sneakoscope 1.18.5 → 1.18.6

package/README.md

@@ -10,7 +10,7 @@ SKS does not try to clone every other harness. It focuses on one thing: making C
 
 ## Current Release
 
-SKS **1.18.5** wires the 1.18.4 real-proof tools into the runtime lifecycle: real tmux mode now writes before-drain, after-drain, and final physical pane proof artifacts; real Codex dynamic smoke validates output-schema/result-file/process cleanup and reports `fixture_instrumented_real` honestly; `sks agent close/cleanup` performs process-tree-aware SIGTERM/SIGKILL cleanup; and the task graph carries AST/import/test ownership, critical path, and runtime truth matrix evidence.
+SKS **1.18.6** closes the zero-gap runtime truth loop: proof policy now reports every runtime subsystem separately, trust reports surface those subsystem proof levels, runtime truth matrix evidence is generated from live release artifacts, cleanup verifies process/tree/tmux/temp/lock after-states, and MAD-SKS writes explicit Warp/tmux lane proof instead of implying UI visibility.
 
 ```bash
 sks mad-sks plan --target-root <path> --json
@@ -72,7 +72,9 @@ Detailed release history lives in [CHANGELOG.md](CHANGELOG.md). Current release
 - Agent cleanup executor: [docs/agent-cleanup-executor.md](docs/agent-cleanup-executor.md)
 - Intelligent work graph: [docs/intelligent-work-graph.md](docs/intelligent-work-graph.md)
 - Fake vs real proof policy: [docs/fake-vs-real-proof-policy.md](docs/fake-vs-real-proof-policy.md)
-- Migration 1.18.4 to 1.18.5: [docs/migration-1.18.4-to-1.18.5.md](docs/migration-1.18.4-to-1.18.5.md)
+- Runtime truth matrix: [docs/runtime-truth-matrix.md](docs/runtime-truth-matrix.md)
+- Warp MAD tmux lanes: [docs/warp-mad-tmux-lanes.md](docs/warp-mad-tmux-lanes.md)
+- Migration 1.18.5 to 1.18.6: [docs/migration-1.18.5-to-1.18.6.md](docs/migration-1.18.5-to-1.18.6.md)
 - Codex official Goal mode: [docs/codex-official-goal-mode.md](docs/codex-official-goal-mode.md)
 - Release parallel full coverage: [docs/release-parallel-full-coverage.md](docs/release-parallel-full-coverage.md)
 - Priority closure P0-P4: [docs/priority-closure-p0-p4.md](docs/priority-closure-p0-p4.md)

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "1.18.5"
+version = "1.18.6"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "1.18.5"
+version = "1.18.6"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 1.18.5"),
+        Some("--version") => println!("sks-rs 1.18.6"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "1.18.5",
-  "source_digest": "25698b68e8f9d6ff16ac94f404e60d99db9841e8e85a0f8c5831069a744434cc",
-  "source_file_count": 1430,
-  "built_at_source_time": 1779807721873
+  "package_version": "1.18.6",
+  "source_digest": "d45147f0f01dfabdab71a2e03ea484173d6de7e64e58958d1b73d31f8719ae5c",
+  "source_file_count": 1435,
+  "built_at_source_time": 1779844415377
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '1.18.3';
+const FAST_PACKAGE_VERSION = '1.18.6';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--version' || args[0] === '-v' || args[0] === 'version') {

package/dist/build-manifest.json

@@ -1,16 +1,16 @@
 {
   "schema": "sks.dist-build.v2",
-  "version": "1.18.5",
-  "package_version": "1.18.5",
+  "version": "1.18.6",
+  "package_version": "1.18.6",
   "typescript": true,
   "mjs_runtime_files": 0,
-  "compiled_file_count": 874,
-  "compiled_js_count": 437,
-  "compiled_dts_count": 437,
-  "source_digest": "25698b68e8f9d6ff16ac94f404e60d99db9841e8e85a0f8c5831069a744434cc",
-  "source_file_count": 1430,
-  "source_files_hash": "f8db0c06ebed73d7f4ee1f33117ef1dc633b59312f6d976ca6abf2e525d527fe",
-  "source_list_hash": "f8db0c06ebed73d7f4ee1f33117ef1dc633b59312f6d976ca6abf2e525d527fe",
+  "compiled_file_count": 878,
+  "compiled_js_count": 439,
+  "compiled_dts_count": 439,
