Addresses the PR #869 security audit (1 MEDIUM, 2 LOW/informational):
MEDIUM — stripComments was not string-aware: a // inside a quoted string
was treated as a line comment, so URL-form references
("https://hf.co/repo/model.safetensors", "file://models/x.gguf",
"http://internal/finetune") evaded the model-file-reference and
generic-finetune rules. Replaced the regex strip with a per-language
character scan that tracks quote state (js-like: ' " ` incl. template
literals with counted ${} nesting and backslash escapes; rust: " only —
' deliberately ignored so lifetimes cannot desynchronize the scan, plus
nested block comments; python: # + ' " and triple quotes; shell: # only
at word start, ' without escapes, " with). Comments are stripped only
outside strings; residual stripper edges (js regex literals with //,
rust char-literal " / raw strings) are documented and are all in the
false-positive direction — they can never hide a token. Self-test gains
the auditor's three URL fixtures (must flag), a comment-containing-URL
case and a .sh comment case (must NOT flag), and the single-slash
"ruvllm/training" import regression case (still flags).
LOW hardening — SCAN_EXT now includes .py and .sh; dist removed from
SKIP_DIRS (committed build output is what executes). Real-tree scan
stays clean: 25 files across the 3 surfaces, 0 hits — no committed
dist/ or vendored code exists under the surfaces today, so no scoping
carve-out was needed. Self-test covers .py/.sh violations and a
violation under dist/. fixtures/ and node_modules/ remain skipped by
convention, stated in the header.
Accepted residuals documented in the script header and shaperLoop.ts
module docs: the capability gate fires on a self-declared
capabilityDelta until WP11 wires independent extraction (evaluation is
not promotion — human + vetoes still gate); the model-hash binding is
record-only until WP12's day-0/day-30 re-hash.
Self-test: 23/23 assertions pass. Harness suite: 26/26 pass.
Refs #841, PR #869 audit.
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X
First shippable slice of the WP9 skill/harness evolution loop (#841),
following SHAPER (arXiv:2608.11350): frozen model as both planner and
optimizer; only skills, context, and the execution harness evolve.
- scripts/frozen-weights-check.mjs: structural (CI-enforced, not policy)
frozen-weights gate. Scans the loop's mutation surfaces (harness/src,
examples/mragent, sona darwin_guard.rs) against a 9-entry deny-list
built from crates/ruvllm's real training entry points (training/, qat/,
lora/, pretrain pipelines, weight writers, model-file references, MCP
weight-mutation tools), each entry documented with why + in-repo anchor.
Symlink/error hardening matches adr-index.mjs (PR #857 lessons); a
missing surface directory fails loudly; --self-test builds adversarial
positive/negative fixtures. Wired into CI as its own job.
- harness/src/genome.ts: ADR-313's mutation-surface enumeration as a
closed type union (skills | context | harness — weights unrepresentable),
FrozenModelRef with loop-start sha256, and the ADR-315 capability-
expansion boundary with a constitutional gate stub (models autogenous
promoteAuthorized's authorized conjunct; blocks by default; WP11
integration point).
- harness/src/shaperLoop.ts: one-generation orchestration
propose (reusing Darwin/GEPA via runRuvectorGepa) -> evaluate (existing
WP2 dreamMachine.ts adapter) -> verdict -> promotion RECOMMENDATION via
the existing vetoes path. Same FrozenModelRef instance serves planner
and optimizer (config-tested); capability-expanding candidates are gated
before evaluation and blocked; constitutional boundary identical to
WP2's (no promote/merge export, frozen data result, test-asserted).
- tests: full synthetic generation, regression block, capability-expansion
block, weights-surface rejection, no-promotion-export assertion, GEPA
proposer reuse, frozen-weights check real-run + self-test. Suite:
26 passing (17 existing + 9 new).
Refs #841, #837. ADR-313, ADR-315, ADR-306.
