release(main): Stage-verified remote readiness repair

.github/workflows/build-binaries.yml

@@ -280,6 +280,16 @@ jobs:
       - name: Build UI
         run: pnpm --filter @role-model-router/runtime-ui run build
 
+      # The Track B adapter bundles sqlite-memory directly from TypeScript.
+      # That package resolves profile-aggregator through its runtime export,
+      # which intentionally targets dist/.  A fresh CI checkout therefore
+      # needs this focused public build before the paired private distribution
+      # can be assembled.
+      - name: Build public runtime adapter dependencies
+        if: env.ROLE_MODEL_BUILD_CHANNEL == 'stage' || env.ROLE_MODEL_BUILD_CHANNEL == 'production'
+        working-directory: ${{ env.ROLE_MODEL_BUILD_CHANNEL == 'production' && '.cache/paired-public' || '.' }}
+        run: corepack pnpm --filter @role-model-router/profile-aggregator... build
+
       - name: Validate exact private release revision
         if: env.ROLE_MODEL_BUILD_CHANNEL == 'stage' || env.ROLE_MODEL_BUILD_CHANNEL == 'production'
         shell: bash
@@ -440,21 +450,20 @@ jobs:
             }
           }
 
-      - name: Include managed stage secrets in the stage package
-        if: env.ROLE_MODEL_BUILD_CHANNEL == 'stage'
+      - name: Assert release package has no bundled secret material
         shell: pwsh
-        env:
-          STAGE_ARTIFACT_DIGEST_KEY: ${{ secrets.STAGE_ARTIFACT_DIGEST_KEY }}
-          STAGE_ARTIFACT_ENCRYPTION_KEY: ${{ secrets.STAGE_ARTIFACT_ENCRYPTION_KEY }}
-          STAGE_DESTINATION_MATERIAL: ${{ secrets.STAGE_DESTINATION_MATERIAL }}
-          STAGE_RECOMMENDATION_MATERIAL: ${{ secrets.STAGE_RECOMMENDATION_MATERIAL }}
         run: |
-          $secretsDir = "role-model-router/dist/release/${{ matrix.target }}/secrets"
-          New-Item -ItemType Directory -Force -Path $secretsDir | Out-Null
-          [IO.File]::WriteAllText("$secretsDir/artifact-digest.key", $env:STAGE_ARTIFACT_DIGEST_KEY)
-          [IO.File]::WriteAllText("$secretsDir/artifact-encryption.key", $env:STAGE_ARTIFACT_ENCRYPTION_KEY)
-          [IO.File]::WriteAllText("$secretsDir/destination-material.json", $env:STAGE_DESTINATION_MATERIAL)
-          [IO.File]::WriteAllText("$secretsDir/recommendation-material.json", $env:STAGE_RECOMMENDATION_MATERIAL)
+          $packageDir = "role-model-router/dist/release/${{ matrix.target }}"
+          $forbiddenPaths = @(
+            "$packageDir/secrets",
+            "$packageDir/.env",
+            "$packageDir/.env.local"
+          )
+          foreach ($path in $forbiddenPaths) {
+            if (Test-Path $path) {
+              throw "Bundled secret material is forbidden in release packages: $path"
+            }
+          }
 
       - name: Archive standalone package (Unix)
         if: matrix.target != 'win32-x64'

docs/operations/02-ci-and-release-flow.md

@@ -56,6 +56,10 @@ Reviewed `hotfix/* -> main` is the explicit emergency exception.
 packages are available by explicit manual dispatch. Every successful `stage` push publishes a GitHub prerelease with
 all four stage-channel archives and `SHA256SUMS.txt`; prereleases are never selected by the stable installers.
 
+An explicit `workflow_dispatch` build is useful for package diagnostics, but it does not publish or replace a Stage
+prerelease. To create a candidate for acceptance, promote a reviewed public change through `dev -> stage` so that a
+`stage` push produces a new immutable `stage-rc-<stage-sha>` identity.
+
 After testing, a maintainer runs `.github/workflows/accept-release-candidate.yml` with the exact prerelease tag and
 checks the explicit acceptance input. That workflow re-downloads the candidate, validates all checksums and stage
 manifests, and creates the immutable `rc-approved/<full-stage-sha>` receipt. Do not approve a candidate based only on

