sneakoscope 2.0.13 → 2.0.15

package/dist/scripts/core-skill-no-inference-optimizer-check.js

@@ -1,75 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:no-inference-optimizer
-// Proves the optimizer NEVER runs in deployment/inference context: deployed-snapshot
-// reads are allowed and carry route proof (skill id/version/hash), while any
-// optimizer/epoch call throws a SkillDeploymentViolationError. Out of context the
-// optimizer works normally.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const cardMod = await importDist('core/skills/core-skill-card.js');
-const runtimeMod = await importDist('core/skills/core-skill-runtime.js');
-const deployMod = await importDist('core/skills/core-skill-deployment.js');
-const epochMod = await importDist('core/skills/core-skill-epoch.js');
-const traceMod = await importDist('core/skills/core-rollout-trace.js');
-const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-no-opt-'));
-const card = cardMod.createCandidateCard({ skillId: 'x', route: 'DFix', baseVersion: 0, body: BODY });
-const trace = traceMod.createRolloutTrace({ route: 'DFix', backend: 'fake', proof_artifacts: [], rollback_ready: false, requested_scope_compliant: true, latency_ms: 1000, failure_reason: null });
-// Enter deployment / inference context.
-deployMod.setDeploymentContext(true);
-process.env.SKS_SKILL_DEPLOYMENT_CONTEXT = '1';
-assertGate(deployMod.isDeploymentContext() === true, 'deployment context must be active', { active: deployMod.isDeploymentContext() });
-// 1) Deployment reads are allowed and never throw.
-let selection = null;
-let readThrew = false;
-try {
-    await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'x');
-    selection = await runtimeMod.selectRouteSkill(tempRoot, 'DFix', 'x');
-}
-catch {
-    readThrew = true;
-}
-assertGate(readThrew === false, 'deployment-path reads must not throw in deployment context', { readThrew });
-assertGate(selection !== null, 'selectRouteSkill must return a selection', { selection });
-assertGate(selection.source === 'fallback' || selection.source === 'deployed', 'selection source must be fallback or deployed', selection);
-// 2) Route proof record: no optimizer invocation, and skill id/version/hash keys present (Task 4.7).
-const proof = runtimeMod.skillProofRecord(selection);
-assertGate(proof.optimizer_invoked === false, 'route proof must show optimizer was not invoked', proof);
-assertGate('skill_id' in proof && 'version' in proof && 'hash' in proof, 'route proof must include skill_id/version/hash keys', proof);
-// 3) Optimizer calls are forbidden in deployment context.
-let proposeThrew = null;
-try {
-    epochMod.proposeSkillPatch(card, [trace]);
-}
-catch (err) {
-    proposeThrew = err;
-}
-assertGate(proposeThrew !== null && proposeThrew.name === 'SkillDeploymentViolationError', 'proposeSkillPatch must throw SkillDeploymentViolationError in deployment context', { name: proposeThrew?.name });
-let epochThrew = null;
-try {
-    await epochMod.runSkillEpoch(tempRoot, { card, trainTraces: [trace], validation: { baselineHeldout: 0.5, candidateHeldout: 0.6, sideEffectZero: true, requestedScopeCompliant: true, proofCompletenessBaseline: 0, proofCompletenessCandidate: 1, rollbackReadyBaseline: 0, rollbackReadyCandidate: 1, latencyBaselineMs: 1000, latencyCandidateMs: 1000 } });
-}
-catch (err) {
-    epochThrew = err;
-}
-assertGate(epochThrew !== null && epochThrew.name === 'SkillDeploymentViolationError', 'runSkillEpoch must throw SkillDeploymentViolationError in deployment context', { name: epochThrew?.name });
-// 4) Reset: out of deployment context the optimizer works (does not throw).
-deployMod.setDeploymentContext(false);
-delete process.env.SKS_SKILL_DEPLOYMENT_CONTEXT;
-assertGate(deployMod.isDeploymentContext() === false, 'deployment context must be cleared', { active: deployMod.isDeploymentContext() });
-let proposeOk = true;
-try {
-    epochMod.proposeSkillPatch(card, [trace]);
-}
-catch {
-    proposeOk = false;
-}
-assertGate(proposeOk === true, 'proposeSkillPatch must not throw out of deployment context', { proposeOk });
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-no-inference-optimizer-check.json'), `${JSON.stringify({ gate: 'core-skill:no-inference-optimizer', source: selection.source, optimizer_invoked: proof.optimizer_invoked, proof_keys: Object.keys(proof) }, null, 2)}\n`);
-fs.rmSync(tempRoot, { recursive: true, force: true });
-emitGate('core-skill:no-inference-optimizer', { deployment_read_allowed: true, optimizer_forbidden_in_deployment: true, route_proof_has_id_version_hash: 'skill_id' in proof && 'version' in proof && 'hash' in proof, optimizer_runs_out_of_context: proposeOk });
-//# sourceMappingURL=core-skill-no-inference-optimizer-check.js.map

