ruvnet-brain 4.6.0 → 4.6.2

package/bin/nightly-refresh.mjs

@@ -80,7 +80,11 @@ try {
   if (registration.mode === 'developer-suite') {
     const coordinator = await import(pathToFileURL(modules['developer-update.mjs'].path).href);
     const receipt = await coordinator.runDeveloperUpdate({ mode: 'apply', env: { ...process.env,
-      RUVNET_NIGHTLY_IDENTITY: registration.identity, RUVNET_NIGHTLY: '1' } });
+      RUVNET_NIGHTLY_IDENTITY: registration.identity, RUVNET_NIGHTLY: '1',
+      RUVNET_NIGHTLY_REGISTRATION: registrationPath,
+      RUVNET_NIGHTLY_NODE_PATH: registration.nodePath,
+      RUVNET_NIGHTLY_RUNNER_PATH: registration.runnerPath,
+      RUVNET_NIGHTLY_RUNNER_SHA256: registration.runnerSha256 } });
     console.log(JSON.stringify(receipt));
     process.exit(0);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.6.0",
+  "version": "4.6.2",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.6.0",
+  "version": "4.6.2",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.6.0",
+  "version": "4.6.2",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/developer-update-maintenance.mjs

@@ -3,6 +3,114 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { cmpVersion as compare } from './developer-update-policy.mjs';
+import crypto from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+const sha = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+const quote = text => `'${String(text).replaceAll("'", "'\\''")}'`;
+function regular(file) {
+  const stat = fs.lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+    || (stat.mode & 0o022)) throw Error('Codex launcher requires owned regular files');
+  return fs.readFileSync(file);
+}
+function runtimeIdentity(root) {
+  const entries = [];
+  function visit(relative) {
+    const file = path.join(root, relative), stat = fs.lstatSync(file);
+    if (stat.isDirectory() && !stat.isSymbolicLink() && stat.uid === process.getuid?.()) {
+      for (const name of fs.readdirSync(file)) visit(path.join(relative, name));
+    } else entries.push([relative.split(path.sep).join('/'), sha(regular(file))]);
+  }
+  visit('');
+  return sha(JSON.stringify(entries.sort(([a], [b]) => a.localeCompare(b))));
+}
+function nativeOwner(file, home) {
+  const real = fs.realpathSync(file), root = path.join(home, '.codex/packages/standalone/releases') + path.sep;
+  if (!real.startsWith(root) || path.basename(real) !== 'codex') throw Error('Codex native owner outside standalone releases');
+  const bytes = regular(real), magic = bytes.subarray(0, 4).toString('hex');
+  if (!['7f454c46', 'cffaedfe', 'feedfacf', 'cafebabe', 'bebafeca'].includes(magic)) throw Error('Codex native executable identity unavailable');
+  fs.accessSync(real, fs.constants.X_OK);
+  return real;
+}
+export function inspectCodexLauncher(file, home) {
+  if (file !== path.join(home, '.local/bin/codex') || fs.lstatSync(file).isSymbolicLink()) return null;
+  const bytes = regular(file);
+  // A direct native binary is handled by the ordinary owner gate; unknown scripts never run.
