ruvnet-brain 4.3.27 → 4.3.29

package/scripts/rvf-generation.mjs

@@ -11,6 +11,29 @@ import path from 'node:path';
 import { getVersion, getVersionTag } from './version.mjs';
 
 export const RVF_GENERATIONS_FILE = 'RVF-GENERATIONS.json';
+export const RUNTIME_LEDGER_KIND = 'ruvnet-brain-runtime-generation-ledger';
+
+// S4 (ONE PROVENANCE RECORD) — RECONCILING THE TWO "schemaVersion 2" MEANINGS.
+//
+// Two independent writers had drifted into calling different shapes "schemaVersion 2":
+//   "Schema A" — THIS module's writeRvfGeneration wrote schemaVersion 1, no `kind`, no
+//     `sourceSnapshot`, one store touched per call (the dev-time incremental refresh ledger).
+//   "Schema B" — scripts/build-bundle.mjs's projectStoreViews independently writes
+//     `{ schemaVersion: 2, kind: 'ruvnet-brain-runtime-generation-ledger', brainVersion,
+//     releaseTag, sourceSnapshot, stores }` (the release-time ledger) — and
+//     plugin/scripts/coverage-integrity.mjs's release validation ALREADY requires exactly this
+//     shape (`schemaVersion !== 2` / `kind !== 'ruvnet-brain-runtime-generation-ledger'` are hard
+//     failures there, confirmed by reading it directly) for the tree an installed brain carries.
+// Schema B is the one kept: it is a strict superset (Schema A's per-store row shape is a subset
+// of Schema B's), and it is what the release-time validator already enforces on every installed
+// tree. Schema A is retired: writeRvfGeneration below now emits Schema B's envelope, carrying
+// `sourceSnapshot` forward from whatever the ledger already had (null until a release build sets
+// it — build-bundle.mjs's own construction is untouched and still wins at release time; this
+// module's schemaVersion bump changes nothing downstream, since nothing reads the dev-time
+// ledger's schemaVersion — verified against every consumer: validateSelectedRvfGenerations/
+// verifyRvfGenerations below check individual fields, never schemaVersion; build-bundle.mjs
+// reads the dev-time ledger via readRvfGenerations only to look up per-store rows by name, then
+// constructs ITS OWN new ledger object from scratch).
 
 export function canonicalRvfStores(dir) {
   return fs.readdirSync(dir)
@@ -42,7 +65,8 @@ export function sha256File(file) {
 export function readRvfGenerations(dir) {
   const file = path.join(dir, RVF_GENERATIONS_FILE);
   if (!fs.existsSync(file)) {
-    return { schemaVersion: 1, brainVersion: getVersion(), releaseTag: getVersionTag(), stores: {} };
+    return { schemaVersion: 2, kind: RUNTIME_LEDGER_KIND, brainVersion: getVersion(),
+      releaseTag: getVersionTag(), sourceSnapshot: null, stores: {} };
   }
   const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
   parsed.stores ||= {};
@@ -56,15 +80,22 @@ export function writeRvfGeneration({
   model,
   dimensions,
   sourceCommit = null,
+  sourceRepo = null,
+  sourceDescribe = null,
   builtUtc = new Date().toISOString(),
   previousDir = dir,
 }) {
   const rvfPath = path.join(dir, rvfFile);
   if (!fs.existsSync(rvfPath)) throw new Error(`cannot stamp missing RVF: ${rvfPath}`);
   const manifest = readRvfGenerations(previousDir);
-  manifest.schemaVersion = 1;
+  manifest.schemaVersion = 2;
+  manifest.kind = RUNTIME_LEDGER_KIND;
   manifest.brainVersion = getVersion();
   manifest.releaseTag = getVersionTag();
+  // Carried forward, never invented here: this is the git sha of the CODE checkout that
+  // assembles a release (build-bundle.mjs's projectStoreViews sets it fresh at release time).
+  // The dev-time incremental refresh this function serves does not know that value yet.
+  manifest.sourceSnapshot = manifest.sourceSnapshot ?? null;
   manifest.stores[store] = {
     file: rvfFile,
     sha256: sha256File(rvfPath),
@@ -72,12 +103,47 @@ export function writeRvfGeneration({
     model,
     dimensions,
     sourceCommit,
+    // S4 (ONE PROVENANCE RECORD): the repo identity a SOURCE.json entry needs, carried alongside
+    // the byte identity this ledger has always recorded, so SOURCE.json can be projected entirely
+    // FROM this ledger (projectSourceStore below) rather than a caller's own second copy of the
+    // same facts. Optional and omitted (not written as null) so a caller that does not pass them
+    // gets a ledger row with no dangling nulls.
+    ...(sourceRepo !== null ? { sourceRepo } : {}),
+    ...(sourceDescribe !== null ? { sourceDescribe } : {}),
     builtUtc,
   };
   fs.writeFileSync(path.join(dir, RVF_GENERATIONS_FILE), `${JSON.stringify(manifest, null, 2)}\n`);
   return manifest.stores[store];
 }
 
