sneakoscope 1.0.0 → 1.0.2

package/dist/core/evidence/evidence-redaction.mjs

@@ -1,9 +0,0 @@
-import { containsPlaintextSecret, redactSecrets } from '../secret-redaction.mjs';
-
-export function redactEvidence(value) {
-  return redactSecrets(value);
-}
-
-export function evidenceHasPlaintextSecret(value) {
-  return containsPlaintextSecret(value);
-}

package/dist/core/evidence/evidence-router.mjs

@@ -1,186 +0,0 @@
-import fsp from 'node:fs/promises';
-import path from 'node:path';
-import { missionDir } from '../mission.mjs';
-import { exists, readText, rel, sha256 } from '../fsx.mjs';
-import { routeRequiresImageVoxelAnchors } from '../proof/route-proof-policy.mjs';
-import { evidenceHasPlaintextSecret, redactEvidence } from './evidence-redaction.mjs';
-import { createEvidenceRecord, validateEvidenceRecord } from './evidence-schema.mjs';
-import { dedupeEvidence } from './evidence-dedupe.mjs';
-import { fileFreshness, lastJsonlEventTime } from './evidence-freshness.mjs';
-import { writeEvidenceIndex } from './evidence-store.mjs';
-
-export async function writeEvidenceIndexForProof(root, proof = {}, opts = {}) {
-  const missionId = proof.mission_id || opts.missionId || null;
-  const route = proof.route || opts.route || null;
-  const staleAfter = missionId ? await lastJsonlEventTime(path.join(missionDir(root, missionId), 'events.jsonl')) : null;
-  const candidates = await evidenceCandidatesForProof(root, proof, { missionId, route });
-  const records = [];
-  const issues = [];
-  for (const candidate of candidates) {
-    const record = await evidenceRecordForCandidate(root, candidate, { missionId, staleAfter, proof });
-    if (!record) continue;
-    const validation = validateEvidenceRecord(record);
-    if (!validation.ok) record.issues.push(...validation.issues);
-    if (record.issues.length) issues.push(...record.issues.map((issue) => `${record.path || record.id}:${issue}`));
-    records.push(record);
-  }
-  const deduped = dedupeEvidence(records);
-  const status = evidenceStatus(deduped, issues);
-  return writeEvidenceIndex(root, {
-    missionId,
-    route,
-    records: deduped.map(redactEvidence),
-    issues: [...new Set(issues)],
-    status
-  });
-}
-
-export async function evidenceCandidatesForProof(root, proof = {}, opts = {}) {
-  const missionId = opts.missionId || proof.mission_id || null;
-  const route = opts.route || proof.route || null;
-  const candidates = [];
-  if (missionId) {
-    candidates.push({ kind: 'proof', relPath: `.sneakoscope/missions/${missionId}/completion-proof.json`, source: sourceForProof(proof) });
-    candidates.push({ kind: 'route_contract', relPath: `.sneakoscope/missions/${missionId}/route-completion-contract.json`, source: 'real', optional: true });
-    candidates.push({ kind: 'trust_report', relPath: `.sneakoscope/missions/${missionId}/trust-report.json`, source: 'real', optional: true });
-  }
-  addArtifactCandidates(candidates, proof.evidence?.artifacts, missionId);
-  addGateCandidate(candidates, proof.evidence?.route_gate, missionId);
-  addScoutCandidates(candidates, proof.evidence?.scouts);
-  addDbCandidates(candidates, proof.evidence?.db || proof.evidence?.db_safety, missionId);
-  addTestCandidates(candidates, proof.evidence?.tests, missionId);
-  if (missionId && routeRequiresImageVoxelAnchors(route)) {
-    candidates.push({ kind: 'image_voxel', relPath: `.sneakoscope/missions/${missionId}/image-voxel-ledger.json`, source: proof.evidence?.image_voxels?.mock ? 'mock' : sourceForProof(proof) });