package/dist/scripts/core-skill-patch-check.js

@@ -1,79 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:patch
-// Proves a SkillPatch edits ONLY the single skill document within the textual
-// learning-rate budget, and rejects budget overruns, external/code targets, and
-// cross-skill (multi-doc) edits.
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root, readJson } from './sks-1-18-gate-lib.js';
-const cardMod = await importDist('core/skills/core-skill-card.js');
-const patchMod = await importDist('core/skills/core-skill-patch.js');
-const applyMod = await importDist('core/skills/core-skill-patch-apply.js');
-const typesMod = await importDist('core/skills/core-skill-types.js');
-const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
-// Base card at version N (createCandidateCard from baseVersion 2 -> version 3).
-const baseCard = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 2, body: BODY });
-const N = baseCard.version;
-// 1) Valid patch within budget: one small add to the verification section.
-const validPatch = {
-    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
-    skill_id: 'demo-skill',
-    base_version: N,
-    operations: [{ op: 'add', target: 'section:verification', text: '- Confirm exit code is zero.' }],
-    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
-};
-const validRes = patchMod.validatePatch(validPatch, baseCard);
-assertGate(validRes.ok === true, 'valid in-budget patch must pass validatePatch', validRes);
-const applied = applyMod.applyPatch(baseCard, validPatch);
-assertGate(applied.ok === true, 'valid patch must apply', applied);
-assertGate(applied.candidate && applied.candidate.body !== baseCard.body, 'applied patch must change the candidate body', { changed: applied.candidate?.body !== baseCard.body });
-assertGate(applied.before_hash !== applied.after_hash, 'applied patch must change the body hash', { before: applied.before_hash, after: applied.after_hash });
-// 2) Budget overrun: add text longer than max_added_chars.
-const overPatch = {
-    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
-    skill_id: 'demo-skill',
-    base_version: N,
-    operations: [{ op: 'add', target: 'section:verification', text: 'x'.repeat(50) }],
-    textual_learning_rate: { max_added_chars: 10, max_deleted_chars: 400, max_replaced_chars: 600 }
-};
-const overRes = patchMod.validatePatch(overPatch, baseCard);
-assertGate(overRes.ok === false && overRes.blockers.includes('budget_added_chars_exceeded'), 'over-budget add must be blocked by budget_added_chars_exceeded', overRes);
-// 3) Code/external target reject.
-const externalPatch = {
-    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
-    skill_id: 'demo-skill',
-    base_version: N,
-    operations: [{ op: 'add', target: 'section:../../src/evil.ts', text: 'pwned' }],
-    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
-};
-const externalRes = patchMod.validatePatch(externalPatch, baseCard);
-const externalBlocked = externalRes.ok === false && externalRes.blockers.some((b) => b.startsWith('patch_target_is_external') || b.startsWith('patch_target_invalid'));
-assertGate(externalBlocked, 'external/code target must be rejected', externalRes);
-const filePatch = {
-    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
-    skill_id: 'demo-skill',
-    base_version: N,
-    operations: [{ op: 'add', target: 'file:src/x.ts', text: 'pwned' }],
-    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
-};
-const fileRes = patchMod.validatePatch(filePatch, baseCard);
-const fileBlocked = fileRes.ok === false && fileRes.blockers.some((b) => b.startsWith('patch_target_is_external') || b.startsWith('patch_target_invalid'));
-assertGate(fileBlocked, 'file:-targeted patch must be rejected', fileRes);
-// 4) Multi-doc / other-skill reject (same base_version so the only difference is skill_id).
-const otherSkillPatch = {
-    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
-    skill_id: 'a-different-skill',
-    base_version: N,
-    operations: [{ op: 'add', target: 'section:verification', text: '- hi' }],
-    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
-};
-const otherRes = patchMod.validatePatch(otherSkillPatch, baseCard);
-assertGate(otherRes.ok === false && otherRes.blockers.includes('patch_targets_other_skill'), 'patch for another skill must be blocked by patch_targets_other_skill', otherRes);
-// 5) Checked-in patch schema parses and const matches the runtime contract.
-const patchSchema = readJson('schemas/skills/core-skill-patch.schema.json');
-assertGate(patchSchema.properties?.schema?.const === typesMod.CORE_SKILL_PATCH_SCHEMA, 'patch schema const must match CORE_SKILL_PATCH_SCHEMA', { const: patchSchema.properties?.schema?.const, expected: typesMod.CORE_SKILL_PATCH_SCHEMA });
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-patch-check.json'), `${JSON.stringify({ gate: 'core-skill:patch', valid_added_chars: validRes.added_chars, schema_const: patchSchema.properties?.schema?.const }, null, 2)}\n`);
-emitGate('core-skill:patch', { valid_patch_applies: applied.ok, budget_enforced: true, external_target_rejected: externalBlocked && fileBlocked, other_skill_rejected: true });
-//# sourceMappingURL=core-skill-patch-check.js.map

