ruvnet-brain 4.3.9 → 4.3.11

package/scripts/prepublication-evidence.mjs

@@ -5,7 +5,10 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { aggregateEvidence } from './release-evidence-aggregate.mjs';
 import { canonicalJson } from './release-transaction.mjs';
-import { EXCLUSION_POLICY } from './integration-evidence.mjs';
+import { RELEASE_QUALIFICATION_POLICY } from './integration-evidence.mjs';
+import { readCandidateRetrieval } from './staged-host-verifier.mjs';
+import { validateRetrievalCanaryReceipt } from './retrieval-canary.mjs';
+import { payloadIdFor } from './release-payload.mjs';
 
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
 
@@ -44,10 +47,13 @@ export function buildPrepublicationEvidence({
   manifestFile,
   payloadProofFile,
   hostFile,
+  runtimeCensusFile,
   ciFile,
   integrationFile,
   uxFiles,
   strangerFile,
+  planFile,
+  coverageFile,
 }) {
   if (!/^[a-f0-9]{40}$/.test(sha || '') || !/^\d+\.\d+\.\d+$/.test(version || '') || !Number.isSafeInteger(runId) || runId <= 0) {
     throw new Error('prepublication identity is malformed');
@@ -60,10 +66,30 @@ export function buildPrepublicationEvidence({
     throw new Error('candidate manifest identity mismatch');
   }
   if (!/^[a-f0-9]{64}$/.test(payload.payloadId || '')) throw new Error('payload identity is malformed');
+  if (payload.payloadId !== payloadIdFor(manifest)) throw new Error('candidate manifest payload identity mismatch');
+  const retrieval = readCandidateRetrieval({ manifest, planFile, coverageFile });
+
+  const runtimeCensus = readJson(runtimeCensusFile);
+  const census = runtimeCensus.value;
+  const result = census.result;
+  const artifacts = result?.provenance?.artifacts;
+  const candidate = result?.provenance?.candidate;
+  const memberHash = (role) => manifest.members.find((member) => member.role === role)?.sha256;
+  if (census.schemaVersion !== 1 || census.kind !== 'ruvnet-brain-runtime-census-evidence'
+    || census.sourceSha !== sha || census.version !== version || census.runId !== runId
+    || census.payloadId !== payload.payloadId || census.payloadManifestSha256 !== sha256(manifestBytes)
+    || result?.status !== 'PASS' || result.diagnostic !== false || result.qualification !== 'staged-candidate'
+    || result.provenance?.projectionVerified !== true || candidate?.sourceSha !== sha || candidate?.version !== version
+    || candidate?.coverageSha256 !== sha256(fs.readFileSync(coverageFile))
+    || artifacts?.payloadId !== payload.payloadId || artifacts.claimSourceSha !== sha
+    || artifacts.packageSha256 !== memberHash('npm') || artifacts.bundleSha256 !== memberHash('bundle')
+    || !(artifacts.sidecarsVerified > 0) || !(artifacts.surfacesVerified > 0)) {
+    throw new Error('runtime census receipt is not an exact candidate-bound PASS');
+  }
 
   const host = readJson(hostFile);
   if (host.value.schemaVersion !== 1 || host.value.sha !== sha || host.value.payloadId !== payload.payloadId
-    || !/^[a-f0-9]{64}$/.test(host.value.artifactSha256 || '') || host.value.leaves?.length !== 3) {
+    || host.value.artifactSha256 !== retrieval.artifactSha256 || host.value.leaves?.length !== 3) {
     throw new Error('candidate host evidence identity or shape mismatch');
   }
   requireExactSet(host.value.leaves.map(({ name }) => name), ['claude-only', 'codex-only', 'dual-host'], 'candidate host leaves');
@@ -77,10 +103,11 @@ export function buildPrepublicationEvidence({
       || leaf.artifactSha256 !== host.value.artifactSha256) {
       throw new Error(`candidate host leaf is not an exact PASS: ${leaf.name || '(missing)'}`);
     }
+    validateRetrievalCanaryReceipt(leaf.retrieval, { plan: retrieval.plan });
   }
 
   const ci = readJson(ciFile);
-  const requiredCiJobs = ['candidate-preflight', 'check', 'windows-unit', 'warm-brain', 'release-qe'];
+  const requiredCiJobs = ['candidate-preflight', 'release-acceptance-linux', 'release-acceptance-windows', 'release-acceptance-macos', 'release-qe'];
   if (ci.value.schemaVersion !== 1 || ci.value.kind !== 'ruvnet-brain-candidate-ci-evidence'
     || ci.value.sourceSha !== sha || ci.value.version !== version || ci.value.payloadId !== payload.payloadId
     || ci.value.payloadManifestSha256 !== sha256(manifestBytes) || ci.value.workflow !== 'ci'
@@ -89,6 +116,10 @@ export function buildPrepublicationEvidence({
   }
   requireExactSet(ci.value.jobs?.map(({ name }) => name) || [], requiredCiJobs, 'candidate CI jobs');
   if (ci.value.jobs.some(({ conclusion }) => conclusion !== 'success')) throw new Error('candidate CI receipt contains a non-success job');
+  requireExactSet(ci.value.acceptanceReceipts?.map(({ platform }) => platform) || [], ['linux', 'macos', 'windows'], 'release acceptance platforms');
+  if (ci.value.acceptanceReceipts.some(row => row.sourceSha !== sha || !(row.passed > 0)
+    || !/^[a-f0-9]{64}$/.test(row.receiptSha256 || ''))) throw new Error('release acceptance receipt identity mismatch');
+
 
