ruvnet-brain 4.7.18 → 4.7.20

package/README.md

@@ -9,7 +9,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 ### Discover the stack. Read the source. Build with confidence.
 
-[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.18-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
+[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.20-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
 
 **A source-grounded companion for Claude Code and Codex that helps you find and use Reuven Cohen's (rUv's) RuvNet ecosystem.**
 
@@ -255,7 +255,7 @@ uses the protected release workflow; a consumer update downloads an available ge
 does not rebuild upstream knowledge. Check `--doctor`, `SOURCE.json` and refresh receipts
 before treating an installation as current.
 
-The **4.6.0 published-corpus baseline** is **205 public stores · 165,488 public source chunks**.
+The **4.6.0 published-corpus baseline** is **205 public stores · 166,022 public source chunks**.
 Those are bundle census values, not a claim that every upstream repository is fresh today.
 Later corpus publication may advance the knowledge generation independently of code changes.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.18",
+  "version": "4.7.20",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.7.18",
+  "version": "4.7.20",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.18",
+  "version": "4.7.20",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/commands/configure.md

@@ -1,7 +1,7 @@
 ---
-description: Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible.
-updated: 2026-10-10 06:00:22 EDT
-version: 1.0.2
+description: "Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible."
+updated: 2026-10-24 18:00:00 EDT
+version: 1.0.3
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,

package/plugin/scripts/nightly-scheduler.mjs

@@ -186,7 +186,8 @@ function verifyUpdateModules(modules) {
  * the allowlisted values from env; an object is kept verbatim; null omits the field (an older registration without it).
  */
 export function installNightlyRunner({ brainHome, source, nodePath = process.execPath,
-  identity = NIGHTLY_LABEL, packageTarget, bundleTarget, env = {}, environment, moduleSource, developerSuite = !NIGHTLY_PROOF_LABEL.test(identity), dryRun = false } = {}) {
+  identity = NIGHTLY_LABEL, packageTarget, bundleTarget, env = {}, environment, moduleSource, developerSuite = !NIGHTLY_PROOF_LABEL.test(identity), dryRun = false,
+  replacedUpdateModules = null } = {}) {
   validateIdentity(identity);
   if (!source || !fs.existsSync(source)) throw new Error(`nightly runner source is missing: ${source || '(unset)'}`);
   const bytes = fs.readFileSync(source);
@@ -204,7 +205,8 @@ export function installNightlyRunner({ brainHome, source, nodePath = process.exe
   const record = { updateModules: modules, ...(developerSuite ? { mode: 'developer-suite' } : {}), schemaVersion: 2, kind: 'ruvnet-brain-nightly-scheduler', identity,
     nodePath: path.resolve(nodePath), runnerPath, runnerSha256: digest, argv: [],
     ...(environment === null ? {} : { environment: environment ?? Object.fromEntries(NIGHTLY_ENV_ALLOWLIST.filter(key => env[key] !== undefined).map(key => [key, key === 'PATH' ? automaticPath({ nodePath, home: homeOf(env), env }) : String(env[key])])) }),
-    packageTarget: normalizePackageTarget(packageTarget), bundleTarget: normalizeBundleTarget(bundleTarget, identity) };
+    packageTarget: normalizePackageTarget(packageTarget), bundleTarget: normalizeBundleTarget(bundleTarget, identity),
+    ...(Array.isArray(replacedUpdateModules) && replacedUpdateModules.length ? { replacedUpdateModules } : {}) };
   const recordPath = path.join(dir, registrationName(identity));
   if (dryRun) return { ...record, recordPath };
   const tmp = `${recordPath}.tmp-${process.pid}`;
@@ -239,6 +241,12 @@ export function nightlyModuleCurrency({ brainHome, identity = NIGHTLY_LABEL, mod
  * and the LaunchAgent command stays exactly what it was; anything else is refused and left as it was.
  */
 export const SCHEDULER_VISIBLE_FIELDS = Object.freeze(['identity', 'nodePath', 'runnerPath', 'runnerSha256', 'argv', 'environment', 'packageTarget', 'bundleTarget', 'mode']);
+/** The replaced-module history after replacing `record.updateModules` now: newest first, last 48 h, at most 20. */
+export function nextReplacedSets(record, now = Date.now()) {
+  return [{ updateModules: record.updateModules, replacedAt: new Date(now).toISOString() },
+    ...(Array.isArray(record.replacedUpdateModules) ? record.replacedUpdateModules : [])]
+    .filter((entry) => now - Date.parse(entry?.replacedAt || '') <= 48 * 3_600_000).slice(0, 20);
+}
 export function refreshNightlyModules(options = {}) {
   const currency = nightlyModuleCurrency(options);
   if (currency.state !== 'stale') return currency;
@@ -250,7 +258,11 @@ export function refreshNightlyModules(options = {}) {
   const candidate = (options.build || ((p) => installNightlyRunner({ ...p, dryRun: true })))(plan);
   const differs = SCHEDULER_VISIBLE_FIELDS.filter((key) => JSON.stringify(candidate[key] ?? null) !== JSON.stringify(record[key] ?? null));
   if (differs.length) return { ...currency, state: 'refused', reason: `refresh would change ${differs.join(', ')}; registration left as it was`, fix: NIGHTLY_ENABLE_FIX };
-  const refreshed = installNightlyRunner(plan);
+  // Remember the module set this replaces: the receipt of the night that ran on it stays valid evidence until the next
+  // night (2026-10-24: doctor said "nightly refresh FAILED" all day after a session-start update re-pointed the modules).
+  // Newest first, every set replaced in the last 48 h (a receipt older than the 30 h health window is stale anyway), at
+  // most 20: any number of refreshes before the next night keeps the set that night ran on (reviews 2026-10-24).
+  const refreshed = installNightlyRunner({ ...plan, replacedUpdateModules: nextReplacedSets(record) });
   return { ...currency, state: 'refreshed', registered: registeredModuleDigest(refreshed), fix: undefined };
 }
 
