ruvnet-brain 4.3.3 → 4.3.9

package/scripts/release-publication-handoff.mjs

@@ -0,0 +1,101 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { canonicalJson, transactionIdFor, verifyReceipt } from './release-transaction.mjs';
+
+const jsonBytes = (value) => Buffer.from(`${JSON.stringify(value, null, 2)}\n`);
+
+function trustedEvidenceDirectory(root) {
+  const evidenceRoot = path.join(path.resolve(root), 'release-evidence');
+  let stat;
+  try { stat = fs.lstatSync(evidenceRoot); } catch { throw new Error('release-evidence directory is missing'); }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error('release-evidence must be a trusted directory');
+  }
+  return evidenceRoot;
+}
+
+export function resolvePublicationHandoffPaths({ root, identityPath, receiptPath } = {}) {
+  const evidenceRoot = trustedEvidenceDirectory(root);
+  const resolveTarget = (configured, label) => {
+    if (typeof configured !== 'string' || !configured.trim()) throw new Error(`${label} output is required`);
+    const target = path.resolve(root, configured);
+    if (path.dirname(target) !== evidenceRoot || path.extname(target) !== '.json') {
+      throw new Error(`${label} output must be a direct JSON file inside release-evidence`);
+    }
+    if (fs.existsSync(target)) throw new Error(`${label} output must be a new file`);
+    return target;
+  };
+  const identity = resolveTarget(identityPath, 'release identity');
+  const receipt = resolveTarget(receiptPath, 'channel receipt');
+  if (identity === receipt) throw new Error('release identity and channel receipt outputs must differ');
+  return { evidenceRoot, identity, receipt };
+}
+
+export function validatePublicationHandoff({ identity, receipt, publicKey } = {}) {
+  verifyReceipt(receipt, publicKey);
+  if (receipt.schemaVersion !== 3 || receipt.state !== 'channels-converged'
+    || receipt.observation?.verdict !== 'PUBLISHED_NOT_VERIFIED') {
+    throw new Error('channel receipt is not signed PUBLISHED_NOT_VERIFIED convergence evidence');
+  }
+  if (receipt.transactionId !== transactionIdFor(identity)
+    || canonicalJson(receipt.identity) !== canonicalJson(identity)) {
+    throw new Error('channel receipt identity differs from the release identity');
+  }
+  return receipt;
+}
+
+function writePrivateTemp(directory, label, bytes) {
+  const temp = path.join(directory, `.${label}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const fd = fs.openSync(temp, 'wx', 0o600);
+  let closed = false;
+  try {
+    fs.writeFileSync(fd, bytes);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    closed = true;
+    return temp;
+  } catch (error) {
+    if (!closed) {
+      try { fs.closeSync(fd); } catch { /* preserve the write failure */ }
+    }
+    fs.rmSync(temp, { force: true });
+    throw error;
+  }
+}
+
+function removeOwnedLink(destination, temporary) {
+  try {
+    const linked = fs.lstatSync(destination);
+    const source = fs.lstatSync(temporary);
+    if (linked.dev === source.dev && linked.ino === source.ino) fs.unlinkSync(destination);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+}
+
+export function materializePublicationHandoff({ paths, identity, receipt, publicKey } = {}) {
+  if (!paths?.evidenceRoot || path.dirname(paths.identity || '') !== paths.evidenceRoot
+    || path.dirname(paths.receipt || '') !== paths.evidenceRoot || paths.identity === paths.receipt) {
+    throw new Error('publication handoff paths were not validated');
+  }
+  validatePublicationHandoff({ identity, receipt, publicKey });
+  const temporary = [];
+  let identityLinked = false;
+  let receiptLinked = false;
+  try {
+    temporary.push(writePrivateTemp(paths.evidenceRoot, 'release-identity', jsonBytes(identity)));
+    temporary.push(writePrivateTemp(paths.evidenceRoot, 'channels-converged', jsonBytes(receipt)));
+    fs.linkSync(temporary[0], paths.identity);
+    identityLinked = true;
+    fs.linkSync(temporary[1], paths.receipt);
+    receiptLinked = true;
+  } catch (error) {
+    if (receiptLinked) removeOwnedLink(paths.receipt, temporary[1]);
+    if (identityLinked) removeOwnedLink(paths.identity, temporary[0]);
+    throw new Error(`publication handoff materialization failed: ${error.message}`);
+  } finally {
+    for (const temp of temporary) fs.rmSync(temp, { force: true });
+  }
+  return { identityPath: paths.identity, receiptPath: paths.receipt };
+}

