction was in flight". A corpus generation
+      // legitimately holding `releases/latest` is NOT that — it is the designed steady state between
+      // code releases — so the comparison is made against the latest CODE release, and the pointer's
+      // own kind is recorded rather than treated as a conflict.
+      const pointer = githubPointerTag();
+      const current = latestCodeTag();
       if (current !== expectedPrior && current !== identity.tag) {
-        throw new Error(`refusing GitHub promotion: latest is ${current}, expected ${expectedPrior}`);
+        throw new Error(`refusing GitHub promotion: latest code release is ${current}, expected ${expectedPrior}`);
+      }
+      if (isCorpusReleaseTag(pointer)) {
+        process.stdout.write(`[release] promoting over corpus generation ${pointer} — the code bundle carries its own corpus\n`);
       }
       command('gh', ['api', '-X', 'PATCH', `repos/${REPO}/releases/${draft.id}`, '-f', 'make_latest=true']);
     },
     async observeGithubLatest() {
-      return { tag: json('gh', ['api', `repos/${REPO}/releases/latest`]).tag_name };
+      return { tag: latestCodeTag() };
     },
     async restoreNpmLatest(prior, expected) {
       const current = command('npm', ['view', `${PACKAGE}@latest`, 'version']);

package/scripts/release-transaction.mjs

@@ -194,6 +194,25 @@ const npmCandidateExact = (snapshot, identity) => snapshot?.npm?.candidateVersio
 const npmLatestIsB = (snapshot, identity) => snapshot?.npm?.latestVersion === identity.version;
 const githubIsB = (snapshot, identity) => snapshot?.github?.sha === identity.candidateSha
   && snapshot?.github?.tag === identity.tag;
+// TWO DIFFERENT QUESTIONS ABOUT "LATEST", ANSWERED BY TWO DIFFERENT FIELDS (4.3.25, 2026-09-16).
+//
+// `snapshot.github.latest` is "is this the newest CODE release" — observeGithub derives it from
+// latestCodeReleaseTag(), deliberately, because per ADR-086 S1 a corpus generation may legitimately
+// hold GitHub's releases/latest pointer and a code release must not observe itself as demoted.
+// `snapshot.github.pointerTag` is what releases/latest actually points at.
+//
+// Every promotion, recovery, verification and abort check in this file wants the SECOND question:
+// "has the pointer been moved to B yet". Ten sites read the first. A freshly published code release
+// is ALWAYS the newest code release, so `!latest` was unsatisfiable (publish gate, resume clause —
+// the transaction wedged at github-promote-intent), `latest` was trivially true (promotion looked
+// already done, the pointer never moved, converge and finalize passed with it unmoved), and abort
+// refused because "latest" had moved. Ask the pointer. Snapshots without one (recorded receipts,
+// older providers) fall back to code recency so history stays interpretable.
+const githubPointerIsB = (snapshot, identity) => (snapshot?.github?.pointerTag !== undefined
+  ? snapshot.github.pointerTag === identity.tag
+  : snapshot?.github?.latest === true);
+const githubPointerTag = (snapshot) => (snapshot?.github?.pointerTag !== undefined
+  ? snapshot.github.pointerTag : snapshot?.github?.latestTag);
 
 /**
  * Pure, total next-action selector. Receipt history is an audit chain, never permission to skip a
@@ -206,7 +225,7 @@ export function reduceReleaseState({ lastReceipt, snapshot, identity, prior }) {
   const npmB = npmLatestIsB(snapshot, identity);
   const githubB = githubIsB(snapshot, identity);
   const githubPublished = githubB && snapshot.github?.published === true;
-  const githubLatest = githubPublished && snapshot.github?.latest === true;
+  const githubLatest = githubPublished && githubPointerIsB(snapshot, identity);
 
   if (snapshot.npm?.candidateVersion === identity.version && snapshot.npm?.candidateIntegrity
     && snapshot.npm.candidateIntegrity !== identity.packageIntegrity) {
@@ -338,8 +357,11 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       await transition('prepared', { recovered: true });
       continue;
     }
+    // 4.3.25 run 35109036116: run 2 died after writing github-promote-intent, run 3 found the draft
+    // published, the reducer asked for promote-npm — not a legal edge from here. This clause was the
+    // only legal exit and its `!latest` was unsatisfiable. Wedged.
