[ruvnet]

Implemented

1. Root signed registry: Ed25519 trust root authorizes role scoped primary, secondary and worker public keys with validity, revocation and expiring revision snapshots. Room B requires a separately supplied minimum registry revision to prevent acceptance of stale rolled back roots.
2. Two person release: Existing strict schema and primary signature supplemented by an independent reviewer signature over canonical release metadata and approval digest. Known restricted source markers, simple encodings and opaque scalar patterns are screened only in Room A. Only a narrowly structured release is exported.
3. Verified Room B intake: Verifies root registry signature, freshness, active roles, both approvals and source independent contract before creating a fresh four file scaffold.
4. Offline author and evaluator pilot: The dedicated real Docker CI fixture runs independent synthetic authoring in a no network container mounted only to its public contract. Existing hardened Docker evaluator mounts just contract, trusted harness and implementation with resource limits.
5. Worker evidence and hash ledger: Signs the v2 runtime report and appends SHA256 chained entries containing only release, registry, approval and evaluation digests, sequence and status. An independently supplied previous head is mandatory to detect ledger rollback.
6. Revocation/abuse tests: Tests wrong or duplicate roles, stale/tampered signatures, revoked keys, DLP known marker and common encodings, symlink output refusal, ledger modification, replay and future registry revision floor.
7. Docs and ADR 143: Operator commands and architecture limits in docs/clean-room/E2E.md.

Room A analyzer integration

The synthetic CI scenario now invokes the actual Node ruDevolution static decompiler with witness generation on the Room A-only source fixture before the independent sign/transfer. Its source-bearing analysis remains inside Room A; the only Room A to Room B release consists of the constrained signed specification. The Room B authoring container mounts neither the original source nor the private analysis.

Reproducibility

• Node unit suites including synthetic positive and negative handoff tests: npm run test:cleanroom
• Standard Node suite: npm test
• New mandatory CI synthetic end to end Docker test: node --test npm/test/clean-room-e2e-docker.test.js with RUDEVOLUTION_TEST_IMAGE set to an immutable pre-pulled Node image digest
• Existing Node22/24, dashboard audit/build, Rust correctness and benchmark compilation unchanged.

Scope and safety boundaries

This is a bounded, synthetic E2E pilot, not a legally certified clean room or a deployed production service. The GitHub runner models roles using separate container mounts on one CI host. Human independent authorization, separate real OS tenants, provider identities, RuVector memory/RuFlo federation access restrictions, external DLP, HSM custody and WORM checkpoints remain infrastructure and governance requirements. The model author in CI is a deterministic fixture, not an AI model. Passing public vectors does not prove held-out behavior or global semantic equivalence.

Acceptance gate

No Room A source marker, key or decompiler output enters Room B; both approvals and current root-signed registry verify; a revoked signer blocks intake; independent B author has no source/network access; the real Docker evaluation runs all approved vectors; signed evaluation and chained ledger verify against an externally supplied head; all CI jobs pass.

Rollback

Changes are strictly opt-in and do not change the legacy decompiler, primary approved-spec or existing v2 isolated evaluator. Disable the new pilot CLI; retain externally anchored evidence and publish a higher signed revocation revision where needed.