sneakoscope 2.0.13 → 2.0.15

package/dist/scripts/codex-sdk-no-legacy-fallback-check.js

@@ -1,33 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, readText, root } from './sks-1-18-gate-lib.js';
-const runtimeFiles = [
-    'src/core/agents/agent-orchestrator.ts',
-    'src/core/agents/native-worker-backend-router.ts',
-    'src/core/agents/agent-command-surface.ts',
-    'src/core/commands/team-command.ts',
-    'src/core/commands/qa-loop-command.ts',
-    'src/core/commands/research-command.ts',
-    'src/core/commands/naruto-command.ts',
-    'src/core/commands/mad-sks-command.ts'
-];
-const violations = [];
-for (const file of runtimeFiles) {
-    const text = readText(file);
-    const allowedLegacyBlocker = file.includes('agent-orchestrator') || file.includes('native-worker-backend-router');
-    if (text.includes("runCodexExecAgent"))
-        violations.push(`${file}:runCodexExecAgent`);
-    if (text.includes("codex-exec'") && !allowedLegacyBlocker && !file.includes('naruto-command'))
-        violations.push(`${file}:codex-exec-default-or-usage`);
-    if (text.includes('codex-exec|fake'))
-        violations.push(`${file}:legacy-help`);
-    if (text.includes("mock ? 'fake' : 'codex-exec'"))
-        violations.push(`${file}:legacy-default`);
-}
-const allSource = fs.readdirSync(path.join(root, 'src', 'core', 'codex-control'));
-assertGate(allSource.includes('codex-sdk-adapter.ts'), 'Codex SDK adapter source missing');
-assertGate(violations.length === 0, 'legacy Codex exec fallback still reachable', { violations });
-emitGate('codex-sdk:no-legacy-fallback', { checked_files: runtimeFiles.length });
-//# sourceMappingURL=codex-sdk-no-legacy-fallback-check.js.map

package/dist/scripts/codex-sdk-qa-pipeline-check.js

@@ -1,8 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
-const source = readText('src/core/commands/qa-loop-command.ts');
-assertGate(source.includes("backend: mock ? 'fake' : 'codex-sdk'"), 'QA pipeline must default native agents to codex-sdk');
-assertGate(source.includes('runNativeAgentOrchestrator'), 'QA pipeline must use native agent orchestrator');
-emitGate('codex-sdk:qa-pipeline', { route: '$QA-LOOP' });
-//# sourceMappingURL=codex-sdk-qa-pipeline-check.js.map

package/dist/scripts/codex-sdk-real-smoke-check.js

@@ -1,39 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const requireReal = process.env.SKS_CODEX_SDK_REQUIRE_REAL === '1'
-    || process.env.SKS_REQUIRE_CODEX_SDK === '1'
-    || process.argv.includes('--require-real');
-if (!requireReal) {
-    const fixture = await runFakeCodexSdkTaskFixture('real-smoke-fixture');
-    assertGate(fixture.result.ok === true, 'fixture SDK smoke must pass', fixture.result);
-    emitGate('codex-sdk:real-smoke', { status: 'integration_optional', fixture_thread_id: fixture.result.sdkThreadId });
-}
-else {
-    const mod = await importDist('core/codex-control/codex-control-plane.js');
-    const schema = await importDist('core/codex-control/schemas/agent-worker-result.schema.js');
-    const result = await mod.runCodexTask({
-        route: '$Agent',
-        missionId: 'M-codex-sdk-real-smoke',
-        workItemId: 'real-smoke',
-        slotId: 'slot-real',
-        generationIndex: 1,
-        sessionId: 'real-smoke-session',
-        cwd: process.cwd(),
-        prompt: [
-            'Read-only real Codex SDK smoke. Do not edit files.',
-            'Return only JSON matching sks.agent-worker-result.v1.',
-            'Use status "done", a short summary, findings as string array, changed_files as [], patch_envelopes as [], verification as { "status": "passed", "checks": ["real-codex-sdk-smoke"] }, rollback_notes as [], and blockers as [].'
-        ].join('\n'),
-        inputFiles: [],
-        inputImages: [],
-        outputSchemaId: schema.CODEX_AGENT_WORKER_RESULT_SCHEMA_ID,
-        outputSchema: schema.codexAgentWorkerResultSchema,
-        sandboxPolicy: 'read-only',
-        requestedScopeContract: { id: 'real-smoke', read_only: true, allowed_paths: [], write_paths: [] },
-        mutationLedgerRoot: '.sneakoscope/reports/codex-sdk-real-smoke'
-    });
-    assertGate(result.ok === true, 'real Codex SDK smoke failed', result);
-    emitGate('codex-sdk:real-smoke', { status: 'proven', sdk_thread_id: result.sdkThreadId, stream_event_count: result.streamEventCount });
-}
-//# sourceMappingURL=codex-sdk-real-smoke-check.js.map