     if (current.state === 'github-promote-intent' && githubIsB(snapshot, identity)
-      && snapshot.github?.published && !snapshot.github?.latest) {
+      && snapshot.github?.published && !githubPointerIsB(snapshot, identity)) {
       await transition('github-promoted-nonlatest', { github: snapshot.github, recovered: true });
       continue;
     }
@@ -348,7 +370,7 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       continue;
     }
     if (current.state === 'github-latest-intent' && npmLatestIsB(snapshot, identity)
-      && githubIsB(snapshot, identity) && snapshot.github?.latest) {
+      && githubIsB(snapshot, identity) && githubPointerIsB(snapshot, identity)) {
       await transition('defaults-promoted', { npm: snapshot.npm, github: snapshot.github, recovered: true });
       continue;
     }
@@ -357,7 +379,7 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       throw new Error('npm compensation recovered; resume the same transaction');
     }
     if (current.state === 'finalize-intent' && npmCandidateExact(snapshot, identity) && npmLatestIsB(snapshot, identity)
-      && githubIsB(snapshot, identity) && snapshot.github?.published && snapshot.github?.latest
+      && githubIsB(snapshot, identity) && snapshot.github?.published && githubPointerIsB(snapshot, identity)
       && snapshot.github?.assetsExact) {
       return append('channels-converged', { verdict: 'PUBLISHED_NOT_VERIFIED', recovered: true,
         npm: snapshot.npm, github: snapshot.github });
@@ -425,7 +447,10 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       await transition('github-promote-intent');
       await adapter.publishDraftNonLatest(draft, identity);
       const observed = await adapter.observeSnapshot(identity, draft);
-      if (!(githubIsB(observed, identity) && observed.github.published && !observed.github.latest)) {
+      // Published as B, and the POINTER has not moved to B yet — it is promoted later, in
+      // make-github-latest. 4.3.25 run 35057738103 published this correctly and then threw here on
+      // `!latest`, which a just-published code release can never satisfy.
+      if (!(githubIsB(observed, identity) && observed.github.published && !githubPointerIsB(observed, identity))) {
         throw new Error('GitHub non-latest publication not observed');
       }
       await transition('github-promoted-nonlatest', { github: observed.github });
@@ -446,7 +471,7 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       await transition('github-latest-intent');
       await adapter.makeGithubLatest(draft, identity, prior.githubLatest);
       const observed = await adapter.observeSnapshot(identity, draft);
-      if (!(npmLatestIsB(observed, identity) && observed.github?.latest && githubIsB(observed, identity))) {
+      if (!(npmLatestIsB(observed, identity) && githubPointerIsB(observed, identity) && githubIsB(observed, identity))) {
         throw new Error('provider defaults not jointly observed at candidate B');
       }
       await transition('defaults-promoted', { npm: observed.npm, github: observed.github });
@@ -469,7 +494,7 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       }
       await transition('finalize-intent');
       const reobserved = await adapter.observeSnapshot(identity, draft, { forceAssets: true });
-      if (!(npmLatestIsB(reobserved, identity) && reobserved.github?.latest && githubIsB(reobserved, identity))) {
+      if (!(npmLatestIsB(reobserved, identity) && githubPointerIsB(reobserved, identity) && githubIsB(reobserved, identity))) {
         throw new Error('provider defaults drifted before channel convergence');
       }
       if (!reobserved.github?.assetsExact || !npmCandidateExact(reobserved, identity)) {
@@ -491,8 +516,12 @@ export async function abortReleaseTransaction({ identity, receipts, reason, auth
   }
   const snapshot = await adapter.observeSnapshot(identity);
   const prior = chain[0]?.observation?.prior;
-  if (!prior || snapshot.npm?.latestVersion === identity.version || snapshot.github?.latest === true
-    || snapshot.npm?.latestVersion !== prior.npmLatest || snapshot.github?.latestTag !== prior.githubLatest) {
+  // "Both defaults still at the captured prior generation" is a question about the npm `latest`
+  // dist-tag and GitHub's releases/latest POINTER. A published-but-not-promoted candidate is the
+  // newest CODE release, so the old `latest === true` / `latestTag !== prior` reads refused to abort
+  // exactly the transaction that most needs aborting: one wedged after publish, before promotion.