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X
Addresses both Phase-4 security findings on the GGUF download curl
fallbacks (crates/ruvllm-cli/src/commands/download.rs):
- MED (CWE-214): the Authorization: Bearer header was passed as a curl
-H argument, leaving HF_TOKEN world-readable via ps / /proc/<pid>/cmdline
for the curl process lifetime. Both call sites (download_via_curl and
list_files_via_curl) now pass the header through a curl config fed on
stdin (--config -), built by curl_auth_config() which escapes quotes,
backslashes, and CR/LF so a hostile token value cannot inject extra
config directives. Behavior when HF_TOKEN is unset is unchanged (no
config, no --config flag).
- LOW: remote-controlled file names from the HF tree/siblings listing
were joined into the cache path unchecked. validate_remote_file_name()
rejects empty names and any non-Normal component (absolute, .., .,
prefixes) before the join, and ensure_under_cache_dir() verifies the
canonicalized parent still resolves under the model cache dir after
create_dir_all.
Tests: 5 new unit tests (hostile-name rejection incl. "../x", "/abs",
"a/../../x"; containment check; curl config content + escaping);
all 31 pass, clippy and fmt clean. Manually verified `ruvllm download
hf-internal-testing/tiny-random-gpt2 --quantization none` end-to-end and
that --config-on-stdin delivers the Authorization header.
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X
Addresses all four findings from the Phase-4 security audit on PR #857:
- MED (symlink following): walk() now uses readdirSync(withFileTypes)
and never follows symlinks — file or directory — skipping each with a
warning. Belt-and-braces: every kept entry is realpath-asserted to
resolve inside docs/adr/, so a committed symlink can no longer inline
outside content into INDEX.md or move the allocation counter.
- MED (fragile traversal): per-entry try/catch with skip+warn for broken
symlinks / EACCES / unresolvable entries, a visited-realpath set guards
cycles, and the top-level dispatch is wrapped so --check fails with
"adr-index: fatal: <msg>" instead of a raw stack trace.
- LOW (markdown injection): slug and rel are now routed through
mdCell/mdLinkText (escaping |, [, ]) and link targets go through
encodeURI plus %28/%29 for parens, so a filename containing
"|", "](", "[..](..)" can no longer break the table or forge links.
- INFO (Windows fail-open): abs.split('/') replaced with path.basename /
path.relative + sep-normalized display paths, so --check cannot pass
vacuously on Windows. Also: Math.max(...) -> reduce (no -Infinity on
an empty set).
Adds `node scripts/adr-index.mjs --self-test`: builds an adversarial
fixture tree in a temp dir (outside-tree file symlink, escaping directory
symlink, broken symlink, symlink loop, hostile "|]()"-laden filename),
runs the script against it as a subprocess, and asserts 12 properties:
symlinks skipped with warnings, no stack trace, hostile row escaped,
link target URI-encoded, counter unaffected.
Regenerating INDEX.md after these changes produces no diff (all current
filenames are benign), and `--check` still passes: 348 ADR files, next
available ADR-317.
Note: CI wiring (a workflow step invoking --check) should land only
after this commit, per the audit — this commit is what makes the gate
safe to expose to PR-controlled trees.
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X
Resolve harness package.json conflict: keep the nine @metaharness pins
bumped by #855 (darwin ^0.9.1, flywheel ^0.1.10, harness ^0.2.0,
redblue ^0.1.6, router ^0.4.0, weight-eft ^0.1.1, workspace-lens ^0.1.2,
workspace-probe ^0.1.1, metaharness ^0.4.7) AND the dream-machine@0.1.1
exact pin from this branch. Lockfile regenerated from main's version via
npm install. All 17 harness tests (12 base + 5 dream-machine adapter)
pass against the bumped metaharness versions.
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X
12 crates under crates/ had a Cargo.toml but were neither workspace
members nor excluded, so their tests never ran in CI. Disposition:
Added to members (build and test green):
- ruvector-agent-memory (also added by PR #858; duplicate entries merge
cleanly, whichever lands second can drop one)
- ruvector-bet4-ivf-bench
- ruvector-hnsw-repair
- ruvector-temporal-tensor-wasm
Added to exclude with per-crate reasons (do not build — see #859):
- agentic-robotics-{core,rt,embedded,mcp,node,benchmarks}: authored
against a different workspace root; workspace.package/dep inheritance
fails at manifest parse
- ruvector-attention-cli: 51 compile errors, API drift vs
ruvector-attention 2.x plus missing bincode dep
- ruvector-sparse-inference-wasm: 11 compile errors, API drift vs
ruvector-sparse-inference
scripts/workspace-check.mjs is the backstop: it fails when any
crates/**/Cargo.toml is neither a member, nor excluded, nor under its
own [workspace] (and flags member entries with no manifest on disk).
