ruvnet-brain 4.3.9 → 4.3.11

package/scripts/qa-lanes.mjs

@@ -0,0 +1,40 @@
+// Shared producers for local diagnostics, CI, and candidate qualification.
+export function selectLanes(lanes, requested) {
+  if (!requested.length) return lanes;
+  const selected = new Set();
+  const visit = (name) => {
+    const lane = lanes.find((entry) => entry.name === name);
+    if (!lane) throw new Error(`unknown QA lane: ${name}`);
+    if (selected.has(name)) return;
+    selected.add(name);
+    for (const dependency of lane.dependsOn || []) visit(dependency);
+  };
+  requested.forEach(visit);
+  return lanes.filter(({ name }) => selected.has(name));
+}
+
+export function qaLanes({ release = false, base = null, runtimeCensusArgs = [] } = {}) {
+  const node = (name, script, args = [], extra = {}) => ({ name, command: process.execPath, args: [script, ...args], resource: 'static', ...extra });
+  const test = (name, args) => node(name, 'node_modules/vitest/vitest.mjs', ['run', ...args], { resource: 'tests' });
+  return [
+    node('version', 'scripts/sync-version.mjs', ['--check']),
+    node('convergence', 'scripts/convergence-manifest.mjs'),
+    node('execution-policy', 'scripts/execution-policy.mjs', ['{"action":"delegate","description":"architecture audit","nativeHosts":["codex"]}']),
+    node('architecture', 'scripts/product-integrity-contract.mjs', ['--check-source']),
+    node('docs', 'scripts/doc-currency.mjs', ['--check', ...(base ? ['--changed', base] : ['--warn-drift'])]),
+    node('wiring', 'scripts/wired-check.mjs', ['--check']),
+    node('substitution', 'scripts/no-silent-substitution.mjs'),
+    node('catalog', 'scripts/verify-model-catalog.mjs'),
+    test('coverage', ['tests/unit', '--coverage']),
+    node('claims-source', 'scripts/claims-verify.mjs', ['--strict', '--scope', 'source'], { dependsOn: ['coverage'], report: 'claims' }),
+    test('mesh', ['tests/mesh']),
+    node('plugin', 'plugin/test/run-tests.mjs', [], { resource: 'tests' }),
+    ...(release ? [
+      test('mutation', ['tests/mutation']),
+      test('regression', ['tests/regression']),
+      test('integration', ['tests/integration']),
+      test('continuity', ['tests/acceptance/cross-host-project-resume.test.mjs']),
+      node('claims-runtime', 'scripts/claims-verify.mjs', ['--strict', '--scope', 'runtime', ...runtimeCensusArgs], { report: 'claims' }),
+    ] : []),
+  ];
+}