-  }
-  return uniqueCandidates(candidates).filter((candidate) => candidate.relPath);
-}
-
-async function evidenceRecordForCandidate(root, candidate, { missionId, staleAfter, proof }) {
-  const relPath = normalizeRelPath(candidate.relPath, missionId, root);
-  const absolute = path.resolve(root, relPath);
-  const freshness = await fileFreshness(absolute, { staleAfter });
-  if (candidate.optional && !freshness.exists) return null;
-  const issues = candidate.optional && !freshness.exists ? [] : [...freshness.issues];
-  let digest = null;
-  let secret = false;
-  if (freshness.exists) {
-    const data = await fsp.readFile(absolute);
-    digest = sha256(data);
-    const text = isTextEvidence(relPath) ? await readText(absolute, '') : '';
-    secret = text ? evidenceHasPlaintextSecret(text) : false;
-    if (secret) issues.push('plaintext_secret');
-  } else if (!candidate.optional) {
-    issues.push('required_evidence_path_missing');
-  }
-  const source = issues.includes('required_evidence_path_missing') ? 'blocked' : normalizeSource(candidate.source || sourceForPath(relPath, proof));
-  const blocked = issues.includes('plaintext_secret') || issues.includes('stale') || issues.includes('required_evidence_path_missing');
-  return createEvidenceRecord({
-    mission_id: missionId,
-    kind: candidate.kind,
-    source,
-    path: relPath,
-    sha256: digest,
-    freshness: freshness.freshness,
-    blocked,
-    issues
-  });
-}
-
-function addArtifactCandidates(candidates, artifacts = [], missionId = null) {
-  for (const artifact of artifacts || []) {
-    const relPath = typeof artifact === 'string' ? artifact : artifact?.path;
-    if (!relPath) continue;
-    candidates.push({ kind: inferKind(relPath), relPath: normalizeRelPath(relPath, missionId), source: sourceForPath(relPath) });
-  }
-}
-
-function addGateCandidate(candidates, gate = null, missionId = null) {
-  const relPath = typeof gate === 'string' ? gate : gate?.source || gate?.path || null;
-  if (relPath) candidates.push({ kind: 'route_gate', relPath: normalizeRelPath(relPath, missionId), source: 'real' });
-}
-
-function addScoutCandidates(candidates, scouts = null) {
-  if (!scouts || scouts.required === false) return;
-  for (const key of ['consensus', 'handoff', 'gate_file', 'performance', 'engine_result']) {
-    if (scouts[key]) candidates.push({ kind: 'scout', relPath: scouts[key], source: scouts.real_parallel ? 'real' : 'fixture' });
-  }
-}
-
-function addDbCandidates(candidates, db = null, missionId = null) {
-  const rows = Array.isArray(db) ? db : [db].filter(Boolean);
-  for (const row of rows) {
-    const relPath = row?.path || row?.report || row?.evidence || null;
-    if (relPath) candidates.push({ kind: 'db_safety', relPath: normalizeRelPath(relPath, missionId), source: sourceForPath(relPath) });
-  }
-}
-
-function addTestCandidates(candidates, tests = null, missionId = null) {
-  const rows = Array.isArray(tests) ? tests : [tests].filter(Boolean);
-  for (const row of rows) {
-    const relPath = row?.path || row?.report || row?.evidence || null;
-    if (relPath) candidates.push({ kind: 'test', relPath: normalizeRelPath(relPath, missionId), source: sourceForPath(relPath) });
-  }
-}
-
-function uniqueCandidates(candidates) {
-  const seen = new Set();
-  const out = [];
-  for (const candidate of candidates) {
