sneakoscope 10.3.0 → 10.3.2

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.0**. Install the latest stable release from npm.
+Current package: **SKS 10.3.2**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.0"
+version = "10.3.2"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.0"
+version = "10.3.2"
 edition = "2021"
 
 [dependencies]

package/dist/cli/install-helpers-codex-lb-config.js

@@ -4,6 +4,14 @@ import { escapeRegExp } from '../core/text/regex.js';
 export const DESKTOP_BRIDGE_MANAGED_MARKER = '# sks-desktop-bridge-managed';
 export const DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER = '# sks-desktop-bridge-managed-base-url';
 export const DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER = '# sks-desktop-bridge-managed-model-catalog';
+export function bindCodexClientProvider(text, provider) {
+    const selected = topLevelTomlString(text, 'model_provider');
+    if (selected && selected !== 'openai' && selected !== 'codex-lb')
+        return text;
+    if (selected === provider)
+        return text;
+    return upsertTopLevelTomlString(String(text || ''), 'model_provider', provider);
+}
 export function upsertDesktopBridgeManagedConfig(text, input) {
     const bridgeBaseUrl = normalizeManagedBridgeBaseUrl(input.bridgeBaseUrl);
     const combinedCatalogPath = String(input.combinedCatalogPath || '').trim();
@@ -16,7 +24,8 @@ export function upsertDesktopBridgeManagedConfig(text, input) {
     const orphanCleanup = removeDesktopBridgeOrphanManagedMarkers(String(text || ''));
     let next = orphanCleanup.text;
     const selectedProvider = topLevelTomlString(next, 'model_provider');
-    if (selectedProvider && (selectedProvider !== 'openai'
+    const managedProvider = selectedProvider === 'codex-lb' || selectedProvider === 'openai';
+    if (selectedProvider && (!managedProvider
         || !topLevelHasLine(next, DESKTOP_BRIDGE_MANAGED_MARKER))) {
         throw new Error('historical_user_owned_config_conflict:model_provider');
     }
@@ -30,8 +39,9 @@ export function upsertDesktopBridgeManagedConfig(text, input) {
     if (existingCatalog && !catalogOwned) {
         throw new Error('historical_user_owned_config_conflict:model_catalog_json');
     }
+    const keepCodexLb = selectedProvider === 'codex-lb';
     next = removeManagedBridgeTopLevelBindings(next);
-    next = upsertTopLevelTomlString(next, 'model_provider', 'openai');
+    next = upsertTopLevelTomlString(next, 'model_provider', keepCodexLb ? 'codex-lb' : 'openai');
     next = addTopLevelMarkerBeforeKey(next, 'model_provider', DESKTOP_BRIDGE_MANAGED_MARKER);
     next = upsertTopLevelTomlString(next, 'openai_base_url', bridgeBaseUrl);
     next = addTopLevelMarkerBeforeKey(next, 'openai_base_url', DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER);
@@ -45,7 +55,7 @@ export function removeDesktopBridgeManagedConfig(text) {
     const baseUrl = topLevelTomlString(next, 'openai_base_url');
     const catalog = topLevelTomlString(next, 'model_catalog_json');
     const owned = [
-        [DESKTOP_BRIDGE_MANAGED_MARKER, 'model_provider', selectedProvider === 'openai'],
+        [DESKTOP_BRIDGE_MANAGED_MARKER, 'model_provider', selectedProvider === 'openai' || selectedProvider === 'codex-lb'],
         [DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, 'openai_base_url', Boolean(baseUrl)],
         [DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER, 'model_catalog_json', Boolean(catalog)]
     ];
@@ -67,7 +77,7 @@ export function removeDesktopBridgeOrphanManagedMarkers(text) {
     const source = String(text || '');
     const selectedProvider = topLevelTomlString(source, 'model_provider');
     const markerTargets = [
-        [DESKTOP_BRIDGE_MANAGED_MARKER, selectedProvider === 'openai'],
+        [DESKTOP_BRIDGE_MANAGED_MARKER, selectedProvider === 'openai' || selectedProvider === 'codex-lb'],
         [DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, Boolean(topLevelTomlString(source, 'openai_base_url'))],
         [DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER, Boolean(topLevelTomlString(source, 'model_catalog_json'))]
     ];