Wired into Workspace CI as a fast Node-only job. The workspace keeps
literal members entries (no crates/* glob): membership stays an
explicit, reviewable decision, and the guard makes silent orphaning
impossible.
Refs #859, #837
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X
GGUF weight downloads failed two ways (deferred in 946275a61, blocks WP9 #841):
1. get_files_to_download() pushed an unexpanded glob ("*Q4_K_M.gguf") that was
sent to HF as a literal filename -> 404. Now the repo's actual file list is
fetched (hf-hub ApiRepo::info(), with a curl fallback against
GET /api/models/<id>/tree/<rev> in the same HF_TOKEN-honoring idiom as the
307-redirect fix) and the quant pattern is matched against real filenames.
Multi-part GGUF (…-q4_k_m-00001-of-00003.gguf) is handled — all parts are
downloaded in order — because the flagship `qwen` alias (Qwen2.5-14B) only
ships Q4_K_M as a 3-part split; failing on multi-part would leave the
primary model unusable. Matching is case-insensitive and accepts per-preset
spelling variants (f16/fp16). Aux files (tokenizer.json etc.) are filtered
by the listing, so GGUF-only repos no longer fail on files they don't have.
2. The `phi` alias maps to microsoft/Phi-4-mini-instruct (safetensors-only),
yet the default q4k quant forced the GGUF path. The registry gains an
optional gguf_repo twin (bartowski GGUF repos for phi/mistral/llama; all
verified live against the HF tree API) and resolve_weights_repo() routes
quantized requests there. chat/serve use the same resolution so the cache
key matches download's. Repos with no GGUF files and no twin now fail
early with the repo's actual file inventory and an actionable hint,
instead of a 404 on a glob.
ADR-259's "Honest gap" is updated: the 307 redirect was fixed 2026-06-18
(946275a61, PR #590); this closes the remaining GGUF gap.
Tests: 11 new unit tests (tree-JSON fixture parsing, multi-part glob
expansion + ordering, uppercase/lowercase naming, fp16 variant, no-GGUF and
missing-quant error listings, aux filtering, alias-routing decisions).
Verified live: `download microsoft/Phi-4-mini-instruct` routes to the twin
and fetches the real 2.5GB Q4_K_M; `download microsoft/phi-2` fails early
listing available files.
Refs #846, #841, ADR-259.
Co-Authored-By: claude-flow <ruv@ruv.net>
Verified ground truth on origin/main: 336 ADR files (289 plain-counter,
47 namespaced), 27 duplicated plain numbers spanning 61 files
(ADR-272 x5; ADR-264/252/194/144 x3; 22 numbers x2). Corrects issue
#845's ~15+ estimate and its ADR-040 x3 claim — 040/040a/040b is the
intentional sub-ADR convention, not a collision.
- ADR-316: policy — duplicates are frozen historical artifacts, never
renamed; cite duplicated numbers as "ADR-NNN (slug)"; new numbers
come from a single canonical counter whose source of truth is the
generated index. 316 chosen because 305-315 are claimed on
feat/pir-adrs (PR #847).
- docs/adr/INDEX.md: generated canonical index with next-available
number header, per-file title/path/date/status and DUPLICATE flags.
- scripts/adr-index.mjs: regenerates the index; --check exits nonzero
on any duplicate outside the frozen list (CI gate for #845).
