ruvnet-brain 4.3.3 → 4.3.8

package/scripts/public-verification-aggregate.mjs

@@ -133,7 +133,7 @@ const identityOf = (leaf) => ({
   releaseTransactionId: leaf.releaseTransactionId,
 });
 
-export function buildPublicVerificationAggregate(leaves, reviews) {
+export function buildPublicVerificationAggregate(leaves) {
   if (!Array.isArray(leaves) || leaves.length !== PUBLIC_VERIFICATION_OS.length * PUBLIC_VERIFICATION_MODES.length) {
     throw new Error('public verification requires exactly nine leaves');
   }
@@ -168,25 +168,11 @@ export function buildPublicVerificationAggregate(leaves, reviews) {
   if (metrics.recallAt10 < 0.98 || metrics.deltaCitationRate !== 1 || metrics.skipped || metrics.unknown) {
     throw new Error('public verification aggregate retrieval acceptance failed');
   }
-  if (!Array.isArray(reviews) || reviews.length !== REQUIRED_REVIEW_MODELS.length) {
-    throw new Error('public verification aggregate requires exactly two independent reviews');
-  }
-  reviews.forEach(validateIndependentReviewReceipt);
-  const byModel = new Map(reviews.map((review) => [review.model, review]));
-  if (byModel.size !== REQUIRED_REVIEW_MODELS.length || REQUIRED_REVIEW_MODELS.some((model) => !byModel.has(model))) {
-    throw new Error('required independent review models are missing or duplicated');
-  }
-  const firstReview = byModel.get(REQUIRED_REVIEW_MODELS[0]);
-  const semanticIdentity = validateReviewOracleAgainstPlan(firstReview, first.retrievalPlan);
-  for (const model of REQUIRED_REVIEW_MODELS) {
-    const review = byModel.get(model);
-    const semantic = validateReviewOracleAgainstPlan(review, first.retrievalPlan);
-    if (review.sourceSha !== identity.sourceSha || review.artifactSha256 !== identity.artifactSha256
-      || review.payloadId !== identity.payloadId || review.productContractSha256 !== firstReview.productContractSha256
-      || review.rubricSha256 !== firstReview.rubricSha256
-      || semantic.recordSetSha256 !== semanticIdentity.recordSetSha256) {
-      throw new Error(`${model} review identity, rubric, or oracle identity differs`);
-    }
+  const oracle = first.retrievalPlan.oracle;
+  if (!oracle || !HEX64.test(String(oracle.receiptSha256 || ''))
+    || !HEX64.test(String(oracle.queryStoreSetSha256 || ''))
+    || oracle.queryStoreSetSha256 !== digest(first.retrievalPlan.denominator.eligibleStores)) {
+    throw new Error('sealed retrieval oracle identity is incomplete');
   }
   return {
     schemaVersion: 1,
@@ -194,17 +180,11 @@ export function buildPublicVerificationAggregate(leaves, reviews) {
     identity,
     coverage: first.coverage,
     lanes: required.map((lane) => ({ lane, leafSha256: byLane.get(lane).leafSha256 })),
-    reviews: REQUIRED_REVIEW_MODELS.map((model) => ({ model, receiptSha256: byModel.get(model).receiptSha256,
-      score: byModel.get(model).score })),
-    evidence: { leaves: required.map((lane) => structuredClone(byLane.get(lane))),
-      reviews: REQUIRED_REVIEW_MODELS.map((model) => structuredClone(byModel.get(model))) },
-    productContractSha256: firstReview.productContractSha256,
-    rubricSha256: firstReview.rubricSha256,
+    evidence: { leaves: required.map((lane) => structuredClone(byLane.get(lane))) },
     retrievalOracle: {
-      oracleReceiptSha256: semanticIdentity.oracleReceiptSha256,
-      queryStoreSetSha256: semanticIdentity.queryStoreSetSha256,
-      recordCount: semanticIdentity.recordCount,
-      recordSetSha256: semanticIdentity.recordSetSha256,
+      oracleReceiptSha256: oracle.receiptSha256,
+      queryStoreSetSha256: oracle.queryStoreSetSha256,
+      recordCount: first.retrievalPlan.denominator.eligibleStores.length,
     },
     metrics,
     verdict: 'PASS',
@@ -212,8 +192,8 @@ export function buildPublicVerificationAggregate(leaves, reviews) {
   };
 }
 
