ruvnet-brain 4.5.17 → 4.6.1

package/bin/developer-update.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { developerUpdateCli } from '../plugin/scripts/developer-update.mjs';
+developerUpdateCli().catch(error => { console.error(error.message); process.exitCode = 1; });

package/bin/install.mjs

@@ -27,6 +27,7 @@ import { acquireRefreshLock, finishRefreshReceipt, openRefreshReceipt, physicalP
 import { assessLifecycleEvidence, pruneLifecycleEvidence } from '../kb/lifecycle-evidence-retention.mjs';
 import { checkDiskSpace, recoverIncompleteStorageTransactions } from '../kb/update-storage-transaction.mjs';
 import { saveUpdateSource, stableNode } from '../plugin/scripts/automatic-update.mjs';
+import { acquireDeveloperLock } from '../plugin/scripts/developer-update-lock.mjs';
 import { footprintRoots, inventoryFootprint, sweepFootprint } from '../plugin/scripts/brain-footprint.mjs';
 import { kbCopyProof } from '../plugin/scripts/kb-copy-proof.mjs';
 import { assessMoveLeftovers, isVolumeMetadata } from '../plugin/scripts/footprint-io.mjs';
@@ -4435,7 +4436,7 @@ function enableNightly() {
       testMode: TEST_MODE });
     if (status.state !== 'on') throw new Error(status.evidence);
     ok(`nightly updates enabled — ${status.evidence}`);
-    info(c.dim(`identity ${NIGHTLY_LABEL}; immutable runner ${registration.runnerSha256.slice(0, 16)}…; 03:47 local`));
+    info(c.dim(`identity ${NIGHTLY_LABEL}; immutable runner ${registration.runnerSha256.slice(0, 16)}…; 03:30 local`));
     if (TEST_MODE) warn('RUVNET_BRAIN_TEST=1 — scheduler registration was written but OS activation was safely simulated');
   } catch (error) {
     console.error(`\n${c.red('✗ nightly updates were NOT enabled:')} ${error.message}`);
@@ -6331,7 +6332,18 @@ the installer reports that boot-level declarations changed.
   }
   if (FLAG_DEMO) return runDemo();
   if (FLAG_FEEDBACK) return runFeedback();
-  if (FLAG_UPDATE) return refuseOverSetAsideBrain() || runUpdate();
+  if (FLAG_UPDATE) {
+    if (refuseOverSetAsideBrain()) return;
+    const developerLock = acquireDeveloperLock({ brainHome: process.env.RUVNET_BRAIN_HOME || path.dirname(resolvedKbDir()) });
+    const previousToken = process.env.RUVNET_DEVELOPER_UPDATE_TOKEN;
+    process.env.RUVNET_DEVELOPER_UPDATE_TOKEN = developerLock.token;
+    try { return await runUpdate(); }
+    finally {
+      if (previousToken === undefined) delete process.env.RUVNET_DEVELOPER_UPDATE_TOKEN;
+      else process.env.RUVNET_DEVELOPER_UPDATE_TOKEN = previousToken;
+      developerLock.release();
+    }
+  }
   if (FLAG_ENABLE_NIGHTLY) return enableNightly();
   if (FLAG_DISABLE_NIGHTLY) return disableNightly();
   // Standalone, like the nightly pair above. Without these, the flags existed only as a way to

