sneakoscope 10.5.6 → 10.5.8

package/README.md

@@ -14,14 +14,19 @@
 </div>
 
 <!-- BEGIN SKS SEARCH VISIBILITY MARKETING -->
-Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
+Sneakoscope Codex (`sks`) is an open-source local tool for the Codex CLI and Codex desktop app. It adds a macOS control center, bounded agent workflows, repository context, and evidence checks for SKS releases.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.5.6**. Install the latest stable release from npm.
+Current package: **SKS 10.5.8**, prepared for npm publication.
+[Release notes](https://github.com/mandarange/Sneakoscope-Codex/releases/tag/v10.5.8)
+· [Changelog](CHANGELOG.md). Install the latest stable release from npm.
 
-Sneakoscope Codex (`sks`) is a local trust layer for Codex CLI and ChatGPT Desktop. It keeps agent work bounded, preserves project context, records machine-verifiable evidence, and prevents release claims that current tests or artifacts cannot support.
-
-Use SKS when you want an AI coding session to end with something you can inspect: the change, the checks that ran, and the evidence behind the result. SKS is local-first and deterministic. It does not promise model quality, search rankings, or traffic.
+Ordinary work stays with the main agent. Optional Jev decisions use OpenRouter
+with cloud consent; source indexing and safety checks run locally. The default
+`essential` verification profile keeps safety checks active without requiring
+completion-proof rituals on every turn. `strict` adds those checks. SKS's npm
+release workflow requires its own current test and artifact evidence in either
+profile. See [verification profiles](docs/essential-trust.md).
 
 ## SKS Center — one place for your Codex setup
 
@@ -50,7 +55,7 @@ After installing SKS, install or rebuild the macOS app with:
 sks menubar install
 ```
 
-Interactive macOS installs can build it automatically. Dependency, CI, and
+Interactive global macOS installs can build it automatically. Dependency, CI, and
 piped installs skip the menu bar setup; scripts can opt in with
 `SKS_POSTINSTALL_MENUBAR=1` or opt out with `SKS_POSTINSTALL_NO_MENUBAR=1`.
 See [connection setup](docs/codex-lb.md), [subagent model lists](docs/naruto.md#connection-specific-subagent-lists),
@@ -62,6 +67,8 @@ and [image generation](docs/image-generation.md) for the underlying settings.
 
 - **Recommended: the latest patch release of Node.js 24 LTS.** Get it from the [official Node.js releases](https://nodejs.org/en/about/previous-releases).
 - npm, Git, and a current Codex CLI or supported Codex desktop host.
+- Building SKS Center on macOS also requires Xcode Command Line Tools and Swift;
+  the installer reports `xcode-select --install` if the tools are missing.
 - For source development and tests, see the locked dependency compatibility ranges in [Contributing](CONTRIBUTING.md#local-setup). CI uses the 24.x line.
 
 The published CLI's declared `package.json` engine floor is still `>=20.11`.
@@ -89,9 +96,10 @@ runs Doctor, and checks that `sks` on `PATH` resolves to the installed version:
 npm exec --yes --package=sneakoscope@latest -- sneakoscope install --yes
 ```
 
-### Enable SKS for a project
+### Add project context
 
-From the root of each project you want SKS to understand:
+Global SKS hooks and skills apply across projects. From a project root, create
+its local context and ignore rules with:
 
 ```sh
 sks bootstrap
@@ -107,9 +115,10 @@ Fix the failing test and verify the changed behavior.
 $sks-review
 ```
 
-`sks bootstrap` adds project-local SKS context and ignore rules. Ordinary work
-stays with the main agent; choose `$sks-naruto` or `$sks-work` when you want
-parallel child work.
+`sks bootstrap` initializes the project's SKS files. `$sks-align` builds the
+source index and refreshes managed guidance. Choose `$sks-naruto` or `$sks-work`
+when you explicitly want child agents; enabled Jev can also select parallel
+work when it judges that the task has independent parts.
 