Refs #845, #837
Co-Authored-By: claude-flow <ruv@ruv.net>
B-3 residual from the re-review: the optionalDependencies policy
METAHARNESS-README.md attributes to an "upstream ADR-150" is not
unresolvable — it's ruflo's own ADR-150
(v3/docs/adr/ADR-150-metaharness-integration-surfaces.md, "MetaHarness
Integration Surfaces in npx ruflo," Status: Implemented, 2026-06-16),
whose rule 2 is verbatim the optionalDependencies policy in question,
and whose rule 4 (a CI job on the --ignore-optional install path) is a
stronger, CI-testable acceptance criterion than a plain npm install
check. Fixed in all five places the review flagged: ADR-313's Related
line and Context, ADR-306's version-drift note, 03-program-plan.md's
WP0b description and its GitHub issue-breakdown body, and the
verification addendum's section 8c — replacing "does not resolve /
unverified" with the confirmed source and citing rule 4 as WP0b's
acceptance criterion. Noted this as the fourth instance of the same
wrong-repo-ADR-number pattern this program keeps catching (ADR-103,
"metaharness ADR-322", "metaharness ADR-251", and now this one).
Also fixes two nits from the same re-review:
- ADR-312's Context and the addendum's section 8d overcounted ruflo
ADR-322C's signing domains as three; it defines two Ed25519 signing
domains (flywheel-receipt, flywheel-ledger-head) plus a third,
non-signing domain-separated prefix that seeds the deterministic
paired bootstrap's statistics. Corrected in both places, and the
addendum's "ADR-381 needed two corrections" is relabeled "three"
to match the (a)/(b)/(c) list that follows it.
- ADR-315 now cites governing invariant 7 (ruflo ADR-322B's
separation-of-powers rule, adopted in ADR-305) in its Related line,
Decision, and Security Gates — it was previously named as bound by
the invariant in ADR-305 and 03-program-plan.md without the
reciprocal reference.
Co-Authored-By: claude-flow <ruv@ruv.net>
Upstream ADR-150 has been located and verified: ruflo's
v3/docs/adr/ADR-150-metaharness-integration-surfaces.md (Status:
Implemented, 2026-06-16). Rule 2 verbatim: '@metaharness/* packages
MUST appear in optionalDependencies or peerDependencies (optional),
never in dependencies'. Cite it directly in the bridge comment and
error message instead of the previous 'unverified upstream' hedge.
Per rule 4 (package must work on an --ignore-optional install path),
add test/metaharness-optional-deps.js to the chained suite:
(a) parses package.json and asserts all nine MetaHarness packages
appear only in optionalDependencies/peerDependencies (optional),
never in dependencies;
(b) codifies the absence simulation: loads a copy of the compiled
bridge from a scratch dir with no reachable node_modules, asserts
getMetaHarnessCapabilities() degrades to available:false for all
nine, and that a MetaHarness-backed call rejects with
ERR_METAHARNESS_OPTIONAL_MISSING naming the missing package.
Full suite (now 13 chained test files) passes.
Co-Authored-By: claude-flow <ruv@ruv.net>
asset-scout's second spot-check of the addendum found the same
back-propagation gap that hit §5 (ADR-381) also hit §6: two references to
"metaharness ADR-251" were not updated when §8b resolved that citation as
nonexistent. The first (dream-machine ADR-0001's "prior instances" claim)
read as an unqualified assertion; the second listed "ruvnet/metaharness
ADR-251" as one of the "four places" Dream Machine exists, which is a real
error since that document does not exist — the real fourth location is
ruvnet/metaharness's docs/dream-cycle/ directory.
Both now carry the correction inline (with a pointer to §8b) instead of
only being fixed in the later section. Grepped the rest of the file for
the same class of issue (stale "metaharness ADR-322", the LatentMesh
2026-08-19 date, and the autogenous 14-crate count) — none of those have
an unqualified stale twin elsewhere in the document.
Co-Authored-By: claude-flow <ruv@ruv.net>
asset-scout spot-checked commit 313543ace and found the ADRs themselves
correct, but 04-verification-addendum.md section 5 still carried the
pre-correction phrasing: it said ruflo ADR-381 "defines" the sequential
promotion-evidence scheme, omitted that ADR-381 is Proposed (not
Accepted), and dropped the per-epoch qualifier on the 0.6% false-promotion
bound. Section 8d already had the correct facts, so the same document
contradicted itself depending on which section a reader hit first.
