ruvnet-brain 4.3.9 → 4.3.10

package/scripts/publication-receipt.mjs

@@ -7,7 +7,6 @@ import os from 'node:os';
 import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
-import readline from 'node:readline';
 import { spawn, spawnSync } from 'node:child_process';
 // ONE doctor rule and ONE mode vocabulary, shared with the staged-side check in
 // scripts/staged-host-verifier.mjs. This file kept its own copies, spelled claudeOnly/
@@ -16,11 +15,12 @@ import { spawn, spawnSync } from 'node:child_process';
 // post-publication proofs below (payload assertions, MCP wiring, SOURCE.json, rpcSearch)
 // stay here — they are this side's job, not duplication.
 import { HOST_MODES, RECEIPT_MODE_NAMES, MODE_FROM_RECEIPT_NAME, classifyDoctor, VARIANTS } from './host-install-matrix.mjs';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { evaluateCandidateReceipt, evaluatePublicationReceipt } from './release-proof.mjs';
 import { verifyPayload } from './release-payload.mjs';
-import { digest, sha256File } from './coverage-integrity.mjs';
-import { parseCitations } from '../kb/verify-citation.mjs';
+import { resolveInstalledCanaryCitation } from './retrieval-canary.mjs';
+import { runNightlyTwoRunProof, validateNightlyProofReceipt } from './nightly-two-run-proof.mjs';
+import { parseRetrievalResult } from '../kb/retrieval-result.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
 const PACKAGE = 'ruvnet-brain';
@@ -35,6 +35,14 @@ export function commandInvocation(name, args, { platform = process.platform, env
   };
   return { executable: name, args };
 }
+export function tarExtractionInvocation(artifactPath, destination, { platform = process.platform } = {}) {
+  const paths = platform === 'win32' ? path.win32 : path;
+  const archive = paths.resolve(artifactPath);
+  // A relative archive argument avoids GNU tar's drive-letter remote-host syntax and also
+  // works with Windows BSD tar, which does not support GNU's --force-local option.
+  return { args: ['-xzf', `./${paths.basename(archive)}`, '-C', paths.resolve(destination)],
+    cwd: paths.dirname(archive) };
+}
 function command(name, args, options = {}) {
   const { platform = process.platform, ...spawnOptions } = options;
   const invocation = commandInvocation(name, args, { platform, env: spawnOptions.env || process.env });
@@ -45,6 +53,31 @@ function command(name, args, options = {}) {
   }
   return String(result.stdout || '').trim();
 }
+export function validateCandidateSource(root, { sha, version }) {
+  const candidateRoot = fs.realpathSync(root);
+  const options = { cwd: candidateRoot };
+  const top = command('git', ['rev-parse', '--show-toplevel'], options);
+  const head = command('git', ['rev-parse', 'HEAD'], options);
+  // Git and Node can spell the same Windows directory with different casing/separators.
+  // Compare actual directory identity, never case-fold distinct source paths.
+  const candidateDirectory = fs.statSync(candidateRoot, { bigint: true });
+  const topDirectory = fs.statSync(top, { bigint: true });
+  if (!candidateDirectory.isDirectory() || !topDirectory.isDirectory()
+    || candidateDirectory.ino <= 0n || topDirectory.ino <= 0n
+    || candidateDirectory.dev !== topDirectory.dev || candidateDirectory.ino !== topDirectory.ino
+    || !/^[a-f0-9]{40}$/.test(String(sha)) || head !== sha) {
+    throw new Error(`candidate checkout ${head} does not match candidate ${sha}`);
+  }
+  if (command('git', ['status', '--porcelain', '--untracked-files=no'], options)) {
+    throw new Error('candidate checkout has tracked changes');
+  }
+  const manifest = path.join(candidateRoot, 'package.json');
+  const stat = fs.lstatSync(manifest);
+  if (!stat.isFile() || stat.isSymbolicLink() || !version || readJson(manifest).version !== version) {
+    throw new Error('candidate checkout package version differs from the released candidate');
+  }
+  return candidateRoot;
+}
 function locate(name, { platform = process.platform } = {}) {
   const query = platform === 'win32' ? (name === 'node' ? 'node.exe' : `${name}.cmd`) : name;
   try {
@@ -166,18 +199,32 @@ export function assertInstalledPayload(sourceRoot, installedRoot) {
   return checked;
 }
 
