ruvnet-brain 4.3.28 → 4.3.30

package/scripts/single-source-check.mjs

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+// scripts/single-source-check.mjs — the single-source contract, as executable checks.
+//
+// Every entry is one defect found in the 2026-09-26 audit: two or more versions of the same rule,
+// process, code path or fact. Each check's exit is the verdict — nobody's word is. `repo` checks run
+// in CI (canonical-qa) so a contradiction that is removed can never silently come back; `machine`
+// checks describe this maintainer Mac and run with --machine.
+//
+//   node scripts/single-source-check.mjs            # repo checks (CI)
+//   node scripts/single-source-check.mjs --machine  # repo + machine checks
+//   node scripts/single-source-check.mjs --json
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readCheckpoint, checkpointStaleness } from './loop-checkpoint.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOME = os.homedir();
+const MACHINE = process.argv.includes('--machine');
+const JSON_OUT = process.argv.includes('--json');
+
+const git = (...a) => execFileSync('git', a, { cwd: ROOT, encoding: 'utf8', maxBuffer: 1 << 26 }).trim();
+const tracked = git('ls-files').split('\n').filter(Boolean);
+const read = (f) => { try { return readFileSync(path.join(ROOT, f), 'utf8'); } catch { return ''; } };
+const readAbs = (f) => { try { return readFileSync(f, 'utf8'); } catch { return ''; } };
+const json = (s) => { try { return JSON.parse(s); } catch { return {}; } };
+
+// Instruction surfaces: files that tell a person or an agent HOW to operate this project.
+// Decision records (ADR/DDD), research notes and append-only logs are history and are excluded.
+const HISTORY = /^(docs\/(adr|ddd|research|audits|reviews|qe)\/|CHANGELOG\.md$|PROGRESS\.md$|plugin\/docs\/RELEASE-NOTES|\.release-evidence\/|tests\/|evals\/)/;
+// kb/ is corpus content (primers/cards describing OTHER projects' own commands) and docs/issues/
+// are upstream bug reports quoting other configs — both are data, not instructions to this project.
+const instructions = tracked.filter((f) => /\.md$/.test(f) && !HISTORY.test(f) && !/^(kb|docs\/issues)\//.test(f));
+const grepIn = (files, re) => files.flatMap((f) => read(f).split('\n')
+  .map((l, i) => (re.test(l) ? `${f}:${i + 1}: ${l.trim().slice(0, 140)}` : null)).filter(Boolean));
+const none = (hits) => ({ ok: hits.length === 0, detail: hits.slice(0, 8).join('\n') || 'none' });
+
+const pkg = json(read('package.json'));
+const workflows = tracked.filter((f) => /^\.github\/workflows\/.+\.ya?ml$/.test(f));
+
+const checks = [
+  // A — one copy of the code
+  { id: 'A1', area: 'code', scope: 'repo', title: 'Every module is wired or has a stated reason (the repo\'s own wired-check audit)',
+    run: () => { const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/wired-check.mjs'), '--check'], { cwd: ROOT, encoding: 'utf8' });
+      return { ok: r.status === 0, detail: `${r.stdout}${r.stderr}`.split('\n').filter((l) => /UNWIRED|✗/.test(l)).slice(0, 6).join('\n') }; } },
+  { id: 'A2', area: 'code', scope: 'repo', title: 'No byte-identical duplicate files (outside test fixtures)',
+    run: () => {
+      const seen = new Map(); const dup = [];
+      for (const f of tracked) {
+        if (!/\.(mjs|js|cjs|sh|md|yml|json)$/.test(f) || /^tests\/|fixtures?\//.test(f)) continue;
+        if (f.endsWith('RELEASE-NOTES-4.0.md')) continue; // intentional pair, equality enforced by tests/integration/whats-new-installed.test.mjs
+        const t = read(f); if (t.length < 200) continue;
+        if (seen.has(t)) dup.push(`${f} == ${seen.get(t)}`); else seen.set(t, f);
+      }
+      return none(dup);
+    } },
+
+  // B — one version of the rules
+  { id: 'B1', area: 'rules', scope: 'repo', title: 'CONTRIBUTING.md is the only operating rulebook (no parallel process docs)',
+    run: () => none(['docs/QA-RELEASE-PROCESS.md', 'docs/NIGHTLY-REFRESH.md'].filter((f) => tracked.includes(f))) },
+  { id: 'B2', area: 'rules', scope: 'repo', title: 'No instruction tells anyone to publish locally',
+    run: () => none(grepIn(instructions.filter((f) => f !== 'CONTRIBUTING.md'), /release\.mjs --publish|\bnpm publish\b|gh release create/)
+      .filter((l) => !/\b(never|not|unusable|refus|intentionally|blocked|cannot|forbid|only through|provenance|ahead of the last)/i.test(l))) },
+  { id: 'B3', area: 'rules', scope: 'repo', title: 'No instruction uses npx for ruflo / claude-flow (one global ruflo)',
+    run: () => none(grepIn(instructions, /npx (-y )?(@claude-flow|claude-flow|ruflo)\b/)
+      .filter((l) => !/\bnever\b|console\/CONTRACT\.md:\d+: +"event"/i.test(l))) },
+  { id: 'B4', area: 'rules', scope: 'repo', title: 'No live file cites a workflow that does not exist',
+    run: () => {
+      const exists = new Set(workflows.map((w) => path.basename(w)));
+      const live = [...instructions, ...workflows, ...tracked.filter((f) => /^(scripts|plugin|bin|kb)\/.+\.(mjs|sh)$/.test(f))];
+      return none(live.flatMap((f) => [...read(f).matchAll(/\b([a-z0-9-]+\.ya?ml)\b/g)].map((m) => m[1])
+        .filter((n) => /release|corpus|publish|nightly|preflight|grading/.test(n) && !exists.has(n))
+        .map((n) => `${f}: ${n}`)));
+    } },
