ruvnet-brain 4.3.35 → 4.3.37

package/scripts/corpus-currency.mjs

@@ -0,0 +1,71 @@
+// scripts/corpus-currency.mjs — ADR-0091 D7.1: the honest content-currency block of manifest.json.
+//
+// There is no single honest "content as of" date for a corpus that mixes current and carried stores:
+// `builtUtc` is restamped to "now" every round (corpus-aggregates.mjs, refresh-capability-only-store.mjs)
+// and `manifest.generated` is the ASSEMBLY time. So the manifest reports what is actually known:
+//
+//   observedAt     when upstream heads were read (the sealed observation). Every CURRENT store equals
+//                  upstream as of that instant. null when nothing was observed (legacy/bootstrap path).
+//   generationTag  the corpus generation this archive was assembled FROM, when the build knows it (a
+//                  code release built from a published generation). null for a nightly candidate, whose
+//                  own tag is corpus-sha256-<this archive's sha256> and so cannot be written inside it.
+//   counts         eligible repository rows by status, plus fixture repositories RETIRED (no row at all
+//                  in a complete observation, scripts/fixture-denominator.mjs -- the one shared rule).
+//                  null when nothing was observed.
+//   oldestCarried  the carried (STALE + carry) store whose content is oldest. Its committedAt comes only
+//                  from carry.carriedCommittedAt; when any carried store's date is unknown the oldest
+//                  cannot be known, so an undated one is reported with committedAt null. Never estimated.
+//
+// Stated plainly, a surface reads it as "N of M repositories match upstream as of <observedAt>".
+
+import { retiredFixtureStores } from './fixture-denominator.mjs';
+
+export const CURRENCY_BASIS = Object.freeze({
+  SEALED: 'sealed-observation',
+  LEGACY: 'legacy-seed-projection-unobserved',
+  NONE: 'no-observation',
+});
+
+const isoOrNull = (value) => (typeof value === 'string' && Number.isFinite(Date.parse(value)) ? value : null);
+
+function oldestCarriedOf(rows) {
+  const carried = rows.filter((row) => row.status === 'STALE' && row.carry && typeof row.carry === 'object');
+  if (!carried.length) return null;
+  const byStore = (a, b) => String(a.artifact?.store).localeCompare(String(b.artifact?.store));
+  const undated = carried.filter((row) => isoOrNull(row.carry.carriedCommittedAt) === null).sort(byStore);
+  const pick = undated[0]
+    || [...carried].sort((a, b) => Date.parse(a.carry.carriedCommittedAt) - Date.parse(b.carry.carriedCommittedAt) || byStore(a, b))[0];
+  return {
+    store: pick.artifact?.store ?? null,
+    sourceCommit: pick.carry.carriedSourceCommit ?? null,
+    committedAt: isoOrNull(pick.carry.carriedCommittedAt),
+  };
+}
+
+/**
+ * `coverage`: the sealed ruvnet-brain-corpus-coverage this archive was bound to (already validated by
+ * the caller), or null. `basis` says why it is null. `fixtureStores`: the frozen fixture's stores, or
+ * null when the runtime has no fixture (then `retired` is null, not 0 -- unknown is not none).
+ */
+export function corpusCurrencyBlock({ coverage = null, basis, generationTag = null, fixtureStores = null }) {
+  if (!Object.values(CURRENCY_BASIS).includes(basis)) throw new Error(`unknown corpus currency basis ${basis}`);
+  if (basis !== CURRENCY_BASIS.SEALED || !coverage) {
+    return { basis, observedAt: null, generationTag: generationTag ?? null, counts: null, oldestCarried: null };
+  }
+  const eligible = (coverage.rows || []).filter((row) => row?.kind === 'repository' && row.disposition === 'eligible');
+  const count = (status) => eligible.filter((row) => row.status === status).length;
+  return {
+    basis,
+    observedAt: isoOrNull(coverage.observedAt),
+    generationTag: generationTag ?? null,
+    counts: {
+      eligible: eligible.length,
+      current: count('CURRENT'),
+      stale: count('STALE'),
+      missing: count('MISSING'),
+      unverified: count('UNVERIFIED'),
+      retired: fixtureStores ? retiredFixtureStores({ coverage, fixtureStores }).length : null,
+    },
+    oldestCarried: oldestCarriedOf(eligible),
+  };
+}

package/scripts/corpus-dispatch-decision.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+// scripts/corpus-dispatch-decision.mjs — the ONE decision the nightly corpus dispatcher makes.