 ## Update an existing installation
 
@@ -136,7 +145,8 @@ requesting a newer package, run `sks doctor --fix` yourself in the terminal.
 | --- | --- |
 | Keep work focused | Answers, tiny edits, ordinary implementation, reviews, and DB work run directly in the main agent. Naruto delegates through official Codex subagents when explicitly requested or selected by Jev. |
 | Keep context bounded | TriWiki indexes repository code into context that can be checked against source. |
-| Know what actually ran | Tests, diagnostics, and release evidence are recorded for completion claims. |
+| Reuse project memory | Opt-in Jev intake stages mission candidates; explicit promotion validates durable records separately from the code index. |
+| Know what actually ran | Diagnostics report measured checks; release gates bind tests and package evidence to the candidate commit. |
 | Recover safely | Doctor and update flows report a concrete recovery action when a check needs attention. |
 | Operate locally | The CLI works without a hosted control plane; macOS users can also use SKS Center. |
 
@@ -145,6 +155,20 @@ references and rebuilds TriWiki. Update and user-run `sks doctor --fix` share
 that maintenance and repair known ignored configuration settings. User text
 and model choices are preserved. See [harness maintenance](docs/align-modernization.md).
 
+### New in 10.5.7
+
+- **Jev execution profiles:** a decision can propose a bounded execution plan.
+  The default policy is `baseline`; fast profiles require `optimize` and an
+  explicit profile list. Required safety and mutation stages stay code-owned.
+- **TriWiki memory:** eligible mission candidates can be staged and explicitly
+  promoted into durable records after provenance, scope, lifecycle, and
+  evidence checks. Intake and promotion are separate opt-ins.
+- **Reliable index refresh:** align preserves canonical memory, and rebuilding
+  the generated memory indexes no longer makes a freshly aligned graph stale.
+
+These are implementation and validation results, not a measured speed or model
+quality improvement. See the [Jev and memory guide](docs/jev-triwiki-memory.md).
+
 ## Everyday commands
 
 ### Core dollar commands
@@ -211,10 +235,40 @@ Naruto runs only when you invoke `$sks-naruto` or `$sks-work`, pass `--agents N`
 3. **Verify** — run the project checks and SKS diagnostics.
 4. **Review** — inspect the diff and the evidence before claiming completion.
 
-SKS keeps these steps observable. It does not turn a failed check into a success, invent test output, or silently substitute a provider.
+Inspect the actual checks and their scope before relying on a result. A passing
+fixture, configured integration, or successful build does not establish a live
+provider result or deployment.
 
 ## Optional integrations
 
+### Jev decisions and memory
+
+Jev is **off by default**. It requires an OpenRouter key and explicit cloud
+consent. Configure the connection in SKS Center, then use **Decisions** or the
+CLI to enable it:
+
+```sh
+sks decision status --json
+sks decision enable --provider openrouter --model typesafe/jev-1.13 --consent-cloud --json
+```
+
+`status` makes no OpenRouter request. Enabling Jev permits bounded decision
+requests, which may contain redacted task text and selected source excerpts;
+the `baseline` execution policy and disabled memory options remain the defaults.
+
+Advanced settings are CLI options: `--execution-policy observe` keeps baseline
+execution; `--execution-policy optimize --profiles <ids>` permits selected fast
+profiles when their preconditions pass. `--memory-intake` enables eligible
+mission candidates; `--memory-promotion` additionally permits an explicit
+`sks memory promote --mission <id> --yes` under the `optimize` policy.
+User-scoped memory additionally requires `--allow-user-memory`.
+Re-running `decision enable` without these flags resets them to their defaults.
+
+Use `sks memory recall --json` to inspect available records. Disabling Jev with
+`sks decision disable` stops its decision and intake paths without deleting
+canonical memory. See [Jev setup](docs/jev-decisions.md) and
+[memory boundaries](docs/jev-triwiki-memory.md) before enabling advanced options.
+
 ### Desktop Bridge
 
