ruvnet-brain 4.3.9 → 4.3.10

package/scripts/qualified-candidate-check.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { extractZip } from '../kb/zip-extract.mjs';
+import { evaluateCandidateReceipt } from './release-proof.mjs';
+import { aggregateEvidence } from './release-evidence-aggregate.mjs';
+import { payloadIdFor } from './release-payload.mjs';
+import { canonicalJson } from './release-transaction.mjs';
+
+const REPO = 'stuinfla/ruvnet-brain';
+const WORKFLOW = '.github/workflows/release-candidate-preflight.yml';
+const positive = (n) => Number.isSafeInteger(n) && n > 0;
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+export function trustedQualificationRun(run, workflow, sha) {
+  return positive(run?.id) && run.workflow_id === workflow.id && run.path === WORKFLOW
+    && run.event === 'push' && run.head_sha === sha && /^release\/.+/.test(run.head_branch || '')
+    && positive(run.repository?.id) && run.repository.full_name === REPO
+    && run.head_repository?.id === run.repository.id && run.head_repository.full_name === REPO;
+}
+function trustedArtifact(artifact, run, name) {
+  return positive(artifact?.id) && artifact.name === name && artifact.expired === false
+    && /^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') && positive(artifact.size_in_bytes)
+    && artifact.workflow_run?.id === run.id && artifact.workflow_run.head_sha === run.head_sha
+    && artifact.workflow_run.head_branch === run.head_branch
+    && artifact.workflow_run.repository_id === run.repository.id
+    && artifact.workflow_run.head_repository_id === run.repository.id;
+}
+export function validateQualificationReceipt(receipt, { sha, run, artifact, requiredCheck }) {
+  if (!['canonical-qa', 'integration'].includes(requiredCheck)) throw new Error('unsupported required check');
+  if (receipt?.schemaVersion !== 1 || receipt.kind !== 'ruvnet-brain-qualified-candidate'
+    || receipt.sha !== sha || receipt.runId !== run.id
+    || canonicalJson(receipt.artifact) !== canonicalJson({ id: artifact.id, name: artifact.name,
+      digest: artifact.digest, size: artifact.size_in_bytes })) throw new Error('qualification receipt provenance differs');
+  const candidate = receipt.candidateReceipt;
+  if (evaluateCandidateReceipt(candidate).verdict !== 'PASS' || candidate.sha !== sha) throw new Error('candidate seal failed');
+  const manifest = receipt.payloadManifest;
+  if (manifest?.schemaVersion !== 1 || manifest.candidateSha !== sha || manifest.version !== candidate.version
+    || manifest.tag !== candidate.tag || !Array.isArray(manifest.members) || !manifest.members.length
+    || new Set(manifest.members.map(({ name }) => name)).size !== manifest.members.length
+    || manifest.members.some((m) => typeof m.name !== 'string' || path.basename(m.name) !== m.name
+      || !positive(m.size) || !/^[a-f0-9]{64}$/.test(m.sha256 || ''))) throw new Error('payload manifest identity differs');
+  const packageName = String(candidate.artifact.path).replaceAll('\\', '/').split('/').at(-1);
+  if (!manifest.members.some((m) => m.name === packageName
+    && m.sha256 === String(candidate.artifact.sha256).replace(/^sha256:/, ''))) throw new Error('candidate package is outside payload');
+  const envelope = receipt.aggregateEnvelope;
+  const rebuilt = aggregateEvidence({ sha, payloadId: payloadIdFor(manifest), leaves: envelope?.leaves });
+  if (canonicalJson(rebuilt) !== canonicalJson(envelope)
+    || envelope.leaves.some((leaf) => leaf.runId !== run.id)) throw new Error('aggregate evidence digest or run differs');
+  return { verdict: 'PASS', sha, requiredCheck, runId: run.id, artifactId: artifact.id,
+    payloadId: rebuilt.payloadId, evidenceDigest: rebuilt.evidenceDigest };
+}
+const api = (endpoint) => JSON.parse(execFileSync('gh', ['api', `repos/${REPO}/${endpoint}`], {