+//
+// WHY A MODULE (2026-09-29 nightly redesign). The decision used to live as bash in
+// corpus-nightly-dispatch.yml and compared the approved runtime against main HEAD: whenever main
+// carried a commit newer than the newest install-verified release -- which under "every main commit
+// is a release" is exactly the window between a code release landing and its verification finishing,
+// and forever if that verification failed -- the nightly stood down, silently. The corpus is built at
+// the APPROVED runtime's own source, so main HEAD is irrelevant to it and is no longer consulted.
+//
+// decide() is pure and returns one of three verdicts:
+//   arm         dispatch protected-release mode=corpus at the approved release's sourceSha
+//   stand-down  a correct, quiet non-event (kill switch off, newest release not yet verified, or an
+//               approved runtime older than the first release whose pipeline understands this workflow)
+//   fail        evidence is present but does not hold -- loud, never a silent skip
+//
+// minPipelineVersion: the dispatched workflow text is always main's, but the scripts it runs come from
+// the approved release's checkout. A runtime older than MIN_PIPELINE_VERSION does not know the flags
+// the new workflow passes (--approved-tag, --no-change-out), so the nightly stands down rather than
+// let new workflow text drive old scripts.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export const MIN_PIPELINE_VERSION = '4.3.36'; // sync-version-ignore: a fixed pipeline floor, not the current version
+const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
+const HEX40 = /^[0-9a-f]{40}$/;
+const CODE_TAG = /^v\d+\.\d+\.\d+$/;
+// scripts/approved-runtime.mjs names the release it refused: "code release vX.Y.Z (the newest) carries ...".
+const REFUSED_NEWEST = /code release (v\d+\.\d+\.\d+) \(the newest\)/;
+
+/** -1 / 0 / 1; throws on anything that is not plain x.y.z. */
+export function compareVersions(left, right) {
+  const a = SEMVER.exec(String(left || ''));
+  const b = SEMVER.exec(String(right || ''));
+  if (!a || !b) throw new Error(`cannot compare versions ${JSON.stringify(left)} and ${JSON.stringify(right)}`);
+  for (let i = 1; i <= 3; i += 1) {
+    const delta = Number(a[i]) - Number(b[i]);
+    if (delta) return Math.sign(delta);
+  }
+  return 0;
+}
+
+/** The owner's kill switch: CORPUS_NIGHTLY reading `off` (any case, surrounding space ignored). */
+export function killSwitchOff(nightlyVar) {
+  return String(nightlyVar ?? '').trim().toLowerCase() === 'off';
+}
+
+/**
+ * @param nightlyVar   repository variable CORPUS_NIGHTLY (armed unless it reads `off`, any case; the owner's
+ *                     approval of the code release is the consent)
+ * @param resolution   { status: 'resolved', release: {tag, version, sourceSha} }
+ *                   | { status: 'not-yet-verified' } | { status: 'invalid', reason }
+ */
+export function decide({ nightlyVar, resolution, minPipelineVersion = MIN_PIPELINE_VERSION } = {}) {
+  if (killSwitchOff(nightlyVar)) {
+    return { verdict: 'stand-down', reason: 'repository variable CORPUS_NIGHTLY is off (the owner kill switch)' };
+  }
+  if (resolution?.status === 'not-yet-verified') {
+    return { verdict: 'stand-down', reason: 'the newest code release has not reached install-verified yet (no aggregate)' };
+  }
+  if (resolution?.status === 'invalid' && CODE_TAG.test(String(resolution.tag || ''))
+    && compareVersions(resolution.tag.slice(1), minPipelineVersion) < 0) {
+    // VERSION SKEW, not tampering (found 2026-09-29): this checkout's verifier is a newer generation
+    // than the newest release's aggregate (e.g. D7's retired-fixture denominator), so it cannot judge
+    // it. A runtime below the floor would stand down even if it verified, so standing down loses
+    // nothing -- and an aggregate that claims a runtime AT or above the floor still fails loud below.
