ruvnet-brain 4.5.4 → 4.5.6

package/scripts/claude-terminal-mod.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// Materialize the sandboxed native mod and bridge it to the existing reviewed policy engine.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { classify } from '../config/model-router/policy.default.mjs';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const MOD_SOURCE = path.join(ROOT, 'config/model-router/claude-terminal-mod');
+export function terminalModDigest(pluginRoot) {
+  const hash = crypto.createHash('sha256');
+  for (const relative of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js', 'hooks/policy.default.mjs', 'hooks/runtime.js']) {
+    hash.update(relative); hash.update('\0'); hash.update(fs.readFileSync(path.join(pluginRoot, relative))); hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+export function prepareClaudeTerminalMod({ destination, nodePath = process.execPath,
+  helperPath = fileURLToPath(import.meta.url), enginePath = path.join(ROOT, 'scripts/model-router-engine.mjs') } = {}) {
+  if (!destination || !path.isAbsolute(destination)) throw new Error('Absolute mod destination required');
+  for (const file of [nodePath, helperPath, enginePath]) if (!path.isAbsolute(file) || !fs.existsSync(file)) throw new Error('Native mod dependency unavailable');
+  fs.mkdirSync(destination, { recursive: true, mode: 0o700 });
+  for (const part of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js']) {
+    const dest = path.join(destination, part);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(path.join(MOD_SOURCE, part), dest);
+  }
+  const policyPath = path.join(destination, 'hooks/policy.default.mjs');
+  fs.copyFileSync(path.join(ROOT, 'config/model-router/policy.default.mjs'), policyPath);
+  fs.writeFileSync(path.join(destination, 'hooks/runtime.js'), `export default ${JSON.stringify({ nodePath, helperPath, enginePath, policyPath })};\n`, { mode: 0o600 });
+  return { pluginDir: destination, policyPath, modDigest: terminalModDigest(destination) };
+}
+export function validateDecision(decision, now = Date.now()) {
+  const age = now - Date.parse(decision?.selectionReviewedAt);
+  const maxAge = decision?.selectionMaxAgeMs;
+  if (decision?.harness !== 'claude-code' || decision.provider !== 'anthropic' || decision.subscriptionCovered !== true ||
+      !/^claude-[a-z0-9][a-z0-9.-]*$/.test(decision.model || '') || !['fast', 'medium', 'hard'].includes(decision.taskClass) ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(decision.effort) ||
+      !Number.isSafeInteger(maxAge) || maxAge <= 0 || maxAge > 604800000 || !Number.isFinite(age) || age < 0 ||
+      !/^[a-f0-9]{64}$/.test(decision.selectionRouteDigest || '')) throw new Error('Native terminal routing decision invalid; no fallback');
+  return decision;
+}
+export function routeNativePrompt({ prompt, turnId, minimumClass, enginePath = path.join(ROOT, 'scripts/model-router-engine.mjs'),
+  policyPath = path.join(ROOT, 'config/model-router/policy.default.mjs'), env = process.env } = {}) {
+  if (typeof prompt !== 'string' || !prompt.trim() || prompt.length > 200000) throw new Error('Native routing requires a bounded text prompt');
+  if (minimumClass !== undefined && !['fast', 'medium', 'hard'].includes(minimumClass)) throw new Error('Invalid class floor');
+  const codeFences = Math.floor((prompt.match(/```/g) || []).length / 2);
+  const hasCode = codeFences > 0 || /\b(function|const|let|def|class|import|=>|SELECT|async)\b/.test(prompt) || /[{};]\s*$/m.test(prompt);
+  const rank = { fast: 0, medium: 1, hard: 2 };
+  const canonicalFloor = classify({ taskHints: prompt, hasCode }, 'claude-code');
+  const floor = rank[minimumClass] > rank[canonicalFloor] ? minimumClass : canonicalFloor;
+  const classificationPrompt = floor === 'hard' ? 'final substantive review\n' + prompt : prompt;
+  // Let the engine honor the user's policy.mjs; the bundled copy is only the
+  // deterministic classification floor used by the sandboxed hook.
+  const result = spawnSync(process.execPath, [enginePath, '--harness', 'claude-code', '--request-json', '--policy-only', '--json'],
+    { input: JSON.stringify({ prompt: classificationPrompt }), encoding: 'utf8', env, timeout: 8000, maxBuffer: 262144 });
+  if (result.error || result.status !== 0) throw new Error('Reviewed native routing policy unavailable; no fallback');
+  const d = validateDecision(JSON.parse(result.stdout));
+  if (rank[d.taskClass] < rank[floor]) throw new Error('Reviewed native routing policy below canonical floor; no fallback');
+  // No prompt, reasoning, credentials, or arbitrary engine output crosses back to the sandbox.