-export function signPublicVerificationAggregate({ leaves, reviews }, privateKey) {
-  const payload = buildPublicVerificationAggregate(leaves, reviews);
+export function signPublicVerificationAggregate({ leaves }, privateKey) {
+  const payload = buildPublicVerificationAggregate(leaves);
   const aggregateSha256 = digest(payload);
   const signed = { ...payload, aggregateSha256 };
   return { ...signed, signature: crypto.sign(null, Buffer.from(canonicalJson(signed)), privateKey).toString('base64') };
@@ -227,10 +207,10 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
   }
   const payload = aggregatePayload(aggregate);
   if (digest(payload) !== aggregate.aggregateSha256) throw new Error('public verification aggregate digest mismatch');
-  if (!Array.isArray(aggregate.evidence?.leaves) || !Array.isArray(aggregate.evidence?.reviews)) {
-    throw new Error('public verification aggregate lacks raw leaf or review evidence');
+  if (!Array.isArray(aggregate.evidence?.leaves)) {
+    throw new Error('public verification aggregate lacks raw leaf evidence');
   }
-  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves, aggregate.evidence.reviews);
+  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves);
   if (canonicalJson(rebuilt) !== canonicalJson(payload)) {
     throw new Error('public verification aggregate differs from rebuilt raw evidence');
   }
@@ -249,17 +229,10 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
     || aggregate.coverage.gistCurrent !== aggregate.coverage.gistTotal) {
     throw new Error('public verification aggregate evidence is incomplete');
   }
-  if (aggregate.reviews?.length !== REQUIRED_REVIEW_MODELS.length
-    || REQUIRED_REVIEW_MODELS.some((model) => !aggregate.reviews.some((row) => row.model === model
-      && Number.isInteger(row.score) && row.score >= 95 && HEX64.test(String(row.receiptSha256 || ''))))
-    || !HEX64.test(String(aggregate.productContractSha256 || '')) || !HEX64.test(String(aggregate.rubricSha256 || ''))) {
-    throw new Error('public verification aggregate reviews are incomplete');
-  }
   if (aggregate.retrievalOracle?.oracleReceiptSha256 !== aggregate.evidence.leaves[0].retrievalPlan.oracle.receiptSha256
     || aggregate.retrievalOracle?.queryStoreSetSha256 !== aggregate.evidence.leaves[0].retrievalPlan.oracle.queryStoreSetSha256
-    || aggregate.retrievalOracle?.recordCount !== aggregate.evidence.leaves[0].retrievalPlan.denominator.eligibleStores.length
-    || !HEX64.test(String(aggregate.retrievalOracle?.recordSetSha256 || ''))) {
-    throw new Error('public verification aggregate retrieval oracle review is incomplete');
+    || aggregate.retrievalOracle?.recordCount !== aggregate.evidence.leaves[0].retrievalPlan.denominator.eligibleStores.length) {
+    throw new Error('public verification aggregate retrieval oracle identity is incomplete');
   }
   if (expectedIdentity && canonicalJson(aggregate.identity) !== canonicalJson(expectedIdentity)) {
     throw new Error('public verification aggregate identity differs from the release transaction');
@@ -272,13 +245,13 @@ function parseCliArgs(argv) {
   for (let index = 0; index < argv.length; index += 2) {
     const flag = argv[index];
     const value = argv[index + 1];
-    if (!['--lanes', '--reviews', '--out'].includes(flag) || !value) {
-      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --reviews <dir> --out <file>');
+    if (!['--lanes', '--out'].includes(flag) || !value) {
+      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
     }
     parsed[flag.slice(2)] = value;
   }
-  if (!parsed.lanes || !parsed.reviews || !parsed.out || Object.keys(parsed).length !== 3) {
-    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --reviews <dir> --out <file>');
+  if (!parsed.lanes || !parsed.out || Object.keys(parsed).length !== 2) {
+    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
   }
   return parsed;
 }
@@ -314,12 +287,11 @@ function readLaneLeaves(directory) {
   return PUBLIC_VERIFICATION_OS.flatMap((osName) => byOs.get(osName));
 }
 