-    const key = `${candidate.kind}:${candidate.relPath}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(candidate);
-  }
-  return out;
-}
-
-function normalizeRelPath(value = '', missionId = null, root = process.cwd()) {
-  const raw = String(value || '').trim();
-  if (!raw) return raw;
-  if (path.isAbsolute(raw)) return rel(root, raw);
-  if (raw.startsWith('.sneakoscope/')) return raw;
-  if (missionId && !raw.includes('/')) return `.sneakoscope/missions/${missionId}/${raw}`;
-  return raw.replace(/^\.\//, '');
-}
-
-function sourceForProof(proof = {}) {
-  const hay = JSON.stringify([proof.unverified, proof.claims, proof.evidence?.image_voxels]);
-  if (/static_contract/i.test(hay)) return 'static_contract';
-  if (/mock/i.test(hay)) return 'mock';
-  if (/fixture/i.test(hay)) return 'fixture';
-  return 'real';
-}
-
-function sourceForPath(relPath = '', proof = {}) {
-  const hay = `${relPath} ${JSON.stringify(proof?.unverified || [])}`;
-  if (/test\/fixtures|fixture/i.test(hay)) return 'fixture';
-  if (/mock/i.test(hay)) return 'mock';
-  if (/static[-_]?contract/i.test(hay)) return 'static_contract';
-  return 'real';
-}
-
-function normalizeSource(source) {
-  return ['real', 'mock', 'static_contract', 'fixture', 'blocked'].includes(source) ? source : 'real';
-}
-
-function inferKind(relPath = '') {
-  if (/completion-proof\.json$/.test(relPath)) return 'proof';
-  if (/route-completion-contract\.json$/.test(relPath)) return 'route_contract';
-  if (/trust-report\.json$/.test(relPath)) return 'trust_report';
-  if (/image-voxel-ledger\.json$|visual-anchors\.json$|image-assets\.json$/.test(relPath)) return 'image_voxel';
-  if (/scout/.test(relPath)) return 'scout';
-  if (/db/.test(relPath)) return 'db_safety';
-  if (/blackbox|npx|global-shim|pack-install/.test(relPath)) return 'blackbox';
-  if (/test|gate|report/.test(relPath)) return 'test';
-  return 'artifact';
-}
-
-function isTextEvidence(relPath = '') {
-  return /\.(json|jsonl|md|txt|log|mjs|js|ts|tsx|jsx|html|css|toml|yml|yaml)$/i.test(relPath);
-}
-
-function evidenceStatus(records = [], issues = []) {
-  if (records.some((record) => record.trust === 'blocked') || issues.some((issue) => /required_evidence_path_missing|plaintext_secret|stale/.test(issue))) return 'blocked';
-  if (records.some((record) => record.source !== 'real' || record.trust !== 'high')) return 'verified_partial';
-  return records.length ? 'verified' : 'not_verified';
-}

package/dist/core/evidence/evidence-schema.mjs

@@ -1,105 +0,0 @@
-import { nowIso, randomId } from '../fsx.mjs';
-
-export const EVIDENCE_SCHEMA = 'sks.evidence.v1';
-export const EVIDENCE_INDEX_SCHEMA = 'sks.evidence-index.v1';
-export const PROJECT_EVIDENCE_INDEX_SCHEMA = 'sks.project-evidence-index.v1';
-
-export const EVIDENCE_KINDS = Object.freeze([
-  'scout',
-  'image_voxel',
-  'db_safety',
-  'hook',
-  'codex_lb',
-  'test',
-  'file_change',
-  'command',
-  'rust',
-  'blackbox',
-  'proof',
-  'route_contract',
-  'trust_report',
-  'route_gate',
-  'artifact'
-]);
-
-export const EVIDENCE_SOURCES = Object.freeze([
-  'real',
-  'mock',
-  'static_contract',
-  'fixture',
-  'blocked'
-]);
-
-export const EVIDENCE_FRESHNESS = Object.freeze([
-  'fresh',
-  'stale',
-  'unknown'
-]);
-
-export const EVIDENCE_TRUST = Object.freeze([
-  'high',
-  'medium',
-  'low',
-  'blocked'
-]);
-
-export function evidenceId(kind = 'artifact') {