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.0",
+  "package_version": "10.3.2",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-controller-v3/provider-commands.js

@@ -1,3 +1,6 @@
+import { bindCodexClientProvider } from '../../../cli/install-helpers-codex-lb-config.js';
+import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
+import { readText } from '../../fsx.js';
 import { testOpenRouterConnection } from '../../providers/openrouter/openrouter-account.js';
 import { openRouterSecretPaths } from '../../providers/openrouter/openrouter-secret-store.js';
 import { codexLbEnvPath, codexLbMetadataPath, readCodexLbModelCatalog } from '../codex-lb-env.js';
@@ -108,6 +111,12 @@ export async function setProviderState(providerId, enabled, operation, options)
             });
         }
     }
+    if (providerId === 'codex-lb') {
+        const current = await readText(paths.configPath, '');
+        const next = bindCodexClientProvider(current, enabled ? 'codex-lb' : 'openai');
+        if (next !== current)
+            await safeWriteCodexConfigToml(paths.configPath, current, next, 'codex-lb-client-provider');
+    }
     const status = await desktopBridgeStatusV3(options);
     return commandResult(operation, true, status, { provider_id: providerId, enabled }, [], options);
 }

package/dist/core/decisions/integration.js

@@ -8,7 +8,7 @@ import { applyRecoveryEffect, listProductionRecoveryCandidates } from './recover
 import { assembleRoutingSelection, buildRoutingCandidates } from './routing.js';
 import { buildDecisionReceipt } from './receipt.js';
 import { applyOptionalContextSelection, graphFileDigest, hydrateContextCandidates, sourceSnapshotDigest } from './state.js';
-import { DESIGN_DEFAULTS, POLICY_REVISION, UNKNOWN_USAGE } from './types.js';
+import { DESIGN_DEFAULTS, POLICY_REVISION, UNKNOWN_USAGE, sealedRoutingModel } from './types.js';
 let testOverrides = null;
 const appliedEffects = new Set();
 export function setDecisionTestOverrides(overrides) {
@@ -101,6 +101,7 @@ async function decideOfficialSubagentPreparationInner(input, started) {
             selectedPlan: null,
             selectedRouting: null,
             selectedContextIds: null,
+            omittedRoutingRoles: [],
             consumptionEvidence: null
         };
     const receipt = buildDecisionReceipt({
@@ -122,12 +123,51 @@ async function decideOfficialSubagentPreparationInner(input, started) {
         selectedPlan: applied.selectedPlan,
         selectedRouting: applied.selectedRouting,
         selectedContextIds: applied.selectedContextIds,
+        omittedRoutingRoles: applied.omittedRoutingRoles,
         llmRejudgeCalls: 0,
         bundle
     };
     overrides?.observe?.({ mode: config.mode, eligible: true, compiled, receipt });
     return result;
 }
+export async function consultJevTurnModel(input) {
+    const overrides = activeOverrides();
+    const env = input.env || process.env;
+    const config = overrides?.config ?? await readDecisionConfig(env);
+    const none = (reason) => ({ called: false, model: null, effort: null, reason });
+    if (!jevEnabled(config))
+        return none('off');
+    const resolved = await resolveOpenRouterApiKey({ env });
+    if (!resolved.key)
+        return none('missing_key');
+    const prompt = String(input.prompt || '').trim();
+    if (!prompt)
+        return none('empty_prompt');
+    const roleId = input.roleId === 'spawn' ? 'spawn' : 'turn';
+    const bundle = buildDecisionBundle({
+        projectId: sha256(input.root).slice(0, 32),
+        workflowRunId: roleId,
+        workflowRevision: roleId,
+        sourceDigest: roleId,
+        graphDigest: null,
+        goal: prompt,
+        routingCandidates: [{ id: roleId, summary: prompt.slice(0, 240) }]
+    });
+    const transport = await requestOpenRouterDecision(bundle, {
