sneakoscope 10.3.2 → 10.3.4

package/dist/core/hooks-runtime/parent-orchestration-gate.js

@@ -0,0 +1,372 @@
+import path from 'node:path';
+import { agentWorkerHookContext } from '../agents/agent-recursion-guard.js';
+import { consultJevToolDelegation } from '../decisions/integration.js';
+import { nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
+import { ensureConfinedDirectory } from '../managed-path-safety.js';
+import { missionDir } from '../mission.js';
+import { readSubagentEvents } from '../subagents/subagent-evidence.js';
+export const PARENT_ORCHESTRATION_GATE_FILENAME = 'parent-orchestration-gate.json';
+export const PARENT_ORCHESTRATION_GATE_SCHEMA = 'sks.parent-orchestration-gate.v1';
+export const PARENT_ORCHESTRATION_MAX_BLOCKS = 2;
+const MAX_TARGETS = 16;
+const SPAWN_TOOL_RE = /^(?:functions\.|collaboration\.)?spawn_agent$/;
+const FILE_EDIT_TOOL_RE = /^(?:functions\.)?(?:apply_patch|edit|write|multiedit|notebookedit|str_replace_editor|str_replace_based_edit_tool|file_write|fs_write|write_file|create_file|edit_file|update_file|delete_file)$/i;
+const SHELL_TOOL_RE = /^(?:functions\.)?(?:shell|shell_command|exec_command|local_shell|bash|container\.exec)$/i;
+const SHELL_WRITE_RE = new RegExp([
+    String.raw `(?:^|[\s;&|(])(?:rm|mv|cp|touch|mkdir|tee|ln|install)\b`,
+    String.raw `\bsed\s+(?:-[a-zA-Z]*i|--in-place)`,
+    String.raw `\bperl\s+-p?i\b`,
+    String.raw `\bpython\d?\s+-c\b`,
+    String.raw `\bnode\s+-e\b`,
+    String.raw `(?<![<>\d])>{1,2}(?!&)\s*(?!\/dev\/null)\S`,
+    String.raw `\*\*\*\s+(?:Update|Add|Delete|Move to)\s+File:`,
+    String.raw `\bgit\s+(?:apply|checkout|restore|stash|reset|commit|rebase|merge|cherry-pick|clean)\b`,
+    String.raw `\b(?:npm|pnpm|yarn|bun)\s+(?:install|add|remove|uninstall|i)\b`,
+    String.raw `\bcargo\s+(?:add|remove)\b`,
+    String.raw `\bpip\d?\s+install\b`
+].join('|'), 'i');
+const PATCH_FILE_RE = /\*\*\*\s+(?:Update|Add|Delete|Move to)\s+File:\s*([^\n\r]+)/g;
+const PATCH_HEADER_RE = /\*\*\*\s+(?:Update|Add|Delete|Move to)\s+File:/;
+const SHELL_PATH_TOKEN_RE = /(?:^|\s)((?:\.{1,2}\/|\/|~\/)?[\w@.+-]+(?:\/[\w@.+-]+)+|[\w@+-]+\.[a-z0-9]{1,8})(?=\s|$)/gi;
+export function isSpawnToolPayload(payload = {}) {
+    return SPAWN_TOOL_RE.test(toolNameOf(payload));
+}
+function toolNameOf(payload = {}) {
+    return String(payload?.tool_name || payload?.toolName || payload?.tool?.name || payload?.name || '').trim();
+}
+function toolInputOf(payload = {}) {
+    const input = payload?.tool_input || payload?.toolInput || payload?.tool?.input || payload?.input;
+    return input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+}
+function commandText(input, payload = {}) {
+    const raw = input.command ?? input.cmd ?? input.args ?? payload?.command ?? '';
+    if (Array.isArray(raw))
+        return raw.map((entry) => String(entry ?? '')).join(' ');
+    return String(raw ?? '');
+}
+function narutoState(state = {}) {
+    const mode = String(state?.mode || '').toUpperCase();
+    const route = String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase();
+    return mode === 'NARUTO' || route === 'NARUTO' || state?.subagents_required === true;
+}
+export function childThreadHookPayload(payload = {}) {
+    const agentId = String(payload?.agent_id || payload?.agentId || '').trim();
+    const agentType = String(payload?.agent_type || payload?.agentType || '').trim();
+    if (agentId || agentType)
+        return true;
+    const thread = String(payload?.thread_id || payload?.threadId || '').trim();
+    const session = String(payload?.session_id || payload?.sessionId || '').trim();
+    return Boolean(thread && session && thread !== session);
+}
+export function narutoRootParentHook(state = {}, payload = {}, sessionKey = null) {
+    if (!narutoState(state))
+        return false;
+    if (!String(state?.mission_id || '').trim())
+        return false;
+    if (state?.route_closed === true)
+        return false;
+    if (agentWorkerHookContext(state, payload))
+        return false;
+    if (childThreadHookPayload(payload))
+        return false;
+    const scope = String(state?.session_scope || '').trim();
+    const current = String(sessionKey || '').trim();
+    if (scope && current && scope !== current)
+        return false;
+    return true;
+}
+export function isSneakoscopeArtifactPath(target) {
+    const normalized = String(target || '').trim().replace(/\\/g, '/').replace(/^['"]|['"]$/g, '');
+    if (!normalized)
+        return false;
+    return /^(?:\.\/)?\.sneakoscope(?:\/|$)/.test(normalized) || /\/\.sneakoscope(?:\/|$)/.test(normalized);
+}
+function pushTarget(targets, value) {
+    const text = String(value ?? '').trim();
+    if (!text || targets.length >= MAX_TARGETS || targets.includes(text))
+        return;
+    targets.push(text);
+}
+function collectInputTargets(input, targets) {
+    for (const key of ['path', 'file_path', 'filePath', 'file', 'filename', 'target', 'target_path', 'targetPath', 'destination']) {
+        if (typeof input[key] === 'string')
+            pushTarget(targets, input[key]);
+    }
+    for (const key of ['paths', 'files', 'targets']) {
+        const rows = input[key];
+        if (Array.isArray(rows))
+            for (const row of rows)
+                pushTarget(targets, row);
+    }
+    const edits = input.edits;
+    if (Array.isArray(edits)) {
+        for (const edit of edits) {
+            if (edit && typeof edit === 'object') {
+                const row = edit;
+                pushTarget(targets, row.path ?? row.file_path ?? row.filePath ?? row.file);
+            }
+        }
+    }
+}
+function patchHeaderTargets(texts) {
+    const targets = [];
+    for (const text of texts) {
+        if (typeof text !== 'string' || !PATCH_HEADER_RE.test(text))
+            continue;
+        for (const match of text.matchAll(PATCH_FILE_RE))
+            pushTarget(targets, match[1]);
+    }
+    return targets;
+}
+function collectShellTargets(command, targets) {
+    for (const match of command.matchAll(SHELL_PATH_TOKEN_RE)) {