 The Desktop Bridge can route eligible models through Codex-LB or OpenRouter while keeping provider choice and session pins explicit:
@@ -247,6 +301,8 @@ See [Image generation](docs/image-generation.md) for provider boundaries and evi
 - [MAD-SKS](docs/mad-sks.md) — explicit permission scope, execution boundaries, and verification.
 - [Agent Bridge](docs/AGENT-BRIDGE.md) — integrate through the CLI or MCP interface.
 - [Context Graph](docs/architecture/context-graph.md) — bounded source lookup and freshness.
+- [Jev decisions](docs/jev-decisions.md) — optional cloud decisions, setup, and fallback behavior.
+- [Jev and TriWiki memory](docs/jev-triwiki-memory.md) — execution profiles, memory intake, explicit promotion, and bounded recall.
 - [Release readiness](docs/release-readiness.md) — build, verify, and publish a release.
 - [Release evidence](docs/release-proof-truth.md) — what each verification result proves.
 - [FAQ](docs/faq.md) — common setup questions.
@@ -257,7 +313,11 @@ See [Image generation](docs/image-generation.md) for provider boundaries and evi
 
 ### Does SKS send my source code to a hosted service?
 
-SKS is local-first. Provider integrations are explicit opt-in routes; inspect the provider and bridge status before using them. Do not paste credentials or private source into an issue.
+TriWiki builds its code index locally. Codex sends the context needed for its
+work to the configured model provider; optional Jev can send bounded, redacted
+task text and selected source excerpts to OpenRouter after cloud consent.
+Local indexing is not a promise that the whole session stays offline. Inspect
+your provider and decision settings before using sensitive repositories.
 
 ### Why does `sks doctor` report a problem after an update?
 
@@ -279,7 +339,9 @@ The native Center is macOS-only. Run `sks menubar install` from an interactive t
 
 ### Does SKS guarantee better AI output or search visibility?
 
-No. SKS verifies process evidence and release claims. Model behavior and search outcomes remain separate measurements.
+No. SKS checks defined safety and evidence contracts. It does not guarantee
+model quality, faster execution, rankings, traffic, or correctness beyond the
+checks that actually ran.
 
 For a reproducible issue, use the [bug report form](https://github.com/mandarange/Sneakoscope-Codex/issues/new?template=bug_report.yml). For a question, start a discussion or open an issue with the smallest redacted reproduction.
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.5.6"
+version = "10.5.8"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.5.6"
+version = "10.5.8"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -70,7 +70,7 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'gx', summary: 'Render/validate GX cartridges', maturity: 'labs' },
     { name: 'eval', summary: 'Run eval reports', maturity: 'labs' },
     { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
-    { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' },
+    { name: 'memory', summary: 'Project TriWiki memory, explicit Jev promotion, digest-bound forgetting, or bounded recall', maturity: 'beta' },
     { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'stats', summary: 'Show storage stats', maturity: 'labs', readonly: true, skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'mcp-server', summary: 'Run a stdio MCP server exposing SKS commands as tools for MCP-capable agent hosts', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true },
@@ -373,8 +373,8 @@ const COMMAND_HELP_LITE = {
         description: 'Build, refresh, publish shared shards, rebuild ignored indexes, validate, and attach wrongness-memory context to RGBA/trig LLM Wiki packs with attention.use_first and attention.hydrate_first for compact recall plus source hydration.'
     },
     memory: {
-        usage: 'sks memory build [--json] | sks memory gc [--dry-run]',
-        description: 'Project TriWiki context-pack memory into managed AGENTS.md blocks or run bounded memory cleanup.'
+        usage: 'sks memory build [--json] | sks memory gc [--dry-run] | sks memory promote --mission <id> --yes [--json] | sks memory forget --memory-id <id> --previous-digest <digest> [--json] | sks memory recall [--query <text>] [--high-risk] [--json]',
+        description: 'Project TriWiki context-pack memory, explicitly promote a Jev mission intake, write a digest-bound tombstone, or read bounded canonical memory.'
     },
     naruto: {
         usage: 'sks naruto run "task" [--agents N] [--max-threads N] [--trusted-project] [--json] | sks naruto status|subagents|proof [latest|M-...] [--json] | sks naruto execution status [--json] | sks naruto execution set --mode auto|current-session|standalone [--restart] [--json] | sks naruto parent-summary --mission M-... --stdin [--json]',