+        env,
+        deadlineMs: DESIGN_DEFAULTS.deadlineMs,
+        ...(overrides?.fetchImpl ? { fetchImpl: overrides.fetchImpl } : {})
+    });
+    if (!transport.ok)
+        return { called: true, model: null, effort: null, reason: transport.reason };
+    const compiled = compileDecision(bundle, transport.response);
+    if (compiled.kind !== 'apply')
+        return { called: true, model: null, effort: null, reason: compiled.reason };
+    const selected = assembleRoutingSelection(compiled.effects.flatMap((effect) => (effect.kind === 'select_routing' ? [{ roleId: effect.roleId, model: effect.model }] : [])));
+    const model = selected?.models[roleId] || null;
+    const sealed = model ? sealedRoutingModel(model) : null;
+    return { called: true, model: sealed?.id || null, effort: sealed?.effort || null, reason: sealed ? 'applied' : 'keep_baseline' };
+}
 export function effectAlreadyConsumed(identity) {
     return appliedEffects.has(identity);
 }
@@ -157,6 +197,7 @@ function applyEffects(attention, contextCandidates, planCandidates, compiled) {
     let selectedContextIds = null;
     const evidence = [];
     const routingEffects = [];
+    const omittedRoutingRoles = [];
     for (const effect of compiled.effects) {
         if (effect.kind === 'select_optional_context') {
             nextAttention = applyOptionalContextSelection(attention, contextCandidates, effect.keepIds);
@@ -171,6 +212,10 @@ function applyEffects(attention, contextCandidates, planCandidates, compiled) {
         if (effect.kind === 'select_routing') {
             routingEffects.push({ roleId: effect.roleId, model: effect.model });
         }
+        if (effect.kind === 'omit_role') {
+            omittedRoutingRoles.push(effect.roleId);
+            evidence.push(`omit:${effect.roleId}`);
+        }
     }
     const selectedRouting = assembleRoutingSelection(routingEffects);
     if (selectedRouting) {
@@ -181,6 +226,7 @@ function applyEffects(attention, contextCandidates, planCandidates, compiled) {
         selectedPlan,
         selectedRouting,
         selectedContextIds,
+        omittedRoutingRoles,
         consumptionEvidence: evidence.length ? evidence.join('|') : null
     };
 }
@@ -256,6 +302,7 @@ function keep(input, reason, started) {
         selectedPlan: null,
         selectedRouting: null,
         selectedContextIds: null,
+        omittedRoutingRoles: [],
         llmRejudgeCalls: 0,
         bundle: null
     };

package/dist/core/decisions/policy.js

@@ -1,4 +1,4 @@
-import { CHOICE_MIN_CONFIDENCE, CHOICE_MIN_PROBABILITY, CONTEXT_DROP_NOUL_MAX, DISTRIBUTION_SUM_TOLERANCE, KEEP_BASELINE_CHOICE, NEEDS_EVIDENCE_CHOICE, POLICY_REVISION, ROUTING_RISK_NOUL_MIN, UNKNOWN_USAGE, sealedRoutingModel } from './types.js';
+import { CHOICE_MIN_CONFIDENCE, CHOICE_MIN_PROBABILITY, CONTEXT_DROP_NOUL_MAX, DISTRIBUTION_SUM_TOLERANCE, KEEP_BASELINE_CHOICE, NEEDS_EVIDENCE_CHOICE, POLICY_REVISION, ROUTING_RISK_NOUL_MIN, ROUTING_ROLE_OMIT_NOUL_MAX, UNKNOWN_USAGE, sealedRoutingModel } from './types.js';
 export function compileDecision(bundle, response) {
     const usage = usageFromWire(response.usage);
     const decoded = decodeWireResponse(bundle, response);
@@ -151,6 +151,16 @@ function compileRouting(bundle, answers) {
         else if (!reason)
             reason = compiled.reason;
     }
+    for (const [questionId, binding] of Object.entries(bundle.questionBindings)) {
+        if (binding.kind !== 'routing_needed')
+            continue;
+        const answer = answers[questionId];
+        if (!answer || answer.type !== 'noul')
+            continue;
+        if (answer.noul <= ROUTING_ROLE_OMIT_NOUL_MAX) {
+            effects.push({ kind: 'omit_role', roleId: binding.roleId });
+        }
+    }
     return { effects, reason };
 }
 function compileRoleRouting(bundle, answers, roleId) {

