ruvnet-brain 4.7.22 → 4.7.24

package/scripts/release-prepush-checks.mjs

@@ -0,0 +1,251 @@
+// scripts/release-prepush-checks.mjs — the individual checks behind `npm run release:prepush`.
+//
+// Each check is `async (ctx) => ({ ok, detail, warnings? })`. Every effect (git, gh, node, network)
+// goes through `ctx.deps`, so the unit tests drive the checks with no real git, gh or network.
+// The rules here restate nothing: the commands come from package.json, the census rules from
+// scripts/claims-verify.mjs, the test inventory from scripts/release-qualification.mjs.
+
+import path from 'node:path';
+
+export const RELEASE_BRANCH = /^release\/(\d+\.\d+\.\d+)$/;
+export const MAX_ADDED_BYTES = 5 * 1024 * 1024;
+export const QUALIFICATION_SUITES = ['source', 'integration'];
+export const QUALIFICATION_PLATFORMS = ['linux', 'macos', 'windows'];
+export const ANCHOR_TEST_DIRS = ['tests/mesh/', 'tests/mutation/', 'tests/regression/'];
+const CHANGED_TEST = /^tests\/(?:unit|integration|mesh|mutation|regression)\/.+\.test\.mjs$/;
+export const RECENT_PRERELEASE_MS = 3 * 60 * 60 * 1000;
+export const SEED_LINE = /\[corpus-next-seed\] (published-generation|committed-bootstrap) (\S+)/g;
+
+// The preflight's first-push gates, by the npm script that defines each (never a restated flag), plus
+// the two the preflight runs directly (.github/workflows/release-candidate-preflight.yml).
+export const STATIC_GATES = [
+  { name: 'node-check-release', argv: ['--check', 'scripts/release.mjs'] },
+  { name: 'version-check', script: 'version:check' },
+  { name: 'release-authority', script: 'release:authority' },
+  { name: 'architecture-review-lock', argv: ['scripts/architecture-review-lock.mjs'] },
+  { name: 'convergence-check', script: 'convergence:check' },
+  { name: 'hooks-check', script: 'hooks:check' },
+  { name: 'single-source-check', script: 'single-source:check' },
+  { name: 'wired-check', script: 'wired:check' },
+  { name: 'substitution-check', script: 'substitution:check' },
+];
+
+/**
+ * Stray-artifact rules for files ADDED on the branch. Every pattern is anchored to a path segment or a
+ * basename suffix: a loose `agentdb*` or `*.rvf*` would match legitimate tracked files such as
+ * kb/l2/agentdb.md or plugin/scripts/package-cards.rvf.
+ */
+export const STRAY_PATTERNS = [
+  { name: 'ruflo/agentdb working store (.swarm/)', re: /(^|\/)\.swarm\// },
+  { name: 'database file', re: /\.db(-wal|-shm)?$/ },
+  { name: 'local Claude settings', re: /(^|\/)\.claude\/settings\.local[^/]*$/ },
+  { name: 'backup file (*.bak*)', re: /(^|\/)[^/]*\.bak(?:$|[-._\d])[^/]*$/ },
+  { name: 'opencode workspace', re: /(^|\/)\.opencode\// },
+  { name: 'VS Code workspace', re: /(^|\/)\.vscode\// },
+];
+
+export function strayFindings(added, { rootFilesAtMain, sizes }) {
+  const findings = [];
+  for (const file of added) {
+    for (const rule of STRAY_PATTERNS) if (rule.re.test(file)) findings.push(`${file}: ${rule.name}`);
+    if (!file.includes('/') && !rootFilesAtMain.has(file)) findings.push(`${file}: new root-level file (absent at origin/main)`);
+    const size = sizes.get(file);
+    if (size > MAX_ADDED_BYTES) findings.push(`${file}: ${(size / 1048576).toFixed(1)} MB added (limit 5 MB)`);
+  }
+  return findings;
+}
+
+const lines = (text) => String(text || '').split('\n').map((line) => line.trim()).filter(Boolean);
+const fail = (detail, extra = {}) => ({ ok: false, detail, ...extra });
+const pass = (detail, extra = {}) => ({ ok: true, detail, ...extra });
+
+async function git(ctx, args) {
+  const result = await ctx.deps.exec('git', args, { cwd: ctx.root });
+  if (result.status !== 0) throw new Error(`git ${args.join(' ')}: ${String(result.stderr || result.stdout).trim()}`);
+  return result.stdout;
+}
+
+/** (a) release/X.Y.Z branch, X.Y.Z = package.json version, no tracked changes. */
+export async function branchIdentity(ctx) {
+  const branch = (await git(ctx, ['rev-parse', '--abbrev-ref', 'HEAD'])).trim();