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.5.6",
+  "package_version": "10.5.8",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/agents/agent-message-bus.js

@@ -1,7 +1,153 @@
 import path from 'node:path';
 import fs from 'node:fs/promises';
-import { appendJsonl, nowIso } from '../fsx.js';
+import { appendJsonl, nowIso, sha256 } from '../fsx.js';
 import { appendAgentLedgerEvent } from './agent-central-ledger.js';
+export const SIBLING_MESSAGE_MAX_BYTES = 4_096;
+export const SIBLING_MESSAGE_MAX_COUNT = 8;
+export const SIBLING_MESSAGE_MAX_REPLIES = 4;
+export const SIBLING_MESSAGE_MAX_TTL_MS = 300_000;
+export const SIBLING_MESSAGE_MAX_HOPS = 1;
+export const SIBLING_MESSAGE_KINDS = Object.freeze(['need_sibling_analysis', 'evidence_request', 'handoff_clarification', 'conflict_notice']);
+const SIBLING_RELAY_LOCKS = new Map();
+async function withSiblingRelayLock(root, fn) {
+    const previous = SIBLING_RELAY_LOCKS.get(root) || Promise.resolve();
+    const next = previous.catch(() => undefined).then(fn);
+    SIBLING_RELAY_LOCKS.set(root, next.catch(() => undefined));
+    return next;
+}
+export function buildSiblingMessage(input) {
+    const created = input.created_at || nowIso();
+    const expires = input.expires_at || new Date(Date.parse(created) + 120_000).toISOString();
+    const body = String(input.body || '').trim();
+    const bodyBytes = Buffer.byteLength(body, 'utf8');
+    if (bodyBytes === 0 || bodyBytes > SIBLING_MESSAGE_MAX_BYTES)
+        throw new Error('sibling_message_body_size');
+    if (/(?:spawn|merge|publish|align|apply|permission|elevat|credential|secret|api[ _-]?key|password|token|session.?id)/i.test(body)) {
+        throw new Error('sibling_message_action_or_sensitive_content');
+    }
+    const ttlMs = Date.parse(expires) - Date.parse(created);
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > SIBLING_MESSAGE_MAX_TTL_MS)
+        throw new Error('sibling_message_ttl');
+    const message = {
+        schema: 'sks.sibling-message.v1',
+        message_id: String(input.message_id),
+        sender_task_id: String(input.sender_task_id),
+        recipient_task_id: String(input.recipient_task_id),
+        mission_id: String(input.mission_id),
+        plan_id: String(input.plan_id),
+        correlation_task_key: String(input.correlation_task_key),
+        kind: input.kind,
+        body_digest: sha256(body),
+        artifact_refs: [...new Set((input.artifact_refs || []).map(String))].filter((ref) => !ref.includes('..') && !/[\\\0]/.test(ref)).slice(0, 16),
+        reply_to: input.reply_to || null,
+        created_at: created,
+        expires_at: expires,
+        hop_count: Math.max(0, Math.floor(input.hop_count || 0)),
+        status: 'pending'
+    };
+    const validation = validateSiblingMessage(message);
+    if (!validation.ok)
+        throw new Error(`sibling_message_invalid:${validation.issues.join('|')}`);
+    return message;
+}
+export function validateSiblingMessage(value, now = Date.now(), options = {}) {
+    const row = value;
+    const issues = [];
+    if (!row || row.schema !== 'sks.sibling-message.v1')
+        issues.push('schema');
+    for (const key of ['message_id', 'sender_task_id', 'recipient_task_id', 'mission_id', 'plan_id', 'correlation_task_key', 'body_digest'])
+        if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(String(row?.[key] || '')))
+            issues.push(key);
+    if (!SIBLING_MESSAGE_KINDS.includes(row?.kind))
+        issues.push('kind');
+    if (!Array.isArray(row?.artifact_refs) || row.artifact_refs.length > 16)
+        issues.push('artifact_refs');
+    if (Number(row?.hop_count) !== 0 && Number(row?.hop_count) !== SIBLING_MESSAGE_MAX_HOPS)
+        issues.push('hop_count');
+    if (!Number.isFinite(Date.parse(String(row?.created_at || ''))) || !Number.isFinite(Date.parse(String(row?.expires_at || ''))))
+        issues.push('time');
+    const ttlMs = Date.parse(String(row?.expires_at || '')) - Date.parse(String(row?.created_at || ''));
+    if (Date.parse(String(row?.expires_at || '')) <= now)
+        issues.push('expired');
+    if (ttlMs <= 0 || ttlMs > (options.maxTtlMs || SIBLING_MESSAGE_MAX_TTL_MS))
+        issues.push('ttl');