Rewrites the section 5 paragraph to attribute the mechanism to PR #2956
and ADR-381's role to governance over it, per-epoch bound included, with
a pointer to section 8d. Also expands section 8b with the exact upstream
source (dream-machine ADR-0001 line 9) of the "metaharness ADR-251"
citation, so a future reader doesn't "fix" ADR-306 back to the wrong
citation on the assumption an ADR-internal reference must already be
resolved.
Co-Authored-By: claude-flow <ruv@ruv.net>
Align crates/ruvector-sota-bench/harness — the direct Darwin consumer —
with the versions the ruvector npm package now targets, closing the
version split that would block WP2's dream-machine integration
(which composes darwin 0.9.x / flywheel 0.1.10):
darwin ^0.9.1 (installs 0.9.2), flywheel ^0.1.10, harness ^0.2.0,
redblue ^0.1.6, router ^0.4.0, workspace-lens ^0.1.2,
metaharness ^0.4.7; weight-eft / workspace-probe stay ^0.1.1.
This package is private, so plain dependencies remain appropriate —
only the versions change. Full suite (7 node --test files, 12 tests,
including the Darwin GEPA suite and capability probes) passes on the
bumped versions.
Co-Authored-By: claude-flow <ruv@ruv.net>
Fixes three blocking findings and several non-blocking ones from
adr-reviewer's adversarial review of the PIR ADR set, cross-checked
against direct clones of ruvnet/LatentMesh, ruvnet/autogenous,
ruvnet/dream-machine, ruvnet/metaharness, and ruvnet/ruflo:
- B-1: ADR-315 and ADR-305 wrongly treated autogenous ADR-401's
Better/Safe/Authorized/Reversible promotion predicate as open work.
ADR-401's Update 1 section 3 marks it DONE upstream
(mesh-evolve.ts's promoteAuthorized, proven by
test/promote-authorized.test.ts) — the capability-table row cited
was stale relative to ADR-401's own Decision section. ADR-315 now
adopts promoteAuthorized instead of scoping work to close it.
- B-2: "metaharness ADR-251" does not exist (metaharness's ADR series
tops out at ADR-250; the Nightly Dream Cycle lives in
docs/dream-cycle/, not an ADR). ADR-306's four citations now point
at docs/dream-cycle/ and note the bad citation's provenance
(inherited from dream-machine ADR-0001) instead of restating it as
fact.
- B-3: "ruvector ADR-150 (optionalDependencies policy)" was a
misattribution — ruvector's own ADR-150 and metaharness's own
ADR-150 are both unrelated documents; METAHARNESS-README.md
attributes the policy to an upstream ADR-150 neither clone
contains. Every reference (ADR-306, ADR-313, 03-program-plan.md)
now cites METAHARNESS-README.md's documented invariant directly,
with the upstream attribution flagged unverified.
Also fixed in the same push:
- ADR-313's WP0b gate: the ruvllm HTTP-307 redirect bug is already
fixed on main (commit 946275a61, PR #590, 2026-06-18); the real
remaining blocker is a GGUF glob/alias mismatch in ruvllm-cli's
get_files_to_download() (download.rs:193, models.rs:65).
- 03-program-plan.md: recorded the 7th governing invariant
(ruflo ADR-322B's proposer/promotion separation, adopted in
ADR-305) that was missing from the "six, unchanged" list; reworded
ADR-list items 0 and 12 as work-package-only entries so the plan's
promised ADR count (11) matches what shipped.
- ADR-306 now attributes "the machine never merges; a human does" to
dream-machine's README (verbatim source) rather than claiming it
verbatim from ADR-0001, whose own section 2.4 phrases the same
substance differently.
- ADR-306/310/312 replace the ruflo ADR-322/322C citations with
source-verified detail (three signing domains, evidence-grading
vocabulary, verbatim 322B quote) now that a full ruflo clone
confirmed them, and correct ADR-381: it is Proposed, not Accepted,
and its own contribution is stream-identity/budget-epoch-reset
governance — the 0.6% false-promotion figure and the alpha_k
allocation belong to ruflo PR #2956's mechanism, which ADR-381
governs. Every family-wise bound is now stated per-epoch, not
globally, per ADR-381's own text.