package/dist/scripts/codex-sdk-release-review-pipeline-check.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, packageScripts, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
-const scripts = packageScripts();
-const releaseRealCheck = String(scripts['release:real-check'] || '');
-const releaseRealCheckSource = readText('src/scripts/release-real-check.ts');
-const releaseGates = releaseGateIds();
-assertGate(releaseGates.has('codex-sdk:capability'), 'release gate DAG must include Codex SDK capability gate');
-assertGate(releaseGates.has('codex-sdk:all-pipelines'), 'release gate DAG must include Codex SDK all-pipelines gate');
-assertGate(releaseRealCheck.includes('codex-sdk:real-smoke') || releaseRealCheckSource.includes('codex-sdk:real-smoke'), 'release:real-check must include Codex SDK real smoke');
-assertGate(readText('src/core/agents/agent-orchestrator.ts').includes('legacy_codex_exec_runtime_removed'), 'orchestrator must block legacy codex-exec requests');
-emitGate('codex-sdk:release-review-pipeline', { release_gate_dag_contains_sdk: true });
-//# sourceMappingURL=codex-sdk-release-review-pipeline-check.js.map

package/dist/scripts/codex-sdk-research-pipeline-check.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
-const source = readText('src/core/commands/research-command.ts');
-assertGate(source.includes("backend: mock ? 'fake' : 'codex-sdk'"), 'Research pipeline must default native agents to codex-sdk');
-assertGate(source.includes("flag(args, '--autoresearch') ? '$AutoResearch' : '$Research'"), 'Research/AutoResearch route selection missing');
-assertGate(source.includes('narutoWorkGraph: researchWorkGraph'), 'Research pipeline must pass the stage-aware Naruto work graph');
-assertGate(source.includes('readonly: true'), 'Research pipeline must force read-only native orchestration');
-assertGate(source.includes('quality_metrics'), 'Research pipeline JSON output must include quality metrics');
-const researchCore = readText('src/core/research.ts');
-assertGate(researchCore.includes('readResearchQualityContract'), 'Research gate must read research-quality-contract.json');
-assertGate(researchCore.includes('claim_evidence_matrix_missing'), 'Research gate must require claim-evidence-matrix.json');
-assertGate(researchCore.includes('research_final_review_not_approved'), 'Research gate must require final reviewer approval');
-emitGate('codex-sdk:research-pipeline', { route: '$Research' });
-//# sourceMappingURL=codex-sdk-research-pipeline-check.js.map

package/dist/scripts/codex-sdk-sandbox-policy-check.js

@@ -1,21 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-sdk-sandbox-policy.js');
-const base = {
-    route: '$Agent',
-    missionId: 'M-sandbox',
-    cwd: process.cwd(),
-    prompt: 'sandbox fixture',
-    outputSchemaId: 'sks.agent-worker-result.v1',
-    outputSchema: {},
-    mutationLedgerRoot: process.cwd()
-};
-const readOnly = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'read-only', requestedScopeContract: { read_only: true } });
-const workspace = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: ['tmp'], write_paths: ['tmp'] } });
-const fullBlocked = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'full-access', requestedScopeContract: { read_only: false } });
-assertGate(readOnly.ok && readOnly.sandboxMode === 'read-only', 'read-only sandbox mapping failed', readOnly);
-assertGate(workspace.ok && workspace.sandboxMode === 'workspace-write', 'workspace-write sandbox mapping failed', workspace);
-assertGate(!fullBlocked.ok && fullBlocked.blockers.includes('codex_sdk_full_access_requires_explicit_mad_scope'), 'full-access must require explicit authorization', fullBlocked);
-emitGate('codex-sdk:sandbox-policy', { read_only: readOnly.sandboxMode, workspace: workspace.sandboxMode, full_blockers: fullBlocked.blockers });
-//# sourceMappingURL=codex-sdk-sandbox-policy-check.js.map

package/dist/scripts/codex-sdk-structured-output-check.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const fixture = await runFakeCodexSdkTaskFixture('structured-output');
-assertGate(fixture.result.ok === true, 'Codex SDK fake run must pass', fixture.result);
-assertGate(fixture.result.structuredOutputValid === true, 'structured output must validate', fixture.result);
-assertGate(fixture.worker.backend === 'codex-sdk', 'worker backend must be codex-sdk', fixture.worker);
-assertGate(fixture.worker.verification?.checks?.includes('sks.agent-worker-result.v1'), 'worker verification must reference output schema', fixture.worker);
-emitGate('codex-sdk:structured-output', { output_schema_id: fixture.proof.output_schema_id, structured_output_valid: fixture.result.structuredOutputValid });
-//# sourceMappingURL=codex-sdk-structured-output-check.js.map