+  return { schemaVersion: 1, turnId: typeof turnId === 'string' ? turnId : null, model: d.model, effort: d.effort,
+    taskClass: d.taskClass, expiresAt: Date.parse(d.selectionReviewedAt) + d.selectionMaxAgeMs,
+    subscriptionCovered: true, routeDigest: d.selectionRouteDigest };
+}
+export function writeReadinessReceipt({ nonce, receiptPath, pluginRoot, version, sessionId, status = 'ready' } = {}) {
+  if (!/^[a-f0-9]{64}$/.test(nonce || '') || !path.isAbsolute(receiptPath || '') ||
+      !path.isAbsolute(pluginRoot || '') || (!/^2\.1\.\d+$/.test(version || '') || Number(version.split('.')[2]) < 287) || typeof sessionId !== 'string' ||
+      !['ready', 'health'].includes(status)) throw new Error('Invalid native mod readiness request');
+  const receipt = { schemaVersion: 1, nonce, pluginRoot: fs.realpathSync(pluginRoot), nativeVersion: version,
+    sessionId, status, modDigest: terminalModDigest(pluginRoot), observedAt: new Date().toISOString(), pid: process.ppid,
+    scope: 'hook activation only; native load failure or worker crash can skip hooks' };
+  const parent = path.dirname(receiptPath);
+  if (!fs.existsSync(parent)) throw new Error('Readiness directory must be prepared by launcher');
+  const temporary = path.join(parent, `.rnb-ready-${crypto.randomBytes(16).toString('hex')}`);
+  fs.writeFileSync(temporary, JSON.stringify(receipt), { mode: 0o600, flag: 'wx' });
+  fs.renameSync(temporary, receiptPath);
+  return receipt;
+}
+async function main() {
+  const mode = process.argv[2];
+  const request = JSON.parse(fs.readFileSync(0, 'utf8'));
+  if (mode === '--decision') process.stdout.write(JSON.stringify(routeNativePrompt(request)) + '\n');
+  else if (mode === '--ready' || mode === '--health') process.stdout.write(JSON.stringify(writeReadinessReceipt({ ...request, status: mode === '--ready' ? 'ready' : 'health' })) + '\n');
+  else if (mode === '--prepare') process.stdout.write(JSON.stringify(prepareClaudeTerminalMod(request)) + '\n');
+  else throw new Error('Expected --prepare, --decision, --ready, or --health');
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main().catch(() => {
+  process.stderr.write('claude-terminal-mod: routing or activation unavailable; no fallback\n'); process.exitCode = 1;
+});

package/scripts/codex-hook-trust-reconcile.mjs

@@ -0,0 +1,247 @@
+// Metadata-only repair. releaseIdentity is an independently verified release input owned by the
+// installer, NOT a hash/boolean synthesized from the installed file. No artifact discovery/inference.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { spawn, spawnSync } from 'node:child_process';
+import { codexHookIdentities } from './codex-hook-trust.mjs';
+
+/** Authenticate exact published package bytes before reading one archive member. No extraction/install. */
+export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetcher = globalThis.fetch,
+  timeoutMs = 10000, maxTarballBytes = 32 * 1024 * 1024, tarBinary = '/usr/bin/tar' } = {}) {
+  if (!/^\d+\.\d+\.\d+$/.test(version || '') || typeof fetcher !== 'function') return blocked('Exact released version and HTTPS fetch required');
+  const deadline = Date.now() + timeoutMs;
+  const get = async (url, limit) => {
+    const remaining = deadline - Date.now(); if (remaining <= 0) throw new Error('Published artifact fetch deadline exceeded');
+    const response = await fetcher(url, { redirect: 'error', signal: AbortSignal.timeout(remaining) });
+    if (!response.ok || !response.body) throw new Error('Published artifact HTTPS fetch failed');
+    if (Number(response.headers.get('content-length')) > limit) throw new Error('Published artifact exceeds size bound');
+    const reader = response.body.getReader(); const chunks = []; let length = 0;
+    try {
+      while (true) {
+        if (Date.now() >= deadline) throw new Error('Published artifact fetch deadline exceeded');
+        const { done, value } = await reader.read(); if (done) break;
+        length += value.byteLength; if (length > limit) throw new Error('Published artifact exceeds size bound');
+        chunks.push(Buffer.from(value));
+      }
+    } finally { await reader.cancel().catch(() => {}); }
+    return Buffer.concat(chunks);
+  };
+  try {
+    const metadataUrl = `https://registry.npmjs.org/ruvnet-brain/${version}`;
+    const metadata = JSON.parse((await get(metadataUrl, 2 * 1024 * 1024)).toString('utf8'));
+    const tarballUrl = `https://registry.npmjs.org/ruvnet-brain/-/ruvnet-brain-${version}.tgz`;
+    if (metadata.name !== 'ruvnet-brain' || metadata.version !== version || metadata.dist?.tarball !== tarballUrl
+      || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(metadata.dist?.integrity || '')) throw new Error('Published version/path/integrity mismatch');
+    const archive = await get(tarballUrl, maxTarballBytes);
+    const integrity = `sha512-${crypto.createHash('sha512').update(archive).digest('base64')}`;
+    if (integrity !== metadata.dist.integrity) throw new Error('Published archive integrity mismatch');
+    const remaining = deadline - Date.now(); if (remaining <= 0) throw new Error('Published artifact deadline exceeded');
+    // stdout-only exact member: no archive paths are ever written to disk or traversed.