package/scripts/release-transaction.mjs

@@ -565,7 +565,7 @@ export async function finalizeReleaseTransaction({
         lanes: aggregate.metrics.leaves,
         recallAt10: aggregate.metrics.recallAt10,
         deltaCitationRate: aggregate.metrics.deltaCitationRate,
-        reviewReceipts: aggregate.reviews,
+        reviewReceipts: aggregate.reviews || [],
       },
       npm: snapshot.npm,
       github: snapshot.github,

package/scripts/release.mjs

@@ -29,8 +29,9 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import crypto from 'node:crypto';
-import { validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
+import { validateProtectedPublishEnvironment, validateProtectedPublishInvocation } from './protected-release-invocation.mjs';
 import { runReleaseTransaction } from './release-transaction.mjs';
+import { materializePublicationHandoff, resolvePublicationHandoffPaths } from './release-publication-handoff.mjs';
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
 import { stagedHostVerifier } from './staged-host-verifier.mjs';
 import { verifyPayload } from './release-payload.mjs';
@@ -44,6 +45,7 @@ let publicationReceiptPath = null;
 let protectedReleaseMode = 'strict';
 let verifiedPayload = null;
 let aggregateEnvelope = null;
+let publicationHandoffPaths = null;
 const c = { g: (s) => `\x1b[32m${s}\x1b[0m`, r: (s) => `\x1b[31m${s}\x1b[0m`, y: (s) => `\x1b[33m${s}\x1b[0m`, b: (s) => `\x1b[1m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m` };
 const V = () => JSON.parse(fs.readFileSync(path.join(ROOT, 'plugin/.claude-plugin/plugin.json'), 'utf8')).version;
 
@@ -87,9 +89,9 @@ export function runProtectedCorpusSeed({
   root = ROOT,
   run = (command, args, options) => spawnSync(command, args, { encoding: 'utf8', ...options }),
 } = {}) {
-  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_WORKFLOW !== 'protected-release'
-    || env.GITHUB_REPOSITORY !== 'stuinfla/ruvnet-brain') {
-    corpusFailure('publication is allowed only inside the protected-release GitHub workflow for stuinfla/ruvnet-brain');
+  const environmentFailures = validateProtectedPublishEnvironment(env);
+  if (environmentFailures.length) {
+    corpusFailure(environmentFailures.join('; '));
   }
 
   const tag = cliArg(argv, '--corpus-tag');
@@ -222,6 +224,11 @@ if (PUBLISH) {
     console.error(`\n${c.r('✗ PROTECTED RELEASE GATE FAILED')}\n  publication receipt output must be a new file inside release-evidence\n`);
     process.exit(1);
   }
+  publicationHandoffPaths = resolvePublicationHandoffPaths({
+    root: ROOT,
+    identityPath: process.env.RUVNET_RELEASE_IDENTITY,
+    receiptPath: process.env.RUVNET_CHANNEL_RECEIPT,
+  });
   const payloadManifestPath = path.resolve(ROOT, process.env.RUVNET_CANDIDATE_PAYLOAD || '');
   const payloadSignaturePath = path.resolve(ROOT, process.env.RUVNET_CANDIDATE_PAYLOAD_SIGNATURE || '');
   const aggregatePath = path.resolve(ROOT, process.env.RUVNET_AGGREGATE_ENVELOPE || '');
@@ -375,6 +382,7 @@ if (PUBLISH) {
   };
   const privatePem = process.env.RUVNET_SIGNING_KEY;
   if (!privatePem) throw new Error('RUVNET_SIGNING_KEY is required for signed transaction receipts');
+  const publicKey = crypto.createPublicKey(fs.readFileSync(path.join(ROOT, 'keys/ruvnet-brain-signing.pub.pem'), 'utf8'));
   const finalReceipt = await runReleaseTransaction({
     identity, assets, adapter: liveReleaseProvider({
       root: ROOT,
@@ -382,10 +390,11 @@ if (PUBLISH) {
       publicationReceipt: process.env.RUVNET_PUBLICATION_RECEIPT,
     }),
     privateKey: crypto.createPrivateKey(privatePem),
-    publicKey: crypto.createPublicKey(fs.readFileSync(path.join(ROOT, 'keys/ruvnet-brain-signing.pub.pem'), 'utf8')),
+    publicKey,
     hostVerifier: stagedHostVerifier({ assets, identity }),
   });
   if (finalReceipt.state !== 'channels-converged') throw new Error(`release transaction stopped at ${finalReceipt.state}`);
+  materializePublicationHandoff({ paths: publicationHandoffPaths, identity, receipt: finalReceipt, publicKey });
 } else {
   step('D', 'remote staged release transaction — SKIPPED (check-only; pass --publish to publish)');
 }
@@ -399,7 +408,6 @@ if (!PUBLISH) {
 