package/scripts/qa-runner.mjs

@@ -1,72 +1,62 @@
 #!/usr/bin/env node
-// Canonical bounded QA runner. Local and CI use the same lanes, command order, timeout policy,
-// and machine-readable receipt; a human log is never the release verdict.
 import fs from 'node:fs';
 import path from 'node:path';
-import { execFileSync, spawn } from 'node:child_process';
+import os from 'node:os';
+import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { qaLanes, selectLanes } from './qa-lanes.mjs';
+import { runLanes, verdictOf, sourceIdentity } from './qa-contract.mjs';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const release = process.argv.includes('--release');
-const timeoutMs = Number(process.env.QA_TIMEOUT_MS || (release ? 15 * 60_000 : 8 * 60_000));
-const lanes = [
-  ['version', 'npm', ['run', 'version:check']],
-  ['convergence', 'npm', ['run', 'convergence:check']],
-  ['execution-policy', 'npm', ['run', 'execution-policy:check']],
-  ['docs', 'npm', ['run', 'doc:currency']],
-  ['wiring', 'npm', ['run', 'wired:check']],
-  ['substitution', 'npm', ['run', 'substitution:check']],
-  ['catalog', 'npm', ['run', 'catalog:verify']],
-  ['contract', 'npx', ['vitest', 'run',
-    'tests/unit/brain-off.test.mjs',
-    'tests/unit/hook-hardening.test.mjs',
-    'tests/unit/hook-battery.test.mjs',
-    'tests/unit/session-start-core-parity.test.mjs',
-    'tests/unit/lesson-gate.test.mjs',
-    'tests/unit/wired-check.test.mjs',
-    'tests/unit/no-restated-truth.test.mjs',
-    'tests/unit/verify-citation.test.mjs',
-    'tests/unit/eval-brain-gate.test.mjs',
-    'tests/unit/distill-project.test.mjs',
-    'tests/unit/record-lesson.test.mjs',
-    'tests/unit/learn-capture-project-root.test.mjs',
-    'tests/unit/codex-claude-hook-parity.test.mjs',
-    'tests/unit/brain-stamp-resolve-built-from-sha.test.mjs',
-    'tests/unit/qa-runner-concurrency.test.mjs',
-    'tests/unit/execution-preflight.test.mjs',
-    '--reporter=dot']],
-  ['mesh', 'npm', ['run', 'test:mesh']],
-  ['plugin', 'npm', ['test']],
-  ...(release ? [['mutation', 'npm', ['run', 'test:mutation']], ['claims', 'npm', ['run', 'claims:verify']], ['integration', 'npm', ['run', 'test:integration']]] : []),
-];
-const receiptDir = path.join(root, '.qa');
-fs.mkdirSync(receiptDir, { recursive: true });
-const started = new Date().toISOString();
-const sha = (() => {
-  try { return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim(); }
-  catch { return null; }
-})();
-const run = ([name, command, args]) => new Promise((resolve) => {
-  const begin = Date.now();
-  const child = spawn(command, args, { cwd: root, env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false });
-  let stdout = '', stderr = '', timedOut = false;
-  child.stdout.on('data', (chunk) => { stdout += chunk; process.stdout.write(chunk); });
-  child.stderr.on('data', (chunk) => { stderr += chunk; process.stderr.write(chunk); });
-  const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); setTimeout(() => child.kill('SIGKILL'), 2000).unref(); }, timeoutMs);
-  child.on('close', (code, signal) => {
-    clearTimeout(timer);
-    resolve({ name, command: [command, ...args].join(' '), status: timedOut ? 'TIMEOUT' : code === 0 ? 'PASS' : 'FAIL', exitCode: code, signal, elapsedMs: Date.now() - begin, stdoutTail: stdout.slice(-4000), stderrTail: stderr.slice(-4000) });
-  });
+const argument = (name) => { const i = process.argv.indexOf(name); return i < 0 ? null : process.argv[i + 1]; };
+const requested = process.argv.flatMap((value, index) => value === '--lane' ? [process.argv[index + 1]] : []);
+const runtimeCensusArgs = ['--candidate-kb', '--candidate-sha', '--candidate-version', '--candidate-root',
+  '--payload-manifest', '--payload-signature', '--payload-id', '--qualification-mode'].flatMap((name) => {
+  if (!process.argv.includes(name)) return [];
+  const value = argument(name);
+  if (!value || value.startsWith('--')) throw new Error(`${name} requires a value`);
+  return [name, value];
 });
-// Every lane is independent. Run the complete set concurrently so one failure does not hide
-// later failures and force a serial fix-rerun cycle. The aggregate receipt remains the single
-// verdict, while each lane keeps its own evidence for targeted repair.
