ruvnet-brain 4.3.3 → 4.3.9

package/README.md

@@ -4,7 +4,7 @@
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.3 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.3-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.9 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.9-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -2245,16 +2245,17 @@ async function doctor() {
     hookResult = await runSelfCheck({ installState: { repos: v.repos, reader: v.reader, mcp: v.mcp } });
   }
 
-  // ── THE PERSISTED GROUNDING VERDICT (ADR-058 §D8) — read-only, never re-derived here ────────────
-  // bin/install.mjs's own install run is the ONLY writer (right after its real smoke query), so a
-  // failed smoke stays non-fatal there. `--doctor` is different: it is the command someone runs
-  // SPECIFICALLY TO ASK whether the install is healthy, so this is the one place an unresolved
-  // "unproven" verdict DOES gate the exit code — without doctor() re-running a second live query
-  // (the live smoke result printed above already updates the SAME file the next real install or
-  // search_ruvnet touches; this just reads back whatever the most recent real attempt recorded).
+  // ── THE PERSISTED GROUNDING VERDICT (ADR-058 §D8) — synchronize stronger live proof first ───────
+  // A failed install smoke stays non-fatal there. `--doctor` is different: it is the command someone
+  // runs SPECIFICALLY TO ASK whether the install is healthy, so this is the one place an unresolved
+  // "unproven" verdict DOES gate the exit code. Its successful live citation proof above must clear
+  // an older failure before this read; otherwise one invocation can print both PROVEN and UNPROVEN.
   let groundingUnprovenPersisted = false;
   try {
     const mod = await import(new URL('../scripts/selfcheck.mjs', import.meta.url).href);
+    if (smoke.grounded === true) {
+      mod.writeInstallState({ grounding: 'proven', reason: null, clearedBy: 'doctor-live-proof' });
+    }
     groundingUnprovenPersisted = mod.groundingUnproven(mod.readInstallState());
     if (groundingUnprovenPersisted) {
       console.log(`  ${c.yellow('! Grounding UNPROVEN')} (recorded at ${c.bold(mod.installStatePath())}).`);

package/data/model-catalog.json

@@ -4,7 +4,7 @@
     "generated": "2026-07-15",
     "schema_version": 1,
     "sources": {
-      "prices": "OpenRouter /api/v1/models live catalog, pulled 2026-07-15 (in/out USD per Mtok).",
+      "prices": "OpenRouter /api/v1/models live catalog, pulled 2026-09-04 (in/out USD per Mtok).",
       "rankings": "Artificial Analysis Intelligence Index (artificialanalysis.ai) + Arena/LMArena (arena.ai) — the ONLY independent evaluators carrying current-generation models as of 2026-07-15; each figure cross-verified twice.",
       "provenance_rule": "rUv ADR-206: vendor-reported scores are optimistic and harness-confounded — trust independent (AA/Arena) numbers, treat vendor self-scaffold SWE-bench/LiveCodeBench figures as noisy features, never as truth.",
       "benchmark_lag": "The canonical hard coding benchmarks (SWE-bench Verified standardized harness, LiveCodeBench, Aider polyglot) were ALL months stale on 2026-07-15 and carry NONE of these models. The '88.6% / 95% SWE-bench' figures in the press are vendor self-scaffold scores, not the standardized harness — excluded here.",
@@ -55,8 +55,8 @@
       ],
       "frontier": {
         "model": "openai/gpt-5.6-sol",
-        "in": 2.5,
-        "out": 15,
+        "in": 2,
+        "out": 10,
         "released": "2026-07-09",
         "rank": "AA Intelligence #2 (59) · AA Coding Index leader (80) · Terminal-Bench 2.1 SOTA · ~1/3 Fable 5's cost/task",
         "source": "independent (AA)"