+  encoding: 'utf8', timeout: 30000, maxBuffer: 16 * 1024 * 1024 }));
+export async function downloadQualificationReceipt(artifact, fetchArchive = (id) => execFileSync('gh',
+  ['api', `repos/${REPO}/actions/artifacts/${id}/zip`], { timeout: 60000, maxBuffer: 2 * 1024 * 1024 })) {
+  if (artifact.size_in_bytes > 2 * 1024 * 1024) throw new Error('qualification receipt artifact oversized');
+  const bytes = await fetchArchive(artifact.id);
+  if (`sha256:${sha256(bytes)}` !== artifact.digest) throw new Error('qualification artifact digest differs');
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'qualified-candidate-'));
+  try {
+    const zip = path.join(temp, 'receipt.zip');
+    fs.writeFileSync(zip, bytes);
+    const out = path.join(temp, 'contents');
+    const extracted = await extractZip(zip, out);
+    if (canonicalJson(extracted.entryNames) !== canonicalJson(['qualification-receipt.json'])) throw new Error('unexpected qualification artifact members');
+    const file = path.join(out, 'qualification-receipt.json');
+    if (fs.statSync(file).size > 1024 * 1024) throw new Error('qualification receipt oversized');
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
+}
+export async function checkQualifiedCandidate({ sha, requiredCheck, timeoutMs = 7200000, pollMs = 30000,
+  readApi = api, readReceipt = downloadQualificationReceipt, now = Date.now,
+  pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms)) } = {}) {
+  if (!/^[a-f0-9]{40}$/.test(sha || '') || !['canonical-qa', 'integration'].includes(requiredCheck)
+    || !positive(timeoutMs) || timeoutMs > 7200000 || !positive(pollMs) || pollMs < 30000 || pollMs > 60000) throw new Error('invalid bounded qualification request');
+  const workflow = await readApi('actions/workflows/release-candidate-preflight.yml');
+  if (!positive(workflow.id) || workflow.path !== WORKFLOW) throw new Error('untrusted qualification workflow');
+  const deadline = now() + timeoutMs;
+  for (;;) {
+    const list = await readApi(`actions/workflows/${workflow.id}/runs?event=push&head_sha=${sha}&per_page=100`);
+    if (list.total_count > 100) throw new Error('qualification run listing truncated');
+    const selected = (list.workflow_runs || []).filter((r) => trustedQualificationRun(r, workflow, sha)).sort((a,b) => b.id-a.id)[0];
+    if (selected) {
+      const run = await readApi(`actions/runs/${selected.id}`);
+      if (run.id !== selected.id || !trustedQualificationRun(run, workflow, sha)) throw new Error('qualification run provenance changed');
+      if (run.status === 'completed') {
+        if (run.conclusion !== 'success') throw new Error(`qualification failed: ${run.conclusion}`);
+        const listed = await readApi(`actions/runs/${run.id}/artifacts?per_page=100`);
+        if (listed.total_count > 100) throw new Error('qualification artifact listing truncated');
+        const select = async (name) => {
+          const rows = (listed.artifacts || []).filter((a) => a.name === name);
+          if (rows.length !== 1) throw new Error('missing or duplicate qualification artifact');
+          const artifact = await readApi(`actions/artifacts/${rows[0].id}`);
+          if (artifact.id !== rows[0].id || !trustedArtifact(artifact, run, name)) throw new Error('qualification artifact provenance changed');
+          return artifact;
+        };
+        const artifact = await select(`release-candidate-${sha}`);
+        const small = await select(`qualification-receipt-${sha}`);
+        return validateQualificationReceipt(await readReceipt(small), { sha, run, artifact, requiredCheck });
+      }
+    }
+    const remaining = deadline - now();
+    if (remaining <= 0) throw new Error('timed out waiting for exact-SHA qualification');
+    process.stderr.write('Waiting for exact-SHA release qualification\n');