-const results = await Promise.all(lanes.map(async (lane) => {
-  const result = await run(lane);
-  fs.writeFileSync(path.join(receiptDir, `${result.name}.json`), `${JSON.stringify({ schema: 'ruvnet-brain.qa.lane', sha, ...result }, null, 2)}\n`);
-  return result;
-}));
-const receipt = { schema: 'ruvnet-brain.qa.aggregate', contract: release ? 'release' : 'pr', sha, started, ended: new Date().toISOString(), status: results.every((r) => r.status === 'PASS') && results.length === lanes.length ? 'PASS' : 'FAIL', requiredLanes: lanes.map(([name]) => name), results };
-fs.writeFileSync(path.join(receiptDir, 'aggregate.json'), `${JSON.stringify(receipt, null, 2)}\n`);
-console.log(JSON.stringify({ status: receipt.status, sha, lanes: results.map(({ name, status, elapsedMs }) => ({ name, status, elapsedMs })) }));
-process.exit(receipt.status === 'PASS' ? 0 : 1);
+const lanes = selectLanes(qaLanes({ release, runtimeCensusArgs, base: argument('--base') || process.env.QA_BASE_SHA }), requested);
+if (process.argv.includes('--list')) {
+  console.log(JSON.stringify(lanes, null, 2));
+} else {
+  const timeoutMs = Number(process.env.QA_TIMEOUT_MS || (release ? 15 * 60_000 : 8 * 60_000));
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error('invalid QA timeout');
+  const receiptDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-brain-qa-'));
+  const started = new Date().toISOString();
+  const source = sourceIdentity(root);
+  const run = (lane) => new Promise((resolve) => {
+    const begin = Date.now();
+    const evidenceFile = lane.report ? path.join(receiptDir, lane.name + '-evidence.json') : null;
+    const args = evidenceFile ? [...lane.args, '--report', evidenceFile] : lane.args;
+    const child = spawn(lane.command, args, { cwd: root, env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false, detached: process.platform !== 'win32' });
+    let stdout = '', stderr = '', timedOut = false, spawnError = null, escalation = null;
+    child.stdout.on('data', (chunk) => { stdout = (stdout + chunk).slice(-4000); process.stdout.write(chunk); });
+    child.stderr.on('data', (chunk) => { stderr = (stderr + chunk).slice(-4000); process.stderr.write(chunk); });
+    child.on('error', (error) => { spawnError = error.message; });
+    const kill = (signal) => {
+      if (!child.pid) return;
+      try {
+        if (process.platform === 'win32') spawn('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore' }).on('error', () => {});
+        else process.kill(-child.pid, signal);
+      } catch (error) { if (error.code !== 'ESRCH') spawnError = error.message; }
+    };
+    const timer = setTimeout(() => { timedOut = true; kill('SIGTERM'); escalation = setTimeout(() => kill('SIGKILL'), 2000); escalation.unref(); }, timeoutMs);
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      clearTimeout(escalation);
+      resolve({ name: lane.name, command: [lane.command, ...args], evidenceFile, status: timedOut ? 'TIMEOUT' : spawnError ? 'FAIL' : code === 0 ? 'PASS' : code === 4 ? 'UNKNOWN' : 'FAIL', exitCode: code, signal, spawnError, elapsedMs: Date.now() - begin, stdoutTail: stdout, stderrTail: stderr });
+    });
+  });
+  const results = await runLanes(lanes, run, 2);
+  const after = sourceIdentity(root);
+  const stable = after.digest === source.digest;
+  const status = stable ? verdictOf(results) : 'UNKNOWN';
+  const receipt = { schema: 'ruvnet-brain.qa.aggregate', contract: release ? 'release' : 'pr', selection: requested.length ? 'partial' : 'complete', source, sourceAfter: after, sourceStable: stable, started, ended: new Date().toISOString(), status, requiredLanes: lanes.map(({ name }) => name), results };
+  for (const result of results) fs.writeFileSync(path.join(receiptDir, result.name + '.json'), JSON.stringify({ schema: 'ruvnet-brain.qa.lane', source, ...result }, null, 2), { flag: 'wx' });
+  fs.writeFileSync(path.join(receiptDir, 'aggregate.json'), JSON.stringify(receipt, null, 2), { flag: 'wx' });
+  console.log(JSON.stringify({ status, receiptDir, source, sourceStable: stable, lanes: results.map(({ name, status }) => ({ name, status })) }));
+  process.exitCode = status === 'PASS' ? 0 : status === 'UNKNOWN' ? 4 : 1;
+}

