ruvnet-brain 4.5.3 → 4.5.5

package/scripts/codex-routed.sh

@@ -1,38 +1,5 @@
 #!/usr/bin/env bash
-# scripts/codex-routed.sh — built 2026-07-12. Codex has no native routing surface
-# (~/.codex/config.toml launches ONE model per run), so a consulted wrapper is the only
-# per-prompt model-selection path available to it. Part of the MetaHarness router (see
-# scripts/model-router-engine.mjs, the harness-neutral prompt -> {model, reason} decision
-# engine). This script only CONSULTS the engine and LAUNCHES codex — all selection logic
-# (features, policy, pricing) lives in the engine, not here.
-#
-# Contract: never block Stuart's launch. If the engine errors, times out, or returns a
-# null model, fall straight through to plain `codex` with no --model flag — a missing
-# routing decision must never be worse than no routing at all.
-set -uo pipefail
+# One routed native noninteractive worker. No silent fallback; model and effort are enforced together.
+set -euo pipefail
 DIR="$(cd "$(dirname "$0")" && pwd)"
-
-DECISION=$(node "$DIR/model-router-engine.mjs" --harness codex --prompt "$*" --json 2>/dev/null)
-
-# Extract .model + a short .reason without a jq dependency (Stuart directive). python3 ships
-# with macOS by default and its json module handles arbitrary reason text (quotes, unicode)
-# more safely than hand-rolled JS string escaping in a node -e one-liner would. Single call,
-# tab-delimited output, so we only shell out once per launch.
-IFS=$'\t' read -r M REASON <<< "$(printf '%s' "$DECISION" | python3 -c '
-import json, sys
-try:
-    d = json.load(sys.stdin)
-    m = d.get("model") or ""
-    r = (d.get("reason") or "").replace("\n", " ").replace("\t", " ")[:80]
-    print(f"{m}\t{r}")
-except Exception:
-    print("\t")
-' 2>/dev/null)"
-
-if [ -z "${M:-}" ] || [ "$M" = "None" ]; then
-  # Engine failed / no policy resolved a model — never block, just launch codex unrouted.
-  exec codex "$@"
-fi
-
-printf '\x1b[2m🧭 codex-routed → %s (%s)\x1b[0m\n' "$M" "$REASON"
-exec codex --model "$M" "$@"
+exec node "$DIR/model-router-dispatch.mjs" --harness codex -- "$@"

package/scripts/goldie-weekly.sh

@@ -1,67 +1,11 @@
 #!/bin/bash
-# goldie-weekly.sh — the ONLY thing launchd invokes for Goldie (weekly model-landscape research).
-# Same discipline as nightly-wrapper.sh: verified outcomes, exactly one phone summary per run,
-# no silent path. Built 2026-07-12 per Stuart's mandate: the router must never run on a stale
-# picture of the model landscape, and no scheduled job may ever die quietly.
-#
-# Two layers, independent by design:
-#   1. DETERMINISTIC (scripts/goldie-research.mjs): live OpenRouter pricing -> catalog refresh +
-#      drift flags + radar + the dated brief. Pure data, no LLM, no key needed.
-#   2. JUDGMENT (headless Claude, subscription-covered): answers the brief's three standing
-#      questions (bucket count, best-model-per-bucket per public evals, radar adoption) with real
-#      web research, APPENDED to the same brief as a PROPOSAL — never auto-applied to policy.mjs.
-#      Skippable (GOLDIE_SKIP_JUDGMENT=1) and its failure never hides layer 1's result.
-set -u
-cd /Users/stuartkerr/Code/ruvnet-brain || exit 1
-mkdir -p logs
-LOG=logs/goldie.log
-TODAY=$(date +%F)
-BRIEF="$HOME/.claude/model-router/goldie/$TODAY.md"
-
-echo "===== goldie-weekly — $(date -u +%FT%TZ) =====" >> "$LOG"
-
-# ── Layer 1: deterministic refresh (must succeed for the run to count) ──
-if ! /usr/local/bin/node scripts/goldie-research.mjs >> "$LOG" 2>&1; then
-  sh scripts/notify.sh "🔴 Goldie FAILED — model catalog is going stale" \
-    "goldie-research.mjs could not produce this week's brief (OpenRouter fetch or catalog write failed). The router is now running on last week's picture. See logs/goldie.log." \
-    urgent "rotating_light" || true
+# Existing Goldie launchd label/calendar stays unchanged. Run installed, guarded native cycle;
+# policy promotion is a separate evidence-qualified boundary. No legacy model/API proposer.
+set -eu
+CYCLE="$HOME/.claude/model-router/bin/model-weekly-cycle.mjs"
+NODE_BINARY="${RUVNET_NODE_BINARY:-/opt/homebrew/opt/node@24/bin/node}"
+if [ ! -f "$CYCLE" ] || [ ! -x "$NODE_BINARY" ]; then
+  echo 'Weekly model cycle is not installed; prior policy retained.' >&2
   exit 1
 fi
-
-# ── Layer 2: judgment (best-effort, never blocks; appends to the brief) ──
-JUDGMENT="skipped"
-if [ "${GOLDIE_SKIP_JUDGMENT:-0}" != "1" ] && command -v claude >/dev/null 2>&1; then
-  PROMPT="You are Goldie, the weekly model-landscape researcher for a prompt->model router.