+    return { verdict: 'stand-down', reason: `the newest code release ${resolution.tag} predates ${minPipelineVersion}; `
+      + `its install evidence is not judged by this pipeline (${resolution.reason || 'unverifiable here'})` };
+  }
+  if (resolution?.status !== 'resolved') {
+    return { verdict: 'fail', reason: `the newest code release carries install-verification evidence that does not hold: ${resolution?.reason || 'unknown resolution'}` };
+  }
+  const { tag, version, sourceSha } = resolution.release || {};
+  if (!SEMVER.test(String(version || '')) || tag !== `v${version}` || !HEX40.test(String(sourceSha || ''))) {
+    return { verdict: 'fail', reason: `resolved release identity is malformed (${JSON.stringify(resolution.release || null)})` };
+  }
+  if (compareVersions(version, minPipelineVersion) < 0) {
+    return { verdict: 'stand-down', reason: `approved runtime ${tag} predates ${minPipelineVersion}, the first release whose pipeline this workflow can drive` };
+  }
+  return { verdict: 'arm', reason: `building the corpus at approved runtime ${tag} @ ${sourceSha}`, tag, version, sourceSha };
+}
+
+/** approved-runtime.mjs --resolve's exit status + stdout (+ stderr, naming a refused release) -> a resolution. */
+export function resolutionFrom({ status, stdout, stderr = '' }) {
+  if (String(status) === '3') return { status: 'not-yet-verified' };
+  if (String(status) !== '0') {
+    const tag = REFUSED_NEWEST.exec(String(stderr))?.[1] ?? null;
+    const detail = String(stderr).split(': ').slice(-1)[0].trim().slice(0, 300);
+    return { status: 'invalid', tag, reason: `approved-runtime.mjs --resolve exited ${status}${detail ? ` (${detail})` : ''}` };
+  }
+  try {
+    const release = JSON.parse(String(stdout || ''));
+    return { status: 'resolved', release };
+  } catch (error) {
+    return { status: 'invalid', reason: `approved-runtime.mjs --resolve printed no release (${error.message})` };
+  }
+}
+
+const arg = (argv, name) => {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : undefined;
+};
+
+/**
+ * CLI: --nightly <value> --resolve-status <n|skipped> --release <file> [--resolve-stderr <file>]
+ *      --github-output <file>. Exit 1 only on `fail`.
+ *      --is-off <value>  prints true|false (lets the workflow skip the ~555 MB resolve when the switch is off)
+ */
+export function main(argv = process.argv.slice(2), { stdout = process.stdout } = {}) {
+  if (argv.includes('--is-off')) {
+    stdout.write(`${killSwitchOff(arg(argv, '--is-off'))}\n`);
+    return 0;
+  }
+  const nightlyVar = arg(argv, '--nightly') ?? '';
+  const status = arg(argv, '--resolve-status');
+  const releaseFile = arg(argv, '--release');
+  const stderrFile = arg(argv, '--resolve-stderr');
+  const githubOutput = arg(argv, '--github-output');
+  const resolution = status === 'skipped' ? null
+    : resolutionFrom({ status,
+      stdout: releaseFile && fs.existsSync(releaseFile) ? fs.readFileSync(releaseFile, 'utf8') : '',
+      stderr: stderrFile && fs.existsSync(stderrFile) ? fs.readFileSync(stderrFile, 'utf8') : '' });
+  const decision = decide({ nightlyVar, resolution });
+  const lines = decision.verdict === 'arm'
+    ? ['armed=true', `approved_sha=${decision.sourceSha}`, `approved_version=${decision.version}`, `approved_tag=${decision.tag}`]
+    : ['armed=false'];
+  lines.push(`verdict=${decision.verdict}`);
+  if (githubOutput) fs.appendFileSync(path.resolve(githubOutput), `${lines.join('\n')}\n`);
+  const annotation = decision.verdict === 'fail' ? '::error::' : '::notice::';
+  stdout.write(`${annotation}corpus-nightly-dispatch ${decision.verdict}: ${decision.reason}\n`);
+  return decision.verdict === 'fail' ? 1 : 0;
+}
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
+  process.exitCode = main();
+}

package/scripts/corpus-next-seed.mjs

@@ -43,9 +43,16 @@
 // re-checks sha256 and byte length before reconciliation, corpus-reconcile.mjs checks the ledger
 // schema after extraction, and corpus-candidate.mjs re-derives the whole candidate from the bytes).