   const integration = readJson(integrationFile);
   if (integration.value.schemaVersion !== 1 || integration.value.kind !== 'ruvnet-brain-integration-evidence'
@@ -102,7 +133,9 @@ export function buildPrepublicationEvidence({
     || integration.value.skippedTests.some((name) => typeof name !== 'string' || !name.trim())) {
     throw new Error('integration receipt is not an exact, fully accounted PASS');
   }
-  if (integration.value.exclusionPolicy !== EXCLUSION_POLICY
+  if (integration.value.exclusionPolicy !== RELEASE_QUALIFICATION_POLICY
+    || integration.value.skipped !== 0 || integration.value.todo !== 0
+    || !/^[a-f0-9]{64}$/.test(integration.value.qualificationReceiptSha256 || '')
     || !Array.isArray(integration.value.todoTests)
     || integration.value.todoTests.length !== Number(integration.value.todo || 0)
     || !/^[a-f0-9]{64}$/.test(integration.value.exclusionsSha256 || '')) {
@@ -133,9 +166,9 @@ export function buildPrepublicationEvidence({
 
   const common = { sha, payloadId: payload.payloadId, runId };
   const leaves = [
-    passLeaf({ ...common, name: 'source-quality', source: 'candidate-ci-receipt:check', receiptSha256: ci.digest }),
+    passLeaf({ ...common, name: 'source-quality', source: 'candidate-ci-receipt:release-acceptance-linux', receiptSha256: ci.digest }),
     passLeaf({ ...common, name: 'ux-qe', source: 'ux-qe-receipts:darwin,linux,win32', receiptSha256: uxDigest }),
-    passLeaf({ ...common, name: 'release-qe', source: 'candidate-ci-receipt:release-qe', receiptSha256: ci.digest }),
+    passLeaf({ ...common, name: 'release-qe', source: 'candidate-ci-receipt:release-qe', receiptSha256: ci.digest, runtimeCensusSha256: runtimeCensus.digest }),
     passLeaf({ ...common, name: 'integration-linux', source: 'integration-receipt', receiptSha256: integration.digest,
       skipped: integration.value.skipped, todo: integration.value.todo }),
     passLeaf({ ...common, name: 'stranger-linux', source: 'stranger-receipt:ubuntu', receiptSha256: stranger.digest }),
@@ -161,6 +194,9 @@ if (isCli) {
     manifestFile: path.resolve(arg('--manifest')),
     payloadProofFile: path.resolve(arg('--payload-proof')),
     hostFile: path.resolve(arg('--hosts')),
+    runtimeCensusFile: path.resolve(arg('--runtime-census')),
+    planFile: arg('--plan'),
+    coverageFile: arg('--coverage'),
     ciFile: path.resolve(arg('--ci')),
     integrationFile: path.resolve(arg('--integration')),
     uxFiles,

package/scripts/primer-grounding.mjs

@@ -0,0 +1,20 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Citation presence is an admission check, not semantic verification of each generated claim.
+export function countPrimerReferences(primer, sourcePaths) {
+  const paths = [...new Set(sourcePaths)].filter((value) => typeof value === 'string' && value);
+  const citations = new Set([...primer.matchAll(/`([^`\n]+)`/g)].map((match) => match[1]));
+  const basenames = new Map();
+  for (const file of paths) basenames.set(path.basename(file), (basenames.get(path.basename(file)) || 0) + 1);
+  return paths.filter((file) => citations.has(file)
+    || (basenames.get(path.basename(file)) === 1 && citations.has(path.basename(file))));
+}
+
+export function writeGroundedPrimer({ primer, sourcePaths, output, minimum = 6 }) {
+  if (!Number.isInteger(minimum) || minimum < 1) throw new Error('invalid primer citation minimum');
+  const refs = countPrimerReferences(primer, sourcePaths);
+  if (refs.length < minimum) throw new Error(`THIN primer: ${refs.length} distinct source citations; requires ${minimum}. Existing primer preserved.`);
+  fs.writeFileSync(output, primer);
+  return refs;
+}