-export function rpcSearch(server, env, query, k = 5, timeoutMs = DEADLINE_MS) {
+export function rpcSearch(server, env, query, k = 5, timeoutMs = DEADLINE_MS, {
+  requiredRepo = 'ruvnet-brain',
+} = {}) {
   if (!Number.isSafeInteger(k) || k < 1 || k > 50) throw new Error(`invalid search result count: ${k}`);
   return new Promise((resolve, reject) => {
     const child = spawn(process.execPath, [server], { env, stdio: ['pipe', 'pipe', 'pipe'] });
     let stdout = '';
     let stderr = '';
     let timer;
+    let killTimer;
+    let closeTimer;
+    let outcome;
     const pending = new Map();
     const finish = (error, value) => {
+      if (outcome) return;
+      outcome = { error, value };
       clearTimeout(timer);
+      pending.clear();
+      // Do not let the next doctor/search probe contend with this process while it exits.
+      // A child that ignores graceful shutdown must not leave the verifier hanging either.
+      killTimer = setTimeout(() => {
+        outcome.error = new Error('installed Brain did not shut down within 5000ms');
+        child.kill('SIGKILL');
+        closeTimer = setTimeout(() => reject(new Error('installed Brain process did not close after SIGKILL')), 1000);
+      }, 5000);
       child.kill('SIGTERM');
-      error ? reject(error) : resolve(value);
     };
     timer = setTimeout(() => finish(new Error(`installed Brain exceeded ${timeoutMs}ms deadline`)), timeoutMs);
     child.stderr.on('data', (chunk) => { stderr += chunk; });
@@ -195,8 +242,12 @@ export function rpcSearch(server, env, query, k = 5, timeoutMs = DEADLINE_MS) {
       }
     });
     child.on('error', (error) => finish(error));
-    child.on('exit', (code) => {
-      if (pending.size) finish(new Error(`installed Brain exited ${code}: ${stderr.slice(0, 400)}`));
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      clearTimeout(closeTimer);
+      const result = outcome || { error: new Error(`installed Brain exited ${code}: ${stderr.slice(0, 400)}`) };
+      result.error ? reject(result.error) : resolve(result.value);
     });
     const call = (id, method, params = {}) => new Promise((done) => {
       pending.set(id, done);
@@ -212,13 +263,17 @@ export function rpcSearch(server, env, query, k = 5, timeoutMs = DEADLINE_MS) {
       const broadMs = Math.round(performance.now() - started);
       const text = (searched.result?.content || []).map((item) => item.text || '').join('\n');
       if (searched.error || searched.result?.isError || /search_ruvnet error:/i.test(text)) throw new Error(`installed Brain search failed: ${text.slice(0, 400)}`);
-      if (!/repo=ruvnet-brain/i.test(text) || !/path\s*:/i.test(text)) throw new Error('installed Brain search returned no ruvnet-brain source citation');
-      finish(null, { broadMs, text });
+      if (!/repo=/i.test(text) || !/path\s*:/i.test(text)) throw new Error('installed Brain search returned no source citation');
+      const repos = [...text.matchAll(/repo=([\w.-]+)/gi)].map((match) => match[1].toLowerCase());
+      if (requiredRepo && !repos.includes(String(requiredRepo).toLowerCase())) {
+        throw new Error(`installed Brain search returned no ${requiredRepo} source citation`);
+      }
+      finish(null, { broadMs, text, mcpResult: searched.result });
     })().catch((error) => finish(error));
   });
 }
 
-export function livePublicationAdapter({ root = process.cwd() } = {}) {
+export function livePublicationAdapter({ root = process.cwd(), candidateRoot = root } = {}) {
   const installContexts = new Map();
   const passageFileDigests = new Map();
   let installTemp = null;
@@ -246,11 +301,40 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
       return { path: destination, tag: release.tag_name, sha: tagCommit(root, tag) };
     },
 