@@ -329,10 +341,19 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   } catch (error) { return { state: 'failed', evidence: `Coordinated update receipt unreadable or refused: ${error.message}`, receipt: null }; }
   if (!receipt) return { state: 'never-ran', evidence: 'No coordinated update receipt exists yet.', receipt: null };
   const validDigest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
-  const bound = validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
-    && receipt.sourceSha256 === registration.updateModules?.['developer-update.mjs']?.sha256
-    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === registration.updateModules?.[name]?.sha256)
-    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || registration.updateModules?.[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === registration.updateModules?.[name]?.sha256);
+  const boundTo = modules => Boolean(modules) && validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
+    && receipt.sourceSha256 === modules['developer-update.mjs']?.sha256
+    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === modules[name]?.sha256)
+    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || modules[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === modules[name]?.sha256);
+  // A receipt from the module set an update just replaced is still the night's proof, but only one that FINISHED before
+  // the replacement: the next scheduled run must bind to the current set.
+  // Judged by LAUNCH time: a night's own knowledge step can install a release and re-point the modules before the run
+  // records finishedAt (cross-model review 2026-10-24). A run launched after its set was replaced must bind to the new one.
+  const launched = Date.parse(receipt.startedAt || receipt.finishedAt || '');
+  const ranOnPrevious = !boundTo(registration.updateModules) && Array.isArray(registration.replacedUpdateModules)
+    && registration.replacedUpdateModules.some((entry) => Number.isFinite(Date.parse(entry?.replacedAt || ''))
+      && launched <= Date.parse(entry.replacedAt) && boundTo(entry.updateModules));
+  const bound = boundTo(registration.updateModules) || ranOnPrevious;
   const ageHours = (now - Date.parse(receipt.finishedAt || receipt.startedAt || '')) / 3_600_000;
   const times = [receipt.startedAt, receipt.finishedAt].filter(value => value !== undefined).map(value => Date.parse(value));
   const timestampsValid = times.length > 0 && times.every(value => Number.isFinite(value) && value <= now)
@@ -349,7 +370,7 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   if (receipt.state !== 'completed') return { state: 'failed', ageHours, receipt, evidence: 'Coordinated update terminal state is unverified.' };
   if (ageHours > maxAgeHours) return { state: 'stale', ageHours, receipt, evidence: `Last coordinated update is ${ageHours.toFixed(1)}h old.` };
   const verification = { ok: bound && receipt.mode === 'apply' && receipt.schedulerIdentity === registration.identity && receipt.state === 'completed' && receipt.ok === true && ageHours >= 0 && ageHours <= maxAgeHours };
-  return { state: verification.ok ? 'ok' : 'failed', verification, ageHours, receipt, evidence: verification.ok ? `Coordinated updates completed ${ageHours.toFixed(1)}h ago; ${receipt.config?.scope || 'unknown'} scope.` : 'Coordinated update timestamp or terminal evidence is invalid.' };
+  return { state: verification.ok ? 'ok' : 'failed', verification, ageHours, receipt, evidence: verification.ok ? `Coordinated updates completed ${ageHours.toFixed(1)}h ago; ${receipt.config?.scope || 'unknown'} scope.${ranOnPrevious ? ' That run used the code an update replaced since; the next night runs the update.' : ''}` : 'Coordinated update timestamp or terminal evidence is invalid.' };
 }
 
 export function refreshRunHealth({ brainHome, identity = NIGHTLY_LABEL, now = Date.now(), maxAgeHours = 30,