package/scripts/product-integrity-contract.mjs

@@ -43,7 +43,7 @@ const make = (id, statement, owner, contributors, implementation, tests, receipt
 export const PRODUCT_INTEGRITY_OBLIGATIONS = Object.freeze([
   make('S-1', 'One complete public corpus', 'CorpusGeneration', ['SourceCoverage'], ['scripts/source-coverage.mjs', 'scripts/corpus-reconcile.mjs', 'scripts/corpus-candidate.mjs'], ['tests/unit/source-coverage.test.mjs', 'tests/unit/corpus-reconcile.test.mjs'], ['ruvnet-brain-source-observation', 'ruvnet-brain-corpus-candidate']),
   make('S-2', 'One immutable public release projection', 'ReleaseProjection', ['CorpusGeneration'], ['scripts/build-bundle.mjs', 'scripts/coverage-integrity.mjs', 'scripts/public-inventory.mjs'], ['tests/integration/build-bundle-fence.test.mjs', 'tests/unit/public-inventory.test.mjs'], ['ruvnet-brain-release-coverage']),
-  make('S-3', 'Recall at 10 is at least 98 percent and delta citations are complete', 'PublicVerification', ['SourceCoverage', 'CorpusGeneration'], ['scripts/retrieval-canary.mjs', 'scripts/packed-retrieval-canary.mjs'], ['tests/unit/retrieval-canary.test.mjs', 'tests/unit/packed-retrieval-canary.test.mjs'], ['ruvnet-brain-retrieval-canary-plan', 'ruvnet-brain-retrieval-canary-receipt']),
+  make('S-3', 'Recall at 10 is at least 98 percent and delta citations are complete', 'PublicVerification', ['SourceCoverage', 'CorpusGeneration'], ['scripts/retrieval-canary.mjs', 'scripts/candidate-host-evidence.mjs', 'scripts/prepublication-evidence.mjs', 'scripts/host-install-matrix.mjs', 'kb/retrieval-result.mjs'], ['tests/unit/retrieval-canary.test.mjs', 'tests/unit/candidate-host-evidence.test.mjs', 'tests/unit/candidate-retrieval-matrix.test.mjs', 'tests/unit/retrieval-result-boundary.test.mjs'], ['ruvnet-brain-retrieval-canary-plan', 'ruvnet-brain-retrieval-canary-receipt']),
   make('S-4', 'Native nightly runs are ordered, idempotent, and retained within budget', 'RefreshLifecycle', [], ['bin/nightly-refresh.mjs', 'plugin/scripts/nightly-scheduler.mjs', 'scripts/nightly-two-run-proof.mjs', 'kb/refresh-run.mjs'], ['tests/unit/nightly-scheduler.test.mjs', 'tests/unit/nightly-two-run-proof.test.mjs'], ['ruvnet-brain-refresh-run', 'ruvnet-brain-native-two-run-nightly-proof']),
   make('S-5', 'One active corpus preserves private stores and bounded recovery', 'RefreshLifecycle', ['CorpusGeneration'], ['kb/update-storage-transaction.mjs', 'kb/forge-update.mjs', 'kb/brain-profile.mjs', 'bin/install.mjs'], ['tests/unit/update-storage-transaction.test.mjs', 'tests/unit/brain-profile.test.mjs'], ['ruvnet-brain-update-storage-transaction', 'ruvnet-brain-installed-profile']),
   make('S-6', 'Every supported OS and host loader converges on exact public bytes', 'HostConvergence', ['PublicVerification'], ['scripts/host-registry.mjs', 'scripts/host-install-matrix.mjs', 'scripts/public-verification-aggregate.mjs'], ['tests/unit/host-registry.test.mjs', 'tests/integration/dual-host-install.test.mjs'], ['ruvnet-brain-host-registry', 'ruvnet-brain-public-verification-leaf']),
@@ -141,9 +141,29 @@ export function renderProductIntegrityTraceMarkdown(contract = validateProductIn
 }
 const valueAfter = (argv, flag) => { const index = argv.indexOf(flag); return index >= 0 ? argv[index + 1] : null; };
 export function runProductIntegrityCli(argv = process.argv.slice(2), io = { stdout: process.stdout }) {
-  const known = new Set(['--markdown', '--check-markdown', '--trace', '--source-sha', '--out', '--verify-trace']);
+  const known = new Set(['--markdown', '--check-markdown', '--check-source', '--trace', '--source-sha', '--out', '--verify-trace']);
   if (argv.some((arg) => arg.startsWith('--') && !known.has(arg))) throw new Error('unknown product integrity argument');
   if (!argv.length) { io.stdout.write(`${canonicalJson(validateProductIntegrityContract())}\n`); return 0; }
+  if (argv.length === 1 && argv[0] === '--check-source') {
+    const root = fs.realpathSync(io.root || fileURLToPath(new URL('..', import.meta.url)));
+    const missing = [], invalid = [];
+    const files = productIntegrityGovernedPaths();
+    for (const file of files) {
+      const absolute = path.join(root, file);
+      try {
+        const stat = fs.lstatSync(absolute);
+        const relative = path.relative(root, fs.realpathSync(absolute));
+        if (!stat.isFile() || stat.isSymbolicLink() || relative.startsWith(`..${path.sep}`)
+          || relative === '..' || path.isAbsolute(relative)) invalid.push(file);
+      } catch (error) {
+        (error.code === 'ENOENT' ? missing : invalid).push(file);
+      }
+    }
+    const verdict = missing.length || invalid.length ? 'FAIL' : 'PASS';
+    io.stdout.write(`${canonicalJson({ verdict, scope: 'source-presence', behaviorVerified: false,
+      checked: files.length, missing, invalid })}\n`);
+    return verdict === 'PASS' ? 0 : 1;
+  }
   if (argv.length === 1 && argv[0] === '--markdown') { io.stdout.write(renderProductIntegrityTraceMarkdown()); return 0; }
   const check = valueAfter(argv, '--check-markdown');
   if (check) { if (fs.readFileSync(path.resolve(check), 'utf8') !== renderProductIntegrityTraceMarkdown()) throw new Error('generated traceability Markdown differs'); io.stdout.write('product integrity Markdown: PASS\n'); return 0; }