+  "source_digest": "d45147f0f01dfabdab71a2e03ea484173d6de7e64e58958d1b73d31f8719ae5c",
+  "source_file_count": 1435,
+  "source_files_hash": "d1b0087b824861574256c5a1f9af243009a1ac33006649d562e5905cba8b829d",
+  "source_list_hash": "d1b0087b824861574256c5a1f9af243009a1ac33006649d562e5905cba8b829d",
   "src_mjs_runtime_files": 0,
   "dist_stamp_schema": "sks.dist-build-stamp.v1",
   "files": [
@@ -598,6 +598,8 @@
     "core/mad-sks/guard-middleware.js",
     "core/mad-sks/immutable-harness-guard.d.ts",
     "core/mad-sks/immutable-harness-guard.js",
+    "core/mad-sks/mad-tmux-lane-proof.d.ts",
+    "core/mad-sks/mad-tmux-lane-proof.js",
     "core/mad-sks/permission-model.d.ts",
     "core/mad-sks/permission-model.js",
     "core/mad-sks/proof-evidence.d.ts",
@@ -743,6 +745,8 @@
     "core/proof/route-proof-gate.js",
     "core/proof/route-proof-policy.d.ts",
     "core/proof/route-proof-policy.js",
+    "core/proof/runtime-truth-matrix.d.ts",
+    "core/proof/runtime-truth-matrix.js",
     "core/proof/selftest-proof-fixtures.d.ts",
     "core/proof/selftest-proof-fixtures.js",
     "core/proof/validation.d.ts",

package/dist/commands/image-ux-review.d.ts

@@ -611,6 +611,9 @@ export declare function run(command: any, args?: any): Promise<void | {
                     Proven: string[];
                     Blocked: string[];
                 };
+                runtime_truth_matrix: string | null;
+                proof_level_by_subsystem: any;
+                fake_real_policy: string | null;
                 blockers: any;
             };
             wrongness: {

package/dist/commands/ppt.d.ts

@@ -463,6 +463,9 @@ export declare function run(command: any, args?: any): Promise<void | {
                     Proven: string[];
                     Blocked: string[];
                 };
+                runtime_truth_matrix: string | null;
+                proof_level_by_subsystem: any;
+                fake_real_policy: string | null;
                 blockers: any;
             };
             wrongness: {

package/dist/core/agents/agent-cleanup-executor.d.ts

@@ -8,6 +8,8 @@ export interface AgentCleanupExecutorOptions {
     dryRun?: boolean;
     drain?: boolean;
     staleMs?: number;
+    graceMs?: number;
+    killEscalation?: boolean;
 }
 type CleanupActionKind = 'terminate_process' | 'close_tmux_pane' | 'remove_temp_dir' | 'remove_lock' | 'skip_active_session' | 'skip_foreign_namespace' | 'archive_transcript_keep';
 interface CleanupAction {
@@ -44,12 +46,19 @@ export declare function runAgentCleanupExecutor(opts: AgentCleanupExecutorOption
         target: string;
         tree: ProcessTreeEntry[];
     }[];
+    process_tree_count: number;
     sigterm_planned: string[];
     sigterm_sent: string[];
     sigkill_escalations: string[];
     process_exit_verified: string[];
+    sigterm_count: number;
+    sigkill_count: number;
+    verified_exited_count: number;
+    failed_to_kill_count: number;
     stale_tmux_panes_found: string[];
     stale_tmux_panes_closed: string[];
+    tmux_panes_verified_closed: string[];
+    tmux_close_failures: string[];
     orphan_temp_dirs_found: string[];
     orphan_temp_dirs_removed: string[];
     stale_locks_found: string[];

package/dist/core/agents/agent-cleanup-executor.js

@@ -23,7 +23,8 @@ export async function runAgentCleanupExecutor(opts) {
     const staleMs = opts.staleMs ?? 30 * 60 * 1000;
     const projectHash = String(namespace?.root_hash || '');
     const actions = [];
-    const graceMs = Number(process.env.SKS_CLEANUP_GRACE_MS || 750);
+    const graceMs = opts.graceMs ?? Number(process.env.SKS_CLEANUP_GRACE_MS || 750);
+    const killEscalation = opts.killEscalation !== false && process.env.SKS_CLEANUP_KILL_ESCALATION !== '0';
     const processReports = await listNamedFiles(path.join(agentRoot, 'sessions'), 'agent-process-report.json');