-  return `EV-${String(kind || 'artifact').replace(/[^A-Za-z0-9]+/g, '-').replace(/^-|-$/g, '').toUpperCase() || 'ART'}-${randomId(8)}`;
-}
-
-export function normalizeEvidenceKind(kind = 'artifact') {
-  return EVIDENCE_KINDS.includes(kind) ? kind : 'artifact';
-}
-
-export function normalizeEvidenceSource(source = 'real') {
-  return EVIDENCE_SOURCES.includes(source) ? source : 'real';
-}
-
-export function normalizeEvidenceFreshness(freshness = 'unknown') {
-  return EVIDENCE_FRESHNESS.includes(freshness) ? freshness : 'unknown';
-}
-
-export function normalizeEvidenceTrust(trust = 'low') {
-  return EVIDENCE_TRUST.includes(trust) ? trust : 'low';
-}
-
-export function createEvidenceRecord(input = {}) {
-  const source = normalizeEvidenceSource(input.source);
-  const freshness = normalizeEvidenceFreshness(input.freshness);
-  return {
-    schema: EVIDENCE_SCHEMA,
-    id: input.id || evidenceId(input.kind),
-    mission_id: input.mission_id || null,
-    kind: normalizeEvidenceKind(input.kind),
-    source,
-    path: input.path || null,
-    sha256: input.sha256 || null,
-    created_at: input.created_at || nowIso(),
-    freshness,
-    trust: normalizeEvidenceTrust(input.trust || trustForEvidence({ source, freshness, blocked: input.blocked })),
-    redacted: input.redacted !== false,
-    issues: Array.isArray(input.issues) ? input.issues : []
-  };
-}
-
-export function trustForEvidence({ source = 'real', freshness = 'unknown', blocked = false } = {}) {
-  if (blocked || source === 'blocked') return 'blocked';
-  if (freshness === 'stale') return 'blocked';
-  if (source === 'mock' || source === 'static_contract') return 'low';
-  if (source === 'fixture') return 'medium';
-  return freshness === 'fresh' ? 'high' : 'medium';
-}
-
-export function validateEvidenceRecord(record = {}) {
-  const issues = [];
-  if (record.schema !== EVIDENCE_SCHEMA) issues.push('schema');
-  if (!record.id) issues.push('id');
-  if (!EVIDENCE_KINDS.includes(record.kind)) issues.push('kind');
-  if (!EVIDENCE_SOURCES.includes(record.source)) issues.push('source');
-  if (!EVIDENCE_FRESHNESS.includes(record.freshness)) issues.push('freshness');
-  if (!EVIDENCE_TRUST.includes(record.trust)) issues.push('trust');
-  if (record.path && !record.sha256) issues.push('sha256');
-  if ((record.source === 'mock' || record.source === 'static_contract') && record.trust === 'high') issues.push('mock_high_trust');
-  if (record.freshness === 'stale' && record.trust !== 'blocked') issues.push('stale_not_blocked');
-  return { ok: issues.length === 0, issues };
-}

package/dist/core/evidence/evidence-store.mjs

@@ -1,73 +0,0 @@
-import path from 'node:path';
-import { appendJsonl, ensureDir, exists, nowIso, readJson, writeJsonAtomic } from '../fsx.mjs';
-import { missionDir } from '../mission.mjs';
-import { EVIDENCE_INDEX_SCHEMA, PROJECT_EVIDENCE_INDEX_SCHEMA } from './evidence-schema.mjs';
-
-export function missionEvidenceIndexPath(root, missionId) {
-  return path.join(missionDir(root, missionId), 'evidence-index.json');
-}
-
-export function missionEvidenceJsonlPath(root, missionId) {
-  return path.join(missionDir(root, missionId), 'evidence.jsonl');
-}
-
-export function projectEvidenceIndexPath(root) {
-  return path.join(root, '.sneakoscope', 'evidence', 'project-index.json');
-}
-
-export async function readEvidenceIndex(root, missionId) {
-  const file = missionEvidenceIndexPath(root, missionId);
-  if (!missionId || !(await exists(file))) return null;
-  return readJson(file, null);