package/scripts/qe/ux-suite.mjs

@@ -11,16 +11,8 @@
 //     scheduler jitter — it can only be a correctness regression. THIS is a genuine hard gate: a
 //     breach here fails the suite, not warns it. See scripts/qe/card-lane-gate.mjs for the full
 //     reasoning and the in-process (no subprocess per firing) measurement method.
-//  3. SESSION-START WALL TIME (added 2026-07-28) is the SAME tier as 2, and is here because tier 2
-//     alone was not enough. An independent grader's words: the card-lane gate "measures a
-//     0.03–0.22ms in-process function against a 250ms budget (~1000x headroom — it can only catch
-//     catastrophic regression classes)", while "everything the user actually FEELS — heavy-lane
-//     query seconds, session-start WALL TIME, install minutes, dead air, refusal clarity — is
-//     advisory or unmeasured". Session-start wall time is the first of those promoted out of tier 1:
-//     it is the hook a stranger's Claude Code fires before their first prompt is answered, it is
-//     already measured by scripts/selfcheck.mjs's external process-group watchdog (no second timer
-//     was written), and its budget is set from a measured distribution — p95 1000ms is ~3.1x the
-//     worst measured p95 (323ms over n=110), NOT 1000x. See scripts/qe/session-start-gate.mjs.
+//  3. Automatic hook retirement is checked across declared source registries and pointers.
+//     The old SessionStart latency probe remains separately callable for diagnostics.
 //
 // HONESTY (same rules as the product):
 //  • Every number is measured on THIS run. Nothing is asserted from memory.
@@ -39,7 +31,7 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { runCommandProbe } from '../../tests/ux/command-probe.mjs';
 import { runCardLaneGate } from './card-lane-gate.mjs';
-import { runSessionStartGate } from './session-start-gate.mjs';
+import { automaticHookRetirementStatus } from '../../bin/install.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const RENDER_PROBE = path.resolve(HERE, '../../tests/ux/render-probe.mjs');
@@ -322,28 +314,11 @@ export async function runUxSuite() {
     hardFailures.push(`card-lane latency gate: could not run — ${e.message}`);
   }
 
-  // ── Probe 5: session-start wall time — HARD GATE, the first USER-FELT number (ADR-058 D6) ───
-  // Wired exactly like probe 4 above and for the same reason: same tier, same "could not measure is
-  // never success" handling, same refusal to reuse line()'s "(proposed)" phrasing, which is correct
-  // for an advisory row and would misreport a HARD breach.
-  console.log('\n  ── session-start wall time (plugin/hooks/hooks.json SessionStart) — HARD GATE, user-felt ──');
-  try {
-    const ss = await runSessionStartGate();
-    const b = ss.budget;
-    const tag = (ok) => (ok ? '✓' : '✗ HARD FAIL');
-    console.log(`  ${'session-start cold first fire'.padEnd(30)} ${ss.warmupMs.toFixed(0).padStart(10)}ms  ${ss.warmupTimedOut ? '✗ HARD FAIL (declared timeout exceeded)' : '✓ inside declared timeout'}`);
-    console.log(`  ${'session-start p50'.padEnd(30)} ${ss.p50.toFixed(0).padStart(10)}ms  (reported, not gated)`);
-    console.log(`  ${'session-start p95'.padEnd(30)} ${ss.p95.toFixed(0).padStart(10)}ms  budget ${b.p95BudgetMs}ms  ${tag(ss.p95 <= b.p95BudgetMs)}`);
-    console.log(`  ${'session-start max'.padEnd(30)} ${ss.max.toFixed(0).padStart(10)}ms  absolute-fail ${b.absoluteFailMs}ms  ${tag(ss.max <= b.absoluteFailMs)}`);
-    console.log(`  firings: ${ss.n} sequential fires of the REAL registered command via selfcheck.mjs's watchdog, from ${ss.surface.source}`);
-    if (ss.warmupStderr) {
-      console.log(`  cold trace: ${ss.warmupStderr.trim().split('\n').join(' | ')}`);
-    }
-    if (!ss.pass) for (const r of ss.reasons) hardFailures.push(`session-start wall time: ${r}`);
-  } catch (e) {
-    console.log(`  ! could not run the session-start wall-time gate: ${e.message}`);
-    hardFailures.push(`session-start wall-time gate: could not run — ${e.message}`);
-  }
+  // Automatic lifecycle hooks are retired; measure registry state, not a fictitious latency.
+  const hookRetirement = automaticHookRetirementStatus(path.resolve(HERE, '../..'));
+  console.log(`\n  Automatic hooks: ${hookRetirement.ok ? 'RETIRED' : 'FAIL'} — ${hookRetirement.files.length} surfaces inspected`);
+  if (!hookRetirement.ok) hardFailures.push(...hookRetirement.errors,
+    ...hookRetirement.registrations.map(row => `automatic registration remains: ${row.file} ${row.event}`));
 