+  const version = JSON.parse(await git(ctx, ['show', 'HEAD:package.json'])).version;
+  const dirty = lines(await git(ctx, ['status', '--porcelain', '--untracked-files=no']));
+  const problems = [];
+  const match = RELEASE_BRANCH.exec(branch);
+  if (!match) problems.push(`HEAD is on "${branch}", not a release/X.Y.Z branch`);
+  else if (match[1] !== version) problems.push(`branch says ${match[1]} but package.json says ${version}`);
+  if (dirty.length) problems.push(`${dirty.length} tracked change(s) not committed: ${dirty.slice(0, 5).join(', ')}`);
+  return problems.length ? fail(problems.join('; ')) : pass(`${branch} = package.json ${version}; tracked tree clean`);
+}
+
+/** (b) one static gate; its exit status is the verdict, its last output lines the detail. */
+export function staticGate(gate) {
+  return async (ctx) => {
+    let argv = gate.argv;
+    if (gate.script) {
+      const command = ctx.packageScripts[gate.script];
+      if (!command) return fail(`package.json has no "${gate.script}" script`);
+      const node = /^node\s+(.+)$/.exec(command.trim());
+      argv = node && !/[|&;<>$`]/.test(node[1]) ? node[1].split(/\s+/) : null;
+      if (!argv) {
+        const npm = await ctx.deps.exec('npm', ['run', '--silent', gate.script], { cwd: ctx.root });
+        return npm.status === 0 ? pass(`npm run ${gate.script}`) : fail(tail(npm));
+      }
+    }
+    const result = await ctx.deps.exec(process.execPath, argv, { cwd: ctx.root });
+    return result.status === 0 ? pass(`node ${argv.join(' ')}`) : fail(`node ${argv.join(' ')} exited ${result.status}: ${tail(result)}`);
+  };
+}
+const tail = (result) => lines(`${result.stdout || ''}\n${result.stderr || ''}`).slice(-6).join(' | ').slice(0, 1200);
+
+/** (c) the qualification inventory builds for every suite and platform, and every file is tracked at HEAD. */
+export async function qualificationInventory(ctx) {
+  const tracked = new Set(lines(await git(ctx, ['ls-tree', '-r', '--name-only', 'HEAD'])));
+  const { qualificationPlan } = await ctx.deps.importModule(path.join(ctx.root, 'scripts/release-qualification.mjs'));
+  const problems = [];
+  let files = 0;
+  for (const suite of QUALIFICATION_SUITES) for (const platform of QUALIFICATION_PLATFORMS) {
+    try {
+      const plan = qualificationPlan(suite, platform);
+      files += plan.files.length;
+      for (const file of plan.files) if (!tracked.has(file)) problems.push(`${suite}/${platform}: ${file} is not tracked at HEAD`);
+    } catch (error) { problems.push(`${suite}/${platform}: ${error.message}`); }
+  }
+  return problems.length ? fail(problems.join('; ')) : pass(`6 plans, ${files} listed files, all tracked at HEAD`);
+}
+
+/** (d) nothing stray was added on the branch. */
+export async function strayArtifacts(ctx) {
+  const base = (await git(ctx, ['merge-base', 'origin/main', 'HEAD'])).trim();
+  const added = lines(await git(ctx, ['diff', '--name-only', '--no-renames', '--diff-filter=A', base, 'HEAD']));
+  const rootFilesAtMain = new Set(lines(await git(ctx, ['ls-tree', '--name-only', 'origin/main'])));
+  const sizes = new Map();
+  for (const row of lines(await git(ctx, ['ls-tree', '-r', '-l', 'HEAD']))) {
+    const m = /^\S+ blob \S+\s+(\d+)\t(.+)$/.exec(row);
+    if (m) sizes.set(m[2], Number(m[1]));
+  }
+  const findings = strayFindings(added, { rootFilesAtMain, sizes });
+  return findings.length ? fail(findings.join('; ')) : pass(`${added.length} added file(s) since ${base.slice(0, 8)}; none stray`);
+}
+
+/** The surface rules of scripts/claims-verify.mjs (qualifyCensusArtifacts), with old and new numbers named. */
+export function surfaceCensusProblems(file, text, census, { SURFACE_CLAIM_RULES }) {
+  const expected = { ...census, builtStores: census.publicStores };
+  const problems = [];
+  const want = census.chunks.toLocaleString('en-US');
+  if (!text.includes(want)) problems.push(`${file}: chunk count ${want} absent`);