 //
+// ADR-0091 D6: --require-coverage is the CODE-RELEASE mode (ci.yml's release-qe and warm-brain jobs,
+// and release.mjs's publish-time re-check). A code release assembles single-pass from the
+// generation's sealed coverage, so a generation that did not publish its coverage sidecar
+// (CORPUS-COVERAGE.json + coverage-receipt.json, D6.2) -- every generation published before D6 --
+// is skipped as incompatible FOR THAT PURPOSE, with its reason. It remains a valid nightly seed:
+// without the flag nothing about the nightly's selection changes.
+//
 // Usage:
 //   node scripts/corpus-next-seed.mjs --repo owner/name [--runtime-root <source tree>]
-//                                     [--bootstrap data/corpus-seed.json] [--out <file>]
+//                                     [--bootstrap data/corpus-seed.json] [--require-coverage] [--out <file>]
 
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -53,6 +60,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { COVERAGE_ASSET, COVERAGE_RECEIPT_ASSET, bindCoverageToReceipt, verifyCoverageSidecar } from './corpus-coverage-sidecar.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HEX64 = /^[0-9a-f]{64}$/;
@@ -110,11 +118,13 @@ export async function loadCompatibilityProfile({ runtimeRoot = ROOT, fixtureFile
     throw new Error(`${root} has no repo-recall reader to judge a seed with`);
   }
   const { model, dimensions } = parseBuildFingerprint(forge.FORGE_BUILD_FINGERPRINT);
+  const fixture = recall.loadFixture(fixtureFile || path.join(root, recall.DEFAULT_FIXTURE_FILE));
   return {
     runtimeRoot: root,
     model,
     dimensions,
-    fixtureSha256: recall.loadFixture(fixtureFile || path.join(root, recall.DEFAULT_FIXTURE_FILE)).fixtureSha256,
+    fixtureSha256: fixture.fixtureSha256,
+    fixtureStores: fixture.questions.map((question) => question.store),
     floorValue: recall.ABSOLUTE_FLOOR,
     readRecallReport: recall.readRecallReport,
   };
@@ -135,13 +145,18 @@ const sha256Of = (file) => crypto.createHash('sha256').update(fs.readFileSync(fi
  * recorded on `rejected` so a no-op night is explainable rather than silent. Never downloads the
  * archive: every check below reads the release's asset list, its receipt, or its recall report.
  */
-function judgeRelease({ run, repo, tag, digest, profile, rejected }) {
-  const reject = (reason) => { rejected.push({ tag, reason }); return null; };
+function judgeRelease({ run, repo, tag, digest, profile, rejected, requireCoverage = false }) {
+  // `indeterminate` marks a rejection that says nothing about the release itself -- the network or
+  // `gh` failed. A publish-time re-check (ADR-0091 D6.6) must not read one as "no newer generation".
