@awak-app/simy-cli 0.5.6 → 0.5.8

package/README.md

@@ -11,9 +11,12 @@ simy --daemon
 
 When an interactive `simy --daemon` starts without managed SIMY workflows,
 the CLI asks once before installing the Codex plugin
-marketplace, Codex/Claude SQM skills, and PR hooks. Existing unrelated plugins
+marketplace and Codex/Claude opt-in SQM skills. Existing unrelated plugins
 and hooks are preserved. Use `--install-workflows` for explicit non-interactive
 installation or `--no-workflow-prompt` to start the daemon without asking.
+
+SQM checks apply when you explicitly select `@simy`, invoke the SQM skill, or ask to use SQM for the current task. Ordinary PR creation and `git push` do not opt in. Upgrading and restarting the daemon migrates the legacy global PR gate and shipped personal skills; unrelated hooks are preserved. Start a new coding session to reload skill instructions.
+
 After installation, restart Codex and find and install **SIMY** in **Plugins**
 before using `@simy` in a new task.
 
@@ -380,3 +383,23 @@ Publishing is handled by GitHub Actions in `.github/workflows/publish.yml`.
   `@awak-app/simy-cli`.
 - The package check inspects the final npm tarball contents and fails if any
   source map file would be published.
+
+### Repository system scopes
+
+Version 0.5.7 supports signed `system_scope` snapshots from Quality Monitor.
+Each check pins the repository's connected component and graph revision. A new
+check revalidates scoped bundles online; a stale or unavailable scope cannot fall
+back to an older cached component. Minimum and full check proofs retain the
+original snapshot. A scope revision change requires a fresh minimum check.
+Deploy this CLI and the web capability proxy before enabling the backend scope
+requirement. Older clients receive an explicit upgrade error, never an expanded
+organization-wide bundle.
+
+### Submit repaired local delivery evidence to SQM
+
+`simy sqm submit-evidence --file delivery.json --host https://app-dev.simy.one`
+submits an explicit bounded summary through your existing organization-bound device
+session. `--dry-run` previews the exact document without uploading it. See the
+[local evidence contract](src/codex-plugins/simy/skills/agentic-delivery-loop/references/local-sqm-evidence.md).
+The receipt identifies the source digest and analysis job; it is not a declaration
+that an incident or blocking rule has been published.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -498,7 +498,7 @@ export async function startAgent({
           const body = await readJson(req);
           if (body.confirmed !== true) {
             json(res, 400, {
-              error: "Explicit confirmation is required before installing the SIMY plugin, agent skills, and PR hooks.",
+              error: "Explicit confirmation is required before installing the SIMY plugin and opt-in agent skills.",
             });
             return;
           }

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.6";
+export const CLI_VERSION = "0.5.8";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/skills/agentic-delivery-loop/SKILL.md

@@ -128,6 +128,22 @@ history or claim `done`. Save the exact revision, environment, input, Run ID,
 timestamps, visible state, network evidence, and logs, then add a boundary
 regression before re-entering implementation.
 
+### Feed repaired delivery failures back into SQM
+
+When an observed failure was repaired, prepare one bounded `delivery.json` record
+per failure using [the local evidence contract](references/local-sqm-evidence.md).
+Record actual impact, distinct failing/fixed commit SHAs, and verification results.
+Keep the same evidence_id when retrying the same submission. Include known PR URLs
+so SQM can retrieve related evidence; a link alone does not establish identity.
+
+When the user's delivery scope authorizes sharing these summaries with their SQM
+organization, submit using `simy sqm submit-evidence --file delivery.json --host
+<the authorized origin>`. Otherwise retain the draft locally. Never attach whole
+transcripts, credentials, unrelated files, or automatically read paths named in
+logs. Record the returned source digest and job ID in the delivery receipt.
+Submission is not analysis completion or a published safeguard. Resource locking
+and validation ordering still require Delivery Loop execution controls.
+
 ### 8. Clean up and issue the receipt
 
 Remove scoped fixtures and prove the residual count is zero. Deliver a compact

package/src/codex-plugins/simy/skills/agentic-delivery-loop/references/local-sqm-evidence.md

