Fix rbenv-built rubies silently running as Homebrew's libruby

[JPDuchesne]

Summary

Root cause of the cellbound-3d#151 CI failure (Your Ruby version is 4.0.6, but your Gemfile specified 4.0.5), diagnosed with a throwaway workflow on the ephemeral hosted runner: dev provisioned rbenv Ruby 4.0.5 correctly, shadowenv exec applied the right PATH, command -v ruby resolved to the 4.0.5 binstub — and ruby -v still printed 4.0.6.

The mechanism is a same-soname shared-library hijack that dev builds into every rbenv Ruby itself:

• ruby_build_env bakes -Wl,-rpath,<brew>/lib into the build (needed so Linuxbrew-linked libs like libcrypt.so.2 resolve at runtime).
• Rubies differing only in teeny share a libruby soname (libruby.so.4.0), and Linuxbrew's lib dir carries its own Ruby's libruby.
• The brew rpath entry precedes the ruby's own libdir in the runtime search order, so the freshly built 4.0.5 binary loads — and runs as — brew's 4.0.6 libruby. Bundler then truthfully reports the pin mismatch.

macOS is unaffected (dyld links libruby by absolute install name), which is why this only ever bites Linux boxes whose linuxbrew Ruby shares the minor version. cellbound-3d#107's "bundle exec runs under Linuxbrew Ruby" symptom is the adjacent seam, but this one corrupts even correctly-shadowenv'd invocations.

Changes

• ruby_build_env now rpaths the build's own lib dir ahead of brew's, so its libruby always wins; brew's dir stays for libcrypt et al. (Signature gains the version to compute the install prefix.)
• ensure_ruby_installed! treats a wrong reported version like a crippled extension: force-rebuild an existing hijacked install, and loudly abort (with the fix command) if the freshly built ruby still runs as another version — instead of surfacing later as a cryptic bundler error.

Test plan

• New RSpock tests: rpath ordering, reported_ruby_version, verify_reported_version! abort, hijack force-rebuild path, healthy fast path (red before the fix, green after)
• Full suite: 750 tests, 0 failures; rubocop + srb clean
• After release: retrigger cellbound-3d#151 — the hosted runner rebuilds 4.0.5 with the corrected rpath and dev up proceeds past bundler

Made with Cursor

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[JPDuchesne]

/learn the root cause here, not the code change: rbenv-built rubies with a Homebrew lib dir rpathed ahead of their own libdir get their libruby hijacked by a same-minor brew Ruby (shared soname libruby.so.X.Y), so the binary silently runs as the other version — bundler then fails the Gemfile ruby pin with a mismatch that looks like a project bug. Diagnosis cue: command -v ruby resolves to the right binstub but ruby -v reports another version. Only bites Linux (macOS dyld links libruby by absolute install name).

✅ /learn — drafted 1 learning in a draft PR: #77

• rbenv-libruby-rpath-hijack

---

⚙️ workflow run · model: claude-fable-5-high