     for (const file of processReports) {
         const report = await readJson(file, null);
@@ -45,7 +46,8 @@ export async function runAgentCleanupExecutor(opts) {
             pid,
             reason: terminal ? 'terminal_session_process_alive' : 'stale_session_process',
             apply,
-            graceMs
+            graceMs,
+            killEscalation
         }));
     }
     const tmuxReports = await listNamedFiles(path.join(agentRoot, 'sessions'), 'agent-tmux-report.json');
@@ -55,7 +57,11 @@ export async function runAgentCleanupExecutor(opts) {
         const sessionId = String(report?.session_id || '');
         if (!validTmuxPaneId(paneId))
             continue;
-        if (activeSessionIds.has(sessionId)) {
+        if (!processReportInNamespace(report, projectHash)) {
+            actions.push({ kind: 'skip_foreign_namespace', target: paneId, status: 'skipped', reason: 'tmux_pane_outside_project_namespace' });
+            continue;
+        }
+        if (activeSessionIds.has(sessionId) && opts.drain !== true) {
             actions.push({ kind: 'skip_active_session', target: sessionId || paneId, status: 'skipped', reason: 'tmux_session_active' });
             continue;
         }
@@ -64,11 +70,12 @@ export async function runAgentCleanupExecutor(opts) {
             target: paneId,
             reason: 'stale_tmux_pane',
             apply,
+            before: async () => ({ listed: await tmuxPaneListed(paneId), pane_id: paneId }),
+            after: async () => ({ listed: await tmuxPaneListed(paneId), pane_id: paneId }),
             run: async () => {
                 const { runProcess } = await import('../fsx.js');
                 await runProcess('tmux', ['kill-pane', '-t', paneId], { timeoutMs: 3000, maxOutputBytes: 4096 });
-                const listed = await runProcess('tmux', ['list-panes', '-a', '-F', '#{pane_id}'], { timeoutMs: 3000, maxOutputBytes: 4096 });
-                if (listed.stdout.split(/\r?\n/).includes(paneId))
+                if (await tmuxPaneListed(paneId))
                     throw new Error('tmux_pane_still_listed_after_kill');
             }
         }));
@@ -85,7 +92,13 @@ export async function runAgentCleanupExecutor(opts) {
             target: dir,
             reason: 'orphan_temp_dir',
             apply,
-            run: async () => fsp.rm(dir, { recursive: true, force: true })
+            before: async () => ({ exists: await exists(dir) }),
+            after: async () => ({ exists: await exists(dir) }),
+            run: async () => {
+                await fsp.rm(dir, { recursive: true, force: true });
+                if (await exists(dir))
+                    throw new Error('temp_dir_still_exists_after_remove');
+            }
         }));
     }
     for (const lock of await staleLockFiles(String(namespace?.lock_dir || ''), projectHash, now, staleMs)) {
@@ -94,7 +107,13 @@ export async function runAgentCleanupExecutor(opts) {
             target: lock,
             reason: 'stale_lock_file',
             apply,
-            run: async () => fsp.rm(lock, { force: true })
+            before: async () => ({ exists: await exists(lock) }),
+            after: async () => ({ exists: await exists(lock) }),
+            run: async () => {
+                await fsp.rm(lock, { force: true });
+                if (await exists(lock))
+                    throw new Error('lock_file_still_exists_after_remove');
+            }
         }));
     }
     for (const transcript of await listNamedFiles(path.join(agentRoot, 'sessions'), 'agent-terminal-session.json')) {
@@ -145,12 +164,19 @@ function buildCleanupProof(input) {
         stale_processes_found: byKind('terminate_process').map((row) => row.target),
         stale_processes_killed: byKind('terminate_process', 'applied').map((row) => row.target),
