ruvnet-brain 4.3.34 → 4.3.36

package/scripts/retrieval-canary.mjs

@@ -5,7 +5,8 @@ import crypto from 'node:crypto';
 import readline from 'node:readline';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { canonicalJson, digest, validateCoverageLedger } from './coverage-integrity.mjs';
+import { canonicalJson, digest, eligibleRepositoryStanding, validateCoverageLedger } from './coverage-integrity.mjs';
+import { fixtureDenominator } from './fixture-denominator.mjs';
 
 // Both release phases resolve against an explicit installed context, never the checkout.
 export async function resolveInstalledCanaryCitation({ kbDir, matched, expected, passageFileDigests = new Map() }) {
@@ -204,8 +205,10 @@ export function auditOracleCoverage({ coverage, queryEvidence, exemptions = null
   const checked = validateCoverageLedger(coverage);
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   validateRetrievalQueryEvidence(queryEvidence);
+  // ADR-0091 D5: a shipped store is CURRENT or STALE with a verified carry (its bytes ship). A
+  // MISSING-with-failure store ships nothing; the fixture-vs-available denominator is D6.4's change.
   const eligibleRows = coverage.rows.filter((row) => row.kind === 'repository'
-    && row.disposition === 'eligible' && row.status === 'CURRENT');
+    && row.disposition === 'eligible' && eligibleRepositoryStanding(row) === 'shipped');
   const eligible = ordered(eligibleRows.map(storeOf));
   if (!eligible.length || new Set(eligible).size !== eligible.length || eligible.some((store) => !store)) {
     throw new Error('eligible coverage denominator is invalid');
@@ -310,9 +313,20 @@ export function validateRetrievalCanaryPlan(plan) {
     'legacy population denominator');
   checkedSet(plan.denominator.legacySelectedStores, plan.denominator.legacySelectedStoreSetSha256,
     'legacy selected denominator');
+  // ADR-0091 D6.4: `eligibleStores` is the FROZEN FIXTURE denominator (it must equal the oracle's store
+  // set exactly, as before). Retired fixture stores are excluded from questioning; eligible stores the
+  // fixture does not cover are recorded, never questioned and never blocking.
+  checkedSet(plan.denominator.retiredFixtureStores, plan.denominator.retiredFixtureStoreSetSha256, 'retired fixture denominator');
+  checkedSet(plan.denominator.unfixturedEligibleStores, plan.denominator.unfixturedEligibleStoreSetSha256,
+    'unfixtured eligible record');
   if (setDigest(plan.denominator.eligibleStores) !== plan.oracle.queryStoreSetSha256) {
     throw new Error('oracle denominator differs from eligible coverage');
   }
+  if (plan.denominator.retiredFixtureStores.some((store) => !plan.denominator.eligibleStores.includes(store))
+    || plan.denominator.unfixturedEligibleStores.some((store) => plan.denominator.eligibleStores.includes(store))
+    || plan.denominator.unfixturedEligibleCount !== plan.denominator.unfixturedEligibleStores.length) {
+    throw new Error('retrieval canary fixture denominator is inconsistent');
+  }
   if (new Set(ids).size !== ids.length) throw new Error('retrieval canary plan has duplicate case ids');
   const hasDelta = plan.cases.some(({ cohort }) => cohort === 'delta');
   if ((!hasDelta && plan.noDelta !== true) || (hasDelta && plan.noDelta === true)
@@ -352,14 +366,18 @@ export function validatePlanAgainstCoverage(plan, coverage, { allowObservedBasel
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   const generation = coverage.kind === 'ruvnet-brain-release-coverage'
     ? coverage.releaseCoverageGeneration : coverage.coverageGeneration;
-  const eligible = ordered(coverage.rows.filter((row) => row.kind === 'repository'
-    && row.disposition === 'eligible' && row.status === 'CURRENT').map(storeOf));
-  if (!eligible.length || new Set(eligible).size !== eligible.length) throw new Error('eligible coverage denominator is invalid');
+  // Recomputed from the coverage and the plan's own sealed fixture, never trusted from the plan.
+  const denominator = fixtureDenominator({ coverage, fixtureStores: Object.keys(plan.oracle.evidence.queries) });
+  if (denominator.blocking.length) throw new Error(`fixture store(s) neither available nor retired: ${denominator.blocking.map(({ store }) => store).join(', ')}`);
+  const eligible = denominator.questioned;
+  if (!eligible.length) throw new Error('eligible coverage denominator is invalid');