package/dist/scripts/core-skill-promotion-side-effect-ledger-check.js

@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// core-skill:promotion-side-effect-ledger (1.20.2 Area 3.3).
-//
-// Proves release-owned skill snapshot promotion is recorded in the mutation
-// ledger as a 'skill_snapshot_promotion' entry with a backup/rollback pointer,
-// and that ledger write failure blocks deployment instead of succeeding.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const { createCandidateCard, routeSkillId } = await importDist('core/skills/core-skill-card.js');
-const { promoteToDeployedWithLedger, promoteToDeployedLegacyForCompatibility } = await importDist('core/skills/core-skill-deployment.js');
-const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
-const { mutationLedgerPath } = await importDist('core/safety/mutation-ledger.js');
-const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-promo-'));
-const route = '$DFix';
-const skillId = routeSkillId(route);
-const contract = createRequestedScopeContract({
-    route: 'skill-promotion', userRequest: 'deploy accepted skill', projectRoot: root,
-    overrides: { skill_snapshot_promotion: true }
-});
-// First deploy (no previous snapshot → no backup, uses no_op reason).
-const c1 = { ...createCandidateCard({ skillId, route, baseVersion: 0, body: 'v1 body' }), status: 'accepted' };
-const p1 = await promoteToDeployedWithLedger(root, c1, { contract, context: 'release' });
-assertGate(p1.ok === true, 'first promotion must succeed', { p1 });
-// Second deploy (higher version) → archives previous as the rollback pointer.
-const c2 = { ...createCandidateCard({ skillId, route, baseVersion: 1, body: 'v2 body' }), status: 'accepted' };
-const p2 = await promoteToDeployedWithLedger(root, c2, { contract, context: 'release' });
-assertGate(p2.ok === true, 'second promotion must succeed', { p2 });
-assertGate(typeof p2.archived_path === 'string' && p2.archived_path.length > 0, 'second promotion must produce a rollback pointer (archived_path)', { p2 });
-// Ledger must contain skill_snapshot_promotion entries, none in violation, the
-// versioned one carrying the archived backup_path.
-const ledgerText = fs.readFileSync(mutationLedgerPath(root), 'utf8');
-const entries = ledgerText.split('\n').filter(Boolean).map((l) => JSON.parse(l));
-const promotions = entries.filter((e) => e.kind === 'skill_snapshot_promotion');
-assertGate(promotions.length >= 2, 'each promotion must be recorded in the mutation ledger', { count: promotions.length });
-assertGate(promotions.every((e) => e.violation === false), 'in-scope confirmed promotions must not be violations', { promotions });
-assertGate(promotions.some((e) => e.backup_path && /deployed-history/.test(String(e.backup_path))), 'a promotion entry must reference the archived rollback pointer', { promotions });
-// Release-owned ledger failure must block the deployment and roll back the pointer.
-const ledgerFailureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-promo-ledgerfail-'));
-const ledgerBlocker = path.join(ledgerFailureRoot, 'not-a-dir');
-fs.writeFileSync(ledgerBlocker, 'block ledger directory creation');
-const cFail = { ...createCandidateCard({ skillId, route, baseVersion: 0, body: 'ledger fail body' }), status: 'accepted' };
-const pFail = await promoteToDeployedWithLedger(ledgerFailureRoot, cFail, { contract, context: 'release', ledgerRoot: ledgerBlocker });
-assertGate(pFail.ok === false && pFail.blockers.some((b) => String(b).startsWith('promotion_ledger_write_failed')), 'ledger write failure must hard-fail release promotion', { pFail });
-assertGate(!fs.existsSync(path.join(ledgerFailureRoot, '.sneakoscope', 'skills', routeSkillId(route), skillId, 'deployed.json')), 'failed first deployment must not leave deployed snapshot behind', { pFail });
-// Regression: explicit legacy wrapper remains available only for compatibility fixtures.
-const fresh = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-promo-2arg-'));
-const c3 = { ...createCandidateCard({ skillId, route, baseVersion: 0, body: 'b' }), status: 'accepted' };
-const p3 = await promoteToDeployedLegacyForCompatibility(fresh, c3);
-assertGate(p3.ok === true && p3.snapshot !== null, 'legacy compatibility promotion must still return ok', { p3 });
-assertGate(!fs.existsSync(mutationLedgerPath(fresh)), 'legacy compatibility promotion must not write a ledger', {});
-fs.rmSync(root, { recursive: true, force: true });
-fs.rmSync(fresh, { recursive: true, force: true });
-fs.rmSync(ledgerFailureRoot, { recursive: true, force: true });
-emitGate('core-skill:promotion-side-effect-ledger', {
-    promotions: promotions.length,
-    rollback_pointer: true,
-    two_arg_safe: true,
-    ledger_failure_hard_fail: true,
-    legacy_wrapper_safe: true
-});
-//# sourceMappingURL=core-skill-promotion-side-effect-ledger-check.js.map