- ADR-305 adds a standing fix-history verification rule: an inherited
"known bug/gap/not-yet-implemented" claim must be checked against
the named path's actual fix history before being repeated in a PIR
ADR — the root cause shared by all three blocking findings above.
docs/research/perpetual-intelligence-runtime/04-verification-addendum.md
records the full correction trail (new section 8) without editing
02-asset-map.md or 03-program-plan.md's prior content in place.
Co-Authored-By: claude-flow <ruv@ruv.net>
Adapter, not fork: src/dreamMachine.ts drives the published dream-machine
npm engine (v0.1.1, dependency-free bundled dist) through its programmatic
API (run(argv, io)) with an in-memory IO, producing witness-stamped,
engine-verified ledger verdicts that feed the EXISTING promotion path:
verdict -> vetoes.ts PromotionVetoProvider -> flywheel.ts
ruvectorPromotionRule.
Authority split (no duplicated authority): statistics.ts keeps the
paired-bootstrap decision; the engine owns verdict vocabulary, ledger,
and witness stamp; vetoes/flywheel own the promotion recommendation;
a human owns promotion. The adapter exports no promote/merge function
and the verdict object is frozen data — both test-enforced.
Adds docs/research/perpetual-intelligence-runtime/05-dream-machine-consolidation.md,
the keep/adapt/deprecate position for the four implementations (issue #838).
Refs #838, ruvnet/dream-machine#22, ADR-306, ADR-282.
Co-Authored-By: claude-flow <ruv@ruv.net>
Move the eight @metaharness/* packages and metaharness itself out of
hard dependencies into optionalDependencies + peerDependencies (with
peerDependenciesMeta optional), matching the optional-dependency
invariant documented in METAHARNESS-README.md ('Only in
optionalDependencies + peerDependencies', attributed upstream to
'ADR-150: MetaHarness Integration Surfaces' — an upstream metaharness
doc not present in this repo; the repo's own docs/adr/ADR-150 is an
unrelated pi-brain/Tailscale ADR). npm i ruvector must not
force-install the MetaHarness research stack.
Also:
- Bump pins to current published versions: darwin ^0.9.1 (0.9.2),
flywheel ^0.1.10, harness ^0.2.0, redblue ^0.1.6, router ^0.4.0,
workspace-lens ^0.1.2, metaharness ^0.4.7; weight-eft and
workspace-probe unchanged at ^0.1.1.
- Update METAHARNESS_VERSIONS in the lazy CJS->ESM bridge to match.
- Wrap module-not-found failures in loadPackage() with a clear error
naming the missing optional package (ERR_METAHARNESS_OPTIONAL_MISSING)
instead of surfacing a raw ESM resolution error.
All 12 chained package tests pass with the bumped versions.
Co-Authored-By: claude-flow <ruv@ruv.net>
Adds ADR-305 through ADR-315, the eleven architecture decisions for the
Perpetual Intelligence Runtime program: adopting LatentMesh ADR-009 and
autogenous ADR-401 as the program's control-loop spine and definition of
record; adopting the ruvnet/dream-machine evaluation engine wired to
ruvector's research-gate/sota-bench statistics and Darwin; three-level
persistent memory (LiveMem + TARL); WorldCycle-style physical-action
verification; greenfield LatentMesh transport/RVF/RVM crates coordinated
on wire format; a causal-attribution CI gate; net-new anomaly quarantine
(explicitly not "LATTE", which is not a real paper); a shared witness
record schema and cross-layer anchoring contract anchored on ruflo
ADR-322C rather than merging the rvm-witness and autogenous witness
crates; the SHAPER-pattern frozen-weight skill/harness evolution loop;
KV-cache cross-model migration in ruvLLM; and a governance constitution
for capability expansion built on autogenous's admission-gate pattern.
All ADRs are numbered above the repo's true existing maximum (ADR-304,
confirmed by scanning every filename in docs/adr/ rather than assuming
uniqueness, since duplicate numbers exist elsewhere in the sequence) and
cite only sources verified against primary text in
docs/research/perpetual-intelligence-runtime/.