+  for (const rule of SURFACE_CLAIM_RULES) for (const match of text.matchAll(rule.re)) for (const group of rule.groups) {
+    const found = Number(match[group.i].replace(/,/g, ''));
+    if (found !== expected[rule.key]) {
+      problems.push(`${file}: ${rule.name} ${found.toLocaleString('en-US')} -> ${expected[rule.key].toLocaleString('en-US')}`);
+    }
+  }
+  return problems;
+}
+
+async function surfacesAgainst(ctx, rev, census) {
+  const claims = await ctx.deps.importModule(path.join(ctx.root, 'scripts/claims-verify.mjs'));
+  const problems = [];
+  for (const file of claims.CHUNK_SURFACES) {
+    const text = await git(ctx, ['show', `${rev}:${file}`]);
+    problems.push(...surfaceCensusProblems(file, text, census, claims));
+  }
+  return { problems, surfaces: claims.CHUNK_SURFACES.length };
+}
+
+/** Which generation is the newest NOW (or the one named for a replay). */
+async function targetGeneration(ctx) {
+  if (ctx.generation) return { tag: ctx.generation, bytes: null, origin: 'named' };
+  const seed = await ctx.deps.resolveSeed();
+  return { tag: seed.tag, bytes: seed.bytes ?? null, origin: seed.origin };
+}
+
+async function corpusWarnings(ctx) {
+  const warnings = [];
+  const now = ctx.deps.now();
+  const releases = await ctx.deps.exec('gh', ['release', 'list', '--repo', ctx.repo, '--limit', '20', '--json', 'tagName,isPrerelease,publishedAt'], { cwd: ctx.root });
+  if (releases.status !== 0) warnings.push('could not list releases to look for a fresh corpus prerelease');
+  else for (const row of JSON.parse(releases.stdout || '[]')) {
+    const age = now - Date.parse(row.publishedAt);
+    if (row.isPrerelease && /^corpus-sha256-/.test(row.tagName) && age < RECENT_PRERELEASE_MS) {
+      warnings.push(`${row.tagName} is a prerelease published ${Math.round(age / 60000)} min ago — a newer generation may promote soon`);
+    }
+  }
+  const runs = await ctx.deps.exec('gh', ['run', 'list', '--repo', ctx.repo, '--workflow', 'protected-release.yml', '--limit', '10', '--json', 'databaseId,displayTitle,status'], { cwd: ctx.root });
+  if (runs.status !== 0) warnings.push('could not list protected-release runs to look for a corpus publish in flight');
+  else for (const run of JSON.parse(runs.stdout || '[]')) {
+    if (run.status !== 'completed' && /^protected-release corpus\b/.test(run.displayTitle || '')) {
+      warnings.push(`corpus publish run ${run.databaseId} is ${run.status} — the newest generation may change under this release`);
+    }
+  }
+  return warnings;
+}
+
+/** (e) every committed claim surface quotes the census of the newest generation. */
+export async function censusCheck(ctx) {
+  const generation = await targetGeneration(ctx);
+  const [census, warnings] = await Promise.all([
+    ctx.deps.census({ tag: generation.tag, bytes: generation.bytes }),
+    corpusWarnings(ctx).catch((error) => [`corpus activity check failed: ${error.message}`]),
+  ]);
+  const { problems, surfaces } = await surfacesAgainst(ctx, 'HEAD', census);
+  const summary = `${generation.tag} (${generation.origin}): ${census.publicStores} public stores, ${census.chunks.toLocaleString('en-US')} chunks`;
+  return problems.length
+    ? fail(`${summary}; stale surfaces: ${problems.join('; ')} — restamp with scripts/sync-census.mjs`, { warnings })
+    : pass(`${summary}; all ${surfaces} surfaces agree`, { warnings });
+}
+
+/** (f) text-anchored mesh/mutation/regression tests for changed source, plus changed tests. */
+export async function anchoredTests(ctx) {
+  const base = (await git(ctx, ['merge-base', 'origin/main', 'HEAD'])).trim();
+  const changed = lines(await git(ctx, ['diff', '--name-only', '--no-renames', base, 'HEAD']));
+  const tracked = lines(await git(ctx, ['ls-tree', '-r', '--name-only', 'HEAD']));
+  const trackedSet = new Set(tracked);
+  const sources = changed.filter((file) => !file.startsWith('tests/') && trackedSet.has(file));