+        const token = String(match[1] || '').trim();
+        if (!token || token.startsWith('-') || /^https?:\/\//i.test(token))
+            continue;
+        if (/^\d+(?:\.\d+)*$/.test(token))
+            continue;
+        pushTarget(targets, token);
+    }
+}
+export function parentMutationIntent(payload = {}) {
+    const toolName = toolNameOf(payload);
+    if (!toolName || SPAWN_TOOL_RE.test(toolName))
+        return null;
+    const input = toolInputOf(payload);
+    const command = commandText(input, payload);
+    const patchTargets = patchHeaderTargets([command, input.patch, input.input, input.content, input.text]);
+    if (FILE_EDIT_TOOL_RE.test(toolName)) {
+        const targets = [];
+        collectInputTargets(input, targets);
+        for (const target of patchTargets)
+            pushTarget(targets, target);
+        if (!patchTargets.length && command)
+            collectShellTargets(command, targets);
+        return {
+            toolName,
+            kind: 'file_edit',
+            targets,
+            exempt: targets.length > 0 && targets.every(isSneakoscopeArtifactPath)
+        };
+    }
+    if (SHELL_TOOL_RE.test(toolName)) {
+        if (!command || !SHELL_WRITE_RE.test(command))
+            return null;
+        const targets = patchTargets.length ? [...patchTargets] : [];
+        if (!patchTargets.length)
+            collectShellTargets(command, targets);
+        return {
+            toolName,
+            kind: 'shell_write',
+            targets,
+            exempt: targets.length > 0 && targets.every(isSneakoscopeArtifactPath)
+        };
+    }
+    return null;
+}
+export function parentOrchestrationLedgerPath(root, missionId) {
+    return path.join(missionDir(root, missionId), PARENT_ORCHESTRATION_GATE_FILENAME);
+}
+function emptyLedger(missionId, workflowRunId) {
+    return {
+        schema: PARENT_ORCHESTRATION_GATE_SCHEMA,
+        mission_id: missionId,
+        workflow_run_id: workflowRunId,
+        spawns: 0,
+        blocks: 0,
+        escapes: 0,
+        parent_owned_allows: 0,
+        wait_blocks: 0,
+        wait_escapes: 0,
+        wait_fingerprint: null,
+        last_action: null,
+        last_tool: null,
+        last_targets: [],
+        last_jev_reason: null,
+        updated_at: null
+    };
+}
+export async function readParentOrchestrationLedger(root, missionId, workflowRunId = null) {
+    const raw = await readJson(parentOrchestrationLedgerPath(root, missionId), null).catch(() => null);
+    const fresh = emptyLedger(missionId, workflowRunId);
+    if (!raw || raw.schema !== PARENT_ORCHESTRATION_GATE_SCHEMA || String(raw.mission_id || '') !== missionId)
+        return fresh;
+    if (workflowRunId && raw.workflow_run_id && String(raw.workflow_run_id) !== workflowRunId)
+        return fresh;
+    return {
+        ...fresh,
+        workflow_run_id: workflowRunId || (typeof raw.workflow_run_id === 'string' ? raw.workflow_run_id : null),
+        spawns: countOf(raw.spawns),
+        blocks: countOf(raw.blocks),
+        escapes: countOf(raw.escapes),
+        parent_owned_allows: countOf(raw.parent_owned_allows),
+        wait_blocks: countOf(raw.wait_blocks),
+        wait_escapes: countOf(raw.wait_escapes),
+        wait_fingerprint: typeof raw.wait_fingerprint === 'string' ? raw.wait_fingerprint : null,
+        last_action: ['allow', 'block', 'escape', 'spawn', 'wait'].includes(raw.last_action) ? raw.last_action : null,
+        last_tool: typeof raw.last_tool === 'string' ? raw.last_tool : null,
+        last_targets: Array.isArray(raw.last_targets) ? raw.last_targets.map((row) => String(row)).slice(0, MAX_TARGETS) : [],
+        last_jev_reason: typeof raw.last_jev_reason === 'string' ? raw.last_jev_reason : null,
+        updated_at: typeof raw.updated_at === 'string' ? raw.updated_at : null
+    };
+}
+function countOf(value) {
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : 0;
+}
+async function writeLedger(root, ledger) {
+    const dir = missionDir(root, ledger.mission_id);
+    await ensureConfinedDirectory(path.resolve(root), dir);
+    await writeJsonAtomic(path.join(dir, PARENT_ORCHESTRATION_GATE_FILENAME), { ...ledger, updated_at: nowIso() });
+}
+export async function recordParentOrchestrationSpawn(root, state = {}, opts = {}) {
+    const missionId = String(state?.mission_id || '').trim();
+    if (!missionId || !narutoState(state))
+        return null;
+    const workflowRunId = String(state?.official_subagent_run_id || '').trim() || null;
+    const ledger = await readParentOrchestrationLedger(root, missionId, workflowRunId);
+    if (opts.atLeastOne && ledger.spawns > 0)
+        return ledger;
+    const next = { ...ledger, spawns: ledger.spawns + 1, last_action: 'spawn' };
+    await writeLedger(root, next);
+    return next;
+}
+async function childThreadActivity(root, missionId, workflowRunId) {
+    const events = await readSubagentEvents(missionDir(root, missionId)).catch(() => []);
+    const started = new Set();
+    const running = new Set();
+    for (const event of events) {
+        if (workflowRunId && event.run_id && event.run_id !== workflowRunId)
+            continue;
+        const thread = event.thread_id || event.agent_id;
+        if (!thread)
+            continue;
+        if (event.event_name === 'SubagentStart') {
+            started.add(thread);
+            running.add(thread);
+        }
+        else if (event.event_name === 'SubagentStop') {
+            running.delete(thread);
+        }
+    }
+    return { started: started.size, running: [...running].sort() };
+}
+function missionGoal(state = {}) {
+    return String(state?.prompt || state?.task || state?.goal || '').trim();
+}
+function renderTargets(intent) {
+    return intent.targets.length ? intent.targets.slice(0, 6).join(', ') : 'source files';
+}
+function blockMessage(missionId, intent, jev) {
+    const jevNote = jev?.called
+        ? jev.choice === 'delegate_child'
+            ? ' Jev classified this edit as slice work for a child.'