+    async runNativeNightly({ identity, workflowRunId }) {
+      const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-nightly-'));
+      let completed = false;
+      try {
+        const npm = await this.downloadNpm({ version: identity.version,
+          destination: path.join(temp, 'package.tgz') });
+        const bundle = await this.downloadGithub({ tag: identity.tag, assetName: 'ruvnet-brain.zip',
+          destination: path.join(temp, 'ruvnet-brain.zip') });
+        const signature = await this.downloadGithub({ tag: identity.tag, assetName: 'ruvnet-brain.zip.sig',
+          destination: path.join(temp, 'ruvnet-brain.zip.sig') });
+        if (sha256(npm.path) !== identity.packageSha256 || sha256(bundle.path) !== identity.bundleSha256
+          || npm.version !== identity.version || bundle.sha !== identity.candidateSha
+          || signature.sha !== identity.candidateSha) throw new Error('nightly public artifact identity mismatch');
+        const proof = await runNightlyTwoRunProof({ packagePath: npm.path, bundlePath: bundle.path,
+          signaturePath: signature.path, sourceSha: identity.candidateSha, workflowRunId,
+          out: path.join(temp, 'nightly-proof.json') });
+        const validation = validateNightlyProofReceipt(proof, { platform: process.platform, version: identity.version,
+          packageSha256: identity.packageSha256, bundleSha256: identity.bundleSha256,
+          sourceSha: identity.candidateSha, workflowRunId });
+        if (!validation.ok) throw new Error(`public nightly proof failed: ${validation.failures.join('; ')}`);
+        completed = true;
+        return proof;
+      } finally {
+        if (completed) fs.rmSync(temp, { recursive: true, force: true });
+        else console.error(`Native public artifact diagnostics retained at ${temp}`);
+      }
+    },
+
     async installHosts({ artifactPath, artifactSha256, bundlePath, bundleSha256, version }) {
-      const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-install-'));
+      const temp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-public-install-')));
       installTemp = temp;
       const packageRoot = path.join(temp, 'package');
-      command('tar', ['-xzf', artifactPath, '-C', temp]);
+      const extraction = tarExtractionInvocation(artifactPath, temp);
+      command('tar', extraction.args, { cwd: extraction.cwd });
       stageVerifiedBundle({ bundlePath, bundleSha256, packageRoot });
       const sealedPlugin = path.join(packageRoot, 'plugin');
       const results = {};
@@ -342,46 +426,26 @@ export function livePublicationAdapter({ root = process.cwd() } = {}) {
     async searchInstalled({ mode, query, k }) {
       const context = installContexts.get(mode);
       if (!context) throw new Error(`${mode} public host is not installed`);
-      const result = await rpcSearch(findMcpServer(context.home), context.env, query, k, DEADLINE_MS);
-      return parseCitations(result.text).map((citation) => ({
-        repo: citation.repo.toLowerCase(),
-        path: citation.docPath,
-      }));
+      // Each canary's exact expected repository/path/passage is checked by the canary validator.
+      const result = await rpcSearch(findMcpServer(context.home), context.env, query, k, DEADLINE_MS,
+        { requiredRepo: null });
+      return parseRetrievalResult(result.mcpResult, { query, k });
     },
 
     async resolveInstalledCitation({ mode, matched, expected }) {
       const context = installContexts.get(mode);
       if (!context) throw new Error(`${mode} public host is not installed`);
-      if (String(matched?.repo || '').toLowerCase() !== expected.repo || matched?.path !== expected.path) {
-        return { resolved: false };
-      }
-      const files = [
-        path.join(context.kb, `${expected.repo}.passages.jsonl`),
-        path.join(context.kb, `${expected.repo}.big.passages.jsonl`),
-      ].filter((file) => fs.existsSync(file));
-      for (const file of files) {
-        const rows = readline.createInterface({ input: fs.createReadStream(file), crlfDelay: Infinity });
-        try {
-          for await (const line of rows) {
-            let record;
-            try { record = JSON.parse(line); } catch { continue; }
-            if (record?.path !== expected.path) continue;
-            const passageSha256 = digest(record);
-            if (passageSha256 !== expected.passageSha256) return { resolved: false };
-            if (!passageFileDigests.has(file)) passageFileDigests.set(file, sha256File(file));
-            return { resolved: true, evidence: { passageSha256, passageFileSha256: passageFileDigests.get(file) } };
-          }
-        } finally { rows.close(); }
-      }
-      return { resolved: false };
+      return resolveInstalledCanaryCitation({ kbDir: context.kb, matched, expected, passageFileDigests });
     },
 
-    async probePublishedSurface({ sha }) {
-      const head = command('git', ['rev-parse', 'HEAD'], { cwd: root });
-      if (head !== sha) throw new Error(`published-surface probe checkout ${head} does not match candidate ${sha}`);
-      const result = spawnSync(process.execPath, ['scripts/published-surface-probe.mjs', '--json'], {
-        cwd: root, env: process.env, encoding: 'utf8', timeout: 600_000,
+    async probePublishedSurface({ sha, version }) {
+      const source = validateCandidateSource(candidateRoot, { sha, version });
+      // The verifier supplies executable checks; the candidate supplies only the released source.
+      const script = fileURLToPath(new URL('./published-surface-probe.mjs', import.meta.url));
+      const result = spawnSync(process.execPath, [script, '--json'], {
+        cwd: source, env: process.env, encoding: 'utf8', timeout: 600_000,
       });
+      validateCandidateSource(candidateRoot, { sha, version });
       let parsed;
       try { parsed = JSON.parse(String(result.stdout || '')); } catch { throw new Error(`published-surface-probe emitted invalid JSON: ${String(result.stderr || '').slice(0, 300)}`); }
       if (result.status !== 0 || parsed.verdict !== 'PASS') throw new Error(`published-surface-probe is ${parsed.verdict || `exit ${result.status}`}`);

package/scripts/published-surface-probe.mjs

@@ -52,6 +52,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 
 export const EXIT = Object.freeze({ PASS: 0, FAIL: 1, UNKNOWN: 4 });
 