package/dist/scripts/core-skill-rollout-scoring-check.js

@@ -1,72 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:rollout-scoring
-// Proves the rollout scorer rewards proof + zero side effects, treats a
-// requested-scope/side-effect violation as a hard fail, and persists a score report.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root, exists } from './sks-1-18-gate-lib.js';
-const traceMod = await importDist('core/skills/core-rollout-trace.js');
-const scorerMod = await importDist('core/skills/core-skill-scorer.js');
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-rollout-score-'));
-// 1) Clean rollout: proof present, no side effects, rollback ready, scope compliant.
-const cleanTrace = traceMod.createRolloutTrace({
-    route: 'DFix',
-    backend: 'fake',
-    prompt: 'fix the bug',
-    proof_artifacts: ['p.json'],
-    side_effect_ledger: [],
-    rollback_ready: true,
-    requested_scope_compliant: true,
-    latency_ms: 1000,
-    failure_reason: null
-});
-const cleanScore = scorerMod.scoreRollout(cleanTrace);
-assertGate(cleanScore.score > 0, 'clean rollout score must be positive', cleanScore);
-assertGate(cleanScore.side_effect_violation === false, 'clean rollout must not be a side-effect violation', cleanScore);
-assertGate(cleanScore.components.proof_completeness === 1, 'clean rollout proof_completeness must be 1', cleanScore.components);
-assertGate(cleanScore.components.side_effect_zero === 1, 'clean rollout side_effect_zero must be 1', cleanScore.components);
-// 2) Side-effect violation: out-of-scope global write is a HARD fail.
-const violationTrace = traceMod.createRolloutTrace({
-    route: 'DFix',
-    backend: 'fake',
-    prompt: 'fix the bug',
-    proof_artifacts: ['p.json'],
-    side_effect_ledger: ['global_config_write'],
-    rollback_ready: true,
-    requested_scope_compliant: false,
-    latency_ms: 1000,
-    failure_reason: null
-});
-const violationScore = scorerMod.scoreRollout(violationTrace);
-assertGate(violationScore.side_effect_violation === true, 'out-of-scope rollout must flag side_effect_violation', violationScore);
-assertGate(violationScore.score < 0, 'side-effect violation must drive score negative (hard fail)', violationScore);
-// 3) Proof-less success scores lower (proof_completeness 0).
-const prooflessTrace = traceMod.createRolloutTrace({
-    route: 'DFix',
-    backend: 'fake',
-    prompt: 'fix the bug',
-    proof_artifacts: [],
-    side_effect_ledger: [],
-    rollback_ready: true,
-    requested_scope_compliant: true,
-    latency_ms: 1000,
-    failure_reason: null
-});
-const prooflessScore = scorerMod.scoreRollout(prooflessTrace);
-assertGate(prooflessScore.components.proof_completeness === 0, 'proof-less rollout proof_completeness must be 0', prooflessScore.components);
-assertGate(prooflessScore.score < cleanScore.score, 'proof-less rollout must score lower than clean rollout', { proofless: prooflessScore.score, clean: cleanScore.score });
-// 4) Baseline vs candidate aggregate comparison.
-const cleanAgg = scorerMod.scoreRollouts([cleanTrace]);
-const prooflessAgg = scorerMod.scoreRollouts([prooflessTrace]);
-assertGate(cleanAgg.score > prooflessAgg.score, 'aggregate clean score must beat aggregate proof-less score', { clean: cleanAgg.score, proofless: prooflessAgg.score });
-// 5) Persist the score report and confirm the artifact exists under a temp root.
-const writtenPath = await scorerMod.writeRolloutScore(tempRoot, cleanScore);
-assertGate(fs.existsSync(writtenPath), 'writeRolloutScore must create the report file', { writtenPath });
-assertGate(fs.existsSync(path.join(tempRoot, '.sneakoscope', 'reports', 'core-skill-rollout-score.json')), 'report must live at .sneakoscope/reports/core-skill-rollout-score.json', { tempRoot });
-fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
-fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-rollout-scoring-check.json'), `${JSON.stringify({ gate: 'core-skill:rollout-scoring', clean_score: cleanScore.score, violation_score: violationScore.score, proofless_score: prooflessScore.score }, null, 2)}\n`);
-fs.rmSync(tempRoot, { recursive: true, force: true });
-emitGate('core-skill:rollout-scoring', { clean_score: cleanScore.score, violation_hard_fail: violationScore.score < 0, proofless_lower: prooflessScore.score < cleanScore.score, report_written: exists('.sneakoscope/reports/core-skill-rollout-scoring-check.json') });
-//# sourceMappingURL=core-skill-rollout-scoring-check.js.map