@@ -0,0 +1,34 @@
+# Local delivery evidence
+
+This is a new SQM source, alongside GitHub and Slack. It is not an incident declaration
+and cannot set review status, severity, organization, or rule lifecycle.
+
+```json
+{
+  "schema_version": "1.0.0",
+  "evidence_id": "checkout-provider-failure-1",
+  "run_id": "delivery-run-42",
+  "repository": "owner/repository",
+  "title": "Checkout provider was missing",
+  "occurred_at": "2026-09-07T00:00:00Z",
+  "base_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "head_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "failure": "What actually failed, with a bounded error excerpt.",
+  "impact": "What was prevented or affected; distinguish local from production.",
+  "fix": "What changed to repair the same failure.",
+  "verification": "What ran at head_sha and its observed result.",
+  "pr_urls": [],
+  "changed_paths": ["src/checkout.ts"],
+  "diff": "A relevant, sanitized diff excerpt (optional, at most 12000 characters)."
+}
+```
+
+Replace sample SHAs and statements with observed evidence. Summaries are limited to
+64 KiB total. `--dry-run` prints exactly the submitted document without making a
+request. `--host` selects an existing authenticated SIMY session; use the explicit
+dev origin when testing dev. SQM analysis must already be enabled for the organization.
+
+An identical record from the same user returns the same job. Changed evidence
+creates a new digest/job and retains the earlier revision. Keep the returned job ID
+for monitoring in SQM. Candidate checks still need independent review/evaluation;
+local success never proves deployment or production impact.

package/src/index.js

@@ -103,7 +103,7 @@ Options:
   --no-open           Do not open the browser when authorization is required
   --port <port>       Bind a specific localhost port
   --host <url>        Connect to a SIMY Web origin (default: ${DEFAULT_WEB_ORIGIN})
-  --install-workflows Install or update SIMY Codex/Claude skills and PR hooks
+  --install-workflows Install or update SIMY Codex/Claude opt-in SQM skills
   --no-workflow-prompt Skip the daemon startup workflow-installation prompt
   --no-auto-update    Disable update checks and automatic installation
 

package/src/sqm/agent-skill.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 export const SQM_AGENT_SKILL_ID = "simy-sqm-pr-check";
-export const SQM_AGENT_SKILL_VERSION = "2.0.0";
+export const SQM_AGENT_SKILL_VERSION = "3.0.0";
 export const SIMY_CODEX_PLUGIN_ID = "simy";
 export const SIMY_CODEX_PLUGIN_VERSION = "0.1.0";
 
@@ -15,41 +15,34 @@ const BUNDLED_CODEX_PLUGIN_ROOT = fileURLToPath(
 const MANAGED_PLUGIN_AUTHOR = "Specialist Doctors Inc.";
 const MANAGED_MARKETPLACE_SOURCE = `./plugins/${SIMY_CODEX_PLUGIN_ID}`;
 
+const LEGACY_SKILL_DIGEST = "c9ab46e855280196dbc93fd36ba849418e0c4e500dd6e4b7b03b2296e838df92";
+
 const SKILL_CONTENT = `---
 name: ${SQM_AGENT_SKILL_ID}
-description: Run SIMY Software Quality Monitor checks before creating or proposing a pull request. Use whenever preparing, opening, or updating a PR.
+description: Run SIMY Software Quality Monitor checks for PR work when the user explicitly invokes @simy, this skill, or asks to use SQM. Ordinary PR creation or git push alone does not activate this skill.
 ---
 
 # SIMY SQM PR check
 
-Before creating or proposing a pull request:
+Apply this workflow only when the user has explicitly selected \`@simy\`, invoked this skill, or requested SQM for the current task. A quoted mention, repository organization, installed plugin, or ordinary request to create a PR is not opt-in. Honor a later request to stop using SQM.
+
+Without opt-in, continue the requested work without running SQM or making it a prerequisite. You may briefly offer SQM if useful; do not delay the work waiting for an optional answer. Follow any independent repository checks required by the project.
+
+When opted in, before creating or proposing a pull request:
 
 1. Run \`simy sqm min-check\` from the repository root.
 2. Run \`simy sqm check --proof proof.json --signed-evidence proof.json.signed.json\`.
 3. Read \`proof.json\` and require \`outcome.status\` to be \`passed\`.
-4. If either command fails, SQM is unavailable, or the proof is not passed, stop. Report the exact blocker and do not create the PR.
+4. If either command fails, SQM is unavailable, or the proof is not passed, report the exact blocker. Do not claim SQM passed or silently bypass the requested check.
 5. Include the proof path and SQM outcome in the PR body when the check passes.
 