+    const result = spawnSync(tarBinary, ['-xzOf', '-', 'package/plugin/hooks/codex-hooks.json'],
+      { input: archive, timeout: Math.min(remaining, 3000), maxBuffer: 256 * 1024 });
+    if (result.error || result.status !== 0 || !result.stdout?.length) throw new Error('Platform tar cannot read exact published hooks entry');
+    if (!codexHookIdentities(JSON.parse(result.stdout)).size) throw new Error('Published native hooks are invalid');
+    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout) },
+      metadataUrl, tarballUrl, archiveBytes: archive.length };
+  } catch (error) { return blocked(error.message); }
+}
+
+const activeMetadataChildren = new Map();
+async function shutdownMetadataChild(child) {
+  const entry = activeMetadataChildren.get(child); if (!entry) return;
+  if (entry.closing) return entry.closing;
+  entry.closing = (async () => {
+    const wait = async () => {
+      let timer;
+      try { await Promise.race([entry.exited, new Promise((resolve) => { timer = setTimeout(resolve, 350); })]); }
+      finally { clearTimeout(timer); }
+    };
+    if (child.pid && child.exitCode === null && child.signalCode === null) {
+      child.kill('SIGTERM'); await wait();
+      if (child.exitCode === null && child.signalCode === null) { child.kill('SIGKILL'); await wait(); }
+    }
+    if (child.pid && child.exitCode === null && child.signalCode === null) throw new Error('Native metadata child exit unverified');
+    activeMetadataChildren.delete(child);
+  })();
+  return entry.closing;
+}
+
+const OWNER = 'ruvnet-brain@ruvnet-brain';
+const digest = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const blocked = (reason) => ({ state: 'blocked', changed: false, reason });
+function privateBackup(configPath, bytes, backupDir) {
+  fs.mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+  if (fs.lstatSync(backupDir).isSymbolicLink()) throw new Error('Backup directory symlink refused');
+  const file = path.join(backupDir, `rnb-hook-trust-${new Date().toISOString().replaceAll(':', '-')}-${crypto.randomUUID()}.toml`);
+  const fd = fs.openSync(file, 'wx', 0o600);
+  try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+  const dir = fs.openSync(backupDir, 'r'); try { fs.fsyncSync(dir); } finally { fs.closeSync(dir); }
+  return file;
+}
+
+export function resolveNativeBinary(binary, { env = process.env, platform = process.platform } = {}) {
+  if (typeof binary !== 'string' || !binary) throw new Error('Native executable required');
+  const candidates = path.isAbsolute(binary) ? [binary] : /^[A-Za-z0-9._-]+$/.test(binary)
+    ? String(env.PATH || '').split(platform === 'win32' ? ';' : path.delimiter).filter(Boolean).flatMap((dir) => {
+      const suffixes = platform === 'win32' && !path.extname(binary) ? String(env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';') : [''];
+      return suffixes.map((suffix) => path.resolve(dir, binary + suffix));
+    }) : [];
+  for (const candidate of candidates) {
+    try {
+      fs.accessSync(candidate, platform === 'win32' ? fs.constants.F_OK : fs.constants.X_OK);
+      if (!fs.statSync(candidate).isFile()) continue;
+      const resolved = fs.realpathSync(candidate);
+      if (resolved === fs.realpathSync(fileURLToPath(import.meta.url))) throw new Error('Recursive native gateway refused');
+      return resolved;
+    } catch (error) { if (error.message === 'Recursive native gateway refused') throw error; }
+  }
+  throw new Error('Native executable unavailable on configured PATH');
+}
+
+/** Only initialize/config/read/config/batchWrite/hooks/list are ever sent by this client. */
+async function nativeClient(binary, cwd, deadlineAt, configPath) {
+  binary = resolveNativeBinary(binary);
+  const env = { ...process.env, CODEX_HOME: path.dirname(configPath) };
+  for (const key of ['OPENAI_API_KEY', 'OPENAI_BASE_URL', 'ANTHROPIC_API_KEY', 'CODEX_API_KEY']) delete env[key];
+  const child = spawn(binary, ['app-server', '--listen', 'stdio://'], { cwd, env, stdio: ['pipe', 'pipe', 'ignore'] });
+  const exited = new Promise((resolve) => { child.once('exit', resolve); child.once('error', () => { if (!child.pid) resolve(); }); });
+  activeMetadataChildren.set(child, { exited });
+  let nextId = 1; let buffer = ''; const pending = new Map();
+  const rejectAll = (message) => { for (const item of pending.values()) { clearTimeout(item.timer); item.reject(new Error(message)); } pending.clear(); };
+  child.on('error', () => rejectAll('Native metadata process failed'));
+  child.stdin.on('error', () => rejectAll('Native metadata input failed'));
+  child.on('exit', () => rejectAll('Native metadata process exited'));
+  child.stdout.on('data', (chunk) => {
+    buffer += chunk;
+    if (Buffer.byteLength(buffer) > 8 * 1024 * 1024) { rejectAll('Native metadata output exceeds bound'); child.kill(); return; }
+    while (buffer.includes('\n')) {
+      const end = buffer.indexOf('\n'); const line = buffer.slice(0, end); buffer = buffer.slice(end + 1);
+      let row; try { row = JSON.parse(line); } catch { continue; }
+      const item = pending.get(row.id); if (!item) continue;
+      pending.delete(row.id); clearTimeout(item.timer);
+      // Do not include native error details: they may contain private config values.