@@ -127,6 +128,12 @@ async function probeRegistry() {
 }
 
 // ── B. EXECUTE the published package, from the registry ────────────────────────────────────────
+export function npxInvocation(args, { platform = process.platform, env = process.env } = {}) {
+  if (platform === 'win32') return {
+    executable: env.ComSpec || 'cmd.exe', args: ['/d', '/c', 'npx.cmd', ...args],
+  };
+  return { executable: 'npx', args };
+}
 function probeExec() {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-brain-probe-'));
   try {
@@ -134,7 +141,8 @@ function probeExec() {
     // (npm resolve → download → unpack → bin mapping → node parses every module it imports) while
     // touching NOTHING on the machine. `--doctor`/`--plan` reach the network and the brain dir; this
     // probe must never be the reason a surface changes.
-    const r = spawnSync('npx', ['-y', `${PKG}@latest`, '--help'], {
+    const invocation = npxInvocation(['-y', `${PKG}@latest`, '--help']);
+    const r = spawnSync(invocation.executable, invocation.args, {
       encoding: 'utf8',
       timeout: 300_000,
       cwd: home,
@@ -237,5 +245,5 @@ export async function main() {
   return EXIT[verdict];
 }
 
-const invokedDirectly = process.argv[1] && path.resolve(process.argv[1]) === path.resolve(new URL(import.meta.url).pathname);
+const invokedDirectly = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 if (invokedDirectly) process.exit(await main());

package/scripts/qa-contract.mjs

@@ -0,0 +1,57 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+
+export function verdictOf(results) {
+  if (results.some(({ status }) => ['FAIL', 'TIMEOUT', 'BLOCKED'].includes(status))) return 'FAIL';
+  return results.length && results.every(({ status }) => status === 'PASS') ? 'PASS' : 'UNKNOWN';
+}
+
+// A source digest includes dirty tracked files and untracked source, never ignored build outputs.
+export function sourceIdentity(root) {
+  const git = (args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  let sha = null;
+  try { sha = git(['rev-parse', 'HEAD']).trim(); } catch { /* unborn repository */ }
+  const files = [...new Set(git(['ls-files', '-z', '--cached', '--others', '--exclude-standard']).split('\0').filter(Boolean))].sort();
+  const hash = createHash('sha256');
+  for (const relative of files) {
+    const file = path.join(root, relative);
+    let bytes = Buffer.from('deleted');
+    try {
+      const stat = fs.lstatSync(file);
+      bytes = stat.isSymbolicLink() ? Buffer.from(`symlink:${fs.readlinkSync(file)}`)
+        : stat.isFile() ? Buffer.concat([Buffer.from(`${stat.mode & 0o777}:`), fs.readFileSync(file)]) : Buffer.from('directory');
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    hash.update(JSON.stringify([relative, createHash('sha256').update(bytes).digest('hex')]));
+  }
+  return { sha, dirty: Boolean(git(['status', '--porcelain']).trim()), digest: hash.digest('hex'), files: files.length, recipe: 'git-source-bytes-v1' };
+}
+
+export async function runLanes(lanes, execute, concurrency = 2) {
+  if (!Number.isInteger(concurrency) || concurrency < 1) throw new Error('invalid QA concurrency');
+  const names = new Set(lanes.map(({ name }) => name));
+  if (names.size !== lanes.length || lanes.some((lane) => (lane.dependsOn || []).some((name) => !names.has(name)))) throw new Error('invalid QA dependency');
+  const pending = [...lanes], completed = new Map();
+  while (pending.length) {
+    const resources = new Set(), batch = [];
+    for (const lane of pending) {
+      if (!(lane.dependsOn || []).every((name) => completed.has(name))) continue;
+      if ((lane.dependsOn || []).some((name) => completed.get(name).status !== 'PASS')) {
+        completed.set(lane.name, { name: lane.name, status: 'BLOCKED', reason: 'required prerequisite did not pass' });
+        continue;
+      }
+      if (batch.length >= concurrency || (lane.resource && resources.has(lane.resource))) continue;
+      batch.push(lane); resources.add(lane.resource);
+    }
+    if (!batch.length && !pending.some(({ name }) => completed.has(name))) throw new Error('QA dependency cycle');
+    await Promise.all(batch.map(async (lane) => {
+      let result;
+      try { result = await execute(lane); }
+      catch (error) { result = { name: lane.name, status: 'FAIL', reason: error.message }; }
+      completed.set(lane.name, result);
+    }));
+    for (let index = pending.length - 1; index >= 0; index--) if (completed.has(pending[index].name)) pending.splice(index, 1);
+  }
+  return lanes.map(({ name }) => completed.get(name));
+}