package/bin/nightly-refresh.mjs

@@ -61,13 +61,29 @@ Object.assign(process.env, registration.environment || {});
 let invocation;
 try {
   const modules = registration.updateModules;
-  if (!modules || Object.keys(modules).sort().join(',') !== 'automatic-update.mjs,ruvnet-gate1-pattern.mjs,user-settings.mjs') throw new Error('registered update module closure is missing');
+  const legacy = ['automatic-update.mjs', 'ruvnet-gate1-pattern.mjs', 'user-settings.mjs'];
+  const bridged = [...legacy, 'developer-update-owner.mjs'];
+  const currentLegacy = [...bridged, 'developer-update-policy.mjs'];
+  if (!modules?.['developer-update-policy.mjs'] && registration.mode === 'developer-suite') throw new Error('suite policy closure is missing');
+  if (registration.mode === 'developer-suite' && (!path.isAbsolute(modules['developer-update-policy.mjs'].path) || path.basename(modules['developer-update-policy.mjs'].path) !== 'developer-update-policy.mjs' || path.dirname(modules['developer-update-policy.mjs'].path) !== path.dirname(modules['automatic-update.mjs'].path) || !fs.lstatSync(modules['developer-update-policy.mjs'].path).isFile())) throw new Error('suite policy path identity mismatch');
+  if (registration.mode === 'developer-suite' && crypto.createHash('sha256').update(fs.readFileSync(modules['developer-update-policy.mjs'].path)).digest('hex') !== modules['developer-update-policy.mjs'].sha256) throw new Error('suite policy digest mismatch');
+  const executionPolicy = registration.mode === 'developer-suite' ? await import(pathToFileURL(modules['developer-update-policy.mjs'].path).href) : null;
+  const suite = executionPolicy ? [...new Set([...currentLegacy, ...executionPolicy.EXECUTION_MODULES])] : [];
+  const expected = registration.mode === 'developer-suite' ? [suite] : [legacy, bridged, currentLegacy];
+  if (!modules || !expected.some(names => Object.keys(modules).sort().join(',') === names.sort().join(','))) throw new Error('registered update module closure is missing');
   for (const [name, item] of Object.entries(modules)) {
     if (!path.isAbsolute(item.path) || path.basename(item.path) !== name
       || path.dirname(item.path) !== path.dirname(modules['automatic-update.mjs'].path)
       || !fs.lstatSync(item.path).isFile()
       || crypto.createHash('sha256').update(fs.readFileSync(item.path)).digest('hex') !== item.sha256) throw new Error('update module digest mismatch');
   }
+  if (registration.mode === 'developer-suite') {
+    const coordinator = await import(pathToFileURL(modules['developer-update.mjs'].path).href);
+    const receipt = await coordinator.runDeveloperUpdate({ mode: 'apply', env: { ...process.env,
+      RUVNET_NIGHTLY_IDENTITY: registration.identity, RUVNET_NIGHTLY: '1' } });
+    console.log(JSON.stringify(receipt));
+    process.exit(0);
+  }
   const policy = await import(pathToFileURL(modules['automatic-update.mjs'].path).href);
   process.env.PATH = policy.automaticPath({ nodePath: registration.nodePath });
   invocation = policy.automaticInvocation(['--update', '--no-nightly-prompt'], {

package/console/CONTRACT.md

@@ -1,8 +1,8 @@
-# Onboarding Console — API + data contract (v1)
-
-Updated: 2026-07-17
+Updated: 2026-10-10 04:37:54 EDT | Version 1.1.2
 Created: 2026-07-15
 
+# Onboarding Console — API + data contract (v1)
+
 The single source of truth both the backend (`scripts/onboarding-console.mjs`) and the
 frontend (`console/index.html` + `app.js` + `style.css`) build against. Implements ADR-0013
 and DDD-0002. **The ordering is the design: Mirror → Explain → Recommend → (consent) Apply → Undo.**
@@ -13,6 +13,50 @@ A GET with a wrong/absent token still serves read-only state; a POST with a wron
 
 ---
 
+## Coordinated developer updates
+
+`GET /api/suite-update` reads the installed coordinator's canonical policy, latest receipt,
+and shared ownership lock on every request. It never starts an update or writes a policy.
+The same live `suiteUpdate` field decorates `/api/state` and `/api/activity`; it is not persisted
+inside their heavier measurement caches.
+
+The response distinguishes `never-run`, `running`, `succeeded`, `failed`, `interrupted`,
+`checked`, and `unavailable`. A scheduled job or a saved setting cannot prove a completed run.
+A check-only receipt cannot prove an apply. The public card shows the saved release policy and
+scope; Latest is recommended, Alpha uses published Ruv alpha tags with Latest fallback, and
+other providers retain their release policies. Newer installed versions remain preserved.
+
+`POST /api/suite-update` requires the existing per-launch token and rejects a supplied Origin
+that differs from this loopback server. The body contains only `channel: "latest" | "alpha"`.
+An explicit **Keep all tools updated** click saves that channel and opts existing installations
+into scope `all`, including supported Homebrew, uv, Cargo, and native inventories. It enables the
+existing canonical nightly job through the same installer scheduler adapter, verifies enforcement,
+mirrors the nightly choice, and then runs one immediate update. Reads never enroll a scheduler. It preserves
+cleanup and managed-callback preferences, never installs a missing provider, and never changes
+project dependencies. An invalid channel or non-idle shared lock returns a refusal before
+policy mutation or child execution.
+
+The server starts the shipped coordinator with its own Node interpreter, a fixed user-home
+working directory and explicit Brain home. The coordinator acquires the shared lock. The adapter
+records an asynchronous launch receipt and accepts success only from a completed apply receipt
+matching the child's PID, exact coordinator source hash, and complete five-module execution snapshot. Activity polls this live read model;
+launch failure, interrupted execution, and a failed provider are distinct from success.
+
+The nightly Settings control uses the same coordinator through the installer's existing scheduler
+adapter. Schedule enforcement and the last completed receipt remain separate measured facts.
+
+## Refresh settlement
+
+A fresh state response is painted directly from the snapshot that satisfied the freshness poller;
+no second fetch can substitute an older or withdrawn state. Stack, capability, and memory cards
+keep waiting when their own cache is warming or stale. Each fresh recommendation source replaces
+its previous source snapshot, so resolved proposals disappear and changed evidence is repainted.
+The header describes the machine reading's age, without claiming all independent cards finished.
+A forced refresh during an active measurement queues one follow-up in the same project scope.
+While it waits, caches from the earlier writer remain stale. When that writer exits, its late
+snapshots are withdrawn before the follow-up begins, so a pre-mutation scan cannot settle a
+post-mutation request. Repeated requests coalesce into that one follow-up.
+
 ## GET `/api/state` — fast sections (no network)
 