package/scripts/public-verification-abandon.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { extractZip } from '../kb/zip-extract.mjs';
+import { abandonPublicVerificationTransaction } from './release-transaction.mjs';
+import { liveReleaseProvider } from './release-transaction-provider.mjs';
+
+function regularJson(file, max = 131072) {
+  const stat = fs.lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > max) throw new Error('untrusted or oversized closure input');
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+const api = (endpoint) => JSON.parse(execFileSync('gh', ['api', endpoint], { encoding: 'utf8', timeout: 30000 }));
+
+export function closureProvenance({ event, env, identity, failure, run, artifact, workflow }) {
+  const input = event.client_payload;
+  if (env.GITHUB_EVENT_NAME !== 'repository_dispatch' || event.action !== 'abandon-public-verification'
+    || event.sender?.login !== env.GITHUB_ACTOR || event.repository?.full_name !== identity.repository
+    || env.GITHUB_REPOSITORY !== identity.repository || input?.authorization !== 'abandon-published-not-verified') {
+    throw new Error('closure requires the explicitly authorized abandonment dispatch');
+  }
+  if (run.event !== 'repository_dispatch' || !Number.isSafeInteger(run.repository?.id)
+    || run.repository.id !== event.repository.id || run.head_repository?.id !== run.repository.id
+    || run.head_repository?.full_name !== identity.repository
+    || !Number.isSafeInteger(workflow?.id) || run.workflow_id !== workflow.id || workflow.path !== run.path
+    || run.id !== input.recovery_run_id || run.status !== 'completed' || run.conclusion !== 'failure'
+    || run.path !== '.github/workflows/recover-public-verification.yml'
+    || run.repository?.full_name !== identity.repository || !/^[a-f0-9]{40}$/.test(run.head_sha || '')
+    || artifact.id !== input.failure_artifact_id || artifact.expired !== false
+    || artifact.workflow_run?.id !== run.id || artifact.workflow_run?.head_sha !== run.head_sha
+    || artifact.name !== `recovered-public-verification-${failure.os}-${identity.candidateSha}-${run.id}`) {
+    throw new Error('GitHub failed-run artifact provenance mismatch');
+  }
+  return {
+    expected: input.expected,
+    reason: input.reason,
+    authorization: { actor: env.GITHUB_ACTOR, reference: input.authorization_reference,
+      event: env.GITHUB_EVENT_NAME, action: event.action,
+      dispatchRunId: Number(env.GITHUB_RUN_ID), verifierSha: env.GITHUB_SHA },
+    recovery: { repository: identity.repository, workflow: run.path, workflowId: workflow.id, repositoryId: run.repository.id, event: run.event, runId: run.id,
+      verifierSha: run.head_sha, conclusion: run.conclusion, artifactId: artifact.id, artifactName: artifact.name },
+  };
+}
+
+// Download the named GitHub artifact independently; a local JSON lookalike is not provenance.
+async function failureFromArtifact(repository, artifactId) {
+  if (!Number.isSafeInteger(artifactId) || artifactId <= 0) throw new Error('invalid failed artifact ID');
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'abandon-failed-artifact-'));
+  try {
+    const zip = path.join(temp, 'failure.zip');
+    fs.writeFileSync(zip, execFileSync('gh', ['api', `repos/${repository}/actions/artifacts/${artifactId}/zip`],
+      { encoding: null, timeout: 60000, maxBuffer: 2 * 1024 * 1024 }), { flag: 'wx' });
+    const output = path.join(temp, 'contents');
+    const extracted = await extractZip(zip, output);
+    if (extracted.entryNames.length !== 1 || !/^(linux|macos|windows)\.json$/.test(extracted.entryNames[0])) {
+      throw new Error('failure artifact must contain exactly one OS failure receipt');
+    }
+    return regularJson(path.join(output, extracted.entryNames[0]));
+  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
+}
+
+export async function abandonPublicVerification({ identityFile, outputFile, env = process.env,
+  readApi = api, readFailure = failureFromArtifact, adapter = liveReleaseProvider({ root: process.cwd() }),
+  publicKeyFile = 'keys/ruvnet-brain-signing.pub.pem' } = {}) {
+  if (!identityFile || !outputFile || !env.GITHUB_EVENT_PATH || !env.RUVNET_SIGNING_KEY) {
+    throw new Error('identity, output, dispatch event, and signing key are required');
+  }
+  if (fs.existsSync(outputFile)) throw new Error('refusing to overwrite closure output');
+  const identity = regularJson(identityFile);
+  if (identity.repository !== 'stuinfla/ruvnet-brain' || identity.package !== 'ruvnet-brain') throw new Error('unexpected release repository');
+  const event = regularJson(env.GITHUB_EVENT_PATH);
+  const input = event.client_payload;
+  if (![input?.recovery_run_id, input?.failure_artifact_id].every((id) => Number.isSafeInteger(id) && id > 0)) {
+    throw new Error('explicit recovery run and failed artifact IDs are required');
+  }
+  const run = await readApi(`repos/${identity.repository}/actions/runs/${input.recovery_run_id}`);
+  const artifact = await readApi(`repos/${identity.repository}/actions/artifacts/${input.failure_artifact_id}`);
+  const workflow = await readApi(`repos/${identity.repository}/actions/workflows/recover-public-verification.yml`);
+  const failure = await readFailure(identity.repository, input.failure_artifact_id);
+  const provenance = closureProvenance({ event, env, identity, failure, run, artifact, workflow });
+  const receipt = await abandonPublicVerificationTransaction({ identity, failure, ...provenance, adapter,
+    privateKey: crypto.createPrivateKey(env.RUVNET_SIGNING_KEY),
+    publicKey: crypto.createPublicKey(fs.readFileSync(publicKeyFile, 'utf8')) });
+  fs.mkdirSync(path.dirname(path.resolve(outputFile)), { recursive: true });
+  fs.writeFileSync(outputFile, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+  return receipt;
+}
+
+const direct = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (direct) {
+  const arg = (name) => { const index = process.argv.indexOf(name); return index < 0 ? null : process.argv[index + 1]; };
+  try {
+    const receipt = await abandonPublicVerification({ identityFile: arg('--identity'), outputFile: arg('--out') });
+    console.log(JSON.stringify({ state: receipt.state, verdict: receipt.observation.verdict,
+      transactionId: receipt.transactionId, sequence: receipt.sequence, receiptDigest: receipt.receiptDigest }));
+  } catch (error) { console.error(`public-verification-abandon: ${error.message}`); process.exitCode = 1; }
+}