         process_trees: byKind('terminate_process').map((row) => ({ target: row.target, tree: row.process_tree || [] })),
+        process_tree_count: byKind('terminate_process').filter((row) => (row.process_tree || []).length > 0).length,
         sigterm_planned: input.actions.filter((row) => row.status === 'planned' && row.signal_sequence?.includes('SIGTERM')).map((row) => row.target),
         sigterm_sent: input.actions.filter((row) => row.status === 'applied' && row.signal_sequence?.includes('SIGTERM')).map((row) => row.target),
         sigkill_escalations: input.actions.filter((row) => row.escalated_to_sigkill === true).map((row) => row.target),
         process_exit_verified: input.actions.filter((row) => row.kind === 'terminate_process' && row.verified_exited === true).map((row) => row.target),
+        sigterm_count: input.actions.filter((row) => row.signal_sequence?.includes('SIGTERM')).length,
+        sigkill_count: input.actions.filter((row) => row.signal_sequence?.includes('SIGKILL')).length,
+        verified_exited_count: input.actions.filter((row) => row.kind === 'terminate_process' && row.verified_exited === true).length,
+        failed_to_kill_count: input.actions.filter((row) => row.kind === 'terminate_process' && row.status === 'failed').length,
         stale_tmux_panes_found: byKind('close_tmux_pane').map((row) => row.target),
         stale_tmux_panes_closed: byKind('close_tmux_pane', 'applied').map((row) => row.target),
+        tmux_panes_verified_closed: byKind('close_tmux_pane', 'applied').filter((row) => row.after?.listed === false).map((row) => row.target),
+        tmux_close_failures: byKind('close_tmux_pane', 'failed').map((row) => row.target),
         orphan_temp_dirs_found: byKind('remove_temp_dir').map((row) => row.target),
         orphan_temp_dirs_removed: byKind('remove_temp_dir', 'applied').map((row) => row.target),
         stale_locks_found: byKind('remove_lock').map((row) => row.target),
@@ -177,7 +203,7 @@ async function terminateProcessTreeAction(input) {
             process_tree: processTree,
             before: { alive: targets.filter(processIsAlive) },
             after: { alive: targets.filter(processIsAlive) },
-            signal_sequence: ['SIGTERM', 'SIGKILL_IF_STILL_ALIVE'],
+            signal_sequence: input.killEscalation ? ['SIGTERM', 'SIGKILL_IF_STILL_ALIVE'] : ['SIGTERM'],
             grace_ms: input.graceMs,
             verified_exited: false,
             escalated_to_sigkill: false
@@ -191,7 +217,7 @@ async function terminateProcessTreeAction(input) {
         await waitForProcessesExited(targets, input.graceMs);
         let alive = targets.filter(processIsAlive);
         let escalated = false;
-        if (alive.length) {
+        if (alive.length && input.killEscalation) {
             for (const pid of [...alive].reverse())
                 safeKill(pid, 'SIGKILL');
             signalSequence.push('SIGKILL');
@@ -232,14 +258,17 @@ async function terminateProcessTreeAction(input) {
     }
 }
 async function applyAction(input) {
+    const before = input.before ? await input.before().catch((err) => ({ error: err instanceof Error ? err.message : String(err) })) : undefined;
     if (!input.apply)
-        return { kind: input.kind, target: input.target, status: 'planned', reason: input.reason };
+        return { kind: input.kind, target: input.target, status: 'planned', reason: input.reason, ...(before ? { before, after: before } : {}) };
     try {
         await input.run();
-        return { kind: input.kind, target: input.target, status: 'applied', reason: input.reason };
+        const after = input.after ? await input.after().catch((err) => ({ error: err instanceof Error ? err.message : String(err) })) : undefined;