package/dist/core/decisions/questions.js

@@ -210,6 +210,20 @@ function appendRoutingSpeculation(roles, questions, bindings, recoverySlot) {
             }
         };
         bindings[riskId] = { kind: 'routing_risk', roleId: role.id };
+        if (questionRoom(questions, recoverySlot) < 1)
+            break;
+        const neededId = `needed_${role.id}`;
+        const neededInstructions = redactDecisionText(`Does state.task require routing.roles.${role.id} as its own child agent? Omit the role when another listed role already covers the work.`);
+        assertIndependentQuestion(neededInstructions);
+        questions[neededId] = {
+            type: 'noul',
+            instructions: neededInstructions,
+            criteria: {
+                true: 'This role must be spawned to finish the task.',
+                false: 'This role is unnecessary. The parent should not spawn it.'
+            }
+        };
+        bindings[neededId] = { kind: 'routing_needed', roleId: role.id };
     }
 }
 export { QUESTION_REVISION };

package/dist/core/decisions/types.js

@@ -27,6 +27,7 @@ export const ROUTING_DIFFICULTY_RUBRIC = Object.freeze([
     'Judgment, architecture, ambiguity, security, or other high-stakes work.'
 ]);
 export const ROUTING_RISK_NOUL_MIN = 0.70;
+export const ROUTING_ROLE_OMIT_NOUL_MAX = 0.35;
 export function sealedRoutingModel(model) {
     const match = SEALED_ROUTING_MODELS.find((row) => row.id === model);
     return match ? { id: match.id, effort: match.effort } : null;

package/dist/core/hooks-runtime/hook-io.js

@@ -1,6 +1,6 @@
 import { IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
 import { readStdin } from '../fsx.js';
-import { buildCompactContinue, buildPermissionRequestAllow, buildPermissionRequestDeny, buildPostToolUseBlock, buildPostToolUseContinue, buildPreToolUseContinue, buildPreToolUseDeny, buildSessionStartContinue, buildStopBlock, buildStopContinue, buildSubagentStartContinue, buildSubagentStopBlock, buildSubagentStopContinue, buildUserPromptSubmitBlock, buildUserPromptSubmitContinue } from '../codex-compat/codex-hook-output-builders.js';
+import { buildCompactContinue, buildPermissionRequestAllow, buildPermissionRequestDeny, buildPostToolUseBlock, buildPostToolUseContinue, buildPreToolUseAllowRewrite, buildPreToolUseContinue, buildPreToolUseDeny, buildSessionStartContinue, buildStopBlock, buildStopContinue, buildSubagentStartContinue, buildSubagentStopBlock, buildSubagentStopContinue, buildUserPromptSubmitBlock, buildUserPromptSubmitContinue } from '../codex-compat/codex-hook-output-builders.js';
 export async function loadHookPayload() {
     const raw = await readStdin();
     try {
@@ -33,6 +33,8 @@ export function normalizeHookResult(name, result = {}) {
         if (out.decision === 'block' || out.permissionDecision === 'deny' || out.decision === 'deny') {
             return buildPreToolUseDeny(reason, { systemMessage });
         }
+        if (out.updatedInput)
+            return buildPreToolUseAllowRewrite(out.updatedInput, { systemMessage });
         return buildPreToolUseContinue({ additionalContext: out.additionalContext, systemMessage });
     }
     if (eventName === 'PermissionRequest') {