package/dist/scripts/codex-sdk-team-naruto-agent-pipeline-check.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
-const team = readText('src/core/commands/team-command.ts');
-const naruto = readText('src/core/commands/naruto-command.ts');
-const agent = readText('src/core/agents/agent-command-surface.ts');
-assertGate(team.includes("backend: mock ? 'fake' : 'codex-sdk'"), 'Team must default to codex-sdk');
-assertGate(naruto.includes("backend: 'codex-sdk'"), 'Naruto help/defaults must expose codex-sdk');
-assertGate(agent.includes("useOllama && !noOllama ? 'ollama' : 'codex-sdk'"), 'Agent command surface must default to codex-sdk unless local model is explicit');
-assertGate(agent.includes('backendExplicit'), 'Agent command surface must preserve explicit backend/local-model intent');
-emitGate('codex-sdk:team-naruto-agent-pipeline', { routes: ['$Team', '$Naruto', '$Agent'] });
-//# sourceMappingURL=codex-sdk-team-naruto-agent-pipeline-check.js.map

package/dist/scripts/codex-sdk-thread-registry-check.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const fixture = await runFakeCodexSdkTaskFixture('thread-registry', { zellijPaneId: 'pane-42' });
-const thread = fixture.registry.threads[0] || {};
-assertGate(fixture.registry.thread_count === 1, 'thread registry must record one thread', fixture.registry);
-assertGate(thread.sdk_thread_id === fixture.result.sdkThreadId, 'thread registry sdk_thread_id mismatch', { thread, result: fixture.result });
-assertGate(thread.zellij_pane_id === 'pane-42', 'thread registry must link zellij pane id when present', thread);
-assertGate(thread.output_schema_id === 'sks.agent-worker-result.v1', 'thread registry output schema mismatch', thread);
-emitGate('codex-sdk:thread-registry', { thread_count: fixture.registry.thread_count, sdk_thread_id: thread.sdk_thread_id });
-//# sourceMappingURL=codex-sdk-thread-registry-check.js.map

package/dist/scripts/codex-sdk-ux-ppt-review-pipeline-check.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, packageScripts } from './lib/codex-sdk-gate-lib.js';
-const scripts = packageScripts();
-assertGate(Boolean(scripts['ux-review:imagegen-blackbox']), 'UX review imagegen blackbox gate missing');
-assertGate(Boolean(scripts['ppt:imagegen-blackbox']), 'PPT imagegen blackbox gate missing');
-assertGate(Boolean(scripts['ux-ppt:structured-extraction']), 'UX/PPT structured extraction gate missing');
-emitGate('codex-sdk:ux-ppt-review-pipeline', { gates: ['ux-review:imagegen-blackbox', 'ppt:imagegen-blackbox', 'ux-ppt:structured-extraction'] });
-//# sourceMappingURL=codex-sdk-ux-ppt-review-pipeline-check.js.map

package/dist/scripts/codex-sdk-zellij-pane-binding-check.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readText, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const fixture = await runFakeCodexSdkTaskFixture('zellij-binding', { zellijPaneId: 'pane-999' });
-const swarmSource = readText('src/core/agents/native-cli-session-swarm.ts');
-const proofSource = readText('src/core/agents/agent-slot-pane-binding-proof.ts');
-const managerSource = readText('src/core/zellij/zellij-worker-pane-manager.ts');
-assertGate(fixture.proof.zellij_pane_id === 'pane-999', 'control proof must link zellij pane id', fixture.proof);
-assertGate(swarmSource.includes('codex_sdk_thread_started'), 'swarm must emit SDK thread event');
-assertGate(proofSource.includes('worker_codex_sdk') && proofSource.includes('slot_status_renderer'), 'slot-pane proof must accept worker command panes and compact slot renderer panes');
-assertGate(managerSource.includes('slot_status_renderer') && managerSource.includes('worker_codex_sdk'), 'worker pane manager must distinguish slot renderer and worker command pane kinds');
-emitGate('codex-sdk:zellij-pane-binding', { zellij_pane_id: fixture.proof.zellij_pane_id, sdk_thread_id: fixture.proof.sdk_thread_id });
-//# sourceMappingURL=codex-sdk-zellij-pane-binding-check.js.map