+  const reject = (reason, { indeterminate = false } = {}) => {
+    rejected.push({ tag, reason, ...(indeterminate ? { indeterminate: true } : {}) });
+    return null;
+  };
   let view;
   try {
     view = ghJson(run, ['release', 'view', tag, '--repo', repo, '--json', 'tagName,isDraft,assets']);
   } catch (error) {
-    return reject(`release view failed (${error.message})`);
+    return reject(`release view failed (${error.message})`, { indeterminate: true });
   }
   if (view?.tagName !== tag || view.isDraft) return reject('release is a draft or names another tag');
   const assets = Array.isArray(view.assets) ? view.assets : [];
@@ -149,13 +164,17 @@ function judgeRelease({ run, repo, tag, digest, profile, rejected }) {
   for (const name of REQUIRED_ASSETS) {
     if (named(name).length !== 1) return reject(`unverified: expected exactly one ${name} asset`);
   }
+  if (requireCoverage && [COVERAGE_ASSET, COVERAGE_RECEIPT_ASSET].some((name) => named(name).length !== 1)) {
+    return reject(`incompatible for a code release: no coverage sidecar (${COVERAGE_ASSET} + ${COVERAGE_RECEIPT_ASSET}; `
+      + 'published before ADR-0091 D6.2)');
+  }
   const archive = named(ARCHIVE_ASSET)[0];
   if (!Number.isSafeInteger(archive.size) || archive.size < 1) return reject('unverified: archive asset has no usable byte length');
 
   const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'corpus-next-seed-'));
   try {
     const receiptFile = download(run, { repo, tag, pattern: RECEIPT_ASSET, dir: scratch });
-    if (!receiptFile) return reject('unverified: corpus receipt could not be downloaded');
+    if (!receiptFile) return reject('unverified: corpus receipt could not be downloaded', { indeterminate: true });
     let receipt;
     try { receipt = JSON.parse(fs.readFileSync(receiptFile, 'utf8')); }
     catch (error) { return reject(`unverified: corpus receipt unreadable (${error.message})`); }
@@ -192,16 +211,47 @@ function judgeRelease({ run, repo, tag, digest, profile, rejected }) {
     // D4 check 2 -- the recall report, the one small file that decides whether the downstream seed
     // re-check can pass. Downloaded only now, after the receipt already qualified.
     const recallFile = download(run, { repo, tag, pattern: RECALL_ASSET, dir: scratch });
-    if (!recallFile) return reject('unverified: repo-recall report could not be downloaded');
+    if (!recallFile) return reject('unverified: repo-recall report could not be downloaded', { indeterminate: true });
     if (sha256Of(recallFile) !== receipt.recallReport.sha256 || fs.statSync(recallFile).size !== receipt.recallReport.bytes) {
       return reject('unverified: repo-recall report is not the one the receipt binds');
     }
-    let claimedFixture = null;
-    try { claimedFixture = JSON.parse(fs.readFileSync(recallFile, 'utf8'))?.fixture?.sha256 ?? null; } catch { /* the reader names it below */ }
+    let claimed = null;
+    try { claimed = JSON.parse(fs.readFileSync(recallFile, 'utf8')); } catch { /* the reader names it below */ }
+    const claimedFixture = claimed?.fixture?.sha256 ?? null;
     if (claimedFixture !== profile.fixtureSha256) {
       return reject(`incompatible: recall report was measured against fixture ${String(claimedFixture).slice(0, 12)}, `
         + `this runtime's frozen fixture is ${profile.fixtureSha256.slice(0, 12)}`);
     }
+    // ADR-0091 D7.3: a report that claims retired questions is verified against the generation's own
+    // sealed coverage (its D6.2 sidecar), recomputed by the reader -- in the nightly mode too, or one
+    // retirement would push every night onto the bootstrap. No sidecar means the claim is unverifiable,
+    // and the generation is skipped.
+    const claimsRetirement = claimed?.retirement !== undefined;
+    if (claimsRetirement && !requireCoverage && [COVERAGE_ASSET, COVERAGE_RECEIPT_ASSET].some((name) => named(name).length !== 1)) {
+      return reject('incompatible: recall report claims retired question(s) but the generation published no coverage sidecar '
+        + `(${COVERAGE_ASSET} + ${COVERAGE_RECEIPT_ASSET}) to verify them against`);
+    }
+
+    // D6.2 -- the code-release mode's extra check, from two more small files: the sidecar must name
+    // THIS generation, bind THESE coverage bytes, and the coverage must describe this receipt's stores.