+    await pause(Math.min(pollMs, remaining));
+  }
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    if (process.env.GITHUB_REPOSITORY !== REPO) throw new Error('unexpected qualification repository');
+    const args = process.argv.slice(2), options = {};
+    for (let i=0;i<args.length;i+=2) {
+      if (!['--sha','--required-check','--timeout-ms','--poll-ms'].includes(args[i]) || !args[i+1]) throw new Error('invalid qualification arguments');
+      options[args[i]] = args[i+1];
+    }
+    console.log(JSON.stringify(await checkQualifiedCandidate({ sha: options['--sha'], requiredCheck: options['--required-check'],
+      ...(options['--timeout-ms'] ? {timeoutMs:Number(options['--timeout-ms'])} : {}),
+      ...(options['--poll-ms'] ? {pollMs:Number(options['--poll-ms'])} : {}) })));
+  } catch(error) { console.error(error.message); process.exitCode=1; }
+}

package/scripts/release-abort-stale.mjs

@@ -34,7 +34,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import {
-  RECEIPT_PREFIX, TERMINAL_STATES, ALLOWED_TRANSITIONS, canonicalJson, digestReceipt, signReceipt,
+  RECEIPT_PREFIX, isClosedReceipt, ALLOWED_TRANSITIONS, canonicalJson, digestReceipt, signReceipt,
 } from './release-transaction.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
@@ -65,7 +65,7 @@ const receipts = receiptAssets.map(fetchAsset).sort((a, b) => a.sequence - b.seq
 const last = receipts.at(-1);
 log(`${TAG}: ${receipts.length} receipt(s), latest seq=${last.sequence} state=${last.state} txn=${String(last.transactionId).slice(0, 16)}…`);
 
-if (TERMINAL_STATES.has(last.state)) {
+if (isClosedReceipt(last)) {
   log(`already terminal (${last.state}) — nothing to do.`);
   process.exit(0);
 }

package/scripts/release-projection.mjs

@@ -6,7 +6,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { digest, generationLedgerBytes, projectPublicGenerationLedger,
-  releaseCoverageGenerationFor } from '../plugin/scripts/coverage-integrity.mjs';
+  releaseCoverageGenerationFor, validateCoverageDirectory } from '../plugin/scripts/coverage-integrity.mjs';
 import { validatePublicInventory } from './public-inventory.mjs';
 import { readRvfGenerations } from './rvf-generation.mjs';
 
@@ -15,6 +15,25 @@ const arg = (name, fallback = null) => { const i = process.argv.indexOf(name); r
 const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
 
+// The first assembly supplies seed bytes to the projection producer. Only the final, projected
+// assembly has a release-bound public ledger; its runtime ledger must describe that same set.
+export function bindAssembledReleaseProjection({ assetsDir, version, sourceSnapshot }) {
+  const ledger = readJson(path.join(assetsDir, 'PUBLIC-RVF-GENERATIONS.json'));
+  if (!/^[a-f0-9]{40}$/.test(sourceSnapshot || '') || ledger.schemaVersion !== 2
+    || ledger.kind !== 'ruvnet-brain-public-generation-ledger'
+    || ledger.brainVersion !== version || ledger.releaseTag !== `v${version}`
+    || ledger.sourceSnapshot !== sourceSnapshot) {
+    throw new Error('assembled public ledger does not bind this release source');
+  }
+  fs.writeFileSync(path.join(assetsDir, 'RVF-GENERATIONS.json'), `${JSON.stringify({
+    ...ledger, kind: 'ruvnet-brain-runtime-generation-ledger',
+  }, null, 2)}\n`);
+  const result = validateCoverageDirectory(assetsDir, { expectedVersion: version,
+    expectedSourceSnapshot: sourceSnapshot, requireCompleteProfile: true });
+  if (!result.valid) throw new Error(`assembled release projection rejected: ${result.failures.join('; ')}`);
+  return result;
+}
+
 function seedCompatibleGistReceipt() {
   const source = readJson(path.join(ROOT, 'kb', 'ruv-gists.sources.json'));
   const gists = {};

package/scripts/release-qualification-contract.mjs

@@ -0,0 +1,87 @@
+// Reviewed stabilization release boundaries. Legacy tests remain developer diagnostics.