+  if (!bytes.subarray(0, 2).equals(Buffer.from('#!'))) {
+    if (!['7f454c46', 'cffaedfe', 'feedfacf', 'cafebabe', 'bebafeca'].includes(bytes.subarray(0, 4).toString('hex'))) throw Error('Unknown Codex native launcher refused');
+    return null;
+  }
+  const configPath = path.join(home, '.cache/ruvnet-brain/model-routing/terminal-launcher-config.json');
+  const configBytes = regular(configPath), config = JSON.parse(configBytes);
+  const runtimeRoot = path.join(home, '.cache/ruvnet-brain/model-routing/versions', config.runtimeDigest || '');
+  const keys = ['schemaVersion', 'managedBy', 'runtimeDigest', 'runtimeRoot', 'nodeBinary', 'runner', 'realCodex', 'gatewayPath',
+    ...(config.realClaude ? ['realClaude', 'claudeHelperPath', 'enginePath'] : [])];
+  if (Object.keys(config).sort().join(',') !== keys.sort().join(',')) throw Error('Codex launcher config shape mismatch');
+  if (config.schemaVersion !== 1 || config.managedBy !== 'ruvnet-brain-terminal-launchers'
+    || !/^[a-f0-9]{64}$/.test(config.runtimeDigest || '') || config.runtimeRoot !== runtimeRoot
+    || fs.realpathSync(runtimeRoot) !== runtimeRoot || config.runner !== path.join(runtimeRoot, 'scripts/model-terminal-launchers.mjs')
+    || config.gatewayPath !== path.join(runtimeRoot, 'scripts/model-terminal-gateway.mjs')
+    || (config.realClaude && (config.claudeHelperPath !== path.join(runtimeRoot, 'scripts/claude-terminal-mod.mjs')
+      || config.enginePath !== path.join(runtimeRoot, 'scripts/model-router-engine.mjs')))
+    || runtimeIdentity(runtimeRoot) !== config.runtimeDigest) throw Error('Codex launcher runtime/config identity mismatch');
+  const expected = `#!/bin/sh\n# Managed RuvNet Brain terminal launcher\nexec ${quote(config.nodeBinary)} ${quote(config.runner)} --launch 'codex' --config ${quote(configPath)} -- "$@"\n`;
+  if (!bytes.equals(Buffer.from(expected))) throw Error('Preserving unknown Codex terminal wrapper');
+  regular(config.nodeBinary); fs.accessSync(config.nodeBinary, fs.constants.X_OK);
+  // The shared installer also visits registered Claude launchers; require exact existing bytes.
+  const claudeEntries = [];
+  if (config.realClaude) {
+    const claudeBytes = Buffer.from(expected.replace("--launch 'codex'", "--launch 'claude'"));
+    for (const entry of ['claude', 'ruvnet-brain-claude-terminal']) {
+      const claudeFile = path.join(home, '.local/bin', entry);
+      if (!regular(claudeFile).equals(claudeBytes)) throw Error('Preserving changed Claude terminal wrapper');
+      claudeEntries.push({ file: claudeFile, bytes: claudeBytes });
+    }
+  }
+  return { file, home, configPath, configBytes, config, bytes, claudeEntries, native: nativeOwner(config.realCodex, home) };
+}
+export function updatedCodexNative(proof) {
+  if (fs.lstatSync(proof.file).uid !== process.getuid?.()) throw Error('Codex canonical owner changed during update');
+  if (!fs.lstatSync(proof.file).isSymbolicLink() && regular(proof.file).equals(proof.bytes)) {
+    return nativeOwner(path.join(proof.home, '.codex/packages/standalone/current/bin/codex'), proof.home);
+  }
+  return nativeOwner(proof.file, proof.home);
+}
+export async function restoreCodexLauncher(proof, { retainOriginalNative = false } = {}) {
+  const { file, home, config, configPath } = proof;
+  if (!regular(configPath).equals(proof.configBytes) || runtimeIdentity(config.runtimeRoot) !== config.runtimeDigest) {
+    throw Error('Codex launcher identity changed during native update');
+  }
+  for (const entry of proof.claudeEntries) if (!regular(entry.file).equals(entry.bytes)) throw Error('Claude wrapper changed during Codex update');
+  const candidate = updatedCodexNative(proof);
+  const native = retainOriginalNative ? nativeOwner(proof.native, home) : candidate;
+  const installed = await import(pathToFileURL(config.runner).href);
+  if (typeof installed.installTerminalLaunchers !== 'function') throw Error('Codex launcher installer unavailable');
+  // Installer accepts only same-owner native links. On failure retain the known original
+  // wrapper first, backing up the verified vendor link, then let its installer reconcile config.
