ruvnet-brain 4.5.11 → 4.5.13

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.11 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.11-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.13 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.13-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 
@@ -273,7 +273,7 @@ The honest limit: this is **3.5, not 4.0**. The advocacy surface is live and the
 
 The 2.4 router was **hand-rolled**: our own heuristic with a placeholder policy, presented as "the MetaHarness router." rUv had already shipped the real thing. 2.5 replaces it with **[`@metaharness/router`](https://www.npmjs.com/package/@metaharness/router)** — his actual learned cost-optimal router (k-NN over labelled embeddings, the productized DRACO Phase-2 finding, ADR-040/043).
 
-Our code now does **one honest job**: a price transform. A model your subscription already covers becomes `costPerMTok = 0`, and rUv's router does the rest natively — a $0 model that clears the quality bar simply *is* the cheapest sufficient candidate. Cost-optimal routing and "already paid for" compose; they never competed.
+Subscription membership is an eligibility constraint, not a measurement of allowance consumption. The managed terminal workflow uses the current per-user model and effort policy, supervised native workers, executable checks, independent review, and execution receipts. MetaHarness supplies routing and evaluation capabilities; registration or a price transform alone does not execute a prompt or prove a handoff. The supported entry paths and remaining boundaries are described in `docs/model-routing-operation.md`.
 
 > **`npm run substitution:check`** — a new CI gate that fails the build if any code implements a capability rUv already ships *and* wears his name without either using the real package or openly disclosing the hand-roll. **Verified to fire on the exact commit where we got this wrong.** You may hand-roll. You may never hand-roll *silently*.
 

