ruvnet-brain 4.3.8 → 4.3.10

package/scripts/product-integrity-contract.mjs

@@ -43,7 +43,7 @@ const make = (id, statement, owner, contributors, implementation, tests, receipt
 export const PRODUCT_INTEGRITY_OBLIGATIONS = Object.freeze([
   make('S-1', 'One complete public corpus', 'CorpusGeneration', ['SourceCoverage'], ['scripts/source-coverage.mjs', 'scripts/corpus-reconcile.mjs', 'scripts/corpus-candidate.mjs'], ['tests/unit/source-coverage.test.mjs', 'tests/unit/corpus-reconcile.test.mjs'], ['ruvnet-brain-source-observation', 'ruvnet-brain-corpus-candidate']),
   make('S-2', 'One immutable public release projection', 'ReleaseProjection', ['CorpusGeneration'], ['scripts/build-bundle.mjs', 'scripts/coverage-integrity.mjs', 'scripts/public-inventory.mjs'], ['tests/integration/build-bundle-fence.test.mjs', 'tests/unit/public-inventory.test.mjs'], ['ruvnet-brain-release-coverage']),
-  make('S-3', 'Recall at 10 is at least 98 percent and delta citations are complete', 'PublicVerification', ['SourceCoverage', 'CorpusGeneration'], ['scripts/retrieval-canary.mjs', 'scripts/packed-retrieval-canary.mjs'], ['tests/unit/retrieval-canary.test.mjs', 'tests/unit/packed-retrieval-canary.test.mjs'], ['ruvnet-brain-retrieval-canary-plan', 'ruvnet-brain-retrieval-canary-receipt']),
+  make('S-3', 'Recall at 10 is at least 98 percent and delta citations are complete', 'PublicVerification', ['SourceCoverage', 'CorpusGeneration'], ['scripts/retrieval-canary.mjs', 'scripts/candidate-host-evidence.mjs', 'scripts/prepublication-evidence.mjs', 'scripts/host-install-matrix.mjs', 'kb/retrieval-result.mjs'], ['tests/unit/retrieval-canary.test.mjs', 'tests/unit/candidate-host-evidence.test.mjs', 'tests/unit/candidate-retrieval-matrix.test.mjs', 'tests/unit/retrieval-result-boundary.test.mjs'], ['ruvnet-brain-retrieval-canary-plan', 'ruvnet-brain-retrieval-canary-receipt']),
   make('S-4', 'Native nightly runs are ordered, idempotent, and retained within budget', 'RefreshLifecycle', [], ['bin/nightly-refresh.mjs', 'plugin/scripts/nightly-scheduler.mjs', 'scripts/nightly-two-run-proof.mjs', 'kb/refresh-run.mjs'], ['tests/unit/nightly-scheduler.test.mjs', 'tests/unit/nightly-two-run-proof.test.mjs'], ['ruvnet-brain-refresh-run', 'ruvnet-brain-native-two-run-nightly-proof']),
   make('S-5', 'One active corpus preserves private stores and bounded recovery', 'RefreshLifecycle', ['CorpusGeneration'], ['kb/update-storage-transaction.mjs', 'kb/forge-update.mjs', 'kb/brain-profile.mjs', 'bin/install.mjs'], ['tests/unit/update-storage-transaction.test.mjs', 'tests/unit/brain-profile.test.mjs'], ['ruvnet-brain-update-storage-transaction', 'ruvnet-brain-installed-profile']),
   make('S-6', 'Every supported OS and host loader converges on exact public bytes', 'HostConvergence', ['PublicVerification'], ['scripts/host-registry.mjs', 'scripts/host-install-matrix.mjs', 'scripts/public-verification-aggregate.mjs'], ['tests/unit/host-registry.test.mjs', 'tests/integration/dual-host-install.test.mjs'], ['ruvnet-brain-host-registry', 'ruvnet-brain-public-verification-leaf']),
@@ -141,9 +141,29 @@ export function renderProductIntegrityTraceMarkdown(contract = validateProductIn
 }
 const valueAfter = (argv, flag) => { const index = argv.indexOf(flag); return index >= 0 ? argv[index + 1] : null; };
 export function runProductIntegrityCli(argv = process.argv.slice(2), io = { stdout: process.stdout }) {
-  const known = new Set(['--markdown', '--check-markdown', '--trace', '--source-sha', '--out', '--verify-trace']);
+  const known = new Set(['--markdown', '--check-markdown', '--check-source', '--trace', '--source-sha', '--out', '--verify-trace']);
   if (argv.some((arg) => arg.startsWith('--') && !known.has(arg))) throw new Error('unknown product integrity argument');
   if (!argv.length) { io.stdout.write(`${canonicalJson(validateProductIntegrityContract())}\n`); return 0; }
+  if (argv.length === 1 && argv[0] === '--check-source') {
+    const root = fs.realpathSync(io.root || fileURLToPath(new URL('..', import.meta.url)));
+    const missing = [], invalid = [];
+    const files = productIntegrityGovernedPaths();
+    for (const file of files) {
+      const absolute = path.join(root, file);
+      try {
+        const stat = fs.lstatSync(absolute);
+        const relative = path.relative(root, fs.realpathSync(absolute));
+        if (!stat.isFile() || stat.isSymbolicLink() || relative.startsWith(`..${path.sep}`)
+          || relative === '..' || path.isAbsolute(relative)) invalid.push(file);
+      } catch (error) {
+        (error.code === 'ENOENT' ? missing : invalid).push(file);
+      }
+    }
+    const verdict = missing.length || invalid.length ? 'FAIL' : 'PASS';
+    io.stdout.write(`${canonicalJson({ verdict, scope: 'source-presence', behaviorVerified: false,
+      checked: files.length, missing, invalid })}\n`);
+    return verdict === 'PASS' ? 0 : 1;
+  }
   if (argv.length === 1 && argv[0] === '--markdown') { io.stdout.write(renderProductIntegrityTraceMarkdown()); return 0; }
   const check = valueAfter(argv, '--check-markdown');
   if (check) { if (fs.readFileSync(path.resolve(check), 'utf8') !== renderProductIntegrityTraceMarkdown()) throw new Error('generated traceability Markdown differs'); io.stdout.write('product integrity Markdown: PASS\n'); return 0; }