   // ── Not run on this host (stated, never faked) ──────────────────────────────────────────────
   console.log('\n  ── execution scope ──');
@@ -363,6 +338,7 @@ export async function runUxSuite() {
     budgetsMs: budgets,
     render,
     command: cmd,
+    hookRetirement,
     hardFailures,
     pass: hardFailures.length === 0,
     scope: {
@@ -375,7 +351,7 @@ export async function runUxSuite() {
 
   console.log('\n  ── verdict ──');
   if (hardFailures.length === 0) {
-    console.log('  PASS — every probe ran and every render, explanation, dead-air, decision-lane, and session-start HARD budget passed.\n');
+    console.log('  PASS — every probe ran and every render, explanation, dead-air, decision-lane HARD budget passed; automatic-hook retirement verified.\n');
     return receipt;
   }
   console.log('  FAIL (hard):');

package/scripts/qualified-candidate-check.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { extractZip } from '../kb/zip-extract.mjs';
+import { evaluateCandidateReceipt } from './release-proof.mjs';
+import { aggregateEvidence } from './release-evidence-aggregate.mjs';
+import { payloadIdFor } from './release-payload.mjs';
+import { canonicalJson } from './release-transaction.mjs';
+
+const REPO = 'stuinfla/ruvnet-brain';
+const WORKFLOW = '.github/workflows/release-candidate-preflight.yml';
+const positive = (n) => Number.isSafeInteger(n) && n > 0;
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+export function trustedQualificationRun(run, workflow, sha) {
+  return positive(run?.id) && run.workflow_id === workflow.id && run.path === WORKFLOW
+    && run.event === 'push' && run.head_sha === sha && /^release\/.+/.test(run.head_branch || '')
+    && positive(run.repository?.id) && run.repository.full_name === REPO
+    && run.head_repository?.id === run.repository.id && run.head_repository.full_name === REPO;
+}
+function trustedArtifact(artifact, run, name) {
+  return positive(artifact?.id) && artifact.name === name && artifact.expired === false
+    && /^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') && positive(artifact.size_in_bytes)
+    && artifact.workflow_run?.id === run.id && artifact.workflow_run.head_sha === run.head_sha
+    && artifact.workflow_run.head_branch === run.head_branch
+    && artifact.workflow_run.repository_id === run.repository.id
+    && artifact.workflow_run.head_repository_id === run.repository.id;
+}
+export function validateQualificationReceipt(receipt, { sha, run, artifact, requiredCheck }) {
+  if (!['canonical-qa', 'integration'].includes(requiredCheck)) throw new Error('unsupported required check');
+  if (receipt?.schemaVersion !== 1 || receipt.kind !== 'ruvnet-brain-qualified-candidate'
+    || receipt.sha !== sha || receipt.runId !== run.id
+    || canonicalJson(receipt.artifact) !== canonicalJson({ id: artifact.id, name: artifact.name,
+      digest: artifact.digest, size: artifact.size_in_bytes })) throw new Error('qualification receipt provenance differs');
+  const candidate = receipt.candidateReceipt;
+  if (evaluateCandidateReceipt(candidate).verdict !== 'PASS' || candidate.sha !== sha) throw new Error('candidate seal failed');
+  const manifest = receipt.payloadManifest;
+  if (manifest?.schemaVersion !== 1 || manifest.candidateSha !== sha || manifest.version !== candidate.version
+    || manifest.tag !== candidate.tag || !Array.isArray(manifest.members) || !manifest.members.length
+    || new Set(manifest.members.map(({ name }) => name)).size !== manifest.members.length
+    || manifest.members.some((m) => typeof m.name !== 'string' || path.basename(m.name) !== m.name
+      || !positive(m.size) || !/^[a-f0-9]{64}$/.test(m.sha256 || ''))) throw new Error('payload manifest identity differs');
+  const packageName = String(candidate.artifact.path).replaceAll('\\', '/').split('/').at(-1);
+  if (!manifest.members.some((m) => m.name === packageName
+    && m.sha256 === String(candidate.artifact.sha256).replace(/^sha256:/, ''))) throw new Error('candidate package is outside payload');
+  const envelope = receipt.aggregateEnvelope;
+  const rebuilt = aggregateEvidence({ sha, payloadId: payloadIdFor(manifest), leaves: envelope?.leaves });
+  if (canonicalJson(rebuilt) !== canonicalJson(envelope)
+    || envelope.leaves.some((leaf) => leaf.runId !== run.id)) throw new Error('aggregate evidence digest or run differs');
+  return { verdict: 'PASS', sha, requiredCheck, runId: run.id, artifactId: artifact.id,
+    payloadId: rebuilt.payloadId, evidenceDigest: rebuilt.evidenceDigest };
+}
+const api = (endpoint) => JSON.parse(execFileSync('gh', ['api', `repos/${REPO}/${endpoint}`], {
