ruvnet/docs/proof/2026-10-02.md at main · ruvnet/ruvnet · GitHub
Skip to content

Latest commit

 

History

History
56 lines (38 loc) · 5.65 KB

2026-10-02.md

File metadata and controls

56 lines (38 loc) · 5.65 KB

October 2026 profile proof record

Observed October 2, 2026 UTC, during the October 1 Toronto update. This record binds the profile's counts and project descriptions to dated inputs. It preserves the distinction between inspected source, published packages, reported tests, and independently reproduced results.

What was verified

  1. Public GitHub metadata: 221 repositories, 196 nonfork repositories, 25 forks, 11,634 followers, 185,968 stars and 24,914 downstream forks across the nonfork population. Watchers use subscribers_count.
  2. Six new public repository histories: APx, rGi, rultra, MCP Studio, ruPet and Agents of the Dawm. Complete clones were inspected with git rev-list --max-parents=0 HEAD; exact roots and inspected heads are in the project snapshot.
  3. Official npm maintainer search: 398 known packages listing ruvnet. This is an indexed set minimum. Official crates.io owner inventory: 480 crates and 1,759,429 cumulative downloads.
  4. Published versions and timestamps: Ruflo 3.50.0, MetaHarness 0.4.17, RVF 0.3.4, RVForge 0.2.0 and KGE 0.2.0. The receipt retains registry integrity metadata.
  5. Source evidence for RVF wire compatibility, witness tamper checks, RVForge staging, Ruflo Mods and RVF integration, and MetaHarness evidence classification. Pinned links and source fingerprints are in the same receipt. These are source inspections, not freshly executed upstream product tests.

Dates and populations

Measurement Population Evidence date
GitHub totals Current public account inventory, forks separated October 2 UTC
npm inventory 398 indexed maintained packages October 2 UTC
npm download events Earlier 385 package cohort, 2025-09-28 through 2026-09-27 September 28
npm monthly chart Same download cohort, September 2025 through August 2026 September 28
crates.io 480 owner inventory entries October 2 UTC
PyPI and Hugging Face 8 packages and 22 artifacts from prior ownership checks July 12
GitHub traffic September 7 rolling 14 day snapshot September 7

The October npm download request was unavailable, and the connected GitHub API did not expose owner traffic. Neither was replaced with zero or a projection. The last verified npm annual total is 83,340,503 events. Mixed observation dates are carried into the README and machine readable metrics.

Source and release boundaries

Ruflo's 3.50.0 release reports opt in Mods, 16 Mods engine tests, 38 swarm tests, 3 ruOS tests, and a 117 entry release witness. Those are upstream reports. The inspected main commit 1c78a51d includes later installation defaults and repair work. Release behavior is not inferred from the newer README.

RVF's wire tests pin segment bytes, a root manifest checksum, and tail discovery. Its witness tests exercise signed evidence, recorded policy outcomes, costs and tamper rejection. These establish the presence of specific tests at a revision. They do not prove every RVF backend or deployment path behaves identically.

RVForge's contract explicitly says local build output is staged and not runnable. Native installer assembly and platform signing are separate. The profile uses that narrower boundary.

MetaHarness's multi generation protocol separates verifier qualification, synthetic lineages, bounded evidence and independent confirmation. A working verifier is not proof of recursive self improvement. Likewise APx's tutorial does not measure rUv's productivity, and rGi does not demonstrate AGI.

Reproduce the profile check

From this repository:

node scripts/verify-profile.mjs

The check recomputes GitHub totals from the captured inventory, verifies the six new histories are represented, reconciles registry counts and download populations, checks the rendered metric rows, validates local links in the refreshed documents, and checks SHA256 fingerprints of the frozen snapshot files. A mismatch exits nonzero. The check passed for this update with 42 local links, 21 source receipts and six frozen snapshots. A deliberately altered snapshot was rejected. The renderer was idempotent, and a synthetic future registry refresh updated the README, package index and aggregate totals consistently. The workflow JavaScript passed syntax validation.

To reproduce a new inventory from live services, paginate these official endpoints and retain a new observation timestamp:

https://api.github.com/users/ruvnet
https://api.github.com/users/ruvnet/repos?type=owner&per_page=100&page=1
https://registry.npmjs.org/-/v1/search?text=maintainer%3Aruvnet&size=250&from=0
https://crates.io/api/v1/crates?user_id=339999&per_page=100&page=1

Live values can differ from a frozen snapshot. Source fingerprints identify the inspected bytes. They are not trusted signatures, independent attestations, or legal priority determinations. The prior art dossier records lineage and named related work without adding broad first claims.