package/scripts/public-verification-abandon.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { extractZip } from '../kb/zip-extract.mjs';
+import { abandonPublicVerificationTransaction } from './release-transaction.mjs';
+import { liveReleaseProvider } from './release-transaction-provider.mjs';
+
+function regularJson(file, max = 131072) {
+  const stat = fs.lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > max) throw new Error('untrusted or oversized closure input');
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+const api = (endpoint) => JSON.parse(execFileSync('gh', ['api', endpoint], { encoding: 'utf8', timeout: 30000 }));
+
+export function closureProvenance({ event, env, identity, failure, run, artifact, workflow }) {
+  const input = event.client_payload;
+  if (env.GITHUB_EVENT_NAME !== 'repository_dispatch' || event.action !== 'abandon-public-verification'
+    || event.sender?.login !== env.GITHUB_ACTOR || event.repository?.full_name !== identity.repository
+    || env.GITHUB_REPOSITORY !== identity.repository || input?.authorization !== 'abandon-published-not-verified') {
+    throw new Error('closure requires the explicitly authorized abandonment dispatch');
+  }
+  if (run.event !== 'repository_dispatch' || !Number.isSafeInteger(run.repository?.id)
+    || run.repository.id !== event.repository.id || run.head_repository?.id !== run.repository.id
+    || run.head_repository?.full_name !== identity.repository
+    || !Number.isSafeInteger(workflow?.id) || run.workflow_id !== workflow.id || workflow.path !== run.path
+    || run.id !== input.recovery_run_id || run.status !== 'completed' || run.conclusion !== 'failure'
+    || run.path !== '.github/workflows/recover-public-verification.yml'
+    || run.repository?.full_name !== identity.repository || !/^[a-f0-9]{40}$/.test(run.head_sha || '')
+    || artifact.id !== input.failure_artifact_id || artifact.expired !== false
+    || artifact.workflow_run?.id !== run.id || artifact.workflow_run?.head_sha !== run.head_sha
+    || artifact.name !== `recovered-public-verification-${failure.os}-${identity.candidateSha}-${run.id}`) {
+    throw new Error('GitHub failed-run artifact provenance mismatch');
+  }
+  return {
+    expected: input.expected,
+    reason: input.reason,
+    authorization: { actor: env.GITHUB_ACTOR, reference: input.authorization_reference,
+      event: env.GITHUB_EVENT_NAME, action: event.action,
+      dispatchRunId: Number(env.GITHUB_RUN_ID), verifierSha: env.GITHUB_SHA },
+    recovery: { repository: identity.repository, workflow: run.path, workflowId: workflow.id, repositoryId: run.repository.id, event: run.event, runId: run.id,
+      verifierSha: run.head_sha, conclusion: run.conclusion, artifactId: artifact.id, artifactName: artifact.name },
+  };
+}
+
+// Download the named GitHub artifact independently; a local JSON lookalike is not provenance.
+async function failureFromArtifact(repository, artifactId) {
+  if (!Number.isSafeInteger(artifactId) || artifactId <= 0) throw new Error('invalid failed artifact ID');
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'abandon-failed-artifact-'));
+  try {
+    const zip = path.join(temp, 'failure.zip');
+    fs.writeFileSync(zip, execFileSync('gh', ['api', `repos/${repository}/actions/artifacts/${artifactId}/zip`],
+      { encoding: null, timeout: 60000, maxBuffer: 2 * 1024 * 1024 }), { flag: 'wx' });
+    const output = path.join(temp, 'contents');
+    const extracted = await extractZip(zip, output);
+    if (extracted.entryNames.length !== 1 || !/^(linux|macos|windows)\.json$/.test(extracted.entryNames[0])) {
+      throw new Error('failure artifact must contain exactly one OS failure receipt');
+    }
+    return regularJson(path.join(output, extracted.entryNames[0]));
+  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
+}
+
+export async function abandonPublicVerification({ identityFile, outputFile, env = process.env,
+  readApi = api, readFailure = failureFromArtifact, adapter = liveReleaseProvider({ root: process.cwd() }),
+  publicKeyFile = 'keys/ruvnet-brain-signing.pub.pem' } = {}) {
+  if (!identityFile || !outputFile || !env.GITHUB_EVENT_PATH || !env.RUVNET_SIGNING_KEY) {
+    throw new Error('identity, output, dispatch event, and signing key are required');
+  }
+  if (fs.existsSync(outputFile)) throw new Error('refusing to overwrite closure output');
+  const identity = regularJson(identityFile);
+  if (identity.repository !== 'stuinfla/ruvnet-brain' || identity.package !== 'ruvnet-brain') throw new Error('unexpected release repository');
+  const event = regularJson(env.GITHUB_EVENT_PATH);
+  const input = event.client_payload;
+  if (![input?.recovery_run_id, input?.failure_artifact_id].every((id) => Number.isSafeInteger(id) && id > 0)) {
+    throw new Error('explicit recovery run and failed artifact IDs are required');
+  }
+  const run = await readApi(`repos/${identity.repository}/actions/runs/${input.recovery_run_id}`);
+  const artifact = await readApi(`repos/${identity.repository}/actions/artifacts/${input.failure_artifact_id}`);
+  const workflow = await readApi(`repos/${identity.repository}/actions/workflows/recover-public-verification.yml`);
+  const failure = await readFailure(identity.repository, input.failure_artifact_id);
+  const provenance = closureProvenance({ event, env, identity, failure, run, artifact, workflow });
+  const receipt = await abandonPublicVerificationTransaction({ identity, failure, ...provenance, adapter,
+    privateKey: crypto.createPrivateKey(env.RUVNET_SIGNING_KEY),
+    publicKey: crypto.createPublicKey(fs.readFileSync(publicKeyFile, 'utf8')) });
+  fs.mkdirSync(path.dirname(path.resolve(outputFile)), { recursive: true });
+  fs.writeFileSync(outputFile, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+  return receipt;
+}
+
+const direct = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (direct) {
+  const arg = (name) => { const index = process.argv.indexOf(name); return index < 0 ? null : process.argv[index + 1]; };
+  try {
+    const receipt = await abandonPublicVerification({ identityFile: arg('--identity'), outputFile: arg('--out') });
+    console.log(JSON.stringify({ state: receipt.state, verdict: receipt.observation.verdict,
+      transactionId: receipt.transactionId, sequence: receipt.sequence, receiptDigest: receipt.receiptDigest }));
+  } catch (error) { console.error(`public-verification-abandon: ${error.message}`); process.exitCode = 1; }
+}