+/**
+ * Project ONE SOURCE.json store entry from its ledger row — the ONE place identity fields
+ * (sourceRepo, sourceCommit, sourceDescribe, builtUtc) are read FROM the ledger rather than
+ * independently recomputed by a caller (S4: ONE PROVENANCE RECORD).
+ *
+ * Deliberately minimal: it projects ONLY the identity fields the ledger itself carries.
+ * `updater` supplies every NON-identity field a caller's SOURCE.json shape wants
+ * (canonicalManifestUrl, canonicalBundleUrl, selfUpdate, builder, updateManaged, origin, …) —
+ * spread first so identity fields read from `generation` always win, the same adapter pattern
+ * scripts/build-bundle.mjs's projectStoreViews already uses for the release-time case ("only its
+ * non-identity updater fields are borrowed per store; sourceCommit/builtUtc are always bound from
+ * the selected generation record, never independently trusted from the updater's own copy"). This
+ * function does not default those non-identity fields itself: a public-bundle store and a private
+ * overlay store want genuinely different shapes (a private store has no selfUpdate command at
+ * all, since forge-update.mjs never fetches it) — each caller states what IT needs.
+ */
+export function projectSourceStore(name, generation, updater = {}) {
+  if (!generation) throw new Error(`projectSourceStore: no ledger generation record for ${name}`);
+  return {
+    ...updater,
+    kbName: updater.kbName || name,
+    sourceRepo: generation.sourceRepo ?? updater.sourceRepo ?? null,
+    sourceCommit: generation.sourceCommit ?? null,
+    sourceDescribe: generation.sourceDescribe ?? updater.sourceDescribe ?? null,
+    builtUtc: generation.builtUtc,
+  };
+}
+
 export function verifyRvfGenerations(dir, {
   version = getVersion(),
   releaseTag = getVersionTag(),