 Returns in well under a second. `memory.fleet` is **`null` here by design** — scanning every memory

package/console/app.js

@@ -25,6 +25,7 @@ let preStateHash = null;          // echoed on /api/apply so the server can refu
 let lastMemory = null;            // last rendered memory card, so the late fleet scan can merge into it
 const renderedRecIds = new Set();
 const renderedRecommendations = new Map();
+const recommendationSources = new Map();
 let stateRecsSettled = false;
 let stackRecsSettled = false;
 // Health advocacy (ADR-027) hydrates from /api/memory, the slowest source. Until it has answered,
@@ -1374,7 +1375,7 @@ async function loadCapabilities(attempt = 0) {
     const r = await fetchCapabilities();
     if (r.status === 404) { capsMissingEndpoint(); return; }
     if (!r.ok) throw new Error(`/api/capabilities answered HTTP ${r.status}`);
-    if (r.data && r.data.warming) {
+    if (r.data && (r.data.warming || r.data.stale === true)) {
       // "Not measured yet" is NOT "off" — this card's entire reason for existing. Rendering a
       // warming answer would produce an empty row list, which on this surface says "you own
       // nothing", the single most damaging thing this page could get wrong.
@@ -1720,14 +1721,26 @@ function addRecommendations(recs, source) {
       'Ordered by what you’re working on — machine-wide updates first (they affect every project), then your most recently active projects.'));
   }
   let dropped = 0;
-  const nodes = [];
+  const next = new Map();
   for (const rec of Array.isArray(recs) ? recs : []) {
-    if (!rec || rec.id == null || renderedRecIds.has(rec.id)) continue;
-    // The DDD invariant, honored in the UI too: no evidence/cost/undo → not rendered.
+    if (!rec || rec.id == null) continue;
+    // A fresh audit replaces this source, including an empty result after an update.
     if (!Array.isArray(rec.evidence) || !rec.evidence.length || !rec.cost || !rec.undo) { dropped += 1; continue; }
-    renderedRecIds.add(rec.id);
-    renderedRecommendations.set(rec.id, rec);
-    nodes.push(buildRecCard(rec));
+    next.set(rec.id, rec);
+  }
+  const previous = recommendationSources.get(source) || new Map();
+  recommendationSources.set(source, next);
+  const nodes = [];
+  for (const id of new Set([...previous.keys(), ...next.keys()])) {
+    const rec = next.get(id) || [...recommendationSources.values()].map(rows => rows.get(id)).find(Boolean);
+    const existing = document.getElementById(`rec-${id}`);
+    if (!rec) {
+      existing?.remove(); renderedRecIds.delete(id); renderedRecommendations.delete(id);
+      continue;
+    }
+    renderedRecIds.add(id); renderedRecommendations.set(id, rec);
+    const card = buildRecCard(rec);
+    if (existing) existing.replaceWith(card); else nodes.push(card);
   }
   // Ordering is by BLAST RADIUS, not arrival time — the slow sources arrive last and matter most.
   //
@@ -2954,6 +2967,83 @@ function nightlyFactsLine(f) {
     f.agree === false ? ' — these disagree, so the toggle above shows no single state until they do.' : '');
 }
 