+  const selected = new Set(changed.filter((file) => CHANGED_TEST.test(file) && trackedSet.has(file)));
+  for (const file of tracked) {
+    if (!file.endsWith('.test.mjs') || !ANCHOR_TEST_DIRS.some((dir) => file.startsWith(dir))) continue;
+    const text = await ctx.deps.readFile(path.join(ctx.root, file));
+    if (sources.some((source) => text.includes(source))) selected.add(file);
+  }
+  const files = [...selected].sort();
+  if (!files.length) return pass(`no anchored or changed tests for ${sources.length} changed source file(s)`, { files });
+  const result = await ctx.deps.exec(process.execPath, [path.join(ctx.root, 'node_modules/vitest/vitest.mjs'), 'run', ...files], { cwd: ctx.root });
+  return result.status === 0 ? pass(`${files.length} test file(s) passed: ${files.join(', ')}`, { files })
+    : fail(`vitest exited ${result.status} on ${files.join(', ')}: ${tail(result)}`, { files });
+}
+
+/** (g) pre-dispatch: the generation the preflight sealed for SHA must still be the newest. */
+export async function sealedGeneration(ctx) {
+  const sha = ctx.sha;
+  if (!/^[0-9a-f]{40}$/.test(String(sha || ''))) return fail('--pre-dispatch needs --sha <full 40-character commit>');
+  const gh = async (args) => {
+    const result = await ctx.deps.exec('gh', args, { cwd: ctx.root });
+    if (result.status !== 0) throw new Error(`gh ${args.slice(0, 2).join(' ')}: ${tail(result)}`);
+    return result.stdout;
+  };
+  const runs = JSON.parse(await gh(['run', 'list', '--repo', ctx.repo, '--workflow', 'release-candidate-preflight.yml', '--commit', sha,
+    '--limit', '20', '--json', 'databaseId,conclusion,status,event,headBranch,createdAt']));
+  const green = runs.filter((run) => run.event === 'push' && run.conclusion === 'success' && RELEASE_BRANCH.test(run.headBranch || ''))
+    .sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt))[0];
+  if (!green) return fail(`no successful release-candidate-preflight push run for ${sha.slice(0, 8)} on a release/* branch`);
+  const newest = await targetGeneration(ctx);
+  let sealed = null;
+  const jobs = JSON.parse(await gh(['run', 'view', String(green.databaseId), '--repo', ctx.repo, '--json', 'jobs'])).jobs || [];
+  const qe = jobs.find((job) => /(^|\/ )release-qe$/.test(job.name || ''));
+  if (qe) {
+    const log = await ctx.deps.exec('gh', ['run', 'view', '--repo', ctx.repo, '--job', String(qe.databaseId), '--log'], { cwd: ctx.root });
+    if (log.status === 0) sealed = [...String(log.stdout).matchAll(SEED_LINE)].map((m) => m[2]).pop() || null;
+  }
+  if (sealed) {
+    return sealed === newest.tag
+      ? pass(`preflight run ${green.databaseId} sealed ${sealed}, still the newest generation`)
+      : fail(`preflight run ${green.databaseId} sealed ${sealed}, but the newest generation is now ${newest.tag} — restamp the census, push, and re-run preflight`);
+  }
+  // Fallback when the job log is gone or reworded: the surfaces at SHA must quote the newest census.
+  const census = await ctx.deps.census({ tag: newest.tag, bytes: newest.bytes });
+  const { problems } = await surfacesAgainst(ctx, sha, census);
+  return problems.length
+    ? fail(`no sealed-generation line in preflight run ${green.databaseId}; surfaces at ${sha.slice(0, 8)} disagree with ${newest.tag}: ${problems.join('; ')}`)
+    : pass(`no sealed-generation line in preflight run ${green.databaseId}; surfaces at ${sha.slice(0, 8)} equal the census of ${newest.tag} (fallback)`);
+}

package/scripts/release-prepush.mjs

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+// scripts/release-prepush.mjs — run, before the FIRST push of a release/X.Y.Z branch, every check
+// release-candidate-preflight would otherwise fail on in its first minutes (CONTRIBUTING.md,
+// "Releasing code"). An explicit command on purpose: tests/unit/development-push-boundary.test.mjs
+// keeps ordinary pushes free of release gates, so this is never wired into the git pre-push hook.
