sneakoscope 10.3.1 → 10.3.3

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.1**. Install the latest stable release from npm.
+Current package: **SKS 10.3.3**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 

package/config/skills-hash-ledger.v1.json

@@ -324,6 +324,7 @@
     {
       "canonical_name": "sks-naruto",
       "trusted_sha256": [
+        "65e19a5d16f486b13541048c239e828f8039bfc6e38bafd7949d9c936fe4b5b2",
         "da43debf97f0b4a1583d8202a7306aca97ac97865accf9bca8f41d75c84a1cb9",
         "b981bea4183376c6c0204941ad6c2e78782e2cdea4f8d25cc85630c609faaf95",
         "5df9c9678eb68fd79ceb998ae7a52dd54dc92336ad5169e8a01acca89f76bd60",
@@ -372,6 +373,7 @@
     {
       "canonical_name": "sks-prompt-pipeline",
       "trusted_sha256": [
+        "93fd938dccd65d9b4d1dd140b60e1baedc627e7fcc54f9afd95eb2e44efd1143",
         "033bb114ec1fac3f8c312f698b1861ed4c2ce6f65c06f4f1a872c4b101b74b92",
         "e7c8ef56d38fdc4879c983f7d6706f26fc1cf0a60c508836bd628e815700bcc3",
         "480c8afffafa9d52c483a963b4b8fafdffc0a47cd6d2efd3fb6d7924c11832c5",
@@ -388,6 +390,7 @@
     {
       "canonical_name": "sks-reasoning-router",
       "trusted_sha256": [
+        "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
         "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
         "647f730520a1c7dc89c2642f5b8502624c65a861ae41aecf1fb137db40fd0611",
         "da0ddb58adc68ddeebdb9c45bf111c26eaa64d3e9dffe1dd39d7f30b943b8b88",

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.1"
+version = "10.3.3"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.1"
+version = "10.3.3"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.1",
+  "package_version": "10.3.3",
   "skills": [
     {
       "canonical_name": "sks",
@@ -393,8 +393,9 @@
     {
       "canonical_name": "sks-naruto",
       "type": "core",
-      "content_sha256": "da43debf97f0b4a1583d8202a7306aca97ac97865accf9bca8f41d75c84a1cb9",
+      "content_sha256": "65e19a5d16f486b13541048c239e828f8039bfc6e38bafd7949d9c936fe4b5b2",
       "hash_history": [
+        "da43debf97f0b4a1583d8202a7306aca97ac97865accf9bca8f41d75c84a1cb9",
         "b981bea4183376c6c0204941ad6c2e78782e2cdea4f8d25cc85630c609faaf95",
         "5df9c9678eb68fd79ceb998ae7a52dd54dc92336ad5169e8a01acca89f76bd60",
         "a1219f6dbad9c8c185953125ef0b8dccf081aa01efb8e8acaa543c6214ac049c",
@@ -451,8 +452,9 @@
     {
       "canonical_name": "sks-prompt-pipeline",
       "type": "official",
-      "content_sha256": "033bb114ec1fac3f8c312f698b1861ed4c2ce6f65c06f4f1a872c4b101b74b92",
+      "content_sha256": "93fd938dccd65d9b4d1dd140b60e1baedc627e7fcc54f9afd95eb2e44efd1143",
       "hash_history": [
+        "033bb114ec1fac3f8c312f698b1861ed4c2ce6f65c06f4f1a872c4b101b74b92",
         "e7c8ef56d38fdc4879c983f7d6706f26fc1cf0a60c508836bd628e815700bcc3",
         "480c8afffafa9d52c483a963b4b8fafdffc0a47cd6d2efd3fb6d7924c11832c5",
         "5dc8524de9bad66cef133ea5ff2a8052331bd12a7ec85695f727d0d2c8523145"
@@ -471,8 +473,9 @@
     {
       "canonical_name": "sks-reasoning-router",
       "type": "official",
-      "content_sha256": "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
+      "content_sha256": "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
       "hash_history": [
+        "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
         "647f730520a1c7dc89c2642f5b8502624c65a861ae41aecf1fb137db40fd0611",
         "da0ddb58adc68ddeebdb9c45bf111c26eaa64d3e9dffe1dd39d7f30b943b8b88",
         "1595beabf2d31397217311fa1323bd62c801cf6c87db9029ff544c457efec8bb",