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.3",
+  "version": "4.3.9",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
     "ruvnet-brain": "bin/install.mjs"
   },
   "scripts": {
+    "prepublishOnly": "node scripts/protected-release-invocation.mjs --prepublish-only",
     "test": "node plugin/test/run-tests.mjs",
     "release:proof": "node scripts/release-proof.mjs",
     "benchmark:brain50": "node scripts/brain-latency-50.mjs",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships an enforced UserPromptSubmit retrieve-and-inject grounding hook that sharply reduces drift.",
-  "version": "4.3.3",
+  "version": "4.3.9",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.3",
+  "version": "4.3.9",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/learn-flush.mjs

@@ -29,7 +29,7 @@ const HOME = os.homedir();
 // SAME CLAUDE_PROJECT_DIR-with-containment rule #85/#107 already fixed for the receipt/Console
 // agreement — reused here rather than trusting the variable unconditionally, which would reopen the
 // class of bug #107 was: an unrelated declared root overruling a cwd it does not actually contain.
-const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || projectDirectory();
+const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || projectDirectory({ env: process.env });
 // ISSUE #139 — this WRITER resolved scope correctly while two READERS hardcoded it, so they agreed
 // only by coincidence. The resolution moved into runtime-preferences.mjs and all three now call it;
 // a future scope is one edit, not three. Behaviour here is unchanged by design.

package/plugin/skills/release-proof/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: release-proof
-description: Fail-closed exact-artifact release and deployment authority. Use before saying a release is ready, pushing a release commit, publishing npm packages, creating GitHub releases, deploying production, closing release-blocking issues, or claiming all gates are green. Requires clean immutable lineage, zero open issues, exact-SHA GitHub success, nonzero no-skip QE, packed-artifact host tests, installed Brain/RVF proof, independent graders, and post-publication byte verification.
+description: Fail-closed exact-artifact release and deployment authority. Use before saying a release is ready, pushing a release commit, publishing npm packages, creating GitHub releases, deploying production, closing release-blocking issues, or claiming all gates are green. Requires clean immutable lineage, zero labeled release blockers, exact-SHA GitHub success, nonzero no-skip QE, packed-artifact host tests, installed Brain/RVF proof, and post-publication byte verification.
+updated: 2026-09-04
 ---
 
 # Release Proof
@@ -12,10 +13,12 @@ green.
 ## Non-bypassable rules
 
 1. Use the exact source SHA and one packed-artifact SHA-256 everywhere.
-2. Require zero open GitHub issues for RuvNet Brain. A local fix is not a closed issue.
-3. Require every named GitHub workflow to complete successfully on the exact candidate SHA.
+2. Require zero open GitHub issues labeled `release-blocker`. Unlabeled backlog is not release authority; a local fix does not clear a labeled blocker.
+3. Run CI, integration, UX, and stranger qualification once in
+   `.github/workflows/release-candidate-preflight.yml` on `release/**`. Require its exact-SHA,
+   source-bound package and aggregate before that unchanged SHA reaches `main`.
 4. Reject any test/QE result with zero tests, skips, todos, unknowns, pending jobs, or failures.
-5. Require two distinct independent graders scoring at least 95, each bound to the SHA and digest.
+5. When the candidate changes architecture or the retrieval oracle, require the accepted Fable 5 and GPT-5.6-Sol design-review receipts for that change. Routine releases do not manufacture caller-supplied reviewer keys; bundled public keys are integrity material, not an independent trust anchor.
 6. Install the sealed artifact into virgin Claude Code and Codex homes; test their real entrypoints.
 7. Require the source package, Claude manifest, Codex manifest, packed npm version, bundle
    `brainVersion`/`releaseTag`, and both installed host versions to identify one exact generation.
@@ -29,12 +32,18 @@ green.
 