Co-Authored-By: claude-flow <ruv@ruv.net>
Adds the three source research documents for the Perpetual Intelligence
Runtime (PIR) program (evidence review, asset map, program plan) plus a
verification addendum capturing direct source checks against LatentMesh,
autogenous, and ruflo that materially correct or extend several asset-map
claims (LatentMesh scale, autogenous's full ADR catalog and TypeScript
governance implementation, the rvm-witness/autogenous-witness comparison,
ruflo ADR-322's flywheel-integration series, and the ruvnet/dream-machine
repo) without editing the asset map in place.
Co-Authored-By: claude-flow <ruv@ruv.net>
The terminate-after cap added in #822 (10 minutes) was sized for the
regular shards and killed legitimately long tests on the first sharded
run of main: ruvector-mincut subpolynomial tests and
ruvector-nervous-system pattern_separation_collision_rate all TIMEOUT
at exactly 600s in run 31714159600, failing ml-research-heavy and
core-and-rest-heavy. Historical successful runs of those shards take
up to ~75 minutes with individual tests exceeding 10 minutes by design.
Scope a slow-timeout override to the 13 packages of the two heavy
shards: 300s SLOW reporting period, killed after 18 periods (90 min) —
still bounding a genuine hang at 1.5h instead of the 4h job budget.
Co-Authored-By: claude-flow <ruv@ruv.net>
Doc corrections (merge gate for PR #824):
- State the actual threat model everywhere: receipts detect post-issuance
mutation of a receipt/result pair; they do NOT protect against a
dishonest query engine and do NOT prove write-chain membership. Leaves
commit to COPIES of WriteReceipt fields and verification never consults
the write gate, so a mutated ingestion history leaves already-issued
receipts verifying. Named future work: bind leaves to MerkleGate's MMR
membership proofs (HashChainGate::verify_receipt needs the live chain;
no offline membership proof exists).
- Soften "verifiable offline without trusting the query engine" to match
reality (unsigned, engine-chosen leaves).
- Relabel the 2x/2.1x benchmark comparison: PerResultReceipt proof size
is defined as genesis-anchored replay O(idx); a head-anchored verifier
needs only the O(k-idx) suffix, so the durable claim is asymptotic
O(log k) vs O(k), not the constant. Reframe 200/200 tamper detection
as a SHA-256 regression check, not an empirical rate (incl. ADR-304
Rejection Criteria).
- Reword ADR-304 Evidence line citing
index_state_root_changes_receipts_across_reingestion (that test
compares roots only; it builds no receipt).
- Applications table: legal/medical row no longer marketed as
chain-of-custody.
Code fixes:
- verify_full now fails closed on empty result sets (was vacuously true);
documented + tested for all variants.
- RetrievalIndex::search uses total_cmp instead of
partial_cmp().unwrap() (NaN no longer panics a public API).
- gate_variant is bound into each result leaf so a NullGate receipt
(all-zero commitment) is distinguishable from a gated one; tested.
Tests: 14 passed (was 12). Clippy -D warnings and fmt clean.
Co-Authored-By: claude-flow <ruv@ruv.net>
Review (measured, with rebuilt crate) found the PoC's headline claim does not
hold: EntropyScaledEf computes ef_actual=122-124 for every query — no per-query
adaptivity — and FixedEf(124) reproduces its recall to four decimal places on
all three query sets. The reported +1.6-3.9pp recall gain was entirely the
2.5x larger ef budget, not entropy. Entropy separation between easy and hard
queries is negative at every usable temperature (softmin entropy over
retrieved-neighbour distances tracks local density, wrong sign for beam
control); T=0.1 is effectively infinite temperature on this data.