package/dist/core/codex-hooks/codex-hook-managed-install.js

@@ -1,5 +1,7 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
-import { ensureDir, nowIso, readText, writeTextAtomic } from '../fsx.js';
+import { ensureDir, nowIso, packageRoot, readText, writeTextAtomic } from '../fsx.js';
 import { CODEX_HOOK_EVENTS } from '../codex-compat/codex-hook-events.js';
 import { postToolEvidenceEnabled } from '../verification-profile.js';
 import { buildCodexCommandHookToml, matcherApplies } from './codex-hook-config-writer.js';
@@ -22,7 +24,7 @@ export async function installManagedCodexHooks(root, opts = {}) {
     const requirementsPath = path.resolve(root, opts.requirementsPath || path.join('.codex', 'requirements.toml'));
     const scriptPath = path.join(managedDir, 'sks-managed-hook.sh');
     const tomlPath = path.join(managedDir, 'sks-managed-hooks.toml');
-    const binCommand = opts.binCommand || 'sks hook';
+    const binCommand = opts.binCommand || await defaultManagedHookCommand();
     const installedEvents = CODEX_HOOK_EVENTS.filter((event) => event !== 'PostToolUse' || postToolEvidenceEnabled(root));
     const hooksToml = installedEvents.map((event) => buildCodexCommandHookToml({
         event,
@@ -77,6 +79,32 @@ export async function installManagedCodexHooks(root, opts = {}) {
         blockers: actual?.blockers || []
     };
 }
+export async function defaultManagedHookCommand() {
+    const entrypoint = path.join(packageRoot(), 'dist', 'bin', 'sks.js');
+    if (!(await isRegularFile(entrypoint)))
+        return 'sks hook';
+    return `${shellQuote(process.execPath)} ${shellQuote(entrypoint)} hook`;
+}
+export async function retargetLiveManagedHookScript(env = process.env) {
+    const home = env.HOME || os.homedir();
+    const codexHome = path.resolve(env.CODEX_HOME || path.join(home, '.codex'));
+    const requirementsPath = path.join(codexHome, 'requirements.toml');
+    const requirements = await readText(requirementsPath, '');
+    const configuredDir = managedDirFromRequirements(String(requirements || ''), requirementsPath);
+    const managedDir = configuredDir || path.join(codexHome, 'managed-hooks');
+    const resolvedDir = path.resolve(managedDir);
+    const script = path.join(resolvedDir, 'sks-managed-hook.sh');
+    if (!pathIsInside(codexHome, script)) {
+        return { ok: false, status: 'absent', script, command: null };
+    }
+    if (!(await isRegularFile(script))) {
+        return { ok: true, status: 'absent', script, command: null };
+    }
+    const command = await defaultManagedHookCommand();
+    await writeTextAtomic(script, managedHookScript(command));
+    await chmodExecutable(script);
+    return { ok: true, status: 'rewritten', script, command };
+}
 function managedHookScript(binCommand) {
     return [
         '#!/usr/bin/env sh',
@@ -86,6 +114,32 @@ function managedHookScript(binCommand) {
         `exec ${binCommand} "$subcommand" "$@"`
     ].join('\n') + '\n';
 }
+function shellQuote(value) {
+    if (/[\0\r\n]/.test(value))
+        throw new Error('hook_command_path_invalid');
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function managedDirFromRequirements(text, requirementsPath) {
+    const match = text.match(/^\s*managed_dir\s*=\s*(.+)\s*$/m);
+    if (!match?.[1])
+        return null;
+    const raw = match[1].trim().replace(/^['"]|['"]$/g, '');
+    if (!raw || raw.includes('\0'))
+        return null;
+    return path.resolve(path.dirname(requirementsPath), raw);
+}
+function pathIsInside(root, target) {
+    const relative = path.relative(path.resolve(root), path.resolve(target));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+async function isRegularFile(file) {
+    try {
+        return (await fs.stat(file)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 function mergeRequirementsToml(existing, opts) {
     const withoutManagedOnly = String(existing || '')
         .replace(/^\s*allow_managed_hooks_only\s*=.*$/gm, '')

package/dist/core/codex-native/core-skill-manifest.js

@@ -16,7 +16,7 @@ const CORE_SKILL_DEFINITIONS = [
         purpose: 'run a Codex official subagent workflow with official agent threads while parent integration remains owner.',
         discovery: 'Run $sks-naruto for explicit parallel official subagents.',
         when: 'Use when the user explicitly invokes $Naruto or the selected route requires bounded parallel delegation.',
-        workflow: 'Run sks naruto run "<task>" [--agents N] [--max-threads N] [--json] with Codex official subagent threads only. The parent owns decomposition, per-wave capacity, later root-owned waves, integration, and final verification. Automatic targets begin at 4/6/8/16 by task size: bounded, explicit parallel, large-scale, then mass mechanical or exploration fan-out on the Astra Low/Astra Medium lanes. After decomposition both lanes may expand to the SKS-owned 256-child ceiling when independent useful slices and real host capacity remain positive; max_threads defaults to a 256-child frame budget cap, never a target. A measured lower Codex host cap or explicit provider/API budget remains authoritative, and multi-wave scheduling reuses returned capacity. Use gpt-6-astra for every child, preserving parent settings and ignoring child-model overrides. Route tiny mechanical and mass shards to Astra Low, broad search and exploration shards to Astra Medium, instructed ordinary coding execution to Astra Low, and planning, analysis, review, or other judgment to Astra Max. Keep the four task-class profiles and compatibility IDs; explicit Astra effort preferences, including High, remain supported; max_depth=1 blocks nested delegation. Wait for every planned thread before final. In an active Codex App Naruto mission, commit the strict parent evidence with sks naruto parent-summary --mission <id> --stdin, then return localized Markdown without exposing the JSON.',
+        workflow: 'Run sks naruto run "<task>" [--agents N] [--max-threads N] [--json] with Codex official subagent threads only. The parent orchestrates only: decompose, assign disjoint slices, spawn, integrate, and verify. Do not implement slice work in the parent thread. The parent owns decomposition, per-wave capacity, later root-owned waves, integration, and final verification. Automatic targets begin at 4/6/8/16 by task size: bounded, explicit parallel, large-scale, then mass mechanical or exploration fan-out. After decomposition both lanes may expand to the SKS-owned 256-child ceiling when independent useful slices and real host capacity remain positive; max_threads defaults to a 256-child frame budget cap, never a target. A measured lower Codex host cap or explicit provider/API budget remains authoritative, and multi-wave scheduling reuses returned capacity. When Jev mode is on, each new child spawn is sealed by Jev to gpt-5.6-luna low, gpt-5.6-sol low, gpt-5.6-terra medium, or gpt-6-astra max; a user role preference stays authoritative, and off mode keeps gpt-6-astra. Do not choose the child model yourself while Jev mode is on. Keep the four task-class profiles and compatibility IDs; explicit Astra effort preferences, including High, remain supported when Jev mode is off or the user asked for that effort; max_depth=1 blocks nested delegation. Wait for every planned thread before final. In an active Codex App Naruto mission, commit the strict parent evidence with sks naruto parent-summary --mission <id> --stdin, then return localized Markdown without exposing the JSON.',
         safety: 'Preserve user-authored content, inherit the parent permission mode, do not spawn nested subagents, do not inject the full pack or the full TriWiki context into every child, and do not fall back to another model, process runtime, custom scheduler, or worker pool. The historical Naruto process runtime is removed; stop with explicit blocker evidence when the official path is unavailable.',
         cli: 'sks naruto run "<task>" [--agents N] [--max-threads N] [--json]; sks naruto status|subagents|proof [--mission <id>] [--json]; sks naruto parent-summary --mission <id> --stdin [--json]',
         evidence: 'subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, subagent-evidence.json, naruto-summary.json, and naruto-gate.json.',