package/scripts/public-verification-aggregate.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { canonicalJson, digest } from './coverage-integrity.mjs';
 import { retrievalOracleExpectationFromPlan, validateRetrievalOracleReview } from './independent-review-receipt.mjs';
 import { validateRetrievalCanaryPlan, validateRetrievalCanaryReceipt } from './retrieval-canary.mjs';
+import { validateNightlyProofReceipt } from './nightly-two-run-proof.mjs';
 
 export const PUBLIC_VERIFICATION_OS = Object.freeze(['linux', 'macos', 'windows']);
 export const PUBLIC_VERIFICATION_MODES = Object.freeze(['claude', 'codex', 'dual']);
@@ -19,7 +20,10 @@ function unsignedLeaf(leaf) {
   return payload;
 }
 
-export function validatePublicVerificationLeaf(leaf) {
+export function validatePublicVerificationLeaf(leaf, { publicKey } = {}) {
+  if (Object.hasOwn(leaf || {}, 'verifierSha') && !HEX40.test(String(leaf.verifierSha))) {
+    throw new Error('public verification leaf verifier SHA is invalid');
+  }
   if (leaf?.schemaVersion !== 1 || leaf?.kind !== 'ruvnet-brain-public-verification-leaf'
     || !PUBLIC_VERIFICATION_OS.includes(leaf.os) || !PUBLIC_VERIFICATION_MODES.includes(leaf.mode)
     || !HEX40.test(String(leaf.sourceSha || '')) || !HEX64.test(String(leaf.artifactSha256 || ''))
@@ -49,12 +53,23 @@ export function validatePublicVerificationLeaf(leaf) {
     || retrieval.coverageGeneration !== leaf.coverageGeneration || retrieval.planSha256 !== leaf.canaryPlanSha256) {
     throw new Error(`${leaf.os}/${leaf.mode} retrieval identity differs`);
   }
+  if (leaf.mode === 'dual') {
+    if (!/^[1-9][0-9]*$/.test(String(leaf.workflowRunId || ''))) throw new Error('native nightly workflow run identity is missing');
+    const native = validateNightlyProofReceipt(leaf.nativeNightly, {
+      platform: { linux: 'linux', macos: 'darwin', windows: 'win32' }[leaf.os],
+      version: leaf.version, sourceSha: leaf.sourceSha, workflowRunId: leaf.workflowRunId,
+      packageSha256: leaf.artifactSha256, bundleSha256: leaf.bundleSha256, publicKey,
+    });
+    if (!native.ok) throw new Error(`${leaf.os}/dual native nightly proof failed: ${native.failures.join('; ')}`);
+  } else if (leaf.nativeNightly !== undefined) {
+    throw new Error('native nightly proof belongs only to the dual-host leaf');
+  }
   return leaf;
 }
 