Fixes applied:
- graph.rs: add FlatGraph::is_empty() (clippy len_without_is_empty CI blocker),
use it in find_entry
- benchmark.rs: move ground_truth() out of the timed closure (it was ~41% of
reported time, hiding a real ~50% search-only latency regression); add
FixedEf(124, matched) control rows so the adaptive claim is falsifiable
- lib.rs: recall_at_k denominator is now min(k, |ground_truth|) only — no
longer shrinks with |results|, which rewarded early termination
- search.rs: fix doc/code mismatch (scale uses ln(|results|), docs said ln(k));
document measured outcomes on both entropy variants
- tests: graph_is_symmetric_on_uniform now asserts the reciprocity fraction it
computes; renamed entropy_threshold_exits_early_on_easy_query and
entropy_scaled_ef_expands_for_hard_queries to match what they actually test
- ADR-303: status now 'Closed — negative result'; removed 'recommended' and
'validated in the PoC benchmark' for Strategy B and the false 'same nominal
ef budget' claim; documented the matched-budget equivalence and wrong-sign
finding; marked the multi-layer-HNSW rescue as untested conjecture
- research README + gist: results regenerated with honest search-only timing
(FixedEf(50) ~33us vs EntropyScaledEf ~50us) and matched-budget comparison
cargo test / clippy -D warnings / fmt --check all pass.
Co-Authored-By: claude-flow <ruv@ruv.net>
The `core-and-rest` catch-all shard was not sharding. Its `packages:` value
is a YAML folded scalar (`>-`) that contained `#`-prefixed lines *inside*
the scalar. Those are content, not YAML comments: folding joins the whole
block onto one line, and when `run:` expands `${{ matrix.packages }}` the
shell treats the first `#` as the start of a comment and truncates the rest
of the command.
The effective command was therefore:
cargo nextest run --no-fail-fast --workspace
0 of 162 `--exclude` flags survived. Every shard split landed in iters
230-240 was inert — the catch-all kept building and testing all 210
workspace crates, which is why it kept drifting into the job timeout no
matter how many crates were hoisted out of it. The doctest step had the
same truncation. `core-and-rest-wasm` had the same defect but its inline
comment was trailing prose with no flags after it, so all 29 `-p` flags
survived; fixed anyway so the pattern does not get copied.
Move every comment above the `packages:` key at mapping level, where YAML
strips it — the pattern the `core-platform` entry already used. The folded
scalars now contain only `--workspace`, `--exclude <crate>`, and
`-p <crate>` tokens.
Verified by parsing the workflow with PyYAML and diffing each shard's
effective package set against `cargo metadata`: 162 excludes / 50 effective
packages in the catch-all, 203 of 210 crates covered, no crate built twice.
Also add `.config/nextest.toml` with a 10-minute per-test kill switch.
`ruvector-delta-index::tests::test_insert_and_search` hangs indefinitely in
DeltaHnsw insert/search rather than failing, and with no timeout it consumed
3h52m of the 240-minute `core-platform` budget. Hold that crate out of CI
until it is fixed (#825).
Co-Authored-By: claude-flow <ruv@ruv.net>
Full methodology, raw benchmark output, memory/performance math,
practical and long-horizon applications, and falsification criteria
for the 2026-08-13 retrieval-receipts nightly run.
Documents the hypothesis, evidence, alternatives considered, and
rejection criteria for promoting retrieval receipts beyond the
experimental crate, including the disclosed Merkle padding
malleability limitation.
Extends ruvector-proof-gate's write-side integrity to the read path:
retrieval receipts bind each query result to the WriteReceipt produced
at ingestion, closing the write->read provenance loop for RAG audits.
Three variants (NoReceipt / PerResultReceipt / MerkleReceipt) measured
against a proof-gate-backed brute-force index. 12 unit tests cover
honest verification and four independent tamper kinds per variant.
Implements Shannon entropy of the candidate-heap distance distribution as
a live beam-width gate for ANN graph traversal — a novel application of
EDEN's entropy-based branching (ICML 2026) to HNSW-style search.
Three variants (FixedEf baseline, EntropyThresholdBeam, EntropyScaledEf)
benchmarked on 16D clustered synthetic data (N=2000, k=10, ef=50).
EntropyScaledEf achieves +1.6–3.9 pp recall@10 vs FixedEf at equal ef.
- 15 unit tests, all pass
- Zero external dependencies
- Real benchmark numbers, no mocks or placeholder values
- ADR-303 and research README included
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_018DMsyZzgWJ1pWw3svjfAAG