package/plugin/scripts/session-start-core.mjs

@@ -31,7 +31,7 @@ import { turnRecordingStatus } from './turn-outcome-capture.mjs';
 import {
   read, json, exists, mkdir, write, runNode,
 } from './session-start-fsutil.mjs';
-import { maintainerIssueEntitlement, surfaceIssuePointer } from './session-start-issue-alert.mjs';
+import { maintainerIssueEntitlement, surfaceIssuePointer, surfaceNtfyAlerts } from './session-start-issue-alert.mjs';
 import { surfaceSignals } from './session-start-signals.mjs';
 import { failureLine, FAILURE_LINE_PREFIX } from './hook-failures.mjs';
 import { brainState, health, knowledgeCurrency, mcpReadiness, KNOWLEDGE_LINE_PREFIX } from './session-start-health.mjs';
@@ -115,6 +115,7 @@ export async function runSessionStart({
       || s.startsWith(KNOWLEDGE_LINE_PREFIX)
       || s.startsWith(FOOTPRINT_LINE_PREFIX)
       || s.startsWith('[RuvNet Brain — OPEN ISSUES')
+      || s.startsWith('[RuvNet Brain — NTFY:')
       || s.startsWith('[RuvNet Brain — TURN CAPTURE]')
       || /\bopen issue\(s\)/i.test(s)
       || /^\[RuvNet Brain — external signal/i.test(s)
@@ -305,6 +306,7 @@ export async function runSessionStart({
 
     tracer.stage('issue-pointer', () => {
       surfaceIssuePointer({ stateDir, emit, now, env, home, platform, cwd });
+      surfaceNtfyAlerts({ stateDir, emit, now, env, home, platform, cwd });
     });
     tracer.stage('signal-surface', () => {
       surfaceSignals({ env, cwd, stateDir, hookDir, emit, now });

package/plugin/scripts/session-start-issue-alert.mjs

@@ -75,3 +75,45 @@ export function surfaceIssuePointer({ stateDir, emit, now, env, home, platform,
     emit(`[RuvNet Brain — OPEN ISSUES: ${open.length} on ${status.repo}${breachNote}, checked ${ageHours.toFixed(1)}h ago — full detail: node scripts/issue-watch.mjs]`);
   } catch { /* advisory only — a broken cache read must never affect the session */ }
 }
+
+/**
+ * The owner's ntfy alerts that still need action (scripts/ntfy-inbox.mjs keeps the list; owner, 2026-10-25: "I don't
+ * want to be in the middle of this equation where I'm having to tell you what's broken"). Same maintainer gate as the
+ * issue pointer; one line, naming the count and the three newest, with the instruction to handle them first.
+ */
+export function surfaceNtfyAlerts({ stateDir, emit, env, home, platform, cwd, now = Date.now() }) {
+  try {
+    if (!maintainerIssueEntitlement(env, home, 'stuinfla/ruvnet-brain', platform) || !isMaintainerRepo(cwd)) return;
+    // The reader writes a few-byte summary (scripts/ntfy-inbox.mjs writeSummary) so a large alert list can never
+    // push this banner past its read limit; the detailed list is only a fallback for an older reader.
+    let total = 0; let kinds = {};
+    const summaryPath = path.join(stateDir, 'ntfy-open-summary.json');
+    const summary = (() => { try { return fs.statSync(summaryPath).size <= 4096 ? json(summaryPath) : null; } catch { return null; } })();
+    // The summary is written before the list; if the list is newer anyway (an interrupted write), trust the list.
+    // Compare the files' own write times (the summary's `at` is when the poll started, which can be minutes earlier).
+    const listNewer = (() => { try { return fs.statSync(path.join(stateDir, 'ntfy-open-alerts.json')).mtimeMs > fs.statSync(summaryPath).mtimeMs + 5000; } catch { return false; } })();
+    let dropped = 0;
+    if (summary && Number.isInteger(summary.open) && !listNewer) {
+      if (Number.isInteger(summary.dropped)) dropped = summary.dropped;
+      total = summary.open;
+      for (const [k, n] of Object.entries(summary.kinds || {})) if (['job', 'ci', 'issue', 'pr', 'other'].includes(k) && Number.isInteger(n)) kinds[k] = n;
+    } else {
+      const file = path.join(stateDir, 'ntfy-open-alerts.json');
+      let size = 0;
+      try { size = fs.statSync(file).size; } catch { return; }
+      // Too big to read here is still news: say so rather than staying silent.
+      if (size > MAX_STATUS_BYTES) { emit('[RuvNet Brain — NTFY: open alerts present (list too large to summarise here). Details: node scripts/ntfy-inbox.mjs --open]'); return; }
+      const open = (json(file, []) || []).filter((a) => a && !a.closedAt);
+      total = open.length;
+      // Counts by kind only, never message text: anyone who learns the topic can post to it, so a title here would
+      // be a way to put words into the session (review 2026-10-25). The owner's tool prints the details.
+      for (const a of open) { const k = ['job', 'ci', 'issue', 'pr'].includes(a.kind) ? a.kind : 'other'; kinds[k] = (kinds[k] || 0) + 1; }
+    }
+    if (!total && !dropped) return;
+    const summaryText = Object.entries(kinds).map(([k, n]) => `${n} ${k}`).join(', ');
+    const polled = json(path.join(stateDir, 'ntfy-inbox-state.json'), {})?.polledAt;
+    const age = polled ? `, read ${((now - Date.parse(polled)) / 3_600_000).toFixed(1)}h ago` : '';
+    const over = dropped ? `; ${dropped} more dropped past the cap` : '';
+    emit(`[RuvNet Brain — NTFY: ${total} open alert(s) (${summaryText || 'none listed'})${over}${age}. Details: node scripts/ntfy-inbox.mjs --open]`);
+  } catch { /* advisory only */ }
+}