package/dist/core/hooks-runtime/jev-spawn-routing.js

@@ -0,0 +1,50 @@
+import { consultJevTurnModel } from '../decisions/integration.js';
+import { readRoleModelPreferences } from '../subagents/role-model-preferences.js';
+const SPAWN_TOOLS = new Set(['spawn_agent', 'collaboration.spawn_agent', 'functions.spawn_agent']);
+function spawnInput(payload) {
+    const name = String(payload?.tool_name || payload?.toolName || payload?.tool?.name || '');
+    if (!SPAWN_TOOLS.has(name))
+        return null;
+    const input = payload?.tool_input || payload?.toolInput || payload?.tool?.input;
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    return { ...input };
+}
+function narutoParent(state) {
+    const mode = String(state?.mode || '').toUpperCase();
+    const route = String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase();
+    return mode === 'NARUTO' || route === 'NARUTO' || state?.subagents_required === true;
+}
+function spawnTask(input) {
+    return [input.message, input.prompt, input.task, input.agent_type, input.agentType]
+        .map((value) => String(value || '').trim())
+        .filter(Boolean)
+        .join('\n')
+        .slice(0, 1200);
+}
+export async function jevSpawnModelRewrite(root, state, payload) {
+    if (!narutoParent(state))
+        return null;
+    const input = spawnInput(payload);
+    if (!input)
+        return null;
+    const agent = String(input.agent_type || input.agentType || '').trim();
+    if (agent) {
+        const preferences = await readRoleModelPreferences().catch(() => null);
+        if (preferences?.store.roles[agent])
+            return null;
+    }
+    const task = spawnTask(input);
+    if (!task)
+        return null;
+    const decision = await consultJevTurnModel({ root, prompt: task, roleId: 'spawn' }).catch(() => null);
+    if (!decision?.model || !decision.effort)
+        return null;
+    if (input.model === decision.model && input.reasoning_effort === decision.effort)
+        return null;
+    return {
+        ...input,
+        model: decision.model,
+        reasoning_effort: decision.effort
+    };
+}