-export function createPublicVerificationLeaf(input) {
+export function createPublicVerificationLeaf(input, options = {}) {
   const payload = { schemaVersion: 1, kind: 'ruvnet-brain-public-verification-leaf', ...input };
-  return validatePublicVerificationLeaf({ ...payload, leafSha256: digest(payload) });
+  return validatePublicVerificationLeaf({ ...payload, leafSha256: digest(payload) }, options);
 }
 
 function aggregatePayload(aggregate) {
@@ -122,6 +137,7 @@ function validateReviewOracleAgainstPlan(review, retrievalPlan) {
 
 const identityOf = (leaf) => ({
   sourceSha: leaf.sourceSha,
+  ...(Object.hasOwn(leaf, 'verifierSha') ? { verifierSha: leaf.verifierSha } : {}),
   version: leaf.version,
   tag: leaf.tag,
   artifactSha256: leaf.artifactSha256,
@@ -133,11 +149,13 @@ const identityOf = (leaf) => ({
   releaseTransactionId: leaf.releaseTransactionId,
 });
 
-export function buildPublicVerificationAggregate(leaves) {
+export function buildPublicVerificationAggregate(leaves, options = {}) {
   if (!Array.isArray(leaves) || leaves.length !== PUBLIC_VERIFICATION_OS.length * PUBLIC_VERIFICATION_MODES.length) {
     throw new Error('public verification requires exactly nine leaves');
   }
-  leaves.forEach(validatePublicVerificationLeaf);
+  leaves.forEach((leaf) => validatePublicVerificationLeaf(leaf, options));
+  const nativeRunIds = new Set(leaves.filter((leaf) => leaf.mode === 'dual').map((leaf) => String(leaf.workflowRunId)));
+  if (nativeRunIds.size !== 1) throw new Error('native nightly proofs span different workflow runs');
   const byLane = new Map(leaves.map((leaf) => [`${leaf.os}/${leaf.mode}`, leaf]));
   const required = PUBLIC_VERIFICATION_OS.flatMap((os) => PUBLIC_VERIFICATION_MODES.map((mode) => `${os}/${mode}`));
   if (byLane.size !== required.length || required.some((lane) => !byLane.has(lane))) {
@@ -178,6 +196,7 @@ export function buildPublicVerificationAggregate(leaves) {
     schemaVersion: 1,
     kind: 'ruvnet-brain-public-verification-aggregate',
     identity,
+    workflowRunId: [...nativeRunIds][0],
     coverage: first.coverage,
     lanes: required.map((lane) => ({ lane, leafSha256: byLane.get(lane).leafSha256 })),
     evidence: { leaves: required.map((lane) => structuredClone(byLane.get(lane))) },
@@ -193,7 +212,7 @@ export function buildPublicVerificationAggregate(leaves) {
 }
 