+    let coverage = null;
+    let coverageBytes = null;
+    if (requireCoverage || claimsRetirement) {
+      const sidecarFile = download(run, { repo, tag, pattern: COVERAGE_RECEIPT_ASSET, dir: scratch });
+      const coverageFile = sidecarFile && download(run, { repo, tag, pattern: COVERAGE_ASSET, dir: scratch });
+      if (!sidecarFile || !coverageFile) return reject('unverified: coverage sidecar could not be downloaded', { indeterminate: true });
+      try {
+        coverageBytes = fs.readFileSync(coverageFile);
+        const verified = verifyCoverageSidecar({ sidecar: JSON.parse(fs.readFileSync(sidecarFile, 'utf8')), coverageBytes,
+          generationTag: tag, archiveSha256: digest, archiveBytes: archive.size });
+        bindCoverageToReceipt({ coverage: verified.coverage, receipt });
+        coverage = { asset: COVERAGE_ASSET, sha256: sha256Of(coverageFile), bytes: coverageBytes.length,
+          receiptAsset: COVERAGE_RECEIPT_ASSET, receiptSha256: sha256Of(sidecarFile), degraded: verified.degraded };
+      } catch (error) {
+        return reject(`unverified: coverage sidecar does not bind this generation (${error.message})`);
+      }
+    }
+
     try {
       profile.readRecallReport({
         reportFile: recallFile,
@@ -210,6 +260,9 @@ function judgeRelease({ run, repo, tag, digest, profile, rejected }) {
         // The same bar corpus-seed.yml's seed re-check uses: a published seed is graded against the
         // fixed ABSOLUTE_FLOOR, never re-judged by a later, higher committed floor.
         floorValue: profile.floorValue,
+        // Ignored by a pre-D7 reader, which then fails closed on a retirement-bearing report's totals.
+        coverageBytes,
+        ...(profile.fixtureStores ? { fixtureStores: profile.fixtureStores } : {}),
       });
     } catch (error) {
       return reject(`incompatible: recall report fails this runtime's reader (${error.message})`);
@@ -221,6 +274,8 @@ function judgeRelease({ run, repo, tag, digest, profile, rejected }) {
       asset: ARCHIVE_ASSET,
       sha256: digest,
       bytes: archive.size,
+      // The nightly descriptor keeps its pre-D7 shape even when a retirement claim fetched the coverage.
+      ...(coverage && requireCoverage ? { coverage } : {}),
       sourceCommit: typeof receipt.builderSourceSha === 'string' ? receipt.builderSourceSha : null,
       // Informational only since D4: the runtime that BUILT the seed, which may be older than the
       // runtime about to consume it. Nothing gates on it.
@@ -233,7 +288,7 @@ function judgeRelease({ run, repo, tag, digest, profile, rejected }) {
 
 export async function resolveNextCorpusSeed({
   repo, run = defaultRun, root = ROOT, runtimeRoot = null, fixtureFile = null, bootstrapFile,
-  limit = 100, searchBound = SEARCH_BOUND, profile = null,
+  limit = 100, searchBound = SEARCH_BOUND, profile = null, requireCoverage = false,
 } = {}) {
   if (!/^[^/\s]+\/[^/\s]+$/.test(String(repo || ''))) throw new Error('--repo must be owner/name');
   if (!Number.isSafeInteger(searchBound) || searchBound < 1) throw new Error('search bound must be a positive integer');
@@ -250,7 +305,7 @@ export async function resolveNextCorpusSeed({
   try {
     listed = ghJson(run, ['release', 'list', '--repo', repo, '--limit', String(limit), '--json', 'tagName,isDraft,createdAt']) || [];
   } catch (error) {
-    rejected.push({ tag: null, reason: `release list failed (${error.message})` });
+    rejected.push({ tag: null, reason: `release list failed (${error.message})`, indeterminate: true });
   }
 
   // Every corpus-shaped tag that is NOT usable gets an explicit reason. A silently skipped row is
@@ -273,7 +328,8 @@ export async function resolveNextCorpusSeed({
   }
   const expects = { model: compatibility.model, dimensions: compatibility.dimensions, fixtureSha256: compatibility.fixtureSha256 };
   for (const candidate of judged) {
-    const resolved = judgeRelease({ run, repo, tag: candidate.tag, digest: candidate.digest, profile: compatibility, rejected });
+    const resolved = judgeRelease({ run, repo, tag: candidate.tag, digest: candidate.digest, profile: compatibility, rejected,
+      requireCoverage });
     if (resolved) return { seed: resolved, rejected, judged: judged.length, expects };
   }
 
@@ -311,6 +367,7 @@ export async function main(argv = process.argv.slice(2), { run = defaultRun, std
       runtimeRoot: arg(argv, '--runtime-root', null),
       fixtureFile: arg(argv, '--fixture', null),
       bootstrapFile: arg(argv, '--bootstrap', null),
+      requireCoverage: argv.includes('--require-coverage'),
       run,
     });
   } catch (error) {