package/bin/install.mjs

@@ -14,6 +14,7 @@
 import { downloadFileWithRetry, httpsJsonWithRetry } from '../kb/download-retry.mjs';
 import fs from 'node:fs';
 import os from 'node:os';
+import { installCodexConsoleAlias } from '../plugin/scripts/codex-console-alias.mjs';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { readAll as readAllReadiness, aggregate as aggregateReadiness } from '../plugin/scripts/mcp-readiness.mjs';
@@ -82,7 +83,7 @@ import { shellDiff as pluginShellDiff } from '../plugin/scripts/host-shell-bound
 import { codexTrustChanges, CODEX_TRUST_ACTION } from '../scripts/codex-hook-trust.mjs';
 import { probeFreshCodexDeclarations } from '../scripts/codex-fresh-host-proof.mjs';
 import { repairSecurityGuidance } from '../scripts/security-guidance-codex-compat.mjs';
-import { installNativeLaunchers, installRoutingRuntime } from '../scripts/model-routing-launchers.mjs';
+import { installNativeLaunchers, installRoutingRuntime, runtimeSnapshot } from '../scripts/model-routing-launchers.mjs';
 import { installTerminalLaunchers } from '../scripts/model-terminal-launchers.mjs';
 import { readConsoleReceipts, replaceStaleConsoles } from '../scripts/console-instances.mjs';
 import { moveBrain, MoveRefused } from '../scripts/move-brain.mjs';
@@ -2000,6 +2001,7 @@ export function wireCodexPlugin({
   cwd = process.cwd(),
   announce = true,
   runJson = runCodexJson,
+  aliasHome,
 } = {}) {
   if (!fs.existsSync(codexDir)) return { host: false, action: 'no-host' };
   const options = { codexBin, codexHome, cwd };
@@ -2024,6 +2026,11 @@ export function wireCodexPlugin({
     if (announce) warn(`Codex Brain plugin is installed but disabled by user or policy — left disabled (${CODEX_PLUGIN_ID}).`);
     return { host: true, action: 'disabled', ...before };
   }
+  // Explicit alternate homes support isolated host qualification; metadata-only injected probes
+  // must not write the real user's skill directory.
+  if (aliasHome !== undefined || (runJson === runCodexJson && codexHome === codexHomeDir())) {
+    installCodexConsoleAlias({ home: aliasHome ?? os.homedir(), codexHome });
+  }
   // An existing Codex session can keep the plugin generation it loaded at boot. Compare the
   // installed bytes with the source candidate before mutating the marketplace so body-only updates
   // remain live while a changed/unknown boot surface gets one explicit restart request.
@@ -4931,7 +4938,7 @@ export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.c
   const destination = path.join(routerDir, 'bin');
   fs.mkdirSync(destination, { recursive: true });
   let copied = 0;
-  for (const name of ['model-router-engine.mjs', 'model-router-setup.mjs', 'model-router-status.mjs', 'model-router-outcome.mjs', 'subscription-hosts.mjs', 'review-model-defaults.mjs', 'dual-host-deliberation.mjs', 'dual-host-suggest.mjs', 'route-cheap.mjs', 'dispatch-receipt.mjs', 'metaharness-receipts.mjs', 'metaharness-router.mjs', 'model-router-dispatch.mjs', 'model-currency.mjs', 'model-currency-evidence.mjs', 'user-model-prompt-hook.mjs', 'model-router-agent-hook.mjs', 'model-weekly-assessment.mjs', 'model-weekly-analyst.mjs', 'model-weekly-cycle.mjs', 'model-weekly-qualification.mjs', 'model-native-qualification.mjs', 'model-routing-launchers.mjs', 'model-terminal-gateway.mjs', 'model-terminal-launchers.mjs', 'claude-terminal-mod.mjs', 'claude-controlled-terminal.mjs', 'model-native-catalog.mjs', 'model-analyst-sandbox.mjs', 'model-routing-policy-promotion.mjs', 'model-routing-gateway.mjs', 'native-subscription-usage.mjs', 'codex-routed.sh', 'goldie-weekly.sh']) {
+  for (const name of ['model-router-engine.mjs', 'model-router-setup.mjs', 'model-router-status.mjs', 'model-router-outcome.mjs', 'subscription-hosts.mjs', 'review-model-defaults.mjs', 'dual-host-deliberation.mjs', 'dual-host-suggest.mjs', 'route-cheap.mjs', 'dispatch-receipt.mjs', 'metaharness-receipts.mjs', 'metaharness-router.mjs', 'model-router-dispatch.mjs', 'model-currency.mjs', 'model-currency-evidence.mjs', 'user-model-prompt-hook.mjs', 'model-router-agent-hook.mjs', 'model-weekly-assessment.mjs', 'model-weekly-analyst.mjs', 'model-weekly-cycle.mjs', 'model-weekly-qualification.mjs', 'model-native-qualification.mjs', 'model-routing-launchers.mjs', 'model-terminal-gateway.mjs', 'model-terminal-launchers.mjs', 'claude-terminal-mod.mjs', 'claude-controlled-terminal.mjs', 'model-managed-prompt.mjs', 'model-managed-workflow-service.mjs', 'model-routing-controller.mjs', 'model-routing-execution-adapters.mjs', 'codex-managed-terminal.mjs', 'grok-subscription-host.mjs', 'model-native-catalog.mjs', 'model-analyst-sandbox.mjs', 'model-routing-policy-promotion.mjs', 'model-routing-gateway.mjs', 'native-subscription-usage.mjs', 'codex-routed.sh', 'goldie-weekly.sh']) {
     const source = path.join(packageRoot, 'scripts', name);
     if (!fs.existsSync(source)) throw new Error(`Packaged router tool missing: ${name}`);
     const target = path.join(destination, name);
@@ -4942,20 +4949,18 @@ export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.c
     finally { fs.rmSync(temporary, { force: true }); }
     copied++;
   }
-  // Preserve package-relative imports without replacing user policy.mjs overrides.
-  for (const runtimeRelative of [path.join('plugin', 'scripts', 'runtime-preferences.mjs'),
-    path.join('plugin', 'scripts', 'project-identity.mjs'),
-    path.join('config', 'model-router', 'policy.default.mjs')]) {
-  const runtimeTarget = path.join(routerDir, runtimeRelative);
-  const runtimeBytes = fs.readFileSync(path.join(packageRoot, runtimeRelative));
-  if (!fs.existsSync(runtimeTarget) || !fs.readFileSync(runtimeTarget).equals(runtimeBytes)) {
+  // Copy the same transitive dependencies used by immutable terminal runtimes.
+  // Repository scripts live in bin here, preserving their relative sibling imports.
+  for (const [relative, runtimeBytes] of runtimeSnapshot(packageRoot).files) {
+    const mapped = relative.startsWith('scripts/') ? `bin/${relative.slice(8)}` : relative;
+    const runtimeTarget = path.join(routerDir, mapped);
+    if (fs.existsSync(runtimeTarget) && fs.readFileSync(runtimeTarget).equals(runtimeBytes)) continue;
     fs.mkdirSync(path.dirname(runtimeTarget), { recursive: true });
     const temporary = `${runtimeTarget}.${crypto.randomUUID()}.tmp`;
     try { fs.writeFileSync(temporary, runtimeBytes, { mode: 0o600 }); fs.renameSync(temporary, runtimeTarget); }
     finally { fs.rmSync(temporary, { force: true }); }
     copied++;
   }
-  }
   const qualificationSource = path.join(packageRoot, 'config', 'model-router', 'qualification-contract.json');
   const qualificationTarget = path.join(routerDir, 'qualification-contract.json');
   const qualificationBytes = fs.readFileSync(qualificationSource);