package/scripts/single-source-check.mjs

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+// scripts/single-source-check.mjs — the single-source contract, as executable checks.
+//
+// Every entry is one defect found in the 2026-09-26 audit: two or more versions of the same rule,
+// process, code path or fact. Each check's exit is the verdict — nobody's word is. `repo` checks run
+// in CI (canonical-qa) so a contradiction that is removed can never silently come back; `machine`
+// checks describe this maintainer Mac and run with --machine.
+//
+//   node scripts/single-source-check.mjs            # repo checks (CI)
+//   node scripts/single-source-check.mjs --machine  # repo + machine checks
+//   node scripts/single-source-check.mjs --json
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readCheckpoint, checkpointStaleness } from './loop-checkpoint.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOME = os.homedir();
+const MACHINE = process.argv.includes('--machine');
+const JSON_OUT = process.argv.includes('--json');
+
+const git = (...a) => execFileSync('git', a, { cwd: ROOT, encoding: 'utf8', maxBuffer: 1 << 26 }).trim();
+const tracked = git('ls-files').split('\n').filter(Boolean);
+const read = (f) => { try { return readFileSync(path.join(ROOT, f), 'utf8'); } catch { return ''; } };
+const readAbs = (f) => { try { return readFileSync(f, 'utf8'); } catch { return ''; } };
+const json = (s) => { try { return JSON.parse(s); } catch { return {}; } };
+
+// Instruction surfaces: files that tell a person or an agent HOW to operate this project.
+// Decision records (ADR/DDD), research notes and append-only logs are history and are excluded.
+const HISTORY = /^(docs\/(adr|ddd|research|audits|reviews|qe)\/|CHANGELOG\.md$|PROGRESS\.md$|plugin\/docs\/RELEASE-NOTES|\.release-evidence\/|tests\/|evals\/)/;
+// kb/ is corpus content (primers/cards describing OTHER projects' own commands) and docs/issues/
+// are upstream bug reports quoting other configs — both are data, not instructions to this project.
+const instructions = tracked.filter((f) => /\.md$/.test(f) && !HISTORY.test(f) && !/^(kb|docs\/issues)\//.test(f));
+const grepIn = (files, re) => files.flatMap((f) => read(f).split('\n')
+  .map((l, i) => (re.test(l) ? `${f}:${i + 1}: ${l.trim().slice(0, 140)}` : null)).filter(Boolean));
+const none = (hits) => ({ ok: hits.length === 0, detail: hits.slice(0, 8).join('\n') || 'none' });
+
+const pkg = json(read('package.json'));
+const workflows = tracked.filter((f) => /^\.github\/workflows\/.+\.ya?ml$/.test(f));
+
+const checks = [
+  // A — one copy of the code
+  { id: 'A1', area: 'code', scope: 'repo', title: 'Every module is wired or has a stated reason (the repo\'s own wired-check audit)',
+    run: () => { const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/wired-check.mjs'), '--check'], { cwd: ROOT, encoding: 'utf8' });
+      return { ok: r.status === 0, detail: `${r.stdout}${r.stderr}`.split('\n').filter((l) => /UNWIRED|✗/.test(l)).slice(0, 6).join('\n') }; } },
+  { id: 'A2', area: 'code', scope: 'repo', title: 'No byte-identical duplicate files (outside test fixtures)',
+    run: () => {
+      const seen = new Map(); const dup = [];
+      for (const f of tracked) {
+        if (!/\.(mjs|js|cjs|sh|md|yml|json)$/.test(f) || /^tests\/|fixtures?\//.test(f)) continue;
+        if (f.endsWith('RELEASE-NOTES-4.0.md')) continue; // intentional pair, equality enforced by tests/integration/whats-new-installed.test.mjs
+        const t = read(f); if (t.length < 200) continue;
+        if (seen.has(t)) dup.push(`${f} == ${seen.get(t)}`); else seen.set(t, f);
+      }
+      return none(dup);
+    } },
+
+  // B — one version of the rules
+  { id: 'B1', area: 'rules', scope: 'repo', title: 'CONTRIBUTING.md is the only operating rulebook (no parallel process docs)',
+    run: () => none(['docs/QA-RELEASE-PROCESS.md', 'docs/NIGHTLY-REFRESH.md'].filter((f) => tracked.includes(f))) },
+  { id: 'B2', area: 'rules', scope: 'repo', title: 'No instruction tells anyone to publish locally',
+    run: () => none(grepIn(instructions.filter((f) => f !== 'CONTRIBUTING.md'), /release\.mjs --publish|\bnpm publish\b|gh release create/)
+      .filter((l) => !/\b(never|not|unusable|refus|intentionally|blocked|cannot|forbid|only through|provenance|ahead of the last)/i.test(l))) },
+  { id: 'B3', area: 'rules', scope: 'repo', title: 'No instruction uses npx for ruflo / claude-flow (one global ruflo)',
+    run: () => none(grepIn(instructions, /npx (-y )?(@claude-flow|claude-flow|ruflo)\b/)
+      .filter((l) => !/\bnever\b|console\/CONTRACT\.md:\d+: +"event"/i.test(l))) },
+  { id: 'B4', area: 'rules', scope: 'repo', title: 'No live file cites a workflow that does not exist',
+    run: () => {
+      const exists = new Set(workflows.map((w) => path.basename(w)));
+      const live = [...instructions, ...workflows, ...tracked.filter((f) => /^(scripts|plugin|bin|kb)\/.+\.(mjs|sh)$/.test(f))];
+      return none(live.flatMap((f) => [...read(f).matchAll(/\b([a-z0-9-]+\.ya?ml)\b/g)].map((m) => m[1])
+        .filter((n) => /release|corpus|publish|nightly|preflight|grading/.test(n) && !exists.has(n))
+        .map((n) => `${f}: ${n}`)));
+    } },
+  { id: 'B5', area: 'rules', scope: 'repo', title: 'Every `npm run X` in an instruction exists in package.json',
+    run: () => {
+      const scripts = new Set([...Object.keys(pkg.scripts || {}), ...Object.keys(json(read('kb/package.json')).scripts || {})]);
+      return none(instructions.flatMap((f) => [...read(f).matchAll(/npm run ([a-z0-9:_-]+)/g)]
+        .filter((m) => !scripts.has(m[1])).map((m) => `${f}: npm run ${m[1]}`)));
+    } },
+  { id: 'B6', area: 'rules', scope: 'repo', title: 'No instruction grants standing authority to publish without the owner',
+    run: () => none(grepIn(instructions, /standing authori[sz]ation permits|no separate human reviewer click/i)) },
+  { id: 'B7', area: 'rules', scope: 'repo', title: 'Model IDs are selected only in their owner modules',
+    run: () => {
+      const re = /['"`](claude-(fable|opus|sonnet|haiku)-[0-9][a-z0-9.-]*|gpt-[0-9][a-z0-9.-]*)['"`]/;
+      // Owners (the single definition sites) and non-selecting mentions, each with its reason.
+      const allowed = new Map([
+        ['scripts/review-model-defaults.mjs', 'owner: review / dual-host defaults'],
+        ['scripts/route-cheap.mjs', 'owner: Claude cost ladder'],
+        ['plugin/scripts/identifier-preflight.mjs', 'doc comment quoting a historical incident'],
+        ['scripts/goldie-research.mjs', 'family prefix match against the live catalog'],
+        ['scripts/routing-flywheel.mjs', 'comment example of id normalisation'],
+        ['scripts/proxy/proxy-verify.mjs', 'standalone ADR-0026 proxy trial tool (wired-check exempt)'],
+      ]);
+      const files = tracked.filter((f) => /^(scripts|plugin|bin|kb)\/.+\.mjs$/.test(f) && !allowed.has(f) && re.test(read(f)));
+      return none(files);
+    } },
+  { id: 'B8', area: 'rules', scope: 'repo', title: 'ADRs governing the live corpus publisher are not left "Proposed"',