-Read $BRIEF (this week's deterministic data) and ~/.claude/model-router/catalog.json (the candidate
-catalog) and ~/.claude/model-router/policy.default.mjs (the current placeholder policy). Then use web
-search on the current public evaluations (Artificial Analysis, LMArena, SWE-bench and similar) to
-answer the brief's three standing questions with sources and dates:
-(1) how many BUCKETS should prompts be classified into and what are they;
-(2) the best model per bucket right now on capability-per-cost-per-speed, split into: covered by a
-Claude Max subscription (claude-code harness), covered by a ChatGPT/Codex subscription (codex
-harness), and cheapest-capable OpenRouter API model;
-(3) whether any radar model in the brief deserves wiring up, and what that requires.
-Rules: cite sources with dates for every claim; distinguish MEASURED numbers from vendor claims;
-recommendations are PROPOSALS for catalog.json/policy.mjs — do not edit any file. End with a
-'## Proposed policy changes' section in plain, reviewable prose.
-Write your full answer to stdout as markdown."
-  # env -u ANTHROPIC_API_KEY: a stray/stale API key in the environment makes headless claude bill
-  # (or fail on) the API instead of riding the Claude Max login — the exact "spend where the
-  # subscription is free" mistake this system exists to kill. Found live 2026-07-12: an invalid
-  # inherited key failed the whole judgment layer with "Invalid API key". Subscription, always.
-  if OUT=$(timeout 900 env -u ANTHROPIC_API_KEY claude -p "$PROMPT" --model sonnet --allowed-tools "WebSearch,WebFetch,Read" 2>>"$LOG"); then
-    { echo ""; echo "---"; echo ""; echo "# Judgment layer (headless Claude, $(date -u +%FT%TZ))"; echo ""; echo "$OUT"; } >> "$BRIEF"
-    JUDGMENT="ok"
-  else
-    JUDGMENT="FAILED (see logs/goldie.log)"
-    { echo ""; echo "---"; echo ""; echo "# Judgment layer: FAILED this week ($(date -u +%FT%TZ)) — deterministic data above still fresh."; } >> "$BRIEF"
-  fi
-fi
-
-# ── Exactly one summary push per run — success included (silence is never a signal) ──
-HEADLINES=$(grep -E "PRICE DRIFT|NOT FOUND" "$BRIEF" | head -3)
-sh scripts/notify.sh "🧭 Goldie ran — model catalog refreshed" \
-  "Weekly brief: $BRIEF. Judgment layer: $JUDGMENT.${HEADLINES:+ ATTENTION: $HEADLINES}" \
-  default "compass" || true
-echo "===== goldie-weekly done (judgment: $JUDGMENT) =====" >> "$LOG"
-exit 0
+exec "$NODE_BINARY" "$CYCLE" --router-dir "$HOME/.claude/model-router"

package/scripts/metaharness-router.mjs

@@ -142,7 +142,13 @@ export async function route(prompt, candidates, profile, { qualityBar = 0.7, k =
   }
 
   const prices = effectivePrices(candidates, profile);
-  const router = mod.Router.fromExamples(rows, prices, { k, qualityBar });
+  const allowed = new Set(candidates.map((m) => m.id));
+  const constrainedRows = rows.map((row) => ({ ...row,
+    scores: Object.fromEntries(Object.entries(row.scores).filter(([id]) => allowed.has(id))),
+  })).filter((row) => Object.keys(row.scores).length);
+  if (constrainedRows.length < MIN_LABELS) return { routedBy: 'COLD-START',
+    reason: 'Insufficient labels for policy-eligible models', labels: constrainedRows.length };
+  const router = mod.Router.fromExamples(constrainedRows, prices, { k, qualityBar });
   const pick = router.route(await embed(prompt));
 
   return {

package/scripts/model-analyst-sandbox.mjs

@@ -0,0 +1,54 @@
+// DISTINCT-FROM: native-subscription-usage.mjs — isolated child tool-denial trust, never an inference turn.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+export const TOOL_DENIAL = { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'Weekly analyst tools are prohibited; analyse supplied evidence only.' } };
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+export function createAnalystHome(runDir) {
+  const requestedHome = path.join(runDir, 'native-home'); fs.mkdirSync(requestedHome, { mode: 0o700 }); const home = fs.realpathSync(requestedHome);
+  const source = path.join(os.homedir(), '.codex');
+  const auth = fs.realpathSync(path.join(source, 'auth.json'));
+  if (!fs.statSync(auth).isFile()) throw new Error('Canonical native OAuth file unavailable');
+  fs.symlinkSync(auth, path.join(home, 'auth.json'));
+  fs.copyFileSync(path.join(source, 'models_cache.json'), path.join(home, 'models_cache.json')); fs.chmodSync(path.join(home, 'models_cache.json'), 0o600);