+            : ` Jev did not classify this edit as parent-owned (${jev.reason}).`
+        : '';
+    return [
+        `SKS parent orchestration gate denied ${intent.toolName} on ${renderTargets(intent)}: mission ${missionId} has no child thread yet.`,
+        'The Naruto parent orchestrates only. Decompose the task into disjoint slices and spawn each child with spawn_agent first',
+        '(sealed model and reasoning_effort; Jev seals them when Jev mode is on; fork_turns="none"; the complete slice contract in message),',
+        'wait for the children, then integrate and verify.',
+        'Until the first child starts, the parent may write only .sneakoscope artifacts.' + jevNote
+    ].join(' ');
+}
+function escapeMessage(missionId, intent, ledger) {
+    return [
+        `SKS parent orchestration gate released ${intent.toolName} on ${renderTargets(intent)} after ${ledger.blocks} denied attempts without a child spawn.`,
+        `This release is recorded as an escape in .sneakoscope/missions/${missionId}/${PARENT_ORCHESTRATION_GATE_FILENAME}.`,
+        'Spawn children for the remaining slices before the next source edit.'
+    ].join(' ');
+}
+function waitMessage(missionId, intent, running) {
+    return [
+        `SKS parent orchestration gate denied ${intent.toolName} on ${renderTargets(intent)}: ${running.length} child thread(s) of mission ${missionId} are still running.`,
+        'The Naruto parent does not implement slice work beside its children.',
+        'Wait for the running children, collect their results, then integrate and verify.',
+        'If more work remains, spawn another child for it instead of editing it in the parent.'
+    ].join(' ');
+}
+function waitEscapeMessage(missionId, intent, ledger) {
+    return [
+        `SKS parent orchestration gate released ${intent.toolName} on ${renderTargets(intent)} after ${ledger.wait_blocks} denied attempts while children were still recorded as running.`,
+        `The release is recorded in .sneakoscope/missions/${missionId}/${PARENT_ORCHESTRATION_GATE_FILENAME}; edit only integration work, not an assigned slice.`
+    ].join(' ');
+}
+function runningFingerprint(running) {
+    return sha256(running.join('\n')).slice(0, 16);
+}
+export async function evaluateParentOrchestrationGate(input) {
+    const { root, state, payload } = input;
+    if (!narutoRootParentHook(state, payload, input.sessionKey))
+        return { action: 'allow', reason: 'not_root_parent', jev: null };
+    const intent = parentMutationIntent(payload);
+    if (!intent)
+        return { action: 'allow', reason: 'no_mutation_intent', jev: null };
+    if (intent.exempt)
+        return { action: 'allow', reason: 'sneakoscope_artifact', jev: null };
+    const missionId = String(state.mission_id).trim();
+    const workflowRunId = String(state?.official_subagent_run_id || '').trim() || null;
+    const ledger = await readParentOrchestrationLedger(root, missionId, workflowRunId);
+    const activity = await childThreadActivity(root, missionId, workflowRunId);
+    if (ledger.spawns > 0 || activity.started > 0) {
+        return evaluateWhileChildrenExist(root, missionId, intent, ledger, activity);
+    }
+    if (ledger.blocks >= PARENT_ORCHESTRATION_MAX_BLOCKS) {
+        const next = { ...ledger, last_tool: intent.toolName, last_targets: intent.targets, escapes: ledger.escapes + 1, last_action: 'escape' };
+        await writeLedger(root, next).catch(() => null);
+        const message = ledger.escapes === 0 ? escapeMessage(missionId, intent, next) : null;
+        return { action: 'escape', reason: 'max_blocks_reached', message, jev: null };
+    }
+    const jev = await consultJevToolDelegation({
+        root,
+        missionGoal: missionGoal(state),
+        toolName: intent.toolName,
+        targets: intent.targets
+    }).catch(() => ({ called: false, choice: null, reason: 'consult_failed' }));
+    const base = {
+        ...ledger,
+        last_tool: intent.toolName,
+        last_targets: intent.targets,
+        last_jev_reason: jev.called ? `${jev.reason}${jev.choice ? `:${jev.choice}` : ''}` : jev.reason
+    };
+    if (jev.choice === 'parent_owned') {
+        await writeLedger(root, { ...base, parent_owned_allows: ledger.parent_owned_allows + 1, last_action: 'allow' }).catch(() => null);
+        return { action: 'allow', reason: 'jev_parent_owned', jev };
+    }
+    const next = { ...base, blocks: ledger.blocks + 1, last_action: 'block' };
+    await writeLedger(root, next).catch(() => null);
+    return {
+        action: 'block',
+        reason: jev.choice === 'delegate_child' ? 'jev_delegate_child' : 'no_child_thread',
+        message: blockMessage(missionId, intent, jev),
+        jev
+    };
+}
+async function evaluateWhileChildrenExist(root, missionId, intent, ledger, activity) {
+    const spawns = Math.max(ledger.spawns, activity.started);
+    if (activity.running.length === 0) {