+  encoding: 'utf8', timeout: 30000, maxBuffer: 16 * 1024 * 1024 }));
+export async function downloadQualificationReceipt(artifact, fetchArchive = (id) => execFileSync('gh',
+  ['api', `repos/${REPO}/actions/artifacts/${id}/zip`], { timeout: 60000, maxBuffer: 2 * 1024 * 1024 })) {
+  if (artifact.size_in_bytes > 2 * 1024 * 1024) throw new Error('qualification receipt artifact oversized');
+  const bytes = await fetchArchive(artifact.id);
+  if (`sha256:${sha256(bytes)}` !== artifact.digest) throw new Error('qualification artifact digest differs');
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'qualified-candidate-'));
+  try {
+    const zip = path.join(temp, 'receipt.zip');
+    fs.writeFileSync(zip, bytes);
+    const out = path.join(temp, 'contents');
+    const extracted = await extractZip(zip, out);
+    if (canonicalJson(extracted.entryNames) !== canonicalJson(['qualification-receipt.json'])) throw new Error('unexpected qualification artifact members');
+    const file = path.join(out, 'qualification-receipt.json');
+    if (fs.statSync(file).size > 1024 * 1024) throw new Error('qualification receipt oversized');
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
+}
+export async function checkQualifiedCandidate({ sha, requiredCheck, timeoutMs = 7200000, pollMs = 30000,
+  readApi = api, readReceipt = downloadQualificationReceipt, now = Date.now,
+  pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms)) } = {}) {
+  if (!/^[a-f0-9]{40}$/.test(sha || '') || !['canonical-qa', 'integration'].includes(requiredCheck)
+    || !positive(timeoutMs) || timeoutMs > 7200000 || !positive(pollMs) || pollMs < 30000 || pollMs > 60000) throw new Error('invalid bounded qualification request');
+  const workflow = await readApi('actions/workflows/release-candidate-preflight.yml');
+  if (!positive(workflow.id) || workflow.path !== WORKFLOW) throw new Error('untrusted qualification workflow');
+  const deadline = now() + timeoutMs;
+  for (;;) {
+    const list = await readApi(`actions/workflows/${workflow.id}/runs?event=push&head_sha=${sha}&per_page=100`);
+    if (list.total_count > 100) throw new Error('qualification run listing truncated');
+    const selected = (list.workflow_runs || []).filter((r) => trustedQualificationRun(r, workflow, sha)).sort((a,b) => b.id-a.id)[0];
+    if (selected) {
+      const run = await readApi(`actions/runs/${selected.id}`);
+      if (run.id !== selected.id || !trustedQualificationRun(run, workflow, sha)) throw new Error('qualification run provenance changed');
+      if (run.status === 'completed') {
+        if (run.conclusion !== 'success') throw new Error(`qualification failed: ${run.conclusion}`);
+        const listed = await readApi(`actions/runs/${run.id}/artifacts?per_page=100`);
+        if (listed.total_count > 100) throw new Error('qualification artifact listing truncated');
+        const select = async (name) => {
+          const rows = (listed.artifacts || []).filter((a) => a.name === name);
+          if (rows.length !== 1) throw new Error('missing or duplicate qualification artifact');
+          const artifact = await readApi(`actions/artifacts/${rows[0].id}`);
+          if (artifact.id !== rows[0].id || !trustedArtifact(artifact, run, name)) throw new Error('qualification artifact provenance changed');
+          return artifact;
+        };
+        const artifact = await select(`release-candidate-${sha}`);
+        const small = await select(`qualification-receipt-${sha}`);
+        return validateQualificationReceipt(await readReceipt(small), { sha, run, artifact, requiredCheck });
+      }
+    }
+    const remaining = deadline - now();
+    if (remaining <= 0) throw new Error('timed out waiting for exact-SHA qualification');
+    process.stderr.write('Waiting for exact-SHA release qualification\n');
+    await pause(Math.min(pollMs, remaining));
+  }
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    if (process.env.GITHUB_REPOSITORY !== REPO) throw new Error('unexpected qualification repository');
+    const args = process.argv.slice(2), options = {};
+    for (let i=0;i<args.length;i+=2) {
+      if (!['--sha','--required-check','--timeout-ms','--poll-ms'].includes(args[i]) || !args[i+1]) throw new Error('invalid qualification arguments');
+      options[args[i]] = args[i+1];
+    }
+    console.log(JSON.stringify(await checkQualifiedCandidate({ sha: options['--sha'], requiredCheck: options['--required-check'],
+      ...(options['--timeout-ms'] ? {timeoutMs:Number(options['--timeout-ms'])} : {}),
+      ...(options['--poll-ms'] ? {pollMs:Number(options['--poll-ms'])} : {}) })));
+  } catch(error) { console.error(error.message); process.exitCode=1; }
+}