 ## Candidate seal
 
-Generate the receipt from commands in the protected candidate workflow. Do not hand-author it.
-Dispatch `.github/workflows/protected-release.yml` only with the full candidate SHA, the exact
-current version, and the successful exact-SHA CI run ID whose named `release-qe` job produced
-`release-evidence-<sha>`. The workflow derives the artifact digest from those sealed bytes and checks
-every binding before creating its handoff and again at the Production boundary. Missing artifacts,
-pending/red jobs, malformed inputs, version splits, and byte mismatches stop before the publisher.
+Generate the candidate receipt in `.github/workflows/release-candidate-preflight.yml`; do not
+hand-author it. The preflight runs the long CI, integration, UX, and stranger lanes once on
+`release/**`, then emits the source-bound package and aggregate as
+`release-candidate-<exact SHA>`. Fast-forward that unchanged SHA to `main`.
+
+Dispatch `.github/workflows/protected-release.yml` only after the fast-forward. It is the sole
+publication controller: it proves current `origin/main` is the preflight SHA, selects the artifact
+by its deterministic name rather than a caller-supplied run ID, revalidates every receipt,
+payload/source binding, and digest, then signs and publishes once. The same protected run downloads
+the public bytes, executes the three-OS by three-host-mode matrix, and appends `install-verified`.
+It does not rerun the long preflight lanes. Conditional architecture/retrieval-oracle reviews are
+candidate inputs only when the governed surfaces changed; they do not authorize publication.
 Validate it from the repository with:
 
 ```bash

package/plugin/skills/release-proof/references/receipt-contract.md

@@ -1,7 +1,10 @@
 # Receipt contract
 
-The authority accepts schema version 1 JSON. Receipts are append-only evidence artifacts generated
-by protected workflows, never editable status documents.
+Updated: 2026-09-04
+
+The authority accepts only typed receipt schemas. The candidate receipts are emitted by
+`release-candidate-preflight` and imported by `protected-release`; publication receipts are emitted
+inside that protected run. All are append-only evidence artifacts, never editable status documents.
 
 ## Candidate receipt
 
@@ -11,17 +14,20 @@ Required bindings:
 - `version`, `tag`, and exact-equal `sourceVersions.package`, `sourceVersions.claudePlugin`, and
   `sourceVersions.codexPlugin`
 - `artifact.path`, `artifact.sha256`, `artifact.sourceSha`
+- artifact name exactly `release-candidate-<sha>`; selection is by name and exact source SHA, never
+  by a caller-supplied workflow run ID
 - exact-equal `artifact.version`, `artifact.bundle.brainVersion`, and
   `artifact.bundle.releaseTag`
 - exact-SHA release-vector verdict with zero unknown/skipped
 - aggregate tests with nonzero total, all passed, zero failed/skipped/todo
 - fresh coverage floor and zero critical/high security findings
-- zero open GitHub issues
+- zero open GitHub issues labeled `release-blocker`
 - required GitHub workflow results on the same SHA
 - virgin-home Claude and Codex results on the same artifact digest and exact candidate version
 - installed Brain self-RVF plus narrow, broad, and concurrent cited search timings
 - nonzero Agentic QE totals with zero failed/skipped
-- two distinct independent grader receipts at 95 or higher, bound to SHA and digest
+- when architecture or retrieval-oracle surfaces changed, accepted Fable 5 and GPT-5.6-Sol review
+  receipts bound to that change; no per-release caller-supplied key can create independent authority
 
 ## Publication receipt
 
@@ -35,10 +41,14 @@ Required bindings:
 - installed Brain self-RVF and broad search within 80 percent of deadline
 - successful exact-SHA `published-surface-probe`
 
+Before provider mutation, `protected-release` revalidates the imported candidate receipt, package