package/scripts/public-verification-aggregate.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { canonicalJson, digest } from './coverage-integrity.mjs';
 import { retrievalOracleExpectationFromPlan, validateRetrievalOracleReview } from './independent-review-receipt.mjs';
 import { validateRetrievalCanaryPlan, validateRetrievalCanaryReceipt } from './retrieval-canary.mjs';
+import { validateNightlyProofReceipt } from './nightly-two-run-proof.mjs';
 
 export const PUBLIC_VERIFICATION_OS = Object.freeze(['linux', 'macos', 'windows']);
 export const PUBLIC_VERIFICATION_MODES = Object.freeze(['claude', 'codex', 'dual']);
@@ -19,7 +20,10 @@ function unsignedLeaf(leaf) {
   return payload;
 }
 
-export function validatePublicVerificationLeaf(leaf) {
+export function validatePublicVerificationLeaf(leaf, { publicKey } = {}) {
+  if (Object.hasOwn(leaf || {}, 'verifierSha') && !HEX40.test(String(leaf.verifierSha))) {
+    throw new Error('public verification leaf verifier SHA is invalid');
+  }
   if (leaf?.schemaVersion !== 1 || leaf?.kind !== 'ruvnet-brain-public-verification-leaf'
     || !PUBLIC_VERIFICATION_OS.includes(leaf.os) || !PUBLIC_VERIFICATION_MODES.includes(leaf.mode)
     || !HEX40.test(String(leaf.sourceSha || '')) || !HEX64.test(String(leaf.artifactSha256 || ''))
@@ -33,6 +37,14 @@ export function validatePublicVerificationLeaf(leaf) {
   if (leaf.publicBytes?.npmExact !== true || leaf.publicBytes?.githubExact !== true
     || leaf.publicBytes?.bundleExact !== true || leaf.installed?.version !== leaf.version
     || leaf.installed?.loaderVerified !== true) throw new Error(`${leaf.os}/${leaf.mode} public bytes or loader are unverified`);
+  if (leaf.acceptancePolicy !== undefined || leaf.searchTiming !== undefined) {
+    const timing = leaf.searchTiming;
+    if (leaf.acceptancePolicy !== 'stabilization-public-deadline-v1' || timing?.deadlineMs !== 30_000
+      || ![timing.firstSearchMs, timing.broadMs].every((value) => typeof value === 'number'
+        && Number.isFinite(value) && value >= 0 && value <= timing.deadlineMs)) {
+      throw new Error(`${leaf.os}/${leaf.mode} public search acceptance policy or timing is invalid`);
+    }
+  }
   if (leaf.coverage?.verified !== true || leaf.coverage.eligibleCurrent !== leaf.coverage.eligibleTotal
     || leaf.coverage.gistCurrent !== leaf.coverage.gistTotal) throw new Error(`${leaf.os}/${leaf.mode} coverage is incomplete`);
   if (!Array.isArray(leaf.untested) || leaf.untested.length || leaf.skipped !== 0 || leaf.unknown !== 0) {
@@ -49,12 +61,23 @@ export function validatePublicVerificationLeaf(leaf) {
     || retrieval.coverageGeneration !== leaf.coverageGeneration || retrieval.planSha256 !== leaf.canaryPlanSha256) {
     throw new Error(`${leaf.os}/${leaf.mode} retrieval identity differs`);
   }
+  if (leaf.mode === 'dual') {
+    if (!/^[1-9][0-9]*$/.test(String(leaf.workflowRunId || ''))) throw new Error('native nightly workflow run identity is missing');