package/dist/core/decisions/integration.js

@@ -8,7 +8,7 @@ import { applyRecoveryEffect, listProductionRecoveryCandidates } from './recover
 import { assembleRoutingSelection, buildRoutingCandidates } from './routing.js';
 import { buildDecisionReceipt } from './receipt.js';
 import { applyOptionalContextSelection, graphFileDigest, hydrateContextCandidates, sourceSnapshotDigest } from './state.js';
-import { DESIGN_DEFAULTS, POLICY_REVISION, UNKNOWN_USAGE } from './types.js';
+import { DESIGN_DEFAULTS, POLICY_REVISION, UNKNOWN_USAGE, sealedRoutingModel } from './types.js';
 let testOverrides = null;
 const appliedEffects = new Set();
 export function setDecisionTestOverrides(overrides) {
@@ -101,6 +101,7 @@ async function decideOfficialSubagentPreparationInner(input, started) {
             selectedPlan: null,
             selectedRouting: null,
             selectedContextIds: null,
+            omittedRoutingRoles: [],
             consumptionEvidence: null
         };
     const receipt = buildDecisionReceipt({
@@ -122,6 +123,7 @@ async function decideOfficialSubagentPreparationInner(input, started) {
         selectedPlan: applied.selectedPlan,
         selectedRouting: applied.selectedRouting,
         selectedContextIds: applied.selectedContextIds,
+        omittedRoutingRoles: applied.omittedRoutingRoles,
         llmRejudgeCalls: 0,
         bundle
     };
@@ -132,22 +134,24 @@ export async function consultJevTurnModel(input) {
     const overrides = activeOverrides();
     const env = input.env || process.env;
     const config = overrides?.config ?? await readDecisionConfig(env);
+    const none = (reason) => ({ called: false, model: null, effort: null, reason });
     if (!jevEnabled(config))
-        return { called: false, model: null, reason: 'off' };
+        return none('off');
     const resolved = await resolveOpenRouterApiKey({ env });
     if (!resolved.key)
-        return { called: false, model: null, reason: 'missing_key' };
+        return none('missing_key');
     const prompt = String(input.prompt || '').trim();
     if (!prompt)
-        return { called: false, model: null, reason: 'empty_prompt' };
+        return none('empty_prompt');
+    const roleId = input.roleId === 'spawn' ? 'spawn' : 'turn';
     const bundle = buildDecisionBundle({
         projectId: sha256(input.root).slice(0, 32),
-        workflowRunId: 'turn',
-        workflowRevision: 'turn',
-        sourceDigest: 'turn',
+        workflowRunId: roleId,
+        workflowRevision: roleId,
+        sourceDigest: roleId,
         graphDigest: null,
         goal: prompt,
-        routingCandidates: [{ id: 'turn', summary: prompt.slice(0, 240) }]
+        routingCandidates: [{ id: roleId, summary: prompt.slice(0, 240) }]
     });
     const transport = await requestOpenRouterDecision(bundle, {
         env,
@@ -155,13 +159,14 @@ export async function consultJevTurnModel(input) {
         ...(overrides?.fetchImpl ? { fetchImpl: overrides.fetchImpl } : {})
     });
     if (!transport.ok)
-        return { called: true, model: null, reason: transport.reason };
+        return { called: true, model: null, effort: null, reason: transport.reason };
     const compiled = compileDecision(bundle, transport.response);
     if (compiled.kind !== 'apply')
-        return { called: true, model: null, reason: compiled.reason };
+        return { called: true, model: null, effort: null, reason: compiled.reason };
     const selected = assembleRoutingSelection(compiled.effects.flatMap((effect) => (effect.kind === 'select_routing' ? [{ roleId: effect.roleId, model: effect.model }] : [])));
-    const model = selected?.models.turn || null;
-    return { called: true, model, reason: model ? 'applied' : 'keep_baseline' };
+    const model = selected?.models[roleId] || null;
+    const sealed = model ? sealedRoutingModel(model) : null;
+    return { called: true, model: sealed?.id || null, effort: sealed?.effort || null, reason: sealed ? 'applied' : 'keep_baseline' };
 }
 export function effectAlreadyConsumed(identity) {
     return appliedEffects.has(identity);
@@ -192,6 +197,7 @@ function applyEffects(attention, contextCandidates, planCandidates, compiled) {
     let selectedContextIds = null;
     const evidence = [];
     const routingEffects = [];
+    const omittedRoutingRoles = [];
     for (const effect of compiled.effects) {
         if (effect.kind === 'select_optional_context') {
             nextAttention = applyOptionalContextSelection(attention, contextCandidates, effect.keepIds);
@@ -206,6 +212,10 @@ function applyEffects(attention, contextCandidates, planCandidates, compiled) {
         if (effect.kind === 'select_routing') {
             routingEffects.push({ roleId: effect.roleId, model: effect.model });
         }
+        if (effect.kind === 'omit_role') {
+            omittedRoutingRoles.push(effect.roleId);
+            evidence.push(`omit:${effect.roleId}`);
+        }
     }
     const selectedRouting = assembleRoutingSelection(routingEffects);
     if (selectedRouting) {
@@ -216,6 +226,7 @@ function applyEffects(attention, contextCandidates, planCandidates, compiled) {
         selectedPlan,
         selectedRouting,
         selectedContextIds,
+        omittedRoutingRoles,
         consumptionEvidence: evidence.length ? evidence.join('|') : null
     };
 }
@@ -291,6 +302,7 @@ function keep(input, reason, started) {
         selectedPlan: null,
         selectedRouting: null,
         selectedContextIds: null,
+        omittedRoutingRoles: [],
         llmRejudgeCalls: 0,
         bundle: null
     };

