Merge pull request #1387 from Hellblazer/release/v6.5.0

release: conexus 6.5.0

Author: Hellblazer

.beads/interactions.jsonl

@@ -1227,3 +1227,25 @@
 {"id":"int-da059ced04cb2489f1a3e6b727674e7c","kind":"field_change","created_at":"2026-07-08T01:06:40.646021Z","actor":"Hellblazer","issue_id":"nexus-mzvwa.8","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed on develop 6a461ba6. git_add_all rule reordered scan-then-escape: an escape event now means 'would have been denied, operator overrode' — the 6,130-phantom-escape class (any annotated Bash command logging escape on an unmatched rule) is dead. TDD: phantom-escape regression (failed pre-fix) + true-escape preservation, 17/17. Installed marketplace copy + all 12 cache copies patched in place (a69bea88 precedent) so telemetry is clean immediately, not at 6.4.0. grep rule moot (unregistered since a69bea88); phase_review already correct. Remaining telemetry work: nexus-mzvwa.9."}}
 {"id":"int-8ffd92da330ce08958e5c67950db84bd","kind":"field_change","created_at":"2026-07-08T01:21:51.169808Z","actor":"Hellblazer","issue_id":"nexus-myk4e","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"SHIPPED + CI-GREEN end to end. Workflow .github/workflows/guided-upgrade-mvv.yml registered on main (PR #1384, merged after a wall-clock flake rerun — flake filed nexus-77fqp); develop carries the bge build-ARG plumbing (1decccd3). Dispatch shakeout run 28910150293 completed SUCCESS on the ubuntu runner: full chain proven in CI — uv sync, wheel build, GraalVM -Ob native build in docker, rehearsal image with the SELF-HOSTED bge asset fetch (no HuggingFace dependency), and the BARE default-path guided journey (the nexus-id750 harness leg that caught both GH #1381 criticals). Cadence per CI-cost directives: weekly Mon 10:41 UTC + workflow_dispatch + develop-push path-gated on migration inputs; no secrets; concurrency-cancelled; success-marker grep + log artifact. Also validated locally end-to-end with the CI asset URLs before wiring. The release-N+1 hard gate (RDR-002 ez5.14/15 escalation) now exists: RDR-155 P4b's myk4e precondition is SATISFIED (P4b itself remains DO-NOT-START pending Hal's explicit go + the 6.3.8 adoption window per the gate comments on 7bomn/19svb)."}}
 {"id":"int-1b79c70b256310d43f4c7278ed3075ae","kind":"field_change","created_at":"2026-07-08T01:53:44.693105Z","actor":"Hellblazer","issue_id":"nexus-yv5m4","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Fixed on develop bed75396. _acquire_pg_bundle_step downloads+verifies (sha256+Sigstore) nexus-pg-<platform>.txz from the pinned tag when host preflight raises PgBinaryNotFoundError/PgVectorNotInstalledError; wired into _provision_postgres_step before provision(). 10 regression tests (tests/test_init_pg_bundle_acquire.py). Stacked review: critic clean (test gap added), code-review High fixed (unguarded extraction). Workaround posted GH #1381 for 6.3.8 users: nx daemon service install-binary engine-service-v0.1.32. CI-exercise of this path = nexus-5qefg."}}
+{"id":"int-63bc7ad2213dc6b13bbc7a3e844f8617","kind":"field_change","created_at":"2026-07-08T05:11:17.157343Z","actor":"Hellblazer","issue_id":"nexus-o02xe","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-81640f9f4b9485861e654cd6a019614f","kind":"field_change","created_at":"2026-07-08T05:11:18.319969Z","actor":"Hellblazer","issue_id":"nexus-v92zj","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-cdc49b5356c641ea0bdd921fb6894331","kind":"field_change","created_at":"2026-07-08T05:19:20.127414Z","actor":"Hellblazer","issue_id":"nexus-5qefg","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-2757850695ddd5764b2dab9cd2cf1329","kind":"field_change","created_at":"2026-07-08T12:18:08.908731Z","actor":"Hellblazer","issue_id":"nexus-53x7s","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-5ba58e67d0483a62e68454f2c6699952","kind":"field_change","created_at":"2026-07-08T12:43:59.701085Z","actor":"Hellblazer","issue_id":"nexus-2bqpn","extra":{"field":"status","new_value":"open","old_value":"in_progress"}}