+export const RELEASE_REQUIREMENTS = Object.freeze({
+  "source": [
+    {
+      "id": "signed-artifacts",
+      "reason": "Signature verification and exact assembled coverage reject changed bytes",
+      "files": [
+        "tests/unit/sign-verify-roundtrip.test.mjs",
+        "tests/unit/assembled-release-projection.test.mjs"
+      ]
+    },
+    {
+      "id": "protected-publication",
+      "reason": "Only owner-authorized exact-source artifacts enter publication",
+      "files": [
+        "tests/unit/protected-release-invocation.test.mjs",
+        "tests/unit/release-identity-invariants.test.mjs",
+        "tests/unit/release-transaction.test.mjs",
+        "tests/unit/prepublication-evidence.test.mjs",
+        "tests/unit/integration-evidence.test.mjs",
+        "tests/unit/qualified-candidate-check.test.mjs",
+        "tests/unit/release-qualification.test.mjs",
+        "tests/unit/development-push-boundary.test.mjs"
+      ]
+    },
+    {
+      "id": "public-verification",
+      "reason": "Public bytes, native update evidence and terminal receipts are bound to the actual candidate and run",
+      "files": [
+        "tests/unit/public-verification-aggregate.test.mjs",
+        "tests/unit/public-verification-finalizer.test.mjs",
+        "tests/unit/public-verification-lane.test.mjs",
+        "tests/unit/public-verification-abandon.test.mjs",
+        "tests/unit/publication-receipt-producer.test.mjs",
+        "tests/unit/recovery-candidate-source.test.mjs"
+      ]
+    },
+    {
+      "id": "safe-install-update",
+      "reason": "Installation and update preserve prior and private state and reject invalid dependencies",
+      "files": [
+        "tests/unit/automatic-hook-retirement.test.mjs",
+        "tests/unit/install-activation-rollback.test.mjs",
+        "tests/unit/forge-update-apply-rollback.test.mjs"
+      ]
+    },
+    {
+      "id": "native-scheduler",
+      "reason": "Owned scheduler lifecycle, execution identity, measured no-op and signed installed coverage",
+      "files": [
+        "tests/unit/nightly-scheduler.test.mjs",
+        "tests/unit/nightly-refresh-launcher.test.mjs",
+        "tests/unit/nightly-two-run-proof.test.mjs"
+      ]
+    }
+  ],
+  "integration": [
+    {
+      "id": "native-explicit-interface",
+      "reason": "Real MCP subprocess readiness, command policy and literal argv safety",
+      "files": [
+        "tests/integration/managed-cli-mcp.test.mjs"
+      ]
+    },
+    {
+      "id": "private-bundle-boundary",
+      "reason": "Actual bundle builder rejects absent private fence and incomplete public payloads",
+      "files": [
+        "tests/integration/build-bundle-fence.test.mjs"
+      ]
+    },
+    {
+      "id": "native-codex-discovery",
+      "reason": "Actual Codex plugin discovery and repair preserve explicit disabled state",
+      "files": [
+        "tests/integration/codex-skill-discovery.test.mjs"
+      ]
+    },
+    {
+      "id": "owned-uninstall",
+      "reason": "Actual offline uninstall preserves unrelated files and user guidance",
+      "files": [
+        "tests/integration/uninstall-footprint.test.mjs"
+      ]
+    }
+  ]
+});

package/scripts/release-qualification.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { digest } from './coverage-integrity.mjs';
+import { sourceIdentity } from './qa-contract.mjs';
+import { RELEASE_REQUIREMENTS } from './release-qualification-contract.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PLATFORM = { linux: 'linux', darwin: 'macos', win32: 'windows' }[process.platform];
+
+export function qualificationPlan(suite = 'source') {
+  const requirements = RELEASE_REQUIREMENTS[suite];
+  if (!requirements?.length) throw new Error('unknown qualification suite');
+  const files = requirements.flatMap((entry) => entry.files);
+  if (new Set(files).size !== files.length || files.some((file) => !file.startsWith('tests/')
+    || !file.endsWith('.test.mjs') || file.includes('..'))) throw new Error('invalid qualification inventory');
+  return { requirements, files, contractSha256: digest(requirements) };
+}
+
+export function assessTestReport(report, files, root = ROOT, platform = PLATFORM) {
+  if (!['linux', 'macos', 'windows'].includes(platform)) throw new Error('invalid test report platform');
+  const paths = platform === 'windows' ? path.win32 : path.posix;
+  if (typeof root !== 'string' || !paths.isAbsolute(root)) throw new Error('test report checkout root must be absolute');
+  const results = report?.testResults;
+  if (!Array.isArray(results) || results.length !== files.length) throw new Error('test report file inventory differs');
