ruvnet-brain 4.5.8 → 4.5.10

package/scripts/model-weekly-cycle.mjs

@@ -36,16 +36,50 @@ function writeOwned(dir, token, file, value) { const committed = transaction(dir
 function release(dir, token) { transaction(dir, () => { if (json(dir, ownerFile, 4096)?.token === token) fs.unlinkSync(path.join(dir, ownerFile)); }); }
 export function runCycleStage({ script, args, timeoutMs, env, spawnHost = spawn }) {
   return new Promise((resolve, reject) => {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 900000) throw new Error('Invalid weekly stage deadline');
+    const deadline = performance.now() + timeoutMs, retirementMs = Math.min(1000, timeoutMs / 10);
+    const workDeadline = deadline - retirementMs;
     const child = spawnHost(process.execPath, [path.join(DIR, script), ...args], { env, shell: false, stdio: ['ignore', 'pipe', 'pipe'] });
-    let stdout = '', timedOut = false, killTimer;
-    const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); killTimer = setTimeout(() => child.kill('SIGKILL'), 1000); }, timeoutMs);
-    child.stderr.on('data', () => {}); child.stdout.on('data', (d) => { stdout += d; if (stdout.length > 262144) { timedOut = true; child.kill('SIGKILL'); } });
-    child.once('error', () => { clearTimeout(timer); clearTimeout(killTimer); reject(new Error('Weekly cycle child host unavailable')); });
-    child.once('exit', (code) => { clearTimeout(timer); clearTimeout(killTimer);
-      if (timedOut) return reject(new Error('Weekly cycle child exceeded bounded deadline or output limit'));
-      let result; try { result = JSON.parse(stdout.trim().split('\n').at(-1)); } catch { return reject(new Error('Weekly cycle child receipt missing')); }
-      resolve({ code, result });
+    let stdout = '', outputBytes = 0, failure, settled = false, exitObserved = false;
+    let timer, killTimer, retirementTimer;
+    const kill = (signal) => { try { child.kill(signal); } catch { /* owned child retirement remains unverified */ } };
+    const finish = (error, value) => {
+      if (settled) return; settled = true;
+      clearTimeout(timer); clearTimeout(killTimer); clearTimeout(retirementTimer);
+      // Drop only our child's referenced handles, including pipes held open after its exit.
+      // Signals/exit cannot prove detached descendants retired.
+      for (const stream of [child.stdin, child.stdout, child.stderr]) { try { stream?.destroy?.(); } catch { /* best effort */ } }
+      try { child.unref?.(); } catch { /* best effort */ }
+      if (error) {
+        error.stageCleanup = { ownedChildPid: child.pid ?? null, childExitObserved: exitObserved,
+          ownedChildRetirement: exitObserved ? 'exit-observed' : 'unverified', descendantRetirement: 'unproven' };
+        reject(error);
+      } else resolve(value);
+    };
+    const fail = (reason) => {
+      if (settled || failure) return; failure = new Error(reason);
+      // Reserve retirement inside the caller's budget; do not wait indefinitely for exit/close.
+      const remaining = Math.max(0, Math.min(retirementMs, deadline - performance.now()));
+      killTimer = setTimeout(() => kill('SIGKILL'), remaining / 2);
+      retirementTimer = setTimeout(() => finish(failure), remaining);
+      kill('SIGTERM');
+    };
+    const consume = (chunk, capture) => {
+      if (settled || failure) return;
+      if (performance.now() >= workDeadline) return fail('Weekly cycle child exceeded bounded deadline or output limit');
+      outputBytes += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(String(chunk));
+      if (outputBytes > 262144) return fail('Weekly cycle child exceeded bounded deadline or output limit');
+      if (capture) stdout += chunk;
+    };
+    child.stderr.on('data', (chunk) => consume(chunk, false)); child.stdout.on('data', (chunk) => consume(chunk, true));
+    child.on('error', () => fail('Weekly cycle child host unavailable'));
+    child.once('exit', (code) => {
+      exitObserved = true; if (failure) return finish(failure); if (settled) return;
+      if (performance.now() >= workDeadline) { fail('Weekly cycle child exceeded bounded deadline or output limit'); return finish(failure); }
+      let result; try { result = JSON.parse(stdout.trim().split('\n').at(-1)); } catch { return finish(new Error('Weekly cycle child receipt missing')); }
+      finish(null, { code, result });
     });
+    timer = setTimeout(() => fail('Weekly cycle child exceeded bounded deadline or output limit'), Math.max(0, workDeadline - performance.now()));
   });
 }
 const INVENTORY_URL = 'https://openrouter.ai/api/v1/models';
@@ -172,7 +206,9 @@ export async function runWeeklyCycle({ routerDir = path.join(os.homedir(), '.cla
     delete state.pendingSemanticReceipt; delete state.pendingSemanticReleaseIds;
     state.lastQualification = qualified.result; save(STATE_FILE, state); record.status = 'complete';
     save('weekly-cycle-last-attempt.json', record); return record;
-  } catch (error) { record.status = 'failed'; record.releaseStatus = 'unknown-or-pending'; record.reason = error.message.slice(0, 240); try { save('weekly-cycle-last-attempt.json', record); } catch { /* superseded cannot write */ } return record;
+  } catch (error) { record.status = 'failed'; record.releaseStatus = 'unknown-or-pending'; record.reason = error.message.slice(0, 240);
+    if (error.stageCleanup) record.stageCleanup = error.stageCleanup;
+    try { save('weekly-cycle-last-attempt.json', record); } catch { /* superseded cannot write */ } return record;
   } finally { release(routerDir, token); }
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/scripts/record-lesson.mjs