package/scripts/qa-lanes.mjs

@@ -0,0 +1,40 @@
+// Shared producers for local diagnostics, CI, and candidate qualification.
+export function selectLanes(lanes, requested) {
+  if (!requested.length) return lanes;
+  const selected = new Set();
+  const visit = (name) => {
+    const lane = lanes.find((entry) => entry.name === name);
+    if (!lane) throw new Error(`unknown QA lane: ${name}`);
+    if (selected.has(name)) return;
+    selected.add(name);
+    for (const dependency of lane.dependsOn || []) visit(dependency);
+  };
+  requested.forEach(visit);
+  return lanes.filter(({ name }) => selected.has(name));
+}
+
+export function qaLanes({ release = false, base = null, runtimeCensusArgs = [] } = {}) {
+  const node = (name, script, args = [], extra = {}) => ({ name, command: process.execPath, args: [script, ...args], resource: 'static', ...extra });
+  const test = (name, args) => node(name, 'node_modules/vitest/vitest.mjs', ['run', ...args], { resource: 'tests' });
+  return [
+    node('version', 'scripts/sync-version.mjs', ['--check']),
+    node('convergence', 'scripts/convergence-manifest.mjs'),
+    node('execution-policy', 'scripts/execution-policy.mjs', ['{"action":"delegate","description":"architecture audit","nativeHosts":["codex"]}']),
+    node('architecture', 'scripts/product-integrity-contract.mjs', ['--check-source']),
+    node('docs', 'scripts/doc-currency.mjs', ['--check', ...(base ? ['--changed', base] : ['--warn-drift'])]),
+    node('wiring', 'scripts/wired-check.mjs', ['--check']),
+    node('substitution', 'scripts/no-silent-substitution.mjs'),
+    node('catalog', 'scripts/verify-model-catalog.mjs'),
+    test('coverage', ['tests/unit', '--coverage']),
+    node('claims-source', 'scripts/claims-verify.mjs', ['--strict', '--scope', 'source'], { dependsOn: ['coverage'], report: 'claims' }),
+    test('mesh', ['tests/mesh']),
+    node('plugin', 'plugin/test/run-tests.mjs', [], { resource: 'tests' }),
+    ...(release ? [
+      test('mutation', ['tests/mutation']),
+      test('regression', ['tests/regression']),
+      test('integration', ['tests/integration']),
+      test('continuity', ['tests/acceptance/cross-host-project-resume.test.mjs']),
+      node('claims-runtime', 'scripts/claims-verify.mjs', ['--strict', '--scope', 'runtime', ...runtimeCensusArgs], { report: 'claims' }),
+    ] : []),
+  ];
+}