package/config/model-router/policy.default.mjs

@@ -39,12 +39,12 @@ function assessmentText(text) {
 export function validateTaskFacts(facts) {
   if (facts === undefined) return undefined;
   if (!facts || typeof facts !== 'object' || Array.isArray(facts)) throw new Error('taskFacts must be an object');
-  const keys = new Set(['taskType','scope','uncertainty','consequentialPlanning','finalSubstantiveReview','exceptionalReason']);
+  const keys = new Set(['taskType','scope','uncertainty','consequentialPlanning','finalSubstantiveReview','exceptionalReason','verifiedTaskQualityFailure']);
   if (Object.keys(facts).some((key) => !keys.has(key))) throw new Error('Unknown taskFacts field');
   if (facts.taskType !== undefined && !['mechanical','coding','research','planning','review'].includes(facts.taskType)) throw new Error('Invalid taskFacts taskType');
   if (facts.scope !== undefined && !['routine','substantial'].includes(facts.scope)) throw new Error('Invalid taskFacts scope');
   if (facts.uncertainty !== undefined && !['none','architecture','coupled-implementation','missing-information','environment'].includes(facts.uncertainty)) throw new Error('Invalid taskFacts uncertainty');
-  for (const key of ['consequentialPlanning','finalSubstantiveReview']) {
+  for (const key of ['consequentialPlanning','finalSubstantiveReview','verifiedTaskQualityFailure']) {
     if (facts[key] !== undefined && typeof facts[key] !== 'boolean') throw new Error(`taskFacts ${key} must be boolean`);
   }
   if (facts.exceptionalReason !== undefined && !/^[a-z][a-z0-9-]{2,79}$/.test(facts.exceptionalReason)) {
@@ -68,7 +68,7 @@ export function classify(features, harness = features.harness || 'codex') {
   const facts = validateTaskFacts(features.taskFacts);
   // Partial caller metadata supplements the assessment; it cannot lower explicit high-consequence text.
   if (facts?.exceptionalReason) return harness === 'claude-code' ? 'hard' : 'exceptional';
-  if (hardText) return 'hard';
+  if (hardText || facts?.verifiedTaskQualityFailure) return 'hard';
   if (facts && (['architecture','coupled-implementation'].includes(facts.uncertainty) ||
       facts.consequentialPlanning || facts.finalSubstantiveReview ||
       ((facts.scope === 'substantial' || substantialText) && ['planning','review'].includes(facts.taskType)))) return 'hard';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.11",
-  "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
+  "version": "4.5.13",
+  "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
     "ruvnet-brain": "bin/install.mjs"
@@ -149,8 +149,10 @@
     "vitest": "^4.1.10"
   },
   "dependencies": {
+    "@claude-flow/aidefence": "^3.0.3",
     "@metaharness/flywheel": "^0.1.7",
     "@metaharness/router": "^0.4.0",
+    "@pacphi/agentic-kit": "next",
     "ws": "^8.22.0"
   }
 }