   const baseline = new Set(plan.baseline.stores);
   const delta = eligible.filter((store) => !baseline.has(store));
   const legacy = eligible.filter((store) => baseline.has(store));
   if (generation !== plan.coverage.releaseCoverageGeneration
-    || canonicalJson(eligible) !== canonicalJson(plan.denominator.eligibleStores)
+    || canonicalJson(denominator.fixture) !== canonicalJson(plan.denominator.eligibleStores)
+    || canonicalJson(denominator.retired) !== canonicalJson(plan.denominator.retiredFixtureStores)
+    || canonicalJson(denominator.unfixturedEligible) !== canonicalJson(plan.denominator.unfixturedEligibleStores)
     || canonicalJson(delta) !== canonicalJson(plan.denominator.deltaStores)
     || canonicalJson(legacy) !== canonicalJson(plan.denominator.legacyPopulationStores)
     || plan.denominator.legacySelectedStores.some((store) => !legacy.includes(store))) {
@@ -417,20 +435,19 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
   }
   validateRetrievalQueryEvidence(queryEvidence);
   if (queryEvidence.sourceCommit === candidate.sourceSha) throw new Error('independent query source is not pre-candidate');
-  const eligible = coverage.rows.filter((row) => row.kind === 'repository' && row.disposition === 'eligible');
-  if (!eligible.length || eligible.some((row) => row.status !== 'CURRENT' || !storeOf(row))) {
-    throw new Error('eligible repository coverage is incomplete');
-  }
-  const duplicateStores = eligible.map(storeOf).filter((store, index, stores) => stores.indexOf(store) !== index);
-  if (duplicateStores.length) throw new Error(`eligible repository stores are duplicated: ${ordered(new Set(duplicateStores)).join(', ')}`);
-  const eligibleStores = ordered(eligible.map(storeOf));
-  if (queryEvidence.queryStoreSetSha256 !== setDigest(eligibleStores)
-    || canonicalJson(ordered(Object.keys(queryEvidence.queries))) !== canonicalJson(eligibleStores)) {
-    const oracleStores = new Set(Object.keys(queryEvidence.queries));
-    const missing = eligibleStores.filter((store) => !oracleStores.has(store));
-    const extra = [...oracleStores].filter((store) => !eligibleStores.includes(store)).sort();
-    throw new Error(`independent query oracle does not cover the exact eligible store set (eligible=${eligibleStores.length}, oracle=${oracleStores.size}, missing=${missing.join(',') || 'none'}, extra=${extra.join(',') || 'none'})`);
-  }
+  // ADR-0091 D6.4: fixture ⊆ available. The frozen fixture no longer has to EQUAL a living eligible
+  // set; every fixture store must ship (or be verified retired), and eligible stores the fixture does
+  // not cover are recorded as unfixturedEligible, never blocking.
+  let denominator;
+  try { denominator = fixtureDenominator({ coverage, fixtureStores: Object.keys(queryEvidence.queries) }); }
+  catch (error) { throw new Error(`eligible repository coverage is incomplete (${error.message})`); }
+  if (denominator.blocking.length) {
+    throw new Error(`independent query oracle names ${denominator.blocking.length} fixture store(s) that are neither shipped nor `
+      + `verified retired: ${denominator.blocking.map(({ store, status }) => `${store}:${status ?? 'no-row'}`).join(', ')}`);
+  }
+  const eligibleStores = denominator.fixture;
+  const eligible = denominator.questionedRows;
+  if (!eligible.length) throw new Error('eligible repository coverage is incomplete');
   const baselineStores = new Set(baseline.stores.map((name) => String(name).toLowerCase()));
   const delta = eligible.filter((row) => !baselineStores.has(storeOf(row)));
   const legacyPool = eligible.filter((row) => baselineStores.has(storeOf(row)));
@@ -502,6 +519,11 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
     denominator: {
       eligibleStores,
       eligibleStoreSetSha256: setDigest(eligibleStores),
+      retiredFixtureStores: denominator.retired,
+      retiredFixtureStoreSetSha256: setDigest(denominator.retired),
+      unfixturedEligibleStores: denominator.unfixturedEligible,
+      unfixturedEligibleStoreSetSha256: setDigest(denominator.unfixturedEligible),
+      unfixturedEligibleCount: denominator.unfixturedEligible.length,
       deltaStores: ordered(delta.map(storeOf)),
       deltaStoreSetSha256: setDigest(delta.map(storeOf)),
       legacyPopulationStores: ordered(legacyPool.map(storeOf)),