+        return { kind: input.kind, target: input.target, status: 'applied', reason: input.reason, ...(before ? { before } : {}), ...(after ? { after } : {}) };
     }
     catch (err) {
-        return { kind: input.kind, target: input.target, status: 'failed', reason: input.reason, error: err instanceof Error ? err.message : String(err) };
+        const after = input.after ? await input.after().catch((afterErr) => ({ error: afterErr instanceof Error ? afterErr.message : String(afterErr) })) : undefined;
+        return { kind: input.kind, target: input.target, status: 'failed', reason: input.reason, error: err instanceof Error ? err.message : String(err), ...(before ? { before } : {}), ...(after ? { after } : {}) };
     }
 }
 async function staleLockFiles(lockDir, projectHash, now, staleMs) {
@@ -340,4 +369,14 @@ async function waitForProcessesExited(pids, timeoutMs) {
 function validTmuxPaneId(value) {
     return /^%\d+$/.test(value);
 }
+async function tmuxPaneListed(paneId) {
+    try {
+        const { runProcess } = await import('../fsx.js');
+        const listed = await runProcess('tmux', ['list-panes', '-a', '-F', '#{pane_id}'], { timeoutMs: 3000, maxOutputBytes: 4096 });
+        return listed.stdout.split(/\r?\n/).includes(paneId);
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=agent-cleanup-executor.js.map

package/dist/core/agents/agent-command-surface.d.ts

@@ -17,6 +17,8 @@ export declare function parseAgentCommandArgs(command: string, args?: string[]):
     dryRun: boolean;
     drain: boolean;
     staleMs: number;
+    graceMs: number;
+    killEscalation: boolean;
     json: boolean;
     missionId: string;
     lane: string;

package/dist/core/agents/agent-command-surface.js

@@ -20,15 +20,17 @@ export function parseAgentCommandArgs(command, args = []) {
     const dryRun = hasFlag(args, '--dry-run') || hasFlag(args, '--dryrun');
     const drain = hasFlag(args, '--drain');
     const staleMs = Number(readOption(args, '--stale-ms', 30 * 60 * 1000));
+    const graceMs = Number(readOption(args, '--grace-ms', 750));
+    const killEscalation = hasFlag(args, '--kill-escalation') || !hasFlag(args, '--no-kill-escalation');
     const codexApp = hasFlag(args, '--codex-app');
-    const positionals = positionalArgs(rest, new Set(['--agents', '--target-active-slots', '--work-items', '--minimum-work-items', '--max-queue-expansion', '--concurrency', '--backend', '--route', '--mission', '--mission-id', '--agent', '--lane', '--stale-ms']));
+    const positionals = positionalArgs(rest, new Set(['--agents', '--target-active-slots', '--work-items', '--minimum-work-items', '--max-queue-expansion', '--concurrency', '--backend', '--route', '--mission', '--mission-id', '--agent', '--lane', '--stale-ms', '--grace-ms']));
     const missionDefault = action === 'run' || action === 'spawn' || action === 'plan' ? '' : 'latest';
     const positionalMission = action === 'run' || action === 'spawn' || action === 'plan' ? '' : (positionals[0] || '');
     const missionId = String(readOption(args, '--mission', readOption(args, '--mission-id', positionalMission || missionDefault)));
     const lane = String(readOption(args, '--agent', readOption(args, '--lane', '')));
     const promptPositionals = positionalMission ? positionals.slice(1) : positionals;
     const prompt = promptPositionals.join(' ').trim() || 'Native agent run';
-    return { command, action, prompt, route, agents, targetActiveSlots, desiredWorkItemCount, minimumWorkItems, maxQueueExpansion, concurrency, backend, mock, real, readonly, apply, dryRun, drain, staleMs, json, missionId, lane, codexApp };
+    return { command, action, prompt, route, agents, targetActiveSlots, desiredWorkItemCount, minimumWorkItems, maxQueueExpansion, concurrency, backend, mock, real, readonly, apply, dryRun, drain, staleMs, graceMs, killEscalation, json, missionId, lane, codexApp };