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.11",
+  "version": "4.5.13",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.11",
+  "version": "4.5.13",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/codex-console-alias.mjs

@@ -0,0 +1,88 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+export const ALIAS_MARKER = '<!-- managed-by: ruvnet-brain; short-console-alias-v1 -->';
+export const ALIAS_NOTICE = 'RuvNet Brain is loaded. Configure it with $rvbc.';
+const aliasPath = (home) => path.join(home, '.agents', 'skills', 'rvbc', 'SKILL.md');
+const aliasBody = `---\nname: rvbc\ndescription: Open the RuvNet Brain configuration console when the user invokes $rvbc or says Configure RuvNet Brain.\n---\n\n${ALIAS_MARKER}\nOpen the installed RuvNet Brain Console. Resolve \`\${RUVNET_BRAIN_KB:-$HOME/.cache/ruvnet-brain/kb}/.console-runtime/scripts/onboarding-console.mjs\`; do not guess a developer checkout. Run \`node <resolved-script> --serve --open\` in the background. Preserve the user's configuration. Report startup failures honestly. Verify the rendered console and client accessibility before claiming it opened or presenting its URL.\n`;
+
+export function ownedCodexConsoleAlias(home = os.homedir()) {
+  try {
+    const file = aliasPath(home);
+    if (fs.lstatSync(path.dirname(file)).isSymbolicLink() || !fs.lstatSync(file).isFile()
+      || fs.lstatSync(file).isSymbolicLink()) return false;
+    const text = fs.readFileSync(file, 'utf8');
+    return text.includes(ALIAS_MARKER) && /^name: rvbc$/m.test(text);
+  } catch { return false; }
+}
+
+export function installCodexConsoleAlias({ home = os.homedir(), codexHome = path.join(home, '.codex'), enabled = true } = {}) {
+  if (!enabled) return { action: 'disabled' };
+  const file = aliasPath(home);
+  try {
+    const config = fs.existsSync(path.join(codexHome, 'config.toml')) ? fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8') : '';
+    for (const section of config.split(/(?=^\[)/m)) {
+      if (!/^\[\[skills\.config\]\]/.test(section) || !/^\s*enabled\s*=\s*false\s*(?:#.*)?$/m.test(section)) continue;
+      const disabled = section.match(/^\s*path\s*=\s*(['"])(.*?)\1\s*(?:#.*)?$/m)?.[2];
+      if (disabled && [file, path.dirname(file)].includes(path.resolve(disabled))) return { action: 'disabled' };
+    }
+    if (fs.existsSync(path.dirname(file)) && !ownedCodexConsoleAlias(home)) return { action: 'user-owned' };
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
+    if (existing === aliasBody) return { action: 'unchanged', path: file };
+    fs.writeFileSync(file, aliasBody);
+    return { action: existing === null ? 'installed' : 'updated', path: file };
+  } catch (error) { return { action: 'unavailable', reason: error.message }; }
+}
+
+// Fresh native metadata only: no inference or plugin mutation requested.
+export function probeCodexConsoleAlias({ home = os.homedir(), codexHome = path.join(home, '.codex'),
+  cwd = process.cwd(), binary = 'codex', timeoutMs = 150, spawnChild = spawn } = {}) {
+  if (!ownedCodexConsoleAlias(home)) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    let child; let timer; let buffer = ''; let settled = false;
+    const finish = (ready) => { if (settled) return; settled = true; clearTimeout(timer); try { child?.kill(); } catch {} resolve(ready); };
+    try { child = spawnChild(binary, ['app-server'], { cwd, env: { ...process.env, HOME: home, CODEX_HOME: codexHome }, stdio: ['pipe', 'pipe', 'ignore'] }); }
+    catch { finish(false); return; }
+    timer = setTimeout(() => finish(false), timeoutMs);
+    child.on('error', () => finish(false)); child.on('exit', () => finish(false));
+    child.stdin.on('error', () => finish(false));
+    child.stdout.on('data', (chunk) => {
+      buffer += String(chunk);
+      if (buffer.length > 8 * 1024 * 1024) { finish(false); return; }
+      let newline;
+      while ((newline = buffer.indexOf('\n')) >= 0) {
+        let message; try { message = JSON.parse(buffer.slice(0, newline)); } catch {}
+        buffer = buffer.slice(newline + 1);
+        if (message?.id === 1 && !message.error) {
+          child.stdin.write(`${JSON.stringify({ method: 'initialized' })}\n`);
+          child.stdin.write(`${JSON.stringify({ id: 2, method: 'skills/list', params: { cwds: [cwd], forceReload: true } })}\n`);
+        } else if (message?.id === 2) {
+          const groups = message.result?.data;
+          const ready = !message.error && Array.isArray(groups) && groups.length === 1 && groups[0].cwd === cwd
+            && Array.isArray(groups[0].skills) && !(groups[0].errors?.length)
+            && groups[0].skills.some((row) => row.name === 'rvbc' && row.path === aliasPath(home) && row.enabled === true);
+          finish(Boolean(ready && ownedCodexConsoleAlias(home)));
+        }
+      }
+    });
+    child.stdin.write(`${JSON.stringify({ id: 1, method: 'initialize', params: { clientInfo: { name: 'rnb_short_console_alias', version: '1' } } })}\n`);
+  });
+}
+
+export function readSessionSource(input = process.stdin) {
+  if (input.isTTY) return Promise.resolve(null);
+  return new Promise((resolve) => {
+    let raw = ''; let settled = false;
+    const finish = () => {
+      if (settled) return; settled = true; clearTimeout(timer); input.pause();
+      input.removeListener('data', onData); input.removeListener('end', finish); input.removeListener('error', finish);
+      try { resolve(JSON.parse(raw).source ?? null); } catch { resolve(null); }
+    };
+    const onData = (chunk) => { raw += String(chunk); if (raw.length > 32768) { raw = ''; finish(); } };
+    const timer = setTimeout(finish, 100);
+    input.on('data', onData); input.once('end', finish); input.once('error', finish); input.resume();
+  });
+}