+  { id: 'B5', area: 'rules', scope: 'repo', title: 'Every `npm run X` in an instruction exists in package.json',
+    run: () => {
+      const scripts = new Set([...Object.keys(pkg.scripts || {}), ...Object.keys(json(read('kb/package.json')).scripts || {})]);
+      return none(instructions.flatMap((f) => [...read(f).matchAll(/npm run ([a-z0-9:_-]+)/g)]
+        .filter((m) => !scripts.has(m[1])).map((m) => `${f}: npm run ${m[1]}`)));
+    } },
+  { id: 'B6', area: 'rules', scope: 'repo', title: 'No instruction grants standing authority to publish without the owner',
+    run: () => none(grepIn(instructions, /standing authori[sz]ation permits|no separate human reviewer click/i)) },
+  { id: 'B7', area: 'rules', scope: 'repo', title: 'Model IDs are selected only in their owner modules',
+    run: () => {
+      const re = /['"`](claude-(fable|opus|sonnet|haiku)-[0-9][a-z0-9.-]*|gpt-[0-9][a-z0-9.-]*)['"`]/;
+      // Owners (the single definition sites) and non-selecting mentions, each with its reason.
+      const allowed = new Map([
+        ['scripts/review-model-defaults.mjs', 'owner: review / dual-host defaults'],
+        ['scripts/route-cheap.mjs', 'owner: Claude cost ladder'],
+        ['plugin/scripts/identifier-preflight.mjs', 'doc comment quoting a historical incident'],
+        ['scripts/goldie-research.mjs', 'family prefix match against the live catalog'],
+        ['scripts/routing-flywheel.mjs', 'comment example of id normalisation'],
+        ['scripts/proxy/proxy-verify.mjs', 'standalone ADR-0026 proxy trial tool (wired-check exempt)'],
+      ]);
+      const files = tracked.filter((f) => /^(scripts|plugin|bin|kb)\/.+\.mjs$/.test(f) && !allowed.has(f) && re.test(read(f)));
+      return none(files);
+    } },
+  { id: 'B8', area: 'rules', scope: 'repo', title: 'ADRs governing the live corpus publisher are not left "Proposed"',
+    run: () => none(tracked.filter((f) => /^docs\/adr\/008[56]-/.test(f)).filter((f) => /^status:\s*Proposed/im.test(read(f)))) },
+  { id: 'B9', area: 'rules', scope: 'repo', title: 'All version surfaces carry one version',
+    run: () => {
+      const v = [['package.json', pkg.version], ['kb/package.json', json(read('kb/package.json')).version],
+        ['plugin/.claude-plugin/plugin.json', json(read('plugin/.claude-plugin/plugin.json')).version],
+        ['plugin/.codex-plugin/plugin.json', json(read('plugin/.codex-plugin/plugin.json')).version]].filter(([, x]) => x);
+      return { ok: new Set(v.map(([, x]) => x)).size === 1, detail: v.map(([f, x]) => `${f}=${x}`).join(' ') };
+    } },
+  { id: 'B10', area: 'rules', scope: 'repo', title: 'Public pages show exactly one current version (no candidate/public split)',
+    run: () => none(grepIn(['README.md', 'explainer/index.html'], /candidate preview|public npm v\d/i)) },
+  { id: 'B11', area: 'rules', scope: 'repo', title: 'The ADR index lists every ADR, with the status the ADR itself declares',
+    run: () => {
+      const idx = read('docs/adr/README.md');
+      const adrs = tracked.filter((f) => /^docs\/adr\/\d{4}-.+\.md$/.test(f));
+      const missing = adrs.filter((f) => !idx.includes(path.basename(f))).map((f) => `not indexed: ${f}`);
+      const drift = adrs.flatMap((f) => {
+        const own = (read(f).match(/^status:\s*([A-Za-z]+)/m) || [])[1];
+        const statusTable = idx.slice(Math.max(0, idx.indexOf('| ADR | Title | Status |')));
+        const row = statusTable.split('\n').find((l) => l.includes(`(${path.basename(f)})`));
+        const listed = row && (row.match(/\|\s*([A-Za-z]+)[^|]*\|\s*$/) || [])[1];
+        return own && listed && own.toLowerCase() !== listed.toLowerCase() ? [`${path.basename(f)}: ADR says ${own}, index says ${listed}`] : [];
+      });
+      return none([...missing, ...drift]);
+    } },
+
+  { id: 'B12', area: 'rules', scope: 'machine', title: 'The local (untracked) CLAUDE.md / AGENTS.md carry no contradicting instruction',
+    run: () => {
+      const main = path.join(HOME, 'Code/ruvnet-brain');
+      const bad = /npx (-y )?(@claude-flow|claude-flow|ruflo)\b|standing authori[sz]ation permits|no separate human reviewer click|npm run (build|dev|test:integration|test:coverage|test:security)\b|not direct Agent tool/i;
+      return none(['CLAUDE.md', 'AGENTS.md'].flatMap((f) => readAbs(path.join(main, f)).split('\n')
+        .map((l, i) => (bad.test(l) ? `${f}:${i + 1}: ${l.trim().slice(0, 120)}` : null)).filter(Boolean)));
+    } },
+
+  // C — one release path
+  { id: 'C1', area: 'release', scope: 'repo', title: 'Unattended corpus promotion stays disarmed until a code release is install-verified',
+    run: () => ({ ok: !tracked.includes('data/approved-runtime.json'), detail: tracked.includes('data/approved-runtime.json') ? 'data/approved-runtime.json present (arms the 07:17 UTC nightly)' : 'absent' }) },
+  { id: 'C2', area: 'release', scope: 'repo', title: 'Every scheduled workflow pages the phone on failure',
+    run: () => {
+      const alerts = read('.github/workflows/ntfy-alerts.yml');
+      return none(workflows.filter((w) => /^\s*schedule:/m.test(read(w)) && !w.endsWith('ntfy-alerts.yml'))
+        .map((w) => ((read(w).match(/^name:\s*(.+)$/m) || [])[1] || w).trim().replace(/['"]/g, ''))
+        .filter((n) => !alerts.includes(n)));
+    } },