package/dist/scripts/core-skill-route-runtime-integration-check.js

@@ -1,49 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// core-skill:route-runtime-integration (1.20.2 Area 3.1).
-//
-// Proves the route runtime reads the deployed Core Skill snapshot and records it
-// in proof: (1) selectRouteSkill returns source:'deployed' + optimizer_invoked:false
-// for a deployed snapshot, (2) a missing snapshot is a graceful 'fallback' with a
-// warning (route still runs), and (3) the agent-proof-evidence builder emits the
-// selected_core_skill field.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const { createCandidateCard, routeSkillId } = await importDist('core/skills/core-skill-card.js');
-const { promoteToDeployedWithLedger } = await importDist('core/skills/core-skill-deployment.js');
-const { selectRouteSkill, skillProofRecord } = await importDist('core/skills/core-skill-runtime.js');
-const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
-const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-rt-'));
-const route = '$Agent';
-const skillId = routeSkillId(route);
-const promotionContract = createRequestedScopeContract({
-    route: 'core-skill-route-runtime-integration',
-    userRequest: 'release gate fixture skill promotion',
-    projectRoot: root,
-    overrides: { skill_snapshot_promotion: true }
-});
-// Missing snapshot → graceful fallback.
-const missing = await selectRouteSkill(root, route, skillId);
-assertGate(missing.source === 'fallback', 'missing snapshot must be a graceful fallback', { missing });
-assertGate(typeof missing.warning === 'string' && missing.warning.length > 0, 'missing snapshot must carry a warning', { missing });
-// Deploy a snapshot, then select it.
-const candidate = createCandidateCard({ skillId, route, baseVersion: 0, body: 'Route skill body.' });
-const accepted = { ...candidate, status: 'accepted' };
-const promoted = await promoteToDeployedWithLedger(root, accepted, { contract: promotionContract, context: 'release' });
-assertGate(promoted.ok === true, 'ledger promotion must succeed', { promoted });
-const selection = await selectRouteSkill(root, route, skillId);
-assertGate(selection.source === 'deployed', 'deployed snapshot must be selected', { selection });
-assertGate(typeof selection.instruction === 'string', 'deployed selection must carry an instruction fragment', { selection });
-const proof = skillProofRecord(selection);
-assertGate(proof.optimizer_invoked === false, 'route skill selection must never invoke the optimizer', { proof });
-assertGate(proof.skill_id === skillId && typeof proof.hash === 'string', 'proof record must carry skill_id + hash', { proof });
-// The agent-proof-evidence builder must surface a selected_core_skill field.
-const evidenceSource = fs.readFileSync(path.join(process.cwd(), 'src/core/agents/agent-proof-evidence.ts'), 'utf8');
-assertGate(/selected_core_skill\s*:/.test(evidenceSource), 'agent-proof-evidence must emit selected_core_skill', {});
-const orchestratorSource = fs.readFileSync(path.join(process.cwd(), 'src/core/agents/agent-orchestrator.ts'), 'utf8');
-assertGate(/selectRouteSkill\(/.test(orchestratorSource) && /selectedCoreSkill/.test(orchestratorSource), 'orchestrator must wire selectRouteSkill into the proof', {});
-fs.rmSync(root, { recursive: true, force: true });
-emitGate('core-skill:route-runtime-integration', { route, skill_id: skillId, deployed_selected: true, fallback_graceful: true });
-//# sourceMappingURL=core-skill-route-runtime-integration-check.js.map