+  const expected = new Set(files.map((file) => paths.resolve(root, file)));
+  if (results.some(file => typeof file.name !== 'string' || !paths.isAbsolute(file.name))) throw new Error('test report file inventory requires absolute names');
+  const names = results.map((file) => paths.resolve(file.name));
+  if (new Set(names).size !== files.length || names.some((name) => !expected.has(name))) {
+    throw new Error('test report contains missing, duplicate, or unexpected files');
+  }
+  const cases = results.flatMap((file) => file.assertionResults || []);
+  if (!cases.length || results.some((file) => file.status !== 'passed' || !file.assertionResults?.length)
+    || cases.some((test) => test.status !== 'passed') || report.success !== true
+    || report.numFailedTests !== 0 || report.numFailedTestSuites !== 0
+    || report.numPendingTests !== 0 || (report.numTodoTests || 0) !== 0
+    || report.numTotalTests !== cases.length || report.numPassedTests !== cases.length) {
+    throw new Error('reviewed release cases did not all execute and pass');
+  }
+  return { total: cases.length, passed: cases.length, failed: 0, skipped: 0 };
+}
+
+export function validateQualificationReceipt(report, { suite, platform, sourceSha }) {
+  const plan = qualificationPlan(suite);
+  const { receiptSha256, ...payload } = report || {};
+  if (report?.schemaVersion !== 1 || report.kind !== 'ruvnet-brain-release-qualification'
+    || report.suite !== suite || report.platform !== platform || report.status !== 'PASS'
+    || digest(payload) !== receiptSha256 || report.contractSha256 !== plan.contractSha256
+    || digest(report.files) !== digest(plan.files)
+    || digest(report.requirements) !== digest(plan.requirements.map(row => row.id))) {
+    throw new Error('qualification receipt identity, digest, or reviewed contract differs');
+  }
+  if (!/^[a-f0-9]{40}$/.test(String(sourceSha)) || report.source?.sha !== sourceSha
+    || report.sourceAfter?.sha !== sourceSha || report.source.dirty !== false || report.sourceAfter.dirty !== false
+    || !/^[a-f0-9]{64}$/.test(report.source.digest || '') || report.source.digest !== report.sourceAfter.digest
+    || report.sourceStable !== true) throw new Error('qualification source is not clean and unchanged');
+  if (!Array.isArray(report.results) || !report.results.length
+    || report.results.some(row => row.status !== 'PASS' || row.exitCode !== 0)) {
+    throw new Error('qualification command did not complete successfully');
+  }
+  if (typeof report.checkoutRoot !== 'string' || !report.checkoutRoot) throw new Error('qualification checkout root is missing');
+  const tests = assessTestReport(report.testReport, plan.files, report.checkoutRoot, platform);
+  if (digest(tests) !== digest(report.tests)) throw new Error('qualification test summary differs from executed cases');
+  return tests;
+}
+
+export function runQualification({ suite = 'source', platform = PLATFORM, report: output, root = ROOT } = {}) {
+  if (platform !== PLATFORM) throw new Error(`cannot produce ${platform} evidence on ${PLATFORM}`);
+  if (!output || fs.existsSync(output)) throw new Error('a new --report path is required');
+  const plan = qualificationPlan(suite);
+  for (const file of plan.files) if (!fs.statSync(path.resolve(root, file)).isFile()) throw new Error(`missing test ${file}`);
+  const source = sourceIdentity(root);
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'release-qualification-'));
+  const results = [];
+  let testReport = null;
+  let tests = { total: 0, passed: 0, failed: 0, skipped: 0 };
+  const execute = (name, args) => {
+    const run = spawnSync(process.execPath, ['scripts/ci/step-watchdog.mjs', '--name', name,
+      '--timeout-ms', '900000', '--receipt-dir', temp, '--', process.execPath, ...args],
+    { cwd: root, env: { ...process.env, ...(suite === 'integration' ? { RUVNET_REQUIRE_CODEX_DISCOVERY: '1' } : {}) },
+      stdio: 'inherit' });
+    const ok = !run.error && run.status === 0;
+    results.push({ name, status: ok ? 'PASS' : 'FAIL', exitCode: run.status });
+    if (!ok) throw new Error(`${name} failed`);
+  };
+  let failure = null;
+  try {
+    if (suite === 'source') {
+      execute('release-version', ['scripts/sync-version.mjs', '--check']);
+      execute('release-source-identity', ['scripts/convergence-manifest.mjs']);
+      execute('automatic-hook-retirement', ['scripts/hook-retirement-check.mjs']);
+    }
+    const testPath = path.join(temp, 'tests.json');
+    execute(`release-${suite}-${platform}`, ['node_modules/vitest/vitest.mjs', 'run', ...plan.files,