+let suiteUpdateTimer = null;
+let suiteUpdateBusy = false;
+let suiteUpdateWasActive = false;
+function suiteUpdateSummary(state) {
+  const labels = { running: 'Update in progress', succeeded: 'Last update completed successfully',
+    failed: 'Last update failed', interrupted: 'Last update has no completed result',
+    checked: 'Last run checked for updates; it did not apply them', 'never-run': 'No update run has been recorded' };
+  const label = state.status === 'succeeded' && state.unverified?.length ? 'Update finished; some checks remain unverified' : labels[state.status];
+  return `${label || 'Update status unknown'}${state.finishedAt ? ` · ${fmtDate(state.finishedAt)}` : ''}${state.error ? ` · ${state.error}` : ''}`;
+}
+function renderSuiteUpdate(state) {
+  if (!state) return;
+  const updateFinished = suiteUpdateWasActive && !state.active && ['succeeded', 'failed'].includes(state.status);
+  suiteUpdateWasActive = !!state.active;
+  if (updateFinished) void recheckMachine(); // Measure the changed machine once, including partial failures.
+  let card = document.getElementById('card-suite-update');
+  if (!card) {
+    card = el('section', { class: 'card sub-card rail-act', id: 'card-suite-update', 'aria-labelledby': 'suite-update-heading' },
+      el('div', { class: 'body' },
+        el('h2', { id: 'suite-update-heading' }, 'Keep all tools updated'),
+        chip('recommended', 'cyan'),
+        el('p', { class: 'fineprint' }, 'One coordinated update for your installed developer tools, plugins and Brain knowledge. Enable nightly updates and run the same coordinator now.'),
+        el('label', { for: 'suite-update-channel' }, 'Release policy '),
+        el('select', { id: 'suite-update-channel' },
+          el('option', { value: '', disabled: true }, 'Policy not measured'),
+          el('option', { value: 'latest' }, 'Latest (recommended)'),
+          el('option', { value: 'alpha' }, 'Alpha')),
+        el('p', { class: 'fineprint' }, 'Alpha uses published alpha releases for supported Ruv tools, with Latest as the fallback. Other providers keep their own release channels; installed newer versions are preserved.'),
+        el('button', { class: 'btn btn-apply', id: 'suite-update-run', type: 'button', onclick: async () => {
+          if (suiteUpdateBusy) return;
+          const button = document.getElementById('suite-update-run');
+          const channel = document.getElementById('suite-update-channel').value;
+          suiteUpdateBusy = true; button.disabled = true;
+          try {
+            const result = await postJSON('/api/suite-update', { channel });
+            if (!result.ok || !result.data.ok) throw new Error(result.status === 403 ? TOKEN_MSG : result.data.error || 'The update could not start.');
+            renderSuiteUpdate(result.data.state);
+          } catch (error) { document.getElementById('suite-update-result').textContent = String(error.message || error); }
+          finally { suiteUpdateBusy = false; void pollSuiteUpdate(); }
+        } }, 'Keep all tools updated'),
+        el('p', { id: 'suite-update-result', role: 'status', 'aria-live': 'polite' }),
+        el('p', { id: 'suite-update-nightly', class: 'fineprint' })));
+    document.getElementById('card-settings')?.before(card);
+  }
+  const select = document.getElementById('suite-update-channel');
+  // Preserve an unsaved policy choice during receipt polling.
+  if (!select.dataset.initialized) {
+    select.value = state.channel || '';
+    select.dataset.initialized = '1';
+  }
+  select.disabled = !!state.active;
+  const button = document.getElementById('suite-update-run');
+  button.disabled = suiteUpdateBusy || !!state.active || !state.available || state.lockState !== 'idle';
+  button.textContent = state.active ? 'Updating…' : 'Keep all tools updated';
+  document.getElementById('suite-update-result').textContent = state.available ? suiteUpdateSummary(state) : state.policyError || 'The coordinated updater is unavailable.';
+  document.getElementById('suite-update-nightly').textContent = `Nightly updates: ${state.nightlyState === 'on' ? 'enabled' : state.nightlyState === 'off' ? 'not scheduled' : 'not verified'}. Saved scope: ${state.scope === 'all' ? 'all installed tools' : state.scope === 'ruvnet' ? 'Ruv tools' : 'not measured'}. Clicking this button includes existing npm, Homebrew, uv, Cargo and native tools. It does not install missing tools or change project dependencies.`;
+  let activity = document.getElementById('suite-update-activity');
+  if (!activity) {
+    activity = el('section', { class: 'body', id: 'suite-update-activity', 'aria-label': 'Tool update activity' });
+    document.getElementById('card-activity')?.append(activity);
+  }
+  activity.replaceChildren(el('h3', {}, 'Tool update activity'),
+    el('p', { role: 'status' }, suiteUpdateSummary(state)),
+    state.startedAt ? el('p', { class: 'fineprint' }, `Started ${fmtDate(state.startedAt)} · ${state.mode === 'check' ? 'check only' : 'apply'}`) : '',
+    state.steps?.length ? el('ul', {}, state.steps.map(step => el('li', {}, `${step.name}: ${step.state}`))) : '',
+    state.unverified?.length ? el('details', { class: 'sub' }, el('summary', {}, 'Checks not verified'),
+      el('ul', {}, state.unverified.map(note => el('li', {}, note)))) : '',
+    state.exclusions?.length ? el('details', { class: 'sub' }, el('summary', {}, `${state.exclusions.length} tools preserved`),
+      el('ul', {}, state.exclusions.map(item => el('li', {}, `${item.name}: ${item.reason}`)))) : '',
+    state.sourceSha256 ? el('details', { class: 'sub' }, el('summary', {}, 'Update receipt'), el('p', { class: 'fineprint' }, `Updater source: ${state.sourceSha256.slice(0, 16)}`)) : '');
+}
+async function pollSuiteUpdate() {
+  try { renderSuiteUpdate(await getJSON('/api/suite-update')); }
+  catch { const result = document.getElementById('suite-update-result'); if (result) result.textContent = 'Update status could not be measured. Reload to reconnect.'; }
+  if (!suiteUpdateTimer) suiteUpdateTimer = setInterval(() => { if (!document.hidden) void pollSuiteUpdate(); }, 3000);
+}
+
 function renderSettings(cfg, us, bp) {
   const body = $('#body-settings');
   // UNSAVED CHOICES SURVIVE A REPAINT. RNBC QA 2026-10-01: a background measurement landing while
@@ -3350,7 +3440,7 @@ function bpParts(bp) {
       'Version updates and the health alarm keep running even when the brain is off — an off machine ',
       'has to be able to receive the fix for an off-state bug. The nightly refresh is the part of that ',
       'you can pause: it is the ',
-      el('button', { class: 'btn btn-ghost btn-sm', type: 'button', onclick: () => jumpToSetting('nightly') }, 'Nightly brain refresh'),
+      el('button', { class: 'btn btn-ghost btn-sm', type: 'button', onclick: () => jumpToSetting('nightly') }, 'Nightly coordinated updates'),
       ' switch in Settings.'),
 