+  fs.writeFileSync(path.join(home, 'config.toml'), '', { mode: 0o600 });
+  const command = `${quote(process.execPath)} ${quote(fileURLToPath(import.meta.url))} --deny`;
+  fs.writeFileSync(path.join(home, 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ matcher: '.*', hooks: [{ type: 'command', command, timeout: 5 }] }] } }), { mode: 0o600 });
+  return { home, command };
+}
+export function sameNativeConfigPath(actual, expected, platform = process.platform) {
+  if (typeof actual !== 'string' || !actual) return false;
+  const paths = platform === 'win32' ? path.win32 : path.posix;
+  const normalize = value => { const resolved = paths.resolve(value); return platform === 'win32' ? resolved.toLowerCase() : resolved; };
+  return normalize(actual) === normalize(expected);
+}
+export async function trustAnalystDenial({ home, command, env = process.env, spawnHost = spawn, timeoutMs = 8000 }) {
+  const child = spawnHost('codex', ['app-server', '--strict-config', '-c', 'features.plugins=false', '-c', 'service_tier="default"', '--listen', 'stdio://'], { cwd: home, env: { ...env, CODEX_HOME: home }, stdio: ['pipe', 'pipe', 'pipe'], shell: false });
+  let id = 0, buffer = ''; const pending = new Map(); let failure;
+  const fail = () => { failure = new Error('Private native hook metadata transport failed'); for (const p of pending.values()) p.reject(failure); pending.clear(); };
+  child.on('error', fail); child.on('exit', fail); child.stderr.on('data', () => {}); child.stdin.on('error', fail);
+  child.stdout.on('data', (chunk) => { buffer += chunk; if (buffer.length > 1048576) return fail(); let split;
+    while ((split = buffer.indexOf('\n')) >= 0) { const line = buffer.slice(0, split); buffer = buffer.slice(split + 1); let r; try { r = JSON.parse(line); } catch { continue; }
+      const p = pending.get(r.id); if (!p) continue; pending.delete(r.id); r.error ? p.reject(new Error('Private native hook metadata request rejected')) : p.resolve(r.result);
+    }
+  });
+  const request = (method, params) => new Promise((resolve, reject) => { if (failure) return reject(failure); const n = ++id; pending.set(n, { resolve, reject }); child.stdin.write(JSON.stringify({ id: n, method, params }) + '\n'); });
+  const timer = setTimeout(() => { fail(); child.kill(); }, timeoutMs);
+  const oneHook = (result) => { const entries = result?.data ?? []; const hooks = entries.flatMap((e) => e.hooks ?? []);
+    if (entries.some((e) => e.errors?.length) || hooks.length !== 1 || hooks[0].eventName !== 'preToolUse' || hooks[0].matcher !== '.*' || hooks[0].command !== command || !hooks[0].enabled || !/^sha256:[a-f0-9]{64}$/.test(hooks[0].currentHash)) throw new Error('Private deny hook is not the sole enabled hook'); return hooks[0]; };
+  try {
+    await request('initialize', { clientInfo: { name: 'weekly_analyst_sandbox', version: '1' }, capabilities: { experimentalApi: true } }); child.stdin.write('{"method":"initialized"}\n');
+    const first = oneHook(await request('hooks/list', { cwds: [home] }));
+    const config = await request('config/read', { cwd: home, includeLayers: true });
+    const layer = config.layers?.find((l) => sameNativeConfigPath(l.name?.file, path.join(home, 'config.toml')));
+    if (!layer?.version) throw new Error('Private native config version missing');
+    await request('config/batchWrite', { filePath: path.join(home, 'config.toml'), expectedVersion: layer.version, reloadUserConfig: true,
+      edits: [{ keyPath: `hooks.state.${JSON.stringify(first.key)}.trusted_hash`, value: first.currentHash, mergeStrategy: 'replace' }] });
+    const final = oneHook(await request('hooks/list', { cwds: [home] }));
+    if (final.trustStatus !== 'trusted' || final.currentHash !== first.currentHash) throw new Error('Private deny hook trust not accepted');
+    return { trusted: true, hookKey: final.key, currentHash: final.currentHash, inferenceStarted: false };
+  } finally { clearTimeout(timer); child.stdin.end(); child.kill(); }
+}
+if (process.argv.includes('--deny')) console.log(JSON.stringify(TOOL_DENIAL));

package/scripts/model-currency-evidence.mjs

@@ -0,0 +1,139 @@
+// DISTINCT-FROM: scripts/refresh-model-catalog.mjs — independent effort-specific evaluation evidence, never router authority.