 export function signPublicVerificationAggregate({ leaves }, privateKey) {
-  const payload = buildPublicVerificationAggregate(leaves);
+  const payload = buildPublicVerificationAggregate(leaves, { publicKey: crypto.createPublicKey(privateKey) });
   const aggregateSha256 = digest(payload);
   const signed = { ...payload, aggregateSha256 };
   return { ...signed, signature: crypto.sign(null, Buffer.from(canonicalJson(signed)), privateKey).toString('base64') };
@@ -210,14 +229,14 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
   if (!Array.isArray(aggregate.evidence?.leaves)) {
     throw new Error('public verification aggregate lacks raw leaf evidence');
   }
-  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves);
-  if (canonicalJson(rebuilt) !== canonicalJson(payload)) {
-    throw new Error('public verification aggregate differs from rebuilt raw evidence');
-  }
   const signed = { ...payload, aggregateSha256: aggregate.aggregateSha256 };
   if (!crypto.verify(null, Buffer.from(canonicalJson(signed)), publicKey, Buffer.from(aggregate.signature, 'base64'))) {
     throw new Error('public verification aggregate signature mismatch');
   }
+  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves, { publicKey });
+  if (canonicalJson(rebuilt) !== canonicalJson(payload)) {
+    throw new Error('public verification aggregate differs from rebuilt raw evidence');
+  }
   const required = PUBLIC_VERIFICATION_OS.flatMap((os) => PUBLIC_VERIFICATION_MODES.map((mode) => `${os}/${mode}`));
   if (aggregate.lanes?.length !== required.length || new Set(aggregate.lanes.map(({ lane }) => lane)).size !== required.length
     || required.some((lane) => !aggregate.lanes.some((row) => row.lane === lane && HEX64.test(String(row.leafSha256 || ''))))) {
@@ -234,7 +253,11 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
     || aggregate.retrievalOracle?.recordCount !== aggregate.evidence.leaves[0].retrievalPlan.denominator.eligibleStores.length) {
     throw new Error('public verification aggregate retrieval oracle identity is incomplete');
   }
-  if (expectedIdentity && canonicalJson(aggregate.identity) !== canonicalJson(expectedIdentity)) {
+  if (expectedIdentity?.workflowRunId !== undefined && String(expectedIdentity.workflowRunId) !== aggregate.workflowRunId) {
+    throw new Error('public verification aggregate workflow run differs from the expected run');
+  }
+  const { workflowRunId: _expectedRun, ...expectedReleaseIdentity } = expectedIdentity || {};
+  if (expectedIdentity && canonicalJson(aggregate.identity) !== canonicalJson(expectedReleaseIdentity)) {
     throw new Error('public verification aggregate identity differs from the release transaction');
   }
   return aggregate;
@@ -245,13 +268,13 @@ function parseCliArgs(argv) {
   for (let index = 0; index < argv.length; index += 2) {
     const flag = argv[index];
     const value = argv[index + 1];
-    if (!['--lanes', '--out'].includes(flag) || !value) {
-      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
+    if (!['--lanes', '--out', '--verifier-sha', '--workflow-run-id'].includes(flag) || !value) {
+      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file> --workflow-run-id <id>');
     }
     parsed[flag.slice(2)] = value;
   }
-  if (!parsed.lanes || !parsed.out || Object.keys(parsed).length !== 2) {
-    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
+  if (!parsed.lanes || !parsed.out || !/^[1-9][0-9]*$/.test(parsed['workflow-run-id'] || '')) {
+    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file> --workflow-run-id <id>');
   }
   return parsed;
 }
@@ -265,20 +288,24 @@ function readExactJsonFiles(directory, count, label) {
     .map((entry) => JSON.parse(fs.readFileSync(path.join(directory, entry.name), 'utf8')));
 }
 
-function readLaneLeaves(directory) {
+function readLaneLeaves(directory, options = {}) {
   const wrappers = readExactJsonFiles(directory, PUBLIC_VERIFICATION_OS.length, 'lane');
   const byOs = new Map();
   for (const wrapper of wrappers) {
     const payload = { schemaVersion: wrapper?.schemaVersion, kind: wrapper?.kind, os: wrapper?.os,
+      ...(Object.hasOwn(wrapper || {}, 'verifierSha') ? { verifierSha: wrapper.verifierSha, sourceSha: wrapper.sourceSha } : {}),
       leaves: wrapper?.leaves };
     if (payload.schemaVersion !== 1 || payload.kind !== 'ruvnet-brain-public-verification-os-lane'
       || !PUBLIC_VERIFICATION_OS.includes(payload.os) || byOs.has(payload.os)
       || !Array.isArray(payload.leaves) || payload.leaves.length !== PUBLIC_VERIFICATION_MODES.length
       || payload.leaves.some((leaf) => leaf?.os !== payload.os)
+      || (Object.hasOwn(payload, 'verifierSha') && (!HEX40.test(String(payload.verifierSha))
+        || !HEX40.test(String(payload.sourceSha))
+        || payload.leaves.some((leaf) => leaf.verifierSha !== payload.verifierSha || leaf.sourceSha !== payload.sourceSha)))
       || digest(payload) !== wrapper.laneSha256) {
       throw new Error('public verification OS lane wrapper is malformed, duplicated, or tampered');
     }
-    payload.leaves.forEach(validatePublicVerificationLeaf);
+    payload.leaves.forEach((leaf) => validatePublicVerificationLeaf(leaf, options));
     byOs.set(payload.os, payload.leaves);
   }
   if (PUBLIC_VERIFICATION_OS.some((osName) => !byOs.has(osName))) {
@@ -287,11 +314,16 @@ function readLaneLeaves(directory) {
   return PUBLIC_VERIFICATION_OS.flatMap((osName) => byOs.get(osName));
 }
 