+    run: () => none(tracked.filter((f) => /^docs\/adr\/008[56]-/.test(f)).filter((f) => /^status:\s*Proposed/im.test(read(f)))) },
+  { id: 'B9', area: 'rules', scope: 'repo', title: 'All version surfaces carry one version',
+    run: () => {
+      const v = [['package.json', pkg.version], ['kb/package.json', json(read('kb/package.json')).version],
+        ['plugin/.claude-plugin/plugin.json', json(read('plugin/.claude-plugin/plugin.json')).version],
+        ['plugin/.codex-plugin/plugin.json', json(read('plugin/.codex-plugin/plugin.json')).version]].filter(([, x]) => x);
+      return { ok: new Set(v.map(([, x]) => x)).size === 1, detail: v.map(([f, x]) => `${f}=${x}`).join(' ') };
+    } },
+  { id: 'B10', area: 'rules', scope: 'repo', title: 'Public pages show exactly one current version (no candidate/public split)',
+    run: () => none(grepIn(['README.md', 'explainer/index.html'], /candidate preview|public npm v\d/i)) },
+  { id: 'B11', area: 'rules', scope: 'repo', title: 'The ADR index lists every ADR, with the status the ADR itself declares',
+    run: () => {
+      const idx = read('docs/adr/README.md');
+      const adrs = tracked.filter((f) => /^docs\/adr\/\d{4}-.+\.md$/.test(f));
+      const missing = adrs.filter((f) => !idx.includes(path.basename(f))).map((f) => `not indexed: ${f}`);
+      const drift = adrs.flatMap((f) => {
+        const own = (read(f).match(/^status:\s*([A-Za-z]+)/m) || [])[1];
+        const statusTable = idx.slice(Math.max(0, idx.indexOf('| ADR | Title | Status |')));
+        const row = statusTable.split('\n').find((l) => l.includes(`(${path.basename(f)})`));
+        const listed = row && (row.match(/\|\s*([A-Za-z]+)[^|]*\|\s*$/) || [])[1];
+        return own && listed && own.toLowerCase() !== listed.toLowerCase() ? [`${path.basename(f)}: ADR says ${own}, index says ${listed}`] : [];
+      });
+      return none([...missing, ...drift]);
+    } },
+
+  { id: 'B12', area: 'rules', scope: 'machine', title: 'The local (untracked) CLAUDE.md / AGENTS.md carry no contradicting instruction',
+    run: () => {
+      const main = path.join(HOME, 'Code/ruvnet-brain');
+      const bad = /npx (-y )?(@claude-flow|claude-flow|ruflo)\b|standing authori[sz]ation permits|no separate human reviewer click|npm run (build|dev|test:integration|test:coverage|test:security)\b|not direct Agent tool/i;
+      return none(['CLAUDE.md', 'AGENTS.md'].flatMap((f) => readAbs(path.join(main, f)).split('\n')
+        .map((l, i) => (bad.test(l) ? `${f}:${i + 1}: ${l.trim().slice(0, 120)}` : null)).filter(Boolean)));
+    } },
+
+  // C — one release path
+  { id: 'C1', area: 'release', scope: 'repo', title: 'Unattended corpus promotion stays disarmed until a code release is install-verified',
+    run: () => ({ ok: !tracked.includes('data/approved-runtime.json'), detail: tracked.includes('data/approved-runtime.json') ? 'data/approved-runtime.json present (arms the 07:17 UTC nightly)' : 'absent' }) },
+  { id: 'C2', area: 'release', scope: 'repo', title: 'Every scheduled workflow pages the phone on failure',
+    run: () => {
+      const alerts = read('.github/workflows/ntfy-alerts.yml');
+      return none(workflows.filter((w) => /^\s*schedule:/m.test(read(w)) && !w.endsWith('ntfy-alerts.yml'))
+        .map((w) => ((read(w).match(/^name:\s*(.+)$/m) || [])[1] || w).trim().replace(/['"]/g, ''))
+        .filter((n) => !alerts.includes(n)));
+    } },
+  { id: 'C4', area: 'release', scope: 'machine', title: 'The corpus gist job has its authenticated token (RUVNET_GISTS_TOKEN)',
+    run: () => { const r = spawnSync('gh', ['secret', 'list', '-R', 'stuinfla/ruvnet-brain'], { encoding: 'utf8' }); return { ok: /^RUVNET_GISTS_TOKEN\b/m.test(r.stdout), detail: r.stdout.split('\n').map((l) => l.split(/\s/)[0]).filter(Boolean).join(', ') }; } },
+  { id: 'C3', area: 'release', scope: 'machine', title: 'Publishing requires the owner: Production environment has a required reviewer',
+    run: () => {
+      const r = spawnSync('gh', ['api', 'repos/stuinfla/ruvnet-brain/environments', '-q',
+        '.environments[]|select(.name=="Production – ruvnet-brain")|[.protection_rules[]?|select(.type=="required_reviewers")]|length'], { encoding: 'utf8' });
+      return { ok: r.status === 0 && Number(r.stdout.trim()) > 0, detail: `required_reviewers rules: ${r.stdout.trim() || r.stderr.trim()}` };
+    } },
+
+  // D — one corpus / update path
+  { id: 'D1', area: 'corpus', scope: 'repo', title: 'The end-user updater label is defined once; the one necessary copy (standalone runner) matches it',
+    run: () => {
+      const owner = (read('plugin/scripts/nightly-scheduler.mjs').match(/NIGHTLY_LABEL\s*=\s*'([^']+)'/) || [])[1];
+      const copies = tracked.filter((f) => /\.(mjs|sh)$/.test(f) && !/^tests\//.test(f) && f !== 'plugin/scripts/nightly-scheduler.mjs')
+        .filter((f) => /\^com\\\.ruvnet\\\.brain-update|'com\.ruvnet\.brain-update'/.test(read(f)));
+      // bin/nightly-refresh.mjs is copied to a standalone content-addressed path and executed outside the package, so it cannot import.
+      const extra = copies.filter((f) => f !== 'bin/nightly-refresh.mjs');
+      // The runner MUST carry the owner's exact label (it validates its own registration against it);
+      // testing only files that already contain the label would miss exactly the drifted case.
+      const runner = read('bin/nightly-refresh.mjs');
+      const esc = owner.replace(/\./g, '\\.');
+      const drift = !owner ? ['owner label not found in plugin/scripts/nightly-scheduler.mjs']
+        : (!runner.includes(`'${owner}'`) || !runner.includes(`/^${esc}\\.proof-`)) ? [`bin/nightly-refresh.mjs does not carry owner label ${owner}`] : [];
+      return none([...extra, ...drift]);
+    } },
+
+  { id: 'D2', area: 'corpus', scope: 'machine', title: 'Installed knowledge matches the installed plugin version',
+    run: () => {
+      const tag = String(json(readAbs(path.join(HOME, '.cache/ruvnet-brain/kb/SOURCE.json'))).releaseTag || '').replace(/^v/, '');
+      const active = json(readAbs(path.join(HOME, '.cache/ruvnet-brain/active.json'))).version;
+      return { ok: !!tag && tag === active, detail: `knowledge ${tag || 'unknown'} vs plugin ${active || 'unknown'}` };
+    } },
+  { id: 'D3', area: 'corpus', scope: 'machine', title: 'Exactly one update owner exists, and its last refresh run passed within 26h',
+    run: () => {
+      const brainJob = spawnSync('launchctl', ['print', `gui/${process.getuid()}/com.ruvnet.brain-update`], { encoding: 'utf8' }).status === 0;
+      const akJob = spawnSync('launchctl', ['print', `gui/${process.getuid()}/com.stuartkerr.ak-sync`], { encoding: 'utf8' }).status === 0;
+      const dir = path.join(HOME, '.cache/ruvnet-brain/refresh-runs');
+      const runs = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith('.json')).sort() : [];
+      const last = runs.length ? json(readAbs(path.join(dir, runs.at(-1)))) : {};
+      const fresh = last.startedAt && (Date.now() - Date.parse(last.startedAt)) < 26 * 3600e3;