+        if (spawns !== ledger.spawns)
+            await writeLedger(root, { ...ledger, spawns, last_action: 'spawn' }).catch(() => null);
+        return { action: 'allow', reason: 'children_settled', jev: null };
+    }
+    const fingerprint = runningFingerprint(activity.running);
+    const sameSet = ledger.wait_fingerprint === fingerprint;
+    const waitBlocks = sameSet ? ledger.wait_blocks : 0;
+    const waitEscapes = sameSet ? ledger.wait_escapes : 0;
+    const base = {
+        ...ledger,
+        spawns,
+        wait_fingerprint: fingerprint,
+        last_tool: intent.toolName,
+        last_targets: intent.targets
+    };
+    if (waitBlocks >= PARENT_ORCHESTRATION_MAX_BLOCKS) {
+        const next = { ...base, wait_blocks: waitBlocks, wait_escapes: waitEscapes + 1, last_action: 'escape' };
+        await writeLedger(root, next).catch(() => null);
+        const message = waitEscapes === 0 ? waitEscapeMessage(missionId, intent, next) : null;
+        return { action: 'escape', reason: 'wait_max_blocks_reached', message, jev: null };
+    }
+    const next = { ...base, wait_blocks: waitBlocks + 1, wait_escapes: waitEscapes, last_action: 'wait' };
+    await writeLedger(root, next).catch(() => null);
+    return { action: 'block', reason: 'children_running', message: waitMessage(missionId, intent, activity.running), jev: null };
+}

package/dist/core/hooks-runtime/subagent-context.js

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { readJson } from '../fsx.js';
 import { managedOfficialSubagentRoleByName } from '../managed-assets/managed-assets-manifest.js';
-import { ASTRA_SUBAGENT_MODEL, NARUTO_LUNA_MODEL, NARUTO_SOL_MODEL, NARUTO_TERRA_MODEL } from '../subagents/model-policy.js';
+import { latestModelForTier, latestTierModelSet } from '../subagents/model-tiers.js';
+import { jevEnabled, readDecisionConfig } from '../decisions/config.js';
 export async function sealedSubagentRoutingContext(artifactDir, payload = {}) {
     const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), null).catch(() => null);
     if (!plan || plan.workflow !== 'official_codex_subagent')
@@ -13,9 +14,18 @@ export async function sealedSubagentRoutingContext(artifactDir, payload = {}) {
     if (!agentName)
         return '';
     const narutoPlan = plan.mode === 'naruto' || plan.route === '$Naruto';
+    const jevSealed = await readDecisionConfig().then(jevEnabled).catch(() => false);
+    if (jevSealed) {
+        return [
+            'SKS sealed child routing:',
+            `- custom agent: ${agentName}`,
+            '- model and model_reasoning_effort: sealed on the spawn call by Jev routing',
+            '- keep this sealed profile; do not retarget model/effort or spawn nested agents'
+        ].join('\n');
+    }
     const plannedModel = String(planned?.routed_model || planned?.model || '').trim();
-    const sealedModels = new Set([ASTRA_SUBAGENT_MODEL, NARUTO_LUNA_MODEL, NARUTO_SOL_MODEL, NARUTO_TERRA_MODEL]);
-    const model = narutoPlan && sealedModels.has(plannedModel) ? plannedModel : ASTRA_SUBAGENT_MODEL;
+    const sealedModels = latestTierModelSet();
+    const model = narutoPlan && sealedModels.has(plannedModel) ? plannedModel : (role?.model || latestModelForTier('deep'));
     const effort = String((model === plannedModel
         ? planned?.routed_model_reasoning_effort || planned?.model_reasoning_effort
         : null) || role?.model_reasoning_effort || 'medium').trim();

package/dist/core/hooks-runtime/subagent-spawn-policy.js

@@ -1,21 +1,16 @@
-import { ASTRA_SUBAGENT_MODEL, NARUTO_LUNA_MODEL, NARUTO_SOL_MODEL, NARUTO_TERRA_MODEL } from '../subagents/model-policy.js';
+import { latestTierModelSet } from '../subagents/model-tiers.js';
 const SPAWN_TOOLS = new Set(['spawn_agent', 'collaboration.spawn_agent', 'functions.spawn_agent']);
-const SEALED_CHILD_MODELS = new Set([
-    ASTRA_SUBAGENT_MODEL,
-    NARUTO_LUNA_MODEL,
-    NARUTO_SOL_MODEL,
-    NARUTO_TERRA_MODEL
-]);
 export function subagentSpawnPolicyBlockReason(payload = {}) {
     const name = String(payload.tool_name || payload.toolName || payload.tool?.name || '');
     if (!SPAWN_TOOLS.has(name))
         return null;
     const input = payload.tool_input || payload.toolInput || payload.tool?.input || {};
-    if (!SEALED_CHILD_MODELS.has(String(input.model || ''))) {
-        return 'SKS children must use a sealed model: gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, or gpt-6-astra. Retry spawn_agent with that model, task-appropriate reasoning_effort, and fork_turns="none" or a positive bounded turn count. Include the complete slice contract in message; do not inherit the parent model.';
+    const allowed = latestTierModelSet();
+    if (!allowed.has(String(input.model || ''))) {