+  if (!prior || snapshot.npm?.latestVersion === identity.version || githubPointerIsB(snapshot, identity)
+    || snapshot.npm?.latestVersion !== prior.npmLatest || githubPointerTag(snapshot) !== prior.githubLatest) {
     throw new Error('release abort cannot prove both defaults at captured prior generation');
   }
   const receipt = stateReceipt({
@@ -550,7 +579,7 @@ export async function finalizeReleaseTransaction({
   }
   const snapshot = await adapter.observeSnapshot(identity, discovered.matchingDrafts?.[0], { forceAssets: true });
   if (snapshot.readError || !npmLatestIsB(snapshot, identity) || !npmCandidateExact(snapshot, identity)
-    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || snapshot.github?.latest !== true
+    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || !githubPointerIsB(snapshot, identity)
     || snapshot.github?.assetsExact !== true) throw new Error('public channels drifted before install verification');
   const materialized = await adapter.materializePublicVerificationAggregate({ identity, aggregate });
   const aggregateAssetSha256 = crypto.createHash('sha256').update(canonicalJson(aggregate)).digest('hex');
@@ -642,7 +671,7 @@ export async function abandonPublicVerificationTransaction({ identity, expected,
   }
   const snapshot = await adapter.observeSnapshot(identity, discovered.matchingDrafts?.[0], { forceAssets: true });
   if (snapshot.readError || !npmLatestIsB(snapshot, identity) || !npmCandidateExact(snapshot, identity)
-    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || snapshot.github?.latest !== true
+    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || !githubPointerIsB(snapshot, identity)
     || snapshot.github?.assetsExact !== true
     || canonicalJson(snapshot.npm) !== canonicalJson(current.observation.npm)
     || canonicalJson(snapshot.github) !== canonicalJson(current.observation.github)) {

package/scripts/release.mjs

@@ -35,6 +35,29 @@ import { materializePublicationHandoff, resolvePublicationHandoffPaths } from '.
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
 import { stagedHostVerifier } from './staged-host-verifier.mjs';
 import { verifyPayload } from './release-payload.mjs';
+import { verifyCorpusReceipt } from './corpus-candidate.mjs';
+import { readDiagnosticAccuracyReport } from './oracle/retrieval-accuracy.mjs';
+import { loadFixture, readRecallReport } from './oracle/repo-recall.mjs';
+
+/**
+ * The measured retrieval numbers, stated in the release notes themselves rather than left behind a
+ * digest. Both halves go in together on purpose: the number that qualified the release, and the one
+ * it did NOT meet. A reader who sees only the first would reasonably assume the second was fine.
+ */
+const recallNotes = (receipt) => {
+  const r = receipt.recallSummary;
+  if (!r) return [];
+  return [
+    `Retrieval (blocking): ${r.repositoriesAnswering}/${r.questions} repositories answer a real question`
+      + ` about themselves from their own content; ${r.exactFileTop5}/${r.questions} return the exact`
+      + ` labeled file in the top 5 (floor ${r.floor}).`,
+    'NOT measured: generated-answer correctness, citation support, or unscoped whole-corpus discovery.',
+    `ADR-086 C3 was NOT met and is NOT claimed — its measurement ships as ${receipt.accuracyReport.file}`
+      + ' for inspection.',
+  ];
+};
+import { verifyBundle } from './verify-bundle.mjs';
+import { CORPUS_GENERATION_FIELD, evaluateCorpusPromotion } from './corpus-promotion.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const PUBLISH = process.argv.includes('--publish');
@@ -83,7 +106,7 @@ function corpusFailure(message) {
   throw new Error(`[corpus-seed] ${message}`);
 }
 
-export function runProtectedCorpusSeed({
+export async function runProtectedCorpusSeed({
   argv = process.argv.slice(2),
   env = process.env,
   root = ROOT,
@@ -94,6 +117,13 @@ export function runProtectedCorpusSeed({
     corpusFailure(environmentFailures.join('; '));
   }
 
+  // The corpus route may never enter product publication. This is belt to the workflow's braces: the
+  // corpus job binds an environment that holds no NPM_TOKEN at all, so npm is unreachable from it by
+  // construction; this refuses the combined invocation outright so the two modes can never share one
+  // process even if a future workflow edit put them in the same job.