+    const native = validateNightlyProofReceipt(leaf.nativeNightly, {
+      platform: { linux: 'linux', macos: 'darwin', windows: 'win32' }[leaf.os],
+      version: leaf.version, sourceSha: leaf.sourceSha, workflowRunId: leaf.workflowRunId,
+      packageSha256: leaf.artifactSha256, bundleSha256: leaf.bundleSha256, publicKey,
+    });
+    if (!native.ok) throw new Error(`${leaf.os}/dual native nightly proof failed: ${native.failures.join('; ')}`);
+  } else if (leaf.nativeNightly !== undefined) {
+    throw new Error('native nightly proof belongs only to the dual-host leaf');
+  }
   return leaf;
 }
 
-export function createPublicVerificationLeaf(input) {
+export function createPublicVerificationLeaf(input, options = {}) {
   const payload = { schemaVersion: 1, kind: 'ruvnet-brain-public-verification-leaf', ...input };
-  return validatePublicVerificationLeaf({ ...payload, leafSha256: digest(payload) });
+  return validatePublicVerificationLeaf({ ...payload, leafSha256: digest(payload) }, options);
 }
 
 function aggregatePayload(aggregate) {
@@ -122,6 +145,7 @@ function validateReviewOracleAgainstPlan(review, retrievalPlan) {
 
 const identityOf = (leaf) => ({
   sourceSha: leaf.sourceSha,
+  ...(Object.hasOwn(leaf, 'verifierSha') ? { verifierSha: leaf.verifierSha } : {}),
   version: leaf.version,
   tag: leaf.tag,
   artifactSha256: leaf.artifactSha256,
@@ -133,11 +157,13 @@ const identityOf = (leaf) => ({
   releaseTransactionId: leaf.releaseTransactionId,
 });
 
-export function buildPublicVerificationAggregate(leaves) {
+export function buildPublicVerificationAggregate(leaves, options = {}) {
   if (!Array.isArray(leaves) || leaves.length !== PUBLIC_VERIFICATION_OS.length * PUBLIC_VERIFICATION_MODES.length) {
     throw new Error('public verification requires exactly nine leaves');
   }
-  leaves.forEach(validatePublicVerificationLeaf);
+  leaves.forEach((leaf) => validatePublicVerificationLeaf(leaf, options));
+  const nativeRunIds = new Set(leaves.filter((leaf) => leaf.mode === 'dual').map((leaf) => String(leaf.workflowRunId)));
+  if (nativeRunIds.size !== 1) throw new Error('native nightly proofs span different workflow runs');
   const byLane = new Map(leaves.map((leaf) => [`${leaf.os}/${leaf.mode}`, leaf]));
   const required = PUBLIC_VERIFICATION_OS.flatMap((os) => PUBLIC_VERIFICATION_MODES.map((mode) => `${os}/${mode}`));
   if (byLane.size !== required.length || required.some((lane) => !byLane.has(lane))) {
@@ -178,6 +204,7 @@ export function buildPublicVerificationAggregate(leaves) {
     schemaVersion: 1,
     kind: 'ruvnet-brain-public-verification-aggregate',
     identity,
+    workflowRunId: [...nativeRunIds][0],
     coverage: first.coverage,
     lanes: required.map((lane) => ({ lane, leafSha256: byLane.get(lane).leafSha256 })),
     evidence: { leaves: required.map((lane) => structuredClone(byLane.get(lane))) },
@@ -193,7 +220,7 @@ export function buildPublicVerificationAggregate(leaves) {
 }
 