-}
-
-export async function writeEvidenceIndex(root, {
-  missionId,
-  route = null,
-  records = [],
-  issues = [],
-  status = 'not_verified'
-} = {}) {
-  const index = {
-    schema: EVIDENCE_INDEX_SCHEMA,
-    generated_at: nowIso(),
-    mission_id: missionId || null,
-    route,
-    status,
-    ok: issues.length === 0 && status !== 'blocked' && status !== 'failed',
-    records,
-    issues
-  };
-  if (missionId) {
-    await ensureDir(missionDir(root, missionId));
-    await writeJsonAtomic(missionEvidenceIndexPath(root, missionId), index);
-    for (const record of records) await appendJsonl(missionEvidenceJsonlPath(root, missionId), record);
-  }
-  await appendProjectEvidenceIndex(root, index);
-  return index;
-}
-
-async function appendProjectEvidenceIndex(root, index) {
-  const file = projectEvidenceIndexPath(root);
-  const current = await readJson(file, {
-    schema: PROJECT_EVIDENCE_INDEX_SCHEMA,
-    generated_at: nowIso(),
-    missions: []
-  });
-  const missions = [
-    ...(current.missions || []).filter((row) => row.mission_id !== index.mission_id),
-    {
-      mission_id: index.mission_id,
-      route: index.route,
-      status: index.status,
-      ok: index.ok,
-      evidence_count: index.records?.length || 0,
-      generated_at: index.generated_at
-    }
-  ].slice(-200);
-  await writeJsonAtomic(file, {
-    schema: PROJECT_EVIDENCE_INDEX_SCHEMA,
-    generated_at: nowIso(),
-    missions
-  });
-}

package/dist/core/feature-fixture-runner.mjs

@@ -1,245 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-
-export function runFeatureFixture(feature, {
-  root = process.cwd(),
-  tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-feature-fixture-')),
-  execute = false,
-  validateArtifacts = false,
-  commandArgs = null
-} = {}) {
-  const fixture = feature.fixture || {};
-  const expected = normalizeExpectedArtifacts(fixture.expected_artifacts);
-  const useHermeticRoot = fixture.root_mode !== 'source_checkout_required' && (execute || validateArtifacts || fixture.kind === 'execute_and_validate_artifacts');
-  const projectRoot = useHermeticRoot ? prepareHermeticFixtureRoot(root, tempRoot) : root;
-  const latestBefore = latestMissionId(projectRoot);
-  const execution = execute && commandArgs ? executeCommand(root, projectRoot, commandArgs, fixture) : null;
-  const latestAfter = execution?.mission_id || latestMissionId(projectRoot) || latestBefore;
-  const shouldValidateArtifacts = validateArtifacts && (fixture.kind === 'execute_and_validate_artifacts' || execution);
-  const artifacts = shouldValidateArtifacts
-    ? expected.map((artifact) => inspectExpectedArtifact(projectRoot, tempRoot, artifact, { latestMissionId: latestAfter }))
-    : expected.map((artifact) => ({ path: artifact.path, requested_path: artifact.path, schema: artifact.schema || inferSchema(artifact.path), exists: null, schema_ok: null, content_ok: null, skipped: 'contract_only' }));
-  const artifactFailures = shouldValidateArtifacts
-    ? artifacts.filter((artifact) => !artifact.exists || !artifact.schema_ok || !artifact.content_ok).map((artifact) => `${feature.id}:${artifact.path}:${artifact.failure || 'artifact_invalid'}`)
-    : [];
-  return {
-    id: feature.id,
-    kind: fixture.kind || 'static',
-    command: fixture.command || null,
-    temp_root: useHermeticRoot ? projectRoot : tempRoot,
-    root_mode: useHermeticRoot ? 'hermetic_temp_project' : 'source_checkout_required',