package/dist/scripts/dfix-fast-blackbox-check.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { emitGate } from './sks-1-12-real-execution-check-lib.js';
-const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-fast-blackbox-'));
-fs.mkdirSync(path.join(root, '.sneakoscope'), { recursive: true });
-fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({
-    private: true,
-    type: 'module',
-    scripts: {
-        test: 'node test.mjs',
-        'test:unit': 'node test.mjs',
-        'dfix:fixture': 'node test.mjs',
-        'dfix:verification': 'node test.mjs'
-    }
-}, null, 2));
-fs.writeFileSync(path.join(root, 'value.js'), 'export const value = "bad";\n');
-fs.writeFileSync(path.join(root, 'test.mjs'), 'import { value } from "./value.js"; if (value !== "good") throw new Error("expected good");\n');
-const sks = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
-const env = { ...process.env, SKS_DISABLE_UPDATE_CHECK: '1' };
-const diagnose = run(root, sks, ['dfix', 'diagnose', 'fix value', '--file', 'value.js', '--error', 'AssertionError: expected good at value.js:1', '--json'], env);
-const mission = JSON.parse(diagnose.stdout).mission_id;
-const patch = run(root, sks, ['dfix', 'patch', mission, '--file', 'value.js', '--find', 'bad', '--replace', 'good', '--apply', '--json'], env);
-const verify = run(root, sks, ['dfix', 'verify', mission, '--command', 'node test.mjs', '--verify-auto', '--json'], env);
-const ok = diagnose.status === 0 && patch.status === 0 && verify.status === 0 && fs.readFileSync(path.join(root, 'value.js'), 'utf8').includes('"good"');
-console.log(JSON.stringify({ schema: 'sks.dfix-fast-blackbox-check.v1', ok, mission_id: mission, root }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-else
-    emitGate('dfix:blackbox-fast', { mission_id: mission });
-function run(cwd, bin, args, env) {
-    return spawnSync(process.execPath, [bin, ...args], { cwd, env, encoding: 'utf8', timeout: 30_000 });
-}
-//# sourceMappingURL=dfix-fast-blackbox-check.js.map

package/dist/scripts/dfix-fast-kernel-check.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
-requireContains('dfix:fast-kernel', 'src/core/dfix.ts', [
-    'DFIX_ERROR_SIGNATURE_ARTIFACT',
-    'DFIX_PATH_DECISION_ARTIFACT',
-    'DFIX_PATCH_RUNNER_RESULT_ARTIFACT',
-    'DFIX_VERIFICATION_SELECTION_ARTIFACT',
-    'dfix-performance-report.json'
-]);
-for (const file of [
-    'src/core/dfix/error-signature.ts',
-    'src/core/dfix/dfix-cache.ts',
-    'src/core/dfix/path-decision.ts',
-    'src/core/dfix/root-cause-ranking.ts',
-    'src/core/dfix/patch-templates.ts',
-    'src/core/dfix/patch-runner.ts',
-    'src/core/dfix/codex-handoff.ts',
-    'src/core/dfix/verification-selector.ts',
-    'src/core/dfix/verification-runner.ts',
-    'src/core/dfix/performance.ts'
-]) {
-    requireContains('dfix:fast-kernel', file, ['sks.dfix']);
-}
-emitGate('dfix:fast-kernel', { paths: ['L0', 'L1', 'L2', 'L3'], artifacts: 10 });
-//# sourceMappingURL=dfix-fast-kernel-check.js.map

package/dist/scripts/dfix-fixture-check.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { emitGate, runDfixFixture } from './sks-1-11-gate-lib.js';
-const result = runDfixFixture();
-emitGate('dfix:fixture', { mission_id: result.mission_id });
-//# sourceMappingURL=dfix-fixture-check.js.map