+      const owners = [brainJob && 'brain-update', akJob && 'ak-sync'].filter(Boolean);
+      return { ok: owners.length === 1 && fresh && last.terminalVerdict !== 'failed', detail: `owners=[${owners.join(',') || 'none'}] last run ${last.startedAt || 'none'} verdict ${last.terminalVerdict || last.status || 'none'}` };
+    } },
+
+  // E — one hook / context plane
+  { id: 'E1', area: 'hooks', scope: 'machine', title: 'No stale autonomous-loop checkpoint is injected into sessions',
+    // H3: judged by the checkpoint's OWN `updatedAt` claim (loop-checkpoint.mjs's checkpointStaleness
+    // — the SAME rule ground-ruvnet.sh's `stale` verb uses), never by file mtime. A copy/rsync/restore
+    // resets mtime without the checkpoint's content changing, which is exactly the kind of second,
+    // drifting definition of "stale" this audit exists to catch — including, previously, in itself.
+    run: () => {
+      const f = path.join(ROOT, '.ruvnet-brain/checkpoint.json');
+      const main = path.join(HOME, 'Code/ruvnet-brain/.ruvnet-brain/checkpoint.json');
+      const stale = [f, main].filter((p) => existsSync(p) && checkpointStaleness(readCheckpoint(p)).stale);
+      return none(stale);
+    } },
+  { id: 'E2', area: 'hooks', scope: 'machine', title: 'Only one hook writes session snapshots (no global + plugin double writer)',
+    run: () => { const s = readAbs(path.join(HOME, '.claude/settings.json')); return { ok: !/agentdb-autocapture/.test(s), detail: /agentdb-autocapture/.test(s) ? 'global agentdb-autocapture still registered alongside the plugin session-snapshot' : 'single writer' }; } },
+
+  { id: 'E3', area: 'hooks', scope: 'machine', title: 'Lessons live in one store (no .swarm lesson-* rows outside the plugin lesson store)',
+    run: () => { const r = spawnSync('ruflo', ['memory', 'list', '--path', path.join(HOME, 'Code/ruvnet-brain/.swarm/memory.db'), '--limit', '500'], { encoding: 'utf8', timeout: 60000 });
+      const n = (r.stdout.match(/lesson-/g) || []).length; return { ok: n === 0, detail: `${n} lesson-* rows in project .swarm (plugin store: ~/.config/ruvnet-brain/lessons.json)` }; } },
+  { id: 'E4', area: 'hooks', scope: 'machine', title: 'One session-start continuity restorer (global hook stands down when the plugin is enabled)',
+    run: () => { const s = readAbs(path.join(HOME, '.claude/hooks/agentdb-ensure.sh')); return { ok: s.includes('SINGLE CONTINUITY OWNER'), detail: 'agentdb-ensure.sh must stand down its project-state recall' }; } },
+
+  // F — this Mac
+  { id: 'F1', area: 'machine', scope: 'machine', title: 'No plaintext API keys in ~/.claude/settings.json',
+    run: () => none(readAbs(path.join(HOME, '.claude/settings.json')).split('\n')
+      .filter((l) => /(api-key-|sk-[A-Za-z0-9]{20,}|_TOKEN"\s*:\s*"[^"$]{16,})/.test(l)).map((l) => l.replace(/:\s*".*"/, ': "<redacted>"').trim())) },
+  { id: 'F2', area: 'machine', scope: 'machine', title: 'Every required scheduled job proves it ran (repo watchdog)',
+    run: () => { const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/nightly-watchdog.mjs')], { cwd: ROOT, encoding: 'utf8', timeout: 60000 }); return { ok: r.status === 0, detail: `${r.stdout}${r.stderr}`.trim().split('\n').slice(-6).join('\n') }; } },
+  { id: 'F3', area: 'machine', scope: 'machine', title: 'Scheduled jobs use the one Node the shell uses (no /usr/local/bin/node v22)',
+    run: () => {
+      const dir = path.join(HOME, 'Library/LaunchAgents');
+      const plists = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith('.plist')) : [];
+      return none(plists.filter((f) => readAbs(path.join(dir, f)).includes('/usr/local/bin/node')));
+    } },
+  { id: 'F4', area: 'machine', scope: 'machine', title: 'Permission allow-list names the real Ruflo MCP server',
+    run: () => { const s = readAbs(path.join(HOME, '.claude/settings.json')); return { ok: !s.includes('"mcp__ruflo__*"') || s.includes('"mcp__claude-flow__*"'), detail: 'allow list names mcp__ruflo__* but the server is claude-flow' }; } },
+
+  // G — one release state
+  { id: 'G1', area: 'state', scope: 'machine', title: 'Local main is exactly origin/main',
+    run: () => { const m = git('rev-parse', 'main'); const o = git('rev-parse', 'origin/main'); return { ok: m === o, detail: `main ${m.slice(0, 8)} origin ${o.slice(0, 8)}` }; } },
+  { id: 'G2', area: 'state', scope: 'machine', title: 'npm latest, GitHub latest release and main carry the same version',
+    run: () => {
+      const npm = spawnSync('npm', ['view', 'ruvnet-brain', 'dist-tags.latest'], { encoding: 'utf8' }).stdout.trim();
+      const gh = spawnSync('gh', ['api', 'repos/stuinfla/ruvnet-brain/releases/latest', '-q', '.tag_name'], { encoding: 'utf8' }).stdout.trim().replace(/^v/, '');
+      const main = json(git('show', 'origin/main:package.json')).version;
+      return { ok: npm === gh && gh === main, detail: `npm ${npm} · github ${gh} · main ${main}` };
+    } },
+];
+
+const selected = checks.filter((c) => c.scope === 'repo' || MACHINE);
+const results = selected.map((c) => { let r; try { r = c.run(); } catch (e) { r = { ok: false, detail: `check crashed: ${e.message}` }; } return { ...c, ...r }; });
+
+// R1 — the register may not claim more than the evidence shows. A row in docs/WORK-REGISTER.md whose
+// State is LIVE or STAGED must have every check it names passing (machine checks only in --machine).
+{
+  const byId = new Map(results.map((r) => [r.id, r]));
+  const scopeOf = new Map(checks.map((c) => [c.id, c.scope]));
+  const bad = [];
+  for (const line of read('docs/WORK-REGISTER.md').split('\n')) {
+    const cells = line.split('|').map((x) => x.trim());
+    if (cells.length < 7 || !/^\d+$/.test(cells[1])) continue;
+    const [, num, family, , state, checkList] = cells;
+    if (!/^(LIVE|STAGED)$/.test(state)) continue;
+    const ids = checkList.split(/[ ,]+/).filter(Boolean);
+    if (!ids.length) bad.push(`#${num} ${family}: claims ${state} but names no check`);
+    for (const id of ids) {
+      if (!scopeOf.has(id)) { bad.push(`#${num}: unknown check ${id}`); continue; }
+      if (scopeOf.get(id) === 'machine' && !MACHINE) continue;
+      const r = byId.get(id);
+      if (!r?.ok) bad.push(`#${num} ${family}: claims ${state} but ${id} fails`);
+    }
+  }
+  results.push({ id: 'R1', area: 'register', scope: 'repo', title: 'The work register claims nothing its checks do not prove', ok: bad.length === 0, detail: bad.join('\n') || 'none' });
+}
+if (JSON_OUT) console.log(JSON.stringify(results.map(({ run, ...r }) => r), null, 1));
+else {
+  for (const r of results) {
+    console.log(`${r.ok ? 'PASS' : 'FAIL'}  ${r.id.padEnd(4)} [${r.area}] ${r.title}`);
+    if (!r.ok) for (const l of String(r.detail).split('\n')) console.log(`        ${l}`);
+  }
+  const failed = results.filter((r) => !r.ok).length;
+  console.log(`\n${results.length - failed}/${results.length} pass${MACHINE ? ' (repo + machine)' : ' (repo)'}`);
+}
+process.exitCode = results.every((r) => r.ok) ? 0 : 1;