     part('Installed knowledge',
@@ -3683,16 +3773,16 @@ function renderFreshness(state, { polling = false, justLanded = false } = {}) {
   }
   const at = state && (state.measuredAt || state.cachedAt || state.generatedAt);
   if (at) FRESH_BASE = at;
-  if (justLanded) {
-    pill.className = 'chip tone-green';
-    pill.textContent = 'measured just now';
-    return;
-  }
   if (!at || stampWithdrawn(at)) {
     pill.className = polling ? 'chip tone-cyan' : 'chip tone-warn';
     pill.textContent = polling ? 're-measuring your machine…' : 'this reading was cleared — click to measure again';
     return;
   }
+  if (justLanded) {
+    pill.className = 'chip tone-green';
+    pill.textContent = `machine reading updated · as of ${fmtAge(at)}`;
+    return;
+  }
   pill.className = polling ? 'chip tone-cyan' : (state && state.stale ? 'chip tone-warn' : 'chip tone-grey');
   pill.textContent = `as of ${fmtAge(at)}${polling ? ' · re-measuring…' : ''}`;
 }
@@ -3738,7 +3828,7 @@ function startFreshnessPolling() {
         // ONE painter — the same loadState() the first paint uses, so a polled repaint can never
         // drift from an initial one. It also refreshes preStateHash and the recommendations, which a
         // sections-only repaint silently left pointing at the pre-measurement machine.
-        await loadState({ landed: true });
+        await loadState({ landed: true, snapshot: st });
         // The other cards measure on their own clocks (stack, capabilities, fleet). Re-ask them here
         // rather than letting the page claim page-wide freshness on the strength of state alone.
         void loadStack();
@@ -3790,10 +3880,12 @@ async function doManualRefresh() {
    that painted the same bytes twice and cost a round-trip on every open. There is now one call, and
    the "live" reading arrives the only way it can without freezing the server — from the detached
    child, via the freshness poller. */
-async function loadState({ landed = false } = {}) {
+async function loadState({ landed = false, snapshot = null } = {}) {
   try {
-    const state = await getJSON('/api/state');
+    const state = snapshot || await getJSON('/api/state');
     $('#global-error').hidden = true;
+    renderSuiteUpdate(state.suiteUpdate);
+    void pollSuiteUpdate();
 