+      if (row.error) item.reject(new Error(`Native ${item.method} rejected`)); else item.resolve(row.result);
+    }
+  });
+  const rpc = (method, params) => new Promise((resolve, reject) => {
+    const remaining = deadlineAt - Date.now(); if (remaining <= 0) { reject(new Error('Native metadata deadline exceeded')); return; }
+    const id = nextId++; const timer = setTimeout(() => { pending.delete(id); reject(new Error(`Native ${method} timed out`)); }, remaining);
+    pending.set(id, { resolve, reject, timer, method });
+    child.stdin.write(`${JSON.stringify({ id, method, params })}\n`, (error) => { if (error) rejectAll('Native metadata input failed'); });
+  });
+  const close = async () => { rejectAll('Native metadata client closed'); child.stdin.destroy(); await shutdownMetadataChild(child); };
+  try {
+    await rpc('initialize', { clientInfo: { name: 'rnb_verified_hook_trust', version: '1' }, capabilities: { experimentalApi: true } });
+    child.stdin.write(`${JSON.stringify({ method: 'initialized' })}\n`);
+    return { rpc, close };
+  } catch (error) { await close(); throw error; }
+}
+const rowsFor = (response) => {
+  if (!Array.isArray(response?.data)) throw new Error('Native hook registry unavailable');
+  return response.data.flatMap((r) => r.hooks || []).filter((r) => r.pluginId === OWNER);
+};
+function assertRegistry(rows, identities) {
+  if (rows.length !== identities.size || new Set(rows.map((r) => r.key)).size !== identities.size
+    || rows.some((row) => identities.get(row.key) !== row.currentHash)) throw new Error('Native registry differs from verified released artifact');
+}
+
+function otherSettings(config, keys) {
+  const clone = structuredClone(config);
+  for (const key of keys) {
+    const state = clone?.hooks?.state?.[key];
+    if (state && typeof state === 'object') {
+      delete state.trusted_hash;
+      if (!Object.keys(state).length) delete clone.hooks.state[key];
+    }
+  }
+  if (clone?.hooks?.state && !Object.keys(clone.hooks.state).length) delete clone.hooks.state;
+  if (clone?.hooks && !Object.keys(clone.hooks).length) delete clone.hooks;
+  const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === 'object'
+    ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, canonical(v[k])])) : v;
+  return JSON.stringify(canonical(clone));
+}
+
+/** Caller must authenticate releaseIdentity against its verified tarball/protected-release receipt.
+ * The helper checks installed bytes/version and native identities; it cannot authenticate caller data.
+ * rpc injection owns its own client lifetime. Default client never starts a thread, turn or account call.
+ */
+export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, installedVersion, hooksPath,
+  configPath, nativeBinary, cwd = process.cwd(), backupDir = path.join(path.dirname(configPath || ''), 'backups'),
+  rpc: suppliedRpc, timeoutMs = 10000 } = {}) {
+  let client; let wrote = false; let writeAttempted = false; let backupPath;
+  try {
+    if (!releaseIdentity || !/^\d+\.\d+\.\d+$/.test(releaseIdentity.version || '')
+      || installedVersion !== releaseIdentity.version || !/^[a-f0-9]{64}$/.test(releaseIdentity.hooksSha256 || '')
+      || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(releaseIdentity.integrity || '')) return blocked('Verified released artifact identity required');
+    if (![hooksPath, configPath, backupDir].every((p) => typeof p === 'string' && path.isAbsolute(p))) return blocked('Absolute owned paths required');
+    if (fs.lstatSync(hooksPath).isSymbolicLink() || fs.lstatSync(configPath).isSymbolicLink()) return blocked('Source/config symlink refused');
+    const bytes = fs.readFileSync(hooksPath);
+    if (digest(bytes) !== releaseIdentity.hooksSha256) return blocked('Installed hooks differ from verified release');
+    const identities = codexHookIdentities(JSON.parse(bytes));
+    if (!identities.size) return blocked('Verified artifact has no native hooks');
+    if (!suppliedRpc) client = await nativeClient(nativeBinary, cwd, Date.now() + Math.min(timeoutMs, 20000), configPath);
+    const rpc = suppliedRpc || client.rpc;
+    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(before, identities);
+    const disabled = before.filter((r) => r.enabled === false).map((r) => r.key).sort();
+    if (before.some((r) => !['trusted', 'modified', 'untrusted', 'managed'].includes(r.trustStatus))) return blocked('Unknown native trust state');
+    const pending = before.filter((r) => r.enabled === true && ['modified', 'untrusted'].includes(r.trustStatus));
+    if (!pending.length) return { state: 'unchanged', changed: false, disabledPreserved: disabled };
+    const read = await rpc('config/read', { includeLayers: true });
+    const users = (read.layers || []).filter((r) => r.name?.type === 'user' && r.name.file === configPath);
+    if (users.length !== 1 || typeof users[0].version !== 'string' || !users[0].version) return blocked('Current user config version unavailable');
+    // Config stays memory-only except the private backup. No logging of effective config values.