package/dist/scripts/codex-thread-runtime-choice-check.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
-const runner = readText('src/core/codex-control/codex-task-runner.ts');
-const registry = readText('src/core/codex-control/codex-thread-registry.ts');
-assertGate(runner.includes('backendPreference'), 'Codex task runner must carry backend/runtime preference');
-assertGate(runner.includes('backend_family'), 'Codex task runner must persist backend family');
-assertGate(registry.includes('recordCodexThread'), 'Codex thread registry missing');
-emitGate('codex:thread-runtime-choice', { runtime_choice: 'backendPreference/backend_family' });
-//# sourceMappingURL=codex-thread-runtime-choice-check.js.map

package/dist/scripts/codex-web-adapter-check.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex/codex-web-search-adapter.js');
-const available = mod.detectCodexWebSearchCapability({ env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' } });
-const offline = mod.detectCodexWebSearchCapability({ offline: true });
-const evidence = await mod.runCodexWebSearch('fixture', { search: async () => [{ title: 'result', url: 'https://example.com' }], env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' } });
-assertGate(available.available === true, 'Codex Web capability env detector must pass');
-assertGate(offline.status === 'disabled_offline', 'offline mode must disable web search with reason');
-assertGate(evidence.ok === true && evidence.normalized_results.length === 1, 'Codex Web adapter must normalize results');
-emitGate('codex-web:adapter', { status: evidence.status, results: evidence.normalized_results.length });
-//# sourceMappingURL=codex-web-adapter-check.js.map

package/dist/scripts/computer-use-live-evidence-check.js

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runProcess } from '../core/fsx.js';
-const entry = './dist/bin/sks.js';
-const probe = await runProcess(process.execPath, [entry, 'computer-use', 'smoke', '--json'], {
-    env: { ...process.env, CI: 'true', SKS_TEST_REAL_COMPUTER_USE: '' },
-    timeoutMs: 20_000,
-    maxOutputBytes: 256 * 1024
-});
-const real = await runProcess(process.execPath, [entry, 'computer-use', 'smoke', '--real', '--capture-screenshot', '--json'], {
-    env: { ...process.env, CI: 'true', SKS_TEST_REAL_COMPUTER_USE: '' },
-    timeoutMs: 20_000,
-    maxOutputBytes: 256 * 1024
-});
-const probeJson = parseJson(probe.stdout);
-const realJson = parseJson(real.stdout);
-const text = `${probe.stdout}\n${probe.stderr}\n${real.stdout}\n${real.stderr}`;
-const forbidden = /mock.*live|fabricated|Computer Use blocked by safety policy|MAD-SKS disabled Computer Use/i.test(text);
-const ok = probe.code === 0
-    && probeJson.schema === 'sks.computer-use-live-smoke.v2'
-    && probeJson.evidence_mode === 'probe_only'
-    && probeJson.mock === false
-    && realJson.schema === 'sks.computer-use-live-smoke.v2'
-    && ['probe_only', 'live_capture_attempted', 'live_capture_success', 'live_capture_blocked'].includes(realJson.evidence_mode)
-    && realJson.mock === false
-    && Boolean(realJson.live_evidence_path)
-    && forbidden === false;
-console.log(JSON.stringify({
-    schema: 'sks.computer-use-live-evidence-check.v1',
-    ok,
-    probe: {
-        code: probe.code,
-        status: probeJson.status || null,
-        evidence_mode: probeJson.evidence_mode || null
-    },
-    real: {
-        code: real.code,
-        status: realJson.status || null,
-        evidence_mode: realJson.evidence_mode || null,
-        live_evidence_path: realJson.live_evidence_path || null,
-        image_voxel_linked: realJson.image_voxel_linked === true
-    },
-    forbidden_wording: forbidden
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-function parseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return {};
-    }
-}
-//# sourceMappingURL=computer-use-live-evidence-check.js.map

package/dist/scripts/computer-use-live-optional-check.js

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runProcess } from '../core/fsx.js';
-const entry = './dist/bin/sks.js';
-const result = await runProcess(process.execPath, [entry, 'computer-use', 'smoke', '--json'], {
-    env: { ...process.env, CI: 'true', SKS_TEST_REAL_COMPUTER_USE: '' },
-    timeoutMs: 20_000,
-    maxOutputBytes: 256 * 1024
-});
-const text = `${result.stdout}\n${result.stderr}`;
-let parsed = {};
-try {
-    parsed = JSON.parse(result.stdout);
-}
-catch { }
-const structuredStatus = ['available', 'codex_app_missing', 'macos_permission_missing', 'codex_app_capability_missing', 'external_capability_blocked', 'not_macos', 'unknown'].includes(parsed.status);
-const ok = result.code === 0
-    && parsed.schema === 'sks.computer-use-live-smoke.v2'
-    && parsed.ok === true
-    && structuredStatus
-    && parsed.mock === false
-    && !/Computer Use blocked by safety policy|MAD-SKS disabled Computer Use|Computer Use access is unsafe/i.test(text);
-console.log(JSON.stringify({
-    schema: 'sks.computer-use-live-optional-check.v1',
-    ok,
-    status: parsed.status || null,
-    mode: parsed.evidence_mode || parsed.mode || null,
-    structured_status: structuredStatus
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=computer-use-live-optional-check.js.map