+{"id":"int-a68af13ec3263f798166db686326e18c","kind":"field_change","created_at":"2026-07-08T13:12:29.559501Z","actor":"Hellblazer","issue_id":"nexus-7ndh3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-d7e7957de09082e5baa325da0cc40381","kind":"field_change","created_at":"2026-07-08T13:31:23.714677Z","actor":"Hellblazer","issue_id":"nexus-uizok","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-93a2fcb4b900a153909a59d0f1434047","kind":"field_change","created_at":"2026-07-08T13:48:28.009593Z","actor":"Hellblazer","issue_id":"nexus-oub13","extra":{"field":"status","new_value":"blocked","old_value":"in_progress"}}
+{"id":"int-7a2ac1d20e75becabaf195658eb588ef","kind":"field_change","created_at":"2026-07-08T14:05:09.903838Z","actor":"Hellblazer","issue_id":"nexus-mzvwa.9","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-abaad2db1aec45c390c6c827f4f7f878","kind":"field_change","created_at":"2026-07-08T14:26:08.541852Z","actor":"Hellblazer","issue_id":"nexus-9kq3h","extra":{"field":"status","new_value":"open","old_value":"in_progress"}}
+{"id":"int-14d787502f99f3b7ce5c7f723146dffd","kind":"field_change","created_at":"2026-07-08T14:30:51.375778Z","actor":"Hellblazer","issue_id":"nexus-z4skl","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-6df0aff032a611433b274ac5f43bbefa","kind":"field_change","created_at":"2026-07-08T14:39:00.695646Z","actor":"Hellblazer","issue_id":"nexus-1jt17","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-f44e71c7337fffc96f8d9794fa60cbfd","kind":"field_change","created_at":"2026-07-08T14:57:05.582345Z","actor":"Hellblazer","issue_id":"nexus-nj4ch","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-e69d7e0f3667490b072e91a2c93d0fdc","kind":"field_change","created_at":"2026-07-08T15:25:02.702368Z","actor":"Hellblazer","issue_id":"nexus-fhhwf","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-d2ea16055311a9d115d77d78a049cc95","kind":"field_change","created_at":"2026-07-08T15:25:03.919516Z","actor":"Hellblazer","issue_id":"nexus-vxgnh","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-314c8ae30daa83006091a6c248a17ac4","kind":"field_change","created_at":"2026-07-08T15:49:24.02435Z","actor":"Hellblazer","issue_id":"nexus-yq8rd","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-ffa3e1ecbe1e9e1a6c6549d6fdf7a52b","kind":"field_change","created_at":"2026-07-08T15:55:21.276924Z","actor":"Hellblazer","issue_id":"nexus-7n553","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-98c1c41e7a87880629aa73e768446420","kind":"field_change","created_at":"2026-07-08T15:55:23.186815Z","actor":"Hellblazer","issue_id":"nexus-d01js","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-e44a1b6cb7ae9c053b83dda34e83f16a","kind":"field_change","created_at":"2026-07-08T16:44:51.469244Z","actor":"Hellblazer","issue_id":"nexus-iytd3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-9349296e80ecb013c5f409eb88325faa","kind":"field_change","created_at":"2026-07-08T16:44:53.459242Z","actor":"Hellblazer","issue_id":"nexus-q3xrx","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-4c4a578fb3179bdae65910ab634924b1","kind":"field_change","created_at":"2026-07-08T16:44:55.478441Z","actor":"Hellblazer","issue_id":"nexus-coq1z","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-1465102b60d5edb410c62959ade62904","kind":"field_change","created_at":"2026-07-08T16:44:57.364457Z","actor":"Hellblazer","issue_id":"nexus-r024j","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Closed"}}