package/scripts/codex-hook-trust-reconcile.mjs

@@ -5,7 +5,103 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
-import { codexHookIdentities } from './codex-hook-trust.mjs';
+import zlib from 'node:zlib';
+import { codexHookIdentities, codexPluginContentHash } from './codex-hook-trust.mjs';
+
+/**
+ * sha256 of every regular file under package/plugin/ in a verified npm tarball, read in memory (ustar with pax `path`
+ * records; nothing is extracted or written). Strict: a bad header checksum, a non-octal size, a body past the end, or
+ * any entry type other than file, directory or pax is refused rather than guessed (review 2026-10-24).
+ */
+export function publishedPluginFiles(archive) {
+  const tar = zlib.gunzipSync(archive);
+  const files = new Map();
+  const field = (b) => { const i = b.indexOf(0); return (i < 0 ? b : b.subarray(0, i)).toString('utf8'); };
+  const octal = (b, what) => { const t = field(b).trim(); if (!/^[0-7]+$/.test(t)) throw new Error(`Published archive has a non-octal ${what}`); return parseInt(t, 8); };
+  const paxRecords = (body) => {
+    const out = {}; let i = 0;
+    while (i < body.length) {
+      const space = body.indexOf(0x20, i);
+      if (space < 0) throw new Error('Published archive has a malformed pax record');
+      const len = Number(body.subarray(i, space).toString('ascii'));
+      if (!Number.isSafeInteger(len) || len <= space - i || i + len > body.length || body[i + len - 1] !== 0x0a) throw new Error('Published archive has a malformed pax record');
+      const rec = body.subarray(space + 1, i + len - 1).toString('utf8');
+      const eq = rec.indexOf('=');
+      if (eq < 1) throw new Error('Published archive has a malformed pax record');
+      out[rec.slice(0, eq)] = rec.slice(eq + 1);
+      i += len;
+    }
+    return out;
+  };
+  let pax = null; let off = 0;
+  for (; off + 512 <= tar.length;) {
+    const header = tar.subarray(off, off + 512);
+    if (header.every((b) => b === 0)) break;
+    const sum = header.reduce((n, b, i) => n + (i >= 148 && i < 156 ? 32 : b), 0);
+    if (octal(header.subarray(148, 156), 'checksum') !== sum) throw new Error('Published archive header checksum mismatch');
+    const size = octal(header.subarray(124, 136), 'size');
+    const type = header[156] === 0 ? '0' : String.fromCharCode(header[156]);
+    const prefix = field(header.subarray(345, 500));
+    const name = pax?.path ?? (prefix ? `${prefix}/${field(header.subarray(0, 100))}` : field(header.subarray(0, 100)));
+    if (off + 512 + size > tar.length) throw new Error('Published archive entry runs past the end');
+    const body = tar.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+    if (type === 'x') { pax = paxRecords(body); continue; }
+    if (type === 'g') { pax = null; continue; }
+    pax = null;
+    if (type === '5') continue;
+    if (type !== '0') throw new Error(`Published archive has an unsupported entry type ${JSON.stringify(type)}`);
+    if (name.startsWith('package/plugin/')) files.set(name.slice('package/plugin/'.length), digest(body));
+  }
+  if (!files.size) throw new Error('Published archive carries no plugin files');
+  return files;
+}
+
+// Codex writes this under the installed plugin itself: one SKILL.md per migrated slash command (openai/codex
+// rust-v0.164.0 codex-rs/core-plugins/src/command_migration.rs render_command_skill). It is not release bytes, so it is
+// accepted only when every byte is what that template renders from the release's own verified command file.
+const CODEX_GENERATED = 'migrated-command-skills';
+function commandParts(text) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/.exec(text);
+  if (!m) return null;
+  const d = /^description:\s*"((?:[^"\\]|\\.)*)"\s*$/m.exec(m[1]);
+  return d ? { description: JSON.parse(`"${d[1]}"`).trim(), body: m[2] } : null;
+}
+function expectedGeneratedSkill(skillName, sourceName, commandText) {
+  const parts = commandParts(commandText);
+  if (!parts || !parts.description) return null;
+  const body = parts.body.trim() || 'No command template body was found.';
+  return `---\nname: ${JSON.stringify(skillName)}\ndescription: ${JSON.stringify(parts.description)}\n---\n\n# ${skillName}\n\n`
+    + `Use this skill when the user asks to run the migrated source command \`${sourceName}\`.\n\n## Command Template\n\n${body}\n`;
+}
+
+/**
+ * ONE pass over the installed plugin: each file's bytes are checked against the verified release (or, for Codex's own
+ * generated skills, against the template rendered from the verified command file) and the SAME bytes feed the content
+ * fingerprint returned. Throws on any changed, extra or missing file, link, or generated file that is not exactly
+ * Codex's rendering.
+ */
+export function verifiedPluginContentHash(root, pluginFiles, { platform = process.platform } = {}) {
+  const seen = new Set(); const commands = new Map(); const generated = new Map();
+  const genPrefix = `.codex-plugin/${CODEX_GENERATED}/`;
+  const hash = codexPluginContentHash(root, { platform, onFile: (rel, bytes) => {
+    if (rel.startsWith(genPrefix)) { generated.set(rel.slice(genPrefix.length), bytes); return; }
+    if (pluginFiles.get(rel) !== digest(bytes)) throw new Error(`Installed plugin file differs from the verified release: ${rel}`);
+    seen.add(rel);
+    if (/^commands\/[^/]+\.md$/.test(rel)) commands.set(rel.slice('commands/'.length, -3), bytes.toString('utf8'));
+  } });
+  const missing = [...pluginFiles.keys()].filter((k) => !seen.has(k));
+  if (missing.length) throw new Error(`Installed plugin lacks ${missing.length} released file(s), e.g. ${missing[0]}`);
+  for (const [rel, bytes] of generated) {
+    const m = /^source-command-([a-z0-9-]+)\/SKILL\.md$/.exec(rel);
+    const source = m && commands.get(m[1]);
+    const expected = source && expectedGeneratedSkill(`source-command-${m[1]}`, m[1], source);
+    if (!expected || bytes.toString('utf8') !== expected) throw new Error(`Codex-generated file is not the rendering of a verified release command: ${rel}`);
+  }
+  return hash;
+}
+/** Kept for callers that only need the yes/no: the installed plugin is the verified release. */
+export function installedPluginMatchesRelease(root, pluginFiles) { verifiedPluginContentHash(root, pluginFiles); return true; }
 