+  if (argv.includes('--publish')) corpusFailure('--corpus-seed cannot be combined with --publish; corpus routing must never enter product publication');
+  const promoteLatest = argv.includes('--promote-latest');
+
   const tag = cliArg(argv, '--corpus-tag');
   const bundleFile = cliArg(argv, '--corpus-bundle');
   const receiptFile = cliArg(argv, '--corpus-receipt');
@@ -130,11 +160,20 @@ export function runProtectedCorpusSeed({
     corpusFailure('target must exactly equal HEAD, GITHUB_SHA, and the corpus receipt builderSourceSha');
   }
 
-  const boundaryIdentities = [receipt.privateFence, receipt.eligibilityPolicy, receipt.generationLedger];
+  // Schema 3 (ADR-086 Step 15 / A6): the receipt binds the full provenance closure shipped INSIDE
+  // the sealed archive (ARCHIVE-MANIFEST.json, PRIVATE-STORES.json, RVF-GENERATIONS.json,
+  // SOURCE.json) AND the detached, digest-bound retrieval-accuracy report that measured this exact
+  // archive. Schema 2 is refused outright: a schema-2 seed carries no accuracy binding, so it is
+  // UNPUBLISHABLE from here forward and data/corpus-seed.json must be re-pointed at a schema-3 seed
+  // in the same change that publishes one.
+  const boundaryIdentities = [receipt.privateFence, receipt.generationLedger, receipt.sourceManifest, receipt.archiveManifest];
   const storeBindingsValid = Number.isSafeInteger(receipt.storeCount) && receipt.storeCount > 0
     && Array.isArray(receipt.stores) && receipt.stores.length === receipt.storeCount
     && receipt.stores.every((store) => typeof store?.name === 'string' && store.name.length > 0
-      && /^[a-f0-9]{7,64}$/.test(String(store.sourceCommit || ''))
+      && ['repository', 'gist-aggregate', 'derived'].includes(store.kind)
+      && (store.kind === 'repository'
+        ? /^[a-f0-9]{7,64}$/.test(String(store.sourceCommit || ''))
+        : store.sourceCommit === null || /^[a-f0-9]{7,64}$/i.test(String(store.sourceCommit || '')))
       && typeof store.builtUtc === 'string' && Number.isFinite(Date.parse(store.builtUtc))
       && typeof store.model === 'string' && store.model.length > 0
       && Number.isSafeInteger(store.dimensions) && store.dimensions > 0
@@ -146,9 +185,10 @@ export function runProtectedCorpusSeed({
   const generatorFile = path.join(root, 'scripts/corpus-candidate.mjs');
   const generatorValid = fs.existsSync(generatorFile)
     && receipt.generator?.corpusCandidateSha256 === sha256File(generatorFile);
-  if (receipt.schemaVersion !== 1 || receipt.kind !== 'ruvnet-brain-corpus-candidate'
-    || !receipt.createdAt || !receipt.coverageGeneration || !storeBindingsValid || !emptyFailureArrays
+  if (receipt.schemaVersion !== 3 || receipt.kind !== 'ruvnet-brain-corpus-candidate'
+    || !receipt.createdAt || !storeBindingsValid || !emptyFailureArrays
     || !privateExclusionsValid || !boundaryIdentities.every(exactFileIdentity) || !exactFileIdentity(receipt.archive)
+    || !exactFileIdentity(receipt.accuracyReport)
     || !generatorValid
     || receipt.archive.file !== path.basename(bundleFile)) {
     corpusFailure('corpus receipt bindings are incomplete or invalid');
@@ -160,6 +200,98 @@ export function runProtectedCorpusSeed({
   }
   if (digestMatch[1] !== archiveSha256) corpusFailure('corpus tag digest does not match the receipt and archive');
 
+  // ADR-086 Step 15's second binding. The detached accuracy report travels beside the archive; this
+  // proves (a) the file the receipt names is the file present here, byte for byte, (b) the report
+  // was measured against THESE archive bytes, (c) every partition in both query modes passed
+  // 20x>=19x with no timeouts and no bounded sampling, and (d) it was produced by the committed
+  // benchmark against the committed oracle — so a swapped oracle or a patched benchmark is caught
+  // here even though the receipt itself carries only {file, sha256, bytes}.