@@ -19,7 +19,8 @@
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveRuflo, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
+import { randomUUID } from 'node:crypto';
+import { resolveRuflo, rufloInvocation, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
 
 const arg = (name, def = '') => {
   const i = process.argv.indexOf(`--${name}`);
@@ -60,21 +61,26 @@ const value = [
   worked ? `WORKED: ${worked}` : null,
   critique ? `CRITIQUE: ${critique}` : null,
   `OUTCOME: ${outcome}`,
+  `RECORDING: ${randomUUID()}`, // binds the read-back to THIS canonical lesson write
 ].filter(Boolean).join(' ');
 
 // Every `ruflo` invocation auto-starts a project background daemon unless this is set (verified
 // live: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/services/
 // daemon-autostart.js:85) — recording a lesson has no business leaving one running.
-const ruflo = (args) =>
-  execFileSync(RUFLO, args, { cwd: dir, encoding: 'utf8', timeout: 60000,
-    shell: process.platform === 'win32', env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+const ruflo = (args) => {
+  const invocation = rufloInvocation(RUFLO, args);
+  return execFileSync(invocation.executable, invocation.args, {
+    cwd: dir, encoding: 'utf8', timeout: 60000, shell: false,
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+  });
+};
 
 console.log(`\nRecording lesson into ${path.basename(dir)}/.swarm/memory.db  (namespace: ${ns})`);
 console.log(`  key: ${key}`);
 
 // 1a. STORE (native, signal namespace) — L1 content + L2 embedding
 try {
-  ruflo(['memory', 'store', '-k', key, '-n', ns, '--value', value]);
+  ruflo(['memory', 'store', '-k', key, '-n', ns, '--value', value, '--path', db]);
 } catch (e) {
   console.error('  store FAILED:', String(e.stdout || e.message).split('\n')[0]);
   process.exit(1);
@@ -91,7 +97,7 @@ try {
 let stored = false;
 try {
   const back = ruflo(['memory', 'retrieve', '-k', key, '-n', ns, '--value-only', '--path', db]);
-  stored = String(back).includes(value);
+  stored = String(back) === value;
 } catch (e) {
   console.error('  round-trip FAILED:', String(e.stdout || e.message).split('\n')[0]);
 }
@@ -133,6 +139,6 @@ console.log(
 // DERIVED, not asserted (F15): the closing line reports exactly what was verified, never more. The
 // old line claimed "captured, refined, and recall-verified" even when distill failed and recall
 // didn't return the key — asserted prose over an honest exit code.
-const parts = ['captured', distillOk ? 'refined' : 'NOT refined (distill failed)', recalled ? 'recall-verified' : 'recall NOT verified'];
+const parts = [stored ? 'captured' : 'capture NOT verified', distillOk ? 'refined' : 'NOT refined (distill failed)', recalled ? 'recall-verified' : 'recall NOT verified'];
 console.log(`\nDone. Lesson is ${parts.join(', ')}.\n`);
 process.exit(stored ? 0 : 1);