package/dist/core/decisions/policy.js

@@ -1,4 +1,4 @@
-import { CHOICE_MIN_CONFIDENCE, CHOICE_MIN_PROBABILITY, CONTEXT_DROP_NOUL_MAX, DISTRIBUTION_SUM_TOLERANCE, KEEP_BASELINE_CHOICE, NEEDS_EVIDENCE_CHOICE, POLICY_REVISION, ROUTING_RISK_NOUL_MIN, UNKNOWN_USAGE, sealedRoutingModel } from './types.js';
+import { CHOICE_MIN_CONFIDENCE, CHOICE_MIN_PROBABILITY, CONTEXT_DROP_NOUL_MAX, DISTRIBUTION_SUM_TOLERANCE, KEEP_BASELINE_CHOICE, NEEDS_EVIDENCE_CHOICE, POLICY_REVISION, ROUTING_RISK_NOUL_MIN, ROUTING_ROLE_OMIT_NOUL_MAX, UNKNOWN_USAGE, sealedRoutingModel } from './types.js';
 export function compileDecision(bundle, response) {
     const usage = usageFromWire(response.usage);
     const decoded = decodeWireResponse(bundle, response);
@@ -151,6 +151,16 @@ function compileRouting(bundle, answers) {
         else if (!reason)
             reason = compiled.reason;
     }
+    for (const [questionId, binding] of Object.entries(bundle.questionBindings)) {
+        if (binding.kind !== 'routing_needed')
+            continue;
+        const answer = answers[questionId];
+        if (!answer || answer.type !== 'noul')
+            continue;
+        if (answer.noul <= ROUTING_ROLE_OMIT_NOUL_MAX) {
+            effects.push({ kind: 'omit_role', roleId: binding.roleId });
+        }
+    }
     return { effects, reason };
 }
 function compileRoleRouting(bundle, answers, roleId) {

package/dist/core/decisions/questions.js

@@ -210,6 +210,20 @@ function appendRoutingSpeculation(roles, questions, bindings, recoverySlot) {
             }
         };
         bindings[riskId] = { kind: 'routing_risk', roleId: role.id };
+        if (questionRoom(questions, recoverySlot) < 1)
+            break;
+        const neededId = `needed_${role.id}`;
+        const neededInstructions = redactDecisionText(`Does state.task require routing.roles.${role.id} as its own child agent? Omit the role when another listed role already covers the work.`);
+        assertIndependentQuestion(neededInstructions);
+        questions[neededId] = {
+            type: 'noul',
+            instructions: neededInstructions,
+            criteria: {
+                true: 'This role must be spawned to finish the task.',
+                false: 'This role is unnecessary. The parent should not spawn it.'
+            }
+        };
+        bindings[neededId] = { kind: 'routing_needed', roleId: role.id };
     }
 }
 export { QUESTION_REVISION };

package/dist/core/decisions/types.js

@@ -27,6 +27,7 @@ export const ROUTING_DIFFICULTY_RUBRIC = Object.freeze([
     'Judgment, architecture, ambiguity, security, or other high-stakes work.'
 ]);
 export const ROUTING_RISK_NOUL_MIN = 0.70;
+export const ROUTING_ROLE_OMIT_NOUL_MAX = 0.35;
 export function sealedRoutingModel(model) {
     const match = SEALED_ROUTING_MODELS.find((row) => row.id === model);
     return match ? { id: match.id, effort: match.effort } : null;

package/dist/core/hooks-runtime/hook-io.js

@@ -1,6 +1,6 @@
 import { IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
 import { readStdin } from '../fsx.js';
-import { buildCompactContinue, buildPermissionRequestAllow, buildPermissionRequestDeny, buildPostToolUseBlock, buildPostToolUseContinue, buildPreToolUseContinue, buildPreToolUseDeny, buildSessionStartContinue, buildStopBlock, buildStopContinue, buildSubagentStartContinue, buildSubagentStopBlock, buildSubagentStopContinue, buildUserPromptSubmitBlock, buildUserPromptSubmitContinue } from '../codex-compat/codex-hook-output-builders.js';
+import { buildCompactContinue, buildPermissionRequestAllow, buildPermissionRequestDeny, buildPostToolUseBlock, buildPostToolUseContinue, buildPreToolUseAllowRewrite, buildPreToolUseContinue, buildPreToolUseDeny, buildSessionStartContinue, buildStopBlock, buildStopContinue, buildSubagentStartContinue, buildSubagentStopBlock, buildSubagentStopContinue, buildUserPromptSubmitBlock, buildUserPromptSubmitContinue } from '../codex-compat/codex-hook-output-builders.js';
 export async function loadHookPayload() {
     const raw = await readStdin();
     try {
@@ -33,6 +33,8 @@ export function normalizeHookResult(name, result = {}) {
         if (out.decision === 'block' || out.permissionDecision === 'deny' || out.decision === 'deny') {
             return buildPreToolUseDeny(reason, { systemMessage });
         }
+        if (out.updatedInput)
+            return buildPreToolUseAllowRewrite(out.updatedInput, { systemMessage });
         return buildPreToolUseContinue({ additionalContext: out.additionalContext, systemMessage });
     }
     if (eventName === 'PermissionRequest') {