+//
+//   npm run release:prepush [-- --receipt <file>] [--generation <corpus tag>]
+//   npm run release:prepush -- --pre-dispatch --sha <SHA> [--receipt <file>]
+//
+// Runs ALL checks, collects every failure, prints each check's wall time and exits 1 on any failure.
+// --pre-dispatch runs only the sealed-generation check: the corpus generation the preflight sealed for
+// SHA must still be the newest one before protected-release.yml is dispatched.
+// Programmatic: runPrepush({ root, sha, preDispatch, generation, repo, deps }) -> { ok, checks }.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { rangeCensus } from './generation-census.mjs';
+import {
+  STATIC_GATES, anchoredTests, branchIdentity, censusCheck, qualificationInventory, sealedGeneration, staticGate, strayArtifacts,
+} from './release-prepush-checks.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const EXEC_TIMEOUT_MS = 10 * 60 * 1000;
+
+/** Promise-returning spawn: never blocks the event loop, so checks really run side by side. */
+export function exec(command, args, { cwd, timeoutMs = EXEC_TIMEOUT_MS, env = process.env } = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    const out = [], err = [];
+    child.stdout.on('data', (chunk) => out.push(chunk));
+    child.stderr.on('data', (chunk) => err.push(chunk));
+    const timer = setTimeout(() => child.kill('SIGKILL'), timeoutMs);
+    const done = (status, error) => {
+      clearTimeout(timer);
+      resolve({ status, stdout: Buffer.concat(out).toString('utf8'),
+        stderr: Buffer.concat(err).toString('utf8') + (error ? `\n${error.message}` : '') });
+    };
+    child.on('error', (error) => done(127, error));
+    child.on('close', (code, signal) => done(code ?? (signal ? 128 : 1)));
+  });
+}
+
+function repoFromRemote(url) {
+  const m = /github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(String(url || '').trim());
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
+/** The real effects. Tests replace any of them. */
+export function defaultDeps({ root = ROOT, repo } = {}) {
+  let token;
+  const ghToken = async () => {
+    if (token === undefined) {
+      const result = await exec('gh', ['auth', 'token'], { cwd: root, timeoutMs: 15_000 });
+      token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || (result.status === 0 ? result.stdout.trim() : null) || null;
+    }
+    return token;
+  };
+  return {
+    exec,
+    now: () => Date.now(),
+    readFile: async (file) => fs.promises.readFile(file, 'utf8'),
+    importModule: (file) => import(pathToFileURL(file).href),
+    // The exact CI invocation (ci.yml release-qe), as a child process; its stdout is the descriptor.
+    resolveSeed: async () => {
+      const result = await exec(process.execPath, [path.join(root, 'scripts/corpus-next-seed.mjs'), '--repo', repo, '--require-coverage'], { cwd: root });
+      if (result.status !== 0) throw new Error(`corpus-next-seed exited ${result.status}: ${result.stderr.trim().split('\n').slice(-3).join(' | ')}`);
+      return JSON.parse(result.stdout);
+    },
+    census: async ({ tag, bytes }) => rangeCensus({ repo, tag, bytes, token: await ghToken(),
+      privateStoresFile: path.join(root, 'kb/PRIVATE-STORES.json'), cacheDir: os.tmpdir() }),
+  };
+}
+
+export async function runPrepush({ root = ROOT, sha = null, preDispatch = false, generation = null, repo = null, deps = {} } = {}) {
+  const resolvedRoot = path.resolve(root);
+  const probe = { ...defaultDeps({ root: resolvedRoot, repo: 'unresolved/unresolved' }), ...deps };
+  let resolvedRepo = repo || process.env.GITHUB_REPOSITORY || null;
+  if (!resolvedRepo) {
+    const remote = await probe.exec('git', ['remote', 'get-url', 'origin'], { cwd: resolvedRoot });
+    resolvedRepo = remote.status === 0 ? repoFromRemote(remote.stdout) : null;
+  }
+  const merged = { ...defaultDeps({ root: resolvedRoot, repo: resolvedRepo }), ...deps };
+  let packageScripts = {};
+  try { packageScripts = JSON.parse(await merged.readFile(path.join(resolvedRoot, 'package.json'))).scripts || {}; } catch { /* the gates name it */ }
+  const ctx = { root: resolvedRoot, repo: resolvedRepo, sha, generation, deps: merged, packageScripts };