package/scripts/staged-host-verifier.mjs

@@ -84,7 +84,7 @@ const preparePackage = async ({ packagePath, bundlePath }) => {
   }
 };
 
-export function stagedHostVerifier({ assets, identity, retrieval }, { runMatrix = runHostMatrixAsync } = {}) {
+export function stagedHostVerifier({ assets, identity, retrieval, sequentialSearches = false }, { runMatrix = runHostMatrixAsync } = {}) {
   return {
     async verify({ source, assets: observedAssets = assets }) {
       if (retrieval) verifyCandidateRetrievalAssets({ retrieval, assets: observedAssets });
@@ -104,6 +104,7 @@ export function stagedHostVerifier({ assets, identity, retrieval }, { runMatrix
           locate,
           temp: prepared.temp,
           retrieval,
+          sequentialSearches,
         });
         if (retrieval) verifyCandidateRetrievalAssets({ retrieval, assets: observedAssets });
         if (matrix.verdict !== 'PASS') {

package/scripts/subscription-hosts.mjs

@@ -14,10 +14,14 @@ export const API_BILLING_ENV = Object.freeze([
   'GEMINI_API_KEY',
   'XAI_API_KEY',
 ]);
+export const PRIVATE_SIGNING_ENV = Object.freeze([
+  'RUVNET_SIGNING_KEY', 'RUVNET_FABLE_REVIEW_SIGNING_KEY', 'RUVNET_ASTRA_REVIEW_SIGNING_KEY',
+]);
 
 export function subscriptionOnlyEnv(parent = process.env) {
   const child = { ...parent, RUVNET_SUBSCRIPTION_ONLY: '1' };
   for (const name of API_BILLING_ENV) delete child[name];
+  for (const name of PRIVATE_SIGNING_ENV) delete child[name];
   return child;
 }
 

package/scripts/sync-version.mjs

@@ -41,6 +41,14 @@ export function writeExplainerBadgeVersion(s, version) {
   return s.replace(/(·\s*v)\d+\.\d+\.\d+(?:-[\w.-]+)?/, `$1${version}`);
 }
 