package/scripts/single-source-check.mjs

@@ -133,8 +133,21 @@ const checks = [
     } },
 
   // C — one release path
-  { id: 'C1', area: 'release', scope: 'repo', title: 'Unattended corpus promotion stays disarmed until a code release is install-verified',
-    run: () => ({ ok: !tracked.includes('data/approved-runtime.json'), detail: tracked.includes('data/approved-runtime.json') ? 'data/approved-runtime.json present (arms the 07:17 UTC nightly)' : 'absent' }) },
+  // ADR-0091 D3: the approved runtime is RESOLVED at run time from the newest install-verified code
+  // release (its signed public-verification aggregate), never committed; the nightly is armed only by
+  // the CORPUS_NIGHTLY repository variable. A committed pin, or a workflow still reading one, is drift.
+  { id: 'C1', area: 'release', scope: 'repo', title: 'Corpus promotion resolves its runtime pin from an install-verified release at run time; nothing commits one',
+    run: () => {
+      const problems = [];
+      if (tracked.includes('data/approved-runtime.json')) problems.push('data/approved-runtime.json is committed (the pin must be resolved, never committed)');
+      for (const w of workflows) if (read(w).includes('data/approved-runtime.json')) problems.push(`${w} still reads data/approved-runtime.json`);
+      const dispatcher = read('.github/workflows/corpus-nightly-dispatch.yml');
+      if (!/vars\.CORPUS_NIGHTLY/.test(dispatcher)) problems.push('corpus-nightly-dispatch.yml is not gated on the CORPUS_NIGHTLY repository variable');
+      for (const w of ['corpus-nightly-dispatch.yml', 'protected-release.yml', 'corpus-seed.yml']) {
+        if (!read(`.github/workflows/${w}`).includes('approved-runtime.mjs --resolve')) problems.push(`${w} does not resolve the approved runtime`);
+      }
+      return none(problems);
+    } },
   { id: 'C2', area: 'release', scope: 'repo', title: 'Every scheduled workflow pages the phone on failure',
     run: () => {
       const alerts = read('.github/workflows/ntfy-alerts.yml');

package/scripts/source-coverage.mjs

@@ -341,7 +341,13 @@ function assertExclusionEvidence(repo, exclusion, upstreamSha) {
   }
 }
 
-export function classifyRepository(repo, evidence, exclusion = null) {
+// ADR-0091 D5: `outcome` is what reconciliation recorded for this store when its refresh FAILED this
+// generation -- { carry } (previous bytes kept, already re-hashed against the ledger), { failure } (no
+// prior bytes), or { integrity } (carried bytes failed that re-hash). The status token is always the
+// one the evidence proves; the record is attached only where it agrees with that status, so a carry
+// can never dress up a row the bytes do not support. Rows are annotated BEFORE sealing, so the
+// coverage generation digest covers them.
+export function classifyRepository(repo, evidence, exclusion = null, outcome = null) {
   const upstreamSha = repo.defaultBranchRef?.target?.oid || null;
   const activeExclusion = Boolean(exclusion && String(exclusion.pushedAt || '') !== ''
     && String(exclusion.pushedAt) === String(repo.pushedAt || ''));
@@ -373,6 +379,14 @@ export function classifyRepository(repo, evidence, exclusion = null) {
   else if (evidence.receipt.sourceCommit !== upstreamSha) { status = 'STALE'; reasons.push('receipt sourceCommit differs from upstream HEAD'); }
   else if (!evidence.bytesVerified) { status = 'FAILED'; reasons.push('RVF bytes do not match receipt'); }
   else if (!evidence.passagesPresent) { status = 'FAILED'; reasons.push('passage inventory is absent'); }
+  const disposed = isIngestibleDisposition(disposition);
+  if (disposed && outcome?.integrity && ['CURRENT', 'STALE'].includes(status)) {
+    status = 'FAILED';
+    reasons.push(outcome.integrity);
+  }
+  const record = {};
+  if (disposed && outcome?.carry && status === 'STALE') record.carry = { ...outcome.carry };
+  if (disposed && outcome?.failure && status === 'MISSING') record.failure = { ...outcome.failure };
   return {
     key: repo.fullName ? `repo:${repo.fullName.toLowerCase()}` : `repo:${repo.databaseId}`,
     kind: 'repository',
@@ -391,6 +405,7 @@ export function classifyRepository(repo, evidence, exclusion = null) {
       cardPresent: evidence.cardPresent },
     status,
     reasons,
+    ...record,
   };
 }
 
@@ -567,7 +582,7 @@ export function explainCoverageDrift(recorded, current) {
 // where they are source-controlled (`<repo>/kb`) unless the caller names both directories, as the
 // release path does with `--assets`.
 export function buildCoverage({ owner = 'ruvnet', env = process.env, home = os.homedir(), kbDir = null, policyDir = null,
-  observation = null, gh = runGh, now = () => new Date().toISOString() } = {}) {
+  observation = null, gh = runGh, now = () => new Date().toISOString(), storeOutcomes = null } = {}) {
   policyDir ??= kbDir ?? path.join(ROOT, 'kb');
   kbDir ??= storeRoot(env, home);
   if (rootNeverMaterialized(kbDir)) {
@@ -597,7 +612,8 @@ export function buildCoverage({ owner = 'ruvnet', env = process.env, home = os.h
   const exclusions = fs.existsSync(exclusionsPath) ? JSON.parse(fs.readFileSync(exclusionsPath, 'utf8')) : {};
   const rows = repositories.rows.map((repo) => {
     const store = storeName(repo.storeName || repo.name);
-    return classifyRepository(repo, artifactEvidence(kbDir, ledger, cardStores, store), exclusions[store] || null);
+    return classifyRepository(repo, artifactEvidence(kbDir, ledger, cardStores, store), exclusions[store] || null,
+      storeOutcomes?.[store.toLowerCase()] || null);
   });
   const gistEvidence = { ...artifactEvidence(kbDir, ledger, cardStores, 'ruv-gists'), sources: gistSources };
   try {