+      '--reporter=json', '--outputFile', testPath, '--maxWorkers=1']);
+    testReport = JSON.parse(fs.readFileSync(testPath, 'utf8'));
+    tests = assessTestReport(testReport, plan.files, root);
+  } catch (error) {
+    failure = error.message;
+    const testPath = path.join(temp, 'tests.json');
+    if (fs.existsSync(testPath)) {
+      try {
+        testReport = JSON.parse(fs.readFileSync(testPath, 'utf8'));
+        tests = { total: testReport.numTotalTests || 0, passed: testReport.numPassedTests || 0,
+          failed: testReport.numFailedTests || 0,
+          skipped: (testReport.numPendingTests || 0) + (testReport.numTodoTests || 0) };
+      } catch { /* failed report remains a failure */ }
+    }
+  }
+  const sourceAfter = sourceIdentity(root);
+  const sourceStable = source.digest === sourceAfter.digest;
+  const receipt = { schemaVersion: 1, kind: 'ruvnet-brain-release-qualification', suite, platform, checkoutRoot: path.resolve(root),
+    source, sourceAfter, sourceStable, status: !failure && sourceStable ? 'PASS' : 'FAIL',
+    requirements: plan.requirements.map((entry) => entry.id), contractSha256: plan.contractSha256,
+    files: plan.files, tests, testReport, results, failure, observedAt: new Date().toISOString() };
+  receipt.receiptSha256 = digest(receipt);
+  fs.mkdirSync(path.dirname(path.resolve(output)), { recursive: true });
+  fs.writeFileSync(output, JSON.stringify(receipt, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+  fs.rmSync(temp, { recursive: true, force: true });
+  return receipt;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2);
+  const value = (flag, fallback) => { const i = args.indexOf(flag); return i < 0 ? fallback : args[i + 1]; };
+  try {
+    const receipt = runQualification({ suite: value('--suite', 'source'), platform: value('--platform', PLATFORM),
+      report: value('--report') });
+    console.log(JSON.stringify({ status: receipt.status, tests: receipt.tests, receiptSha256: receipt.receiptSha256 }));
+    process.exitCode = receipt.status === 'PASS' ? 0 : 1;
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/scripts/release-transaction.mjs

@@ -68,7 +68,7 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
   compensated: ['github-promote-intent', 'npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
   'defaults-promoted': ['finalize-intent', 'manual-intervention-required', ...ABORTABLE],
   'finalize-intent': ['channels-converged', 'manual-intervention-required', ...ABORTABLE],
-  'manual-intervention-required': [],
+  'manual-intervention-required': [...ABORTABLE],
   'channels-converged': ['install-verified', 'abandoned', 'superseded'],
   'install-verified': [],
   abandoned: [],
@@ -506,11 +506,18 @@ export async function abortReleaseTransaction({ identity, receipts, reason, auth
 export async function finalizeReleaseTransaction({
   identity,
   aggregate,
+  verifierSha,
+  workflowRunId,
   adapter,
   privateKey,
   publicKey,
   aggregatePublicKey,
 } = {}) {
+  if (!/^[1-9][0-9]*$/.test(String(workflowRunId || ''))) throw new Error('expected workflow run ID is required');
+  if (verifierSha !== undefined && (!/^[a-f0-9]{40}$/.test(String(verifierSha))
+    || aggregate?.identity?.verifierSha !== verifierSha)) {
+    throw new Error('public verification verifier SHA differs from the expected verifier');
+  }
   if (!adapter || typeof adapter.discover !== 'function' || typeof adapter.observeSnapshot !== 'function'
     || typeof adapter.materializePublicVerificationAggregate !== 'function'
     || typeof adapter.appendReceipt !== 'function' || typeof adapter.readReceipt !== 'function') {
@@ -518,6 +525,7 @@ export async function finalizeReleaseTransaction({
   }
   const expectedAggregateIdentity = {
     ...aggregate?.identity,
+    workflowRunId: String(workflowRunId),
     sourceSha: identity?.candidateSha,
     version: identity?.version,
     tag: identity?.tag,
@@ -560,6 +568,7 @@ export async function finalizeReleaseTransaction({
       verdict: 'INSTALL_VERIFIED',
       publicVerification: {
         aggregateSha256: aggregate.aggregateSha256,
+        ...(aggregate.identity.verifierSha === undefined ? {} : { verifierSha: aggregate.identity.verifierSha }),
         aggregateAssetSha256,
         signatureAssetSha256,
         lanes: aggregate.metrics.leaves,
@@ -580,3 +589,74 @@ export async function finalizeReleaseTransaction({
   validateReceiptChain([...chain, persisted], identity, publicKey);
   return persisted;
 }
+
+// Close an unsuccessful public verification attempt without changing public bytes or truth.