 if (PUBLISH) {
   console.log(`\n${c.y(c.b('PUBLISHED, NOT VERIFIED'))}`);
-  console.log(`\n${c.g(c.b('✓✓✓ SHIPPED'))} — every gate passed and every live channel is current. ${c.dim('A user on any path (npm, npx, explainer, --update) gets the working, current build.')}\n`);
 } else {
   console.log(`\n${c.g(c.b('✓✓✓ PREFLIGHT PASS — NOT PUBLISHED'))} — the committed candidate passed every check-only gate.\n`);
 }

package/scripts/source-coverage.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { readRvfGenerations, sha256File } from './rvf-generation.mjs';
 import { canonicalJson, coverageGenerationFor, digest, validateGistAggregateReceipt } from './coverage-integrity.mjs';
+import { repositoryNames } from '../kb/card-lane.mjs';
 
 export { canonicalJson, digest } from './coverage-integrity.mjs';
 
@@ -272,7 +273,15 @@ export function classifyGist(gist, evidence) {
   };
 }
 
-function artifactEvidence(kbDir, ledger, cardStores, name) {
+// ALIAS-AWARE, BECAUSE THE ROUTER IS. `cardStores` holds card HEADINGS; a store reachable only
+// under an alias (e.g. `metaharness` via its `## agent-harness-generator` card) has no heading of
+// its own, so a direct `cardStores.has(store)` reports it card-absent even though the router finds
+// it. `kb/store-root.mjs`'s `darkStores()` and `scripts/brain-score.mjs`'s `readCoverage()` were
+// already fixed for this exact conflation (ADR-058; metaharness is the standing example in both);
+// this sibling computation, which feeds the committed `data/source-coverage.json` and
+// `docs/RUVNET-COVERAGE.md` (ADR-069), never received it. `repositoryNames` is the router's own
+// resolver (kb/card-lane.mjs), imported rather than reimplemented.
+export function artifactEvidence(kbDir, ledger, cardStores, name) {
   const store = storeName(name);
   const receipt = Object.entries(ledger.stores).find(([key]) => key.toLowerCase() === store)?.[1] || null;
   const rvfFile = receipt?.file || `${store}.big.rvf`;
@@ -284,7 +293,7 @@ function artifactEvidence(kbDir, ledger, cardStores, name) {
     bytesVerified: Boolean(rvfPresent && receipt?.sha256 && sha256File(rvfPath) === receipt.sha256),
     passagesPresent: fs.existsSync(path.join(kbDir, `${store}.passages.jsonl`))
       && fs.statSync(path.join(kbDir, `${store}.passages.jsonl`)).size > 0,
-    cardPresent: cardStores.has(store),
+    cardPresent: repositoryNames(store, kbDir).some((alias) => cardStores.has(storeName(alias))),
   };
 }
 

package/scripts/staged-host-verifier.mjs

@@ -3,7 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { runHostMatrix } from './host-install-matrix.mjs';
+import { runHostMatrixAsync } from './host-install-matrix.mjs';
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const locate = (name) => {
@@ -50,7 +50,7 @@ export function stagedHostVerifier({ assets, identity }) {
         // install shape than the one that runs after publication — so the two halves of a release
         // were judging different things and could not be compared. Only the STAGED-vs-PUBLISHED
         // difference is real, and it is now a named variant rather than a second implementation.
-        const matrix = runHostMatrix({
+        const matrix = await runHostMatrixAsync({
           packageRoot: prepared.packageRoot,
           version: identity.version,
           variant: 'staged',

package/scripts/wired-check.mjs

@@ -95,6 +95,7 @@ const STANDALONE = [
     + 'RVFs to RVF-GENERATIONS.json and optionally prunes legacy sidecars; build-bundle.mjs consumes '
     + 'and validates the resulting manifest, so scheduling this destructive migration would be wrong'],
   ['release', 'the ship path, run by a human'],
+  ['execution-preflight', 'external orchestration boundary — invoked by the host before consequential Ruflo/Codex execution; no in-repo caller exists because the host supplies the live Brain and AgentDB receipts'],
   ['fix-workstream', 'session-supervised coordination CLI run explicitly by the integration owner or an '
     + 'isolated writing agent to start and hand off a fix lane. Scheduling it would violate its safety '
     + 'boundary: it prepares evidence but never merges, pushes, publishes, deletes, or cleans worktrees'],