+import { createHash } from 'node:crypto';
+
+export const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+export const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const finite = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+
+/** Captured AA Next Flight contract. No eval/script execution; a changed schema fails closed. */
+export function parseArtificialAnalysis(html, { url, checkedAt, identityBindings = {} } = {}) {
+  const version = html.match(/Artificial Analysis Intelligence Index v(\d+\.\d+(?:\.\d+)?)/)?.[1];
+  if (!version) throw new Error('AA Intelligence Index version is absent');
+  const rows = new Map();
+  const walk = (value) => {
+    if (Array.isArray(value)) { for (const item of value) walk(item); return; }
+    if (!value || typeof value !== 'object') return;
+    if (Array.isArray(value.intelligenceIndexEvaluations) && typeof value.id === 'string') {
+      rows.set(value.id, value); return;
+    }
+    for (const child of Object.values(value)) walk(child);
+  };
+  for (const match of html.matchAll(/self\.__next_f\.push\((.*?)\)<\/script>/gs)) {
+    try {
+      const envelope = JSON.parse(match[1]);
+      if (typeof envelope[1] !== 'string' || !envelope[1].includes('intelligenceIndexEvaluations')) continue;
+      const line = envelope[1];
+      walk(JSON.parse(line.slice(line.indexOf(':') + 1)));
+    } catch { /* unrelated or chunked flight frame; required rows checked below */ }
+  }
+  const source = { url, checkedAt, sha256: digest(html), parser: 'aa-next-flight-v1' };
+  const records = [];
+  for (const row of rows.values()) {
+    const effortLabel = typeof row.suffix === 'string' ? row.suffix : row.name?.match(/\((Low|Medium|High|Xhigh|Max|Minimal|None)(?:,|\))/i)?.[1];
+    const effort = effortLabel?.split(',')[0]?.trim().toLowerCase();
+    if (!['low', 'medium', 'high', 'xhigh', 'max', 'minimal', 'none'].includes(effort)) continue;
+    if (!row.release?.slug || !finite(row.intelligenceIndex) || row.intelligenceIndexIsEstimated !== false) continue;
+    const benchmarks = row.intelligenceIndexEvaluations.filter((b) => typeof b.slug === 'string'
+      && Number.isFinite(b.score) && finite(b.costPerTask) && finite(b.timePerTask))
+      .map((b) => ({ suite: b.slug, score: b.score, costUsd: b.costPerTask, timeSeconds: b.timePerTask }));
+    const binding = identityBindings[row.release.slug];
+    if (binding && (typeof binding.model !== 'string' || !binding.evidence || !binding.checkedAt)) {
+      throw new Error(`Invalid native identity binding: ${row.release.slug}`);
+    }
+    records.push({
+      sourceModelId: row.id, sourceReleaseSlug: row.release.slug, sourceName: row.name,
+      model: binding?.model ?? null, identityEvidence: binding ?? null, effort,
+      benchmark: { suite: 'artificial-analysis-intelligence-index', version },
+      quality: { intelligenceIndex: row.intelligenceIndex, estimated: false }, benchmarks,
+      costPerTaskUsd: finite(row.intelligenceIndexCostPerTask?.cost?.total) ? row.intelligenceIndexCostPerTask.cost.total : null,
+      timePerTaskSeconds: finite(row.intelligenceIndexTimePerTask) ? row.intelligenceIndexTimePerTask : null,
+      speedTokensPerSecond: finite(row.outputSpeedVariance?.median ?? row.medianOutputSpeed) ? (row.outputSpeedVariance?.median ?? row.medianOutputSpeed) : null,
+      inputUsdPerMillion: finite(row.price1mInputTokens) ? row.price1mInputTokens : null,
+      outputUsdPerMillion: finite(row.price1mOutputTokens) ? row.price1mOutputTokens : null,
+      source,
+    });
+  }
+  if (records.length === 0 || !records.some((r) => r.benchmarks.length > 0 && r.costPerTaskUsd !== null && r.timePerTaskSeconds !== null)) {
+    throw new Error('AA effort benchmark matrix absent or incomplete');
+  }
+  return { source, records };
+}
+
+export function parseInventory(body, source) {
+  const data = JSON.parse(body).data;
+  if (!Array.isArray(data) || data.length < 50) throw new Error('OpenRouter inventory is suspiciously thin');
+  const models = data.map((row) => {
+    const input = Number(row.pricing?.prompt); const output = Number(row.pricing?.completion);
+    if (typeof row.id !== 'string' || !row.id || !Number.isFinite(input) || !Number.isFinite(output)) throw new Error('Invalid OpenRouter model/pricing');
+    return { id: row.id, pricing: { inputUsdPerMillion: finite(input) ? input * 1e6 : null, outputUsdPerMillion: finite(output) ? output * 1e6 : null },
+      supportedParameters: Array.isArray(row.supported_parameters) ? row.supported_parameters.filter((p) => typeof p === 'string') : [] };
+  });
+  return { checkedAt: source.checkedAt, source, models, discoveryOnly: true };
+}
+
+/** No benchmark row can certify native access, supported effort, or default-selection eligibility. */
+export function currencyStatus(record, now = Date.now()) {
+  const fresh = (section) => {
