ruvnet-brain 4.7.21 → 4.7.23

package/scripts/release-qualification-contract.mjs

@@ -345,6 +345,24 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "reason": "Complete outbox tails replay and accepted pending journal events survive capacity pressure without silent deletion",
       "files": [
       ]
+    },
+    {
+      "id": "open-issue-fixes-4-7-22",
+      "reason": "Reporter-filed defects stay fixed: completion evidence never binds a masked or negated check and a masked check is an advisory, not a false 'no check ran' stop; the boot surface of a recovered Codex host is proven per changed path; Console fleet and lesson counts match by store identity and never show unknown as zero; one project-scope rule is shared by the lesson gate and the Console; a refused or unreadable memory restore is reported as such and an aborted Ruflo call leaves no child process",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/unit/continuation-gate-codex-transcript.test.mjs", "tests/unit/codex-boot-surface-proof.test.mjs", "tests/unit/console-activity-fleet-dedupe.test.mjs", "tests/unit/console-activity-identity.test.mjs", "tests/unit/console-activity-lessons.test.mjs", "tests/unit/lesson-gate.test.mjs", "tests/unit/ruflo-memory-session.test.mjs"],
+        "macos": ["tests/unit/continuation-gate-codex-transcript.test.mjs", "tests/unit/codex-boot-surface-proof.test.mjs", "tests/unit/console-activity-fleet-dedupe.test.mjs", "tests/unit/console-activity-identity.test.mjs", "tests/unit/console-activity-lessons.test.mjs", "tests/unit/lesson-gate.test.mjs", "tests/unit/ruflo-memory-session.test.mjs"]
+      }
+    },
+    {
+      "id": "issue-autofix-bounded-writer",
+      "reason": "The unattended issue fixer (ADR-107) stays inside its authority: kill switch, single-writer lock, deny-by-default editable paths, the static malware and secret scan, the manifest/lockfile/pack/audit night gate, the red-team judge, restricted tool-less LLM stages, the macOS sandbox for model-written code (macOS only), never-weakened tests, independent verifier, resumable never-doubled release steps, no force or merge, owner-marker-prefixed comments, personal notes that are never boilerplate or repeated, and a registry and LaunchAgent that match. It runs on the owner's macOS launchd, so it is qualified on macOS and Linux only, the same scope as the ntfy inbox reader",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/unit/issue-autofix-policy.test.mjs", "tests/unit/issue-autofix-agents.test.mjs", "tests/unit/issue-autofix-release.test.mjs", "tests/unit/issue-autofix-release-ship.test.mjs", "tests/unit/issue-autofix-comment.test.mjs", "tests/unit/issue-autofix-deploy.test.mjs", "tests/unit/issue-autofix-security.test.mjs", "tests/unit/issue-autofix-notes.test.mjs", "tests/unit/issue-autofix-gate.test.mjs", "tests/unit/issue-autofix-night.test.mjs"],
+        "macos": ["tests/unit/issue-autofix-policy.test.mjs", "tests/unit/issue-autofix-agents.test.mjs", "tests/unit/issue-autofix-release.test.mjs", "tests/unit/issue-autofix-release-ship.test.mjs", "tests/unit/issue-autofix-comment.test.mjs", "tests/unit/issue-autofix-deploy.test.mjs", "tests/unit/issue-autofix-security.test.mjs", "tests/unit/issue-autofix-notes.test.mjs", "tests/unit/issue-autofix-gate.test.mjs", "tests/unit/issue-autofix-night.test.mjs", "tests/unit/issue-autofix-sandbox.test.mjs"]
+      }
     }
   ],
   "integration": [
@@ -367,6 +385,11 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "reason": "Retired 2026-10-12: the learning queue, flush worker and Console queue recovery were deleted (owner ruling: hooks only call rUv's memory tools); learning writes are covered by canonical-learning-capture",
       "files": []
     },
+    {
+      "id": "release-prepush-shift-left",
+      "reason": "The explicit release pre-push gate collects every failure with per-check timing, reads the newest corpus generation's public census over HTTP Range (refusing zip64, unknown compression and CRC mismatch), names each stale claim surface with its old and new number, refuses stray added artifacts with anchored patterns, selects text-anchored tests for changed source, and before dispatch requires the preflight's sealed generation to still be the newest",
+      "files": ["tests/unit/release-prepush.test.mjs", "tests/unit/generation-census.test.mjs"]
+    },
     {
       "id": "canonical-progression-store",
       "reason": "Actual adopted canonical storage, exact readback, and concurrent session restoration retain consent and complete history",
@@ -441,6 +464,24 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "reason": "POSIX non-root permission refusal, capacity-pressure reporting and recovery preserve all accepted pending continuity events",
       "files": [
       ]
+    },
+    {
+      "id": "open-issue-fixes-4-7-22-integration",
+      "reason": "A named release over an existing install moves, skips truthfully or warns on a downgrade instead of reporting a false lookup failure; the Ruflo memory hooks honour the absolute deadline and abort, kill the whole child process group, and never report a refused or partly unreadable restore as restored",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/integration/stale-install-trap.test.mjs", "tests/integration/ruflo-memory-hooks.test.mjs"],
+        "macos": ["tests/integration/stale-install-trap.test.mjs", "tests/integration/ruflo-memory-hooks.test.mjs"]
+      }
+    },
+    {
+      "id": "issue-autofix-simulated-end-to-end",
+      "reason": "The whole autofix night (select, AIDefence screen, plan, build, scan, sandboxed test validity, red-team, verify, one batched release, push, pull request, fast-forward, dispatch, terminal check, one personal note per person) runs against a file:// origin with a fake gh and fake claude; hostile fixes (obfuscated payload, new dependency, off-allowlist edit, red-team flag, new audit advisory) never ship, one failing fix never blocks the others, a dropped connection or the kill switch pauses and the next run resumes without a second push or dispatch, and only a red after main moved halts. macOS and Linux only (the job is the owner's launchd tool)",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/integration/issue-autofix-simulate.test.mjs", "tests/integration/issue-autofix-simulate-night.test.mjs"],
+        "macos": ["tests/integration/issue-autofix-simulate.test.mjs", "tests/integration/issue-autofix-simulate-night.test.mjs"]
+      }
     }
   ]
 });