 }
 function hasFlag(args, flag) {
     return args.includes(flag);

package/dist/core/agents/agent-orchestrator.d.ts

@@ -230,6 +230,9 @@ export declare function runNativeAgentOrchestrator(opts?: AgentRunOptions): Prom
             Proven: string[];
             Blocked: string[];
         };
+        runtime_truth_matrix: string | null;
+        proof_level_by_subsystem: any;
+        fake_real_policy: string | null;
         blockers: any;
     };
     wrongness: {

package/dist/core/agents/agent-proof-evidence.js

@@ -1,12 +1,13 @@
 import path from 'node:path';
 import { AGENT_PROOF_EVIDENCE_SCHEMA } from './agent-schema.js';
-import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { nowIso, PACKAGE_VERSION, readJson, writeJsonAtomic } from '../fsx.js';
 import { validateAgentLedgerHashChain } from './agent-central-ledger.js';
 import { assertAllAgentSessionsClosed } from './agent-lifecycle.js';
 import { assertAgentTerminalSessionsClosed } from './agent-terminal-session.js';
 import { assertAgentSessionGenerationsClosed } from './agent-session-generation.js';
 import { readTmuxLaneSupervisor } from './tmux-lane-supervisor.js';
 import { writeFakeRealProofPolicyReport } from '../proof/fake-real-proof-policy.js';
+import { buildRuntimeTruthMatrix, writeRuntimeTruthMatrix } from '../proof/runtime-truth-matrix.js';
 export async function writeAgentProofEvidence(root, input) {
     const lifecycle = await assertAllAgentSessionsClosed(root);
     const terminal = await assertAgentTerminalSessionsClosed(root);
@@ -206,6 +207,20 @@ export async function writeAgentProofEvidence(root, input) {
     };
     await writeJsonAtomic(path.join(root, 'agent-proof-evidence.json'), evidence);
     await writeFakeRealProofPolicyReport(root, evidence);
+    const runtimeTruthMatrix = await buildRuntimeTruthMatrix({
+        root: repoRootFromAgentRoot(root),
+        agentRoot: root,
+        releaseVersion: PACKAGE_VERSION,
+        reports: {
+            'agent-tmux-physical-proof.json': tmuxPhysicalProof,
+            'agent-cleanup-proof.json': cleanupProof,
+            'agent-intelligent-work-graph.json': intelligentWorkGraph,
+            'source-intelligence-evidence.json': input.partition?.source_intelligence_refs,
+            'goal-mode-applied.json': input.partition?.goal_mode_ref,
+            'agent-scheduler-state.json': scheduler
+        }
+    });
+    await writeRuntimeTruthMatrix(repoRootFromAgentRoot(root), runtimeTruthMatrix, { agentRoot: root });
     return evidence;
 }
 export async function readAgentProofEvidence(root, missionId) {
@@ -239,4 +254,7 @@ function pathWithin(file, leasePath) {
     const right = String(leasePath || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '');
     return left === right || left.startsWith(right + '/');
 }
+function repoRootFromAgentRoot(agentRoot) {
+    return path.resolve(agentRoot, '..', '..', '..', '..');
+}
 //# sourceMappingURL=agent-proof-evidence.js.map

package/dist/core/agents/agent-trust-report.d.ts

@@ -67,6 +67,9 @@ export declare function writeAgentTrustReport(root: string, input?: any): Promis
         Proven: string[];
         Blocked: string[];
     };
+    runtime_truth_matrix: string | null;
+    proof_level_by_subsystem: any;
+    fake_real_policy: string | null;
     blockers: any;
 }>;
 //# sourceMappingURL=agent-trust-report.d.ts.map

package/dist/core/agents/agent-trust-report.js

@@ -7,6 +7,8 @@ export async function writeAgentTrustReport(root, input = {}) {
     const tmuxPhysicalProofSummary = await readJson(path.join(root, 'agent-tmux-physical-proof-summary.json'), null);
     const cleanupProof = await readJson(path.join(root, 'agent-cleanup-proof.json'), null);
     const intelligentWorkGraph = await readJson(path.join(root, 'agent-intelligent-work-graph.json'), null);