+    const prior = fs.readFileSync(configPath);
+    backupPath = privateBackup(configPath, prior, backupDir);
+    const edits = pending.map((r) => ({ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
+      value: identities.get(r.key), mergeStrategy: 'replace' }));
+    writeAttempted = true;
+    await rpc('config/batchWrite', { filePath: configPath, expectedVersion: users[0].version, reloadUserConfig: true, edits });
+    wrote = true;
+    const afterRead = await rpc('config/read', { includeLayers: true });
+    const afterUsers = (afterRead.layers || []).filter((r) => r.name?.type === 'user' && r.name.file === configPath);
+    if (afterUsers.length !== 1 || otherSettings(users[0].config, pending.map((r) => r.key))
+      !== otherSettings(afterUsers[0].config, pending.map((r) => r.key))) throw new Error('Unrelated config changed; no whole-file rollback attempted');
+    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities);
+    if (JSON.stringify(after.filter((r) => r.enabled === false).map((r) => r.key).sort()) !== JSON.stringify(disabled)
+      || after.some((r) => r.enabled === true && !['trusted', 'managed'].includes(r.trustStatus))) throw new Error('Native trust repair verification incomplete');
+    return { state: 'registry-verified', changed: true, editedTrustHashes: edits.length,
+      enabledBrainTrusted: after.filter((r) => r.enabled === true).length, disabledPreserved: disabled,
+      artifactHooksSha256: releaseIdentity.hooksSha256, backupPath, otherSemanticSettingsUnchanged: true,
+      priorConfigSha256: digest(prior), afterConfigSha256: digest(fs.readFileSync(configPath)), inferenceRequests: 0,
+      executionAcceptance: 'not-run' };
+  } catch (error) {
+    // Never restore an entire backup over concurrent writers. A successful write followed by failed
+    // verification is degraded, not "unchanged"; the installer must expose this outcome.
+    return { state: wrote || writeAttempted ? 'degraded' : 'blocked', changed: wrote ? true : writeAttempted ? 'unknown' : false, reason: error.message, ...(backupPath ? { backupPath } : {}) };
+  } finally { await client?.close(); }
+}
+
+// Explicit CLI only; importing the helper never starts a process or reads stdin.
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+  && process.argv[2] === '--reconcile-installed') {
+  const started = Date.now(); let emitted = false; let reconcileStarted = false;
+  const emit = (receipt) => { if (!emitted) { emitted = true; process.stdout.write(JSON.stringify(receipt) + '\n'); } };
+  const guard = setTimeout(async () => {
+    await Promise.allSettled([...activeMetadataChildren.keys()].map(shutdownMetadataChild));
+    emit({ state: 'degraded', changed: 'unknown', reason: 'CLI deadline exceeded; verify native trust state', inferenceRequests: 0 });
+    process.exit(1);
+  }, 29000);
+  (async () => {
+    let input = ''; for await (const chunk of process.stdin) {
+      input += chunk; if (Buffer.byteLength(input) > 16384) throw new Error('CLI input exceeds bound');
+    }
+    const args = JSON.parse(input);
+    if (!args || typeof args !== 'object' || Array.isArray(args)
+      || Object.keys(args).some((k) => !['installedVersion', 'hooksPath', 'configPath', 'nativeBinary', 'cwd'].includes(k))) throw new Error('Invalid CLI options');
+    const proof = await obtainVerifiedPublishedHookIdentity({ version: args.installedVersion, timeoutMs: 10000 });
+    if (proof.state !== 'verified') { emit(proof); return; }
+    reconcileStarted = true;
+    const result = await reconcileVerifiedCodexHookTrust({ ...args, releaseIdentity: proof.releaseIdentity,
+      timeoutMs: Math.max(1, Math.min(20000, 28000 - (Date.now() - started))) });
+    emit(result);
+  })().catch(() => emit(reconcileStarted
+    ? { state: 'degraded', changed: 'unknown', reason: 'Native reconciliation or shutdown failed; verify trust state', inferenceRequests: 0 }
+    : blocked('CLI request or published artifact proof failed'))).finally(() => clearTimeout(guard));
+}

package/scripts/codex-routed.sh

@@ -1,38 +1,5 @@
 #!/usr/bin/env bash
-# scripts/codex-routed.sh — built 2026-07-12. Codex has no native routing surface
-# (~/.codex/config.toml launches ONE model per run), so a consulted wrapper is the only
-# per-prompt model-selection path available to it. Part of the MetaHarness router (see
-# scripts/model-router-engine.mjs, the harness-neutral prompt -> {model, reason} decision
-# engine). This script only CONSULTS the engine and LAUNCHES codex — all selection logic
-# (features, policy, pricing) lives in the engine, not here.