-export function generatePublicVerificationAggregate({ lanesDirectory, outputFile, privateKey }) {
+export function generatePublicVerificationAggregate({ lanesDirectory, outputFile, privateKey, verifierSha, workflowRunId }) {
+  if (!/^[1-9][0-9]*$/.test(String(workflowRunId || ''))) throw new Error('expected workflow run ID is required');
   if (!privateKey) throw new Error('RUVNET_SIGNING_KEY is required');
   if (fs.existsSync(outputFile)) throw new Error(`refusing to overwrite existing aggregate: ${outputFile}`);
-  const leaves = readLaneLeaves(lanesDirectory);
+  const leaves = readLaneLeaves(lanesDirectory, { publicKey: crypto.createPublicKey(privateKey) });
   const aggregate = signPublicVerificationAggregate({ leaves }, privateKey);
+  if (aggregate.workflowRunId !== String(workflowRunId)) throw new Error('public verification aggregate workflow run differs from the expected run');
+  if (verifierSha !== undefined && (!HEX40.test(String(verifierSha)) || aggregate.identity.verifierSha !== verifierSha)) {
+    throw new Error('public verification aggregate verifier SHA differs from the expected verifier');
+  }
   fs.writeFileSync(outputFile, `${JSON.stringify(aggregate, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   return aggregate;
 }
@@ -301,6 +333,8 @@ async function main() {
   const aggregate = generatePublicVerificationAggregate({
     lanesDirectory: options.lanes,
     outputFile: options.out,
+    verifierSha: options['verifier-sha'],
+    workflowRunId: options['workflow-run-id'],
     privateKey: process.env.RUVNET_SIGNING_KEY,
   });
   process.stdout.write(`${JSON.stringify({ ok: true, aggregateSha256: aggregate.aggregateSha256,

package/scripts/public-verification-finalizer.mjs

@@ -2,6 +2,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { finalizeReleaseTransaction } from './release-transaction.mjs';
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
 
@@ -22,6 +23,8 @@ export async function finalizePublicVerification({
   identityFile,
   aggregateFile,
   outputFile,
+  verifierSha,
+  workflowRunId,
   privatePem = process.env.RUVNET_SIGNING_KEY,
   publicKeyFile = 'keys/ruvnet-brain-signing.pub.pem',
   adapter = liveReleaseProvider({ root: process.cwd() }),
@@ -33,7 +36,7 @@ export async function finalizePublicVerification({
   const identity = regularJson(identityFile, 'release identity');
   const aggregate = regularJson(aggregateFile, 'public verification aggregate');
   const publicKey = crypto.createPublicKey(fs.readFileSync(path.resolve(publicKeyFile), 'utf8'));
-  const receipt = await finalizeReleaseTransaction({ identity, aggregate, adapter,
+  const receipt = await finalizeReleaseTransaction({ identity, aggregate, adapter, verifierSha, workflowRunId,
     privateKey: crypto.createPrivateKey(privatePem), publicKey, aggregatePublicKey: publicKey });
   fs.mkdirSync(path.dirname(output), { recursive: true });
   fs.writeFileSync(output, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
@@ -46,6 +49,8 @@ export async function main(args = process.argv.slice(2)) {
       identityFile: argument(args, '--identity'),
       aggregateFile: argument(args, '--aggregate'),
       outputFile: argument(args, '--out'),
+      verifierSha: argument(args, '--verifier-sha') ?? undefined,
+      workflowRunId: argument(args, '--workflow-run-id'),
     });
     process.stdout.write(`${JSON.stringify({ state: receipt.state, transactionId: receipt.transactionId,
       receiptDigest: receipt.receiptDigest }, null, 2)}\n`);
@@ -56,4 +61,5 @@ export async function main(args = process.argv.slice(2)) {
   }
 }
 
-if (path.resolve(process.argv[1] || '') === path.resolve(new URL(import.meta.url).pathname)) process.exitCode = await main();
+const invokedDirectly = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (invokedDirectly) process.exitCode = await main();

package/scripts/public-verification-lane.mjs

@@ -3,11 +3,12 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import osModule from 'node:os';
 import path from 'node:path';
+import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { canonicalJson, digest, validateCoverageLedger } from './coverage-integrity.mjs';
 import { validateHostRegistry } from './host-registry.mjs';
 import { RECEIPT_MODE_NAMES } from './host-install-matrix.mjs';
-import { generatePublicationReceipt, livePublicationAdapter } from './publication-receipt.mjs';
+import { generatePublicationReceipt, livePublicationAdapter, validateCandidateSource } from './publication-receipt.mjs';
 import {
   createPublicVerificationLeaf,
   PUBLIC_VERIFICATION_MODES,
@@ -24,6 +25,33 @@ const HEX40 = /^[a-f0-9]{40}$/;
 const HEX64 = /^[a-f0-9]{64}$/;
 const normalizedDigest = (value) => String(value || '').replace(/^sha256:/, '');
 