-    latest_mission_id: latestAfter,
-    executed: Boolean(execution),
-    execution,
-    expected_artifacts: artifacts,
-    artifact_schema_validated: validateArtifacts,
-    no_plaintext_secrets: validateNoPlaintextSecrets(projectRoot),
-    ok: (!execution || execution.ok) && artifactFailures.length === 0 && validateNoPlaintextSecrets(projectRoot) && !(validateArtifacts && fixture.kind === 'execute_and_validate_artifacts' && expected.length && !execution),
-    failures: [
-      ...(!fixture.command && fixture.status === 'pass' ? [`${feature.id}:fixture_command_missing`] : []),
-      ...(validateArtifacts && fixture.kind === 'execute_and_validate_artifacts' && expected.length && !execution ? [`${feature.id}:command_not_executed_for_artifact_validation`] : []),
-      ...(execution && !execution.ok ? [`${feature.id}:command_exit_${execution.status}`] : []),
-      ...(validateNoPlaintextSecrets(projectRoot) ? [] : [`${feature.id}:plaintext_secret_detected`]),
-      ...artifactFailures
-    ]
-  };
-}
-
-export function writeFeatureFixtureReports(root, report) {
-  const reportDir = path.join(root, '.sneakoscope', 'reports');
-  fs.mkdirSync(reportDir, { recursive: true });
-  const jsonPath = path.join(reportDir, 'feature-fixtures.json');
-  const mdPath = path.join(reportDir, 'feature-fixtures.md');
-  fs.writeFileSync(jsonPath, `${JSON.stringify(report, null, 2)}\n`);
-  fs.writeFileSync(mdPath, renderFeatureFixtureMarkdown(report));
-  return { json: jsonPath, md: mdPath };
-}
-
-function executeCommand(sourceRoot, projectRoot, spec, fixture = {}) {
-  const normalized = Array.isArray(spec) ? { command: spec } : spec;
-  const setup = [
-    ...(fixture.root_mode === 'source_checkout_required' ? [] : [['setup', '--local-only', '--json']]),
-    ...(normalized.setup || [])
-  ];
-  const setupResults = setup.map((args) => spawnSks(sourceRoot, projectRoot, args));
-  const command = normalized.command || normalized.args || [];
-  const result = command.length ? spawnSks(sourceRoot, projectRoot, command) : { status: 0, signal: null, ok: true, stdout_bytes: 0, stderr_bytes: 0, args: [] };
-  const missionId = result.mission_id || [...setupResults].reverse().find((row) => row.mission_id)?.mission_id || null;
-  return {
-    args: command,
-    setup: setupResults,
-    mission_id: missionId,
-    status: result.status,
-    signal: result.signal || null,
-    ok: setupResults.every((row) => row.ok) && result.ok,
-    stdout_bytes: result.stdout_bytes,
-    stderr_bytes: result.stderr_bytes
-  };
-}
-
-function spawnSks(sourceRoot, projectRoot, args = []) {
-  const result = spawnSync(process.execPath, [path.join(sourceRoot, 'bin', 'sks.mjs'), ...args], {
-    cwd: projectRoot,
-    encoding: 'utf8',
-    timeout: 30_000,
-    env: { ...process.env, CI: 'true', SKS_SKIP_NPM_FRESHNESS_CHECK: '1' }
-  });
-  const parsed = parseJsonOutput(result.stdout || '');
-  return {
-    args,
-    status: result.status,
-    signal: result.signal || null,
-    ok: result.status === 0,
-    mission_id: parsed?.mission_id || parsed?.id || parsed?.proof?.mission_id || parsed?.completion_proof?.mission_id || null,
-    stdout_bytes: Buffer.byteLength(result.stdout || ''),
-    stderr_bytes: Buffer.byteLength(result.stderr || ''),
-    stderr_tail: String(result.stderr || '').slice(-600)
-  };
-}
-
-function prepareHermeticFixtureRoot(sourceRoot, tempRoot) {
-  fs.mkdirSync(tempRoot, { recursive: true });