package/scripts/qa-runner.mjs

@@ -1,72 +1,62 @@
 #!/usr/bin/env node
-// Canonical bounded QA runner. Local and CI use the same lanes, command order, timeout policy,
-// and machine-readable receipt; a human log is never the release verdict.
 import fs from 'node:fs';
 import path from 'node:path';
-import { execFileSync, spawn } from 'node:child_process';
+import os from 'node:os';
+import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { qaLanes, selectLanes } from './qa-lanes.mjs';
+import { runLanes, verdictOf, sourceIdentity } from './qa-contract.mjs';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const release = process.argv.includes('--release');
-const timeoutMs = Number(process.env.QA_TIMEOUT_MS || (release ? 15 * 60_000 : 8 * 60_000));
-const lanes = [
-  ['version', 'npm', ['run', 'version:check']],
-  ['convergence', 'npm', ['run', 'convergence:check']],
-  ['execution-policy', 'npm', ['run', 'execution-policy:check']],
-  ['docs', 'npm', ['run', 'doc:currency']],
-  ['wiring', 'npm', ['run', 'wired:check']],
-  ['substitution', 'npm', ['run', 'substitution:check']],
-  ['catalog', 'npm', ['run', 'catalog:verify']],
-  ['contract', 'npx', ['vitest', 'run',
-    'tests/unit/brain-off.test.mjs',
-    'tests/unit/hook-hardening.test.mjs',
-    'tests/unit/hook-battery.test.mjs',
-    'tests/unit/session-start-core-parity.test.mjs',
-    'tests/unit/lesson-gate.test.mjs',
-    'tests/unit/wired-check.test.mjs',
-    'tests/unit/no-restated-truth.test.mjs',
-    'tests/unit/verify-citation.test.mjs',
-    'tests/unit/eval-brain-gate.test.mjs',
-    'tests/unit/distill-project.test.mjs',
-    'tests/unit/record-lesson.test.mjs',
-    'tests/unit/learn-capture-project-root.test.mjs',
-    'tests/unit/codex-claude-hook-parity.test.mjs',
-    'tests/unit/brain-stamp-resolve-built-from-sha.test.mjs',
-    'tests/unit/qa-runner-concurrency.test.mjs',
-    'tests/unit/execution-preflight.test.mjs',
-    '--reporter=dot']],
-  ['mesh', 'npm', ['run', 'test:mesh']],
-  ['plugin', 'npm', ['test']],
-  ...(release ? [['mutation', 'npm', ['run', 'test:mutation']], ['claims', 'npm', ['run', 'claims:verify']], ['integration', 'npm', ['run', 'test:integration']]] : []),
-];
-const receiptDir = path.join(root, '.qa');
-fs.mkdirSync(receiptDir, { recursive: true });
-const started = new Date().toISOString();
-const sha = (() => {
-  try { return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim(); }
-  catch { return null; }
-})();
-const run = ([name, command, args]) => new Promise((resolve) => {
-  const begin = Date.now();
-  const child = spawn(command, args, { cwd: root, env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false });
-  let stdout = '', stderr = '', timedOut = false;
-  child.stdout.on('data', (chunk) => { stdout += chunk; process.stdout.write(chunk); });
-  child.stderr.on('data', (chunk) => { stderr += chunk; process.stderr.write(chunk); });
-  const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); setTimeout(() => child.kill('SIGKILL'), 2000).unref(); }, timeoutMs);
-  child.on('close', (code, signal) => {
-    clearTimeout(timer);
-    resolve({ name, command: [command, ...args].join(' '), status: timedOut ? 'TIMEOUT' : code === 0 ? 'PASS' : 'FAIL', exitCode: code, signal, elapsedMs: Date.now() - begin, stdoutTail: stdout.slice(-4000), stderrTail: stderr.slice(-4000) });
-  });
+const argument = (name) => { const i = process.argv.indexOf(name); return i < 0 ? null : process.argv[i + 1]; };
+const requested = process.argv.flatMap((value, index) => value === '--lane' ? [process.argv[index + 1]] : []);
+const runtimeCensusArgs = ['--candidate-kb', '--candidate-sha', '--candidate-version', '--candidate-root',
+  '--payload-manifest', '--payload-signature', '--payload-id', '--qualification-mode'].flatMap((name) => {
+  if (!process.argv.includes(name)) return [];
+  const value = argument(name);
+  if (!value || value.startsWith('--')) throw new Error(`${name} requires a value`);
+  return [name, value];
 });
-// Every lane is independent. Run the complete set concurrently so one failure does not hide
-// later failures and force a serial fix-rerun cycle. The aggregate receipt remains the single
-// verdict, while each lane keeps its own evidence for targeted repair.
-const results = await Promise.all(lanes.map(async (lane) => {
-  const result = await run(lane);
-  fs.writeFileSync(path.join(receiptDir, `${result.name}.json`), `${JSON.stringify({ schema: 'ruvnet-brain.qa.lane', sha, ...result }, null, 2)}\n`);
-  return result;
-}));
-const receipt = { schema: 'ruvnet-brain.qa.aggregate', contract: release ? 'release' : 'pr', sha, started, ended: new Date().toISOString(), status: results.every((r) => r.status === 'PASS') && results.length === lanes.length ? 'PASS' : 'FAIL', requiredLanes: lanes.map(([name]) => name), results };
-fs.writeFileSync(path.join(receiptDir, 'aggregate.json'), `${JSON.stringify(receipt, null, 2)}\n`);
-console.log(JSON.stringify({ status: receipt.status, sha, lanes: results.map(({ name, status, elapsedMs }) => ({ name, status, elapsedMs })) }));
-process.exit(receipt.status === 'PASS' ? 0 : 1);
+const lanes = selectLanes(qaLanes({ release, runtimeCensusArgs, base: argument('--base') || process.env.QA_BASE_SHA }), requested);
+if (process.argv.includes('--list')) {
+  console.log(JSON.stringify(lanes, null, 2));
+} else {
+  const timeoutMs = Number(process.env.QA_TIMEOUT_MS || (release ? 15 * 60_000 : 8 * 60_000));
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error('invalid QA timeout');
+  const receiptDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-brain-qa-'));
+  const started = new Date().toISOString();
+  const source = sourceIdentity(root);
+  const run = (lane) => new Promise((resolve) => {
+    const begin = Date.now();
+    const evidenceFile = lane.report ? path.join(receiptDir, lane.name + '-evidence.json') : null;
+    const args = evidenceFile ? [...lane.args, '--report', evidenceFile] : lane.args;
+    const child = spawn(lane.command, args, { cwd: root, env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false, detached: process.platform !== 'win32' });
+    let stdout = '', stderr = '', timedOut = false, spawnError = null, escalation = null;
+    child.stdout.on('data', (chunk) => { stdout = (stdout + chunk).slice(-4000); process.stdout.write(chunk); });
+    child.stderr.on('data', (chunk) => { stderr = (stderr + chunk).slice(-4000); process.stderr.write(chunk); });
+    child.on('error', (error) => { spawnError = error.message; });
+    const kill = (signal) => {
+      if (!child.pid) return;
+      try {
+        if (process.platform === 'win32') spawn('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore' }).on('error', () => {});
+        else process.kill(-child.pid, signal);
+      } catch (error) { if (error.code !== 'ESRCH') spawnError = error.message; }
+    };
+    const timer = setTimeout(() => { timedOut = true; kill('SIGTERM'); escalation = setTimeout(() => kill('SIGKILL'), 2000); escalation.unref(); }, timeoutMs);
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      clearTimeout(escalation);
+      resolve({ name: lane.name, command: [lane.command, ...args], evidenceFile, status: timedOut ? 'TIMEOUT' : spawnError ? 'FAIL' : code === 0 ? 'PASS' : code === 4 ? 'UNKNOWN' : 'FAIL', exitCode: code, signal, spawnError, elapsedMs: Date.now() - begin, stdoutTail: stdout, stderrTail: stderr });
+    });
+  });
+  const results = await runLanes(lanes, run, 2);
+  const after = sourceIdentity(root);
+  const stable = after.digest === source.digest;
+  const status = stable ? verdictOf(results) : 'UNKNOWN';
+  const receipt = { schema: 'ruvnet-brain.qa.aggregate', contract: release ? 'release' : 'pr', selection: requested.length ? 'partial' : 'complete', source, sourceAfter: after, sourceStable: stable, started, ended: new Date().toISOString(), status, requiredLanes: lanes.map(({ name }) => name), results };
+  for (const result of results) fs.writeFileSync(path.join(receiptDir, result.name + '.json'), JSON.stringify({ schema: 'ruvnet-brain.qa.lane', source, ...result }, null, 2), { flag: 'wx' });
+  fs.writeFileSync(path.join(receiptDir, 'aggregate.json'), JSON.stringify(receipt, null, 2), { flag: 'wx' });
+  console.log(JSON.stringify({ status, receiptDir, source, sourceStable: stable, lanes: results.map(({ name, status }) => ({ name, status })) }));
+  process.exitCode = status === 'PASS' ? 0 : status === 'UNKNOWN' ? 4 : 1;
+}