-export function generatePublicVerificationAggregate({ lanesDirectory, reviewsDirectory, outputFile, privateKey }) {
+export function generatePublicVerificationAggregate({ lanesDirectory, outputFile, privateKey }) {
   if (!privateKey) throw new Error('RUVNET_SIGNING_KEY is required');
   if (fs.existsSync(outputFile)) throw new Error(`refusing to overwrite existing aggregate: ${outputFile}`);
   const leaves = readLaneLeaves(lanesDirectory);
-  const reviews = readExactJsonFiles(reviewsDirectory, REQUIRED_REVIEW_MODELS.length, 'review');
-  const aggregate = signPublicVerificationAggregate({ leaves, reviews }, privateKey);
+  const aggregate = signPublicVerificationAggregate({ leaves }, privateKey);
   fs.writeFileSync(outputFile, `${JSON.stringify(aggregate, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   return aggregate;
 }
@@ -328,12 +300,11 @@ async function main() {
   const options = parseCliArgs(process.argv.slice(2));
   const aggregate = generatePublicVerificationAggregate({
     lanesDirectory: options.lanes,
-    reviewsDirectory: options.reviews,
     outputFile: options.out,
     privateKey: process.env.RUVNET_SIGNING_KEY,
   });
   process.stdout.write(`${JSON.stringify({ ok: true, aggregateSha256: aggregate.aggregateSha256,
-    leaves: aggregate.metrics.leaves, reviews: aggregate.reviews.length })}\n`);
+    leaves: aggregate.metrics.leaves })}\n`);
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/scripts/qa-runner.mjs

@@ -33,6 +33,7 @@ const lanes = [
     'tests/unit/codex-claude-hook-parity.test.mjs',
     'tests/unit/brain-stamp-resolve-built-from-sha.test.mjs',
     'tests/unit/qa-runner-concurrency.test.mjs',
+    'tests/unit/execution-preflight.test.mjs',
     '--reporter=dot']],
   ['mesh', 'npm', ['run', 'test:mesh']],
   ['plugin', 'npm', ['test']],

package/scripts/refresh-model-catalog.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 // scripts/refresh-model-catalog.mjs — pulls the LIVE OpenRouter model catalog and writes the committed
-// snapshot data/openrouter-catalog-snapshot.json (with a pulledAt stamp). verify-model-catalog.mjs then
+// snapshot data/openrouter-catalog-snapshot.json (with a pulledAt stamp) and synchronizes the catalog's
+// factual prices. verify-model-catalog.mjs then
 // enforces, offline in CI, that every model in data/model-catalog.json exists and is priced correctly
-// against this snapshot — and that the snapshot is fresh. Run nightly (the anti-rot mechanism) + on demand.
+// against this snapshot — and that the snapshot is fresh. Run weekly (the anti-rot mechanism) + on demand.
 // ADR-0016.
 //
 // It ALSO flags drift so a new flagship (e.g. a GPT-5.6-class release) surfaces instead of rotting:
@@ -45,6 +46,30 @@ export function detectDrift(catalog, models) {
   return missing;
 }
 