-  const packageFile = path.join(tempRoot, 'package.json');
-  if (!fs.existsSync(packageFile)) {
-    fs.writeFileSync(packageFile, `${JSON.stringify({ name: 'sks-hermetic-fixture', private: true, version: '0.0.0' }, null, 2)}\n`);
-  }
-  const readme = path.join(tempRoot, 'README.md');
-  if (!fs.existsSync(readme)) fs.writeFileSync(readme, '# SKS Hermetic Fixture\n');
-  copyFixtureFile(sourceRoot, tempRoot, 'test/fixtures/images/one-by-one.png');
-  return tempRoot;
-}
-
-function copyFixtureFile(sourceRoot, tempRoot, rel) {
-  const src = path.join(sourceRoot, rel);
-  const dest = path.join(tempRoot, rel);
-  if (!fs.existsSync(src) || fs.existsSync(dest)) return;
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-  fs.copyFileSync(src, dest);
-}
-
-function parseJsonOutput(text = '') {
-  const trimmed = String(text || '').trim();
-  if (!trimmed) return null;
-  try { return JSON.parse(trimmed); } catch {}
-  const start = trimmed.indexOf('{');
-  const end = trimmed.lastIndexOf('}');
-  if (start >= 0 && end > start) {
-    try { return JSON.parse(trimmed.slice(start, end + 1)); } catch {}
-  }
-  return null;
-}
-
-export function resolveExpectedArtifactPath(root, rel, { latestMissionId = null } = {}) {
-  const normalized = String(rel || '').replace('<latest>', latestMissionId || 'latest').replace('<mission-id>', latestMissionId || 'latest').replace('<root>', '.');
-  if (normalized.startsWith('.sneakoscope/')) return path.join(root, normalized);
-  if (latestMissionId) return path.join(root, '.sneakoscope', 'missions', latestMissionId, normalized);
-  return path.join(root, normalized);
-}
-
-function inspectExpectedArtifact(root, tempRoot, artifact, ctx = {}) {
-  const rel = artifact.path;
-  const file = resolveExpectedArtifactPath(root, rel, ctx);
-  const exists = fs.existsSync(file);
-  const schema = artifact.schema || inferSchema(rel);
-  const result = {
-    path: path.relative(root, file).split(path.sep).join('/'),
-    requested_path: rel,
-    schema,
-    exists,
-    schema_ok: false,
-    content_ok: false,
-    temp_root: tempRoot
-  };
-  if (!exists) return { ...result, failure: 'missing' };
-  if (file.endsWith('.md')) return { ...result, schema_ok: true, content_ok: fs.readFileSync(file, 'utf8').trim().length > 0 };
-  let parsed;
-  try {
-    parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch {
-    return { ...result, failure: 'json_parse' };
-  }
-  if (schema === 'sks.completion-proof.v1') return { ...result, schema_ok: parsed.schema === schema, content_ok: ['verified', 'verified_partial', 'blocked'].includes(parsed.status), status: parsed.status };
-  if (schema === 'sks.image-voxel-ledger.v1') {
-    const anchorCount = Array.isArray(parsed.anchors) ? parsed.anchors.length : 0;
-    const relationCount = Array.isArray(parsed.relations) ? parsed.relations.length : 0;
-    const requireAnchors = artifact.require_anchors !== false;
-    const requireRelations = artifact.require_relations === true;
-    return { ...result, schema_ok: parsed.schema === schema, content_ok: (!requireAnchors || anchorCount >= 1) && (!requireRelations || relationCount >= 1), anchor_count: anchorCount, relation_count: relationCount };
-  }
-  if (schema === 'sks.visual-anchors.v1') return { ...result, schema_ok: parsed.schema === schema, content_ok: Array.isArray(parsed.anchors) && (artifact.require_anchors === false || parsed.anchors.length >= 1), anchor_count: parsed.anchors?.length || 0 };