 Do not replace SQM with an LLM review, and do not claim the check passed without reading the generated proof.
 `;
 
-const HOOK_SCRIPT = `#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-
-let raw = "";
-for await (const chunk of process.stdin) raw += chunk;
-let payload = {};
-try { payload = raw ? JSON.parse(raw) : {}; } catch { process.exit(0); }
-const command = String(payload?.tool_input?.command || payload?.tool_input?.cmd || "");
-if (!/(^|[;&|]\\s*)gh\\s+pr\\s+create(?:\\s|$)/.test(command)) process.exit(0);
-
-for (const args of [["sqm", "min-check"], ["sqm", "check"]]) {
-  const result = spawnSync("simy", args, { cwd: process.cwd(), stdio: "inherit" });
-  if (result.error || result.status !== 0) {
-    console.error(result.error ? \`SIMY SQM PR gate failed: \${result.error.message}\` : \`SIMY SQM PR gate blocked the PR (exit \${result.status}).\`);
-    process.exit(2);
-  }
-}
+// Cached hook registrations in running sessions must also stop blocking PRs.
+const RETIRED_HOOK_SCRIPT = `#!/usr/bin/env node
+// Global SQM gate retired; the skill applies only after explicit task opt-in.
+process.exit(0);
 `;
 
 const TARGETS = {
@@ -65,8 +58,6 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
   const digest = sqmAgentSkillDigest();
   const codexPlugin = await inspectCodexPlugin({ home });
   const hookPath = managedHookPath(home);
-  const installedHookDigest = await fileDigest(hookPath);
-  const hookMatches = installedHookDigest === digestText(HOOK_SCRIPT);
   const platforms = {};
   for (const [platform, segments] of Object.entries(TARGETS)) {
     const target = path.join(home, ...segments);
@@ -77,14 +68,12 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     platforms[platform] = {
       path: target,
       hook_path: platformHookConfigPath(platform, home),
-      installed: skillMatches && hookMatches && hookConfigured && platformExtraMatches,
+      installed: skillMatches && !hookConfigured && platformExtraMatches,
       state:
         installedDigest === null ||
-        !hookConfigured ||
-        installedHookDigest === null ||
         (platform === "codex" && codexPlugin.state === "missing")
           ? "missing"
-          : skillMatches && hookMatches && platformExtraMatches
+          : skillMatches && !hookConfigured && platformExtraMatches
             ? "installed"
             : "outdated",
       ...(platform === "codex" ? { plugin: codexPlugin } : {}),
@@ -94,7 +83,7 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     skill_id: SQM_AGENT_SKILL_ID,
     version: SQM_AGENT_SKILL_VERSION,
     digest: `sha256:${digest}`,
-    enforcement: "pre_tool_use",
+    enforcement: "explicit_opt_in",
     codex_plugin: codexPlugin,
     installed: Object.values(platforms).every((entry) => entry.installed),
     platforms,
@@ -106,12 +95,10 @@ export async function installSqmAgentSkill({ home = homedir(), platforms = Objec
   if (!requested.length || requested.some((platform) => !Object.hasOwn(TARGETS, platform))) {
     throw new Error("platforms must contain codex and/or claude");
   }
-  const hookPath = managedHookPath(home);
   if (requested.includes("codex")) await installCodexPlugin({ home });
-  await atomicText(hookPath, HOOK_SCRIPT, 0o700);
+  await retireLegacySqmGate({ home });
   for (const platform of requested) {
     await atomicText(path.join(home, ...TARGETS[platform]), SKILL_CONTENT, 0o600);
-    await installManagedHook(platform, home, hookPath);
   }
   return inspectSqmAgentSkill({ home });
 }
@@ -252,60 +239,59 @@ function platformHookConfigPath(platform, home) {
     : path.join(home, ".claude", "settings.json");
 }
 