+  const accuracyReportFile = `${bundleFile}.accuracy.json`;
+  if (receipt.accuracyReport.file !== path.basename(accuracyReportFile)) {
+    corpusFailure('corpus receipt names an accuracy report that is not the one beside this archive');
+  }
+  if (!fs.existsSync(accuracyReportFile) || !fs.statSync(accuracyReportFile).isFile()) {
+    corpusFailure(`detached retrieval-accuracy report missing beside the archive (${path.basename(accuracyReportFile)})`);
+  }
+  if (sha256File(accuracyReportFile) !== receipt.accuracyReport.sha256
+    || fs.statSync(accuracyReportFile).size !== receipt.accuracyReport.bytes) {
+    corpusFailure('detached retrieval-accuracy report bytes do not match the corpus receipt');
+  }
+  const committedOracleFile = path.join(root, 'data/retrieval-accuracy-oracle.json');
+  const accuracyGeneratorFile = path.join(root, 'scripts/oracle/retrieval-accuracy.mjs');
+  if (!fs.existsSync(committedOracleFile)) corpusFailure('committed retrieval-accuracy oracle is missing from the release checkout');
+  if (!fs.existsSync(accuracyGeneratorFile)) corpusFailure('committed retrieval-accuracy benchmark is missing from the release checkout');
+  // The BLOCKING retrieval predicate at publication is the frozen-fixture repo-recall gate, read
+  // through the same module candidate acceptance used so the two can never drift apart. ADR-086's
+  // C3 report still has to exist and still has to be bound to these exact archive bytes — an
+  // unbound diagnostic looks like evidence and is worse than none — but its score no longer refuses
+  // publication. That reduction is declared in docs/adr/0086 and in the published report itself.
+  const archiveIdentity = { file: receipt.archive.file, sha256: archiveSha256, bytes: fs.statSync(bundleFile).size };
+  try {
+    readDiagnosticAccuracyReport({
+      reportFile: accuracyReportFile,
+      archive: archiveIdentity,
+      expectedOracleSha256: sha256File(committedOracleFile),
+      expectedGeneratorSha256: sha256File(accuracyGeneratorFile),
+    });
+  } catch (error) {
+    corpusFailure(`the published C3 diagnostic is not bound to this archive (${error.message})`);
+  }
+  const recallReportFile = `${bundleFile}.recall.json`;
+  if (!fs.existsSync(recallReportFile)) {
+    corpusFailure(`detached repo-recall report missing beside the archive (${path.basename(recallReportFile)})`);
+  }
+  if (!receipt.recallReport
+    || sha256File(recallReportFile) !== receipt.recallReport.sha256
+    || fs.statSync(recallReportFile).size !== receipt.recallReport.bytes) {
+    corpusFailure('detached repo-recall report bytes do not match the corpus receipt');
+  }
+  try {
+    readRecallReport({
+      reportFile: recallReportFile,
+      archive: archiveIdentity,
+      expectedFixtureSha256: loadFixture().fixtureSha256,
+    });
+  } catch (error) {
+    corpusFailure(`retrieval does not qualify this corpus for publication (${error.message})`);
+  }
+
+  // Deep re-verification — moved here 2026-09-13 from the deleted scripts/corpus-seed-publish.mjs
+  // (ADR-085). Everything above proves the receipt is well-FORMED and that the archive's outer
+  // digest matches it; none of it proves the receipt is TRUE. verifyCorpusReceipt re-extracts the
+  // sealed archive and re-derives the entire candidate from its own bytes — per-store file digests,
+  // private-store fence, generation ledger, RVF index audit — and requires canonical equality with
+  // the receipt. A receipt with a single forged store digest passes every check above and fails
+  // here. It runs before any `gh` call so an untrue candidate never reaches the network.