package/plugin/scripts/session-start-budget.mjs

@@ -47,7 +47,7 @@ export const STAGE_BUDGETS_MS = {
   'stable-spine': 300,    // seed-dispatch decision + a single detach launch
   heartbeat: 300,         // update-check dispatch launch
   'ascii-drift': 300,     // optional ascii->svg drift advisory, already spawnSync-timeout bounded
-  banner: 200,            // version/readiness/health banner assembly — pure fs reads, no subprocess
+  banner: 200,            // banner assembly, including a bounded native skill metadata probe
 };
 
 export function sumBudgetsMs(budgets = STAGE_BUDGETS_MS) {

package/plugin/scripts/session-start-core.mjs

@@ -39,6 +39,7 @@ import { FOOTPRINT_LINE_PREFIX } from './brain-confirmation.mjs';
 import { describeLifecycleHooks, readHookContracts } from './session-start-hook-description.mjs';
 import { createStageTracer } from './session-start-trace.mjs';
 import { sessionStartProofRecorder } from './session-start-proof.mjs';
+import { ALIAS_NOTICE, probeCodexConsoleAlias, readSessionSource } from './codex-console-alias.mjs';
 
 // Re-exported for callers/tests that import the entitlement check directly from this file's own
 // long-standing public surface (tests/unit/session-start-core-parity.test.mjs).
@@ -90,6 +91,8 @@ export async function runSessionStart({
   platform = process.platform,
   restoreContinuity = restoreWithBrief,
   runHeartbeat = true,
+  sessionSource = 'startup',
+  probeConsoleAlias = probeCodexConsoleAlias,
 } = {}) {
   const lines = [];
   // SessionStart is context plumbing, not an instruction channel. Keep factual, actionable
@@ -99,6 +102,7 @@ export async function runSessionStart({
   const isSafeStatus = (line) => {
     const s = String(line);
     return s.startsWith('🚨')
+      || s === ALIAS_NOTICE
       || s.startsWith('[RuvNet Brain — HEALTH ALARM')
       || s.startsWith('[RuvNet Brain — INSTALL ALARM')
       || s.startsWith('[RuvNet Brain — NIGHTLY FAILED')
@@ -332,7 +336,7 @@ export async function runSessionStart({
       }
     });
 