package/dist/scripts/computer-use-policy-check.js

@@ -1,69 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runProcess } from '../core/fsx.js';
-const entry = './dist/bin/sks.js';
-const status = await runProcess(process.execPath, [entry, 'computer-use', 'status', '--json'], {
-    env: { ...process.env, CI: 'true' },
-    timeoutMs: 20_000,
-    maxOutputBytes: 256 * 1024
-});
-const text = `${status.stdout}\n${status.stderr}`;
-const forbidden = [
-    /Computer Use blocked by safety policy/i,
-    /Computer Use access is unsafe/i,
-    /MAD-SKS disabled Computer Use/i,
-    /Computer Use 접근이 안전 정책상 차단/i
-].filter((pattern) => pattern.test(text)).map(String);
-let parsed = {};
-try {
-    parsed = JSON.parse(status.stdout);
-}
-catch { }
-const allowedStatus = ['available', 'codex_app_missing', 'macos_permission_missing', 'codex_app_capability_missing', 'external_capability_blocked', 'not_macos', 'unknown'];
-const ok = status.code === 0
-    && parsed.schema === 'sks.computer-use-status.v1'
-    && allowedStatus.includes(parsed.status)
-    && parsed.mad_sks_independent === true
-    && forbidden.length === 0;
-console.log(JSON.stringify({
-    schema: 'sks.computer-use-policy-check.v1',
-    ok,
-    status_code: status.code,
-    computer_use_status: parsed.status || null,
-    forbidden
-}, null, 2));
-if (!ok && forbidden.length)
-    await recordComputerUseWrongness(forbidden);
-if (!ok)
-    process.exitCode = 1;
-async function recordComputerUseWrongness(forbidden) {
-    const { addWrongnessRecord } = await import('../core/triwiki-wrongness/wrongness-ledger.js');
-    await addWrongnessRecord(process.cwd(), {
-        route: '$Computer-Use',
-        wrongness_kind: 'computer_use_policy_misclassification',
-        severity: 'high',
-        claim: { text: `Computer Use was described with forbidden safety/MAD-SKS block wording: ${forbidden.join(', ')}` },
-        detected_by: {
-            source: 'computer_use_policy_check',
-            command: 'npm run computer-use:policy-check',
-            artifact: 'dist/scripts/computer-use-policy-check.js',
-            detail: forbidden.join(', ')
-        },
-        root_cause: {
-            category: 'route_policy_gap',
-            explanation: 'Computer Use is a Codex App/macOS capability check, not a MAD-SKS or generic SKS safety block.'
-        },
-        corrective_action: {
-            summary: 'Separate Computer Use availability from safety policy wording and rerun the policy fixture.',
-            required_evidence: ['npm run computer-use:policy-check'],
-            patch_status: 'pending'
-        },
-        avoidance_rule: {
-            text: 'Do not classify macOS Computer Use as MAD-SKS or generic SKS safety block.',
-            applies_to: ['computer-use', '$Computer-Use', '$QA-LOOP', '$Image-UX-Review'],
-            severity: 'high'
-        },
-        links: { tests: ['npm run computer-use:policy-check'], files: ['dist/scripts/computer-use-policy-check.js'] }
-    });
-}
-//# sourceMappingURL=computer-use-policy-check.js.map

package/dist/scripts/computer-use-visual-route-fixture-check.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runProcess } from '../core/fsx.js';
-const entry = './dist/bin/sks.js';
-const routes = ['$Image-UX-Review', '$QA-LOOP', '$PPT', '$Computer-Use', '$From-Chat-IMG'];
-const results = [];
-for (const route of routes) {
-    const result = await runProcess(process.execPath, [entry, 'computer-use', 'require', '--route', route, '--json'], {
-        env: { ...process.env, CI: 'true' },
-        timeoutMs: 20_000,
-        maxOutputBytes: 256 * 1024
-    });
-    const text = `${result.stdout}\n${result.stderr}`;
-    let parsed = {};
-    try {
-        parsed = JSON.parse(result.stdout);
-    }
-    catch { }
-    results.push({
-        route,
-        code: result.code,
-        schema: parsed.schema || null,
-        status: parsed.status || null,
-        ok_or_structured_blocker: parsed.ok === true || ['available', 'codex_app_missing', 'macos_permission_missing', 'codex_app_capability_missing', 'external_capability_blocked', 'not_macos', 'unknown', 'web_verification_uses_chrome_extension'].includes(parsed.status),
-        no_forbidden_wording: !/Computer Use blocked by safety policy|MAD-SKS disabled Computer Use|Computer Use access is unsafe/i.test(text),
-        evidence_status: parsed.evidence?.status || null
-    });
-}
-const ok = results.every((row) => row.schema === 'sks.computer-use-require.v1' && row.ok_or_structured_blocker && row.no_forbidden_wording);
-console.log(JSON.stringify({
-    schema: 'sks.computer-use-visual-route-fixture-check.v1',
-    ok,
-    results
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=computer-use-visual-route-fixture-check.js.map