+    if (options.expectedPlanId && row?.plan_id !== options.expectedPlanId)
+        issues.push('cross_plan');
+    if (options.allowedRecipients && !options.allowedRecipients.includes(String(row?.recipient_task_id || '')))
+        issues.push('recipient');
+    if (options.mainTaskId && row?.kind === 'need_sibling_analysis' && row?.recipient_task_id !== options.mainTaskId)
+        issues.push('decomposition_recipient');
+    if (typeof row?.status !== 'string' || !['pending', 'replied', 'resolved', 'denied', 'expired'].includes(row.status))
+        issues.push('status');
+    return { ok: issues.length === 0, issues };
+}
+export async function appendSiblingMessage(root, input, options = {}) {
+    return withSiblingRelayLock(root, async () => {
+        const row = buildSiblingMessage(input);
+        const now = options.now || Date.now();
+        if (options.maxBytes !== undefined && Buffer.byteLength(String(input.body || '').trim(), 'utf8') > Math.min(SIBLING_MESSAGE_MAX_BYTES, Math.max(1, Math.floor(options.maxBytes))))
+            throw new Error('sibling_message_size_cap');
+        if (row.sender_task_id === row.recipient_task_id)
+            throw new Error('sibling_message_self_recipient');
+        if (options.planId && row.plan_id !== options.planId)
+            throw new Error('sibling_message_cross_plan');
+        if (options.parentTaskId && (options.senderParentTaskId !== options.parentTaskId || options.recipientParentTaskId !== options.parentTaskId)) {
+            throw new Error('sibling_message_parent_scope');
+        }
+        const allowedRecipients = options.allowedRecipients ? [...new Set(options.allowedRecipients.map(String))] : null;
+        if (allowedRecipients && !allowedRecipients.includes(row.recipient_task_id))
+            throw new Error('sibling_message_recipient_denied');
+        if (options.mainTaskId && row.kind === 'need_sibling_analysis' && row.recipient_task_id !== options.mainTaskId)
+            throw new Error('sibling_message_decomposition_main_only');
+        const requiredCapability = options.requiredCapability || 'sibling_discussion';
+        for (const side of [options.senderCapabilities, options.recipientCapabilities]) {
+            if (side && !side.includes(requiredCapability))
+                throw new Error('sibling_message_capability_denied');
+        }
+        const validation = validateSiblingMessage(row, now, {
+            ...(options.planId === undefined ? {} : { expectedPlanId: options.planId }),
+            ...(allowedRecipients === null ? {} : { allowedRecipients }),
+            ...(options.maxTtlMs === undefined ? {} : { maxTtlMs: options.maxTtlMs }),
+            ...(options.mainTaskId === undefined ? {} : { mainTaskId: options.mainTaskId })
+        });
+        if (!validation.ok)
+            throw new Error(`sibling_message_invalid:${validation.issues.join('|')}`);
+        const existing = await readRawAgentMessages(root);
+        const duplicate = existing.find((entry) => entry?.message_id === row.message_id && entry?.plan_id === row.plan_id);
+        if (duplicate)
+            return { ...row, duplicate: true, bus_entry: normalizeAgentMessageBusEntry(duplicate, row.mission_id) };
+        const planCount = existing.filter((entry) => entry?.plan_id === row.plan_id && entry?.mission_id === row.mission_id).length;
+        if (planCount >= Math.min(SIBLING_MESSAGE_MAX_COUNT, Math.max(1, Math.floor(options.maxCount || SIBLING_MESSAGE_MAX_COUNT))))
+            throw new Error('sibling_message_count_cap');
+        if (row.reply_to) {
+            const parent = existing.find((entry) => entry?.message_id === row.reply_to && entry?.plan_id === row.plan_id);
+            if (!parent)
+                throw new Error('sibling_message_reply_target_missing');
+            const replies = existing.filter((entry) => entry?.plan_id === row.plan_id && entry?.reply_to === row.reply_to).length;
+            if (replies >= Math.min(SIBLING_MESSAGE_MAX_REPLIES, Math.max(1, Math.floor(options.maxReplies || SIBLING_MESSAGE_MAX_REPLIES))))
+                throw new Error('sibling_message_reply_cap');
+        }
+        const entry = await appendAgentMessage(root, {