-function managedHookGroup(hookPath) {
-  return {
-    matcher: "Bash",
-    hooks: [
-      {
-        type: "command",
-        command: `node ${JSON.stringify(hookPath)}`,
-        statusMessage: "Running SIMY SQM PR gate",
-      },
-    ],
-  };
+// Only migrate the exact shipped legacy skill. Custom user instructions are retained.
+export async function retireLegacySqmGate({ home = homedir() } = {}) {
+  const hookPath = managedHookPath(home);
+  let changed = false;
+  for (const [platform, segments] of Object.entries(TARGETS)) {
+    const target = path.join(home, ...segments);
+    if (await fileDigest(target) === LEGACY_SKILL_DIGEST) {
+      await atomicText(target, SKILL_CONTENT, 0o600);
+      changed = true;
+    }
+    changed = await removeManagedHook(platform, home, hookPath) || changed;
+  }
+  const hookDigest = await fileDigest(hookPath);
+  if (hookDigest !== null && hookDigest !== digestText(RETIRED_HOOK_SCRIPT)) {
+    await atomicText(hookPath, RETIRED_HOOK_SCRIPT, 0o700);
+    changed = true;
+  }
+  return changed;
 }
 
-async function installManagedHook(platform, home, hookPath) {
+async function removeManagedHook(platform, home, hookPath) {
   const target = platformHookConfigPath(platform, home);
-  let config = {};
-  try {
-    config = JSON.parse(await readFile(target, "utf8"));
-  } catch (error) {
-    if (error?.code !== "ENOENT") {
-      throw new Error(`${target} must contain valid JSON before SIMY can merge the SQM hook.`);
+  const config = await readJsonFile(target, { missing: null, invalid: "throw" });
+  if (!config?.hooks) return false;
+  let changed = false;
+  for (const [event, groups] of Object.entries(config.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    const kept = [];
+    for (const group of groups) {
+      if (!Array.isArray(group?.hooks)) { kept.push(group); continue; }
+      const remaining = group.hooks.filter((hook) => !isManagedHook(hook, hookPath));
+      if (remaining.length === group.hooks.length) kept.push(group);
+      else {
+        changed = true;
+        if (remaining.length) kept.push({ ...group, hooks: remaining });
+      }
     }
+    if (kept.length) config.hooks[event] = kept;
+    else if (groups.length) delete config.hooks[event];
   }
-  const hooks = config && typeof config === "object" && !Array.isArray(config)
-    ? { ...(config.hooks || {}) }
-    : {};
-  const existing = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
-  hooks.PreToolUse = [
-    ...existing.filter((group) => !groupContainsManagedHook(group)),
-    managedHookGroup(hookPath),
-  ];
-  await atomicText(target, `${JSON.stringify({ ...config, hooks }, null, 2)}\n`, 0o600);
+  if (changed) await atomicText(target, `${JSON.stringify(config, null, 2)}\n`, 0o600);
+  return changed;
 }
 
 async function hasManagedHook(platform, home, hookPath) {
-  try {
-    const config = JSON.parse(await readFile(platformHookConfigPath(platform, home), "utf8"));
-    return Array.isArray(config?.hooks?.PreToolUse) &&
-      config.hooks.PreToolUse.some((group) => groupContainsManagedHook(group, hookPath));
-  } catch (error) {
-    if (error?.code === "ENOENT" || error instanceof SyntaxError) return false;
-    throw error;
-  }
+  const config = await readJsonFile(platformHookConfigPath(platform, home), { missing: null, invalid: "throw" });
+  return Object.values(config?.hooks || {}).some((groups) => Array.isArray(groups) &&
+    groups.some((group) => Array.isArray(group?.hooks) && group.hooks.some((hook) => isManagedHook(hook, hookPath))));
 }
 
-function groupContainsManagedHook(group, expectedPath = null) {
-  if (!Array.isArray(group?.hooks)) return false;
-  return group.hooks.some((hook) => {
-    const command = typeof hook?.command === "string" ? hook.command : "";
-    return expectedPath
-      ? command === `node ${JSON.stringify(expectedPath)}`
-      : command.includes("/.simy/integrations/sqm-agent/pre-pr-hook.mjs") ||
-          command.includes("\\.simy\\integrations\\sqm-agent\\pre-pr-hook.mjs");
-  });
+function isManagedHook(hook, expectedPath) {
+  const command = typeof hook?.command === "string" ? hook.command : "";
+  return command === `node ${JSON.stringify(expectedPath)}`;
 }
 