package/dist/scripts/core-skill-card-schema-check.js

@@ -1,61 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:card-schema
-// Proves the Core Skill Card is read-only external state, that the checked-in
-// schema matches the runtime contract, and that an optimizer candidate can never
-// overwrite a deployed snapshot in place.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root, readJson } from './sks-1-18-gate-lib.js';
-const cardMod = await importDist('core/skills/core-skill-card.js');
-const typesMod = await importDist('core/skills/core-skill-types.js');
-const deployMod = await importDist('core/skills/core-skill-deployment.js');
-const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
-const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-card-schema-'));
-const promotionContract = createRequestedScopeContract({
-    route: 'core-skill-card-schema',
-    userRequest: 'release gate fixture skill promotion',
-    projectRoot: tempRoot,
-    overrides: { skill_snapshot_promotion: true }
-});
-// 1) A fresh candidate is structurally valid and read-only.
-const candidate = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 0, body: BODY });
-const shape = cardMod.validateCardShape(candidate);
-assertGate(shape.ok, 'candidate card must pass validateCardShape', shape);
-assertGate(candidate.status === 'candidate', 'fresh card status must be candidate', { status: candidate.status });
-assertGate(candidate.deployment_snapshot === false, 'candidate must not be a deployment snapshot', candidate);
-assertGate(candidate.side_effect_scope.read_only === true, 'candidate card must be read_only', candidate.side_effect_scope);
-assertGate(candidate.side_effect_scope.allowed_mutations.length === 0, 'candidate card must grant zero mutations', candidate.side_effect_scope);
-// 2) The checked-in schema parses and its const matches the runtime schema id.
-const cardSchema = readJson('schemas/skills/core-skill-card.schema.json');
-assertGate(cardSchema.properties?.schema?.const === typesMod.CORE_SKILL_CARD_SCHEMA, 'card schema const must match CORE_SKILL_CARD_SCHEMA', { const: cardSchema.properties?.schema?.const, expected: typesMod.CORE_SKILL_CARD_SCHEMA });
-// 3) Negative invariants.
-const notReadOnly = { ...candidate, side_effect_scope: { allowed_mutations: [], read_only: false } };
-const notReadOnlyShape = cardMod.validateCardShape(notReadOnly);
-assertGate(notReadOnlyShape.ok === false && notReadOnlyShape.blockers.includes('card_not_read_only'), 'read_only=false card must be blocked by card_not_read_only', notReadOnlyShape);
-const grantsMutations = { ...candidate, side_effect_scope: { allowed_mutations: ['x'], read_only: true } };
-const grantsShape = cardMod.validateCardShape(grantsMutations);
-assertGate(grantsShape.ok === false && grantsShape.blockers.includes('card_grants_mutations'), 'allowed_mutations card must be blocked by card_grants_mutations', grantsShape);
-const badDeployed = { ...candidate, status: 'deployed', deployment_snapshot: false };
-const badDeployedShape = cardMod.validateCardShape(badDeployed);
-assertGate(badDeployedShape.ok === false && badDeployedShape.blockers.includes('deployed_card_not_snapshot'), 'deployed card without snapshot flag must be blocked', badDeployedShape);
-// 4) A deployed snapshot cannot be overwritten by an optimizer candidate.
-//    The deployed snapshot lives in deployed.json; a candidate is a SEPARATE file.
-const accepted = { ...candidate, status: 'accepted' };
-const promotion = await deployMod.promoteToDeployedWithLedger(tempRoot, accepted, { contract: promotionContract, context: 'release' });
-assertGate(promotion.ok === true, 'ledger promotion must succeed for an accepted card', promotion);
-const deployedBefore = await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'demo-skill');
-assertGate(deployedBefore && deployedBefore.status === 'deployed' && deployedBefore.deployment_snapshot === true, 'loadDeployedSnapshot must return a deployed snapshot', deployedBefore);
-// Saving a candidate with the same skill_id must NOT touch deployed.json.
-const sneakyCandidate = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 9, body: '## Goal\nOverwrite me.\n' });
-await cardMod.saveCard(tempRoot, sneakyCandidate);
-const deployedAfter = await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'demo-skill');
-assertGate(deployedAfter && deployedAfter.status === 'deployed' && deployedAfter.deployment_snapshot === true, 'deployed snapshot must remain deployed after saving a candidate', deployedAfter);
-assertGate(deployedAfter.body === deployedBefore.body, 'deployed snapshot body must be unchanged by candidate save', { before: deployedBefore.body, after: deployedAfter.body });
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-card-schema-check.json'), `${JSON.stringify({ gate: 'core-skill:card-schema', candidate_ok: shape.ok, schema_const: cardSchema.properties?.schema?.const, deployed_protected: deployedAfter.body === deployedBefore.body }, null, 2)}\n`);
-fs.rmSync(tempRoot, { recursive: true, force: true });
-emitGate('core-skill:card-schema', { candidate_read_only: true, schema_const: cardSchema.properties?.schema?.const, deployed_snapshot_immutable: true });
-//# sourceMappingURL=core-skill-card-schema-check.js.map