+payload, source binding, and digest against current `origin/main`. It consumes the long-lane proof;
+it does not rerun CI, integration, UX, or stranger qualification.
+
 ## Failure semantics
 
-Any missing field, split version identity, malformed digest, mismatched SHA, dirty tree, open issue, absent/pending/red
+Any missing field, split version identity, malformed digest, mismatched SHA, dirty tree, open labeled release blocker, absent/pending/red
 workflow, skipped/todo/zero-test result, missing RVF store, uncited search, deadline-margin breach,
-low/missing grader, or public byte mismatch is `FAIL`. There is no warning state and no score
-average. The authority never publishes; publication belongs to the protected workflow after the
-candidate seal.
+missing required change-triggered design review, or public byte mismatch is `FAIL`. There is no
+warning state and no score average. Preflight owns candidate qualification; one `protected-release`
+run owns import revalidation, publication, public verification, and the terminal receipt.

package/scripts/candidate-host-evidence.mjs

@@ -25,7 +25,12 @@ if (result.verdict !== 'PASS') throw new Error(`candidate host matrix failed: ${
 const modeNames = { claude: 'claude-only', codex: 'codex-only', dual: 'dual-host' };
 const leaves = Object.entries(modeNames).map(([mode, name]) => {
   const fixture = result.fixtures?.[mode];
-  if (fixture?.status !== 'PASS' || fixture?.doctorExit !== 0) throw new Error(`${name} did not produce a clean doctor receipt`);
+  const grounding = fixture?.grounding;
+  const grounded = grounding && ['repo', 'path', 'file', 'storedPath']
+    .every((field) => typeof grounding[field] === 'string' && grounding[field].trim());
+  if (fixture?.status !== 'PASS' || fixture?.process?.status !== 0 || !grounded) {
+    throw new Error(`${name} did not produce a clean installed-search grounding receipt`);
+  }
   return {
     name,
     sha: manifest.candidateSha,
@@ -35,7 +40,9 @@ const leaves = Object.entries(modeNames).map(([mode, name]) => {
     verdict: 'PASS',
     source: 'candidate-host-evidence',
     mode,
-    doctorExit: fixture.doctorExit,
+    functionalSearch: true,
+    searchExit: fixture.process.status,
+    grounding,
     artifactSha256: sha256(packagePath),
   };
 });

package/scripts/execution-policy.mjs

@@ -5,6 +5,40 @@
 const NATIVE_HOSTS = new Set(['claude', 'codex']);
 const API_EXECUTORS = new Set(['agent_execute', 'sdk', 'openrouter', 'api']);
 const ARCHITECTURE_TERMS = /\b(adr|ddd|architecture|release|deploy|qa|security|schema|migration)\b/i;
+const CONSEQUENTIAL_ACTIONS = new Set(['delegate', 'write', 'release', 'external']);
+const FRESHNESS_MS = 30 * 60 * 1000;
+
+const hex64 = (value) => /^[a-f0-9]{64}$/i.test(String(value || ''));
+const fresh = (value, now = Date.now()) => {
+  const time = Date.parse(String(value || ''));
+  return Number.isFinite(time) && time <= now && now - time <= FRESHNESS_MS;
+};
+
+/**
+ * The classifier used to trust caller-supplied routing fields. That made a correct memory lesson
+ * advisory: a caller could omit the live search and AgentDB read and still receive ALLOW. This is
+ * the evidence boundary used by the executable preflight. Receipts are intentionally structural;
+ * the producers (search_ruvnet and ruflo memory retrieve) own their contents and identities.
+ */
+export function validateEvidence(input = {}, now = Date.now()) {
+  const failures = [];
+  const grounding = input.groundingReceipt;
+  const memory = input.memoryReceipt;
+  if (!grounding || grounding.status !== 'success' || !fresh(grounding.observedAt, now)) {
+    failures.push('fresh successful search_ruvnet receipt is required');
+  } else if (!(Array.isArray(grounding.sources) && grounding.sources.length > 0)
+    && !hex64(grounding.sourceIdentity)) {