-#
-# Contract: never block Stuart's launch. If the engine errors, times out, or returns a
-# null model, fall straight through to plain `codex` with no --model flag — a missing
-# routing decision must never be worse than no routing at all.
-set -uo pipefail
+# One routed native noninteractive worker. No silent fallback; model and effort are enforced together.
+set -euo pipefail
 DIR="$(cd "$(dirname "$0")" && pwd)"
-
-DECISION=$(node "$DIR/model-router-engine.mjs" --harness codex --prompt "$*" --json 2>/dev/null)
-
-# Extract .model + a short .reason without a jq dependency (Stuart directive). python3 ships
-# with macOS by default and its json module handles arbitrary reason text (quotes, unicode)
-# more safely than hand-rolled JS string escaping in a node -e one-liner would. Single call,
-# tab-delimited output, so we only shell out once per launch.
-IFS=$'\t' read -r M REASON <<< "$(printf '%s' "$DECISION" | python3 -c '
-import json, sys
-try:
-    d = json.load(sys.stdin)
-    m = d.get("model") or ""
-    r = (d.get("reason") or "").replace("\n", " ").replace("\t", " ")[:80]
-    print(f"{m}\t{r}")
-except Exception:
-    print("\t")
-' 2>/dev/null)"
-
-if [ -z "${M:-}" ] || [ "$M" = "None" ]; then
-  # Engine failed / no policy resolved a model — never block, just launch codex unrouted.
-  exec codex "$@"
-fi
-
-printf '\x1b[2m🧭 codex-routed → %s (%s)\x1b[0m\n' "$M" "$REASON"
-exec codex --model "$M" "$@"
+exec node "$DIR/model-router-dispatch.mjs" --harness codex -- "$@"

package/scripts/goldie-weekly.sh

@@ -1,67 +1,11 @@
 #!/bin/bash
-# goldie-weekly.sh — the ONLY thing launchd invokes for Goldie (weekly model-landscape research).
-# Same discipline as nightly-wrapper.sh: verified outcomes, exactly one phone summary per run,
-# no silent path. Built 2026-07-12 per Stuart's mandate: the router must never run on a stale
-# picture of the model landscape, and no scheduled job may ever die quietly.
-#
-# Two layers, independent by design:
-#   1. DETERMINISTIC (scripts/goldie-research.mjs): live OpenRouter pricing -> catalog refresh +
-#      drift flags + radar + the dated brief. Pure data, no LLM, no key needed.
-#   2. JUDGMENT (headless Claude, subscription-covered): answers the brief's three standing
-#      questions (bucket count, best-model-per-bucket per public evals, radar adoption) with real
-#      web research, APPENDED to the same brief as a PROPOSAL — never auto-applied to policy.mjs.
-#      Skippable (GOLDIE_SKIP_JUDGMENT=1) and its failure never hides layer 1's result.
-set -u
-cd /Users/stuartkerr/Code/ruvnet-brain || exit 1
-mkdir -p logs
-LOG=logs/goldie.log
-TODAY=$(date +%F)
-BRIEF="$HOME/.claude/model-router/goldie/$TODAY.md"
-
-echo "===== goldie-weekly — $(date -u +%FT%TZ) =====" >> "$LOG"
-
-# ── Layer 1: deterministic refresh (must succeed for the run to count) ──
-if ! /usr/local/bin/node scripts/goldie-research.mjs >> "$LOG" 2>&1; then
-  sh scripts/notify.sh "🔴 Goldie FAILED — model catalog is going stale" \
-    "goldie-research.mjs could not produce this week's brief (OpenRouter fetch or catalog write failed). The router is now running on last week's picture. See logs/goldie.log." \
-    urgent "rotating_light" || true
+# Existing Goldie launchd label/calendar stays unchanged. Run installed, guarded native cycle;
+# policy promotion is a separate evidence-qualified boundary. No legacy model/API proposer.