+
+  const plan = preDispatch
+    ? [['sealed-generation', sealedGeneration]]
+    : [
+      ['branch-identity', branchIdentity],
+      ...STATIC_GATES.map((gate) => [gate.name, staticGate(gate)]),
+      ['qualification-inventory', qualificationInventory],
+      ['stray-artifacts', strayArtifacts],
+      ['census', censusCheck],
+      ['anchored-tests', anchoredTests],
+    ];
+  const checks = await Promise.all(plan.map(async ([name, check]) => {
+    const started = Date.now();
+    let outcome;
+    try {
+      outcome = resolvedRepo || !['census', 'sealed-generation'].includes(name)
+        ? await check(ctx)
+        : { ok: false, detail: 'cannot tell which GitHub repository this is (no GITHUB_REPOSITORY, no github.com origin)' };
+    } catch (error) {
+      outcome = { ok: false, detail: `check threw: ${error.message}` };
+    }
+    return { name, ok: outcome.ok === true, ms: Date.now() - started, detail: outcome.detail,
+      ...(outcome.warnings?.length ? { warnings: outcome.warnings } : {}), ...(outcome.files ? { files: outcome.files } : {}) };
+  }));
+  return { ok: checks.every((check) => check.ok), checks };
+}
+
+function parseArgs(argv) {
+  const opts = { preDispatch: false, sha: null, generation: null, receipt: null, repo: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    const flag = argv[i];
+    const value = () => {
+      const next = argv[i + 1];
+      if (!next || next.startsWith('--')) throw new Error(`${flag} needs a value`);
+      i += 1;
+      return next;
+    };
+    if (flag === '--pre-dispatch') opts.preDispatch = true;
+    else if (flag === '--sha') opts.sha = value();
+    else if (flag === '--generation') opts.generation = value();
+    else if (flag === '--receipt') opts.receipt = value();
+    else if (flag === '--repo') opts.repo = value();
+    else throw new Error(`unknown argument ${flag}`);
+  }
+  if (opts.sha && !opts.preDispatch) throw new Error('--sha is only meaningful with --pre-dispatch');
+  return opts;
+}
+
+export async function main(argv = process.argv.slice(2), { stdout = process.stdout, stderr = process.stderr, deps = {}, root = ROOT } = {}) {
+  let opts;
+  try { opts = parseArgs(argv); } catch (error) {
+    stderr.write(`[release:prepush] ${error.message}\nUsage: npm run release:prepush [-- --receipt FILE] [--generation TAG] | -- --pre-dispatch --sha SHA\n`);
+    return 2;
+  }
+  const started = Date.now();
+  const result = await runPrepush({ root, sha: opts.sha, preDispatch: opts.preDispatch, generation: opts.generation, repo: opts.repo, deps });
+  const totalMs = Date.now() - started;
+  for (const check of result.checks) {
+    stdout.write(`${check.ok ? 'PASS' : 'FAIL'}  ${check.name.padEnd(26)} ${(check.ms / 1000).toFixed(1).padStart(6)} s  ${check.detail}\n`);
+    for (const warning of check.warnings || []) stdout.write(`WARN  ${check.name.padEnd(26)}          ${warning}\n`);
+  }
+  const failed = result.checks.filter((check) => !check.ok);
+  stdout.write(`\n[release:prepush] ${result.ok ? 'PASS' : `FAIL (${failed.length}: ${failed.map((c) => c.name).join(', ')})`} in ${(totalMs / 1000).toFixed(1)} s\n`);
+  if (opts.receipt) {
+    const head = await (deps.exec || exec)('git', ['rev-parse', 'HEAD'], { cwd: root });
+    const receipt = { schemaVersion: 1, kind: 'ruvnet-brain-release-prepush', mode: opts.preDispatch ? 'pre-dispatch' : 'pre-push',
+      head: head.stdout.trim() || null, sha: opts.sha, generation: opts.generation, ok: result.ok,
+      finishedAt: new Date().toISOString(), totalMs, checks: result.checks };
+    fs.writeFileSync(path.resolve(opts.receipt), `${JSON.stringify(receipt, null, 2)}\n`);
+  }
+  return result.ok ? 0 : 1;
+}
+
+if (isDirectInvocation(import.meta.url)) {
+  main().then((code) => { process.exitCode = code; }).catch((error) => {
+    console.error(`[release:prepush] ${error?.stack || error}`);
+    process.exitCode = 1;
+  });
+}

package/scripts/release-qualification-contract.mjs