+        return `SKS children must name a current model: ${[...allowed].join(', ')} (the latest fast, balanced, context, or deep tier). Retry spawn_agent with the slice contract model, which the SKS hook re-seals when Jev mode is on, and fork_turns="none" or a positive bounded turn count. Include the complete slice contract in message; do not inherit the parent model.`;
     }
     if (input.fork_turns !== 'none' && !/^[1-9]\d*$/.test(String(input.fork_turns || ''))) {
-        return 'SKS Astra child spawns require fork_turns="none" or a positive bounded turn count. Retry with the complete slice contract in message; full-history/default forks cannot carry an explicit child model.';
+        return 'SKS child spawns require fork_turns="none" or a positive bounded turn count. Retry with the complete slice contract in message; full-history/default forks cannot carry an explicit child model.';
     }
     return null;
 }

package/dist/core/hooks-runtime.js

@@ -31,6 +31,8 @@ import { classifyTaskProfile } from './runtime/task-profile.js';
 import { resolveSubagentThreadBudget } from './subagents/thread-budget.js';
 import { readOfficialSubagentConfig } from './subagents/official-subagent-config.js';
 import { jevSpawnModelRewrite } from './hooks-runtime/jev-spawn-routing.js';
+import { maybeReconcileManagedGuidancePreflight } from './hooks-runtime/managed-guidance-preflight.js';
+import { evaluateParentOrchestrationGate, isSpawnToolPayload, recordParentOrchestrationSpawn } from './hooks-runtime/parent-orchestration-gate.js';
 import { subagentSpawnPolicyBlockReason } from './hooks-runtime/subagent-spawn-policy.js';
 import { withFileLock } from './locks/file-lock.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from './managed-path-safety.js';
@@ -120,9 +122,15 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
         parentLaunchMissionId: activeNarutoParentLaunchMissionId()
     });
     const withNarutoDecision = (result) => ({ ...result, sksNarutoDecision });
+    if (name === 'user-prompt-submit' || name === 'session-start') {
+        await maybeReconcileManagedGuidancePreflight(root).catch(() => null);
+    }
     if (name === 'user-prompt-submit') {
         const result = await hookUserPrompt(root, state, payload, noQuestion, sessionKey);
-        const withJev = await attachJevTurnRouting(root, payload, result);
+        const orchestrationRequired = sksNarutoDecision.required === true
+            && (sksNarutoDecision.action === 'prepare_naruto' || sksNarutoDecision.action === 'observe_required');
+        const withOrchestration = attachParentOrchestrationDirective(result, orchestrationRequired);
+        const withJev = await attachJevTurnRouting(root, payload, withOrchestration, orchestrationRequired);
         const withSkillContext = await attachAuthoritativeSksSkillContext(root, state, payload, withJev);
         return withNarutoDecision(attachOfficialSubagentSpawnCompatibilityContext(state, payload, withSkillContext));
     }
@@ -169,7 +177,7 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
         : '';
     const resourceGuard = skillGuardBinding ? [
         `SKS Naruto policy: max_threads frame budget is ${budget.maxThreads} (cap, not a spawn target).`,
-        'All children use gpt-6-astra; low/medium/high/max are effort lanes, not an agent-count cap.',
+        'Keep the model and reasoning effort your spawn call sealed; do not retarget them.',
         'Use max_depth=1. Naruto children must not spawn children.',
         'Do not duplicate an already assigned slice.',
         'Parallel writes require disjoint paths; serialize overlapping paths.',
@@ -208,6 +216,7 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
         }
     }
     if (skillGuardBinding && artifactDirSafe) {
+        await recordParentOrchestrationSpawn(root, state, { atLeastOne: true }).catch(() => null);
         try {
             await recordAndRefreshSubagentEvidence(root, state, payload, 'SubagentStart', sessionKey);
         }
@@ -236,7 +245,24 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
     const additionalContext = [coreEngineeringDirectiveReferenceText(), resourceGuard, routingContext, active, skillContext].filter(Boolean).join('\n\n');
     return { continue: true, additionalContext, ...(skillBlockers.length ? { silent: true } : {}) };
 }
-async function attachJevTurnRouting(root, payload, result) {
+function attachParentOrchestrationDirective(result, orchestrationRequired) {
+    if (!orchestrationRequired || !result || result.decision === 'block')
+        return result;
+    const line = [
+        'SKS parent orchestration gate is armed for this turn.',
+        'The parent thread orchestrates only: decompose the task into disjoint slices, spawn each child with spawn_agent',
+        '(sealed model and reasoning_effort, fork_turns="none", complete slice contract in message), wait, then integrate and verify.',
+        'The PreToolUse hook denies parent-thread source edits until the first child thread starts and while children are still running; .sneakoscope artifacts stay parent-writable.'