 export function signPublicVerificationAggregate({ leaves }, privateKey) {
-  const payload = buildPublicVerificationAggregate(leaves);
+  const payload = buildPublicVerificationAggregate(leaves, { publicKey: crypto.createPublicKey(privateKey) });
   const aggregateSha256 = digest(payload);
   const signed = { ...payload, aggregateSha256 };
   return { ...signed, signature: crypto.sign(null, Buffer.from(canonicalJson(signed)), privateKey).toString('base64') };
@@ -210,14 +237,14 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
   if (!Array.isArray(aggregate.evidence?.leaves)) {
     throw new Error('public verification aggregate lacks raw leaf evidence');
   }
-  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves);
-  if (canonicalJson(rebuilt) !== canonicalJson(payload)) {
-    throw new Error('public verification aggregate differs from rebuilt raw evidence');
-  }
   const signed = { ...payload, aggregateSha256: aggregate.aggregateSha256 };
   if (!crypto.verify(null, Buffer.from(canonicalJson(signed)), publicKey, Buffer.from(aggregate.signature, 'base64'))) {
     throw new Error('public verification aggregate signature mismatch');
   }
+  const rebuilt = buildPublicVerificationAggregate(aggregate.evidence.leaves, { publicKey });
+  if (canonicalJson(rebuilt) !== canonicalJson(payload)) {
+    throw new Error('public verification aggregate differs from rebuilt raw evidence');
+  }
   const required = PUBLIC_VERIFICATION_OS.flatMap((os) => PUBLIC_VERIFICATION_MODES.map((mode) => `${os}/${mode}`));
   if (aggregate.lanes?.length !== required.length || new Set(aggregate.lanes.map(({ lane }) => lane)).size !== required.length
     || required.some((lane) => !aggregate.lanes.some((row) => row.lane === lane && HEX64.test(String(row.leafSha256 || ''))))) {
@@ -234,7 +261,11 @@ export function verifyPublicVerificationAggregate(aggregate, publicKey, expected
     || aggregate.retrievalOracle?.recordCount !== aggregate.evidence.leaves[0].retrievalPlan.denominator.eligibleStores.length) {
     throw new Error('public verification aggregate retrieval oracle identity is incomplete');
   }
-  if (expectedIdentity && canonicalJson(aggregate.identity) !== canonicalJson(expectedIdentity)) {
+  if (expectedIdentity?.workflowRunId !== undefined && String(expectedIdentity.workflowRunId) !== aggregate.workflowRunId) {
+    throw new Error('public verification aggregate workflow run differs from the expected run');
+  }
+  const { workflowRunId: _expectedRun, ...expectedReleaseIdentity } = expectedIdentity || {};
+  if (expectedIdentity && canonicalJson(aggregate.identity) !== canonicalJson(expectedReleaseIdentity)) {
     throw new Error('public verification aggregate identity differs from the release transaction');
   }
   return aggregate;
@@ -245,13 +276,13 @@ function parseCliArgs(argv) {
   for (let index = 0; index < argv.length; index += 2) {
     const flag = argv[index];
     const value = argv[index + 1];
-    if (!['--lanes', '--out'].includes(flag) || !value) {
-      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
+    if (!['--lanes', '--out', '--verifier-sha', '--workflow-run-id'].includes(flag) || !value) {
+      throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file> --workflow-run-id <id>');
     }
     parsed[flag.slice(2)] = value;
   }
-  if (!parsed.lanes || !parsed.out || Object.keys(parsed).length !== 2) {
-    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file>');
+  if (!parsed.lanes || !parsed.out || !/^[1-9][0-9]*$/.test(parsed['workflow-run-id'] || '')) {
+    throw new Error('usage: public-verification-aggregate.mjs --lanes <dir> --out <file> --workflow-run-id <id>');
   }
   return parsed;
 }
@@ -265,20 +296,24 @@ function readExactJsonFiles(directory, count, label) {
     .map((entry) => JSON.parse(fs.readFileSync(path.join(directory, entry.name), 'utf8')));
 }
 
-function readLaneLeaves(directory) {
+function readLaneLeaves(directory, options = {}) {
   const wrappers = readExactJsonFiles(directory, PUBLIC_VERIFICATION_OS.length, 'lane');
   const byOs = new Map();
   for (const wrapper of wrappers) {
     const payload = { schemaVersion: wrapper?.schemaVersion, kind: wrapper?.kind, os: wrapper?.os,
+      ...(Object.hasOwn(wrapper || {}, 'verifierSha') ? { verifierSha: wrapper.verifierSha, sourceSha: wrapper.sourceSha } : {}),
       leaves: wrapper?.leaves };
     if (payload.schemaVersion !== 1 || payload.kind !== 'ruvnet-brain-public-verification-os-lane'
       || !PUBLIC_VERIFICATION_OS.includes(payload.os) || byOs.has(payload.os)
       || !Array.isArray(payload.leaves) || payload.leaves.length !== PUBLIC_VERIFICATION_MODES.length
       || payload.leaves.some((leaf) => leaf?.os !== payload.os)
+      || (Object.hasOwn(payload, 'verifierSha') && (!HEX40.test(String(payload.verifierSha))
+        || !HEX40.test(String(payload.sourceSha))
+        || payload.leaves.some((leaf) => leaf.verifierSha !== payload.verifierSha || leaf.sourceSha !== payload.sourceSha)))
       || digest(payload) !== wrapper.laneSha256) {
       throw new Error('public verification OS lane wrapper is malformed, duplicated, or tampered');
     }
-    payload.leaves.forEach(validatePublicVerificationLeaf);
+    payload.leaves.forEach((leaf) => validatePublicVerificationLeaf(leaf, options));
     byOs.set(payload.os, payload.leaves);
   }
   if (PUBLIC_VERIFICATION_OS.some((osName) => !byOs.has(osName))) {
@@ -287,11 +322,16 @@ function readLaneLeaves(directory) {
   return PUBLIC_VERIFICATION_OS.flatMap((osName) => byOs.get(osName));
 }
 