package.json

@@ -65,7 +65,7 @@
     "storage:compact": "node scripts/track-b/run-command-test.mjs TB06-CMD-04",
     "test:track-b-authorization": "node scripts/track-b/run-command-test.mjs TB07-CMD-03",
     "test:rust": "cargo test --manifest-path role-model-router/rust/Cargo.toml --workspace",
-    "smoke": "corepack pnpm --filter @role-model-router/gateway-smoke exec tsx src/index.ts",
+    "smoke": "corepack pnpm --filter @role-model-router/gateway-smoke... run build && corepack pnpm --filter @role-model-router/gateway-smoke exec tsx src/index.ts",
     "ci:check": "corepack pnpm run lint && corepack pnpm run schemas:validate && corepack pnpm run build && corepack pnpm run test && corepack pnpm run runtime:test-critical && corepack pnpm run test:rust && corepack pnpm run smoke"
   },
   "devDependencies": {

packages/extension-host/index.mjs

@@ -9,6 +9,33 @@ import {
   verifySignedBundle,
 } from "../extension-sdk/index.mjs";
 
+/**
+ * Reject malformed graph-contract metadata at the host boundary.  Extension
+ * packages must not be able to treat an incomplete registry as a usable
+ * contract, even when they are loaded independently from the Track-B bundle.
+ */
+export function validateGraphRegistry(registry) {
+  if (!registry || registry.version !== 1 || !Array.isArray(registry.kinds)) {
+    throw new Error("invalid graph registry");
+  }
+  const seen = new Set();
+  const kinds = registry.kinds.map((kind) => {
+    if (
+      !kind?.id ||
+      !Number.isInteger(kind.version) ||
+      !kind.category ||
+      !Array.isArray(kind.fields)
+    ) {
+      throw new Error("incomplete graph registry entry");
+    }
+    const key = `${kind.id}@${kind.version}`;
+    if (seen.has(key)) throw new Error(`duplicate graph registry entry: ${key}`);
+    seen.add(key);
+    return Object.freeze({ ...kind, fields: Object.freeze([...kind.fields]) });
+  });
+  return Object.freeze({ version: registry.version, kinds: Object.freeze(kinds) });
+}
+
 const runtimePath = fileURLToPath(new URL("./worker-runtime.mjs", import.meta.url));
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const normalizeModuleUrl = (value) =>

role-model-router/apps/runtime-host-bridge/package.json

@@ -41,8 +41,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",
-    "test:critical": "vitest run test/account-repair.test.ts test/unified-runtime-config.test.ts test/provider-overlap-metadata.test.ts test/benchmark-summary.test.ts test/validate-observability.test.ts test/validate-ui.test.ts",
-    "test:router": "vitest run test/controller-routing-contract.test.ts test/runtime-routing-model.test.ts test/request-capability-inference.test.ts test/alias-capability-routing.test.ts test/restart-rehydration.test.ts test/endpoint-rehydration.test.ts test/model-capability-resolver.test.ts test/session-readiness-api.test.ts test/downstream-openai-discovery.test.ts test/validate-restart-rehydration.test.ts test/validate-observability.test.ts",
+    "test:critical": "corepack pnpm --filter @role-model-router/profile-aggregator build && vitest run test/account-repair.test.ts test/unified-runtime-config.test.ts test/provider-overlap-metadata.test.ts test/benchmark-summary.test.ts test/validate-observability.test.ts test/validate-ui.test.ts",
+    "test:router": "corepack pnpm --filter @role-model-router/profile-aggregator build && vitest run test/controller-routing-contract.test.ts test/runtime-routing-model.test.ts test/request-capability-inference.test.ts test/alias-capability-routing.test.ts test/restart-rehydration.test.ts test/endpoint-rehydration.test.ts test/model-capability-resolver.test.ts test/session-readiness-api.test.ts test/downstream-openai-discovery.test.ts test/validate-restart-rehydration.test.ts test/validate-observability.test.ts",
     "package-sea": "tsx src/package-sea.ts",
     "validate-packaging": "corepack pnpm build && tsx src/validate-packaging.ts"
   }

role-model-router/apps/runtime-host-bridge/src/cli.ts

@@ -703,9 +703,7 @@ export function applyRecommendationServiceLauncherConfig(values: LauncherConfigV
     (channel === "stage" ? "https://recommendations-stage.role-model.dev" : undefined);
   const verificationKey = readLauncherString(values, "recommendation-verification-key");
   const serviceToken = readLauncherString(values, "recommendation-service-token");
-  const materialFile =
-    readLauncherString(values, "recommendation-material-file") ??
-    (channel === "stage" ? path.resolve("secrets", "recommendation-material.json") : undefined);
+  const materialFile = readLauncherString(values, "recommendation-material-file");
   const aggregateScope = readLauncherString(values, "aggregate-scope");
   const recommendationScope = readLauncherString(values, "recommendation-scope");
 