+  { id: 'C4', area: 'release', scope: 'machine', title: 'The corpus gist job has its authenticated token (RUVNET_GISTS_TOKEN)',
+    run: () => { const r = spawnSync('gh', ['secret', 'list', '-R', 'stuinfla/ruvnet-brain'], { encoding: 'utf8' }); return { ok: /^RUVNET_GISTS_TOKEN\b/m.test(r.stdout), detail: r.stdout.split('\n').map((l) => l.split(/\s/)[0]).filter(Boolean).join(', ') }; } },
+  { id: 'C3', area: 'release', scope: 'machine', title: 'Publishing requires the owner: Production environment has a required reviewer',
+    run: () => {
+      const r = spawnSync('gh', ['api', 'repos/stuinfla/ruvnet-brain/environments', '-q',
+        '.environments[]|select(.name=="Production – ruvnet-brain")|[.protection_rules[]?|select(.type=="required_reviewers")]|length'], { encoding: 'utf8' });
+      return { ok: r.status === 0 && Number(r.stdout.trim()) > 0, detail: `required_reviewers rules: ${r.stdout.trim() || r.stderr.trim()}` };
+    } },
+
+  // D — one corpus / update path
+  { id: 'D1', area: 'corpus', scope: 'repo', title: 'The end-user updater label is defined once; the one necessary copy (standalone runner) matches it',
+    run: () => {
+      const owner = (read('plugin/scripts/nightly-scheduler.mjs').match(/NIGHTLY_LABEL\s*=\s*'([^']+)'/) || [])[1];
+      const copies = tracked.filter((f) => /\.(mjs|sh)$/.test(f) && !/^tests\//.test(f) && f !== 'plugin/scripts/nightly-scheduler.mjs')
+        .filter((f) => /\^com\\\.ruvnet\\\.brain-update|'com\.ruvnet\.brain-update'/.test(read(f)));
+      // bin/nightly-refresh.mjs is copied to a standalone content-addressed path and executed outside the package, so it cannot import.
+      const extra = copies.filter((f) => f !== 'bin/nightly-refresh.mjs');
+      // The runner MUST carry the owner's exact label (it validates its own registration against it);
+      // testing only files that already contain the label would miss exactly the drifted case.
+      const runner = read('bin/nightly-refresh.mjs');
+      const esc = owner.replace(/\./g, '\\.');
+      const drift = !owner ? ['owner label not found in plugin/scripts/nightly-scheduler.mjs']
+        : (!runner.includes(`'${owner}'`) || !runner.includes(`/^${esc}\\.proof-`)) ? [`bin/nightly-refresh.mjs does not carry owner label ${owner}`] : [];
+      return none([...extra, ...drift]);
+    } },
+
+  { id: 'D2', area: 'corpus', scope: 'machine', title: 'Installed knowledge matches the installed plugin version',
+    run: () => {
+      const tag = String(json(readAbs(path.join(HOME, '.cache/ruvnet-brain/kb/SOURCE.json'))).releaseTag || '').replace(/^v/, '');
+      const active = json(readAbs(path.join(HOME, '.cache/ruvnet-brain/active.json'))).version;
+      return { ok: !!tag && tag === active, detail: `knowledge ${tag || 'unknown'} vs plugin ${active || 'unknown'}` };
+    } },
+  { id: 'D3', area: 'corpus', scope: 'machine', title: 'Exactly one update owner exists, and its last refresh run passed within 26h',
+    run: () => {
+      const brainJob = spawnSync('launchctl', ['print', `gui/${process.getuid()}/com.ruvnet.brain-update`], { encoding: 'utf8' }).status === 0;
+      const akJob = spawnSync('launchctl', ['print', `gui/${process.getuid()}/com.stuartkerr.ak-sync`], { encoding: 'utf8' }).status === 0;
+      const dir = path.join(HOME, '.cache/ruvnet-brain/refresh-runs');
+      const runs = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith('.json')).sort() : [];
+      const last = runs.length ? json(readAbs(path.join(dir, runs.at(-1)))) : {};
+      const fresh = last.startedAt && (Date.now() - Date.parse(last.startedAt)) < 26 * 3600e3;
+      const owners = [brainJob && 'brain-update', akJob && 'ak-sync'].filter(Boolean);
+      return { ok: owners.length === 1 && fresh && last.terminalVerdict !== 'failed', detail: `owners=[${owners.join(',') || 'none'}] last run ${last.startedAt || 'none'} verdict ${last.terminalVerdict || last.status || 'none'}` };
+    } },
+
+  // E — one hook / context plane
+  { id: 'E1', area: 'hooks', scope: 'machine', title: 'No stale autonomous-loop checkpoint is injected into sessions',
+    // H3: judged by the checkpoint's OWN `updatedAt` claim (loop-checkpoint.mjs's checkpointStaleness
+    // — the SAME rule ground-ruvnet.sh's `stale` verb uses), never by file mtime. A copy/rsync/restore
+    // resets mtime without the checkpoint's content changing, which is exactly the kind of second,
+    // drifting definition of "stale" this audit exists to catch — including, previously, in itself.
+    run: () => {
+      const f = path.join(ROOT, '.ruvnet-brain/checkpoint.json');
+      const main = path.join(HOME, 'Code/ruvnet-brain/.ruvnet-brain/checkpoint.json');
+      const stale = [f, main].filter((p) => existsSync(p) && checkpointStaleness(readCheckpoint(p)).stale);
+      return none(stale);
+    } },
+  { id: 'E2', area: 'hooks', scope: 'machine', title: 'Only one hook writes session snapshots (no global + plugin double writer)',
+    run: () => { const s = readAbs(path.join(HOME, '.claude/settings.json')); return { ok: !/agentdb-autocapture/.test(s), detail: /agentdb-autocapture/.test(s) ? 'global agentdb-autocapture still registered alongside the plugin session-snapshot' : 'single writer' }; } },
+
+  { id: 'E3', area: 'hooks', scope: 'machine', title: 'Lessons live in one store (no .swarm lesson-* rows outside the plugin lesson store)',