package/scripts/qe/ux-suite.mjs

@@ -11,16 +11,8 @@
 //     scheduler jitter — it can only be a correctness regression. THIS is a genuine hard gate: a
 //     breach here fails the suite, not warns it. See scripts/qe/card-lane-gate.mjs for the full
 //     reasoning and the in-process (no subprocess per firing) measurement method.
-//  3. SESSION-START WALL TIME (added 2026-07-28) is the SAME tier as 2, and is here because tier 2
-//     alone was not enough. An independent grader's words: the card-lane gate "measures a
-//     0.03–0.22ms in-process function against a 250ms budget (~1000x headroom — it can only catch
-//     catastrophic regression classes)", while "everything the user actually FEELS — heavy-lane
-//     query seconds, session-start WALL TIME, install minutes, dead air, refusal clarity — is
-//     advisory or unmeasured". Session-start wall time is the first of those promoted out of tier 1:
-//     it is the hook a stranger's Claude Code fires before their first prompt is answered, it is
-//     already measured by scripts/selfcheck.mjs's external process-group watchdog (no second timer
-//     was written), and its budget is set from a measured distribution — p95 1000ms is ~3.1x the
-//     worst measured p95 (323ms over n=110), NOT 1000x. See scripts/qe/session-start-gate.mjs.
+//  3. Automatic hook retirement is checked across declared source registries and pointers.
+//     The old SessionStart latency probe remains separately callable for diagnostics.
 //
 // HONESTY (same rules as the product):
 //  • Every number is measured on THIS run. Nothing is asserted from memory.
@@ -39,7 +31,7 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { runCommandProbe } from '../../tests/ux/command-probe.mjs';
 import { runCardLaneGate } from './card-lane-gate.mjs';
-import { runSessionStartGate } from './session-start-gate.mjs';
+import { automaticHookRetirementStatus } from '../../bin/install.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const RENDER_PROBE = path.resolve(HERE, '../../tests/ux/render-probe.mjs');
@@ -322,28 +314,11 @@ export async function runUxSuite() {
     hardFailures.push(`card-lane latency gate: could not run — ${e.message}`);
   }
 