-export function generatePublicVerificationAggregate({ lanesDirectory, outputFile, privateKey }) {
+export function generatePublicVerificationAggregate({ lanesDirectory, outputFile, privateKey, verifierSha, workflowRunId }) {
+  if (!/^[1-9][0-9]*$/.test(String(workflowRunId || ''))) throw new Error('expected workflow run ID is required');
   if (!privateKey) throw new Error('RUVNET_SIGNING_KEY is required');
   if (fs.existsSync(outputFile)) throw new Error(`refusing to overwrite existing aggregate: ${outputFile}`);
-  const leaves = readLaneLeaves(lanesDirectory);
+  const leaves = readLaneLeaves(lanesDirectory, { publicKey: crypto.createPublicKey(privateKey) });
   const aggregate = signPublicVerificationAggregate({ leaves }, privateKey);
+  if (aggregate.workflowRunId !== String(workflowRunId)) throw new Error('public verification aggregate workflow run differs from the expected run');
+  if (verifierSha !== undefined && (!HEX40.test(String(verifierSha)) || aggregate.identity.verifierSha !== verifierSha)) {
+    throw new Error('public verification aggregate verifier SHA differs from the expected verifier');
+  }
   fs.writeFileSync(outputFile, `${JSON.stringify(aggregate, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
   return aggregate;
 }
@@ -301,6 +341,8 @@ async function main() {
   const aggregate = generatePublicVerificationAggregate({
     lanesDirectory: options.lanes,
     outputFile: options.out,
+    verifierSha: options['verifier-sha'],
+    workflowRunId: options['workflow-run-id'],
     privateKey: process.env.RUVNET_SIGNING_KEY,
   });
   process.stdout.write(`${JSON.stringify({ ok: true, aggregateSha256: aggregate.aggregateSha256,

package/scripts/public-verification-finalizer.mjs

@@ -2,6 +2,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { finalizeReleaseTransaction } from './release-transaction.mjs';
 import { liveReleaseProvider } from './release-transaction-provider.mjs';
 
@@ -22,6 +23,8 @@ export async function finalizePublicVerification({
   identityFile,
   aggregateFile,
   outputFile,
+  verifierSha,
+  workflowRunId,
   privatePem = process.env.RUVNET_SIGNING_KEY,
   publicKeyFile = 'keys/ruvnet-brain-signing.pub.pem',
   adapter = liveReleaseProvider({ root: process.cwd() }),
@@ -33,7 +36,7 @@ export async function finalizePublicVerification({
   const identity = regularJson(identityFile, 'release identity');
   const aggregate = regularJson(aggregateFile, 'public verification aggregate');
   const publicKey = crypto.createPublicKey(fs.readFileSync(path.resolve(publicKeyFile), 'utf8'));
-  const receipt = await finalizeReleaseTransaction({ identity, aggregate, adapter,
+  const receipt = await finalizeReleaseTransaction({ identity, aggregate, adapter, verifierSha, workflowRunId,
     privateKey: crypto.createPrivateKey(privatePem), publicKey, aggregatePublicKey: publicKey });
   fs.mkdirSync(path.dirname(output), { recursive: true });
   fs.writeFileSync(output, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
@@ -46,6 +49,8 @@ export async function main(args = process.argv.slice(2)) {
       identityFile: argument(args, '--identity'),
       aggregateFile: argument(args, '--aggregate'),
       outputFile: argument(args, '--out'),
+      verifierSha: argument(args, '--verifier-sha') ?? undefined,
+      workflowRunId: argument(args, '--workflow-run-id'),
     });
     process.stdout.write(`${JSON.stringify({ state: receipt.state, transactionId: receipt.transactionId,
       receiptDigest: receipt.receiptDigest }, null, 2)}\n`);
@@ -56,4 +61,5 @@ export async function main(args = process.argv.slice(2)) {
   }
 }
 
-if (path.resolve(process.argv[1] || '') === path.resolve(new URL(import.meta.url).pathname)) process.exitCode = await main();
+const invokedDirectly = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (invokedDirectly) process.exitCode = await main();