+  if (retainOriginalNative && fs.lstatSync(file).isSymbolicLink()) {
+    const link = fs.readlinkSync(file), backup = `${file}.${sha(link)}.original`;
+    try { fs.symlinkSync(link, backup); }
+    catch (error) {
+      if (error.code !== 'EEXIST' || !fs.lstatSync(backup).isSymbolicLink()
+        || fs.lstatSync(backup).uid !== process.getuid?.() || fs.readlinkSync(backup) !== link) throw Error('Codex vendor link backup mismatch');
+    }
+    const temporary = `${file}.${crypto.randomUUID()}.tmp`;
+    try { fs.writeFileSync(temporary, proof.bytes, { flag: 'wx', mode: 0o755 }); fs.renameSync(temporary, file); }
+    finally { fs.rmSync(temporary, { force: true }); }
+  }
+  installed.installTerminalLaunchers({ home, runtimeRoot: config.runtimeRoot, runtimeDigest: config.runtimeDigest,
+    nodeBinary: config.nodeBinary, realCodex: native, realClaude: config.realClaude, apply: true, manageZsh: false });
+  if (!regular(file).equals(proof.bytes)) throw Error('Codex wrapper restoration verification failed');
+  const after = JSON.parse(regular(configPath));
+  const expectedConfig = { ...config, realCodex: native };
+  const sameConfig = Object.keys(after).sort().join(',') === Object.keys(expectedConfig).sort().join(',')
+    && Object.entries(expectedConfig).every(([key, value]) => after[key] === value);
+  if (!sameConfig || nativeOwner(after.realCodex, home) !== native) {
+    throw Error('Codex restored owner verification failed');
+  }
+  return native;
+}
+
 const HOME = os.homedir();
 const read = p => JSON.parse(fs.readFileSync(p, 'utf8'));
 function required(p) { fs.accessSync(p, fs.constants.X_OK); return p; }
@@ -66,14 +174,33 @@ export async function maintenance(config, run, dryRun, { home = HOME, brainHome,
       const resolved = fs.realpathSync(file);
       if (resolved.split(path.sep).includes('node_modules')) { result.exclusions.push(`npm owns native alias: ${file}`); continue; }
       required(file);
-      const owner = fs.realpathSync(file), stage = { owner: file, originalTarget: owner, state: 'running', commands: [] }; result.stages.push(stage);
-      const before = commandOutput(run, file, ['--version'], { timeout: 30_000 }, stage); stage.before = before;
-      if (!dryRun) commandOutput(run, file, args, { timeout: 900_000 }, stage);
-      const after = commandOutput(run, file, ['--version'], { timeout: 30_000 }, stage);
+      const launcher = inspectCodexLauncher(file, home);
+      const command = launcher?.native || file;
+      const owner = launcher?.native || fs.realpathSync(file), stage = { owner: file, originalTarget: owner, state: 'running', commands: [] }; result.stages.push(stage);
+      if (launcher) stage.launcherProof = { kind: 'brain-terminal-wrapper', runtimeDigest: launcher.config.runtimeDigest, wrapperSha256: sha(launcher.bytes) };
+      const before = commandOutput(run, command, ['--version'], { timeout: 30_000 }, stage); stage.before = before;
       const version = text => text.match(/\b(\d+\.\d+\.\d+(?:-[\w.-]+)?)/)?.[1];
-      const versionVerified = !!version(before) && !!version(after) && compare(version(after), version(before)) >= 0;
+      let after, afterOwner, versionVerified, restorationAttempted = false;
+      try {
+        if (!dryRun) commandOutput(run, command, args, { timeout: 900_000 }, stage);
+        const afterCommand = launcher && !dryRun ? updatedCodexNative(launcher) : command;
+        after = commandOutput(run, afterCommand, ['--version'], { timeout: 30_000 }, stage);
+        versionVerified = !!version(before) && !!version(after) && compare(version(after), version(before)) >= 0;
+        if (launcher && !dryRun) {
+          restorationAttempted = true;
+          if (!versionVerified) stage.rejectedNativeTarget = afterCommand;
+          afterOwner = await restoreCodexLauncher(launcher, { retainOriginalNative: !versionVerified });
+        }
+        else afterOwner = launcher?.native || fs.realpathSync(file);
+      } catch (error) {
+        stage.state = 'failed';
+        if (launcher && !dryRun && !restorationAttempted) {
+          try { stage.restoredTarget = await restoreCodexLauncher(launcher, { retainOriginalNative: true }); }
+          catch (restoreError) { stage.restorationError = restoreError.message; }
+        }
+        throw error;
+      }
       // Native launchers may re-point to a newer version, but stay in the same established root.