+            from: row.sender_task_id,
+            session_id: row.sender_task_id,
+            to: row.recipient_task_id,
+            body: `body_digest:${row.body_digest}`,
+            type: row.kind,
+            mission_id: row.mission_id,
+            worker_id: row.sender_task_id,
+            event_type: 'status',
+            artifact_paths: row.artifact_refs,
+            message_id: row.message_id,
+            plan_id: row.plan_id,
+            correlation_task_key: row.correlation_task_key,
+            reply_to: row.reply_to,
+            expires_at: row.expires_at,
+            hop_count: row.hop_count,
+            body_digest: row.body_digest
+        });
+        return { ...row, duplicate: false, bus_entry: entry };
+    });
+}
 export async function appendAgentMessage(root, message) {
     const eventType = normalizeAgentMessageEventType(message.event_type || message.type);
     const entry = {
@@ -18,10 +164,21 @@ export async function appendAgentMessage(root, message) {
         from: message.from,
         to: message.to || 'orchestrator',
         type: message.type || 'note',
-        body: message.body
+        body: message.body,
+        ...(message.message_id === undefined ? {} : { message_id: message.message_id }),
+        ...(message.plan_id === undefined ? {} : { plan_id: message.plan_id }),
+        ...(message.correlation_task_key === undefined ? {} : { correlation_task_key: message.correlation_task_key }),
+        ...(message.reply_to === undefined ? {} : { reply_to: message.reply_to }),
+        ...(message.expires_at === undefined ? {} : { expires_at: message.expires_at }),
+        ...(message.hop_count === undefined ? {} : { hop_count: message.hop_count }),
+        ...(message.body_digest === undefined ? {} : { body_digest: message.body_digest })
     };
     await appendJsonl(path.join(root, 'agent-messages.jsonl'), entry);
-    await appendAgentLedgerEvent(root, { agent_id: message.from, session_id: message.session_id, event_type: 'message_appended', payload: { to: entry.to, type: entry.type } });
+    await appendAgentLedgerEvent(root, { agent_id: message.from, session_id: message.session_id, event_type: 'message_appended', payload: {
+            to: entry.to, type: entry.type, message_id: entry.message_id || null, plan_id: entry.plan_id || null,
+            correlation_task_key: entry.correlation_task_key || null, reply_to: entry.reply_to || null,
+            expires_at: entry.expires_at || null, hop_count: entry.hop_count ?? null, body_digest: entry.body_digest || null
+        } });
     return entry;
 }
 export async function readAgentMessageBus(root, missionId, opts = {}) {
@@ -74,9 +231,28 @@ function normalizeAgentMessageBusEntry(value, missionId) {
         from: value.from == null ? undefined : String(value.from),
         to: value.to == null ? undefined : String(value.to),
         type: value.type == null ? undefined : String(value.type),
-        body: value.body == null ? undefined : String(value.body)
+        body: value.body == null ? undefined : String(value.body),
+        message_id: value.message_id == null ? undefined : String(value.message_id),
+        plan_id: value.plan_id == null ? undefined : String(value.plan_id),
+        correlation_task_key: value.correlation_task_key == null ? undefined : String(value.correlation_task_key),
+        reply_to: value.reply_to == null ? value.reply_to : String(value.reply_to),
+        expires_at: value.expires_at == null ? undefined : String(value.expires_at),
+        hop_count: value.hop_count == null ? undefined : Number(value.hop_count),
+        body_digest: value.body_digest == null ? undefined : String(value.body_digest)
     };
 }
+async function readRawAgentMessages(root) {
+    const file = path.join(root, 'agent-messages.jsonl');
+    const text = await fs.readFile(file, 'utf8').catch(() => '');
+    return text.split(/\n+/).filter(Boolean).flatMap((line) => {
+        try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        }
+    });
+}
 function normalizeAgentMessageEventType(value) {
     const text = String(value || '').toLowerCase();
     if (text === 'worker_completed' || text === 'completed' || text === 'done')