+/** Synchronize factual catalog prices from the same live map that backs the snapshot. */
+export function syncCatalogPrices(catalog, models, pulledAt) {
+  const changes = [];
+  for (const [provider, entry] of Object.entries(catalog.providers || {})) {
+    if (entry.aliasOf) continue;
+    for (const tier of ['frontier', 'mid', 'cheap']) {
+      const candidate = entry[tier];
+      if (!candidate?.model) continue;
+      const live = models[candidate.model]
+        || (!candidate.model.includes('/') ? models[`anthropic/${candidate.model}`] : null);
+      if (!live) continue;
+      if (candidate.in !== live.in || candidate.out !== live.out) {
+        changes.push({ provider, tier, model: candidate.model, from: { in: candidate.in, out: candidate.out }, to: live });
+        candidate.in = live.in;
+        candidate.out = live.out;
+      }
+    }
+  }
+  if (catalog._meta?.sources) {
+    catalog._meta.sources.prices = `OpenRouter /api/v1/models live catalog, pulled ${pulledAt.slice(0, 10)} (in/out USD per Mtok).`;
+  }
+  return changes;
+}
+
 export function shapeSnapshot(models, pulledAt) {
   return { _meta: { source: 'OpenRouter /api/v1/models (live metadata)', pulledAt, modelCount: Object.keys(models).length }, models };
 }
@@ -73,7 +98,8 @@ async function main() {
 
   const catalog = JSON.parse(fs.readFileSync(CATALOG, 'utf8'));
   const missing = detectDrift(catalog, models);
-  const snapshot = shapeSnapshot(models, new Date().toISOString());
+  const pulledAt = new Date().toISOString();
+  const snapshot = shapeSnapshot(models, pulledAt);
   const next = JSON.stringify(snapshot, null, 2) + '\n';
 
   if (check) {
@@ -86,8 +112,11 @@ async function main() {
     return;
   }
 
+  const priceChanges = syncCatalogPrices(catalog, models, pulledAt);
   fs.writeFileSync(SNAPSHOT, next);
+  fs.writeFileSync(CATALOG, JSON.stringify(catalog, null, 2) + '\n');
   console.log(`✓ wrote ${SNAPSHOT.replace(ROOT + '/', '')} — ${Object.keys(models).length} live models, pulledAt ${snapshot._meta.pulledAt}`);
+  console.log(`✓ synchronized ${priceChanges.length} catalog price field(s) from the same live response`);
   if (missing.length) {
     console.log(`\n⚠ DRIFT: ${missing.length} catalog model(s) no longer in the live catalog — update data/model-catalog.json:`);
     for (const m of missing) console.log('  - ' + m);

package/scripts/release-authority.mjs

@@ -11,7 +11,7 @@ const CANONICAL_PUBLISHERS = new Set([
   'scripts/release.mjs',
   'scripts/release-transaction-provider.mjs',
 ]);
-const SOURCE_EXTENSIONS = new Set(['.mjs', '.js', '.cjs', '.sh']);
+const SOURCE_EXTENSIONS = new Set(['.mjs', '.js', '.cjs', '.sh', '.yml', '.yaml']);
 
 function executableSource(source) {
   const withoutBlocks = source.replace(/\/\*[\s\S]*?\*\//g, '');
@@ -28,7 +28,7 @@ const ACTIONS = [
     jsPatterns: [
       /\[\s*['"]release['"]\s*,\s*['"]create['"]/,
     ],
-    shellPatterns: [/^\s*gh\s+release\s+create\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?gh\s+release\s+create\b/m],
   },
   {
     action: 'github-release-update',
@@ -36,7 +36,7 @@ const ACTIONS = [
       /['"]PATCH['"][\s\S]{0,120}releases\//,
       /\[\s*['"]release['"]\s*,\s*['"]edit['"]/,
     ],
-    shellPatterns: [/^\s*gh\s+(?:release\s+edit|api\s+.*releases\/.*PATCH)\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?gh\s+(?:release\s+edit|api\s+.*releases\/.*PATCH)\b/m],
   },
   {
     action: 'npm-publish',
@@ -44,7 +44,7 @@ const ACTIONS = [
       /(?:execFileSync|spawnSync)\(\s*['"]npm['"]\s*,\s*\[\s*['"]publish['"]/,
       /runOrDie\(\s*['"]npm publish['"]/,
     ],
-    shellPatterns: [/^\s*npm\s+publish\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?npm\s+publish\b/m],
   },
   {
     action: 'npm-dist-tag',
@@ -52,7 +52,7 @@ const ACTIONS = [
       /(?:execFileSync|spawnSync)\(\s*['"]npm['"]\s*,\s*\[\s*['"]dist-tag['"]\s*,\s*['"]add['"]/,
       /runOrDie\(\s*['"]npm dist-tag[^'"]*['"]/,
     ],
-    shellPatterns: [/^\s*npm\s+dist-tag\s+add\b/m],
+    shellPatterns: [/^\s*(?:-\s*run:\s*)?npm\s+dist-tag\s+add\b/m],
   },
 ];
 