+    const checked = Date.parse(section?.checkedAt);
+    return Number.isFinite(checked) && checked <= now && now - checked < WEEK_MS;
+  };
+  const inventoryFresh = record?.schemaVersion === 1 && fresh(record.inventory)
+    && record.inventory.discoveryOnly === true && record.inventory.models?.length >= 50;
+  const evaluationsFresh = record?.schemaVersion === 1 && fresh(record.evaluations)
+    && record.evaluations.sources?.length > 0 && record.evaluations.records?.length > 0
+    && record.evaluations.sources.every((source) => fresh(source) && /^[a-f0-9]{64}$/.test(source.sha256 ?? ''));
+  const failed = !!record?.lastAttempt && record.lastAttempt.status !== 'complete';
+  return { status: inventoryFresh && evaluationsFresh && !failed ? 'current' : 'stale', inventoryFresh: !!inventoryFresh,
+    evaluationsFresh: !!evaluationsFresh, selectionQualified: false, maxAgeMs: WEEK_MS,
+    errors: record?.lastAttempt?.errors ?? [], assessment: record?.assessment ?? null, reason: failed ? 'last refresh incomplete' : inventoryFresh && evaluationsFresh ? 'fresh independent evidence' : 'weekly evidence required' };
+}
+
+/** Coding-agent workloads are a separate suite and harness/configuration, never model-index aliases. */
+export function parseCodingAgentEvidence(html, methodology, { url, checkedAt, identityBindings = {} } = {}) {
+  const version = methodology.match(/Coding Agent Index v(\d+\.\d+(?:\.\d+)?)/)?.[1];
+  if (!version) throw new Error('Coding Agent Index methodology version absent');
+  const rows = new Map();
+  const walk = (value) => {
+    if (Array.isArray(value)) { for (const child of value) walk(child); return; }
+    if (!value || typeof value !== 'object') return;
+    if (typeof value.hostModelSlug === 'string' && typeof value.id === 'string' && value.indexScore !== undefined) { rows.set(value.id, value); return; }
+    for (const child of Object.values(value)) walk(child);
+  };
+  for (const match of html.matchAll(/self\.__next_f\.push\((.*?)\)<\/script>/gs)) {
+    try {
+      const envelope = JSON.parse(match[1]);
+      if (typeof envelope[1] !== 'string') continue;
+      for (const line of envelope[1].split('\n')) {
+        if (!line.includes('hostModelSlug')) continue;
+        try { walk(JSON.parse(line.slice(line.indexOf(':') + 1))); } catch { /* unrelated frame */ }
+      }
+    } catch { /* required contract checked below */ }
+  }
+  const source = { url, checkedAt, sha256: digest(html), parser: 'aa-coding-agents-flight-v1' };
+  const records = [];
+  for (const row of rows.values()) {
+    if (!finite(row.indexScore) || row.indexScore > 1 || !finite(row.mean?.costUsd) || !finite(row.mean?.agentWallTimeSec)
+      || !row.display?.model || !Array.isArray(row.evals) || row.evals.length !== row.indexComponentCount || !row.versions
+      || row.evals.some((e) => !e.datasetIndexName || !finite(e.mean?.reward))) {
+      throw new Error(`Incomplete coding-agent record: ${row.id}`);
+    }
+    const nativeHost = row.agentName === 'Codex' && row.provider === 'openai' ? 'codex'
+      : row.agentName === 'Claude Code' && row.provider === 'anthropic' ? 'claude-code' : null;
+    const binding = nativeHost ? identityBindings[row.modelRelease?.slug] : null;
+    if (binding && (!binding.model || !binding.evidence || !binding.checkedAt)) throw new Error('Invalid coding-agent native identity binding');
+    const effort = nativeHost ? row.display.model.match(/\((low|medium|high|xhigh|max|minimal|none)\)/i)?.[1]?.toLowerCase() ?? null : null;
+    records.push({ sourceId: row.id, harness: row.agentName, provider: row.provider, nativeHost,
+      sourceModelSlug: row.hostModelSlug, sourceReleaseSlug: row.modelRelease?.slug ?? null,
+      displayModel: row.display.model, configurationLabel: row.displayLabel, effort,
+      model: binding?.model ?? null, identityEvidence: binding ?? null,
+      fallback: /fallback/i.test(row.displayLabel ?? row.display.model),
+      benchmark: { suite: 'artificial-analysis-coding-agent-index', version }, codingAgentIndexFraction: row.indexScore,
+      apiBenchmarkCostPerTaskUsd: row.mean.costUsd, timePerTaskSeconds: row.mean.agentWallTimeSec,
+      versions: row.versions, components: row.evals.map((e) => ({ suite: e.datasetIndexName,
+        dataset: e.refDatasetName, score: e.mean.reward, mean: e.mean })), source,
+      selectionQualified: false });
+  }
+  if (!records.length) throw new Error('Coding-agent structured records absent');
+  return { source, records, coverage: { scope: 'public serialized agent/configuration records; native entitlements unverified',
+    recordCount: records.length, renderedChartSelectionVerified: false }, selectionQualified: false };
+}

package/scripts/model-currency.mjs

@@ -0,0 +1,230 @@
+#!/usr/bin/env node
+// DISTINCT-FROM: scripts/model-router-catalog.mjs — per-user evidence currency, never candidate/default mutation.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { buildWeeklyAssessment } from './model-weekly-assessment.mjs';