-    tracer.stage('banner', () => {
+    await tracer.stageAsync('banner', async () => {
       const bannerVersion = effectiveVersion || 'unknown';
       if (pluginRoot.startsWith(path.join(home, '.claude', 'plugins') + path.sep)) {
         if (running) write(path.join(stateDir, '.running-version'), `${running}\n`);
@@ -368,6 +372,9 @@ export async function runSessionStart({
       // correction it is delivered to everyone, worded for the user, through the same always-shown
       // alarm mechanism as HEALTH ALARM above (never gated by maintainerIssueEntitlement).
       emit(`[RuvNet Brain v${bannerVersion} — active this session${updated ? ` · updated ${updated}` : ''}]`);
+      if (env.RUVNET_HOOK_HOST === 'codex' && sessionSource === 'startup'
+        && await probeConsoleAlias({ home, codexHome: env.CODEX_HOME || path.join(home, '.codex'),
+          cwd, binary: env.CODEX_BIN || 'codex' })) emit(ALIAS_NOTICE);
       bannerEmitted = true;
       // S2 (ONE CURRENCY VERDICT): this no longer compares the KB's own SOURCE.json releaseTag to the
       // plugin version — that heuristic fires a FALSE POSITIVE for the entire (normal, expected)
@@ -430,7 +437,8 @@ function isDirectInvocation() {
 
 const direct = isDirectInvocation();
 if (direct) {
-  runSessionStart().catch((error) => {
+  const sessionSource = await readSessionSource();
+  runSessionStart({ sessionSource }).catch((error) => {
     if (process.env.RUVNET_SESSION_TRACE === '1') {
       process.stderr.write(`SESSION_TRACE native-fail-open ${error?.message || error}\n`);
     }

package/scripts/architecture-review-lock.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// A release adapter over doc-currency, not a second review engine.
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { REPO_ROOT, evaluateDoc, blockingFindings } from './doc-currency.mjs';
+
+export const GOVERNING_ADR = 'docs/adr/0103-routing-architecture-review-lock.md';
+
+export function evaluateArchitectureReview(root = REPO_ROOT) {
+  try {
+    const doc = evaluateDoc(root, GOVERNING_ADR);
+    const findings = blockingFindings([doc], { strict: true });
+    const block = (code, message) => findings.push({ file: GOVERNING_ADR, level: 'block', code, message });
+    if (doc.id !== 'ADR-103' || doc.status !== 'Accepted') {
+      block('architecture-decision-not-accepted', 'The finite governing ADR-103 must be Accepted.');
+    }
+    if (!doc.governsDeclared.length || doc.governsDeclared.some((entry) => /[*?\[\]{}]/.test(entry))
+      || !doc.governed?.length || doc.governed.some((entry) => !entry.resolved)) {
+      block('architecture-scope-incomplete', 'The governing set must name existing tracked files explicitly, without directories or globs.');
+    }
+    if (doc.review?.current !== true) {
+      block('architecture-review-not-current', 'Update the architecture/test mapping and record a source-bound review of the final governed bytes before qualification.');
+    }
+    return { schemaVersion: 1, pass: findings.length === 0, file: GOVERNING_ADR,
+      review: doc.review ?? null, findings };
+  } catch (error) {
+    return { schemaVersion: 1, pass: false, file: GOVERNING_ADR, review: null,
+      findings: [{ file: GOVERNING_ADR, level: 'block', code: 'architecture-review-unreadable', message: error.message }] };
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  if (argv.length && (argv.length !== 2 || argv[0] !== '--root')) {
+    console.error('Usage: node scripts/architecture-review-lock.mjs [--root PATH]');
+    return 2;
+  }
+  const result = evaluateArchitectureReview(argv.length ? path.resolve(argv[1]) : REPO_ROOT);
+  console.log(JSON.stringify(result, null, 2));
+  return result.pass ? 0 : 1;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main();
+}