-      const afterOwner = fs.realpathSync(file);
       const ownerPreserved = nativeOwnerPreserved(file, owner, afterOwner, home);
       settleStage(stage, after, { versionVerified, ownerPreserved }, { currentTarget: afterOwner });
     }

package/plugin/scripts/developer-update.mjs

@@ -310,7 +310,7 @@ function knowledge(run, dryRun, runId, { brainHome, root, node }) {
 }
 export function developerUpdatePaths({ home = os.homedir(), brainHome = process.env.RUVNET_BRAIN_HOME || path.join(home, '.cache/ruvnet-brain') } = {}) {
   return { home, brainHome, config: path.join(brainHome, 'developer-update-config.json'),
-    receipt: path.join(brainHome, 'nightly-suite-update.json'), lock: path.join(brainHome, 'developer-update.lock') };
+    receipt: path.join(brainHome, 'nightly-suite-update.json'), scheduledReceipt: path.join(brainHome, 'scheduler/last-suite-attempt.json'), lock: path.join(brainHome, 'developer-update.lock') };
 }
 export function validateDeveloperUpdateConfig(value = {}) {
   const defaults = { schemaVersion: 1, channel: 'latest', scope: 'ruvnet', homebrew: false, uv: false, cargo: false, native: false, managedCallback: null, cleanup: false, preservePackages: [] };
@@ -371,12 +371,42 @@ export async function runDeveloperUpdate({ mode = 'check', home = os.homedir(),
   run.receipt = (command, args, options = {}) => dispatch(command, args, { ...options, capture: true });
   const locate = name => locateExecutable(name, { env: childEnv });
   const receipt = { schemaVersion: 1, kind: 'nightly-suite-update', runId: crypto.randomUUID(), pid: process.pid,
-    startedAt: new Date().toISOString(), mode, state: 'running', ok: false, config, steps: [], notes: [],
+    startedAt: new Date().toISOString(), mode, scheduled: mode === 'apply' && env.RUVNET_NIGHTLY === '1' && !!env.RUVNET_NIGHTLY_IDENTITY, state: 'running', ok: false, config, steps: [], notes: [],
     sourceSha256: null, ownerToken: lock.token, ownerPid: lock.ownerPid, schedulerIdentity: env.RUVNET_NIGHTLY_IDENTITY || null };
+  const scheduledAttempt = value => value?.mode === 'apply' && value.scheduled !== false && !!value.schedulerIdentity;
+  const readAttempt = file => {
+    try {
+      const stat = fs.lstatSync(file);
+      if (!stat.isFile() || stat.isSymbolicLink()) throw Error('scheduled receipt must be a regular file');
+      return read(file);
+    } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  };
+  const persistReceipt = () => {
+    // Write Activity first: if the second write fails, health still sees this newer failed attempt.
+    atomic(paths.receipt, receipt);
+    if (receipt.scheduled) {
+      try { atomic(paths.scheduledReceipt, receipt); }
+      catch (error) {
+        receipt.state = 'failed'; receipt.ok = false; receipt.error = `Scheduled receipt persistence failed: ${error.message}`;
+        atomic(paths.receipt, receipt);
+        throw error;
+      }
+    }
+  };
+  let latestMayBeReplaced = receipt.scheduled;
   try {
+    if (!receipt.scheduled) {
+      const latest = readAttempt(paths.receipt), retained = readAttempt(paths.scheduledReceipt);
+      const latestTime = Date.parse(latest?.startedAt || latest?.finishedAt || ''), retainedTime = Date.parse(retained?.startedAt || retained?.finishedAt || '');
+      if (scheduledAttempt(latest) && (!retained || !Number.isFinite(latestTime) || !Number.isFinite(retainedTime) || latestTime >= retainedTime)) {
+        // Preserve real legacy/failed evidence before a check or manual run replaces Activity.