-  if (schema === 'sks.fixture-artifact.v1') return { ...result, schema_ok: Boolean(parsed.schema || parsed.schema_version || Object.hasOwn(parsed, 'passed') || Object.hasOwn(parsed, 'ok')), content_ok: true };
-  return { ...result, schema_ok: schema ? parsed.schema === schema || parsed.schema_version != null : true, content_ok: true };
-}
-
-function normalizeExpectedArtifacts(items = []) {
-  return (items || []).map((artifact) => {
-    if (typeof artifact === 'string') return { path: artifact, schema: inferSchema(artifact) };
-    return { ...artifact, schema: artifact.schema || inferSchema(artifact.path) };
-  });
-}
-
-function inferSchema(file = '') {
-  if (file.includes('completion-proof')) return 'sks.completion-proof.v1';
-  if (file.includes('image-voxel-ledger')) return 'sks.image-voxel-ledger.v1';
-  if (file.includes('visual-anchors')) return 'sks.visual-anchors.v1';
-  if (file.includes('image-assets')) return 'sks.image-assets.v1';
-  if (file.endsWith('.json')) return 'sks.fixture-artifact.v1';
-  return null;
-}
-
-function latestMissionId(root) {
-  const dir = path.join(root, '.sneakoscope', 'missions');
-  if (!fs.existsSync(dir)) return null;
-  const entries = fs.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith('M-')).map((entry) => entry.name).sort();
-  return entries.at(-1) || null;
-}
-
-function renderFeatureFixtureMarkdown(report = {}) {
-  const lines = [
-    '# SKS Feature Fixtures',
-    '',
-    `- Status: ${report.ok ? 'pass' : 'blocked'}`,
-    `- Checked: ${report.checked || 0}`,
-    `- Executed: ${report.executed || 0}`,
-    `- Artifact/schema validated: ${report.artifact_schema_validated || 0}`,
-    ''
-  ];
-  if (report.failures?.length) {
-    lines.push('## Failures', '');
-    for (const failure of report.failures) lines.push(`- ${failure}`);
-  }
-  return `${lines.join('\n')}\n`;
-}
-
-export function validateCompletionProofArtifact(file) {
-  const proof = JSON.parse(fs.readFileSync(file, 'utf8'));
-  return proof.schema === 'sks.completion-proof.v1' && ['verified', 'verified_partial', 'blocked'].includes(proof.status);
-}
-
-export function validateImageVoxelArtifact(file, { requireAnchors = true, requireRelations = false } = {}) {
-  const ledger = JSON.parse(fs.readFileSync(file, 'utf8'));
-  const anchors = ledger.anchors?.length || 0;
-  const relations = ledger.relations?.length || 0;
-  return ledger.schema === 'sks.image-voxel-ledger.v1' && (!requireAnchors || anchors >= 1) && (!requireRelations || relations >= 1);
-}
-
-export function validateNoPlaintextSecrets(root) {
-  const secretPattern = /(sk-proj-[A-Za-z0-9_-]{8,}|sk-clb-[A-Za-z0-9_-]{8,}|github_pat_[A-Za-z0-9_]{8,}|(?:CODEX_ACCESS_TOKEN|OPENAI_API_KEY)\s*[:=]\s*["']?(?:sk-[A-Za-z0-9_-]{8,}|[A-Za-z0-9_-]{32,}))/;
-  const reportDir = path.join(root, '.sneakoscope');
-  if (!fs.existsSync(reportDir)) return true;
-  const stack = [reportDir];
-  while (stack.length) {
-    const current = stack.pop();
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      const p = path.join(current, entry.name);
-      if (entry.isDirectory()) stack.push(p);
-      else if (/\.(json|md|txt|jsonl)$/i.test(entry.name) && secretPattern.test(fs.readFileSync(p, 'utf8'))) return false;
-    }
-  }
-  return true;
-}
-
-export const validateDbEvidenceArtifact = validateCompletionProofArtifact;
-export const validateHookReplayArtifact = validateCompletionProofArtifact;