@@ -1007,6 +1005,13 @@ export async function main(): Promise<void> {
       ),
     });
     let postObservationOperations: ReturnType<typeof createTrackBOperations> | null = null;
+    // `createBackend` initializes this after the packaged runtime is selected.
+    // Keep that initialization boundary opaque to TypeScript's local control-flow
+    // analysis: the public-only build does not inline the private operations
+    // adapter, but startup still needs to retry a durable outbox when it is
+    // available at runtime.
+    const currentPostObservationOperations = (): ReturnType<typeof createTrackBOperations> | null =>
+      postObservationOperations;
     const drainPostObservationOutbox = async (
       runtime: Awaited<ReturnType<typeof createProductionExtensionRuntime>>,
     ) =>
@@ -1212,6 +1217,10 @@ export async function main(): Promise<void> {
       }
       const trackBStateRoot = path.join(options.runtimeStateRoot, options.scopeId, "track-b");
       const runtimeChannel = packagedProfile?.channel ?? "development";
+      const destinationTrustMaterialFile =
+        args.values["destination-material-file"] ??
+        args.values["destination-trust-material-file"] ??
+        process.env.ROLE_MODEL_DESTINATION_AUTH_SECRET_FILE;
       const artifactKeyFiles = await resolveManagedArtifactKeyFiles({
         channel: runtimeChannel,
         stateRoot: trackBStateRoot,
@@ -1244,23 +1253,19 @@ export async function main(): Promise<void> {
           channel: runtimeChannel,
           artifactDigestKeyFile: artifactKeyFiles.artifactDigestKeyFile,
           artifactEncryptionKeyFile: artifactKeyFiles.artifactEncryptionKeyFile,
-          trustMaterialFile:
-            args.values["destination-material-file"] ??
-            args.values["destination-trust-material-file"] ??
-            process.env.ROLE_MODEL_DESTINATION_AUTH_SECRET_FILE ??
-            (runtimeChannel === "stage"
-              ? path.resolve("secrets", "destination-material.json")
-              : undefined),
+          trustMaterialFile: destinationTrustMaterialFile,
           aggregateEndpoint:
             args.values["aggregate-ingestion-url"] ??
             process.env.ROLE_MODEL_AGGREGATE_INGESTION_URL ??
-            (runtimeChannel === "stage"
+            (runtimeChannel === "stage" && destinationTrustMaterialFile
               ? "https://ingest-stage.role-model.dev/contribution/aggregate"
               : undefined),
           aggregateScope:
             args.values["aggregate-scope"] ??
             process.env.ROLE_MODEL_AGGREGATE_SCOPE ??
-            (runtimeChannel === "stage" ? "standalone-runtime-stage" : undefined),
+            (runtimeChannel === "stage" && destinationTrustMaterialFile
+              ? "standalone-runtime-stage"
+              : undefined),
           ...(aggregateCorrelationReleaseId && aggregateCorrelationCohortId
             ? {
                 aggregateCorrelationReleaseId,
@@ -1320,6 +1325,9 @@ export async function main(): Promise<void> {
           qaStartupReceipts.set(extension.descriptor.id, { ...receipt, requestId });
         }
         await drainPostObservationOutbox(extensionRuntime);
+        // A prior cloud outage must not require an unrelated new provider request
+        // before its already-authorized, durable aggregate is retried.
+        await currentPostObservationOperations()?.retryContributionAggregates();
       } catch (error) {
         console.error("[role-model] extension host failed after core runtime was ready:", error);
       }