 /** Authenticate exact published package bytes before reading one archive member. No extraction/install. */
 export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetcher = globalThis.fetch,
@@ -43,7 +139,9 @@ export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetc
       { input: archive, timeout: Math.min(remaining, 3000), maxBuffer: 256 * 1024 });
     if (result.error || result.status !== 0 || !result.stdout?.length) throw new Error('Platform tar cannot read exact published hooks entry');
     if (!codexHookIdentities(JSON.parse(result.stdout)).size) throw new Error('Published native hooks are invalid');
-    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout) },
+    let pluginFiles = null;
+    try { pluginFiles = publishedPluginFiles(archive); } catch { pluginFiles = null; /* content trust is then refused, never guessed */ }
+    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout), pluginFiles },
       metadataUrl, tarballUrl, archiveBytes: archive.length };
   } catch (error) { return blocked(error.message); }
 }
@@ -142,9 +240,14 @@ const rowsFor = (response) => {
   if (!Array.isArray(response?.data)) throw new Error('Native hook registry unavailable');
   return response.data.flatMap((r) => r.hooks || []).filter((r) => r.pluginId === OWNER);
 };
-function assertRegistry(rows, identities) {
+// Codex <0.164: currentHash is the declaration hash. 0.164+: "<declaration hash>/<plugin content hash>" (discovery.rs).
+const splitHash = (current) => { const [declaration, content = null] = String(current || '').split('/'); return { declaration, content }; };
+function assertRegistry(rows, identities, contentHash = null) {
   if (rows.length !== identities.size || new Set(rows.map((r) => r.key)).size !== identities.size
-    || rows.some((row) => identities.get(row.key) !== row.currentHash)) throw new Error('Native registry differs from verified released artifact');
+    || rows.some((row) => identities.get(row.key) !== splitHash(row.currentHash).declaration)) throw new Error('Native registry differs from verified released artifact');
+  if (rows.some((row) => splitHash(row.currentHash).content !== null && splitHash(row.currentHash).content !== contentHash)) {
+    throw new Error('Native plugin content fingerprint differs from the verified installed plugin');
+  }
 }
 