package/dist/scripts/dfix-parallel-write-blackbox.js

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-patch-'));
-fs.writeFileSync(path.join(tmp, 'copy.txt'), 'old label\n');
-const envelope = {
-    schema: 'sks.agent-patch-envelope.v1',
-    agent_id: 'dfix-fast-lane',
-    session_id: 'dfix-session',
-    slot_id: 'dfix-slot',
-    generation_index: 1,
-    lease_id: 'lease:dfix-fast-lane:copy.txt',
-    operations: [{ op: 'replace', path: 'copy.txt', search: 'old label', replace: 'new label' }]
-};
-const applied = await applyMod.applyAgentPatchEnvelope(tmp, envelope);
-const dfixFile = path.join(tmp, 'dfix-route.txt');
-fs.writeFileSync(dfixFile, 'old label\n');
-const diagnose = spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'diagnose', 'dfix parallel write route fixture', '--file', dfixFile, '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 });
-const diagnoseJson = parseJson(diagnose.stdout);
-const plan = diagnoseJson?.mission_id
-    ? spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'plan', diagnoseJson.mission_id, '--file', dfixFile, '--write-mode', 'parallel', '--apply-patches', '--dry-run-patches', '--max-write-agents', '1', '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 })
-    : { status: 1, stdout: '', stderr: 'diagnose mission missing' };
-const planJson = parseJson(plan.stdout);
-const routePolicy = planJson?.patch_plan?.route_parallel_write || null;
-const report = { schema: 'sks.dfix-parallel-write-blackbox.v1', ok: applied.ok && diagnose.status === 0 && plan.status === 0 && routePolicy?.route_level_flags_wired === true, applied, route_command: { diagnose_status: diagnose.status, plan_status: plan.status, mission_id: diagnoseJson?.mission_id || null, route_policy: routePolicy, stderr_tail: `${diagnose.stderr || ''}${plan.stderr || ''}`.slice(-2000) } };
-const out = path.join(root, '.sneakoscope', 'reports', 'dfix-parallel-write-blackbox.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(applied.ok === true, 'DFix parallel write blackbox patch failed', report);
-assertGate(fs.readFileSync(path.join(tmp, 'copy.txt'), 'utf8') === 'new label\n', 'DFix parallel write blackbox content mismatch', report);
-assertGate(routePolicy?.write_mode === 'parallel', 'DFix route must record --write-mode parallel', report);
-assertGate(routePolicy?.apply_patches === true, 'DFix route must record --apply-patches', report);
-assertGate(routePolicy?.dry_run_patches === true, 'DFix route must record --dry-run-patches', report);
-emitGate('dfix:parallel-write-blackbox', { changed_files: applied.changed_files.length });
-function parseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=dfix-parallel-write-blackbox.js.map

package/dist/scripts/dfix-patch-handoff-check.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
-requireContains('dfix:patch-handoff', 'src/core/dfix.ts', [
-    'codex_patch_handoff',
-    'buildDfixCodexPatchPrompt',
-    'git_diff_before',
-    'git_diff_after',
-    'rollback_plan',
-    'explicit_apply_opt_in'
-]);
-emitGate('dfix:patch-handoff', { patch_mode: 'exact-find-replace-or-codex-handoff', diff_capture: true });
-//# sourceMappingURL=dfix-patch-handoff-check.js.map

package/dist/scripts/dfix-patch-swarm-route-blackbox.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { runPatchSwarmRouteBlackbox } from './agent-patch-swarm-gate-lib.js';
-await runPatchSwarmRouteBlackbox({
-    gate: 'dfix:patch-swarm-route-blackbox',
-    route: '$DFix',
-    routeCommand: 'sks dfix',
-    reportName: 'dfix-patch-swarm-route-blackbox'
-});
-//# sourceMappingURL=dfix-patch-swarm-route-blackbox.js.map

package/dist/scripts/dfix-performance-check.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { DFIX_SPEED_BUDGETS_MS } from '../core/dfix/performance.js';
-const ok = DFIX_SPEED_BUDGETS_MS.diagnose_cold_source_local <= 500
-    && DFIX_SPEED_BUDGETS_MS.path_decision <= 100
-    && DFIX_SPEED_BUDGETS_MS.deterministic_patch_plan <= 300
-    && DFIX_SPEED_BUDGETS_MS.dry_run_patch_handoff_without_codex <= 500
-    && DFIX_SPEED_BUDGETS_MS.exact_patch_apply_small_file <= 1000
-    && DFIX_SPEED_BUDGETS_MS.verification_selector <= 300
-    && DFIX_SPEED_BUDGETS_MS.no_codex_full_loop_fixture <= 3000
-    && DFIX_SPEED_BUDGETS_MS.codex_handoff_timeout <= 60000;
-console.log(JSON.stringify({ schema: 'sks.dfix-performance-check.v1', ok, budgets_ms: DFIX_SPEED_BUDGETS_MS }, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=dfix-performance-check.js.map

package/dist/scripts/dfix-verification-check.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readMissionJson, runDfixFixture } from './sks-1-11-gate-lib.js';
-const result = runDfixFixture();
-const verification = readMissionJson(result.mission_id, 'dfix-verification.json');
-const proof = readMissionJson(result.mission_id, 'completion-proof.json');
-assertGate(verification.status === 'passed' && proof.evidence?.dfix?.verification_status === 'passed', 'dfix verification evidence missing from proof', { verification, dfix: proof.evidence?.dfix });
-emitGate('dfix:verification', { mission_id: result.mission_id });
-//# sourceMappingURL=dfix-verification-check.js.map

package/dist/scripts/dfix-verification-recommendation-check.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
-requireContains('dfix:verification-recommendation', 'src/core/dfix.ts', [
-    'DFIX_VERIFICATION_SUGGESTION_ARTIFACT',
-    'writeDfixVerificationSuggestion',
-    'suggested_verification_commands',
-    'auto_run_requires_opt_in',
-    'recovery_action'
-]);
-requireContains('dfix:verification-recommendation', 'src/core/commands/dfix-command.ts', [
-    '--verify-auto'
-]);
-emitGate('dfix:verification-recommendation', { artifact: 'dfix-verification-suggestion.json' });
-//# sourceMappingURL=dfix-verification-recommendation-check.js.map