+set -eu
+CYCLE="$HOME/.claude/model-router/bin/model-weekly-cycle.mjs"
+NODE_BINARY="${RUVNET_NODE_BINARY:-/opt/homebrew/opt/node@24/bin/node}"
+if [ ! -f "$CYCLE" ] || [ ! -x "$NODE_BINARY" ]; then
+  echo 'Weekly model cycle is not installed; prior policy retained.' >&2
   exit 1
 fi
-
-# ── Layer 2: judgment (best-effort, never blocks; appends to the brief) ──
-JUDGMENT="skipped"
-if [ "${GOLDIE_SKIP_JUDGMENT:-0}" != "1" ] && command -v claude >/dev/null 2>&1; then
-  PROMPT="You are Goldie, the weekly model-landscape researcher for a prompt->model router.
-Read $BRIEF (this week's deterministic data) and ~/.claude/model-router/catalog.json (the candidate
-catalog) and ~/.claude/model-router/policy.default.mjs (the current placeholder policy). Then use web
-search on the current public evaluations (Artificial Analysis, LMArena, SWE-bench and similar) to
-answer the brief's three standing questions with sources and dates:
-(1) how many BUCKETS should prompts be classified into and what are they;
-(2) the best model per bucket right now on capability-per-cost-per-speed, split into: covered by a
-Claude Max subscription (claude-code harness), covered by a ChatGPT/Codex subscription (codex
-harness), and cheapest-capable OpenRouter API model;
-(3) whether any radar model in the brief deserves wiring up, and what that requires.
-Rules: cite sources with dates for every claim; distinguish MEASURED numbers from vendor claims;
-recommendations are PROPOSALS for catalog.json/policy.mjs — do not edit any file. End with a
-'## Proposed policy changes' section in plain, reviewable prose.
-Write your full answer to stdout as markdown."
-  # env -u ANTHROPIC_API_KEY: a stray/stale API key in the environment makes headless claude bill
-  # (or fail on) the API instead of riding the Claude Max login — the exact "spend where the
-  # subscription is free" mistake this system exists to kill. Found live 2026-07-12: an invalid
-  # inherited key failed the whole judgment layer with "Invalid API key". Subscription, always.
-  if OUT=$(timeout 900 env -u ANTHROPIC_API_KEY claude -p "$PROMPT" --model sonnet --allowed-tools "WebSearch,WebFetch,Read" 2>>"$LOG"); then
-    { echo ""; echo "---"; echo ""; echo "# Judgment layer (headless Claude, $(date -u +%FT%TZ))"; echo ""; echo "$OUT"; } >> "$BRIEF"
-    JUDGMENT="ok"
-  else
-    JUDGMENT="FAILED (see logs/goldie.log)"
-    { echo ""; echo "---"; echo ""; echo "# Judgment layer: FAILED this week ($(date -u +%FT%TZ)) — deterministic data above still fresh."; } >> "$BRIEF"
-  fi
-fi
-
-# ── Exactly one summary push per run — success included (silence is never a signal) ──
-HEADLINES=$(grep -E "PRICE DRIFT|NOT FOUND" "$BRIEF" | head -3)
-sh scripts/notify.sh "🧭 Goldie ran — model catalog refreshed" \
-  "Weekly brief: $BRIEF. Judgment layer: $JUDGMENT.${HEADLINES:+ ATTENTION: $HEADLINES}" \
-  default "compass" || true
-echo "===== goldie-weekly done (judgment: $JUDGMENT) =====" >> "$LOG"
-exit 0
+exec "$NODE_BINARY" "$CYCLE" --router-dir "$HOME/.claude/model-router"

package/scripts/metaharness-router.mjs

@@ -142,7 +142,13 @@ export async function route(prompt, candidates, profile, { qualityBar = 0.7, k =
   }
 
   const prices = effectivePrices(candidates, profile);
-  const router = mod.Router.fromExamples(rows, prices, { k, qualityBar });
+  const allowed = new Set(candidates.map((m) => m.id));
+  const constrainedRows = rows.map((row) => ({ ...row,
+    scores: Object.fromEntries(Object.entries(row.scores).filter(([id]) => allowed.has(id))),
+  })).filter((row) => Object.keys(row.scores).length);
+  if (constrainedRows.length < MIN_LABELS) return { routedBy: 'COLD-START',
+    reason: 'Insufficient labels for policy-eligible models', labels: constrainedRows.length };
+  const router = mod.Router.fromExamples(constrainedRows, prices, { k, qualityBar });
   const pick = router.route(await embed(prompt));
 
   return {

package/scripts/model-analyst-sandbox.mjs

@@ -0,0 +1,54 @@
+// DISTINCT-FROM: native-subscription-usage.mjs — isolated child tool-denial trust, never an inference turn.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+export const TOOL_DENIAL = { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'Weekly analyst tools are prohibited; analyse supplied evidence only.' } };
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+export function createAnalystHome(runDir) {
+  const requestedHome = path.join(runDir, 'native-home'); fs.mkdirSync(requestedHome, { mode: 0o700 }); const home = fs.realpathSync(requestedHome);