     // WARMING: NOTHING HAS BEEN MEASURED FOR THIS PROJECT YET. Paint NOTHING. Every render* below
     // would turn a missing section into a positive claim — renderWiring(undefined) prints "No wiring
@@ -3968,7 +4060,7 @@ const WARM_RETRY_MAX = 60;
 async function loadMemoryFleet(attempt = 0) {
   try {
     const m = await getJSON('/api/memory');
-    if (m && m.warming) {
+    if (m && (m.warming || m.stale === true)) {
       // The fleet scan is the slowest thing the console does. Until it lands, the memory card keeps
       // whatever /api/state already gave it and simply does not claim a fleet — it must never render
       // "0 projects", which on this card would read as "nothing on your machine learns anything".
@@ -3999,8 +4091,8 @@ async function loadMemoryFleet(attempt = 0) {
 async function loadStack(attempt = 0) {
   try {
     const stack = await getJSON('/api/stack');
-    if (stack && stack.warming) {
-      setChips('chips-stack', [chip('auditing your stack…', 'wait')]);
+    if (stack && (stack.warming || stack.stale === true)) {
+      setChips('chips-stack', [chip(stack.warming ? 'auditing your stack…' : 're-measuring your stack…', 'wait')]);
       if (attempt < WARM_RETRY_MAX) setTimeout(() => { void loadStack(attempt + 1); }, WARM_RETRY_MS);
       else { setChips('chips-stack', [chip('audit is taking unusually long', 'warn')]); recsSettled('stack', false); }
       return;   // skeleton stays: an empty package list would read as "nothing is installed"
@@ -4076,7 +4168,7 @@ const MOCK_STATE = {
       values: { openrouterKey: true, nightly: true, routing: 'auto', qeFleet: false },
       schema: [
         { key: 'openrouterKey', label: 'OpenRouter API key', type: 'secret', help: 'Unlocks cheap-model routing + the self-improvement loop', secret: true },
-        { key: 'nightly', label: 'Nightly brain refresh', type: 'bool', help: 'Rebuild the KB from pinned SHAs overnight' },
+        { key: 'nightly', label: 'Nightly coordinated updates', type: 'bool', help: 'Rebuild the KB from pinned SHAs overnight' },
         { key: 'routing', label: 'Token-smart routing', type: 'enum', options: ['auto', 'off'], help: 'Route cheap tasks to smaller models' },
         { key: 'qeFleet', label: 'On-demand QE fleet', type: 'bool', help: 'Agentic-QE test fleet, spun up on request' },
       ],

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.17",
+  "version": "4.6.1",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
-    "ruvnet-brain": "bin/install.mjs"
+    "ruvnet-brain": "bin/install.mjs",
+    "ruvnet-brain-update": "bin/developer-update.mjs"
   },
   "scripts": {
     "prepublishOnly": "node scripts/protected-release-invocation.mjs --prepublish-only",
@@ -83,6 +84,7 @@
     ".claude-plugin/marketplace.json",
     "bin/install.mjs",
     "bin/nightly-refresh.mjs",
+    "bin/developer-update.mjs",
     "plugin/",
     "plugin/mcp/managed-cli-interface.mjs",
     "plugin/mcp/server.mjs",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.17",
+  "version": "4.6.1",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.17",
+  "version": "4.6.1",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/commands/brain-console.md

@@ -1,6 +1,7 @@
 ---
 description: "Brain Console — the RuvNet Brain Console, also opened by /rnbc (same console as /rnb, /rvbc, /rvcb and /ruvnet-brain:configure — every spelling works). Your whole RuvNet stack on one page. Read-only until you click."
-updated: 2026-10-01
+updated: 2026-10-10 06:00:22 EDT
+version: 1.0.2
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,
@@ -64,6 +65,17 @@ header chip says how fresh the reading is and re-measures if they click it.
 Report it plainly — the real error, not a guess — and offer to fix it. Never leave them staring at
 a dead tab wondering whether it is still loading.
 