package/dist/scripts/core-skill-deployment-snapshot-check.js

@@ -1,54 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:deployment-snapshot
-// Proves deployed snapshots are immutable (a changed body needs a higher version),
-// the previous snapshot is archived for rollback, rollback restores it, and only an
-// accepted card may be promoted.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const cardMod = await importDist('core/skills/core-skill-card.js');
-const deployMod = await importDist('core/skills/core-skill-deployment.js');
-const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
-const ROUTE = 'DFix';
-const SKILL = 'demo-skill';
-const BODY_V1 = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
-const BODY_V2 = '## Goal\nDo the task carefully.\n\n## Verification\nCheck output twice.\n\n## Rollback\nRevert on failure.\n';
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-deploy-'));
-const promotionContract = createRequestedScopeContract({
-    route: 'core-skill-deployment-snapshot',
-    userRequest: 'release gate fixture skill promotion',
-    projectRoot: tempRoot,
-    overrides: { skill_snapshot_promotion: true }
-});
-// 1) Promote an accepted card to a deployed snapshot.
-const acceptedV1 = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 0, body: BODY_V1 }), status: 'accepted' };
-const promoteV1 = await deployMod.promoteToDeployedWithLedger(tempRoot, acceptedV1, { contract: promotionContract, context: 'release' });
-assertGate(promoteV1.ok === true, 'promoting an accepted card must succeed', promoteV1);
-assertGate(promoteV1.snapshot && promoteV1.snapshot.status === 'deployed' && promoteV1.snapshot.deployment_snapshot === true, 'snapshot must be deployed + flagged', promoteV1.snapshot);
-// 2) Immutability: a changed body at version <= existing must be rejected.
-const changedSameVersion = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 0, body: BODY_V2 }), status: 'accepted' };
-assertGate(changedSameVersion.version === acceptedV1.version, 'changed-body card must share the existing version for this check', { changed: changedSameVersion.version, existing: acceptedV1.version });
-const promoteSame = await deployMod.promoteToDeployedWithLedger(tempRoot, changedSameVersion, { contract: promotionContract, context: 'release' });
-assertGate(promoteSame.ok === false && promoteSame.blockers.includes('snapshot_changed_without_version_increment'), 'changed body without version bump must be rejected', promoteSame);
-// 3) A changed body at a HIGHER version succeeds, archives the previous snapshot.
-const acceptedV2 = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 1, body: BODY_V2 }), status: 'accepted' };
-assertGate(acceptedV2.version > acceptedV1.version, 'v2 must have a higher version than v1', { v2: acceptedV2.version, v1: acceptedV1.version });
-const promoteV2 = await deployMod.promoteToDeployedWithLedger(tempRoot, acceptedV2, { contract: promotionContract, context: 'release' });
-assertGate(promoteV2.ok === true, 'higher-version changed snapshot must promote', promoteV2);
-assertGate(typeof promoteV2.archived_path === 'string' && promoteV2.archived_path.length > 0, 'previous snapshot must be archived', promoteV2);
-const hasRollback = await deployMod.hasRollbackSnapshot(tempRoot, ROUTE, SKILL);
-assertGate(hasRollback === true, 'a rollback snapshot must exist after a version bump', { hasRollback });
-// 4) Rollback restores the previous (v1) snapshot.
-const rolled = await deployMod.rollbackDeployment(tempRoot, ROUTE, SKILL);
-assertGate(rolled.ok === true && rolled.restored_version === acceptedV1.version, 'rollback must restore the previous version', rolled);
-// 5) Promotion requires accepted status.
-const candidate = cardMod.createCandidateCard({ skillId: 'other-skill', route: ROUTE, baseVersion: 0, body: BODY_V1 });
-const promoteCandidate = await deployMod.promoteToDeployedWithLedger(tempRoot, candidate, { contract: promotionContract, context: 'release' });
-assertGate(promoteCandidate.ok === false && promoteCandidate.blockers.includes('promote_requires_accepted_status'), 'a candidate card must not be promotable', promoteCandidate);
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-deployment-snapshot-check.json'), `${JSON.stringify({ gate: 'core-skill:deployment-snapshot', restored_version: rolled.restored_version, archived_path: Boolean(promoteV2.archived_path) }, null, 2)}\n`);
-fs.rmSync(tempRoot, { recursive: true, force: true });
-emitGate('core-skill:deployment-snapshot', { immutable_without_version_bump: true, archived_on_bump: true, rollback_restores_previous: rolled.restored_version === acceptedV1.version, promote_requires_accepted: true });
-//# sourceMappingURL=core-skill-deployment-snapshot-check.js.map