package/dist/core/hooks-runtime/jev-spawn-routing.js

@@ -0,0 +1,50 @@
+import { consultJevTurnModel } from '../decisions/integration.js';
+import { readRoleModelPreferences } from '../subagents/role-model-preferences.js';
+const SPAWN_TOOLS = new Set(['spawn_agent', 'collaboration.spawn_agent', 'functions.spawn_agent']);
+function spawnInput(payload) {
+    const name = String(payload?.tool_name || payload?.toolName || payload?.tool?.name || '');
+    if (!SPAWN_TOOLS.has(name))
+        return null;
+    const input = payload?.tool_input || payload?.toolInput || payload?.tool?.input;
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    return { ...input };
+}
+function narutoParent(state) {
+    const mode = String(state?.mode || '').toUpperCase();
+    const route = String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase();
+    return mode === 'NARUTO' || route === 'NARUTO' || state?.subagents_required === true;
+}
+function spawnTask(input) {
+    return [input.message, input.prompt, input.task, input.agent_type, input.agentType]
+        .map((value) => String(value || '').trim())
+        .filter(Boolean)
+        .join('\n')
+        .slice(0, 1200);
+}
+export async function jevSpawnModelRewrite(root, state, payload) {
+    if (!narutoParent(state))
+        return null;
+    const input = spawnInput(payload);
+    if (!input)
+        return null;
+    const agent = String(input.agent_type || input.agentType || '').trim();
+    if (agent) {
+        const preferences = await readRoleModelPreferences().catch(() => null);
+        if (preferences?.store.roles[agent])
+            return null;
+    }
+    const task = spawnTask(input);
+    if (!task)
+        return null;
+    const decision = await consultJevTurnModel({ root, prompt: task, roleId: 'spawn' }).catch(() => null);
+    if (!decision?.model || !decision.effort)
+        return null;
+    if (input.model === decision.model && input.reasoning_effort === decision.effort)
+        return null;
+    return {
+        ...input,
+        model: decision.model,
+        reasoning_effort: decision.effort
+    };
+}

package/dist/core/hooks-runtime.js

@@ -30,6 +30,7 @@ import { activeNarutoParentLaunchMissionId, claimStandaloneParentHostCapabilityR
 import { classifyTaskProfile } from './runtime/task-profile.js';
 import { resolveSubagentThreadBudget } from './subagents/thread-budget.js';
 import { readOfficialSubagentConfig } from './subagents/official-subagent-config.js';
+import { jevSpawnModelRewrite } from './hooks-runtime/jev-spawn-routing.js';
 import { subagentSpawnPolicyBlockReason } from './hooks-runtime/subagent-spawn-policy.js';
 import { withFileLock } from './locks/file-lock.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from './managed-path-safety.js';
@@ -596,7 +597,11 @@ async function consumeActiveOfficialWorkflowQueue(root, missionId, workflowRunId
     }
 }
 async function hookPreTool(root, state, payload, noQuestion, sessionKey = null) {
-    const spawnPolicyBlock = subagentSpawnPolicyBlockReason(payload);
+    const jevSpawnInput = await jevSpawnModelRewrite(root, state, payload).catch(() => null);
+    const spawnPayload = jevSpawnInput
+        ? { ...payload, tool_input: jevSpawnInput, toolInput: jevSpawnInput }
+        : payload;
+    const spawnPolicyBlock = subagentSpawnPolicyBlockReason(spawnPayload);
     if (spawnPolicyBlock)
         return { decision: 'block', permissionDecision: 'deny', reason: spawnPolicyBlock };
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
@@ -665,15 +670,20 @@ async function hookPreTool(root, state, payload, noQuestion, sessionKey = null)
     const waveGuidance = await parentWaveGuidanceContext(root, state, sessionKey).catch(() => '');
     const additionalContext = [skillRefresh.context, waveGuidance].filter(Boolean).join('\n\n');
     if (additionalContext) {
-        return {
+        return withJevSpawnRewrite({
             continue: true,
             additionalContext,
             ...(waveGuidance
                 ? { systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.') }
                 : { silent: true })
-        };
+        }, jevSpawnInput);
     }
-    return { continue: true };
+    return withJevSpawnRewrite({ continue: true }, jevSpawnInput);
+}
+function withJevSpawnRewrite(result, updatedInput) {
+    if (!updatedInput || result?.decision === 'block' || result?.permissionDecision === 'deny')
+        return result;
+    return { ...result, permissionDecision: 'allow', updatedInput };
 }
 async function parentWaveGuidanceContext(root, state = {}, sessionKey = null) {
     if (!state?.mission_id && !state?.official_subagent_run_id)