role-model-router/apps/runtime-host-bridge/src/index.ts

@@ -25748,6 +25748,15 @@ export async function createRuntimeBridgeBackend(
       const contribution = (await operations.readContributionState()) as {
         readonly recommendationTier?: string;
       };
+      const recommendationTier = contribution.recommendationTier ?? "advanced";
+      const persistedCursor = await operations.readRecommendationCursor();
+      const activeCursor =
+        persistedCursor?.channel === channel &&
+        persistedCursor.scopeId === recommendationScopeId &&
+        persistedCursor.recommendationTier === recommendationTier
+          ? persistedCursor
+          : null;
+      const legacyRecommendationRevision = await operations.readRecommendationRevision();
       let run88CorrelationHeader: Record<string, string> = {};
       if (runtimeChannel === "stage") {
         const identity = options.run88StageIdentity;
@@ -25783,9 +25792,15 @@ export async function createRuntimeBridgeBackend(
           channel,
           runtimeChannel: channel,
           releaseTrack: "stable",
-          recommendationTier: contribution.recommendationTier ?? "advanced",
+          recommendationTier,
           clientSchemaVersions: ["1.0.0"],
-          activeChannelSequence: 0,
+          activeChannelSequence: activeCursor?.channelSequence ?? 0,
+          ...(activeCursor
+            ? {
+                activeSnapshotId: activeCursor.snapshotId,
+                activeManifestHash: activeCursor.manifestHash,
+              }
+            : {}),
           identityKind: "anonymous_public",
           scopeId: recommendationScopeId,
           boundaryProtocolVersion: "1.1",
@@ -25797,10 +25812,30 @@ export async function createRuntimeBridgeBackend(
         return operations.listRecommendations();
       if (
         resolved.status !== "available" ||
+        !Number.isSafeInteger(Number(resolved.channelSequence)) ||
+        typeof resolved.snapshotId !== "string" ||
         typeof resolved.bundleUri !== "string" ||
         typeof resolved.manifestHash !== "string"
       )
         throw new Error("recommendation resolve response did not include an available bundle");
+      const recommendationCursor = {
+        channel,
+        scopeId: recommendationScopeId,
+        recommendationTier,
+        channelSequence: Number(resolved.channelSequence),
+        snapshotId: resolved.snapshotId,
+        manifestHash: resolved.manifestHash,
+      };
+      if (!activeCursor && recommendationCursor.channelSequence === legacyRecommendationRevision) {
+        const existing = await operations.listRecommendations();
+        if (
+          existing.length > 0 &&
+          existing.every((row) => row.provenance === `cloud:${recommendationCursor.manifestHash}`)
+        ) {
+          await operations.rememberRecommendationCursor(recommendationCursor);
+          return existing;
+        }
+      }
       const manifestUrl = new URL(resolved.bundleUri);
       const manifestResponse = await fetch(manifestUrl);
       if (!manifestResponse.ok)
@@ -25840,6 +25875,7 @@ export async function createRuntimeBridgeBackend(
           signature,
         },
         verificationKey,
+        recommendationCursor,
       );
     },
     async applyRecommendation(body: Record<string, unknown>): Promise<unknown> {

role-model-router/apps/runtime-host-bridge/src/remote-health-probe.test.ts

@@ -45,6 +45,64 @@ describe("remote-health-probe", () => {
     });
   });
 
+  it("coalesces one model-list request across effort siblings on the same provider account", async () => {
+    let requestCount = 0;
+    const result = await probeRemoteEndpoints({
+      litellmHealthy: true,
+      targets: [
+        {
+          endpointId: "deepseek.personal.primary.global.deepseek-v4-flash",
+          providerAccountId: "deepseek.personal.primary",
+          modelId: "deepseek/deepseek-v4-flash",
+          apiBase: "https://api.deepseek.com/v1",
+          servingSource: "remote-service",
+        },
+        {
+          endpointId: "deepseek.personal.primary.global.deepseek-v4-flash-max",
+          providerAccountId: "deepseek.personal.primary",
+          modelId: "deepseek/deepseek-v4-flash",
+          apiBase: "https://api.deepseek.com/v1",
+          servingSource: "remote-service",
+        },
+        {
+          endpointId: "deepseek.personal.primary.global.deepseek-v4-pro-max",
+          providerAccountId: "deepseek.personal.primary",
+          modelId: "deepseek/deepseek-v4-pro",
+          apiBase: "https://api.deepseek.com/v1",
+          servingSource: "remote-service",
+        },
+      ],
+      resolveAuthorization: async () => "deepseek-live-key",
+      networkFetcher: async () => {
+        requestCount += 1;
+        return new Response(
+          JSON.stringify({ data: [{ id: "deepseek-v4-flash" }, { id: "deepseek-v4-pro" }] }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      },
+    });
+
+    expect(requestCount).toBe(1);
+    expect(result).toMatchObject({ probed: 3, healthy: 3, degraded: 0 });
+    expect(result.results).toMatchObject([
+      {
+        endpointId: "deepseek.personal.primary.global.deepseek-v4-flash",
+        modelId: "deepseek/deepseek-v4-flash",
+        reason: "healthy",
+      },
+      {
+        endpointId: "deepseek.personal.primary.global.deepseek-v4-flash-max",
+        modelId: "deepseek/deepseek-v4-flash",
+        reason: "healthy",
+      },
+      {
+        endpointId: "deepseek.personal.primary.global.deepseek-v4-pro-max",
+        modelId: "deepseek/deepseek-v4-pro",
+        reason: "healthy",
+      },
+    ]);
+  });
+
   it("maps auth failures to degraded health with auth reason", async () => {
     const result = await probeRemoteEndpoints({
       litellmHealthy: true,