+export async function abandonPublicVerificationTransaction({ identity, expected, reason, authorization,
+  recovery, failure, adapter, privateKey, publicKey } = {}) {
+  const hex = (value, length) => new RegExp(`^[a-f0-9]{${length}}$`).test(value || '');
+  const bounded = (value, max) => typeof value === 'string' && value.trim().length > 0 && value.length <= max;
+  if (!expected || expected.transactionId !== transactionIdFor(identity)
+    || !Number.isSafeInteger(expected.sequence) || expected.sequence < 0 || !hex(expected.receiptDigest, 64)) {
+    throw new Error('abandonment requires exact expected transaction, sequence, and digest');
+  }
+  if (!bounded(reason, 1024) || !bounded(authorization?.actor, 100) || !bounded(authorization?.reference, 1024)
+    || authorization.event !== 'repository_dispatch' || authorization.action !== 'abandon-public-verification'
+    || !Number.isSafeInteger(authorization.dispatchRunId) || authorization.dispatchRunId <= 0
+    || !hex(authorization.verifierSha, 40)) throw new Error('explicit abandonment authorization provenance is required');
+  if (recovery?.event !== 'repository_dispatch' || !Number.isSafeInteger(recovery.workflowId) || recovery.workflowId <= 0
+    || !Number.isSafeInteger(recovery.repositoryId) || recovery.repositoryId <= 0
+    || recovery.repository !== identity.repository || recovery.workflow !== '.github/workflows/recover-public-verification.yml'
+    || recovery.conclusion !== 'failure' || !Number.isSafeInteger(recovery.runId) || recovery.runId <= 0
+    || !Number.isSafeInteger(recovery.artifactId) || recovery.artifactId <= 0 || !hex(recovery.verifierSha, 40)
+    || recovery.artifactName !== `recovered-public-verification-${failure?.os}-${identity.candidateSha}-${recovery.runId}`) {
+    throw new Error('failed recovery provenance differs from the candidate');
+  }
+  const { failureSha256, ...failurePayload } = failure || {};
+  if (Buffer.byteLength(canonicalJson(failure || {})) > 131072 || failure?.schemaVersion !== 1
+    || failure.kind !== 'ruvnet-brain-public-verification-failure' || !['linux', 'macos', 'windows'].includes(failure.os)
+    || failure.sourceSha !== identity.candidateSha || failure.artifactSha256 !== identity.packageSha256
+    || failure.bundleSha256 !== identity.bundleSha256 || !Array.isArray(failure.failures)
+    || failure.failures.length < 1 || failure.failures.length > 3
+    || failure.failures.some((entry) => !bounded(entry.reason, 4096))
+    || (failure.verifierSha !== undefined && failure.verifierSha !== recovery.verifierSha)
+    || !hex(failureSha256, 64)
+    || crypto.createHash('sha256').update(canonicalJson(failurePayload)).digest('hex') !== failureSha256) {
+    throw new Error('bounded failed recovery evidence is invalid or belongs to another candidate');
+  }
+  const intent = { expected, reason, authorization: { actor: authorization.actor, reference: authorization.reference }, recovery, failureSha256 };
+  const intentSha256 = crypto.createHash('sha256').update(canonicalJson(intent)).digest('hex');
+  if (!adapter || ['discover', 'observeSnapshot', 'appendReceipt', 'readReceipt'].some((key) => typeof adapter[key] !== 'function')) {
+    throw new Error('abandonment adapter is incomplete');
+  }
+  const discovered = await adapter.discover(identity);
+  const chain = validateReceiptChain(discovered.receipts || [], identity, publicKey);
+  const current = chain.at(-1);
+  if (current?.state === 'abandoned') {
+    if (current.observation?.abandonment?.intentSha256 !== intentSha256) throw new Error('conflicting abandonment intent');
+    return current;
+  }
+  if (current?.schemaVersion !== 3 || current.state !== 'channels-converged'
+    || current.observation?.verdict !== 'PUBLISHED_NOT_VERIFIED'
+    || current.sequence !== expected.sequence || current.receiptDigest !== expected.receiptDigest) {
+    throw new Error('abandonment expected receipt is not the current published-unverified transaction');