+  try {
+    await verifyCorpusReceipt({
+      receiptFile, bundleFile, accuracyReportFile, recallReportFile, expectedBuilderSha: target, expectedArchiveSha256: archiveSha256,
+    });
+  } catch (error) {
+    corpusFailure(`corpus receipt does not verify against the sealed archive (${error.message})`);
+  }
+
+  // EVERY local proof happens before the first network call. `gh` must never be reached by a
+  // candidate that is already known to be unpublishable — that is the same discipline the deep
+  // verifyCorpusReceipt above follows, and a customer release with an unusable signature is exactly
+  // as unpublishable as an untrue receipt.
+  const signatureFile = `${bundleFile}.sig`;
+  const digestFile = `${bundleFile}.sha256`;
+  const generation = String(receipt.createdAt || '');
+  if (promoteLatest) {
+    for (const [label, file] of [['detached signature', signatureFile], ['sha256 sidecar', digestFile]]) {
+      if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
+        corpusFailure(`customer corpus promotion requires a ${label} beside the archive (${path.basename(file)} missing) — the updater fails closed without it`);
+      }
+    }
+    // The real verifier, against the trust root that ships inside the npm package. Signing happens in
+    // the workflow with the environment-scoped key; this proves the bytes about to be published
+    // verify with the key kb/forge-update.mjs actually carries.
+    const signature = verifyBundle(bundleFile, signatureFile);
+    if (!signature.ok) corpusFailure(`detached signature does not verify against the shipped trust root (${signature.reason})`);
+    if (!Number.isFinite(Date.parse(generation))) corpusFailure('corpus receipt createdAt is not a readable generation timestamp');
+  }
+
   const viewArgs = ['release', 'view', tag, '--json', 'tagName', '--repo', repo];
   const ghCommand = env.RUVNET_GH_COMMAND || 'gh';
   const ghPrefix = env.RUVNET_GH_SCRIPT ? [env.RUVNET_GH_SCRIPT] : [];
@@ -168,33 +300,136 @@ export function runProtectedCorpusSeed({
   const viewError = String(view.error?.message || view.stderr || view.stdout || '');
   if (!/(release not found|no release found)/i.test(viewError)) corpusFailure(`cannot prove ${tag} is absent (${viewError.trim() || `gh exited ${view.status}`})`);
 
+  const receiptSha256 = sha256File(receiptFile);
+  const gh = (args) => run(ghCommand, [...ghPrefix, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+
+  if (!promoteLatest) {
+    // BOOTSTRAP/RECOVERY seeds stay exactly as ADR-086's original contract left them: an immutable
+    // prerelease that never touches releases/latest. Dual's C4 resolution (S1) narrows the change to
+    // CUSTOMER releases — "Bootstrap-only releases may remain prereleases."
+    const notes = [
+      'Content-addressed RuvNet Brain corpus seed.',
+      `Archive SHA-256: ${archiveSha256}`,
+      `Receipt SHA-256: ${receiptSha256}`,
+      `Accuracy report SHA-256: ${receipt.accuracyReport.sha256}`,
+      `Recall report SHA-256: ${receipt.recallReport.sha256}`,
+      ...recallNotes(receipt),
+      `Stores: ${receipt.storeCount}`,
+      `Builder source SHA: ${receipt.builderSourceSha}`,
+      'This published prerelease is immutable and must never be replaced.',
+    ].join('\n');
+    // The detached accuracy report ships AS AN ASSET. Without it a downloader holds an archive it
+    // cannot re-verify — "reverify the downloaded final artifact against the measured identity"
+    // requires the measurement to travel with the artifact it measured.