+        atomic(paths.scheduledReceipt, latest);
+      }
+      latestMayBeReplaced = true;
+    }
     receipt.sourceSha256 = hash(fs.readFileSync(new URL(import.meta.url)));
     receipt.sourceSnapshot = Object.fromEntries(EXECUTION_MODULES.map(name => [name, hash(fs.readFileSync(new URL(name, import.meta.url)))]));
-    atomic(paths.receipt, receipt);
+    persistReceipt();
     const npm = locate('npm');
     if (!npm) throw Error('existing npm owner absent; fresh install refused');
     const prefix = run(npm, ['prefix', '-g'], { timeout: 30_000 }).trim();
@@ -386,16 +416,16 @@ export async function runDeveloperUpdate({ mode = 'check', home = os.homedir(),
     childEnv.npm_config_prefix = prefix;
     receipt.npmIdentity = { npm, prefix, root, node: process.execPath };
     receipt.before = discover(root, prefix, config.scope);
-    atomic(paths.receipt, receipt);
+    persistReceipt();
     for (const before of receipt.before) {
       const tags = before.localSource ? {} : JSON.parse(run(npm, ['view', before.name, 'dist-tags', '--json'], { timeout: 90_000 }));
       receipt.steps.push(upgradePackage(before, tags, REVIEWED_INSTALL_SCRIPTS, { run, dryRun: mode === 'check', channel: config.channel, npm, preservePackages: config.preservePackages }));
-      atomic(paths.receipt, receipt);
+      persistReceipt();
     }
     receipt.plugins = await synchronizePlugins(run, mode === 'check', receipt.notes, { home, prefix, scope: config.scope, locate, unattended: !!env.RUVNET_NIGHTLY_IDENTITY });
     if (exists(path.join(paths.brainHome, 'kb/forge-update.mjs'))) receipt.knowledge = knowledge(run, mode === 'check', receipt.runId, { brainHome: paths.brainHome, root, node: process.execPath });
     else receipt.notes.push('Brain corpus absent; fresh knowledge install excluded');
-    receipt.maintenance = await maintenance(config, run, mode === 'check', { home, brainHome: paths.brainHome, locate, node: process.execPath, progress: result => { receipt.maintenance = result; atomic(paths.receipt, receipt); } });
+    receipt.maintenance = await maintenance(config, run, mode === 'check', { home, brainHome: paths.brainHome, locate, node: process.execPath, progress: result => { receipt.maintenance = result; persistReceipt(); } });
     receipt.cleanup = cleanupNpxDuplicates({ home, globalRoot: root, enabled: config.cleanup && mode === 'apply', run });
     receipt.after = discover(root, prefix, config.scope);
     receipt.state = mode === 'check' ? 'checked' : 'completed'; receipt.ok = true;
@@ -412,7 +442,7 @@ export async function runDeveloperUpdate({ mode = 'check', home = os.homedir(),
     throw error;
   } finally {
     receipt.finishedAt = new Date().toISOString();
-    try { atomic(paths.receipt, receipt); } finally { lock.release(); }
+    try { if (latestMayBeReplaced) persistReceipt(); } finally { lock.release(); }
   }
 }
 export async function developerUpdateCli(args = process.argv.slice(2)) {

package/plugin/scripts/nightly-scheduler.mjs

@@ -252,24 +252,45 @@ export function resolveNightlyProofBundle({ brainHome, env = process.env } = {})
 }
 
 export function developerRunHealth({ brainHome, registration, now = Date.now(), maxAgeHours = 30 }) {
-  const file = path.join(brainHome, 'nightly-suite-update.json');
-  if (!fs.existsSync(file)) return { state: 'never-ran', evidence: 'No coordinated update receipt exists yet.', receipt: null };
+  const scheduled = value => value?.mode === 'apply' && value.scheduled !== false && !!value.schedulerIdentity;
+  const readReceipt = file => {
+    try {
+      const stat = fs.lstatSync(file);
+      if (!stat.isFile() || stat.isSymbolicLink()) throw Error('receipt is not a regular file');
+      return JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  };
   let receipt;
-  try { receipt = JSON.parse(fs.readFileSync(file, 'utf8')); }
-  catch (error) { return { state: 'failed', evidence: `Coordinated update receipt unreadable: ${error.message}`, receipt: null }; }
+  try {
+    const retained = readReceipt(path.join(brainHome, 'scheduler/last-suite-attempt.json'));
+    const latest = readReceipt(path.join(brainHome, 'nightly-suite-update.json'));
+    if (retained && !scheduled(retained)) throw Error('retained receipt is not a scheduled apply attempt');
+    receipt = retained || latest;
+    if (scheduled(latest)) {
+      const latestTime = Date.parse(latest.startedAt || latest.finishedAt || '');
+      const retainedTime = Date.parse(retained?.startedAt || retained?.finishedAt || '');
+      if (!retained || !Number.isFinite(latestTime) || !Number.isFinite(retainedTime) || latestTime >= retainedTime) receipt = latest;
+    }
+  } catch (error) { return { state: 'failed', evidence: `Coordinated update receipt unreadable or refused: ${error.message}`, receipt: null }; }
+  if (!receipt) return { state: 'never-ran', evidence: 'No coordinated update receipt exists yet.', receipt: null };