package/scripts/release-abort-stale.mjs

@@ -34,7 +34,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import {
-  RECEIPT_PREFIX, TERMINAL_STATES, ALLOWED_TRANSITIONS, canonicalJson, digestReceipt, signReceipt,
+  RECEIPT_PREFIX, isClosedReceipt, ALLOWED_TRANSITIONS, canonicalJson, digestReceipt, signReceipt,
 } from './release-transaction.mjs';
 
 const REPO = 'stuinfla/ruvnet-brain';
@@ -65,7 +65,7 @@ const receipts = receiptAssets.map(fetchAsset).sort((a, b) => a.sequence - b.seq
 const last = receipts.at(-1);
 log(`${TAG}: ${receipts.length} receipt(s), latest seq=${last.sequence} state=${last.state} txn=${String(last.transactionId).slice(0, 16)}…`);
 
-if (TERMINAL_STATES.has(last.state)) {
+if (isClosedReceipt(last)) {
   log(`already terminal (${last.state}) — nothing to do.`);
   process.exit(0);
 }

package/scripts/release-projection.mjs

@@ -6,7 +6,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { digest, generationLedgerBytes, projectPublicGenerationLedger,
-  releaseCoverageGenerationFor } from '../plugin/scripts/coverage-integrity.mjs';
+  releaseCoverageGenerationFor, validateCoverageDirectory } from '../plugin/scripts/coverage-integrity.mjs';
 import { validatePublicInventory } from './public-inventory.mjs';
 import { readRvfGenerations } from './rvf-generation.mjs';
 
@@ -15,6 +15,25 @@ const arg = (name, fallback = null) => { const i = process.argv.indexOf(name); r
 const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
 
+// The first assembly supplies seed bytes to the projection producer. Only the final, projected
+// assembly has a release-bound public ledger; its runtime ledger must describe that same set.
+export function bindAssembledReleaseProjection({ assetsDir, version, sourceSnapshot }) {
+  const ledger = readJson(path.join(assetsDir, 'PUBLIC-RVF-GENERATIONS.json'));
+  if (!/^[a-f0-9]{40}$/.test(sourceSnapshot || '') || ledger.schemaVersion !== 2
+    || ledger.kind !== 'ruvnet-brain-public-generation-ledger'
+    || ledger.brainVersion !== version || ledger.releaseTag !== `v${version}`
+    || ledger.sourceSnapshot !== sourceSnapshot) {
+    throw new Error('assembled public ledger does not bind this release source');
+  }
+  fs.writeFileSync(path.join(assetsDir, 'RVF-GENERATIONS.json'), `${JSON.stringify({
+    ...ledger, kind: 'ruvnet-brain-runtime-generation-ledger',
+  }, null, 2)}\n`);
+  const result = validateCoverageDirectory(assetsDir, { expectedVersion: version,
+    expectedSourceSnapshot: sourceSnapshot, requireCompleteProfile: true });
+  if (!result.valid) throw new Error(`assembled release projection rejected: ${result.failures.join('; ')}`);
+  return result;
+}
+
 function seedCompatibleGistReceipt() {
   const source = readJson(path.join(ROOT, 'kb', 'ruv-gists.sources.json'));
   const gists = {};