+    run: () => { const r = spawnSync('ruflo', ['memory', 'list', '--path', path.join(HOME, 'Code/ruvnet-brain/.swarm/memory.db'), '--limit', '500'], { encoding: 'utf8', timeout: 60000 });
+      const n = (r.stdout.match(/lesson-/g) || []).length; return { ok: n === 0, detail: `${n} lesson-* rows in project .swarm (plugin store: ~/.config/ruvnet-brain/lessons.json)` }; } },
+  { id: 'E4', area: 'hooks', scope: 'machine', title: 'One session-start continuity restorer (global hook stands down when the plugin is enabled)',
+    run: () => { const s = readAbs(path.join(HOME, '.claude/hooks/agentdb-ensure.sh')); return { ok: s.includes('SINGLE CONTINUITY OWNER'), detail: 'agentdb-ensure.sh must stand down its project-state recall' }; } },
+
+  // F — this Mac
+  { id: 'F1', area: 'machine', scope: 'machine', title: 'No plaintext API keys in ~/.claude/settings.json',
+    run: () => none(readAbs(path.join(HOME, '.claude/settings.json')).split('\n')
+      .filter((l) => /(api-key-|sk-[A-Za-z0-9]{20,}|_TOKEN"\s*:\s*"[^"$]{16,})/.test(l)).map((l) => l.replace(/:\s*".*"/, ': "<redacted>"').trim())) },
+  { id: 'F2', area: 'machine', scope: 'machine', title: 'Every required scheduled job proves it ran (repo watchdog)',
+    run: () => { const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/nightly-watchdog.mjs')], { cwd: ROOT, encoding: 'utf8', timeout: 60000 }); return { ok: r.status === 0, detail: `${r.stdout}${r.stderr}`.trim().split('\n').slice(-6).join('\n') }; } },
+  { id: 'F3', area: 'machine', scope: 'machine', title: 'Scheduled jobs use the one Node the shell uses (no /usr/local/bin/node v22)',
+    run: () => {
+      const dir = path.join(HOME, 'Library/LaunchAgents');
+      const plists = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith('.plist')) : [];
+      return none(plists.filter((f) => readAbs(path.join(dir, f)).includes('/usr/local/bin/node')));
+    } },
+  { id: 'F4', area: 'machine', scope: 'machine', title: 'Permission allow-list names the real Ruflo MCP server',
+    run: () => { const s = readAbs(path.join(HOME, '.claude/settings.json')); return { ok: !s.includes('"mcp__ruflo__*"') || s.includes('"mcp__claude-flow__*"'), detail: 'allow list names mcp__ruflo__* but the server is claude-flow' }; } },
+
+  // G — one release state
+  { id: 'G1', area: 'state', scope: 'machine', title: 'Local main is exactly origin/main',
+    run: () => { const m = git('rev-parse', 'main'); const o = git('rev-parse', 'origin/main'); return { ok: m === o, detail: `main ${m.slice(0, 8)} origin ${o.slice(0, 8)}` }; } },
+  { id: 'G2', area: 'state', scope: 'machine', title: 'npm latest, GitHub latest release and main carry the same version',
+    run: () => {
+      const npm = spawnSync('npm', ['view', 'ruvnet-brain', 'dist-tags.latest'], { encoding: 'utf8' }).stdout.trim();
+      const gh = spawnSync('gh', ['api', 'repos/stuinfla/ruvnet-brain/releases/latest', '-q', '.tag_name'], { encoding: 'utf8' }).stdout.trim().replace(/^v/, '');
+      const main = json(git('show', 'origin/main:package.json')).version;
+      return { ok: npm === gh && gh === main, detail: `npm ${npm} · github ${gh} · main ${main}` };
+    } },
+];
+
+const selected = checks.filter((c) => c.scope === 'repo' || MACHINE);
+const results = selected.map((c) => { let r; try { r = c.run(); } catch (e) { r = { ok: false, detail: `check crashed: ${e.message}` }; } return { ...c, ...r }; });
+
+// R1 — the register may not claim more than the evidence shows. A row in docs/WORK-REGISTER.md whose
+// State is LIVE or STAGED must have every check it names passing (machine checks only in --machine).
+{
+  const byId = new Map(results.map((r) => [r.id, r]));
+  const scopeOf = new Map(checks.map((c) => [c.id, c.scope]));
+  const bad = [];
+  for (const line of read('docs/WORK-REGISTER.md').split('\n')) {
+    const cells = line.split('|').map((x) => x.trim());
+    if (cells.length < 7 || !/^\d+$/.test(cells[1])) continue;
+    const [, num, family, , state, checkList] = cells;
+    if (!/^(LIVE|STAGED)$/.test(state)) continue;
+    const ids = checkList.split(/[ ,]+/).filter(Boolean);
+    if (!ids.length) bad.push(`#${num} ${family}: claims ${state} but names no check`);
+    for (const id of ids) {
+      if (!scopeOf.has(id)) { bad.push(`#${num}: unknown check ${id}`); continue; }
+      if (scopeOf.get(id) === 'machine' && !MACHINE) continue;
+      const r = byId.get(id);
+      if (!r?.ok) bad.push(`#${num} ${family}: claims ${state} but ${id} fails`);
+    }
+  }
+  results.push({ id: 'R1', area: 'register', scope: 'repo', title: 'The work register claims nothing its checks do not prove', ok: bad.length === 0, detail: bad.join('\n') || 'none' });
+}
+if (JSON_OUT) console.log(JSON.stringify(results.map(({ run, ...r }) => r), null, 1));
+else {
+  for (const r of results) {
+    console.log(`${r.ok ? 'PASS' : 'FAIL'}  ${r.id.padEnd(4)} [${r.area}] ${r.title}`);
+    if (!r.ok) for (const l of String(r.detail).split('\n')) console.log(`        ${l}`);
+  }
+  const failed = results.filter((r) => !r.ok).length;
+  console.log(`\n${results.length - failed}/${results.length} pass${MACHINE ? ' (repo + machine)' : ' (repo)'}`);
+}
+process.exitCode = results.every((r) => r.ok) ? 0 : 1;