package/dist/core/hooks-runtime.js

@@ -22,6 +22,7 @@ import { codePackFreshnessNote } from './hooks-runtime/code-pack-freshness-prefl
 import { claimHookInvocation } from './hooks-runtime/hook-invocation-dedupe.js';
 import { armLightTurnStopBypass, clearLightTurnStopBypass, consumeLightTurnStopBypass, hasMatchingLightTurnStopBypass } from './hooks-runtime/light-turn.js';
 import { evaluateHookNarutoDecisionGate, looksLikeActiveContinuationPrompt } from './hooks-runtime/naruto-decision-gate.js';
+import { consultJevTurnModel } from './decisions/integration.js';
 import { ensureOfficialSubagentArtifactDirConfined, inspectActiveOfficialSubagentWorkflow, recordOfficialSubagentLifecycleCaptureFailure, officialSubagentArtifactDir, recordAndRefreshSubagentEvidence, refreshOfficialSubagentCompletionArtifacts } from './hooks-runtime/official-subagent-lifecycle.js';
 import { finalizationRepeatDecision } from './hooks-runtime/stop-repeat-guard.js';
 import { armCodexGitActionStopBypass, consumeCodexGitActionStopBypass, consumeLightRouteStop, hasCompletionSummary, hasDfixLightCompletion, hasHonestMode, hasHonestModeUnresolvedGap, honestModeLoopbackBudgetExhausted, recordHonestModeLoopback, recordHonestModeTerminalUnverified, resolveHonestModeLoopback, shouldLoopBackAfterHonestMode, successfulAppNarutoStopNeedsVisibleSummary } from './hooks-runtime/stop-finalization.js';
@@ -29,6 +30,7 @@ import { activeNarutoParentLaunchMissionId, claimStandaloneParentHostCapabilityR
 import { classifyTaskProfile } from './runtime/task-profile.js';
 import { resolveSubagentThreadBudget } from './subagents/thread-budget.js';
 import { readOfficialSubagentConfig } from './subagents/official-subagent-config.js';
+import { jevSpawnModelRewrite } from './hooks-runtime/jev-spawn-routing.js';
 import { subagentSpawnPolicyBlockReason } from './hooks-runtime/subagent-spawn-policy.js';
 import { withFileLock } from './locks/file-lock.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from './managed-path-safety.js';
@@ -120,7 +122,8 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
     const withNarutoDecision = (result) => ({ ...result, sksNarutoDecision });
     if (name === 'user-prompt-submit') {
         const result = await hookUserPrompt(root, state, payload, noQuestion, sessionKey);
-        const withSkillContext = await attachAuthoritativeSksSkillContext(root, state, payload, result);
+        const withJev = await attachJevTurnRouting(root, payload, result);
+        const withSkillContext = await attachAuthoritativeSksSkillContext(root, state, payload, withJev);
         return withNarutoDecision(attachOfficialSubagentSpawnCompatibilityContext(state, payload, withSkillContext));
     }
     if (name === 'session-start' || name === 'pre-compact' || name === 'post-compact') {
@@ -233,6 +236,28 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
     const additionalContext = [coreEngineeringDirectiveReferenceText(), resourceGuard, routingContext, active, skillContext].filter(Boolean).join('\n\n');
     return { continue: true, additionalContext, ...(skillBlockers.length ? { silent: true } : {}) };
 }
+async function attachJevTurnRouting(root, payload, result) {
+    if (!result || result.decision === 'block')
+        return result;
+    const prompt = stripVisibleDecisionAnswerBlocks(extractUserPrompt(payload));
+    if (!String(prompt || '').trim())
+        return result;
+    const decision = await consultJevTurnModel({ root, prompt }).catch(() => null);
+    if (!decision?.called)
+        return result;
+    const line = decision.model
+        ? `Jev sealed this turn to ${decision.model}. Use that sealed model and do not reclassify it.`
+        : '';
+    if (!line)
+        return { ...result, jev_turn: decision };
+    const additionalContext = [result.additionalContext, line].filter(Boolean).join('\n\n');
+    return {
+        ...result,
+        additionalContext,
+        jev_turn: decision,
+        ...(result.systemMessage ? { systemMessage: visibleHookMessage('user-prompt-submit', additionalContext) } : {})
+    };
+}
 async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = null) {
     await clearLightTurnStopBypass(root, { sessionKey }).catch(() => undefined);
     const submittedPrompt = stripVisibleDecisionAnswerBlocks(extractUserPrompt(payload));
@@ -572,7 +597,11 @@ async function consumeActiveOfficialWorkflowQueue(root, missionId, workflowRunId
     }
 }
 async function hookPreTool(root, state, payload, noQuestion, sessionKey = null) {
-    const spawnPolicyBlock = subagentSpawnPolicyBlockReason(payload);
+    const jevSpawnInput = await jevSpawnModelRewrite(root, state, payload).catch(() => null);
+    const spawnPayload = jevSpawnInput
+        ? { ...payload, tool_input: jevSpawnInput, toolInput: jevSpawnInput }
+        : payload;
+    const spawnPolicyBlock = subagentSpawnPolicyBlockReason(spawnPayload);
     if (spawnPolicyBlock)
         return { decision: 'block', permissionDecision: 'deny', reason: spawnPolicyBlock };
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
@@ -641,15 +670,20 @@ async function hookPreTool(root, state, payload, noQuestion, sessionKey = null)
     const waveGuidance = await parentWaveGuidanceContext(root, state, sessionKey).catch(() => '');
     const additionalContext = [skillRefresh.context, waveGuidance].filter(Boolean).join('\n\n');
     if (additionalContext) {
-        return {
+        return withJevSpawnRewrite({
             continue: true,
             additionalContext,
             ...(waveGuidance
                 ? { systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.') }
                 : { silent: true })
-        };
+        }, jevSpawnInput);
     }
-    return { continue: true };
+    return withJevSpawnRewrite({ continue: true }, jevSpawnInput);
+}
+function withJevSpawnRewrite(result, updatedInput) {
+    if (!updatedInput || result?.decision === 'block' || result?.permissionDecision === 'deny')
+        return result;
+    return { ...result, permissionDecision: 'allow', updatedInput };
 }
 async function parentWaveGuidanceContext(root, state = {}, sessionKey = null) {
     if (!state?.mission_id && !state?.official_subagent_run_id)