+    const createArgs = [
+      'release', 'create', tag,
+      '--prerelease', '--latest=false',
+      '--target', target,
+      '--repo', repo,
+      '--title', `Immutable corpus seed ${archiveSha256.slice(0, 16)}`,
+      '--notes', notes,
+      bundleFile, receiptFile, accuracyReportFile, recallReportFile,
+    ];
+    const create = gh(createArgs);
+    if (create.error || create.status !== 0) {
+      corpusFailure(`protected corpus publication failed (${String(create.error?.message || create.stderr || create.stdout || '').trim()})`);
+    }
+    return { tag, target, repository: repo, archiveSha256, receiptSha256, promoted: false };
+  }
+
+  // ── CUSTOMER CORPUS RELEASE (ADR-086 step 17 / C4 resolution S1) ───────────────────────────────
+  // The old path was invisible AND unusable to a customer, for two independent reasons, and fixing
+  // only one leaves the channel dead. `--prerelease --latest=false` means kb/forge-update.mjs's
+  // releases/latest poll never sees it; and with no detached .sig the updater fails closed anyway
+  // (kb/forge-update.mjs:1275 fetches `${url}.sig`, :1284-1285 exits 4 when verification fails).
+  // scripts/verify-channels.mjs checks exactly these two things (checks 3 and 4) against the live
+  // endpoints, and is the owner's post-publish acceptance gate.
+  const latestView = gh(['release', 'view', '--json', 'tagName,body', '--repo', repo]);
+  let currentLatest = null;
+  if (!latestView.error && latestView.status === 0) {
+    try { currentLatest = JSON.parse(String(latestView.stdout || 'null')); }
+    catch (error) { corpusFailure(`cannot read the current latest release (${error.message})`); }
+    if (!currentLatest || typeof currentLatest.tagName !== 'string') corpusFailure('current latest release carries no tag name');
+  } else {
+    const latestError = String(latestView.error?.message || latestView.stderr || latestView.stdout || '');
+    if (!/(release not found|no release found)/i.test(latestError)) {
+      corpusFailure(`cannot determine the current latest release (${latestError.trim() || `gh exited ${latestView.status}`})`);
+    }
+  }
+  const promotion = evaluateCorpusPromotion({ tag, generation, currentLatest });
+  if (!promotion.allowed) corpusFailure(promotion.reason);
+
   const notes = [
-    'Content-addressed RuvNet Brain corpus seed.',
+    'RuvNet Brain corpus generation — signed, content-addressed, and promoted to latest.',
+    `${CORPUS_GENERATION_FIELD} ${generation}`,
     `Archive SHA-256: ${archiveSha256}`,
-    `Receipt SHA-256: ${sha256File(receiptFile)}`,
+    `Receipt SHA-256: ${receiptSha256}`,
     `Stores: ${receipt.storeCount}`,
-    `Coverage generation: ${receipt.coverageGeneration}`,
-    'This published prerelease is immutable and must never be replaced.',
+    `Builder source SHA: ${receipt.builderSourceSha}`,
+    `Shipped runtime: ${receipt.archiveManifestReleaseTag}`,
+    ...recallNotes(receipt),
+    'Immutable: this tag is the archive digest and must never be replaced.',
   ].join('\n');
-  const createArgs = [
+
+  // ASSETS COMPLETE BEFORE PROMOTION. `gh release create` uploads assets AFTER the release exists, so
+  // creating a non-draft release directly opens a window in which releases/latest resolves to a
+  // release with no archive — every polling client in that window fails or, worse, half-downloads.
+  // Create as a draft (invisible to releases/latest), prove all four assets landed, and only then
+  // flip draft off and claim latest in one edit.