package/scripts/subscription-hosts.mjs

@@ -14,10 +14,14 @@ export const API_BILLING_ENV = Object.freeze([
   'GEMINI_API_KEY',
   'XAI_API_KEY',
 ]);
+export const PRIVATE_SIGNING_ENV = Object.freeze([
+  'RUVNET_SIGNING_KEY', 'RUVNET_FABLE_REVIEW_SIGNING_KEY', 'RUVNET_ASTRA_REVIEW_SIGNING_KEY',
+]);
 
 export function subscriptionOnlyEnv(parent = process.env) {
   const child = { ...parent, RUVNET_SUBSCRIPTION_ONLY: '1' };
   for (const name of API_BILLING_ENV) delete child[name];
+  for (const name of PRIVATE_SIGNING_ENV) delete child[name];
   return child;
 }
 

package/scripts/sync-version.mjs

@@ -41,6 +41,14 @@ export function writeExplainerBadgeVersion(s, version) {
   return s.replace(/(·\s*v)\d+\.\d+\.\d+(?:-[\w.-]+)?/, `$1${version}`);
 }
 
+// The explainer once showed a second, competing version next to the product version
+// ("candidate preview" ... "public npm vX.Y.Z") — two versions on one public page, exactly the
+// defect single-source-check.mjs check B10 exists to catch (fixed 2026-09-26). This regression
+// guard keeps it from silently coming back.
+export function hasSplitVersionLabel(s) {
+  return /candidate preview|public npm v\d/i.test(s);
+}
+
 // Each target: a file, a regex to find the version-bearing line, and the corrected line.
 const targets = [
   { // Codex plugin manifest — same product, same release train as the Claude manifest
@@ -160,6 +168,20 @@ if (CHECK && fs.existsSync(path.join(ROOT, 'kb/RVF-GENERATIONS.json'))) {
   }
 }
 
+// Guard: the explainer must never again show a second, competing version next to the product
+// version (the "candidate preview" / "public npm vX.Y.Z" split fixed 2026-09-26 — see
+// hasSplitVersionLabel() above and single-source-check.mjs check B10). This is a content
+// regression, not a mechanical one, so --check only reports it; there is no auto-fix.
+{
+  const p = path.join(ROOT, 'explainer/index.html');
+  if (fs.existsSync(p) && hasSplitVersionLabel(fs.readFileSync(p, 'utf8'))) {
+    if (CHECK) {
+      console.error('[version] DRIFT: explainer/index.html shows a second/candidate version label ("candidate preview" / "public npm vX") — the page must show exactly one current version');
+      drift++;
+    }
+  }
+}
+
 // Guard: no stray hardcoded product-version literal anywhere in the source tree — every code path must
 // read getVersion() (or inherit a synced literal via the `targets` above / the README badge). Rather than
 // a fixed 3-file allowlist (which silently missed strays in every other file), walk the WHOLE tree and

package/scripts/trismart.mjs

@@ -3,6 +3,7 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { TRI_HOST_MODEL_IDS } from './review-model-defaults.mjs';
 
 const ROOT = path.dirname(fileURLToPath(import.meta.url));
 const DUAL = path.join(ROOT, 'dual-host-deliberation.mjs');
@@ -24,9 +25,8 @@ if (!task) { usage(); process.exit(2); }
 
 if (dryRun) {
   const providers = mode === 'dual' ? ['claude', 'codex'] : ['claude', 'codex', 'grok'];
-  console.log(JSON.stringify({ status: 'ready', mode, providers, models: {
-    claude: 'claude-fable-5-1', codex: 'gpt-6-astra', grok: 'grok-4.6',
-  }, billingPath: 'native subscription/OAuth CLI; API-key variables unset', taskHash: task.length }, null, 2));
+  console.log(JSON.stringify({ status: 'ready', mode, providers, models: TRI_HOST_MODEL_IDS,
+    billingPath: 'native subscription/OAuth CLI; API-key variables unset', taskHash: task.length }, null, 2));
   process.exit(0);
 }
 