package/dist/core/routes.js

@@ -1211,6 +1211,9 @@ export function narutoDecisionForRoute(route, prompt = '', profile = classifyTas
         return narutoRouteDecision('none', routeId, profile, `task_profile_${profile}_bypass`, true);
     }
     if (profile === 'bounded-work') {
+        if (routeId === 'Naruto') {
+            return narutoRouteDecision('generic_naruto', routeId, profile, 'naruto_parent_orchestrates', false);
+        }
         return narutoRouteDecision('none', routeId, profile, 'task_profile_bounded_work_parent_owned', false);
     }
     if (profile === 'parallel-read' || profile === 'parallel-write' || profile === 'high-risk') {

package/dist/core/subagents/official-subagent-preparation.js

@@ -461,6 +461,12 @@ function applyOfficialSubagentDecision(derived, decided) {
         : { ...derived.fanoutPolicy };
     if (selectedRouting)
         fanoutPolicy = { ...fanoutPolicy, jev_selected_routing: selectedRouting.id };
+    const omitted = new Set(decided.omittedRoutingRoles || []);
+    if (omitted.size)
+        fanoutPolicy = { ...fanoutPolicy, jev_omitted_roles: [...omitted] };
+    const recommendedAgents = omitted.size > 0 && derived.suggestedAgents.some((name) => !omitted.has(name))
+        ? derived.suggestedAgents.filter((name) => !omitted.has(name))
+        : derived.suggestedAgents;
     const routingPreferences = selectedRouting
         ? Object.fromEntries(Object.entries(selectedRouting.efforts)
             .filter(([name]) => !derived.roleModelPreferences.store.roles[name])
@@ -483,7 +489,7 @@ function applyOfficialSubagentDecision(derived, decided) {
         waveCount: budget.waveCount,
         capacity: budget.capacity,
         triwikiAttention: attention,
-        recommendedAgents: derived.suggestedAgents,
+        recommendedAgents,
         roleModelPreferences: {
             ...derived.roleModelPreferences.store.roles,
             ...routingPreferences
@@ -519,6 +525,7 @@ function applyOfficialSubagentDecision(derived, decided) {
         }),
         triwiki_attention: attention,
         agents,
+        suggested_agents: recommendedAgents,
         fanout_policy: fanoutPolicy,
         capacity_controller: budget.capacity,
         jev_decision: decided.receipt,

package/dist/core/subagents/official-subagent-prompt.js

@@ -53,6 +53,8 @@ export function buildOfficialSubagentPrompt(input) {
     const spawnModelRouting = renderSpawnModelRouting(narutoChildren);
     const childModelRules = narutoChildren
         ? [
+            '- the parent orchestrates only: decompose the goal, assign disjoint slices, spawn children, and integrate their results',
+            '- do not implement the assigned slice work in the parent thread',
             '- use the model and reasoning_effort named in each slice spawn contract',
             '- sealed child models are gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, and gpt-6-astra',
             '- keep a stored user role-model preference for that role'

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.3.0';
+export const PACKAGE_VERSION = '10.3.2';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.3.0",
+  "version": "10.3.2",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",