+  }
+  const snapshot = await adapter.observeSnapshot(identity, discovered.matchingDrafts?.[0], { forceAssets: true });
+  if (snapshot.readError || !npmLatestIsB(snapshot, identity) || !npmCandidateExact(snapshot, identity)
+    || !githubIsB(snapshot, identity) || snapshot.github?.published !== true || snapshot.github?.latest !== true
+    || snapshot.github?.assetsExact !== true
+    || canonicalJson(snapshot.npm) !== canonicalJson(current.observation.npm)
+    || canonicalJson(snapshot.github) !== canonicalJson(current.observation.github)) {
+    throw new Error('public artifacts or channels changed before abandonment');
+  }
+  const receipt = stateReceipt({ identity, prior: current, state: 'abandoned', privateKey,
+    observation: { verdict: 'PUBLISHED_NOT_VERIFIED', abandonment: { intentSha256, ...intent, authorization, failure },
+      npm: snapshot.npm, github: snapshot.github } });
+  verifyReceipt(receipt, publicKey);
+  const name = `${RECEIPT_PREFIX}${String(receipt.sequence).padStart(4, '0')}.json`;
+  await adapter.appendReceipt(discovered.matchingDrafts?.[0] || null, receipt, name);
+  const persisted = await adapter.readReceipt(discovered.matchingDrafts?.[0] || null, receipt.sequence);
+  verifyReceipt(persisted, publicKey);
+  if (canonicalJson(persisted) !== canonicalJson(receipt)) throw new Error('abandoned receipt readback differs');
+  validateReceiptChain([...chain, persisted], identity, publicKey);
+  return persisted;
+}

package/scripts/remedy-registry.mjs

@@ -103,26 +103,19 @@ export const REMEDIES = [
     inverse: () => ({ kind: K.RESTORE_STORE_BACKUPS }),
   },
   {
-    // THE CAPABILITY BRIDGE'S ONLY CURRENT MEMBER. buildCapabilityRecommendations() in
-    // console-engine.mjs offers `enable:memory-distillation` only while the capability is OFF; this
-    // is the executor behind it. See distill-project.mjs's header for why THIS script and not bare
-    // `ruflo memory distill run`: the wrapper snapshots first, fails closed on a receipt-write
-    // failure, and its `--restore` is the tested inverse (proven 644→648→644→648, 2026-07-24).
+    // Retained for explicit execution and existing receipts, not offered as reversible.
+    // The restore command refuses unsafe replacement; historical roundtrips do not authorize it.
     key: 'enable-memory-distillation',
-    autoEligible: true,
-    summary: "mine this project's stored memories into reusable patterns (snapshots first; reversible)",
+    autoEligible: false,
+    summary: "mine this project's stored memories into reusable patterns (snapshots first; automatic undo unavailable)",
     match: (id) => (id === 'enable:memory-distillation' ? {} : null),
     // This console instance is always scoped to ONE project — the directory it was started in — the
     // same assumption the memory-index/learning-flush/learning-train remedies above already make.
     // `usesServerProject` asks onboarding-console.mjs (impure, process-aware) to supply that directory
     // at call time; this file stays pure and never reads process.cwd() itself (see header).
     plan: () => ({ script: 'scripts/distill-project.mjs', args: [], usesServerProject: true }),
-    // `--restore` with no path argument uses distill-project.mjs's OWN newestSnapshot() lookup inside
-    // this project's `.swarm/backups` — the exact mechanism its header proves end to end. Re-deriving
-    // which snapshot to restore here, instead of asking the tool that took it, is the kind of
-    // duplicate implementation this project has already been burned by once (ADR-047's rejected
-    // "offered command and promised undo live on different execution paths" bug).
-    inverse: () => ({ kind: K.RESTORE_PROJECT_DISTILL }),
+    inverse: () => ({ kind: K.RESTORE_PROJECT_DISTILL, available: false,
+      human: 'automatic undo is unavailable; retain the snapshot and coordinate offline SQLite recovery with all database users stopped' }),
   },
   {
     key: 'stack-sync',