@@ -60,7 +60,10 @@ export function detectPublisherActions(file, source) {
   const relative = file.split(path.sep).join('/');
   if (CANONICAL_PUBLISHERS.has(relative)) return [];
   const executable = executableSource(source);
-  const kind = path.extname(relative) === '.sh' ? 'shellPatterns' : 'jsPatterns';
+  const extension = path.extname(relative);
+  const kind = ['.sh', '.yml', '.yaml'].includes(extension) || relative.startsWith('package.json#scripts.')
+    ? 'shellPatterns'
+    : 'jsPatterns';
   return ACTIONS
     .filter((action) => action[kind].some((pattern) => pattern.test(executable)))
     .map(({ action }) => ({ file: relative, action }));
@@ -79,14 +82,23 @@ function sourceFiles(root) {
   visit(path.join(root, 'scripts'));
   visit(path.join(root, 'deploy'));
   visit(path.join(root, 'bin'));
+  visit(path.join(root, '.github', 'workflows'));
   return files;
 }
 
 export function findUnauthorizedPublishers(root = ROOT) {
-  return sourceFiles(root).flatMap((absolute) => {
+  const findings = sourceFiles(root).flatMap((absolute) => {
     const relative = path.relative(root, absolute).split(path.sep).join('/');
     return detectPublisherActions(relative, fs.readFileSync(absolute, 'utf8'));
   });
+  const packageFile = path.join(root, 'package.json');
+  if (fs.existsSync(packageFile)) {
+    const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+    for (const [name, command] of Object.entries(pkg.scripts || {})) {
+      findings.push(...detectPublisherActions(`package.json#scripts.${name}`, String(command)));
+    }
+  }
+  return findings;
 }
 
 export function main(root = ROOT) {

package/scripts/release-convergence-watchdog.mjs

@@ -11,18 +11,16 @@
  * for a month.
  *
  * WHAT IT WILL NOT DO. It does not publish. `scripts/self-update.mjs:56` refuses `--publish` and
- * only `protected-release.yml` may create a release, publish npm, or move a dist-tag. This script
- * DISPATCHES that workflow — the sanctioned path — and never substitutes for it. Every safety gate
- * (exact-SHA evidence, clean worktree, release-proof, host verification, post-publication seal)
- * still runs inside the workflow exactly as designed. Bypassing them to "get it done while nobody
- * is looking" would be the worst possible reading of an instruction to finish the job.
+ * `release-candidate-preflight.yml` owns the one-time long lanes and `protected-release.yml` is the
+ * sole publication controller. This watchdog is report-only: it never dispatches either phase and
+ * cannot manufacture typed candidate evidence.
  *
  * IT IS A NO-OP UNLESS EVERY PRECONDITION HOLDS. It runs from the nightly, unattended, for weeks.
  * A watchdog that acts on a partial picture is worse than no watchdog, so it refuses on anything
  * unexpected and says why. The default outcome is "nothing happened, here is the reason".
  *
  *   node scripts/release-convergence-watchdog.mjs           # report only, never acts
- *   node scripts/release-convergence-watchdog.mjs --dispatch # act, but only if ALL gates pass
+ *   node scripts/release-convergence-watchdog.mjs --dispatch # compatibility flag; still reports only
  */
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
@@ -99,21 +97,11 @@ const runsFor = (wf) => JSON.parse(tryShy(() => sh('gh', ['run', 'list', '--repo
 const greenAt = (wf) => runsFor(wf).find((r) => r.headSha === originMain && r.conclusion === 'success');
 
 const ci = greenAt('ci');
-const aggregate = greenAt('release-aggregate');
 if (!ci) stand_down(`no successful exact-SHA \`ci\` run at ${originMain.slice(0, 7)} yet`);
-if (!aggregate) stand_down(`no successful exact-SHA \`release-aggregate\` run at ${originMain.slice(0, 7)} yet`);
 