package/scripts/wired-check.mjs

@@ -172,6 +172,10 @@ const STANDALONE = [
   // plist's own ProgramArguments on 2026-07-23, not assumed from the header comment alone:
   ['clear-claude-tmp', 'launchd, every 3h (out-of-repo scheduler) — confirmed live: '
     + 'com.stuartkerr.clear-claude-tmp.plist is loaded and its ProgramArguments invoke this exact file'],
+  ['issue-autofix', 'launchd, daily 10:30 (out-of-repo scheduler, ADR-107): deploy/com.ruvnet.issue-autofix.plist '
+    + 'ProgramArguments invoke scripts/issue-fix.mjs --mode autofix through scripts/job-heartbeat.sh, and issue-fix.mjs '
+    + 'dynamically imports this file for that mode. Off unless the repository variable ISSUE_AUTOFIX is exactly on; '
+    + 'the owner arms it after the dry-run simulation and a supervised live dry-run'],
   ['nightly-gists', 'manual re-embed of the developer checkout gists store (the launchd job '
     + 'com.ruvnet.brain-gists was retired 2026-10-26: no installed brain reads that store)'],
   ['nightly-wrapper', 'author-run maintenance harness, deliberately unscheduled; refuses primary, nested, and dirty worktrees'],
@@ -226,6 +230,8 @@ const STANDALONE = [
     + 'starts themselves (--url http://127.0.0.1:.../page.html, via Playwright) — needs a live '
     + 'rendered page, not a static diff, so it is a dev-loop tool like gen-console-images.mjs, not a '
     + 'CI step'],
+  ['recall-latency-probe', 'human-run measurement (#429): times prompt recall and SessionStart restore against a real '
+    + 'project store and exits 1 outside the budgets; it reads the owner\'s live store and loads the machine, so no scheduler runs it'],
   ['dev-plugin-link', 'developer convenience CLI — its own header: "Users never run it." Hot-links '
     + 'the cached plugin install to the working tree so hook edits apply without a CC restart'],
 
@@ -342,11 +348,13 @@ const HELD = {
     + 'ADR-028 and 4.0-READINESS §4 both name this the single largest 4.0 gap. HELD because the fix is a '
     + 'real decision — one in-session consumer that speaks unprompted, with a one-action permanent silence '
     + '— not a line of wiring.',
-  'issue-fix': 'the GitHub-issue AUTO-FIXER, built but intentionally NOT wired. Verified 2026-07-23: '
-    + 'issue-watch.yml runs only issue-watch.mjs (which LISTS issues), and issue-watch.mjs spawns only '
-    + 'gh/sleep — never this. Its own yml comment says why it is gated: it "spawns a headless Claude and '
-    + 'costs money + needs credentials". Wiring it is a cost-and-consent decision the owner makes, not a '
-    + 'gap to silently close.',
+  'issue-fix': 'the GitHub-issue fixer (modes unattended, supervised, autofix). Verified 2026-10-29: there is no '
+    + 'issue-watch.yml — the watcher runs from launchd — and the launchd jobs com.ruvnet.issue-fix '
+    + '(--mode unattended, read-only triage) and com.ruvnet.issue-autofix (--mode autofix, ADR-107) run this '
+    + 'file through scripts/job-heartbeat.sh from deploy/*.plist. A .plist is not a scanned caller extension, so '
+    + 'the gate cannot see that invocation; it stays HELD for that reason, not because it is unwired. The '
+    + 'autofix mode is armed only by the owner (repository variable ISSUE_AUTOFIX=on plus the LaunchAgent), '
+    + 'a cost-and-consent decision, not a gap to silently close.',
 };
 
 /** Where first-party executables live. v1 knew only the first line of this table. */