+import { fileURLToPath } from 'node:url';
+import { WEEK_MS, digest, parseInventory, parseArtificialAnalysis, parseCodingAgentEvidence, currencyStatus } from './model-currency-evidence.mjs';
+
+export const DEFAULT_ROUTER_DIR = path.join(os.homedir(), '.claude', 'model-router');
+export const AA_URLS = [
+  'https://artificialanalysis.ai/models/comparisons',
+  'https://artificialanalysis.ai/models/comparisons/claude-fable-5-1-medium-vs-claude-opus-5-medium',
+  'https://artificialanalysis.ai/models/releases/comparisons/gpt-6-1-sol-vs-claude-sonnet-5-5',
+  'https://artificialanalysis.ai/models/releases/comparisons/gpt-6-luna-vs-gpt-6-astra',
+  'https://artificialanalysis.ai/models/releases/comparisons/claude-opus-5-5-vs-gpt-6-astra',
+];
+export const OFFICIAL_SOURCES = [
+  { provider: 'openai', url: 'https://developers.openai.com/api/docs/models' },
+  { provider: 'anthropic', url: 'https://platform.claude.com/docs/en/models/overview' },
+];
+export const AGENT_SOURCE_URLS = [
+  'https://artificialanalysis.ai/agents/coding-agents',
+  'https://artificialanalysis.ai/methodology/coding-agents-benchmarking',
+];
+export const CODING_BENCHMARK_SOURCES = [
+  { suite: 'vulcanbench', url: 'https://vulcanbench.com/' },
+  { suite: 'vulcanbench-swe-v4', url: 'https://vulcanbench.com/benchmarks/swe-v4-gpt61-sol-v318.html' },
+  { suite: 'terminal-bench', url: 'https://www.tbench.ai/' },
+  { suite: 'swe-bench', url: 'https://www.swebench.com/' },
+];
+const INVENTORY_URL = 'https://openrouter.ai/api/v1/models';
+const LOCK_MS = 10 * 60 * 1000;
+const RETRY_MS = 60 * 60 * 1000;
+const SELF = fileURLToPath(import.meta.url);
+function readRecord(routerDir) {
+  try {
+    const target = path.join(routerDir, 'currency.json');
+    if (fs.statSync(target).size > 8 * 1024 * 1024) return null;
+    return JSON.parse(fs.readFileSync(target, 'utf8'));
+  } catch { return null; }
+}
+export function readCurrencyStatus({ routerDir = DEFAULT_ROUTER_DIR, now = Date.now() } = {}) {
+  return currencyStatus(readRecord(routerDir), now);
+}
+function atomicWrite(target, bytes, beforeCommit = () => {}) {
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    const fd = fs.openSync(tmp, 'wx', 0o600);
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    beforeCommit();
+    fs.renameSync(tmp, target);
+  } finally { try { fs.unlinkSync(tmp); } catch { /* renamed */ } }
+}
+// This guard is held only for synchronous filesystem transactions, never during fetches.
+// Never reap it: a crash inside this tiny transaction must fail closed rather than overlap writers.
+function transaction(routerDir, operation) {
+  fs.mkdirSync(routerDir, { recursive: true, mode: 0o700 });
+  const guard = path.join(routerDir, 'currency-mutation.lock');
+  try { fs.mkdirSync(guard, { mode: 0o700 }); } catch (error) { if (error.code === 'EEXIST') return null; throw error; }
+  try { return operation(); } finally { fs.rmdirSync(guard); }
+}
+function ownerPath(routerDir) { return path.join(routerDir, 'currency-refresh-owner.json'); }
+function readOwner(routerDir) {
+  try { return JSON.parse(fs.readFileSync(ownerPath(routerDir), 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+function claim(routerDir, now) {
+  return transaction(routerDir, () => {
+    const owner = readOwner(routerDir);
+    if (owner && (!Number.isFinite(owner.claimedAt) || now - owner.claimedAt <= LOCK_MS)) return null;
+    const next = { token: randomUUID(), claimedAt: now };
+    atomicWrite(ownerPath(routerDir), JSON.stringify(next));
+    return next.token;
+  });
+}
+function release(routerDir, token) {
+  return transaction(routerDir, () => {
+    if (readOwner(routerDir)?.token !== token) return false;
+    fs.unlinkSync(ownerPath(routerDir)); return true;
+  });
+}
+function fencedWrite(routerDir, token, target, bytes) {
+  const written = transaction(routerDir, () => {
+    if (readOwner(routerDir)?.token !== token) throw new Error('refresh superseded: ownership token changed');
+    atomicWrite(target, bytes, () => {
+      if (readOwner(routerDir)?.token !== token) throw new Error('refresh superseded before commit');
+    }); return true;
+  });
+  if (!written) throw new Error('refresh transaction busy; no write committed');
+}
+
+/** Prompt path: local bounded read and one detached worker; never await a network request. */
+export function maybeLaunchCurrencyRefresh({ routerDir = DEFAULT_ROUTER_DIR, now = Date.now(), launch = spawn } = {}) {
+  const record = readRecord(routerDir); const status = currencyStatus(record, now);
+  if (status.status === 'current') return { ...status, launched: false };
+  const attempted = Date.parse(record?.lastAttempt?.checkedAt);
+  if (Number.isFinite(attempted) && attempted <= now && now - attempted < RETRY_MS) return { ...status, launched: false, deferred: 'retry cooldown' };