package/dist/scripts/docs-truthfulness-check.js

@@ -1,61 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const files = [
-    'README.md',
-    'CHANGELOG.md',
-    'docs/computer-use-evidence.md',
-    'docs/codex-lb.md',
-    'docs/codex-0.136-compat.md',
-    'docs/codex-0.135-compat.md',
-    'docs/codex-cli-compat.md',
-    'docs/official-docs-compat.md',
-    'docs/hooks-pat.md',
-    'docs/known-gaps.md',
-    'docs/release-readiness.md'
-];
-const required = {
-    'README.md': ['CHANGELOG.md', 'docs/release-readiness.md', 'gpt-image-2'],
-    'CHANGELOG.md': ['1.14.0', 'DFix Extreme Speed Kernel', 'hook trust doctor', 'warning-zero'],
-    'docs/computer-use-evidence.md': ['sks.computer-use-live-evidence.v1', 'probe_only', 'live_capture_blocked', 'local-only', 'Codex Chrome Extension'],
-    'docs/codex-lb.md': ['durable_env_file', 'durable_keychain', 'durable_launchctl', 'shell_profile', 'process_only_ephemeral'],
-    'docs/codex-0.136-compat.md': ['rust-v0.136.0', 'codex:0.136-compat', 'codex archive', 'codex app-server --stdio', 'CODEX_API_KEY', 'server tokens'],
-    'docs/codex-0.135-compat.md': ['rust-v0.135.0', 'codex:0.135-compat', 'named permission profiles'],
-    'docs/codex-cli-compat.md': ['rust-v0.136.0', 'session_archive_restore', 'profile_primary_selector', 'managed_network_proxy_env', 'goals_default_enabled', 'permission_profiles_requirements', 'SubagentStart', 'sks_zero_warning_disallowed', 'strict subset'],
-    'docs/official-docs-compat.md': ['official-docs:compat', 'rust-v0.136.0', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
-    'docs/hooks-pat.md': ['SubagentStop', 'strict subset', 'zero-warning'],
-    'docs/known-gaps.md': ['No P0', 'P1'],
-    'docs/release-readiness.md': ['sks.release-readiness.v1', 'release:readiness', 'official-docs:compat']
-};
-const forbidden = [
-    /Computer Use is always available/i,
-    /live evidence is guaranteed/i,
-    /Browser Use evidence is Computer Use evidence/i,
-    /process-only setup is durable/i,
-    /screenshots are published to shared TriWiki automatically/i
-];
-const results = [];
-for (const file of files) {
-    const full = path.join(root, file);
-    const text = fs.existsSync(full) ? fs.readFileSync(full, 'utf8') : '';
-    const missing = (required[file] || []).filter((needle) => !text.includes(needle));
-    const forbiddenMatches = forbidden.filter((pattern) => pattern.test(text)).map(String);
-    results.push({
-        file,
-        ok: Boolean(text) && missing.length === 0 && forbiddenMatches.length === 0,
-        missing,
-        forbidden: forbiddenMatches
-    });
-}
-const ok = results.every((row) => row.ok);
-console.log(JSON.stringify({
-    schema: 'sks.docs-truthfulness-check.v1',
-    ok,
-    results
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=docs-truthfulness-check.js.map

package/dist/scripts/doctor-codex-doctor-parity-check.js

@@ -1,17 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok)
-    fail('dist_not_fresh', { freshness });
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'doctor', 'codex-doctor-bridge.js')).href);
-const report = await mod.runCodexDoctorBridge({ cwd: root, required: process.argv.includes('--actual-codex') });
-const requiredFields = ['available', 'exit_code', 'environment_diagnostics_ok', 'git_diagnostics_ok', 'terminal_diagnostics_ok', 'app_server_diagnostics_ok', 'thread_inventory_ok', 'blockers', 'warnings'];
-const ok = requiredFields.every((field) => Object.prototype.hasOwnProperty.call(report, field)) && (!process.argv.includes('--actual-codex') || report.blockers.length === 0);
-emit({ schema: 'sks.doctor-codex-doctor-parity-check.v1', ok, report, required_fields: requiredFields });
-function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
-    process.exitCode = 1; }
-function fail(blocker, detail) { emit({ schema: 'sks.doctor-codex-doctor-parity-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
-//# sourceMappingURL=doctor-codex-doctor-parity-check.js.map