+    failures.push('grounding receipt must bind a source list or source identity');
+  }
+  if (!memory || memory.status !== 'retrieved' || !fresh(memory.observedAt, now)) {
+    failures.push('fresh exact AgentDB checkpoint retrieval is required');
+  } else {
+    if (!String(memory.path || '').endsWith('/.swarm/memory.db')) failures.push('memory receipt must use the project .swarm/memory.db');
+    if (!/^project-state-current-\d+$/.test(String(memory.key || ''))) failures.push('memory receipt must retrieve an append-only project-state-current key');
+    if (!hex64(memory.valueDigest)) failures.push('memory receipt must bind the retrieved value digest');
+  }
+  return { valid: failures.length === 0, failures };
+}
 
 export function classifyExecutionPolicy(input = {}) {
   const action = String(input.action || 'read');
@@ -24,10 +58,21 @@ export function classifyExecutionPolicy(input = {}) {
         ? 'architecture-or-consequential-action'
         : 'single-sequential-surface';
 
+  const evidence = CONSEQUENTIAL_ACTIONS.has(action) && input.enforceEvidence === true
+    ? validateEvidence(input, input.now ?? Date.now())
+    : { valid: true, failures: [] };
+  if (!evidence.valid) {
+    return {
+      schema: 'ruvnet-brain.execution-policy.v1',
+      verdict: 'REFUSE', action, swarmRequired, swarmReason,
+      executor: 'unknown', reason: 'live-evidence-preflight-failed', evidence,
+    };
+  }
+
   if (action !== 'delegate') {
     return {
       schema: 'ruvnet-brain.execution-policy.v1',
-      verdict: 'ALLOW', action, swarmRequired, swarmReason,
+      verdict: 'ALLOW', action, swarmRequired, swarmReason, evidence,
       executor: 'current-agent', reason: 'delegation-not-requested',
     };
   }
@@ -37,7 +82,7 @@ export function classifyExecutionPolicy(input = {}) {
   if (API_EXECUTORS.has(requestedExecutor)) {
     return {
       schema: 'ruvnet-brain.execution-policy.v1',
-      verdict: nativeHost ? 'REFUSE' : 'DEGRADED', action, swarmRequired, swarmReason,
+      verdict: nativeHost ? 'REFUSE' : 'DEGRADED', action, swarmRequired, swarmReason, evidence,
       executor: nativeHost ? `native:${nativeHost}` : 'unknown',
       reason: nativeHost
         ? 'api-backed-executor-is-not-the-native-subscription-route'
@@ -47,13 +92,13 @@ export function classifyExecutionPolicy(input = {}) {
   if (!nativeHost) {
     return {
       schema: 'ruvnet-brain.execution-policy.v1',
-      verdict: 'DEGRADED', action, swarmRequired, swarmReason, executor: 'unknown',
+      verdict: 'DEGRADED', action, swarmRequired, swarmReason, executor: 'unknown', evidence,
       reason: 'no-authenticated-native-host-is-available',
     };
   }
   return {
     schema: 'ruvnet-brain.execution-policy.v1',
-    verdict: 'ALLOW', action, swarmRequired, swarmReason,
+    verdict: 'ALLOW', action, swarmRequired, swarmReason, evidence,
     executor: `native:${nativeHost}`, reason: 'native-subscription-route-selected',
   };
 }

package/scripts/execution-preflight.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// Enforced knowledge-to-execution boundary. The caller must provide receipts produced by the
+// live Brain search and exact project AgentDB retrieval; prose, memory, and guessed host state do
+// not satisfy this command.
+import { classifyExecutionPolicy } from './execution-policy.mjs';
+
+export function runExecutionPreflight(input = {}) {
+  return classifyExecutionPolicy({ ...input, enforceEvidence: true });
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  let input;
+  try { input = JSON.parse(process.argv[2] || '{}'); }
+  catch { process.stderr.write('execution-preflight: input must be JSON\n'); process.exit(2); }
+  const result = runExecutionPreflight(input);
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  process.exit(result.verdict === 'ALLOW' ? 0 : 2);
+}