+  const lock = claim(routerDir, now);
+  if (!lock) return { ...status, launched: false, deferred: fs.existsSync(path.join(routerDir, 'currency-mutation.lock'))
+    ? 'refresh transaction blocked; inspect mutation guard before recovery' : 'refresh already running' };
+  try {
+    const child = launch(process.execPath, [SELF, '--refresh', '--claim-token', lock, '--router-dir', routerDir], { detached: true, stdio: 'ignore' });
+    child.once?.('error', () => release(routerDir, lock));
+    child.unref();
+    return { ...status, launched: true };
+  } catch (error) { release(routerDir, lock); return { ...status, launched: false, errors: [error.message] }; }
+}
+
+export async function refreshModelCurrency({ routerDir = DEFAULT_ROUTER_DIR, now = Date.now(), fetchImpl = fetch,
+  identityBindings, aaUrls = AA_URLS, officialSources = OFFICIAL_SOURCES, agentSourceUrls = AGENT_SOURCE_URLS, codingBenchmarkSources = CODING_BENCHMARK_SOURCES, claimToken = null } = {}) {
+  const lock = claimToken ?? claim(routerDir, now);
+  if (!lock) return { action: 'busy', status: 'stale', reason: 'refresh ownership or transaction guard unavailable' };
+  try {
+    const prior = readRecord(routerDir) ?? { schemaVersion: 1 };
+    const checkedAt = new Date(now).toISOString(); const errors = [];
+    let bindings = identityBindings;
+    if (!bindings) {
+      try { bindings = JSON.parse(fs.readFileSync(path.join(routerDir, 'identity-bindings.json'), 'utf8')); }
+      catch { bindings = {}; }
+    }
+    const collect = async (url) => {
+      const response = await fetchImpl(url, { signal: AbortSignal.timeout(20_000) });
+      if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      const bytes = await response.text();
+      if (bytes.length > 6 * 1024 * 1024) throw new Error('source exceeds 6 MiB limit');
+      const source = { url, checkedAt, sha256: digest(bytes) };
+      fencedWrite(routerDir, lock, path.join(routerDir, 'evidence', `${source.sha256}.${url === INVENTORY_URL ? 'json' : 'html'}`), bytes);
+      return { source, bytes };
+    };
+    const results = await Promise.allSettled([INVENTORY_URL, ...aaUrls, ...officialSources.map((s) => s.url), ...agentSourceUrls, ...codingBenchmarkSources.map((s) => s.url)].map(collect));
+    let inventory = prior.inventory; let evaluations = prior.evaluations;
+    if (results[0].status === 'fulfilled') {
+      try { inventory = parseInventory(results[0].value.bytes, results[0].value.source); }
+      catch (error) { errors.push(`inventory: ${error.message}`); }
+    } else errors.push(`inventory: ${results[0].reason.message}`);
+    const parsed = [];
+    for (let i = 1; i <= aaUrls.length; i++) {
+      const result = results[i];
+      try {
+        if (result.status !== 'fulfilled') throw result.reason;
+        parsed.push(parseArtificialAnalysis(result.value.bytes, { ...result.value.source, identityBindings: bindings }));
+      } catch (error) { errors.push(`evaluations ${aaUrls[i - 1]}: ${error.message}`); }
+    }
+    // All requested pages must parse before certifying a new matrix; partial pages are evidence only.
+    if (parsed.length === aaUrls.length && parsed.length > 0) {
+      const records = new Map();
+      for (const page of parsed) for (const record of page.records) records.set(record.sourceModelId, record);
+      evaluations = { checkedAt, sources: parsed.map((p) => p.source), records: [...records.values()],
+        selectionQualified: false, limitation: 'Independent benchmark evidence; native access and supported effort require separate verification. Arena is not collected.' };
+    }
+    let official = prior.officialSources;
+    const publicDocs = [];
+    for (let i = 0; i < officialSources.length; i++) {
+      const result = results[1 + aaUrls.length + i];
+      if (result.status === 'fulfilled') publicDocs.push({ ...result.value.source, provider: officialSources[i].provider,
+        scope: 'official public/API documentation; not native subscription access', semanticallyQualified: false });
+      else errors.push(`official ${officialSources[i].url}: ${result.reason.message}`);
+    }
+    if (publicDocs.length === officialSources.length) official = { checkedAt, sources: publicDocs };
+    let agents = prior.agentSources;
+    if (agentSourceUrls.length) {
+      const agentResults = results.slice(1 + aaUrls.length + officialSources.length, 1 + aaUrls.length + officialSources.length + agentSourceUrls.length);
+      try {
+        if (agentResults.length !== 2) throw new Error('coding-agent source and methodology pair required');
+        for (const result of agentResults) if (result.status !== 'fulfilled') throw result.reason;
+        const parsedAgents = parseCodingAgentEvidence(agentResults[0].value.bytes, agentResults[1].value.bytes,
+          { ...agentResults[0].value.source, identityBindings: bindings });