-log(`ALL GATES PASS — candidate=${originMain.slice(0, 7)} version=${version} ci=${ci.databaseId} aggregate=${aggregate.databaseId}`);
-if (!DISPATCH) {
-  log('report-only mode; pass --dispatch to actually invoke the protected release workflow.');
-  process.exit(0);
-}
-
-// ── 6. Dispatch THE SANCTIONED PUBLISHER. Nothing here publishes; the workflow does. ─────────────
-sh('gh', ['workflow', 'run', 'protected-release.yml', '--repo', REPO,
-  '-f', `candidate_sha=${originMain}`,
-  '-f', `version=${version}`,
-  '-f', `release_qe_run_id=${ci.databaseId}`,
-  '-f', `aggregate_run_id=${aggregate.databaseId}`]);
-log(`DISPATCHED protected-release for ${version}. The workflow owns every safety gate from here.`);
-log('Verify afterwards with: node scripts/published-surface-probe.mjs (D-version-coherence must PASS).');
+log(`PRECONDITIONS VISIBLE — candidate=${originMain.slice(0, 7)} version=${version} ci=${ci.databaseId}`);
+// ── 6. Never dispatch a publisher from the watchdog. ───────────────────────────────────────────
+// Only protected-release may derive the complete typed evidence chain and cross Production.
+// This unattended observer cannot turn visible preconditions into release authority.
+log(`PRECONDITIONS ONLY — no candidate artifact inferred and no action taken for ${version} at ${originMain}`);
+log('Run release-candidate-preflight on release/** once; fast-forward that exact SHA to main; then protected-release imports release-candidate-<SHA> without a run ID.');

package/scripts/release-transaction.mjs

@@ -565,7 +565,7 @@ export async function finalizeReleaseTransaction({
         lanes: aggregate.metrics.leaves,
         recallAt10: aggregate.metrics.recallAt10,
         deltaCitationRate: aggregate.metrics.deltaCitationRate,
-        reviewReceipts: aggregate.reviews,
+        reviewReceipts: aggregate.reviews || [],
       },
       npm: snapshot.npm,
       github: snapshot.github,

package/scripts/release.mjs

@@ -29,7 +29,7 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import crypto from 'node:crypto';
-import { validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
+import { validateProtectedPublishEnvironment, validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
 import { runReleaseTransaction } from './release-transaction.mjs';
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
 import { stagedHostVerifier } from './staged-host-verifier.mjs';
@@ -87,9 +87,9 @@ export function runProtectedCorpusSeed({
   root = ROOT,
   run = (command, args, options) => spawnSync(command, args, { encoding: 'utf8', ...options }),
 } = {}) {
-  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_WORKFLOW !== 'protected-release'
-    || env.GITHUB_REPOSITORY !== 'stuinfla/ruvnet-brain') {
-    corpusFailure('publication is allowed only inside the protected-release GitHub workflow for stuinfla/ruvnet-brain');
+  const environmentFailures = validateProtectedPublishEnvironment(env);
+  if (environmentFailures.length) {
+    corpusFailure(environmentFailures.join('; '));
   }
 
   const tag = cliArg(argv, '--corpus-tag');
@@ -399,7 +399,6 @@ if (!PUBLISH) {
 
 if (PUBLISH) {
   console.log(`\n${c.y(c.b('PUBLISHED, NOT VERIFIED'))}`);
-  console.log(`\n${c.g(c.b('✓✓✓ SHIPPED'))} — every gate passed and every live channel is current. ${c.dim('A user on any path (npm, npx, explainer, --update) gets the working, current build.')}\n`);
 } else {
   console.log(`\n${c.g(c.b('✓✓✓ PREFLIGHT PASS — NOT PUBLISHED'))} — the committed candidate passed every check-only gate.\n`);
 }