@@ -354,6 +354,24 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "linux": ["tests/unit/continuation-gate-codex-transcript.test.mjs", "tests/unit/codex-boot-surface-proof.test.mjs", "tests/unit/console-activity-fleet-dedupe.test.mjs", "tests/unit/console-activity-identity.test.mjs", "tests/unit/console-activity-lessons.test.mjs", "tests/unit/lesson-gate.test.mjs", "tests/unit/ruflo-memory-session.test.mjs"],
         "macos": ["tests/unit/continuation-gate-codex-transcript.test.mjs", "tests/unit/codex-boot-surface-proof.test.mjs", "tests/unit/console-activity-fleet-dedupe.test.mjs", "tests/unit/console-activity-identity.test.mjs", "tests/unit/console-activity-lessons.test.mjs", "tests/unit/lesson-gate.test.mjs", "tests/unit/ruflo-memory-session.test.mjs"]
       }
+    },
+    {
+      "id": "open-issue-fixes-4-7-24",
+      "reason": "A storage transaction stuck at RECOVERY_REQUIRED has a supported way out: a read-only preview, then an explicit keep-live disposition bound to the live tree's exact sha256 that moves every other tree intact and records a terminal DISPOSED receipt (#335); a detached learning capture is acknowledged only after its exact readback, so a refused store is retried instead of being coalesced away for ten minutes (#377). Windows is not verified",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/unit/update-recovery-disposition.test.mjs", "tests/unit/learn-capture-ack-after-readback.test.mjs"],
+        "macos": ["tests/unit/update-recovery-disposition.test.mjs", "tests/unit/learn-capture-ack-after-readback.test.mjs"]
+      }
+    },
+    {
+      "id": "issue-autofix-bounded-writer",
+      "reason": "The unattended issue fixer (ADR-107) stays inside its authority: kill switch, single-writer lock, deny-by-default editable paths, the static malware and secret scan, the manifest/lockfile/pack/audit night gate, the red-team judge, restricted tool-less LLM stages, the macOS sandbox for model-written code (macOS only), never-weakened tests, independent verifier, resumable never-doubled release steps, no force or merge, owner-marker-prefixed comments, personal notes that are never boilerplate or repeated, and a registry and LaunchAgent that match. It runs on the owner's macOS launchd, so it is qualified on macOS and Linux only, the same scope as the ntfy inbox reader",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/unit/issue-autofix-policy.test.mjs", "tests/unit/issue-autofix-agents.test.mjs", "tests/unit/issue-autofix-release.test.mjs", "tests/unit/issue-autofix-release-ship.test.mjs", "tests/unit/issue-autofix-comment.test.mjs", "tests/unit/issue-autofix-deploy.test.mjs", "tests/unit/issue-autofix-security.test.mjs", "tests/unit/issue-autofix-notes.test.mjs", "tests/unit/issue-autofix-gate.test.mjs", "tests/unit/issue-autofix-night.test.mjs"],
+        "macos": ["tests/unit/issue-autofix-policy.test.mjs", "tests/unit/issue-autofix-agents.test.mjs", "tests/unit/issue-autofix-release.test.mjs", "tests/unit/issue-autofix-release-ship.test.mjs", "tests/unit/issue-autofix-comment.test.mjs", "tests/unit/issue-autofix-deploy.test.mjs", "tests/unit/issue-autofix-security.test.mjs", "tests/unit/issue-autofix-notes.test.mjs", "tests/unit/issue-autofix-gate.test.mjs", "tests/unit/issue-autofix-night.test.mjs", "tests/unit/issue-autofix-sandbox.test.mjs"]
+      }
     }
   ],
   "integration": [
@@ -376,6 +394,11 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "reason": "Retired 2026-10-12: the learning queue, flush worker and Console queue recovery were deleted (owner ruling: hooks only call rUv's memory tools); learning writes are covered by canonical-learning-capture",
       "files": []
     },
+    {
+      "id": "release-prepush-shift-left",
+      "reason": "The explicit release pre-push gate collects every failure with per-check timing, reads the newest corpus generation's public census over HTTP Range (refusing zip64, unknown compression and CRC mismatch), names each stale claim surface with its old and new number, refuses stray added artifacts with anchored patterns, selects text-anchored tests for changed source, and before dispatch requires the preflight's sealed generation to still be the newest",
+      "files": ["tests/unit/release-prepush.test.mjs", "tests/unit/generation-census.test.mjs"]
+    },
     {
       "id": "canonical-progression-store",