package/scripts/wired-check.mjs

@@ -78,7 +78,6 @@ const STANDALONE = [
   ['dream-issue-gate', 'pure Dream Cycle disposition policy; invoked by the external issue adapter, never a GitHub writer'],
   ['sync-census', 'explicit maintainer census writer; a destructive source-to-surface refresh is never scheduled'],
   ['sync-commands', 'explicit maintainer alias synchronizer; run deliberately before release, never from a lifecycle hook'],
-  ['version-bump-gate', 'retired automatic interceptor; explicit version checks own release validation'],
   ['project-progression-checkpoint', 'the body of the shipped `/ruvnet-brain:checkpoint` command '
     + '(plugin/commands/checkpoint.md:39; added a7167b6b 2026-09-11). The command host executes that '
     + 'instruction, and this check does not scan command markdown — the same shape as '
@@ -89,6 +88,10 @@ const STANDALONE = [
     + '.claude/worktrees/ — their package.json copies had been counted as callers all day.'],
   ['lesson-seed', 'one-shot seeding, run deliberately by a human'],
   ['lesson-ratify', 'the human control surface — a CLI is its entire purpose'],
+  ['lesson-migrate-agentdb', 'one-time reconciliation between the two AgentDB lesson stores and the '
+    + 'one plugin lesson store, run deliberately by a human/model, never scheduled. Completion is '
+    + 'proven and kept honest by tests/unit/lesson-migrate-agentdb.test.mjs (0 pending rows), a drift '
+    + 'canary rather than automated invocation — the same shape as lesson-seed/lesson-ratify above.'],
   ['stamp-sweep', 'ADR-056 §2 — the ONE-TIME backfill half of the stamp rule. A human runs it once '
     + '(--apply) to reach the files nobody is editing; the ongoing half is the md-stamp PostToolUse '
     + 'hook, which IS wired. Deliberately not in a gate: it WRITES to documents, and a writer that '
@@ -109,9 +112,6 @@ const STANDALONE = [
   ['fix-metaharness-memretrieve', 'one-shot historical repair; kept for the record'],
   ['gen-console-images', 'build-time asset generation, run by hand'],
   ['adr-backfill', 'one-shot backfill by a human; its result is enforced by adr-format.test.mjs'],
-  ['stamp-existing-rvf-generations', 'one-shot maintainer migration that binds already-built canonical '
-    + 'RVFs to RVF-GENERATIONS.json and optionally prunes legacy sidecars; build-bundle.mjs consumes '
-    + 'and validates the resulting manifest, so scheduling this destructive migration would be wrong'],
   ['release', 'the ship path, run by a human'],
   ['execution-preflight', 'external orchestration boundary — invoked by the host before consequential Ruflo/Codex execution; no in-repo caller exists because the host supplies the live Brain and AgentDB receipts'],
   ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
@@ -230,6 +230,27 @@ const STANDALONE = [
     + 'ground-before-write. Per ADR-0014 ownership moved to the Kling skill (confirmed live: a copy '
     + 'ships at ~/.claude/skills/klingai/scripts/kling-preflight.sh); NOT currently wired into any '
     + 'settings.json there either — honestly dormant until a user opts in, not a silent gap'],
+
+  // H5 (2026-09-26 dead-code audit): decision-gate.mjs's REGISTRY['bash'] was the only production
+  // caller of these three — never registered in plugin/hooks/hooks.json or codex-hooks.json
+  // (continuity-hook-policy.mjs's own header: "remains reachable through hook-shim's dispatch table
+  // by explicit invocation" only). Removing that dead route makes each of these genuinely uncalled
+  // by any product path. Not deleted: each exports pure, independently-tested logic with its own
+  // passing suite — identifier-preflight.test.mjs / spend-guard.test.mjs import and exercise these
+  // functions directly, and tests/unit/lesson-gate.test.mjs imports degradation-watch.mjs's
+  // `dependentEvent` to cross-check lesson-hooks.sh's own pattern. A test importing an export is not
+  // a product caller (same distinction this file already draws for correction-detect-measure above),
+  // so these are honestly STANDALONE rather than silently left to read as still-wired.
+  ['identifier-preflight', 'H5: orphaned by decision-gate.mjs\'s dead bash route (REGISTRY[\'bash\'] '
+    + 'removed 2026-09-26). Pure `check`/`identifierIn` logic remains directly imported and exercised '
+    + 'by its own tests/unit/identifier-preflight.test.mjs; no product path calls it'],
+  ['spend-guard', 'H5: orphaned by decision-gate.mjs\'s dead bash route (REGISTRY[\'bash\'] removed '
+    + '2026-09-26). Its logic remains directly imported and exercised by its own '
+    + 'tests/unit/spend-guard.test.mjs; no product path calls it'],
+  ['degradation-watch', 'H5: orphaned by decision-gate.mjs\'s dead bash route (REGISTRY[\'bash\'] '
+    + 'removed 2026-09-26). Its `dependentEvent` export remains directly imported by '
+    + 'tests/unit/lesson-gate.test.mjs (cross-checked against lesson-hooks.sh\'s own pattern) and by '
+    + 'its own test file; no product path calls it'],
 ];
 // REMOVED 2026-07-22, each verified before removal:
 //   check-legibility / check-indexation / status-honesty — claimed "invoked from the workflow";
@@ -889,9 +910,24 @@ export function hookWiringAudit({
   const scriptsDir = path.join(repo, 'plugin/scripts');
   let all = [];
   try { all = fs.readdirSync(scriptsDir).filter((f) => /\.(mjs|sh)$/.test(f)); } catch { /* no dir */ }
+  // H6 (2026-09-26 dead-code audit): hook-shim.mjs is a DISPATCH TABLE, not a script that
+  // unconditionally executes everything it mentions. `scanConfig()` above already proves reachability
+  // for a TABLE entry CORRECTLY — only when its id is genuinely dispatched by a real command string in
+  // a manifest. Letting hook-shim.mjs ALSO participate as a "from" in the generic fixed-point pass
+  // below double-counts every OTHER entry in its TABLE as "spawned", because the pass's own predicate
+  // (callerPattern) matches any quoted filename — and every TABLE entry is, by construction, a quoted
+  // filename in hook-shim.mjs's source, dispatched or not. Measured: before this exclusion,
+  // design-wall.sh, route-dispatch.sh, verify-interface.sh, learn-capture.sh, learn-flush.mjs,
+  // md-stamp.mjs, signal-watch.mjs, routing-outcome-capture.mjs and swarm-slot-recycler.mjs all read
+  // "wired · via spawned by plugin/scripts/hook-shim.mjs" while zero manifest (hooks.json,
+  // codex-hooks.json, this repo's or the user's settings.json) ever dispatches most of their ids —
+  // exactly the false positive this check exists to catch. Excluding it here does not remove any
+  // GENUINE reachability: every id hook-shim.mjs's TABLE actually dispatches was already added by
+  // scanConfig() above, before this loop runs at all.
   for (let i = 0; i < 10; i++) {
     let changed = false;
     for (const from of [...reached.keys()]) {
+      if (from === 'hook-shim.mjs') continue;
       const src = sourceCache.commentFree(path.join(scriptsDir, from));
       if (src === null) continue;
       for (const cand of all) {