+        agents = { checkedAt, sources: agentResults.map((r) => r.value.source), ...parsedAgents };
+      } catch (error) { errors.push(`coding agents: ${error.message}`); }
+    }
+    const additional = [];
+    for (let i = 0; i < codingBenchmarkSources.length; i++) {
+      const result = results[1 + aaUrls.length + officialSources.length + agentSourceUrls.length + i];
+      if (result.status === 'fulfilled' && result.value.bytes.trim().length >= 100) {
+        additional.push({ ...result.value.source, suite: codingBenchmarkSources[i].suite,
+          scope: 'raw source archive; independent suite, score parsing and semantic qualification not implemented' });
+      } else errors.push(`coding benchmark ${codingBenchmarkSources[i].url}: ${result.status === 'rejected' ? result.reason.message : 'empty or truncated source'}`);
+    }
+    if (additional.length === codingBenchmarkSources.length && agents && agents !== prior.agentSources) agents = { ...agents, additionalSources: additional };
+    else if (additional.length !== codingBenchmarkSources.length) agents = prior.agentSources;
+    const instructionPath = path.join(routerDir, 'weekly-analyst-instruction.md');
+    let instruction; let instructionSource = 'packaged-fallback';
+    try {
+      const fd = fs.openSync(instructionPath, 'r');
+      try {
+        const buffer = Buffer.alloc(128 * 1024 + 1);
+        const size = fs.readSync(fd, buffer, 0, buffer.length, 0);
+        if (size > 128 * 1024) throw new Error('effective weekly instruction exceeds 128 KiB');
+        instruction = buffer.subarray(0, size).toString('utf8');
+        if (!instruction.trim()) throw new Error('effective weekly instruction is empty');
+        instructionSource = 'effective-per-user-file';
+      } finally { fs.closeSync(fd); }
+    } catch (error) {
+      if (error.code !== 'ENOENT') { errors.push(`instruction: ${error.message}`); instruction = undefined; instructionSource = 'fallback-after-read-error'; }
+    }
+    const next = { schemaVersion: 1, maxAgeMs: WEEK_MS, inventory, evaluations, officialSources: official, agentSources: agents,
+      lastAttempt: { checkedAt, status: errors.length ? (inventory === prior.inventory && evaluations === prior.evaluations ? 'failed' : 'partial') : 'complete', errors } };
+    let priorPolicyBytes = null; let policy = null;
+    try { priorPolicyBytes = fs.readFileSync(path.join(routerDir, 'routing-policy.json'), 'utf8'); policy = JSON.parse(priorPolicyBytes); }
+    catch { /* no policy: report missing allocation, never synthesize one */ }
+    const assessment = buildWeeklyAssessment({ currency: next, policy, priorPolicyBytes, now, previousAssessment: prior.assessment, instruction, instructionSource });
+    const assessmentDir = path.join(routerDir, 'assessments', `${checkedAt.replaceAll(':', '-')}-${lock}`);
+    for (const [name, bytes] of [['report.json', JSON.stringify(assessment.report, null, 2)],
+      ['proposal.json', JSON.stringify(assessment.proposal, null, 2)], ['report.md', assessment.markdown],
+      ['instruction.md', assessment.instruction], ['prior-policy.json', priorPolicyBytes ?? 'null']]) {
+      fencedWrite(routerDir, lock, path.join(assessmentDir, name), bytes);
+    }
+    if (!fs.existsSync(instructionPath)) fencedWrite(routerDir, lock, instructionPath, assessment.instruction);
+    next.assessment = { instructionPath, instructionSha256: assessment.report.instructionSha256, instructionSource, checkedAt, signature: assessment.report.signature, reportPath: path.join(assessmentDir, 'report.json'),
+      proposalPath: path.join(assessmentDir, 'proposal.json'), status: 'complete-unqualified', analystExecuted: false,
+      notification: assessment.report.notification };
+    fencedWrite(routerDir, lock, path.join(routerDir, 'currency.json'), `${JSON.stringify(next, null, 2)}\n`);
+    return { action: 'refreshed', ...currencyStatus(next, now), lastAttempt: next.lastAttempt };
+  } finally { release(routerDir, lock); }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === SELF) {
+  const dirIndex = process.argv.indexOf('--router-dir');
+  const routerDir = dirIndex >= 0 ? process.argv[dirIndex + 1] : DEFAULT_ROUTER_DIR;
+  if (!routerDir || !path.isAbsolute(routerDir)) throw new Error('--router-dir must be absolute');
+  if (process.argv.includes('--refresh')) {
+    refreshModelCurrency({ routerDir, claimToken: process.argv.includes('--claim-token') ? process.argv[process.argv.indexOf('--claim-token') + 1] : null }).then((result) => {
+      console.log(JSON.stringify(result)); if (result.status === 'stale') process.exitCode = 1;
+    }).catch((error) => { console.error(error.message); process.exitCode = 1; });
+  } else console.log(JSON.stringify(process.argv.includes('--catch-up') ? maybeLaunchCurrencyRefresh({ routerDir }) : readCurrencyStatus({ routerDir })));
+}