package/dist/core/init/skills.js

@@ -65,9 +65,9 @@ async function installOfficialSkills(root) {
         'mad-sks': `---\nname: mad-sks\ndescription: Use $sks-mad-sks only for explicit high-risk SQL or grants.\n---\n\nUse only when the user explicitly invokes $MAD-SKS, top-level sks --mad, or \`sks mad-sks plan|run|apply|sql|apply-migration|status|close|rollback-apply\`. MAD-SKS is the single high-risk route for scoped permission widening and bound SQL-plane execution. It can be combined with another route, such as $MAD-SKS $Naruto or $DB ... $MAD-SKS; in that case the other command remains the primary workflow and MAD-SKS is the temporary permission grant or SQL-plane executor. The widened permission applies only while the active mission gate is open, must be deactivated when the task ends, and can open approved scopes such as target-project file writes, shell commands, package installs, local service control, network operations, browser/Computer Use workflows, generated assets, file permissions, migrations, Supabase MCP database writes, column/schema cleanup, direct execute SQL, and normal targeted DB writes.\n\nSQL-plane policy:\n${canonicalMadSksSqlPlanePolicy}\n\nCatastrophic SQL boundary: TRUNCATE, all-row UPDATE/DELETE, table/schema/database DROP, and equivalent reset operations are allowed only through the SQL-plane executor and only when the user's prompt or CLI SQL statement literally names that operation. Other MAD-SKS executors, including db-write, keep those catastrophic categories blocked. Whole database/schema/table removal outside SQL-plane, dangerous project/branch management, credential exfiltration, persistent security weakening, destructive delete without explicit confirmation, and unrequested fallback implementation remain blocked. Do not carry MAD-SKS permission into later prompts or routes. The permission profile source is centralized in src/core/permission-gates.ts and emitted as dist/core/permission-gates.js so skill/hook/MCP-style gates share one decision function.\n`,
         'gx': `---\nname: gx\ndescription: Run $sks-gx to render or validate a GX visual cartridge.\n---\n\nUse when the user invokes $GX/$gx or asks for architecture/context visualization through SKS. Prefer sks gx init, render, validate, drift, and snapshot. vgraph.json remains the source of truth.\n`,
         'help': `---\nname: help\ndescription: Explain installed SKS commands via $sks-help.\n---\n\nUse when the user invokes $Help/$help or asks what commands exist. Prefer concise output from sks commands, sks usage <topic>, sks quickstart, sks aliases, and sks codex-app.\n`,
-        'prompt-pipeline': `---\nname: prompt-pipeline\ndescription: Route an execution request; Answer and DFix stay light.\n---\n\nClassify only the route and the constraints that change execution. Answer handles real information requests; DFix handles tiny copy/config/docs/labels/spacing/translation/mechanical edits; general work stays parent-owned and uses Naruto only for explicit parallel work or concrete independent slices. Preserve the literal user request; TriWiki may enrich it but never replace an explicit requirement. ${coreEngineeringDirectiveReferenceText()} For code work, identify the requested outcome, actual code/data flow, exact write scope, acceptance criteria, and the smallest meaningful verification. Load route-specific Design, PPT, image, browser, research, DB, release, or Context7 rules only when that route or external contract requires them. Materialize pipeline-plan.json with route, scopes, verification, and blockers, then finish the requested work instead of stopping at the plan.\n`,
+        'prompt-pipeline': `---\nname: prompt-pipeline\ndescription: Route an execution request; Answer and DFix stay light.\n---\n\nClassify only the route and the constraints that change execution. Answer handles real information requests; DFix handles tiny copy/config/docs/labels/spacing/translation/mechanical edits. Answer and tiny DFix stay parent-owned. Naruto implementation is parent orchestration: spawn disjoint slices and do not implement them in the parent thread. Preserve the literal user request; TriWiki may enrich it but never replace an explicit requirement. ${coreEngineeringDirectiveReferenceText()} For code work, identify the requested outcome, actual code/data flow, exact write scope, acceptance criteria, and the smallest meaningful verification. Load route-specific Design, PPT, image, browser, research, DB, release, or Context7 rules only when that route or external contract requires them. Materialize pipeline-plan.json with route, scopes, verification, and blockers, then finish the requested work instead of stopping at the plan.\n`,
         [SOLUTION_SCOUT_SKILL_NAME]: `---\nname: ${SOLUTION_SCOUT_SKILL_NAME}\ndescription: Scout external precedent only when the local path needs it.\n---\n\nUse only when the user asks for similar cases or when a package, API, platform, or externally documented behavior makes outside precedent materially useful. Search with the concrete symptom and current stack, prefer primary sources, and keep the local code path authoritative. Do not add this step to ordinary local bugfixes. If external evidence is unavailable, record that gap instead of inventing a workaround.\n`,
-        'reasoning-router': `---\nname: reasoning-router\ndescription: Inspect reasoning hints; keep the user's Codex settings.\n---\n\nUse the active Codex model catalog for supported reasoning efforts. GPT-6 Astra does not support none/minimal; use low when migrating those efforts, and preserve other supported choices. Task hints are advisory: do not override the selected model, effort, or service tier or persist profile changes without a request. Inspect with sks reasoning and sks pipeline status. Every child uses gpt-6-astra independently of the parent model; vary only effort by task.\n`,
+        'reasoning-router': `---\nname: reasoning-router\ndescription: Inspect reasoning hints; keep the user's Codex settings.\n---\n\nUse the active Codex model catalog for supported reasoning efforts. GPT-6 Astra does not support none/minimal; use low when migrating those efforts, and preserve other supported choices. Task hints are advisory: do not override the selected model, effort, or service tier or persist profile changes without a request. Inspect with sks reasoning and sks pipeline status. When Jev mode is on, each new child spawn is sealed by Jev and must not be replaced with a parent-chosen model. Off mode uses gpt-6-astra. A user role preference stays authoritative.\n`,
         'pipeline-runner': `---\nname: pipeline-runner\ndescription: Execute the selected SKS route with bounded evidence.\n---\n\nEvery $ command selects a route. Use current.json, mission artifacts, and pipeline-plan.json as bounded execution state; load only the selected route skill. ${coreEngineeringDirectiveReferenceText()} Codex native /goal is the only persisted goal owner. Use official Codex subagents only when the route requires independent slices, keep parent-owned integration, use bounded TriWiki context, fetch current external docs only when relevant, record real blockers, and finish with a completion summary that states what was verified and what remains. Reflection and Honest Mode sections are strict-profile requirements only.\n`,
         'context7-docs': `---\nname: context7-docs\ndescription: Fetch Context7 docs when an external library contract matters.\n---\n\nWhen an external library, framework, API, MCP, or generated-docs contract matters, resolve-library-id, then query-docs for the resolved id. Legacy get-library-docs evidence is accepted. Prefer sks context7 tools/resolve/docs/evidence and finish only after both evidence stages exist. Check setup with sks context7 check.\n`,
         'super-search': `---\nname: super-search\ndescription: Run $sks-super-search for provider-independent source proof.\n---\n\nUse when the user invokes $Super-Search or asks for provider-independent source proof, X-search collection, or URL acquisition. Prefer \`sks super-search doctor --json\` for readiness and \`sks super-search run "<query>" --mode balanced --json\` for provider-independent source proof; use \`sks super-search x "<query>" --json\` for X-search intent and \`sks super-search fetch "<url>" --json\` for URL acquisition. Context7 is required only when the query depends on current package/API/framework/MCP/generated documentation behavior. Provider-specific credentials are optional and must not be required for route readiness. Evidence/artifacts remain under \`.sneakoscope/missions/<super-search-* or route mission>/super-search/\`: intent.json, axes.json, query-variants.json, provider-plan.json, source-ledger.json, lead-ledger.json, claim-ledger.json, attempt-ledger.json, synthesis.md, super-search-proof.json, super-search-gate.json, and super-search-result.json. Do not turn weak discovery into supported claims; finish with an Honest Mode summary of verified sources, blockers, and unverified external coverage.\n`,