-  // ── Probe 5: session-start wall time — HARD GATE, the first USER-FELT number (ADR-058 D6) ───
-  // Wired exactly like probe 4 above and for the same reason: same tier, same "could not measure is
-  // never success" handling, same refusal to reuse line()'s "(proposed)" phrasing, which is correct
-  // for an advisory row and would misreport a HARD breach.
-  console.log('\n  ── session-start wall time (plugin/hooks/hooks.json SessionStart) — HARD GATE, user-felt ──');
-  try {
-    const ss = await runSessionStartGate();
-    const b = ss.budget;
-    const tag = (ok) => (ok ? '✓' : '✗ HARD FAIL');
-    console.log(`  ${'session-start cold first fire'.padEnd(30)} ${ss.warmupMs.toFixed(0).padStart(10)}ms  ${ss.warmupTimedOut ? '✗ HARD FAIL (declared timeout exceeded)' : '✓ inside declared timeout'}`);
-    console.log(`  ${'session-start p50'.padEnd(30)} ${ss.p50.toFixed(0).padStart(10)}ms  (reported, not gated)`);
-    console.log(`  ${'session-start p95'.padEnd(30)} ${ss.p95.toFixed(0).padStart(10)}ms  budget ${b.p95BudgetMs}ms  ${tag(ss.p95 <= b.p95BudgetMs)}`);
-    console.log(`  ${'session-start max'.padEnd(30)} ${ss.max.toFixed(0).padStart(10)}ms  absolute-fail ${b.absoluteFailMs}ms  ${tag(ss.max <= b.absoluteFailMs)}`);
-    console.log(`  firings: ${ss.n} sequential fires of the REAL registered command via selfcheck.mjs's watchdog, from ${ss.surface.source}`);
-    if (ss.warmupStderr) {
-      console.log(`  cold trace: ${ss.warmupStderr.trim().split('\n').join(' | ')}`);
-    }
-    if (!ss.pass) for (const r of ss.reasons) hardFailures.push(`session-start wall time: ${r}`);
-  } catch (e) {
-    console.log(`  ! could not run the session-start wall-time gate: ${e.message}`);
-    hardFailures.push(`session-start wall-time gate: could not run — ${e.message}`);
-  }
+  // Automatic lifecycle hooks are retired; measure registry state, not a fictitious latency.
+  const hookRetirement = automaticHookRetirementStatus(path.resolve(HERE, '../..'));
+  console.log(`\n  Automatic hooks: ${hookRetirement.ok ? 'RETIRED' : 'FAIL'} — ${hookRetirement.files.length} surfaces inspected`);
+  if (!hookRetirement.ok) hardFailures.push(...hookRetirement.errors,
+    ...hookRetirement.registrations.map(row => `automatic registration remains: ${row.file} ${row.event}`));
 
   // ── Not run on this host (stated, never faked) ──────────────────────────────────────────────
   console.log('\n  ── execution scope ──');
@@ -363,6 +338,7 @@ export async function runUxSuite() {
     budgetsMs: budgets,
     render,
     command: cmd,
+    hookRetirement,
     hardFailures,
     pass: hardFailures.length === 0,
     scope: {
@@ -375,7 +351,7 @@ export async function runUxSuite() {
 
   console.log('\n  ── verdict ──');
   if (hardFailures.length === 0) {
-    console.log('  PASS — every probe ran and every render, explanation, dead-air, decision-lane, and session-start HARD budget passed.\n');
+    console.log('  PASS — every probe ran and every render, explanation, dead-air, decision-lane HARD budget passed; automatic-hook retirement verified.\n');
     return receipt;
   }
   console.log('  FAIL (hard):');