+// The explainer once showed a second, competing version next to the product version
+// ("candidate preview" ... "public npm vX.Y.Z") — two versions on one public page, exactly the
+// defect single-source-check.mjs check B10 exists to catch (fixed 2026-09-26). This regression
+// guard keeps it from silently coming back.
+export function hasSplitVersionLabel(s) {
+  return /candidate preview|public npm v\d/i.test(s);
+}
+
 // Each target: a file, a regex to find the version-bearing line, and the corrected line.
 const targets = [
   { // Codex plugin manifest — same product, same release train as the Claude manifest
@@ -160,6 +168,20 @@ if (CHECK && fs.existsSync(path.join(ROOT, 'kb/RVF-GENERATIONS.json'))) {
   }
 }
 
+// Guard: the explainer must never again show a second, competing version next to the product
+// version (the "candidate preview" / "public npm vX.Y.Z" split fixed 2026-09-26 — see
+// hasSplitVersionLabel() above and single-source-check.mjs check B10). This is a content
+// regression, not a mechanical one, so --check only reports it; there is no auto-fix.
+{
+  const p = path.join(ROOT, 'explainer/index.html');
+  if (fs.existsSync(p) && hasSplitVersionLabel(fs.readFileSync(p, 'utf8'))) {
+    if (CHECK) {
+      console.error('[version] DRIFT: explainer/index.html shows a second/candidate version label ("candidate preview" / "public npm vX") — the page must show exactly one current version');
+      drift++;
+    }
+  }
+}
+
 // Guard: no stray hardcoded product-version literal anywhere in the source tree — every code path must
 // read getVersion() (or inherit a synced literal via the `targets` above / the README badge). Rather than
 // a fixed 3-file allowlist (which silently missed strays in every other file), walk the WHOLE tree and

package/scripts/trismart.mjs

@@ -3,6 +3,7 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { TRI_HOST_MODEL_IDS } from './review-model-defaults.mjs';
 
 const ROOT = path.dirname(fileURLToPath(import.meta.url));
 const DUAL = path.join(ROOT, 'dual-host-deliberation.mjs');
@@ -24,9 +25,8 @@ if (!task) { usage(); process.exit(2); }
 
 if (dryRun) {
   const providers = mode === 'dual' ? ['claude', 'codex'] : ['claude', 'codex', 'grok'];
-  console.log(JSON.stringify({ status: 'ready', mode, providers, models: {
-    claude: 'claude-fable-5-1', codex: 'gpt-6-astra', grok: 'grok-4.6',
-  }, billingPath: 'native subscription/OAuth CLI; API-key variables unset', taskHash: task.length }, null, 2));
+  console.log(JSON.stringify({ status: 'ready', mode, providers, models: TRI_HOST_MODEL_IDS,
+    billingPath: 'native subscription/OAuth CLI; API-key variables unset', taskHash: task.length }, null, 2));
   process.exit(0);
 }
 