package/dist/core/align/code-navigation-align.js

@@ -17,6 +17,7 @@ import { walkCodeInventory } from '../triwiki/context-graph/extractors/code/inve
 import { codeInventoryInputHashes } from '../triwiki/code-navigation-policy.js';
 import { clearContextGraphSnapshotCache, clearWorkspaceContextIndex } from '../triwiki/context-graph/query/index.js';
 import { withTriWikiStateLock } from '../triwiki/triwiki-cleanup.js';
+import { preserveCanonicalMemory, rebuildSharedIndexes } from '../git-hygiene/shared-memory-publish.js';
 import { publishArchitectureMapToStage } from '../triwiki/context-graph/store/architecture-map-store.js';
 import { alignPendingRoot, alignPendingWiki, alignSourceFingerprint, projectAlignCodePack, publishAlignContextIndex } from './align-context-index.js';
 import { ALIGN_LEDGER_ARTIFACT, ALIGN_OUTPUT_ARTIFACTS, ALIGN_PLAN_ARTIFACT, ALIGN_STAGING_ROOT_REL, buildInitialAlignLedger, refreshAlignGate } from './align-route.js';
@@ -43,7 +44,7 @@ if (new Set(ALIGN_OUTPUT_ARTIFACTS).size !== ALIGN_OUTPUT_ARTIFACTS.length) {
 }
 const ALIGN_REPLACED_SURFACES = Object.freeze([
     { key: 'wiki', rel: '.sneakoscope/wiki' },
-    { key: 'memory', rel: '.sneakoscope/memory' },
+    { key: 'legacy_memory_runtime', rel: '.sneakoscope/memory' },
     { key: 'context_graph_cache', rel: '.sneakoscope/cache/context-graph' },
     { key: 'code_pack_freshness_cache', rel: '.sneakoscope/cache/code-pack-head-freshness.json' },
     { key: 'generated_agents_projection', rel: '.sneakoscope/context/AGENTS.generated.md' },
@@ -167,7 +168,15 @@ async function validateStaging(input) {
     if (!packValidation.ok || !isCodePackProjectionBoundToSnapshot(input.snapshot.snapshotHash, pack))
         return false;
     const contextPack = await readJson(path.join(input.stageWiki, 'context-pack.json'), null);
-    return validateCodeNavigationContextPack(contextPack, input.root).ok;
+    if (!validateCodeNavigationContextPack(contextPack, input.root).ok)
+        return false;
+    for (const [relative, expected] of Object.entries(input.canonicalHashes || {})) {
+        const file = path.join(input.stageWiki, relative);
+        const stat = await fsp.stat(file).catch(() => null);
+        if (!stat?.isFile() || await fileSha256(file) !== expected)
+            return false;
+    }
+    return true;
 }
 async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCas) {
     const startedAt = Date.now();
@@ -177,6 +186,28 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     if (staleStage?.isSymbolicLink())
         throw new Error('code_navigation_staging_symlink_refused');
     if (staleStage) {
+        const entries = await fsp.readdir(stageBase, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                throw new Error('align_recovery_stage_invalid');
+            const journal = await readJson(path.join(stageBase, entry.name, 'swap-journal.json'), null);
+            const priorRoot = path.join(stageBase, entry.name, 'previous');
+            for (const surface of ALIGN_REPLACED_SURFACES) {
+                const prior = path.join(priorRoot, surface.key);
+                if (!(await lstatOrNull(prior)))
+                    continue;
+                if ((await lstatOrNull(prior))?.isSymbolicLink())
+                    throw new Error('align_recovery_symlink');
+                const active = path.join(root, surface.rel);