package/scripts/source-coverage.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { readRvfGenerations, sha256File } from './rvf-generation.mjs';
 import { canonicalJson, coverageGenerationFor, digest, validateGistAggregateReceipt } from './coverage-integrity.mjs';
+import { repositoryNames } from '../kb/card-lane.mjs';
 
 export { canonicalJson, digest } from './coverage-integrity.mjs';
 
@@ -272,7 +273,15 @@ export function classifyGist(gist, evidence) {
   };
 }
 
-function artifactEvidence(kbDir, ledger, cardStores, name) {
+// ALIAS-AWARE, BECAUSE THE ROUTER IS. `cardStores` holds card HEADINGS; a store reachable only
+// under an alias (e.g. `metaharness` via its `## agent-harness-generator` card) has no heading of
+// its own, so a direct `cardStores.has(store)` reports it card-absent even though the router finds
+// it. `kb/store-root.mjs`'s `darkStores()` and `scripts/brain-score.mjs`'s `readCoverage()` were
+// already fixed for this exact conflation (ADR-058; metaharness is the standing example in both);
+// this sibling computation, which feeds the committed `data/source-coverage.json` and
+// `docs/RUVNET-COVERAGE.md` (ADR-069), never received it. `repositoryNames` is the router's own
+// resolver (kb/card-lane.mjs), imported rather than reimplemented.
+export function artifactEvidence(kbDir, ledger, cardStores, name) {
   const store = storeName(name);
   const receipt = Object.entries(ledger.stores).find(([key]) => key.toLowerCase() === store)?.[1] || null;
   const rvfFile = receipt?.file || `${store}.big.rvf`;
@@ -284,7 +293,7 @@ function artifactEvidence(kbDir, ledger, cardStores, name) {
     bytesVerified: Boolean(rvfPresent && receipt?.sha256 && sha256File(rvfPath) === receipt.sha256),
     passagesPresent: fs.existsSync(path.join(kbDir, `${store}.passages.jsonl`))
       && fs.statSync(path.join(kbDir, `${store}.passages.jsonl`)).size > 0,
-    cardPresent: cardStores.has(store),
+    cardPresent: repositoryNames(store, kbDir).some((alias) => cardStores.has(storeName(alias))),
   };
 }
 

package/scripts/staged-host-verifier.mjs

@@ -3,7 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { runHostMatrix } from './host-install-matrix.mjs';
+import { runHostMatrixAsync } from './host-install-matrix.mjs';
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const locate = (name) => {
@@ -50,7 +50,7 @@ export function stagedHostVerifier({ assets, identity }) {
         // install shape than the one that runs after publication — so the two halves of a release
         // were judging different things and could not be compared. Only the STAGED-vs-PUBLISHED
         // difference is real, and it is now a named variant rather than a second implementation.
-        const matrix = runHostMatrix({
+        const matrix = await runHostMatrixAsync({
           packageRoot: prepared.packageRoot,
           version: identity.version,
           variant: 'staged',

package/scripts/wired-check.mjs

@@ -95,6 +95,7 @@ const STANDALONE = [
     + 'RVFs to RVF-GENERATIONS.json and optionally prunes legacy sidecars; build-bundle.mjs consumes '
     + 'and validates the resulting manifest, so scheduling this destructive migration would be wrong'],
   ['release', 'the ship path, run by a human'],
+  ['execution-preflight', 'external orchestration boundary — invoked by the host before consequential Ruflo/Codex execution; no in-repo caller exists because the host supplies the live Brain and AgentDB receipts'],
   ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
     + 'isolated writing agent to start and hand off a fix lane. Scheduling it would violate its safety '
     + 'boundary: it prepares evidence but never merges, pushes, publishes, deletes, or cleans worktrees'],