+    const fakeRealPolicy = await readJson(path.join(root, 'fake-real-proof-policy.json'), null);
+    const runtimeTruthMatrix = await readJson(path.join(root, 'runtime-truth-matrix.json'), null);
     const runtimeTruthGroups = {
         Fake: [],
         Optional: [],
@@ -26,6 +28,13 @@ export async function writeAgentTrustReport(root, input = {}) {
     pushTruth(String(tmuxPhysicalProof?.status || 'not_run'), 'tmux physical');
     pushTruth(cleanupProof?.ok === true ? 'passed' : cleanupProof ? 'blocked' : 'not_run', 'cleanup executor');
     pushTruth(intelligentWorkGraph?.ok === true ? 'passed' : intelligentWorkGraph ? 'partial' : 'not_run', 'intelligent work graph');
+    const subsystemProofLevels = {
+        ...(fakeRealPolicy?.subsystem_levels || {}),
+        ...Object.fromEntries((runtimeTruthMatrix?.rows || runtimeTruthMatrix?.subsystems || []).map((row) => [row.subsystem, row.proof_level])),
+        tmux_physical: runtimeTruthMatrix?.rows?.find?.((row) => row.subsystem === 'tmux_physical')?.proof_level || fakeRealPolicy?.subsystem_levels?.tmux_physical || (tmuxPhysicalProof?.proof_level || tmuxPhysicalProof?.status || 'not_run'),
+        cleanup: runtimeTruthMatrix?.rows?.find?.((row) => row.subsystem === 'cleanup')?.proof_level || fakeRealPolicy?.subsystem_levels?.cleanup || (cleanupProof?.ok === true ? 'proven' : cleanupProof ? 'blocked' : 'not_run'),
+        intelligent_work_graph: runtimeTruthMatrix?.rows?.find?.((row) => row.subsystem === 'intelligent_work_graph')?.proof_level || fakeRealPolicy?.subsystem_levels?.intelligent_work_graph || intelligentWorkGraph?.proof_level || (intelligentWorkGraph ? 'partial' : 'not_run')
+    };
     const report = {
         schema: 'sks.agent-trust-report.v1',
         generated_at: nowIso(),
@@ -90,6 +99,9 @@ export async function writeAgentTrustReport(root, input = {}) {
             fake_backend_disclaimer: input.backend === 'fake' ? 'fixture only; no real parallel execution claim' : null
         },
         runtime_truth_groups: runtimeTruthGroups,
+        runtime_truth_matrix: runtimeTruthMatrix ? 'runtime-truth-matrix.json' : null,
+        proof_level_by_subsystem: subsystemProofLevels,
+        fake_real_policy: fakeRealPolicy ? 'fake-real-proof-policy.json' : null,
         blockers: Array.isArray(input.blockers) ? input.blockers : []
     };
     await writeJsonAtomic(path.join(root, 'agent-trust-report.json'), report);
@@ -125,6 +137,8 @@ function renderAgentTrustReportMarkdown(report) {
         `- runtime_truth_optional: ${(report.runtime_truth_groups?.Optional || []).join(', ') || 'None'}`,
         `- runtime_truth_proven: ${(report.runtime_truth_groups?.Proven || []).join(', ') || 'None'}`,
         `- runtime_truth_blocked: ${(report.runtime_truth_groups?.Blocked || []).join(', ') || 'None'}`,
+        `- runtime_truth_matrix: ${report.runtime_truth_matrix || 'not_run'}`,
+        ...Object.entries(report.proof_level_by_subsystem || {}).sort(([a], [b]) => a.localeCompare(b)).map(([name, level]) => `- proof_level.${name}: ${level}`),
         `- generation_count: ${orchestration.generation_count ?? 'unknown'}`,
         `- no_overlap_ok: ${orchestration.no_overlap_ok === true}`,
         `- ledger_hash_chain_ok: ${orchestration.ledger_hash_chain_ok === true}`,

package/dist/core/agents/intelligent-work-graph.d.ts

@@ -13,6 +13,8 @@ export interface IntelligentWorkGraph {
     ast_inventory: any;
     file_to_symbols: Record<string, string[]>;
     symbol_to_files: Record<string, string[]>;
+    exported_symbols: Record<string, string[]>;
+    imported_symbols: Record<string, string[]>;
     exported_api_ownership: Record<string, string>;
     command_to_module_ownership: Record<string, string[]>;
     route_to_module_ownership: Record<string, string[]>;