package/scripts/candidate-ci-receipt.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { verifyPayloadMembers } from './release-payload.mjs';
+import { validateQualificationReceipt } from './release-qualification.mjs';
+
+export const REQUIRED_CI_JOBS = ['candidate-preflight', 'release-acceptance-linux',
+  'release-acceptance-windows', 'release-acceptance-macos', 'release-qe'];
+const sha256 = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+
+export function createCandidateCiReceipt({ sha, runId, runAttempt, results, ciResult, manifestFile,
+  candidateFile, acceptanceDir }) {
+  if (!/^[a-f0-9]{40}$/.test(sha || '') || !Number.isSafeInteger(runId) || runId <= 0
+    || !Number.isSafeInteger(runAttempt) || runAttempt <= 0) throw new Error('candidate CI run identity is invalid');
+  if (ciResult !== 'success') throw new Error('candidate CI reusable workflow did not succeed');
+  if (!results || Object.keys(results).sort().join(',') !== [...REQUIRED_CI_JOBS].sort().join(',')
+    || REQUIRED_CI_JOBS.some(name => results[name] !== 'success')) {
+    throw new Error('candidate CI contains a missing or non-success dependency');
+  }
+  const manifestBytes = fs.readFileSync(manifestFile);
+  const manifest = JSON.parse(manifestBytes);
+  const candidate = JSON.parse(fs.readFileSync(candidateFile));
+  if (manifest.candidateSha !== sha || candidate.sha !== sha || manifest.version !== candidate.version
+    || !/^\d+\.\d+\.\d+$/.test(manifest.version || '') || manifest.tag !== `v${manifest.version}`) {
+    throw new Error('candidate CI receipt identity differs from checked-out source');
+  }
+  const members = manifest.members;
+  if (!Array.isArray(members) || !members.length
+    || new Set(members.map(row => row.name)).size !== members.length
+    || members.filter(row => row.role === 'npm').length !== 1) throw new Error('candidate CI payload members are invalid');
+  const payload = verifyPayloadMembers({ manifest, root: path.dirname(manifestFile) });
+  const npm = members.find(row => row.role === 'npm');
+  if (String(candidate.artifact?.sha256 || '').replace(/^sha256:/, '') !== npm.sha256) {
+    throw new Error('candidate package digest differs from payload');
+  }
+  const acceptanceReceipts = ['linux', 'macos', 'windows'].map(platform => {
+    const bytes = fs.readFileSync(path.join(acceptanceDir, `release-acceptance-${platform}.json`));
+    const report = JSON.parse(bytes);
+    const tests = validateQualificationReceipt(report, { suite: 'source', platform, sourceSha: sha });
+    return { platform, sourceSha: report.source.sha, passed: tests.passed, receiptSha256: sha256(bytes) };
+  });
+  return { acceptanceReceipts, schemaVersion: 1, kind: 'ruvnet-brain-candidate-ci-evidence',
+    sourceSha: sha, version: manifest.version, payloadId: payload.payloadId,
+    payloadManifestSha256: sha256(manifestBytes), producerWorkflow: 'release-candidate-preflight',
+    producerJob: 'aggregate', summarizedWorkflow: 'ci', runId, runAttempt,
+    jobs: REQUIRED_CI_JOBS.map(name => ({ name, conclusion: results[name],
+      workflow: name === 'candidate-preflight' ? 'release-candidate-preflight' : 'ci' })),
+    verdict: 'PASS', skipped: 0, unknown: 0 };
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const receipt = createCandidateCiReceipt({ sha: process.env.CANDIDATE_SHA,
+    runId: Number(process.env.GITHUB_RUN_ID), runAttempt: Number(process.env.GITHUB_RUN_ATTEMPT),
+    ciResult: process.env.CI_RESULT,
+    results: { ...JSON.parse(process.env.CI_RESULTS_JSON), 'candidate-preflight': process.env.PREFLIGHT_RESULT }, manifestFile: 'release-evidence/payload-manifest.json',
+    candidateFile: 'release-evidence/candidate-receipt.json', acceptanceDir: 'acceptance-reports' });
+  fs.writeFileSync('lane-evidence/ci/candidate-ci-evidence.json', JSON.stringify(receipt, null, 2) + '\n', { flag: 'wx' });
+}