+                if (!await lstatOrNull(active) && journal?.phase === 'prior_moved') {
+                    await ensureDir(path.dirname(active));
+                    await guardedRename(guard, prior, active);
+                }
+                else if (await lstatOrNull(prior)) {
+                    await guardedRm(guard, prior, { recursive: true, force: true });
+                }
+            }
+        }
         await guardedRm(guard, stageBase, { recursive: true, force: true });
         if (await lstatOrNull(stageBase))
             throw new Error('code_navigation_stale_staging_not_removed');
@@ -311,8 +342,11 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         await writeJsonAtomic(path.join(stageWiki, 'code-pack.json'), pack);
         await writeJsonAtomic(path.join(stageWiki, 'context-pack.json'), contextPack);
         await publishArchitectureMapToStage(stageWiki, snapshot, { root, missionId });
+        const canonicalHashes = await preserveCanonicalMemory(root, stageWiki);
+        await rebuildSharedIndexes(pendingRoot);
+        ledger.publication.canonical_memory_sha256 = canonicalHashes;
         ledger.publication.staged = true;
-        ledger.validation.staged_readback = await validateStaging({ stageWiki, root, snapshot, pack, contextPack, manifest });
+        ledger.validation.staged_readback = await validateStaging({ stageWiki, root, snapshot, pack, contextPack, manifest, canonicalHashes });
         if (!ledger.validation.staged_readback)
             throw new Error('code_navigation_staging_validation_failed');
         const prior = await inspectPriorSurfaces(root);
@@ -321,15 +355,36 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         ledger.input_state.prior_state_digest = prior.length
             ? crypto.createHash('sha256').update(prior.map((surface) => surface.descriptor).sort().join('\n')).digest('hex')
             : null;
+        await writeJsonAtomic(path.join(stageRoot, 'swap-journal.json'), {
+            schema: 'sks.align-swap-journal.v1',
+            phase: 'prepared',
+            mission_id: missionId,
+            active_surfaces: prior.map((surface) => surface.rel).sort(),
+            created_at: nowIso()
+        });
         for (const surface of prior) {
             const temporary = path.join(previousRoot, surface.key);
             await ensureDir(path.dirname(temporary));
             await guardedRename(guard, surface.absolute, temporary);
             movedPrior.push({ surface, temporary });
         }
+        await writeJsonAtomic(path.join(stageRoot, 'swap-journal.json'), {
+            schema: 'sks.align-swap-journal.v1',
+            phase: 'prior_moved',
+            mission_id: missionId,
+            active_surfaces: prior.map((surface) => surface.rel).sort(),
+            created_at: nowIso()
+        });
         await ensureDir(path.dirname(activeWiki));
         await guardedRename(guard, stageWiki, activeWiki);
         promoted = true;
+        await writeJsonAtomic(path.join(stageRoot, 'swap-journal.json'), {
+            schema: 'sks.align-swap-journal.v1',
+            phase: 'promoted',
+            mission_id: missionId,
+            active_surfaces: prior.map((surface) => surface.rel).sort(),
+            created_at: nowIso()
+        });
         clearContextGraphSnapshotCache();
         clearWorkspaceContextIndex(root);
         ledger.publication.transactional_directory_replaced = true;