package/dist/scripts/core-skill-heldout-validation-check.js

@@ -1,49 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:heldout-validation
-// Proves strict held-out acceptance: a candidate is accepted ONLY on strict
-// held-out improvement with no safety regression, train-only gains are rejected,
-// and rejected patches are buffered so the same failed edit is not retried.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const validationMod = await importDist('core/skills/core-skill-validation.js');
-const bufferMod = await importDist('core/skills/rejected-skill-patch-buffer.js');
-const baseInput = {
-    baselineHeldout: 0.76,
-    candidateHeldout: 0.82,
-    sideEffectZero: true,
-    requestedScopeCompliant: true,
-    proofCompletenessBaseline: 1,
-    proofCompletenessCandidate: 1,
-    rollbackReadyBaseline: 1,
-    rollbackReadyCandidate: 1,
-    latencyBaselineMs: 1000,
-    latencyCandidateMs: 1100
-};
-// 1) Accept on strict improvement with no regression.
-const acceptRes = validationMod.validateHeldout(baseInput);
-assertGate(acceptRes.accept === true && acceptRes.reason === 'strict_improvement', 'strict improvement must be accepted', acceptRes);
-// 2) Held-out not improved -> reject.
-const notImproved = validationMod.validateHeldout({ ...baseInput, candidateHeldout: 0.74 });
-assertGate(notImproved.accept === false && notImproved.reason === 'heldout_not_improved', 'non-improving held-out must be rejected', notImproved);
-// 3) Train-improves-but-held-out-worse maps to heldout_not_improved.
-//    (Held-out is the only acceptance signal; a worse held-out is rejected regardless of train gains.)
-const trainGainHeldoutWorse = validationMod.validateHeldout({ ...baseInput, candidateHeldout: 0.70 });
-assertGate(trainGainHeldoutWorse.accept === false && trainGainHeldoutWorse.reason === 'heldout_not_improved', 'train-gain/held-out-worse must reject as heldout_not_improved', trainGainHeldoutWorse);
-// 4) Side-effect violation with improved held-out -> reject.
-const sideEffect = validationMod.validateHeldout({ ...baseInput, sideEffectZero: false });
-assertGate(sideEffect.accept === false && sideEffect.reason === 'side_effect_zero_failed', 'side-effect failure must reject as side_effect_zero_failed', sideEffect);
-// 5) Rejected-patch buffer dedupes by hash.
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-heldout-'));
-await bufferMod.recordRejectedPatch(tempRoot, { skill_id: 's', base_version: 3, patch_hash: 'abc', reason: 'heldout_not_improved', score_delta: -0.03 });
-const knownRejected = await bufferMod.isPatchRejected(tempRoot, 'abc');
-const unknownRejected = await bufferMod.isPatchRejected(tempRoot, 'zzz');
-assertGate(knownRejected === true, 'recorded patch hash must be reported as rejected', { knownRejected });
-assertGate(unknownRejected === false, 'unknown patch hash must not be reported as rejected', { unknownRejected });
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-heldout-validation-check.json'), `${JSON.stringify({ gate: 'core-skill:heldout-validation', accept_delta: acceptRes.score_delta, reject_reasons: [notImproved.reason, trainGainHeldoutWorse.reason, sideEffect.reason] }, null, 2)}\n`);
-fs.rmSync(tempRoot, { recursive: true, force: true });
-emitGate('core-skill:heldout-validation', { accept_strict_improvement: true, heldout_not_improved_rejected: true, side_effect_rejected: true, rejected_buffer_dedupes: knownRejected && !unknownRejected });
-//# sourceMappingURL=core-skill-heldout-validation-check.js.map