+function failedCanaryCases(retrieval) {
+  return retrieval.cases.filter(({ cohort, status, retrievalHit, citationResolved }) =>
+    status !== 'COMPLETED' || retrievalHit !== true || (cohort === 'delta' && citationResolved !== true));
+}
+
+function publicVerificationFailure({ os, identity, verifierSha, failures, completedLeaves }) {
+  const payload = {
+    schemaVersion: 1,
+    kind: 'ruvnet-brain-public-verification-failure',
+    os,
+    sourceSha: identity.candidateSha,
+    ...(verifierSha === undefined ? {} : { verifierSha }),
+    artifactSha256: identity.packageSha256,
+    bundleSha256: identity.bundleSha256,
+    failures: failures.map(({ mode, reason, retrieval }) => ({
+      mode,
+      reason,
+      metrics: retrieval.metrics,
+      failedCaseIds: failedCanaryCases(retrieval).map(({ id }) => id),
+      failedCases: failedCanaryCases(retrieval),
+      retrievalReceiptSha256: retrieval.receiptSha256,
+    })),
+    completedLeaves: completedLeaves.map(({ mode, leafSha256 }) => ({ mode, leafSha256 })),
+  };
+  return { ...payload, failureSha256: digest(payload) };
+}
+
 function validateReleaseIdentity(identity) {
   if (identity?.repository !== 'stuinfla/ruvnet-brain' || identity?.package !== 'ruvnet-brain'
     || !HEX40.test(String(identity.candidateSha || '')) || !HEX64.test(String(identity.payloadId || ''))
@@ -76,6 +104,9 @@ function coverageProjection(coverage) {
 
 export async function createPublicVerificationLane({
   os,
+  verifierSha,
+  workflowRunId,
+  publicKey,
   candidate,
   publication,
   identity,
@@ -86,6 +117,8 @@ export async function createPublicVerificationLane({
   adapter,
 } = {}) {
   if (!PUBLIC_VERIFICATION_OS.includes(os)) throw new Error(`unsupported public verification OS: ${os || '(missing)'}`);
+  if (verifierSha !== undefined && !HEX40.test(String(verifierSha))) throw new Error('verifier SHA must be a full commit identity');
+  if (!/^[1-9][0-9]*$/.test(String(workflowRunId || ''))) throw new Error('workflow run ID is required');
   validateReleaseIdentity(identity);
   validatePublicEvidence({ candidate, publication, identity });
   const registry = validateHostRegistry(hostRegistry);
@@ -106,7 +139,9 @@ export async function createPublicVerificationLane({
     throw new Error('public verification lane adapter is incomplete');
   }
   const common = {
+    workflowRunId: String(workflowRunId),
     sourceSha: identity.candidateSha,
+    ...(verifierSha === undefined ? {} : { verifierSha }),
     version: identity.version,
     tag: identity.tag,
     artifactSha256: identity.packageSha256,
@@ -118,6 +153,7 @@ export async function createPublicVerificationLane({
     releaseTransactionId: transactionIdFor(identity),
   };
   const leaves = [];
+  const failures = [];
   for (const mode of PUBLIC_VERIFICATION_MODES) {
     const installed = publication.installed?.[RECEIPT_MODE_NAMES[mode]];
     if (installed?.status !== 'PASS' || installed.doctorExit !== 0 || installed.version !== identity.version
@@ -132,12 +168,24 @@ export async function createPublicVerificationLane({
       search: ({ query, k }) => adapter.searchInstalled({ mode, query, k }),
       citationResolver: (matched, expected) => adapter.resolveInstalledCitation({ mode, matched, expected }),
     });
-    const verifiedRetrieval = validateRetrievalCanaryReceipt(
-      retrieval,
-      { plan: retrievalPlan, requireAcceptance: true },
-    );
+    let verifiedRetrieval;
+    try {
+      verifiedRetrieval = validateRetrievalCanaryReceipt(
+        retrieval,
+        { plan: retrievalPlan, requireAcceptance: true },
+      );
+    } catch (error) {
+      failures.push({ mode, reason: error.message, retrieval });
+      continue;
+    }
+    let nativeNightly;
+    if (mode === 'dual') {
+      if (typeof adapter.runNativeNightly !== 'function') throw new Error('native nightly proof adapter is required');
+      nativeNightly = await adapter.runNativeNightly({ identity, workflowRunId: String(workflowRunId) });
+    }
     leaves.push(createPublicVerificationLeaf({
       ...common,
+      ...(nativeNightly === undefined ? {} : { nativeNightly }),
       os,
       mode,
       status: verifiedRetrieval.receiptSha256 === retrieval.receiptSha256 ? 'completed' : 'failed',
@@ -150,7 +198,12 @@ export async function createPublicVerificationLane({
       untested: [],
       skipped: 0,
       unknown: 0,
-    }));
+    }, { publicKey }));
+  }
+  if (failures.length) {
+    const error = new Error(`retrieval canary acceptance failed for ${failures.map(({ mode }) => mode).join(', ')}`);
+    error.publicVerificationFailure = publicVerificationFailure({ os, identity, verifierSha, failures, completedLeaves: leaves });
+    throw error;
   }
   if (canonicalJson(leaves.map(({ mode }) => mode)) !== canonicalJson(PUBLIC_VERIFICATION_MODES)) {
     throw new Error('public verification lane modes are incomplete');
@@ -168,8 +221,22 @@ function regularJson(file, label) {
   return { absolute, bytes: fs.readFileSync(absolute), value: JSON.parse(fs.readFileSync(absolute, 'utf8')) };
 }
 