.claude-plugin/marketplace.json

@@ -11,21 +11,21 @@
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "conexus",
-        "ref": "v6.4.0"
+        "ref": "v6.5.0"
       },
       "description": "Self-hosted three-tier knowledge management with 13 specialized agents, plan-centric retrieval via nx_answer, semantic search, and RDR decision tracking for Claude Code.",
-      "version": "6.4.0"
+      "version": "6.5.0"
     },
     {
       "name": "sn",
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "sn",
-        "ref": "v6.4.0"
+        "ref": "v6.5.0"
       },
       "description": "Injects Serena and Context7 MCP tool usage guidance into subagents via SubagentStart hook.",
-      "version": "6.4.0"
+      "version": "6.5.0"
     }
   ]
 }

.github/workflows/engine-service-release.yml

@@ -515,8 +515,10 @@ jobs:
           # a psql/createdb/pg_dump/initdb/... that dyld-aborted ("Library not
           # loaded") on any machine other than the exact CI build path — macOS
           # `configure`/`make install` bakes the literal absolute --prefix into
-          # every libpq-linked binary's LC_LOAD_DYLIB (Linux gets $ORIGIN-relative
-          # RPATH from PG's own build system by default; macOS does not).
+          # every libpq-linked binary's LC_LOAD_DYLIB. Linux has the SAME class
+          # of defect — the literal build-prefix RUNPATH, dangling off-runner
+          # (nexus-iytd3, verified on the live v0.1.32 artifact; the earlier
+          # claim here that Linux gets $ORIGIN by default was wrong).
           # scripts/build_pg_bundle.sh now rewrites this at build time
           # (fixup_macos_relocatability), but NOTHING previously verified the
           # PUBLISHED ARTIFACT ITSELF before it shipped — ci.yml's relocation
@@ -531,23 +533,40 @@ jobs:
           mkdir -p "$reloc"
           tar -xJf "dist/$ASSET.txz" -C "$reloc"
           root="$reloc/$(basename "$GITHUB_WORKSPACE/bundle")"
+          # nexus-iytd3 gate hardening: this step used to run the binaries with
+          # the runner's ambient env — a system libpq (present on ubuntu-latest)
+          # satisfied the loader even when the bundle's own RUNPATH was a
+          # dangling literal build path, which is exactly how the broken linux
+          # bundles false-passed and shipped. Two closures: (a) deterministic —
+          # on Linux, assert every critical binary's RUNPATH carries $ORIGIN;
+          # (b) behavioural — run everything below with LD_LIBRARY_PATH unset.
+          if [ "$(uname -s)" = "Linux" ]; then
+            for b in psql initdb pg_ctl pg_config createdb postgres; do
+              rp="$(readelf -d "$root/bin/$b" | grep -E 'RUNPATH|RPATH' || true)"
+              case "$rp" in
+                *'$ORIGIN'*) : ;;
+                *) echo "::error::relocation gate: $b RUNPATH lacks \$ORIGIN (got: ${rp:-none}) — bundle is not self-contained (nexus-iytd3)"; exit 1 ;;
+              esac
+            done
+            echo "RUNPATH \$ORIGIN assertion passed for all critical binaries"
+          fi
           data="$reloc/pgdata"
           sock="$(mktemp -d /tmp/pgrelocgate.XXXXXX)"
           cleanup() { "$root/bin/pg_ctl" -D "$data" stop -m fast >/dev/null 2>&1 || true; rm -rf "$sock" "$reloc"; }
           trap cleanup EXIT
-          "$root/bin/initdb" --no-locale -D "$data" -U "$(id -un)" >/dev/null
-          "$root/bin/pg_ctl" -D "$data" -o "-p 59987 -k $sock" -l "$reloc/pg.log" start
+          env -u LD_LIBRARY_PATH "$root/bin/initdb" --no-locale -D "$data" -U "$(id -un)" >/dev/null
+          env -u LD_LIBRARY_PATH "$root/bin/pg_ctl" -D "$data" -o "-p 59987 -k $sock" -l "$reloc/pg.log" start
           # Two SEPARATE psql calls, not one semicolon-joined -tAc: psql echoes
           # each statement's own output (a DDL's completion tag AND a SELECT's
           # row) concatenated into one combined -tAc stream, which is NOT the
           # bare "vector" this assertion originally (incorrectly) expected.
-          "$root/bin/psql" -h "$sock" -p 59987 -U "$(id -un)" -d postgres -c \
+          env -u LD_LIBRARY_PATH "$root/bin/psql" -h "$sock" -p 59987 -U "$(id -un)" -d postgres -c \
             "CREATE EXTENSION IF NOT EXISTS vector" >/dev/null
           # nexus-u30zm: pg_trgm must LOAD, not merely exist on disk — the
           # cache-hit path has no other executable proof of the contrib set.
-          "$root/bin/psql" -h "$sock" -p 59987 -U "$(id -un)" -d postgres -c \
+          env -u LD_LIBRARY_PATH "$root/bin/psql" -h "$sock" -p 59987 -U "$(id -un)" -d postgres -c \
             "CREATE EXTENSION IF NOT EXISTS pg_trgm" >/dev/null
-          out="$("$root/bin/psql" -h "$sock" -p 59987 -U "$(id -un)" -d postgres -tAc \
+          out="$(env -u LD_LIBRARY_PATH "$root/bin/psql" -h "$sock" -p 59987 -U "$(id -un)" -d postgres -tAc \
             "SELECT extname FROM pg_extension WHERE extname='vector'")"
           if [ "$out" != "vector" ]; then
             echo "::error::relocation gate FAILED for $ASSET — SELECT extname did not return 'vector' (got: '$out')"