package/plugin/scripts/version-bump-gate.sh

@@ -1,124 +0,0 @@
-#!/bin/bash
-# version-bump-gate.sh — PreToolUse gate on Bash. EVERY PUSH CARRIES A VERSION INCREMENT.
-#
-# ─────────────────────────────────────────────────────────────────────────────────────────────
-# WHY (2026-07-13). Stuart, after a push with no bump served him stale code: "Every single
-# commit to GitHub should come with a version increment: major.minor.bugfix. It's the only way
-# we're gonna know beyond a shadow of a doubt what's going on. When other things are looking to
-# read a change in version to know that there's something they need to be aware of, that's not
-# negotiable."
-#
-# THE INCIDENT: gates/fleet-doctor//savings were pushed under an unchanged 2.5.2. The plugin
-# cache compared 2.5.2 == 2.5.2, correctly served the STALE copy, and a restarted session
-# loaded without /savings. THE VERSION NUMBER IS THE UPDATE SIGNAL — a push without a bump is
-# an update nothing can see.
-#
-# Prior art is rUv's own: agent-harness-generator preflight.mjs refuses to greenlight a release
-# when package versions drift, and version-bump.mjs bumps every manifest in lockstep — the gate
-# is the product. This is that discipline applied at the push boundary.
-#
-# CONTRACT: exit 0 = allow · exit 2 + stderr = BLOCK. FAILS OPEN on anything unparseable.
-# Opt-in (router profile.json); local Git checks and a Node maintenance-state check.
-# ─────────────────────────────────────────────────────────────────────────────────────────────
-
-set -uo pipefail
-
-# Reversible, repository-scoped development maintenance; no profile, ledger, or Git work first.
-MAINTENANCE_HELPER="${BASH_SOURCE[0]%/*}/development-maintenance.mjs"
-if [ -f "$MAINTENANCE_HELPER" ] && node --input-type=module -e '
-  import { pathToFileURL } from "node:url";
-  const { developmentHooksSuspended } = await import(pathToFileURL(process.argv[1]));
-  process.exit(developmentHooksSuspended() ? 0 : 1);
-' "$MAINTENANCE_HELPER" >/dev/null 2>&1; then
-  exit 0
-fi
-
-INPUT=""
-# BOUNDED READ (2026-07-27, ADR-055 F20): an unqualified `read` never returns on a stdin that is
-# opened and never closed — measured across the mesh, 18 of 37 registered commands sat until the
-# harness killed them. Real Claude Code writes and closes, so this costs no normal turn; that is
-# exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
-# is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
-# the whole thing back at once and a per-iteration cap never fires.
-while IFS= read -r -t 2 _l; do
-  INPUT+="$_l"
-  [ ${#INPUT} -ge 65536 ] && break
-done
-[ -n "$_l" ] && INPUT+="$_l"
-INPUT="${INPUT:0:65536}"
-[ -n "$INPUT" ] || exit 0
-
-PROFILE="${MODEL_ROUTER_PROFILE:-$HOME/.claude/model-router/profile.json}"
-[ -f "$PROFILE" ] || exit 0
-[ "${RUVNET_SKIP_VERSION_GATE:-0}" = "1" ] && exit 0
-
-# Consume JSON escape pairs so quoted commit messages do not truncate the command before a
-# following git push. This retains the existing bounded Bash parser's matching behavior.
-field() { local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"\\\\]*(\\\\.[^\"\\\\]*)*)\""; [[ $INPUT =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"; }
-[ "$(field tool_name)" = "Bash" ] || exit 0
-CMD=$(field command)
-[[ $CMD == *"git push"* ]] || exit 0
-
-ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
-
-# The version source of truth, in precedence order. A repo with neither is not version-managed
-# by this convention — pass untouched.
-SRC=""
-for c in plugin/.claude-plugin/plugin.json package.json; do
-  [ -f "$ROOT/$c" ] && { SRC="$c"; break; }
-done
-[ -n "$SRC" ] || exit 0
-
-UP=$(git -C "$ROOT" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null) || UP=origin/main
-git -C "$ROOT" rev-parse --verify "$UP" >/dev/null 2>&1 || exit 0
-
-AHEAD=$(git -C "$ROOT" rev-list --count "$UP..HEAD" 2>/dev/null) || exit 0
-[ "$AHEAD" -gt 0 ] || exit 0   # nothing outgoing → nothing to gate
-
-ver_at() { # ver_at <rev> — version string in $SRC at that rev, empty on any failure
-  local j re='"version"[[:space:]]*:[[:space:]]*"([^"]*)"'
-  j=$(git -C "$ROOT" show "$1:$SRC" 2>/dev/null) || return 0
-  [[ $j =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"
-}
-V_HEAD=$(ver_at HEAD); V_UP=$(ver_at "$UP")
-[ -n "$V_HEAD" ] && [ -n "$V_UP" ] || exit 0   # can't read either side → fail open
-[ "$V_HEAD" != "$V_UP" ] && exit 0             # bumped → pass
-
-# ── LESSON STORE CONSULTATION (ADR-030 L3, wired 2026-07-22) ────────────────────────────────────
-# This gate hardcoded its own message for months while lesson L05 — the identical rule, recorded 52
-# times across 4 projects — sat in a store that nothing read. A grep for `lessonsFor` across every
-# gate returned zero: lessons were mined, weighted, trust-boundaried, and consumed by nobody.
-#
-# Now the store speaks here. Today every lesson is an unratified candidate, so this ADDS the lesson's
-# own words and evidence to the refusal below rather than changing whether it fires. The day the
-# owner ratifies L05, the same wire starts refusing on the lesson's authority instead of on this
-# script's hardcoded copy — with no change to this file. Enforcement is data, not a rewrite.
-#
-# Fails open by construction: any error, missing store, or absent node exits this block silently. A
-# gate that blocks a push because it could not read a config file is a gate people switch off.
-LESSON_GATE="$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd)/scripts/lesson-gate.mjs"
-if [ -f "$LESSON_GATE" ] && command -v node >/dev/null 2>&1; then
-  LESSON_OUT="$(node "$LESSON_GATE" --trigger ship 2>/dev/null || true)"
-fi
-
-read -r -d '' MSG <<EOF || true
-⛔ BLOCKED — this push carries $AHEAD commit(s) but NO version increment ($SRC still $V_UP).
-
-THE VERSION NUMBER IS THE UPDATE SIGNAL. Plugin caches, update checks, and other sessions decide
-whether to pull fresh code by comparing versions — a push without a bump is an update nothing can
-see. This exact miss served a restarted session stale 2.5.2 without /savings on 2026-07-13.
-
-Before pushing:
-    1. bump "version" in $SRC (major.minor.bugfix)
-    2. node scripts/sync-version.mjs      # syncs every surface, --check must pass
-    3. include the bump in the outgoing commits, then push
-
-(Stuart, 2026-07-13: "that's not negotiable." Deliberate override, say why out loud:
-RUVNET_SKIP_VERSION_GATE=1)
-${LESSON_OUT:+
-── from your own lesson store ─────────────────────────────────────────────
-$LESSON_OUT}
-EOF
-bash "$(dirname "${BASH_SOURCE[0]}")/gate-receipt.sh" version-bump-gate "push" "commits carried no version bump — an update nothing can see" 2>/dev/null || true
-printf '%s\n' "$MSG" >&2
-exit 2