 function otherSettings(config, keys) {
@@ -153,6 +256,7 @@ function otherSettings(config, keys) {
     const state = clone?.hooks?.state?.[key];
     if (state && typeof state === 'object') {
       delete state.trusted_hash;
+      delete state.trusted_content_hash;
       if (!Object.keys(state).length) delete clone.hooks.state[key];
     }
   }
@@ -170,7 +274,7 @@ function otherSettings(config, keys) {
 export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, installedVersion, hooksPath,
   configPath, nativeBinary, cwd = process.cwd(), backupDir = path.join(path.dirname(configPath || ''), 'backups'),
   rpc: suppliedRpc, timeoutMs = 10000 } = {}) {
-  let client; let wrote = false; let writeAttempted = false; let backupPath;
+  let client; let wrote = false; let writeAttempted = false; let backupPath; let contentRefusal = 'Verified release plugin files unavailable';
   try {
     if (!releaseIdentity || !/^\d+\.\d+\.\d+$/.test(releaseIdentity.version || '')
       || installedVersion !== releaseIdentity.version || !/^[a-f0-9]{64}$/.test(releaseIdentity.hooksSha256 || '')
@@ -181,9 +285,19 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     if (digest(bytes) !== releaseIdentity.hooksSha256) return blocked('Installed hooks differ from verified release');
     const identities = codexHookIdentities(JSON.parse(bytes));
     if (!identities.size) return blocked('Verified artifact has no native hooks');
+    // Codex 0.164+ also pins the installed plugin folder. Approve that fingerprint only for a folder that holds exactly
+    // the verified release's plugin/ bytes (Codex's own generated migrations aside); otherwise refuse, never guess.
+    const pluginRoot = path.dirname(path.dirname(hooksPath));
+    let contentHash = null;
+    if (releaseIdentity.pluginFiles instanceof Map) {
+      try { contentHash = verifiedPluginContentHash(pluginRoot, releaseIdentity.pluginFiles); }
+      catch (error) { contentHash = null; contentRefusal = error.message; }
+    }
     if (!suppliedRpc) client = await nativeClient(nativeBinary, cwd, Date.now() + Math.min(timeoutMs, 20000), configPath);
     const rpc = suppliedRpc || client.rpc;
-    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(before, identities);
+    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] }));
+    if (!contentHash && before.some((row) => splitHash(row.currentHash).content !== null)) return blocked(contentRefusal);
+    assertRegistry(before, identities, contentHash);
     const disabled = before.filter((r) => r.enabled === false).map((r) => r.key).sort();
     if (before.some((r) => !['trusted', 'modified', 'untrusted', 'managed'].includes(r.trustStatus))) return blocked('Unknown native trust state');
     const pending = before.filter((r) => r.enabled === true && ['modified', 'untrusted'].includes(r.trustStatus));
@@ -194,8 +308,11 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     // Config stays memory-only except the private backup. No logging of effective config values.
     const prior = fs.readFileSync(configPath);
     backupPath = privateBackup(configPath, prior, backupDir);
-    const edits = pending.map((r) => ({ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
-      value: identities.get(r.key), mergeStrategy: 'replace' }));
+    const edits = pending.flatMap((r) => [{ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
+      value: identities.get(r.key), mergeStrategy: 'replace' },
+      // The second approval Codex 0.164 stores separately (plugin_trust.rs matches_hash).
+      ...(splitHash(r.currentHash).content !== null ? [{ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_content_hash`,
+        value: contentHash, mergeStrategy: 'replace' }] : [])]);
     writeAttempted = true;
     await rpc('config/batchWrite', { filePath: configPath, expectedVersion: users[0].version, reloadUserConfig: true, edits });
     wrote = true;
@@ -203,7 +320,7 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     const afterUsers = (afterRead.layers || []).filter((r) => r.name?.type === 'user' && r.name.file === configPath);
     if (afterUsers.length !== 1 || otherSettings(users[0].config, pending.map((r) => r.key))
       !== otherSettings(afterUsers[0].config, pending.map((r) => r.key))) throw new Error('Unrelated config changed; no whole-file rollback attempted');
-    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities);
+    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities, contentHash);
     if (JSON.stringify(after.filter((r) => r.enabled === false).map((r) => r.key).sort()) !== JSON.stringify(disabled)
       || after.some((r) => r.enabled === true && !['trusted', 'managed'].includes(r.trustStatus))) throw new Error('Native trust repair verification incomplete');
     return { state: 'registry-verified', changed: true, editedTrustHashes: edits.length,

package/scripts/codex-hook-trust.mjs

@@ -23,6 +23,7 @@
 // that one hook `modified`, the other ten still `trusted`. currentHash from `hooks/list` equals
 // codexHookHash() below for every hook (tests/unit/codex-hook-trust.test.mjs pins the real values).
 import crypto from 'node:crypto';
+import nodeFs from 'node:fs';
 