   const validDigest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
   const bound = validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
     && receipt.sourceSha256 === registration.updateModules?.['developer-update.mjs']?.sha256
+    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === registration.updateModules?.[name]?.sha256)
     && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || registration.updateModules?.[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === registration.updateModules?.[name]?.sha256);
   const ageHours = (now - Date.parse(receipt.finishedAt || receipt.startedAt || '')) / 3_600_000;
-  if (!bound || !Number.isFinite(ageHours)) return { state: 'failed', evidence: 'Coordinated update receipt is not bound to registered source.', receipt };
+  const times = [receipt.startedAt, receipt.finishedAt].filter(value => value !== undefined).map(value => Date.parse(value));
+  const timestampsValid = times.length > 0 && times.every(value => Number.isFinite(value) && value <= now)
+    && !(receipt.startedAt && receipt.finishedAt && Date.parse(receipt.finishedAt) < Date.parse(receipt.startedAt));
+  if (!bound) return { state: 'failed', evidence: 'Coordinated update receipt is not bound to registered source.', receipt };
+  if (!Number.isFinite(ageHours) || !timestampsValid) return { state: 'failed', evidence: 'Coordinated update receipt timestamps are invalid or future-dated.', receipt };
+  if (!scheduled(receipt) || receipt.schedulerIdentity !== registration.identity) return { state: 'never-ran', ageHours, receipt, evidence: 'No scheduled apply attempt is bound to the current registration.' };
   if (receipt.state === 'running') {
     const lock = sharedLockStatus({ brainHome });
     const live = lock.state === 'running' && lock.owner.pid === (receipt.ownerPid || receipt.pid) && lock.owner.token === receipt.ownerToken;
     return { state: live ? 'running' : 'failed', ageHours, receipt, evidence: live ? 'Coordinated updates have a live exact owner.' : 'Coordinated update owner is absent or unverified.' };
   }
   if (receipt.state === 'failed' || receipt.ok !== true) return { state: 'failed', ageHours, receipt, evidence: receipt.error || 'Coordinated updates failed.' };
-  if (receipt.mode !== 'apply' || receipt.schedulerIdentity !== registration.identity) return { state: 'never-ran', ageHours, receipt, evidence: 'Latest receipt is manual or a currency check; nightly execution remains unproven.' };
   if (receipt.state !== 'completed') return { state: 'failed', ageHours, receipt, evidence: 'Coordinated update terminal state is unverified.' };
   if (ageHours > maxAgeHours) return { state: 'stale', ageHours, receipt, evidence: `Last coordinated update is ${ageHours.toFixed(1)}h old.` };
   const verification = { ok: bound && receipt.mode === 'apply' && receipt.schedulerIdentity === registration.identity && receipt.state === 'completed' && receipt.ok === true && ageHours >= 0 && ageHours <= maxAgeHours };

package/scripts/release-qualification-contract.mjs

@@ -1,13 +1,18 @@
 // Reviewed stabilization release boundaries. Legacy tests remain developer diagnostics.
 export const RELEASE_REQUIREMENTS = Object.freeze({
   "source": [
+    {
+      "id": "public-admin-release-and-engineering-status",
+      "reason": "Latest code release stays separate from corpus identity; issue and pull-request pagination preserves the complete engineering queue and failed probes remain unknown without inventing owner action",
+      "files": ["tests/unit/explainer-api.test.mjs", "tests/unit/admin-render.test.mjs"]
+    },
     {
       "id": "source-bound-installed-update-coordinator",
       "reason": "Allowed channels and immutable Claude artifact paths reject downgrades, ambiguous registry records, changed bytes, extra active resources and escape paths; Console success requires the exact launched source closure. POSIX owner fixtures additionally enforce original-prefix installs, existing-tool-only policy, shared locks and source-bound scheduler receipts",
-      "files": ["tests/unit/developer-update-policy-portable.test.mjs", "tests/unit/plugin-artifact-proof.test.mjs", "tests/unit/console-suite-update.test.mjs"],
+      "files": ["tests/unit/developer-update-policy-portable.test.mjs", "tests/unit/plugin-artifact-proof.test.mjs", "tests/unit/console-suite-update.test.mjs", "tests/unit/developer-update-scheduled-receipt.test.mjs"],
       "platformFiles": {
-        "linux": ["tests/unit/developer-update.test.mjs"],
-        "macos": ["tests/unit/developer-update.test.mjs"]
+        "linux": ["tests/unit/developer-update.test.mjs", "tests/unit/developer-update-codex-launcher.test.mjs"],
+        "macos": ["tests/unit/developer-update.test.mjs", "tests/unit/developer-update-codex-launcher.test.mjs"]
       }
     },
     {