 async function fileDigest(target) {

package/src/sqm/bundle-store.js

@@ -41,13 +41,13 @@ export async function loadKnowledgeBundle({
   }
   const cacheIdentity = normalizedCacheIdentity({ endpoint, accountId, organizationId, repository });
   const location = cacheLocation(cacheRoot, cacheIdentity);
-  const validation = { cliVersion, publicKeys, organizationId };
+  const validation = { cliVersion, publicKeys, organizationId, repository };
   const cached = await readVerifiedCache(location, validation, cacheIdentity);
   const fresh =
     cached &&
     now - cached.fetchedAt < ttlMs &&
     Date.parse(cached.bundle.expires_at) > now;
-  if (!offline && endpoint && (!fresh || refresh)) {
+  if (!offline && endpoint && (!fresh || refresh || cached?.bundle.system_scope)) {
     try {
       const fetched = await fetchBundle({ endpoint, repository, cliVersion, token, organizationId, etag: cached?.etag, fetchImpl });
       if (fetched.notModified) {
@@ -56,6 +56,7 @@ export async function loadKnowledgeBundle({
         await writeMetadata(location, { ...cached.metadata, fetched_at: new Date(now).toISOString(), etag: fetched.etag || cached.etag });
         return result(cached.bundle, [], "cache_revalidated");
       }
+      if (cached?.bundle.system_scope && !fetched.bundle?.system_scope) throw nonFallbackError("SQM Cloud attempted to remove the pinned system scope contract.");
       const discoveredTrust = signingTrustForFetch({
         bundle: fetched.bundle,
         endpoint,
@@ -81,11 +82,12 @@ export async function loadKnowledgeBundle({
       return result(bundle, [], "cloud");
     } catch (error) {
       if (error?.code === "incompatible_cli") throw error;
-      if (error?.fallbackAllowed !== false && cached && Date.parse(cached.bundle.expires_at) > now) return result(cached.bundle, [`SQM Cloud unavailable; using last verified bundle: ${message(error)}`], "stale_cache");
+      if (error?.fallbackAllowed !== false && cached && !cached.bundle.system_scope && Date.parse(cached.bundle.expires_at) > now) return result(cached.bundle, [`SQM Cloud unavailable; using last verified bundle: ${message(error)}`], "stale_cache");
       return result(null, [`SQM knowledge could not be used; shadow checks were skipped: ${message(error)}`], "unavailable");
     }
   }
   if (cached) {
+    if (cached.bundle.system_scope) return result(null, ["SQM system scope must be revalidated online before a new check."], "unavailable");
     if (Date.parse(cached.bundle.expires_at) <= now) return result(null, ["The cached SQM knowledge bundle is expired; shadow checks were skipped."], "unavailable");
     const warnings = [];
     if (offline) warnings.push("SQM is offline; using the last verified knowledge bundle.");
@@ -96,10 +98,12 @@ export async function loadKnowledgeBundle({
   return result(null, [`SQM has no verified cache (${reason}); shadow checks were skipped.`], "unavailable");
 }
 
-export function verifyAndValidate(bundle, { cliVersion, publicKeys, organizationId } = {}) {
+export function verifyAndValidate(bundle, { cliVersion, publicKeys, organizationId, repository } = {}) {
   try { validateKnowledgeBundle(bundle, { cliVersion }); } catch (error) { throw nonFallbackError(message(error), error); }
   if (organizationId && bundle.organization_id !== organizationId) throw nonFallbackError(`SQM bundle organization mismatch: expected ${organizationId}.`);
+  if (bundle.system_scope && repository && bundle.system_scope.repository !== repository.toLowerCase()) throw nonFallbackError("SQM bundle repository system scope does not match this repository.");
   for (const module of bundle.modules) {
+    if (bundle.system_scope && module.scope.visibility === "organization" && !module.scope.repositories.some((repo) => bundle.system_scope.repositories.includes(repo.toLowerCase()))) throw nonFallbackError(`SQM module ${module.id} is outside the repository system.`);
     if (module.scope.visibility === "organization" && module.scope.organization_id !== bundle.organization_id) throw nonFallbackError(`SQM module ${module.id} is scoped to a different organization.`);
   }
   const keyId = bundle.integrity.key_id;
@@ -166,6 +170,7 @@ async function fetchBundle({ endpoint, repository, cliVersion, token, organizati
   const url = new URL(endpoint);
   url.searchParams.set("repository", repository);
   url.searchParams.set("cli_version", cliVersion);
+  url.searchParams.set("scope_version", "1");
   const headers = { Accept: "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;
   if (organizationId) headers["x-simy-org-id"] = organizationId;

package/src/sqm/command.js

@@ -4,6 +4,7 @@ import path from "node:path";
 