package/scripts/release-qualification-contract.mjs

@@ -1,6 +1,43 @@
 // Reviewed stabilization release boundaries. Legacy tests remain developer diagnostics.
 export const RELEASE_REQUIREMENTS = Object.freeze({
   "source": [
+    {
+      "id": "installer-release-argument-safety",
+      "reason": "Incomplete named releases refuse before network or settings writes; valid named releases and installer help retain their contracts",
+      "files": ["tests/unit/install-release-fallback.test.mjs"]
+    },
+    {
+      "id": "honest-currency-lesson-and-metrics-evidence",
+      "reason": "Foreign KB roots remain isolated; panel currency derives from measured completion rather than checkout time; exact lesson readback binds this shell-free write; public metrics never fabricate performance or a competing product score",
+      "files": ["tests/unit/forge-currency-selected-root.test.mjs", "tests/unit/brain-score-producer.test.mjs", "tests/unit/brain-grade-groundtruth-timestamp.test.mjs", "tests/unit/record-lesson.test.mjs", "tests/unit/lesson-presentation-budget.test.mjs", "tests/unit/metrics-truth.test.mjs", "tests/unit/issue-watch-retry.test.mjs"]
+    },
+    {
+      "id": "automatic-update-source-and-transport",
+      "reason": "Captured owner policy never falls back on read failures; installed-only automation avoids npx; transient GET and body failures retry without weakening trust; POSIX executable aliases retain interpreter identity",
+      "files": ["tests/unit/automatic-update.test.mjs", "tests/unit/download-retry.test.mjs"],
+      "platformFiles": {
+        "linux": ["tests/unit/automatic-update-node-alias.test.mjs"],
+        "macos": ["tests/unit/automatic-update-node-alias.test.mjs"]
+      }
+    },
+    {
+      "id": "customer-scope-and-session-ownership",
+      "reason": "Captured assistant commitments retain their actual session owner and honest noncompleted states; scoped grounding retains strict conservative evidence under contention; legacy guidance never suppresses a tool call",
+      "files": ["tests/unit/continuation-commitment-ownership.test.mjs"],
+      "platformFiles": {
+        "linux": ["tests/unit/grounding-scope.test.mjs", "tests/unit/hijack-no-defer.test.mjs"],
+        "macos": ["tests/unit/grounding-scope.test.mjs", "tests/unit/hijack-no-defer.test.mjs"]
+      }
+    },
+    {
+      "id": "bounded-advocacy-and-write-grounding",
+      "reason": "Explicit document meaning requests retain corroboration; literal searches stay silent; POSIX complete-write exemptions preserve executable and managed-store grounding",
+      "files": ["tests/unit/advocacy-route.test.mjs", "tests/unit/advocacy-catalog.test.mjs", "tests/unit/card-lane.test.mjs"],
+      "platformFiles": {
+        "linux": ["tests/unit/advocacy-route-budget.test.mjs", "tests/unit/ground-before-write.test.mjs", "tests/unit/grounding-code-projection.test.mjs"],
+        "macos": ["tests/unit/advocacy-route-budget.test.mjs", "tests/unit/ground-before-write.test.mjs", "tests/unit/grounding-code-projection.test.mjs"]
+      }
+    },
     {
       "id": "owned-startup-execution-evidence",
       "reason": "Opt-in native execution and private stage diagnostics bind released source and preserve unknown convergence and incomplete cleanup boundaries",
@@ -136,9 +173,11 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
     },
     {
       "id": "canonical-memory-privacy",
-      "reason": "Canonical project isolation, persisted consent and truthful capture status",
+      "reason": "Canonical project isolation, persisted consent, excluded-resource privacy before recording, immutable delivery refusal and truthful terminal failure status",
       "files": [
         "tests/unit/turn-outcome-capture.test.mjs",
+        "tests/unit/turn-capture-content-privacy.test.mjs",
+        "tests/integration/project-progression-hook.test.mjs",
         "tests/unit/turn-journal-platform.test.mjs",
         "tests/unit/project-store-resolver.test.mjs"
       ]