package/scripts/release-qualification-contract.mjs

@@ -0,0 +1,87 @@
+// Reviewed stabilization release boundaries. Legacy tests remain developer diagnostics.
+export const RELEASE_REQUIREMENTS = Object.freeze({
+  "source": [
+    {
+      "id": "signed-artifacts",
+      "reason": "Signature verification and exact assembled coverage reject changed bytes",
+      "files": [
+        "tests/unit/sign-verify-roundtrip.test.mjs",
+        "tests/unit/assembled-release-projection.test.mjs"
+      ]
+    },
+    {
+      "id": "protected-publication",
+      "reason": "Only owner-authorized exact-source artifacts enter publication",
+      "files": [
+        "tests/unit/protected-release-invocation.test.mjs",
+        "tests/unit/release-identity-invariants.test.mjs",
+        "tests/unit/release-transaction.test.mjs",
+        "tests/unit/prepublication-evidence.test.mjs",
+        "tests/unit/integration-evidence.test.mjs",
+        "tests/unit/qualified-candidate-check.test.mjs",
+        "tests/unit/release-qualification.test.mjs",
+        "tests/unit/development-push-boundary.test.mjs"
+      ]
+    },
+    {
+      "id": "public-verification",
+      "reason": "Public bytes, native update evidence and terminal receipts are bound to the actual candidate and run",
+      "files": [
+        "tests/unit/public-verification-aggregate.test.mjs",
+        "tests/unit/public-verification-finalizer.test.mjs",
+        "tests/unit/public-verification-lane.test.mjs",
+        "tests/unit/public-verification-abandon.test.mjs",
+        "tests/unit/publication-receipt-producer.test.mjs",
+        "tests/unit/recovery-candidate-source.test.mjs"
+      ]
+    },
+    {
+      "id": "safe-install-update",
+      "reason": "Installation and update preserve prior and private state and reject invalid dependencies",
+      "files": [
+        "tests/unit/automatic-hook-retirement.test.mjs",
+        "tests/unit/install-activation-rollback.test.mjs",
+        "tests/unit/forge-update-apply-rollback.test.mjs"
+      ]
+    },
+    {
+      "id": "native-scheduler",
+      "reason": "Owned scheduler lifecycle, execution identity, measured no-op and signed installed coverage",
+      "files": [
+        "tests/unit/nightly-scheduler.test.mjs",
+        "tests/unit/nightly-refresh-launcher.test.mjs",
+        "tests/unit/nightly-two-run-proof.test.mjs"
+      ]
+    }
+  ],
+  "integration": [
+    {
+      "id": "native-explicit-interface",
+      "reason": "Real MCP subprocess readiness, command policy and literal argv safety",
+      "files": [
+        "tests/integration/managed-cli-mcp.test.mjs"
+      ]
+    },
+    {
+      "id": "private-bundle-boundary",
+      "reason": "Actual bundle builder rejects absent private fence and incomplete public payloads",
+      "files": [
+        "tests/integration/build-bundle-fence.test.mjs"
+      ]
+    },
+    {
+      "id": "native-codex-discovery",
+      "reason": "Actual Codex plugin discovery and repair preserve explicit disabled state",
+      "files": [
+        "tests/integration/codex-skill-discovery.test.mjs"
+      ]
+    },
+    {
+      "id": "owned-uninstall",
+      "reason": "Actual offline uninstall preserves unrelated files and user guidance",
+      "files": [
+        "tests/integration/uninstall-footprint.test.mjs"
+      ]
+    }
+  ]
+});