       "reason": "Actual adopted canonical storage, exact readback, and concurrent session restoration retain consent and complete history",
@@ -459,6 +482,15 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "linux": ["tests/integration/stale-install-trap.test.mjs", "tests/integration/ruflo-memory-hooks.test.mjs"],
         "macos": ["tests/integration/stale-install-trap.test.mjs", "tests/integration/ruflo-memory-hooks.test.mjs"]
       }
+    },
+    {
+      "id": "issue-autofix-simulated-end-to-end",
+      "reason": "The whole autofix night (select, AIDefence screen, plan, build, scan, sandboxed test validity, red-team, verify, one batched release, push, pull request, fast-forward, dispatch, terminal check, one personal note per person) runs against a file:// origin with a fake gh and fake claude; hostile fixes (obfuscated payload, new dependency, off-allowlist edit, red-team flag, new audit advisory) never ship, one failing fix never blocks the others, a dropped connection or the kill switch pauses and the next run resumes without a second push or dispatch, and only a red after main moved halts. macOS and Linux only (the job is the owner's launchd tool)",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/integration/issue-autofix-simulate.test.mjs", "tests/integration/issue-autofix-simulate-night.test.mjs"],
+        "macos": ["tests/integration/issue-autofix-simulate.test.mjs", "tests/integration/issue-autofix-simulate-night.test.mjs"]
+      }
     }
   ]
 });

package/scripts/wired-check.mjs

@@ -172,6 +172,10 @@ const STANDALONE = [
   // plist's own ProgramArguments on 2026-07-23, not assumed from the header comment alone:
   ['clear-claude-tmp', 'launchd, every 3h (out-of-repo scheduler) — confirmed live: '
     + 'com.stuartkerr.clear-claude-tmp.plist is loaded and its ProgramArguments invoke this exact file'],
+  ['issue-autofix', 'launchd, daily 10:30 (out-of-repo scheduler, ADR-107): deploy/com.ruvnet.issue-autofix.plist '
+    + 'ProgramArguments invoke scripts/issue-fix.mjs --mode autofix through scripts/job-heartbeat.sh, and issue-fix.mjs '
+    + 'dynamically imports this file for that mode. Off unless the repository variable ISSUE_AUTOFIX is exactly on; '
+    + 'the owner arms it after the dry-run simulation and a supervised live dry-run'],
   ['nightly-gists', 'manual re-embed of the developer checkout gists store (the launchd job '
     + 'com.ruvnet.brain-gists was retired 2026-10-26: no installed brain reads that store)'],
   ['nightly-wrapper', 'author-run maintenance harness, deliberately unscheduled; refuses primary, nested, and dirty worktrees'],
@@ -344,11 +348,13 @@ const HELD = {
     + 'ADR-028 and 4.0-READINESS §4 both name this the single largest 4.0 gap. HELD because the fix is a '
     + 'real decision — one in-session consumer that speaks unprompted, with a one-action permanent silence '
     + '— not a line of wiring.',
-  'issue-fix': 'the GitHub-issue AUTO-FIXER, built but intentionally NOT wired. Verified 2026-07-23: '
-    + 'issue-watch.yml runs only issue-watch.mjs (which LISTS issues), and issue-watch.mjs spawns only '
-    + 'gh/sleep — never this. Its own yml comment says why it is gated: it "spawns a headless Claude and '
-    + 'costs money + needs credentials". Wiring it is a cost-and-consent decision the owner makes, not a '
-    + 'gap to silently close.',
+  'issue-fix': 'the GitHub-issue fixer (modes unattended, supervised, autofix). Verified 2026-10-29: there is no '
+    + 'issue-watch.yml — the watcher runs from launchd — and the launchd jobs com.ruvnet.issue-fix '
+    + '(--mode unattended, read-only triage) and com.ruvnet.issue-autofix (--mode autofix, ADR-107) run this '
+    + 'file through scripts/job-heartbeat.sh from deploy/*.plist. A .plist is not a scanned caller extension, so '
+    + 'the gate cannot see that invocation; it stays HELD for that reason, not because it is unwired. The '
+    + 'autofix mode is armed only by the owner (repository variable ISSUE_AUTOFIX=on plus the LaunchAgent), '
+    + 'a cost-and-consent decision, not a gap to silently close.',
 };
 
 /** Where first-party executables live. v1 knew only the first line of this table. */