 import { isSessionValid, readSession } from "../session-store.js";
 import { resolveWebOrigin } from "../web-origin.js";
+import { submitLocalEvidence } from "./local-evidence.js";
 import { uploadRunEvidence } from "./evidence-client.js";
 import { evaluateKnowledgeBundle } from "./checkers.js";
 import { runSqmCheck, runSqmMinCheck } from "./index.js";
@@ -15,6 +16,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     printHelp();
     return 0;
   }
+  if (argv[0] === "submit-evidence") return await submitLocalEvidence(argv);
   if (argv[0] === "lint") return await runLintCommand(argv);
   if (argv[0] === "replay") return await runReplayCommand(argv);
   if (!["min-check", "check"].includes(argv[0])) throw new Error("Usage: simy sqm <min-check|check|lint|replay> [options]");
@@ -95,6 +97,7 @@ function printHelp() {
   console.log(`Usage:
   simy sqm min-check [options]
   simy sqm check [options]
+  simy sqm submit-evidence --file <delivery.json> [--host <origin>] [--dry-run]
   simy sqm lint --bundle <path>
   simy sqm replay --bundle <path> --dataset <path>
 

package/src/sqm/index.js

@@ -132,7 +132,7 @@ function toLegacyCheck(minCheck, loaded) {
 }
 
 function bundleIdentity(bundle) {
-  return { id: bundle.bundle_id, version: bundle.version, digest: bundle.integrity.digest, signing_key_id: bundle.integrity.key_id };
+  return { id: bundle.bundle_id, version: bundle.version, digest: bundle.integrity.digest, signing_key_id: bundle.integrity.key_id, ...(bundle.system_scope ? { system_scope: bundle.system_scope } : {}) };
 }
 
 function unavailable(warning, repository = null) {

package/src/sqm/local-evidence.js

@@ -0,0 +1,28 @@
+import { readFile } from "node:fs/promises";
+import { isSessionValid, readSession } from "../session-store.js";
+import { resolveWebOrigin } from "../web-origin.js";
+import { webApiUrl } from "../web-api.js";
+
+/** Submission is explicit; no transcript scanning or implicit file attachment. */
+export async function submitLocalEvidence(argv, { fetchImpl = globalThis.fetch, readSessionImpl = readSession } = {}) {
+  const option = (name) => { const i = argv.indexOf(name); return i < 0 ? undefined : argv[i + 1]; };
+  const file = option("--file");
+  if (!file || file.startsWith("--")) throw new Error("Usage: simy sqm submit-evidence --file <delivery.json> [--host <origin>] [--dry-run]");
+  const raw = await readFile(file);
+  if (raw.length > 64 * 1024) throw new Error("Local delivery evidence exceeds 64 KiB; submit a bounded summary.");
+  const evidence = JSON.parse(raw.toString("utf8"));
+  if (!evidence || Array.isArray(evidence) || evidence.schema_version !== "1.0.0") throw new Error("Expected local delivery evidence schema_version 1.0.0");
+  if (argv.includes("--dry-run")) { console.log(JSON.stringify({ submitted: false, evidence }, null, 2)); return 0; }
+  const origin = resolveWebOrigin(option("--host"));
+  const session = await readSessionImpl(origin);
+  if (!isSessionValid(session, Date.now(), origin)) throw new Error(`Sign in first: simy --host ${origin}`);
+  const response = await fetchImpl(webApiUrl("sqm/local-evidence", { webOrigin: origin, apiBaseUrl: session.api_base_url }), {
+    method: "POST", headers: { authorization: `Bearer ${session.token}`, "content-type": "application/json" },
+    body: JSON.stringify(evidence), signal: AbortSignal.timeout(30_000),
+  });
+  const result = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(`SQM submission failed (${response.status}): ${result?.error?.message || result?.error || "Unavailable"}`);
+  if (!result?.source_id || !Array.isArray(result.jobs) || !result.jobs.length) throw new Error("SQM returned no analysis job receipt");
+  console.log(JSON.stringify(result, null, 2));
+  return 0;
+}

package/src/sqm/proof.js

@@ -57,6 +57,7 @@ export function buildProof({ organizationId, repository, bundle, minCheck, evalu
       version: bundle.version,
       digest: bundle.integrity.digest,
       signing_key_id: bundle.integrity.key_id,
+      ...(bundle.system_scope ? { system_scope: bundle.system_scope } : {}),
     },
     min_check: {
       result_digest: minCheck.result_digest,