+## Promise capture preference
+
+If the user asks to stop automatic promise capture, explain the supported setting:
+`RUVNET_PROMISE_CAPTURE=off` in the hook process environment. It can be supplied for the machine or
+one project through the host's environment configuration. The exact value `off` stops capturing new
+"I'll …" promises; unset it or set `on` to resume capture. This preference is separate from the Brain
+on/off switch and is not currently a Console toggle. Existing promises remain visible and forceable,
+and close only on verified evidence. Capability and completion integrity checks keep running. Do not
+disable the Stop hook or edit the work ledger to apply this preference. Reopen the host if its current
+session has not picked up the changed environment.
+
 ---
 
 ## Things NOT to do before the page is open

package/plugin/commands/configure.md

@@ -1,7 +1,7 @@
 ---
 description: Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible.
-updated: 2026-10-04
-version: 1.0.1
+updated: 2026-10-10 06:00:22 EDT
+version: 1.0.2
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,

package/plugin/commands/rnb.md

@@ -1,6 +1,7 @@
 ---
 description: "RNB — opens the RuvNet Brain Console (same console as /rnbc, /rvbc, /brain-console and /ruvnet-brain:configure — every spelling works). Your whole RuvNet stack on one page. Read-only until you click."
-updated: 2026-10-01
+updated: 2026-10-10 06:00:22 EDT
+version: 1.0.2
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,
@@ -64,6 +65,17 @@ header chip says how fresh the reading is and re-measures if they click it.
 Report it plainly — the real error, not a guess — and offer to fix it. Never leave them staring at
 a dead tab wondering whether it is still loading.
 
+## Promise capture preference
+
+If the user asks to stop automatic promise capture, explain the supported setting:
+`RUVNET_PROMISE_CAPTURE=off` in the hook process environment. It can be supplied for the machine or
+one project through the host's environment configuration. The exact value `off` stops capturing new
+"I'll …" promises; unset it or set `on` to resume capture. This preference is separate from the Brain
+on/off switch and is not currently a Console toggle. Existing promises remain visible and forceable,
+and close only on verified evidence. Capability and completion integrity checks keep running. Do not
+disable the Stop hook or edit the work ledger to apply this preference. Reopen the host if its current
+session has not picked up the changed environment.
+
 ---
 
 ## Things NOT to do before the page is open

package/plugin/commands/rnbc.md

@@ -1,6 +1,7 @@
 ---
 description: "RNBC — RuvNet Brain Console. Opens the live console page: your whole RuvNet stack on one page — what's installed, what your AI learned, one-click reversible fixes. Read-only until you click. (Also: /rnb, /rvbc, /rvcb, /brain-console — all the same thing.)"
-updated: 2026-10-01
+updated: 2026-10-10 06:00:22 EDT
+version: 1.0.2
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,
@@ -64,6 +65,17 @@ header chip says how fresh the reading is and re-measures if they click it.
 Report it plainly — the real error, not a guess — and offer to fix it. Never leave them staring at
 a dead tab wondering whether it is still loading.
 
+## Promise capture preference
+
+If the user asks to stop automatic promise capture, explain the supported setting:
+`RUVNET_PROMISE_CAPTURE=off` in the hook process environment. It can be supplied for the machine or
+one project through the host's environment configuration. The exact value `off` stops capturing new
+"I'll …" promises; unset it or set `on` to resume capture. This preference is separate from the Brain
+on/off switch and is not currently a Console toggle. Existing promises remain visible and forceable,
+and close only on verified evidence. Capability and completion integrity checks keep running. Do not
+disable the Stop hook or edit the work ledger to apply this preference. Reopen the host if its current
+session has not picked up the changed environment.
+
 ---
 
 ## Things NOT to do before the page is open

package/plugin/commands/rvbc.md

@@ -1,6 +1,7 @@
 ---
 description: "RvBC — the older spelling of /rnbc, the RuvNet Brain Console (same console as /rnbc, /rnb, /brain-console and /ruvnet-brain:configure — every spelling works). Your whole RuvNet stack on one page. Read-only until you click."
-updated: 2026-10-01
+updated: 2026-10-10 06:00:22 EDT
+version: 1.0.2
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,
@@ -64,6 +65,17 @@ header chip says how fresh the reading is and re-measures if they click it.
 Report it plainly — the real error, not a guess — and offer to fix it. Never leave them staring at
 a dead tab wondering whether it is still loading.
 