+  // Both reports ride with every corpus release for the same reason they ride with a seed: a customer
+  // (or the next night's dispatcher) that downloads the archive must be able to reverify it against
+  // the identity it was actually measured under — the blocking recall gate AND the C3 diagnostic it
+  // scored 59.0% on, so nobody has to take either number on trust.
+  const assetFiles = [bundleFile, signatureFile, digestFile, receiptFile, accuracyReportFile, recallReportFile];
+  const create = gh([
     'release', 'create', tag,
-    '--prerelease', '--latest=false',
+    '--draft',
     '--target', target,
     '--repo', repo,
-    '--title', `Immutable corpus seed ${archiveSha256.slice(0, 16)}`,
+    '--title', `RuvNet Brain corpus ${archiveSha256.slice(0, 16)}`,
     '--notes', notes,
-    bundleFile, receiptFile,
-  ];
-  const create = run(ghCommand, [...ghPrefix, ...createArgs], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    ...assetFiles,
+  ]);
   if (create.error || create.status !== 0) {
     corpusFailure(`protected corpus publication failed (${String(create.error?.message || create.stderr || create.stdout || '').trim()})`);
   }
-  return { tag, target, repository: repo, archiveSha256, receiptSha256: sha256File(receiptFile) };
+
+  const expectedAssets = assetFiles.map((file) => path.basename(file)).sort();
+  const draftView = gh(['release', 'view', tag, '--json', 'isDraft,assets', '--repo', repo]);
+  if (draftView.error || draftView.status !== 0) corpusFailure('cannot confirm the draft corpus release before promotion');
+  let draft;
+  try { draft = JSON.parse(String(draftView.stdout || 'null')); }
+  catch (error) { corpusFailure(`cannot read the draft corpus release (${error.message})`); }
+  const uploaded = (draft?.assets || []).filter((asset) => asset?.state === 'uploaded' && Number.isSafeInteger(asset.size) && asset.size > 0);
+  if (draft?.isDraft !== true || JSON.stringify(uploaded.map((asset) => asset.name).sort()) !== JSON.stringify(expectedAssets)) {
+    corpusFailure(`refusing to promote an incomplete corpus release; expected ${expectedAssets.join(', ')} fully uploaded on a draft`);
+  }
+
+  const promote = gh(['release', 'edit', tag, '--repo', repo, '--draft=false', '--latest', '--prerelease=false']);
+  if (promote.error || promote.status !== 0) {
+    corpusFailure(`corpus promotion to latest failed (${String(promote.error?.message || promote.stderr || promote.stdout || '').trim()})`);
+  }
+
+  const finalView = gh(['release', 'view', tag, '--json', 'tagName,isDraft,isLatest,isPrerelease,assets', '--repo', repo]);
+  if (finalView.error || finalView.status !== 0) corpusFailure('cannot confirm the promoted corpus release');
+  let promoted;
+  try { promoted = JSON.parse(String(finalView.stdout || 'null')); }
+  catch (error) { corpusFailure(`cannot read the promoted corpus release (${error.message})`); }
+  const promotedAssets = (promoted?.assets || []).map((asset) => asset?.name).sort();
+  if (promoted?.tagName !== tag || promoted.isDraft !== false || promoted.isLatest !== true
+    || promoted.isPrerelease !== false || JSON.stringify(promotedAssets) !== JSON.stringify(expectedAssets)) {
+    corpusFailure('corpus release did not reach a complete, non-draft, non-prerelease latest state');
+  }
+
+  return {
+    tag, target, repository: repo, archiveSha256, receiptSha256, promoted: true,
+    generation, supersededLatest: currentLatest?.tagName || null,
+  };
 }
 
 if (CORPUS_SEED) {
   try {
-    const result = runProtectedCorpusSeed();
+    const result = await runProtectedCorpusSeed();
     console.log(JSON.stringify({ ok: true, mode: 'corpus-seed', ...result }, null, 2));
   } catch (error) {
     console.error(error.message);