+export function resolveVerifierSha(root, expected) {
+  const options = { cwd: root, encoding: 'utf8' };
+  const actual = execFileSync('git', ['rev-parse', 'HEAD'], options).trim();
+  if (!HEX40.test(actual) || (expected !== undefined && expected !== actual)) {
+    throw new Error('verifier SHA differs from the executing checkout');
+  }
+  if (execFileSync('git', ['status', '--porcelain', '--untracked-files=no'], options).trim()) {
+    throw new Error('verifier checkout has tracked changes');
+  }
+  return actual;
+}
+
 export async function generatePublicVerificationLane({
   os,
+  verifierSha: expectedVerifierSha,
+  workflowRunId,
   candidatePath,
   identityPath,
   coveragePath,
@@ -177,10 +244,19 @@ export async function generatePublicVerificationLane({
   registryPath,
   outPath,
   root = process.cwd(),
-  adapter = livePublicationAdapter({ root }),
+  candidateRoot = root,
+  adapter = livePublicationAdapter({ root, candidateRoot }),
 } = {}) {
   if (os !== hostOperatingSystem()) throw new Error(`runner OS ${hostOperatingSystem() || process.platform} cannot produce ${os || '(missing)'}`);
+  const rootDirectory = fs.statSync(root, { bigint: true });
+  const scriptDirectory = fs.statSync(fileURLToPath(new URL('..', import.meta.url)), { bigint: true });
+  if (!rootDirectory.isDirectory() || rootDirectory.ino <= 0n
+    || rootDirectory.dev !== scriptDirectory.dev || rootDirectory.ino !== scriptDirectory.ino) {
+    throw new Error('verifier root differs from the executing script checkout');
+  }
+  const verifierSha = resolveVerifierSha(root, expectedVerifierSha);
   const candidate = regularJson(candidatePath, 'candidate receipt');
+  validateCandidateSource(candidateRoot, candidate.value);
   const identity = regularJson(identityPath, 'release identity');
   const releaseCoverage = regularJson(coveragePath, 'release coverage');
   const retrievalPlan = regularJson(planPath, 'retrieval plan');
@@ -196,6 +272,8 @@ export async function generatePublicVerificationLane({
     const publication = JSON.parse(fs.readFileSync(publicationPath, 'utf8'));
     const leaves = await createPublicVerificationLane({
       os,
+      verifierSha,
+      workflowRunId,
       candidate: candidate.value,
       publication,
       identity: identity.value,
@@ -206,11 +284,30 @@ export async function generatePublicVerificationLane({
       hostRegistry: hostRegistry.value,
       adapter,
     });
-    const payload = { schemaVersion: 1, kind: 'ruvnet-brain-public-verification-os-lane', os, leaves };
+    resolveVerifierSha(root, verifierSha);
+    validateCandidateSource(candidateRoot, candidate.value);
+    const payload = { schemaVersion: 1, kind: 'ruvnet-brain-public-verification-os-lane', os,
+      verifierSha, sourceSha: identity.value.candidateSha, leaves };
     const receipt = { ...payload, laneSha256: digest(payload) };
     fs.mkdirSync(path.dirname(output), { recursive: true });
     fs.writeFileSync(output, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
     return receipt;
+  } catch (error) {
+    if (!fs.existsSync(output)) {
+      const failure = error.publicVerificationFailure || (() => {
+        const payload = { schemaVersion: 1, kind: 'ruvnet-brain-public-verification-failure',
+          os, verifierSha, sourceSha: identity.value.candidateSha,
+          artifactSha256: identity.value.packageSha256, bundleSha256: identity.value.bundleSha256,
+          workflowRunId: String(workflowRunId || ''),
+          failures: [{ stage: 'public-install-and-native-update', reason: String(error.message).slice(0, 2000) }],
+          completedLeaves: [] };
+        return { ...payload, failureSha256: digest(payload) };
+      })();
+      fs.mkdirSync(path.dirname(output), { recursive: true });
+      fs.writeFileSync(output, `${JSON.stringify(failure, null, 2)}\n`,
+        { flag: 'wx', mode: 0o600 });
+    }
+    throw error;
   } finally {
     await adapter.dispose?.();
     fs.rmSync(temp, { recursive: true, force: true });
@@ -226,6 +323,9 @@ export async function main(args = process.argv.slice(2)) {
   try {
     const receipt = await generatePublicVerificationLane({
       os: argument(args, '--os'),
+      verifierSha: argument(args, '--verifier-sha') ?? undefined,
+      workflowRunId: argument(args, '--workflow-run-id'),
+      candidateRoot: argument(args, '--candidate-root') ?? undefined,
       candidatePath: argument(args, '--candidate'),
       identityPath: argument(args, '--identity'),
       coveragePath: argument(args, '--coverage'),