 const EVENT_LABEL = Object.freeze({
   PreToolUse: 'pre_tool_use', PermissionRequest: 'permission_request', PostToolUse: 'post_tool_use',
@@ -92,3 +93,47 @@ export function codexTrustChanges(prevHooksFile, nextHooksFile, keySource) {
 export const CODEX_TRUST_ACTION = 'Start Codex (interactive, in any project). At the "Hooks need review" prompt choose'
   + ' "Trust all and continue" — or type /hooks and trust each RuvNet Brain hook. Until then Codex skips them'
   + ' (codex exec never asks). Then re-run npx ruvnet-brain --doctor.';
+
+/**
+ * Codex's plugin bundle fingerprint, ported byte for byte from openai/codex rust-v0.164.0
+ * codex-rs/hooks/src/engine/plugin_fingerprint.rs plugin_content_hash(). Since 0.164 a plugin hook's
+ * `currentHash` is "<declaration hash>/<this hash>" and its approval stores the two separately
+ * (`trusted_hash` + `trusted_content_hash`, plugin_trust.rs matches_hash). Measured 2026-10-24: every Brain update
+ * left all 13 Codex hooks "modified" because the Brain wrote only the declaration hash.
+ * Walk: depth-first, entries sorted by file name (bytes), skipping __pycache__, .venv, *.pyc, *.egg-info; each entry
+ * hashes its root-relative path (u64 LE length + bytes), then "directory", or "file" + u64 LE size + contents.
+ * Anything that is neither (a symlink) throws, as it does in Codex.
+ */
+export function codexPluginContentHash(root, { fsImpl = null, onFile = null, platform = process.platform } = {}) {
+  const fs = fsImpl || nodeFs;
+  const u64 = (n) => { const b = Buffer.alloc(8); b.writeBigUInt64LE(BigInt(n)); return b; };
+  if (!fs.lstatSync(root).isDirectory()) throw new Error('plugin root is not a directory');
+  const hash = crypto.createHash('sha256').update('codex-plugin-bundle-v1');
+  // Rust hashes the OS-native relative path bytes: '\\' separators on Windows (review 2026-10-24).
+  const sep = platform === 'win32' ? '\\' : '/';
+  const pending = [''];
+  while (pending.length) {
+    const rel = pending.pop();
+    const base = rel.split('/').pop();
+    if (rel && (base === '__pycache__' || base === '.venv' || base.endsWith('.pyc') || base.endsWith('.egg-info'))) continue;
+    const name = Buffer.from(rel.split('/').join(sep));
+    hash.update(u64(name.length)).update(name);
+    const full = rel ? `${root}/${rel}` : root;
+    const st = fs.lstatSync(full);
+    if (st.isDirectory()) {
+      hash.update('directory');
+      const entries = fs.readdirSync(full).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+      for (const entry of entries.reverse()) pending.push(rel ? `${rel}/${entry}` : entry);
+    } else if (st.isFile()) {
+      const bytes = fs.readFileSync(full);
+      if (bytes.length !== st.size) throw new Error('plugin file changed while fingerprinting');
+      // The caller sees exactly the bytes that enter the fingerprint: one read, so nothing can change between a check
+      // and the hash it approves (review 2026-10-24: a separate verification pass was a swap window).
+      onFile?.(rel, bytes);
+      hash.update('file').update(u64(st.size)).update(bytes);
+    } else {
+      throw new Error(`unsupported plugin entry type: ${full}`);
+    }
+  }
+  return `sha256:${hash.digest('hex')}`;
+}

package/scripts/issue-watch.mjs

@@ -46,6 +46,21 @@ export const OWNER_LOGIN = 'stuinfla';
 // moved here.)
 export const BOT_MARKER = '🤖 Automated';
 const SLA_HOURS = 4;
+// WHO IS WAITING (owner, 2026-10-25: "10,747 notifications"). An issue opened by the owner's own account or a bot is
+// work the owner's automation filed (Dream Cycle, dependabot), not a person waiting for an answer: it never pages
+// and gets no acknowledgment. Only a person's issue pages.
+const AUTOMATION_AUTHORS = new Set([OWNER_LOGIN, 'dependabot', 'dependabot[bot]', 'github-actions', 'github-actions[bot]', 'app/dependabot']);
+export const isPersonIssue = (issue) => !AUTOMATION_AUTHORS.has(String(issue?.author?.login || '').toLowerCase())
+  && !issue?.author?.is_bot && !String(issue?.author?.login || '').endsWith('[bot]');
+// ONE morning summary instead of a page per issue per 4 hours: the first run at or after 9 a.m. Eastern sends it,
+// only if a person's issue is still waiting, and at most once per Eastern calendar day.
+const DIGEST_HOUR_ET = 9;
+const etParts = (ms) => Object.fromEntries(new Intl.DateTimeFormat('en-US', { timeZone: 'America/New_York', year: 'numeric',
+  month: '2-digit', day: '2-digit', hour: '2-digit', hour12: false }).formatToParts(new Date(ms)).map((p) => [p.type, p.value]));
+export function digestDue(lastDay, now) {
+  const p = etParts(now); const day = `${p.year}-${p.month}-${p.day}`;
+  return { due: Number(p.hour) % 24 >= DIGEST_HOUR_ET && lastDay !== day, day };
+}
 const STATE_PATH = process.env.ISSUE_WATCH_STATE
   || path.join(os.homedir(), '.claude', 'ruvnet-brain', 'issue-watch-state.json');
 // A compact, always-current snapshot the SessionStart hook surfaces (2026-07-17). ntfy alerts are
@@ -78,7 +93,9 @@ function ghJson(args) {
 /** Resolve the ntfy topic the same way the rest of the repo does: env, then the machine-wide
  * cache file, then the repo .env — see scripts/notify.sh / scripts/job-heartbeat.sh / scripts/nightly-watchdog.mjs. */
 function resolveTopic() {
-  if (process.env.NTFY_TOPIC) return process.env.NTFY_TOPIC;
+  // Set-but-EMPTY is an explicit opt-out (job-heartbeat.sh's convention): tests use it, and it must never fall
+  // through to the repo's real .env topic (2026-10-25: a unit test read the owner's topic that way).
+  if (process.env.NTFY_TOPIC !== undefined) return process.env.NTFY_TOPIC || null;
   try {
     const t = fs.readFileSync(path.join(os.homedir(), '.cache', 'ruvnet-brain', 'ntfy-topic'), 'utf8').trim();
     if (t) return t;
@@ -133,7 +150,7 @@ export function judgeIssue(issue, comments, now) {
 