package/scripts/qe/aggregate-4.3.mjs

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-
-const ROOT = path.resolve(import.meta.dirname, '../..');
-const dir = path.resolve(ROOT, process.env.QE_RECEIPT_DIR || '.qe/receipts');
-const required = ['preflight', 'check', 'integration', 'release', 'resources', 'windows-unit'];
-const failures = [];
-const receipts = required.map((lane) => {
-  const file = path.join(dir, `${lane}.json`);
-  if (!fs.existsSync(file)) { failures.push(`${lane}: receipt missing`); return null; }
-  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) {
-    failures.push(`${lane}: invalid receipt (${error.message})`); return null;
-  }
-});
-const shas = new Set(receipts.filter(Boolean).map((receipt) => receipt.sha));
-if (shas.size !== 1) failures.push(`receipts are not bound to one SHA: ${[...shas].join(', ') || '<none>'}`);
-const runIds = new Set(receipts.filter(Boolean).map((receipt) => receipt.runId));
-if (runIds.size !== 1) failures.push(`receipts are not bound to one run: ${[...runIds].join(', ') || '<none>'}`);
-for (const [index, receipt] of receipts.entries()) {
-  const lane = required[index];
-  if (!receipt) continue;
-  if (receipt.schema !== 'ruvnet-brain.agentic-qe.receipt' || receipt.contract !== 'agentic-qe-4.3') {
-    failures.push(`${lane}: wrong receipt contract`);
-  }
-  if (receipt.lane !== lane || receipt.status !== 'PASS') failures.push(`${lane}: status ${receipt.status || '<missing>'}`);
-  for (const step of receipt.steps || []) {
-    if (step.status !== 'PASS') failures.push(`${lane} step ${step.index}: ${step.status}`);
-    if (step.tests && (step.tests.total === 0 || step.tests.skipped > 0)) {
-      failures.push(`${lane} step ${step.index}: skipped or empty test result`);
-    }
-  }
-}
-const result = {
-  schema: 'ruvnet-brain.agentic-qe.aggregate', contract: 'agentic-qe-4.3',
-  sha: shas.size === 1 ? [...shas][0] : null, required,
-  status: failures.length ? 'FAIL' : 'PASS', failures, receipts,
-};
-fs.mkdirSync(dir, { recursive: true });
-fs.writeFileSync(path.join(dir, 'aggregate.json'), `${JSON.stringify(result, null, 2)}\n`);
-console.log(JSON.stringify({ status: result.status, sha: result.sha, failures }));
-process.exitCode = failures.length ? 1 : 0;