package/scripts/wired-check.mjs

@@ -78,7 +78,6 @@ const STANDALONE = [
   ['dream-issue-gate', 'pure Dream Cycle disposition policy; invoked by the external issue adapter, never a GitHub writer'],
   ['sync-census', 'explicit maintainer census writer; a destructive source-to-surface refresh is never scheduled'],
   ['sync-commands', 'explicit maintainer alias synchronizer; run deliberately before release, never from a lifecycle hook'],
-  ['version-bump-gate', 'retired automatic interceptor; explicit version checks own release validation'],
   ['project-progression-checkpoint', 'the body of the shipped `/ruvnet-brain:checkpoint` command '
     + '(plugin/commands/checkpoint.md:39; added a7167b6b 2026-09-11). The command host executes that '
     + 'instruction, and this check does not scan command markdown — the same shape as '
@@ -89,6 +88,10 @@ const STANDALONE = [
     + '.claude/worktrees/ — their package.json copies had been counted as callers all day.'],
   ['lesson-seed', 'one-shot seeding, run deliberately by a human'],
   ['lesson-ratify', 'the human control surface — a CLI is its entire purpose'],
+  ['lesson-migrate-agentdb', 'one-time reconciliation between the two AgentDB lesson stores and the '
+    + 'one plugin lesson store, run deliberately by a human/model, never scheduled. Completion is '
+    + 'proven and kept honest by tests/unit/lesson-migrate-agentdb.test.mjs (0 pending rows), a drift '
+    + 'canary rather than automated invocation — the same shape as lesson-seed/lesson-ratify above.'],
   ['stamp-sweep', 'ADR-056 §2 — the ONE-TIME backfill half of the stamp rule. A human runs it once '
     + '(--apply) to reach the files nobody is editing; the ongoing half is the md-stamp PostToolUse '
     + 'hook, which IS wired. Deliberately not in a gate: it WRITES to documents, and a writer that '
@@ -109,9 +112,6 @@ const STANDALONE = [
   ['fix-metaharness-memretrieve', 'one-shot historical repair; kept for the record'],
   ['gen-console-images', 'build-time asset generation, run by hand'],
   ['adr-backfill', 'one-shot backfill by a human; its result is enforced by adr-format.test.mjs'],
-  ['stamp-existing-rvf-generations', 'one-shot maintainer migration that binds already-built canonical '
-    + 'RVFs to RVF-GENERATIONS.json and optionally prunes legacy sidecars; build-bundle.mjs consumes '
-    + 'and validates the resulting manifest, so scheduling this destructive migration would be wrong'],
   ['release', 'the ship path, run by a human'],
   ['execution-preflight', 'external orchestration boundary — invoked by the host before consequential Ruflo/Codex execution; no in-repo caller exists because the host supplies the live Brain and AgentDB receipts'],
   ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
@@ -230,6 +230,27 @@ const STANDALONE = [
     + 'ground-before-write. Per ADR-0014 ownership moved to the Kling skill (confirmed live: a copy '
     + 'ships at ~/.claude/skills/klingai/scripts/kling-preflight.sh); NOT currently wired into any '
     + 'settings.json there either — honestly dormant until a user opts in, not a silent gap'],
+
+  // H5 (2026-09-26 dead-code audit): decision-gate.mjs's REGISTRY['bash'] was the only production
+  // caller of these three — never registered in plugin/hooks/hooks.json or codex-hooks.json
+  // (continuity-hook-policy.mjs's own header: "remains reachable through hook-shim's dispatch table
+  // by explicit invocation" only). Removing that dead route makes each of these genuinely uncalled
+  // by any product path. Not deleted: each exports pure, independently-tested logic with its own
+  // passing suite — identifier-preflight.test.mjs / spend-guard.test.mjs import and exercise these
+  // functions directly, and tests/unit/lesson-gate.test.mjs imports degradation-watch.mjs's
+  // `dependentEvent` to cross-check lesson-hooks.sh's own pattern. A test importing an export is not
+  // a product caller (same distinction this file already draws for correction-detect-measure above),
+  // so these are honestly STANDALONE rather than silently left to read as still-wired.
+  ['identifier-preflight', 'H5: orphaned by decision-gate.mjs\'s dead bash route (REGISTRY[\'bash\'] '
+    + 'removed 2026-09-26). Pure `check`/`identifierIn` logic remains directly imported and exercised '
+    + 'by its own tests/unit/identifier-preflight.test.mjs; no product path calls it'],
+  ['spend-guard', 'H5: orphaned by decision-gate.mjs\'s dead bash route (REGISTRY[\'bash\'] removed '
+    + '2026-09-26). Its logic remains directly imported and exercised by its own '
+    + 'tests/unit/spend-guard.test.mjs; no product path calls it'],
+  ['degradation-watch', 'H5: orphaned by decision-gate.mjs\'s dead bash route (REGISTRY[\'bash\'] '
+    + 'removed 2026-09-26). Its `dependentEvent` export remains directly imported by '
+    + 'tests/unit/lesson-gate.test.mjs (cross-checked against lesson-hooks.sh\'s own pattern) and by '
+    + 'its own test file; no product path calls it'],
 ];
 // REMOVED 2026-07-22, each verified before removal:
 //   check-legibility / check-indexation / status-honesty — claimed "invoked from the workflow";
@@ -889,9 +910,24 @@ export function hookWiringAudit({
   const scriptsDir = path.join(repo, 'plugin/scripts');
   let all = [];
   try { all = fs.readdirSync(scriptsDir).filter((f) => /\.(mjs|sh)$/.test(f)); } catch { /* no dir */ }
+  // H6 (2026-09-26 dead-code audit): hook-shim.mjs is a DISPATCH TABLE, not a script that
+  // unconditionally executes everything it mentions. `scanConfig()` above already proves reachability
+  // for a TABLE entry CORRECTLY — only when its id is genuinely dispatched by a real command string in
+  // a manifest. Letting hook-shim.mjs ALSO participate as a "from" in the generic fixed-point pass
+  // below double-counts every OTHER entry in its TABLE as "spawned", because the pass's own predicate
+  // (callerPattern) matches any quoted filename — and every TABLE entry is, by construction, a quoted
+  // filename in hook-shim.mjs's source, dispatched or not. Measured: before this exclusion,
+  // design-wall.sh, route-dispatch.sh, verify-interface.sh, learn-capture.sh, learn-flush.mjs,
+  // md-stamp.mjs, signal-watch.mjs, routing-outcome-capture.mjs and swarm-slot-recycler.mjs all read
+  // "wired · via spawned by plugin/scripts/hook-shim.mjs" while zero manifest (hooks.json,
+  // codex-hooks.json, this repo's or the user's settings.json) ever dispatches most of their ids —
+  // exactly the false positive this check exists to catch. Excluding it here does not remove any
+  // GENUINE reachability: every id hook-shim.mjs's TABLE actually dispatches was already added by
+  // scanConfig() above, before this loop runs at all.
   for (let i = 0; i < 10; i++) {
     let changed = false;
     for (const from of [...reached.keys()]) {
+      if (from === 'hook-shim.mjs') continue;
       const src = sourceCache.commentFree(path.join(scriptsDir, from));
       if (src === null) continue;
       for (const cand of all) {