package/dist/core/init.js

@@ -274,11 +274,11 @@ const AGENTS_BLOCK = [
     '## Execution',
     '',
     '- Codex native `/goal` is the only persisted goal owner. Goal objectives must state the outcome, scope, constraints, verification, done-when conditions, stop conditions, and non-goals.',
-    '- General work stays parent-owned. Use `$Naruto` for explicitly requested parallel work or concrete independent slices that benefit from delegation; Answer and tiny DFix work stay lightweight.',
-    '- The parent owns decomposition, integration, verification, and the final answer. Delegate only independent slices with disjoint write scopes, reuse capacity across root-owned waves, and never nest subagents.',
-    '- Use gpt-6-astra for every subagent; vary reasoning effort by the slice: Astra Low for tiny mechanical work and instructed ordinary coding execution, Astra Medium for read-heavy context or direct tool operation, and Astra Max for planning, analysis, review, risk, or other focused judgment. Explicit Astra effort preferences, including High, remain supported.',
-    '- Preserve the user-selected parent model, reasoning effort, and service tier. SKS-launched Naruto defaults to GPT-6 Astra; parent settings and role preferences never override the sealed Astra child profiles.',
-    '- SKS child spawns must explicitly set model="gpt-6-astra" and the role reasoning effort with `fork_turns="none"` or a positive bounded turn count; carry the complete bounded slice contract in `message`. Never use full-history inheritance for children.',
+    '- Answer, Help, Goal, and tiny DFix stay parent-owned. Naruto implementation is parent orchestration only: decompose, assign disjoint slices, spawn, integrate, and verify. Do not implement those slices in the parent thread.',
+    '- The parent owns decomposition, integration, verification, and the final answer. Delegate implementation slices with disjoint write scopes, reuse capacity across root-owned waves, and never nest subagents.',
+    '- When Jev mode is on, each new Naruto child spawn is sealed by Jev to gpt-5.6-luna low, gpt-5.6-sol low, gpt-5.6-terra medium, or gpt-6-astra max. A user role preference stays authoritative. Off mode keeps gpt-6-astra. Do not pick a child model yourself while Jev mode is on.',
+    '- Preserve the user-selected parent model, reasoning effort, and service tier. Parent settings stay on the parent thread. A role preference wins over the Jev seal for that role.',
+    '- SKS child spawns must pass the sealed model and reasoning effort with `fork_turns="none"` or a positive bounded turn count; carry the complete bounded slice contract in `message`. Never use full-history inheritance for children. Full-history forks (`fork_turns="all"`, including the omitted default) inherit the parent agent type, model, and reasoning effort and must not be combined with `agent_type`, `model`, or `reasoning_effort`.',
     '- Route-specific skills own route-specific details. Do not inject unrelated Design, PPT, image, browser, research, DB, or release policy into ordinary work.',
     '- Do not stop at a plan when implementation was requested. Finish the requested outcome, including verification of the changed path, before stopping for review. Stop early only on a hard blocker or when the stated done-when conditions are met.',
     '- User instructions outrank skill guidance. Infer routine details, honor authorization already provided, and finish authorized preparation before asking for a decision that changes scope or has irreversible effects.',
@@ -1119,8 +1119,8 @@ export function codexAppQuickReference(scope, commandPrefix) {
         coreEngineeringDirectiveReferenceText(),
         'dollar-commands:',
         ...currentDollarCommands().map((c) => `- \`${sksPrefixedDollarCommand(c.command)}\`: ${c.route}`),
-        'Routing: Answer is read-only, DFix handles tiny edits, and general work stays parent-owned. Use Naruto for explicit parallel work or independent slices that benefit from delegation.',
-        'Subagent context: explicitly set model="gpt-6-astra" and the role reasoning effort with `fork_turns="none"` or a positive bounded turn count. Pass the complete bounded slice contract in `message`; never inherit the parent model or apply a role-model preference.',
+        'Routing: Answer is read-only, DFix handles tiny edits, and Naruto implementation is parent orchestration with child slices. Answer and tiny DFix stay on the parent.',
+        'Subagent context: pass the sealed model and reasoning effort with `fork_turns="none"` or a positive bounded turn count. Jev mode seals that model at each new spawn; off mode uses gpt-6-astra. Pass the complete bounded slice contract in `message`. Never use `fork_turns="all"` together with a custom model.',
         'Goal: Codex native /goal is the only persisted goal owner; no SKS Goal mission, bridge, compatibility loop, or fallback state is allowed.',
         'Context: use bounded TriWiki recall when a claim needs project memory; refresh after material changes; validate before handoff/final; use Context7 or official vendor docs when external contracts or versions matter.',
         'Completion: report the result, actual verification, and remaining gaps once. Reflection and Honest Mode are optional unless explicitly requested or required by the strict profile.',