package/src/sqm/validation.js

@@ -17,13 +17,27 @@ const SCENARIO_REQUIREMENTS = new Set(["local", "requires_human", "requires_post
 export function validateKnowledgeBundle(bundle, { cliVersion }) {
   const errors = [];
   object(bundle, "$", errors);
-  exactKeys(bundle, ["schema_version", "bundle_id", "version", "organization_id", "generated_at", "expires_at", "modules", "integrity"], "$", errors);
+  exactKeys(bundle, ["schema_version", "bundle_id", "version", "organization_id", "generated_at", "expires_at", "modules", "integrity", "system_scope"], "$", errors);
   equal(bundle?.schema_version, "1.0.0", "$.schema_version", errors);
   stringPattern(bundle?.bundle_id, /^[a-z][a-z0-9._-]{2,127}$/, "$.bundle_id", errors);
   stringPattern(bundle?.version, /^[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]+$/, "$.version", errors);
   nullableString(bundle?.organization_id, 200, "$.organization_id", errors);
   dateTime(bundle?.generated_at, "$.generated_at", errors);
   dateTime(bundle?.expires_at, "$.expires_at", errors);
+  if (bundle?.system_scope !== undefined) {
+    const scope = bundle.system_scope;
+    object(scope, "$.system_scope", errors);
+    exactKeys(scope, ["organization_id", "repository", "graph_revision", "repositories"], "$.system_scope", errors);
+    equal(scope?.organization_id, bundle.organization_id, "$.system_scope.organization_id", errors);
+    stringPattern(scope?.repository, REPOSITORY, "$.system_scope.repository", errors);
+    if (!Number.isSafeInteger(scope?.graph_revision) || scope.graph_revision < 0) errors.push("$.system_scope.graph_revision must be a nonnegative integer");
+    if (!Array.isArray(scope?.repositories) || !scope.repositories.length || !scope.repositories.includes(scope.repository)) {
+      errors.push("$.system_scope.repositories must contain the target repository");
+    } else {
+      for (const repo of scope.repositories) stringPattern(repo, REPOSITORY, "$.system_scope.repositories[]", errors);
+      if (new Set(scope.repositories).size !== scope.repositories.length) errors.push("$.system_scope.repositories must be unique");
+    }
+  }
   if (!Array.isArray(bundle?.modules)) errors.push("$.modules must be an array");
   for (const [index, module] of (bundle?.modules || []).entries()) {
     validateModule(module, `$.modules[${index}]`, errors, cliVersion);

package/src/sqm/workflow-onboarding.js

@@ -73,7 +73,7 @@ export async function confirmWorkflowInstallation({
 } = {}) {
   output.write(
     [
-      "SIMY can install or update its Codex plugin marketplace, Codex/Claude SQM skills, and PR hooks.",
+      "SIMY can install or update its Codex plugin marketplace, Codex/Claude opt-in SQM skills.",
       "Existing unrelated plugins and hooks will be preserved.",
       "",
     ].join("\n"),

package/src/sqm/workflow-update.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 
 import { resolveBackendExecutable } from "../backend-executable.js";
-import { inspectSqmAgentSkill, installSqmAgentSkill } from "./agent-skill.js";
+import { inspectSqmAgentSkill, installSqmAgentSkill, retireLegacySqmGate } from "./agent-skill.js";
 
 const execFileAsync = promisify(execFile);
 const CHECK_INTERVAL_MS = 60 * 60 * 1000;
@@ -47,11 +47,12 @@ export async function syncInstalledWorkflows({ home = homedir(),
     throw error;
   }
   try {
+    const migrated = await retireLegacySqmGate({ home });
     let status = await inspect({ home });
     const platforms = Object.entries(status.platforms)
       .filter(([, entry]) => entry.state === "outdated").map(([platform]) => platform);
     if (platforms.length) status = await install({ home, platforms });
-    if (!status.platforms.codex.installed) return { outcome: platforms.length ? "updated" : "unchanged" };
+    if (!status.platforms.codex.installed) return { outcome: platforms.length || migrated ? "updated" : "unchanged" };
 
     const marketplace = JSON.parse(await readFile(status.codex_plugin.marketplace_path, "utf8"));
     if (typeof marketplace.name !== "string" || !/^[A-Za-z0-9_-]+$/.test(marketplace.name)) {