+  const source = path.join(os.homedir(), '.codex');
+  const auth = fs.realpathSync(path.join(source, 'auth.json'));
+  if (!fs.statSync(auth).isFile()) throw new Error('Canonical native OAuth file unavailable');
+  fs.symlinkSync(auth, path.join(home, 'auth.json'));
+  fs.copyFileSync(path.join(source, 'models_cache.json'), path.join(home, 'models_cache.json')); fs.chmodSync(path.join(home, 'models_cache.json'), 0o600);
+  fs.writeFileSync(path.join(home, 'config.toml'), '', { mode: 0o600 });
+  const command = `${quote(process.execPath)} ${quote(fileURLToPath(import.meta.url))} --deny`;
+  fs.writeFileSync(path.join(home, 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ matcher: '.*', hooks: [{ type: 'command', command, timeout: 5 }] }] } }), { mode: 0o600 });
+  return { home, command };
+}
+export function sameNativeConfigPath(actual, expected, platform = process.platform) {
+  if (typeof actual !== 'string' || !actual) return false;
+  const paths = platform === 'win32' ? path.win32 : path.posix;
+  const normalize = value => { const resolved = paths.resolve(value); return platform === 'win32' ? resolved.toLowerCase() : resolved; };
+  return normalize(actual) === normalize(expected);
+}
+export async function trustAnalystDenial({ home, command, env = process.env, spawnHost = spawn, timeoutMs = 8000 }) {
+  const child = spawnHost('codex', ['app-server', '--strict-config', '-c', 'features.plugins=false', '-c', 'service_tier="default"', '--listen', 'stdio://'], { cwd: home, env: { ...env, CODEX_HOME: home }, stdio: ['pipe', 'pipe', 'pipe'], shell: false });
+  let id = 0, buffer = ''; const pending = new Map(); let failure;
+  const fail = () => { failure = new Error('Private native hook metadata transport failed'); for (const p of pending.values()) p.reject(failure); pending.clear(); };
+  child.on('error', fail); child.on('exit', fail); child.stderr.on('data', () => {}); child.stdin.on('error', fail);
+  child.stdout.on('data', (chunk) => { buffer += chunk; if (buffer.length > 1048576) return fail(); let split;
+    while ((split = buffer.indexOf('\n')) >= 0) { const line = buffer.slice(0, split); buffer = buffer.slice(split + 1); let r; try { r = JSON.parse(line); } catch { continue; }
+      const p = pending.get(r.id); if (!p) continue; pending.delete(r.id); r.error ? p.reject(new Error('Private native hook metadata request rejected')) : p.resolve(r.result);
+    }
+  });
+  const request = (method, params) => new Promise((resolve, reject) => { if (failure) return reject(failure); const n = ++id; pending.set(n, { resolve, reject }); child.stdin.write(JSON.stringify({ id: n, method, params }) + '\n'); });
+  const timer = setTimeout(() => { fail(); child.kill(); }, timeoutMs);
+  const oneHook = (result) => { const entries = result?.data ?? []; const hooks = entries.flatMap((e) => e.hooks ?? []);
+    if (entries.some((e) => e.errors?.length) || hooks.length !== 1 || hooks[0].eventName !== 'preToolUse' || hooks[0].matcher !== '.*' || hooks[0].command !== command || !hooks[0].enabled || !/^sha256:[a-f0-9]{64}$/.test(hooks[0].currentHash)) throw new Error('Private deny hook is not the sole enabled hook'); return hooks[0]; };
+  try {
+    await request('initialize', { clientInfo: { name: 'weekly_analyst_sandbox', version: '1' }, capabilities: { experimentalApi: true } }); child.stdin.write('{"method":"initialized"}\n');
+    const first = oneHook(await request('hooks/list', { cwds: [home] }));
+    const config = await request('config/read', { cwd: home, includeLayers: true });
+    const layer = config.layers?.find((l) => sameNativeConfigPath(l.name?.file, path.join(home, 'config.toml')));
+    if (!layer?.version) throw new Error('Private native config version missing');
+    await request('config/batchWrite', { filePath: path.join(home, 'config.toml'), expectedVersion: layer.version, reloadUserConfig: true,
+      edits: [{ keyPath: `hooks.state.${JSON.stringify(first.key)}.trusted_hash`, value: first.currentHash, mergeStrategy: 'replace' }] });
+    const final = oneHook(await request('hooks/list', { cwds: [home] }));
+    if (final.trustStatus !== 'trusted' || final.currentHash !== first.currentHash) throw new Error('Private deny hook trust not accepted');
+    return { trusted: true, hookKey: final.key, currentHash: final.currentHash, inferenceStarted: false };
+  } finally { clearTimeout(timer); child.stdin.end(); child.kill(); }
+}
+if (process.argv.includes('--deny')) console.log(JSON.stringify(TOOL_DENIAL));