Repository navigation
ruvnet-brain: content-addressed corpus releases, sig/receipt recorded - #15
Merged
Merged
Conversation
Upstream stuinfla/ruvnet-brain now publishes signed, content-addressed
generations (tags corpus-sha256-<archive digest>, with .zip.sig and
corpus-receipt.json). The ingest now:
- selects GitHub's designated /releases/latest, falling back to the list
only when that release lacks the zip. The list API orders by creation
time and put runtime release v4.5.2 ahead of the promoted
corpus-sha256-832bae01…, so first-in-list picked the wrong corpus;
- for corpus-sha256-* tags, requires the published .zip.sha256 to equal the
tag digest before downloading, and the bytes to hash to it;
- fetches .zip.sig and corpus-receipt.json beside the zip, refuses a receipt
whose archive digest differs from the zip, or whose own digest differs from
the release body's "Receipt SHA-256";
- records sig_present/sig_bytes, receipt_sha256, receipt_matches_archive,
archive_sha256, content_addressed and shipped_runtime in the manifest, and
keeps the full tag as corpus_version. signature_verified is always false
("no published public key"): no key is guessed;
- is import-safe (entry guard, pg loaded in main) so the pure helpers are
unit-tested in tests/ruvnet-brain-ingest.spec.mjs (16 tests, node --test).
ruvnet_brain_status gains a derived provenance block. The skill documents the
tag scheme, the provenance fields, that `npx ruvnet-brain` (RVF into
~/.cache) is not our path, the isovision.ai docs link, and the serial
REINDEX the ingest does not perform.
Co-Authored-By: jjohare <github@thedreamlab.uk>
… on ADR-2104 and the skill Co-Authored-By: jjohare <github@thedreamlab.uk>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ingest now handles upstream's signed, content-addressed corpus generations (
corpus-sha256-<archive digest>). This PR is the CI vehicle; per the owner it lands on main once CI is green./releases/latest. The list API had orderedv4.5.2ahead of the promotedcorpus-sha256-832bae01…, so the old first-in-list logic would have stamped the wrong corpus. It falls back to the list only when the designated release has no zip..zip.sha256must equal the tag digest, checked before the download, and the downloaded bytes must hash to it..zip.sigandcorpus-receipt.jsonare fetched beside the zip. The receipt's archive digest must equal the zip digest, and the receipt must match the release body'sReceipt SHA-256. The signature is only recorded:signature_verified: falsewith the reason "no published public key". No key is guessed.content_addressed,archive_sha256,sig_present,sig_bytes,receipt_sha256,receipt_matches_archiveandshipped_runtime.ruvnet_brain_statusgains a derivedprovenanceblock.npx ruvnet-brainis not our path, links the isovision.ai docs, and corrects the rebuild command to the serialREINDEX.node --test tests/ruvnet-brain-ingest.spec.mjsruns 16 tests, all written red first.Live reconcile, 2026-10-03: v4.5.1 →
corpus-sha256-832bae01…. Of 162,292 chunks, 1,518 were embedded, 160,774 were unchanged and 450 were pruned, with 0 failures, in 9 min 9 s. The ingest does not rebuild the HNSW index; the serial REINDEX is a follow-up.🤖 Generated by Claude Code