+    ].join(' ');
+    const additionalContext = [result.additionalContext, line].filter(Boolean).join('\n\n');
+    return {
+        ...result,
+        additionalContext,
+        parent_orchestration_gate: 'armed',
+        ...(result.systemMessage ? { systemMessage: visibleHookMessage('user-prompt-submit', additionalContext) } : {})
+    };
+}
+async function attachJevTurnRouting(root, payload, result, orchestrationRequired = false) {
     if (!result || result.decision === 'block')
         return result;
     const prompt = stripVisibleDecisionAnswerBlocks(extractUserPrompt(payload));
@@ -246,7 +272,9 @@ async function attachJevTurnRouting(root, payload, result) {
     if (!decision?.called)
         return result;
     const line = decision.model
-        ? `Jev sealed this turn to ${decision.model}. Use that sealed model and do not reclassify it.`
+        ? orchestrationRequired
+            ? `Jev rated this task as ${decision.model} (${decision.effort}). Use that as the default child seal; Jev re-seals every spawn_agent call and the parent model stays as the user set it.`
+            : `Jev rated this turn as ${decision.effort}-effort work (${decision.model} tier). Treat it as this turn's reasoning hint; the parent model, effort, and service tier stay as the user set them.`
         : '';
     if (!line)
         return { ...result, jev_turn: decision };
@@ -664,18 +692,28 @@ async function hookPreTool(root, state, payload, noQuestion, sessionKey = null)
         return agentRecursionDecision;
     if (noQuestion && looksInteractiveCommand(command))
         return { decision: 'block', reason: interactiveCommandReason(command) };
+    const orchestration = await evaluateParentOrchestrationGate({ root, state, payload, sessionKey })
+        .catch(() => null);
+    if (orchestration?.action === 'block') {
+        return { decision: 'block', permissionDecision: 'deny', reason: orchestration.message };
+    }
     const hostCapabilityDecision = await enforceHostCapabilityPreTool(root, state, payload, sessionKey);
     if (hostCapabilityDecision && hostCapabilityDecision.continue !== true)
         return hostCapabilityDecision;
+    if (isSpawnToolPayload(spawnPayload))
+        await recordParentOrchestrationSpawn(root, state).catch(() => null);
     const waveGuidance = await parentWaveGuidanceContext(root, state, sessionKey).catch(() => '');
-    const additionalContext = [skillRefresh.context, waveGuidance].filter(Boolean).join('\n\n');
+    const escapeNote = orchestration?.action === 'escape' ? orchestration.message || '' : '';
+    const additionalContext = [skillRefresh.context, waveGuidance, escapeNote].filter(Boolean).join('\n\n');
     if (additionalContext) {
         return withJevSpawnRewrite({
             continue: true,
             additionalContext,
-            ...(waveGuidance
-                ? { systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.') }
-                : { silent: true })
+            ...(escapeNote
+                ? { systemMessage: visibleHookMessage('pre-tool', escapeNote), parent_orchestration_gate: 'escaped' }
+                : waveGuidance
+                    ? { systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.') }
+                    : { silent: true })
         }, jevSpawnInput);
     }
     return withJevSpawnRewrite({ continue: true }, jevSpawnInput);

package/dist/core/init/skills/inventory.js

@@ -33,7 +33,11 @@ export const REMOVED_SKS_SKILL_NAMES = [
     'ralph-supervisor',
     'ralph-resolver',
     'loop',
-    'sks-loop'
+    'sks-loop',
+    'with-local-llm-on',
+    'with-local-llm-off',
+    'sks-with-local-llm-on',
+    'sks-with-local-llm-off'
 ];
 export const LEGACY_SKS_SUPPORT_SKILL_NAMES = [
     'autoresearch-loop',

package/dist/core/init/skills.js

@@ -40,7 +40,7 @@ async function installOfficialSkills(root) {
     const skills = {
         'dfix': `---\nname: dfix\ndescription: Apply $sks-dfix only to tiny copy, config, or mechanical edits.\n---\n\nUse for tiny copy/config/docs/labels/spacing/translation/simple mechanical edits. List exact micro-edits, inspect only needed files, apply only those edits, and run cheap verification. Keep broad implementation out of DFix; for UI/UX micro-edits read \`design.md\` when present and use imagegen for image/logo/raster assets. Bypass broad SKS routing, mission state, TriWiki/TriFix/reflection/state recording, Goal, Research, eval, redesign, and repeated full-route Honest Mode loops. Report the change, actual verification, and remaining issues once. ${CODEX_IMAGEGEN_REQUIRED_POLICY}\n`,
         'answer': `---\nname: answer\ndescription: Answer questions with research or docs; never implement.\n---\n\nUse for explanations, comparisons, status, facts, source-backed research, or docs guidance. Use repo/TriWiki first for project-local facts; hydrate low-trust claims from source. Browse or use Context7 for current external package/API/framework/MCP docs. End with a concise answer that separates what was verified from what was inferred; do not create missions, subagents, or file edits.\n`,
-        'sks': `---\nname: sks\ndescription: Use $sks for setup, status, conflicts, or SKS commands.\n---\n\nUse local SKS commands: bootstrap, deps, commands, quickstart, codex-app, context7, guard, conflicts, reasoning, wiki, pipeline status, pipeline plan, skill-dream. Execute general code-changing work in the current task; use Naruto only for explicit parallel work or concrete independent slices. Surface route/guard/scope, use TriWiki, do not edit installed harness files outside this engine repo, and clear conflicting third-party Codex harness markers via \`sks conflicts cleanup --yes\`. ${skillDreamPolicyText()}\n`,
+        'sks': `---\nname: sks\ndescription: Use $sks for setup, status, conflicts, or SKS commands.\n---\n\nUse local SKS commands: bootstrap, deps, commands, quickstart, codex-app, context7, guard, conflicts, reasoning, wiki, pipeline status, pipeline plan, skill-dream. Route code-changing work through Naruto, where the parent orchestrates child slices instead of implementing them itself; keep answers, SKS commands, and tiny DFix edits in the current task. Surface route/guard/scope, use TriWiki, do not edit installed harness files outside this engine repo, and clear conflicting third-party Codex harness markers via \`sks conflicts cleanup --yes\`. ${skillDreamPolicyText()}\n`,