+## Promise capture preference
+
+If the user asks to stop automatic promise capture, explain the supported setting:
+`RUVNET_PROMISE_CAPTURE=off` in the hook process environment. It can be supplied for the machine or
+one project through the host's environment configuration. The exact value `off` stops capturing new
+"I'll …" promises; unset it or set `on` to resume capture. This preference is separate from the Brain
+on/off switch and is not currently a Console toggle. Existing promises remain visible and forceable,
+and close only on verified evidence. Capability and completion integrity checks keep running. Do not
+disable the Stop hook or edit the work ledger to apply this preference. Reopen the host if its current
+session has not picked up the changed environment.
+
 ---
 
 ## Things NOT to do before the page is open

package/plugin/commands/rvcb.md

@@ -1,6 +1,7 @@
 ---
 description: "RvCB — another spelling of /rnbc, the RuvNet Brain Console (same console as /rnbc, /rnb, /rvbc, /brain-console and /ruvnet-brain:configure — every spelling works). Read-only until you click."
-updated: 2026-10-01
+updated: 2026-10-10 06:00:22 EDT
+version: 1.0.2
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,
@@ -64,6 +65,17 @@ header chip says how fresh the reading is and re-measures if they click it.
 Report it plainly — the real error, not a guess — and offer to fix it. Never leave them staring at
 a dead tab wondering whether it is still loading.
 
+## Promise capture preference
+
+If the user asks to stop automatic promise capture, explain the supported setting:
+`RUVNET_PROMISE_CAPTURE=off` in the hook process environment. It can be supplied for the machine or
+one project through the host's environment configuration. The exact value `off` stops capturing new
+"I'll …" promises; unset it or set `on` to resume capture. This preference is separate from the Brain
+on/off switch and is not currently a Console toggle. Existing promises remain visible and forceable,
+and close only on verified evidence. Capability and completion integrity checks keep running. Do not
+disable the Stop hook or edit the work ledger to apply this preference. Reopen the host if its current
+session has not picked up the changed environment.
+
 ---
 
 ## Things NOT to do before the page is open

package/plugin/scripts/automatic-update.mjs

@@ -5,6 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
+import { developerCoordinatorOwner } from './developer-update-owner.mjs';
 import { SETTINGS_VERSION, validate, saveSettings } from './user-settings.mjs';
 
 export const ownerSettingsPath = (home = os.homedir()) => path.join(home, '.config', 'ruvnet-brain', 'settings.json');
@@ -44,7 +45,7 @@ export function saveUpdateSource(source, { home = os.homedir() } = {}) {
 }
 
 export function automaticPath({ nodePath = process.execPath, home = os.homedir(), platform = process.platform, env = process.env } = {}) {
-  const paths = [path.dirname(nodePath), path.join(home, '.npm-global', 'bin'), path.join(home, '.local', 'bin')];
+  const paths = [path.join(home, '.npm-global', 'bin'), path.dirname(nodePath), path.join(home, '.local', 'bin'), path.join(home, '.cargo', 'bin'), path.join(home, '.bun', 'bin')];
   if (platform === 'win32') {
     const system = env.SystemRoot || env.SYSTEMROOT;
     if (system && path.win32.isAbsolute(system)) paths.push(system, path.join(system, 'System32'));
@@ -91,8 +92,16 @@ export function installedUpdater({ home = os.homedir(), platform = process.platf
   return { entry, version: manifest.version, sha256 };
 }
 
-export function automaticInvocation(args, { source = updateSource(), home = os.homedir(), nodePath = process.execPath,
+export function automaticInvocation(args, { source, home = os.homedir(), nodePath = process.execPath,
   packageTarget = 'ruvnet-brain@latest' } = {}) {
+  if (packageTarget === 'ruvnet-brain@latest') {
+    const coordinator = developerCoordinatorOwner({ home });
+    if (coordinator.active) {
+      if (!coordinator.ready) throw new Error(`coordinated updater is not ready: ${coordinator.reason}`);
+      return { executable: nodePath, args: [coordinator.entry, '--apply'], source: 'developer-suite', coordinator };
+    }
+  }
+  source ??= updateSource({ home });
   if (source === 'installed') {
     if (packageTarget !== 'ruvnet-brain@latest') throw new Error('installed mode cannot select a proof tarball');
     const installed = installedUpdater({ home });

package/plugin/scripts/continuation-gate.mjs

@@ -392,7 +392,8 @@ function promiseBookkeeping() {
         if (!assistantCommitmentOwned(item, hookInput.session_id, projectIdentity)) continue;
         const claim = completion.claims.find((c) => claimClosesPromise(c.text, item.text));
         if (!claim) continue;
-        Object.assign(item, { done: true, state: 'completed', doneAt: at, completionEvidence: { claim: claim.text,
+        const verifiedCompletion = completion.verdict === 'PASS' && Boolean(claim);
+        Object.assign(item, { done: verifiedCompletion, state: verifiedCompletion ? 'completed' : item.state, doneAt: at, completionEvidence: { claim: claim.text,
           checks: completion.verification.checks.slice(-5).map((c) => c.what),
           transcript: String(hookInput.transcript_path || ''), sessionId: hookInput.session_id } });
         changed = true;