package/dist/core/routes.js

@@ -1211,6 +1211,9 @@ export function narutoDecisionForRoute(route, prompt = '', profile = classifyTas
         return narutoRouteDecision('none', routeId, profile, `task_profile_${profile}_bypass`, true);
     }
     if (profile === 'bounded-work') {
+        if (routeId === 'Naruto') {
+            return narutoRouteDecision('generic_naruto', routeId, profile, 'naruto_parent_orchestrates', false);
+        }
         return narutoRouteDecision('none', routeId, profile, 'task_profile_bounded_work_parent_owned', false);
     }
     if (profile === 'parallel-read' || profile === 'parallel-write' || profile === 'high-risk') {

package/dist/core/subagents/official-subagent-preparation.js

@@ -461,6 +461,12 @@ function applyOfficialSubagentDecision(derived, decided) {
         : { ...derived.fanoutPolicy };
     if (selectedRouting)
         fanoutPolicy = { ...fanoutPolicy, jev_selected_routing: selectedRouting.id };
+    const omitted = new Set(decided.omittedRoutingRoles || []);
+    if (omitted.size)
+        fanoutPolicy = { ...fanoutPolicy, jev_omitted_roles: [...omitted] };
+    const recommendedAgents = omitted.size > 0 && derived.suggestedAgents.some((name) => !omitted.has(name))
+        ? derived.suggestedAgents.filter((name) => !omitted.has(name))
+        : derived.suggestedAgents;
     const routingPreferences = selectedRouting
         ? Object.fromEntries(Object.entries(selectedRouting.efforts)
             .filter(([name]) => !derived.roleModelPreferences.store.roles[name])
@@ -483,7 +489,7 @@ function applyOfficialSubagentDecision(derived, decided) {
         waveCount: budget.waveCount,
         capacity: budget.capacity,
         triwikiAttention: attention,
-        recommendedAgents: derived.suggestedAgents,
+        recommendedAgents,
         roleModelPreferences: {
             ...derived.roleModelPreferences.store.roles,
             ...routingPreferences
@@ -519,6 +525,7 @@ function applyOfficialSubagentDecision(derived, decided) {
         }),
         triwiki_attention: attention,
         agents,
+        suggested_agents: recommendedAgents,
         fanout_policy: fanoutPolicy,
         capacity_controller: budget.capacity,
         jev_decision: decided.receipt,

package/dist/core/subagents/official-subagent-prompt.js

@@ -53,6 +53,8 @@ export function buildOfficialSubagentPrompt(input) {
     const spawnModelRouting = renderSpawnModelRouting(narutoChildren);
     const childModelRules = narutoChildren
         ? [
+            '- the parent orchestrates only: decompose the goal, assign disjoint slices, spawn children, and integrate their results',
+            '- do not implement the assigned slice work in the parent thread',
             '- use the model and reasoning_effort named in each slice spawn contract',
             '- sealed child models are gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, and gpt-6-astra',
             '- keep a stored user role-model preference for that role'

package/dist/core/update/update-migration-state/simple-stages.js

@@ -1,3 +1,4 @@
+import { retargetLiveManagedHookScript } from '../../codex-hooks/codex-hook-managed-install.js';
 import { codexHookTrustDoctor } from '../../codex-hooks/codex-hook-trust-doctor.js';
 export async function runOtherHarnessCleanupStage(root) {
     const { cleanupOtherHarnessConflicts, scanHarnessConflicts } = await import('../../harness-conflicts.js');
@@ -38,15 +39,27 @@ export async function runOtherHarnessCleanupStage(root) {
 }
 export async function runHookTrustRefreshStage(root) {
     const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });
-    const blockers = result.ok === false
-        ? (result.blockers || ['hook_trust_refresh_failed'])
-        : [];
+    const liveHook = await retargetLiveManagedHookScript(process.env).catch((err) => ({
+        ok: false,
+        status: 'absent',
+        script: null,
+        command: null,
+        error: err instanceof Error ? err.message : String(err)
+    }));
+    const blockers = [
+        ...(result.ok === false ? (result.blockers || ['hook_trust_refresh_failed']) : []),
+        ...(liveHook.ok === false ? [`live_managed_hook_retarget_failed:${liveHook.error || liveHook.status}`] : [])
+    ];
     return {
         ok: blockers.length === 0,
         status: blockers.length ? 'failed' : 'ok',
-        actions: ['refreshed_hook_trust'],
+        actions: ['refreshed_hook_trust', ...(liveHook.status === 'rewritten' ? ['retargeted_live_managed_hook'] : [])],
         blockers,
         warnings: result.warnings || [],
-        detail: { entries: result.current_hash_count ?? null }
+        detail: {
+            entries: result.current_hash_count ?? null,
+            live_hook_status: liveHook.status,
+            live_hook_script: liveHook.script
+        }
     };
 }

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.3.1';
+export const PACKAGE_VERSION = '10.3.3';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.3.1",
+  "version": "10.3.3",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",