         'plan': `---\nname: plan\ndescription: Write a plan artifact only; never edit product or source files.\n---\n\nUse when the user invokes $Plan or asks for a plan-only frontdoor. Produce a concrete plan artifact under .sneakoscope/plans/<slug>.md with goal, scope, files to inspect, implementation steps, acceptance checks, and rollback notes. Do not edit product/source files, generated harness files, package metadata, or docs beyond the plan artifact. Keep implementation_allowed=false and hand off execution to $Work only after the user or route explicitly moves from planning to work. Finish with what is planned, what remains unimplemented, and Honest Mode.\n`,
         'work': `---\nname: work\ndescription: Execute the latest .sneakoscope plan with evidence-gated close.\n---\n\nUse when the user invokes $Work or asks to execute the latest SKS plan. Resolve the newest .sneakoscope/plans/*.md, route execution through Naruto evidence gates, keep leases and verification artifacts current, and do not claim completion without machine evidence or explicit blocker evidence. If no plan exists, block with a clear next action: run $Plan first or provide a task.\n`,
         'review': `---\nname: review\ndescription: Review a selected diff with machine evidence first.\n---\n\nUse when the user asks for $Review or sks review. Review the selected diff read-only unless --fix is explicitly supplied. Machine evidence such as TypeScript, lint, tests, conflict markers, or secret scans outranks LLM findings and must be tagged evidence: machine; judgment-only findings must be tagged evidence: llm. --fix may attempt at most one machine-evidence fix pass and must re-run verification once. Do not mutate code for LLM-only opinions.\n`,
@@ -65,10 +65,10 @@ async function installOfficialSkills(root) {
         'mad-sks': `---\nname: mad-sks\ndescription: Use $sks-mad-sks only for explicit high-risk SQL or grants.\n---\n\nUse only when the user explicitly invokes $MAD-SKS, top-level sks --mad, or \`sks mad-sks plan|run|apply|sql|apply-migration|status|close|rollback-apply\`. MAD-SKS is the single high-risk route for scoped permission widening and bound SQL-plane execution. It can be combined with another route, such as $MAD-SKS $Naruto or $DB ... $MAD-SKS; in that case the other command remains the primary workflow and MAD-SKS is the temporary permission grant or SQL-plane executor. The widened permission applies only while the active mission gate is open, must be deactivated when the task ends, and can open approved scopes such as target-project file writes, shell commands, package installs, local service control, network operations, browser/Computer Use workflows, generated assets, file permissions, migrations, Supabase MCP database writes, column/schema cleanup, direct execute SQL, and normal targeted DB writes.\n\nSQL-plane policy:\n${canonicalMadSksSqlPlanePolicy}\n\nCatastrophic SQL boundary: TRUNCATE, all-row UPDATE/DELETE, table/schema/database DROP, and equivalent reset operations are allowed only through the SQL-plane executor and only when the user's prompt or CLI SQL statement literally names that operation. Other MAD-SKS executors, including db-write, keep those catastrophic categories blocked. Whole database/schema/table removal outside SQL-plane, dangerous project/branch management, credential exfiltration, persistent security weakening, destructive delete without explicit confirmation, and unrequested fallback implementation remain blocked. Do not carry MAD-SKS permission into later prompts or routes. The permission profile source is centralized in src/core/permission-gates.ts and emitted as dist/core/permission-gates.js so skill/hook/MCP-style gates share one decision function.\n`,
         'gx': `---\nname: gx\ndescription: Run $sks-gx to render or validate a GX visual cartridge.\n---\n\nUse when the user invokes $GX/$gx or asks for architecture/context visualization through SKS. Prefer sks gx init, render, validate, drift, and snapshot. vgraph.json remains the source of truth.\n`,
         'help': `---\nname: help\ndescription: Explain installed SKS commands via $sks-help.\n---\n\nUse when the user invokes $Help/$help or asks what commands exist. Prefer concise output from sks commands, sks usage <topic>, sks quickstart, sks aliases, and sks codex-app.\n`,
-        'prompt-pipeline': `---\nname: prompt-pipeline\ndescription: Route an execution request; Answer and DFix stay light.\n---\n\nClassify only the route and the constraints that change execution. Answer handles real information requests; DFix handles tiny copy/config/docs/labels/spacing/translation/mechanical edits; general work stays parent-owned and uses Naruto only for explicit parallel work or concrete independent slices. Preserve the literal user request; TriWiki may enrich it but never replace an explicit requirement. ${coreEngineeringDirectiveReferenceText()} For code work, identify the requested outcome, actual code/data flow, exact write scope, acceptance criteria, and the smallest meaningful verification. Load route-specific Design, PPT, image, browser, research, DB, release, or Context7 rules only when that route or external contract requires them. Materialize pipeline-plan.json with route, scopes, verification, and blockers, then finish the requested work instead of stopping at the plan.\n`,
+        'prompt-pipeline': `---\nname: prompt-pipeline\ndescription: Route an execution request; Answer and DFix stay light.\n---\n\nClassify only the route and the constraints that change execution. Answer handles real information requests; DFix handles tiny copy/config/docs/labels/spacing/translation/mechanical edits. Answer and tiny DFix stay parent-owned. Naruto implementation is parent orchestration: spawn disjoint slices and do not implement them in the parent thread; the PreToolUse gate denies parent source edits until the first child starts and while children are running. Preserve the literal user request; TriWiki may enrich it but never replace an explicit requirement. ${coreEngineeringDirectiveReferenceText()} For code work, identify the requested outcome, actual code/data flow, exact write scope, acceptance criteria, and the smallest meaningful verification. Load route-specific Design, PPT, image, browser, research, DB, release, or Context7 rules only when that route or external contract requires them. Materialize pipeline-plan.json with route, scopes, verification, and blockers, then finish the requested work instead of stopping at the plan.\n`,