 export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}) {
   const issues = ghJson(['issue', 'list', '--repo', repo, '--state', 'open', '--json',
-    'number,title,createdAt,comments,updatedAt']);
+    'number,title,createdAt,comments,updatedAt,author']);
 
   const state = loadState();
   const results = [];
@@ -144,17 +161,23 @@ export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}
     const { ageHours, ownerComment, breach } = judgeIssue(issue, detail.comments || [], now);
     const url = `https://github.com/${repo}/issues/${issue.number}`;
     const key = String(issue.number);
-    const last = state[key]?.lastAlertAt ? Date.parse(state[key].lastAlertAt) : null;
-    const dueForAlert = breach && (!last || (now - last) / 3_600_000 >= SLA_HOURS);
+    // A person's issue pages ONCE when it first passes the SLA, never again (it used to repeat every 4 h, forever,
+    // which with ~14 old issues and an hourly run was most of the 10,747 notifications). The morning digest below
+    // carries whatever is still waiting. An existing lastAlertAt means that one page already went out.
+    const person = isPersonIssue(issue);
+    const dueForAlert = person && breach && !state[key]?.lastAlertAt;
     // First sighting → page once, immediately (rule 2 in the header). Delivery-derived like
     // lastAlertAt: state is only written when the push actually went out, so a failed push
     // retries next run instead of burying the sighting.
     const firstSighting = !state[key];
-    // Acknowledgment delivery is not page delivery. Retry each missing channel independently.
-    const needsNewPage = !state[key]?.newAlertAt;
-    const needsAck = !state[key]?.ackAt;
+    // Acknowledgment delivery is not page delivery. Retry each missing channel independently. Neither applies to an
+    // issue the owner's automation opened.
+    // Arrival is paged once, instantly, by .github/workflows/ntfy-alerts.yml (the `issues: opened` event). Paging it
+    // here too sent every new issue twice (review 2026-10-25), so this watcher owns only the SLA page and the digest.
+    const needsNewPage = false;
+    const needsAck = person && !state[key]?.ackAt;
 
-    results.push({ number: issue.number, title: issue.title, ageHours, ownerComment, breach, dueForAlert, firstSighting, url });
+    results.push({ number: issue.number, title: issue.title, ageHours, ownerComment, breach, dueForAlert, firstSighting, url, person });
 
     if (needsNewPage || needsAck) {
       if (dryRun) {
@@ -215,6 +238,22 @@ export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}
     }
   }
 
+  // The morning digest: one notification naming every person's issue still unanswered, oldest first.
+  const waiting = results.filter((r) => r.person && r.breach).sort((a, b) => b.ageHours - a.ageHours);
+  const digest = digestDue(state._digest?.day, now);
+  if (waiting.length && digest.due) {
+    const title = `Waiting on a reply: ${waiting.length} contributor issue${waiting.length === 1 ? '' : 's'}`;
+    const body = waiting.slice(0, 8).map((r) => `#${r.number} (${fmtAge(r.ageHours)}) ${r.title.slice(0, 70)}`).join('\n')
+      + (waiting.length > 8 ? `\n…and ${waiting.length - 8} more` : '') + `\nhttps://github.com/${repo}/issues`;
+    if (dryRun) alertsSent.push({ kind: 'digest', sent: false, reason: 'dry-run', count: waiting.length });
+    else {
+      const topic = resolveTopic();
+      const sent = topic ? await pushNtfy(topic, { title, body, priority: 'default', tags: 'clipboard' }) : false;
+      if (sent) state._digest = { day: digest.day, sentAt: new Date(now).toISOString(), count: waiting.length };
+      alertsSent.push({ kind: 'digest', sent, count: waiting.length, reason: topic ? null : 'no ntfy topic configured' });
+    }
+  }
+
   if (!dryRun) saveState(state);
 
   return { results, alertsSent, checkedAt: new Date(now).toISOString() };
@@ -353,8 +392,10 @@ async function main() {
       if (r.dueForAlert) {
         const alert = output.alertsSent.find((a) => a.number === r.number && a.kind === 'sla-breach');
         console.log(`   ${dryRun ? '[DRY-RUN] would push ntfy alert' : alert?.sent ? 'ntfy alert pushed' : `ntfy alert NOT sent (${alert?.reason})`}`);
+      } else if (r.breach && !r.person) {
+        console.log('   opened by the owner\'s own automation — never paged');
       } else if (r.breach) {
-        console.log(`   already alerted within the last ${SLA_HOURS}h — not repeating`);
+        console.log('   already paged once — listed in the morning summary until answered');
       }
       console.log('');
     }