         [SOLUTION_SCOUT_SKILL_NAME]: `---\nname: ${SOLUTION_SCOUT_SKILL_NAME}\ndescription: Scout external precedent only when the local path needs it.\n---\n\nUse only when the user asks for similar cases or when a package, API, platform, or externally documented behavior makes outside precedent materially useful. Search with the concrete symptom and current stack, prefer primary sources, and keep the local code path authoritative. Do not add this step to ordinary local bugfixes. If external evidence is unavailable, record that gap instead of inventing a workaround.\n`,
-        'reasoning-router': `---\nname: reasoning-router\ndescription: Inspect reasoning hints; keep the user's Codex settings.\n---\n\nUse the active Codex model catalog for supported reasoning efforts. GPT-6 Astra does not support none/minimal; use low when migrating those efforts, and preserve other supported choices. Task hints are advisory: do not override the selected model, effort, or service tier or persist profile changes without a request. Inspect with sks reasoning and sks pipeline status. Every child uses gpt-6-astra independently of the parent model; vary only effort by task.\n`,
-        'pipeline-runner': `---\nname: pipeline-runner\ndescription: Execute the selected SKS route with bounded evidence.\n---\n\nEvery $ command selects a route. Use current.json, mission artifacts, and pipeline-plan.json as bounded execution state; load only the selected route skill. ${coreEngineeringDirectiveReferenceText()} Codex native /goal is the only persisted goal owner. Use official Codex subagents only when the route requires independent slices, keep parent-owned integration, use bounded TriWiki context, fetch current external docs only when relevant, record real blockers, and finish with a completion summary that states what was verified and what remains. Reflection and Honest Mode sections are strict-profile requirements only.\n`,
+        'reasoning-router': `---\nname: reasoning-router\ndescription: Inspect reasoning hints; keep the user's Codex settings.\n---\n\nUse the active Codex model catalog for supported reasoning efforts. GPT-6 Astra does not support none/minimal; use low when migrating those efforts, and preserve other supported choices. Task hints are advisory: do not override the selected model, effort, or service tier or persist profile changes without a request. Inspect with sks reasoning and sks pipeline status. When Jev mode is on, each new child spawn is sealed by Jev and must not be replaced with a parent-chosen model. Off mode uses gpt-6-astra. A user role preference stays authoritative.\n`,
+        'pipeline-runner': `---\nname: pipeline-runner\ndescription: Execute the selected SKS route with bounded evidence.\n---\n\nEvery $ command selects a route. Use current.json, mission artifacts, and pipeline-plan.json as bounded execution state; load only the selected route skill. ${coreEngineeringDirectiveReferenceText()} Codex native /goal is the only persisted goal owner. When the route requires official Codex subagents, the parent decomposes, spawns children, waits, and owns integration and verification without implementing slice work itself; use bounded TriWiki context, fetch current external docs only when relevant, record real blockers, and finish with a completion summary that states what was verified and what remains. Reflection and Honest Mode sections are strict-profile requirements only.\n`,
         'context7-docs': `---\nname: context7-docs\ndescription: Fetch Context7 docs when an external library contract matters.\n---\n\nWhen an external library, framework, API, MCP, or generated-docs contract matters, resolve-library-id, then query-docs for the resolved id. Legacy get-library-docs evidence is accepted. Prefer sks context7 tools/resolve/docs/evidence and finish only after both evidence stages exist. Check setup with sks context7 check.\n`,
         'super-search': `---\nname: super-search\ndescription: Run $sks-super-search for provider-independent source proof.\n---\n\nUse when the user invokes $Super-Search or asks for provider-independent source proof, X-search collection, or URL acquisition. Prefer \`sks super-search doctor --json\` for readiness and \`sks super-search run "<query>" --mode balanced --json\` for provider-independent source proof; use \`sks super-search x "<query>" --json\` for X-search intent and \`sks super-search fetch "<url>" --json\` for URL acquisition. Context7 is required only when the query depends on current package/API/framework/MCP/generated documentation behavior. Provider-specific credentials are optional and must not be required for route readiness. Evidence/artifacts remain under \`.sneakoscope/missions/<super-search-* or route mission>/super-search/\`: intent.json, axes.json, query-variants.json, provider-plan.json, source-ledger.json, lead-ledger.json, claim-ledger.json, attempt-ledger.json, synthesis.md, super-search-proof.json, super-search-gate.json, and super-search-result.json. Do not turn weak discovery into supported claims; finish with an Honest Mode summary of verified sources, blockers, and unverified external coverage.\n`,
         'search-visibility-core': `---\nname: search-visibility-core\ndescription: Shared SEO/GEO kernel for $sks-seo-geo-optimizer evidence.\n---\n\nPurpose: keep Search Engine Optimization and Generative Engine Optimization on one typed search-visibility kernel instead of duplicate implementations. Use when $SEO-GEO-OPTIMIZER or \`sks seo-geo-optimizer\` is selected. Workflow: doctor detects package/static/Next evidence; audit writes source-backed inventory and findings; plan compiles safe mutation operations; apply requires explicit \`--apply\`; verify separates source, build, HTTP, browser, production, and measured outcome; rollback only reverses mission-owned operations. Safety: default read-only, never overwrite unmanaged robots.txt, sitemap, llms.txt, metadata, or structured data; do not hard-code customer routes; do not invent prices, reviews, availability, rankings, traffic, or AI citation outcomes. Evidence/artifacts: search-visibility/intake.json, adapter-detection.json, site-inventory.json, route-graph.json, robots-policy.json, structured-data-ledger.json, mutation-plan.json, mutation-journal.jsonl, rollback-manifest.json, verification-report.json, route gate, and completion-proof.json. Failure/recovery: unsupported frameworks stay audit/plan-only; missing production/browser/Search Console evidence remains unverified, not fabricated. CLI entrypoint: \`sks seo-geo-optimizer ... --mode seo|geo\`.\n`,