sneakoscope 2.0.4 → 2.0.6

package/dist/scripts/local-llm-throughput-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const scheduler = await importDist('core/local-llm/local-llm-scheduler.js');
+const plan = scheduler.planLocalLlmSchedule({ workItems: Array.from({ length: 20 }, (_, i) => ({ id: i })), maxParallelRequests: 4 });
+assertGate(plan.ok === true, 'local scheduler must not exceed max parallel requests');
+assertGate(plan.active_requests <= plan.max_parallel_requests, 'active requests exceeded max_parallel_requests');
+assertGate(plan.queued_count === 16, '20 worker fixture should queue work beyond max parallel requests');
+emitGate('local-llm:throughput', { active_requests: plan.active_requests, queued_count: plan.queued_count, backpressure: plan.backpressure });
+//# sourceMappingURL=local-llm-throughput-check.js.map

package/dist/scripts/local-llm-tool-call-repair-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const mod = await importDist('core/local-llm/local-llm-json-repair.js');
+const repaired = mod.parseOrRepairLocalLlmJson('Here is JSON: {"status":"ok","summary":"done"} thanks');
+const failed = mod.parseOrRepairLocalLlmJson('not json at all');
+assertGate(repaired.ok === true && repaired.repaired === true && repaired.attempts === 1, 'bounded JSON repair should recover one object');
+assertGate(failed.ok === false && failed.attempts === 1, 'invalid local JSON must fail after one repair attempt');
+emitGate('local-llm:tool-call-repair', { repaired: repaired.ok, failed: failed.ok });
+//# sourceMappingURL=local-llm-tool-call-repair-check.js.map

package/dist/scripts/local-llm-warmup-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
+const cfg = await importDist('core/agents/ollama-worker-config.js');
+const warmup = await importDist('core/local-llm/local-llm-warmup.js');
+const state = warmup.buildLocalLlmWarmupState(cfg.normalizeLocalModelConfig({ enabled: true, status: 'enabled_unverified' }), { ok: true, ttlMs: 1000 });
+assertGate(state.explicit_only === true, 'local warmup must be explicit only');
+assertGate(state.postinstall_allowed === false, 'postinstall must not run local warmup');
+assertGate(state.release_check_real_warmup_allowed === false, 'release:check must not run real warmup');
+emitGate('local-llm:warmup', { explicit_only: state.explicit_only, expires_at: state.expires_at });
+//# sourceMappingURL=local-llm-warmup-check.js.map

package/dist/scripts/naruto-active-pool-check.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const governorMod = await importDist('core/naruto/naruto-concurrency-governor.js');
+const activePool = await importDist('core/naruto/naruto-active-pool.js');
+const graph = workGraph.buildNarutoWorkGraph({ requestedClones: 20, totalWorkItems: 20, writeCapable: true, maxActiveWorkers: 5 });
+const governor = governorMod.decideNarutoConcurrency({
+    requestedClones: 20,
+    totalWorkItems: 20,
+    pendingWorkQueueSize: 20,
+    backend: 'fake',
+    hardware: { remoteApiRateLimitBudget: 5, fileDescriptorLimit: 4096, freeMemoryBytes: 8 * 1024 * 1024 * 1024, totalMemoryBytes: 16 * 1024 * 1024 * 1024 }
+});
+const report = activePool.simulateNarutoActivePool({ graph, governor: { ...governor, safe_active_workers: 5 } });
+assertGate(report.ok === true, 'active pool must drain cleanly', report);
+assertGate(report.max_observed_active_workers <= 5, 'active pool must never exceed safe cap', report);
+assertGate(report.max_observed_write_lease_conflicts === 0, 'active pool must never run overlapping write leases concurrently', report);
+assertGate(report.completed_count >= graph.total_work_items, 'active pool must complete all base work items', report);
+assertGate(report.refill_events >= 5, 'active pool must refill slots as work drains', report);
+assertGate(report.duplicate_execution_count === 0, 'active pool must not duplicate work without retry', report);
+const sameLeaseGraph = workGraph.buildNarutoWorkGraph({
+    requestedClones: 10,
+    totalWorkItems: 10,
+    writeCapable: true,
+    targetPaths: ['src/shared-fixture.ts'],
+    maxActiveWorkers: 5
+});
+const sameLeaseReport = activePool.simulateNarutoActivePool({ graph: sameLeaseGraph, governor: { ...governor, safe_active_workers: 5 } });
+assertGate(sameLeaseReport.ok === true, 'same-file work graph must drain without overlapping write leases', sameLeaseReport);
+assertGate(sameLeaseReport.max_observed_write_lease_conflicts === 0, 'same-file write items must be serialized or interleaved with read-only work only', sameLeaseReport);
+emitGate('naruto:active-pool', {
+    safe_active_workers: report.safe_active_workers,
+    completed_count: report.completed_count,
+    refill_events: report.refill_events,
+    max_observed_active_workers: report.max_observed_active_workers,
+    same_lease_max_write_conflicts: sameLeaseReport.max_observed_write_lease_conflicts
+});
+//# sourceMappingURL=naruto-active-pool-check.js.map

package/dist/scripts/naruto-concurrency-governor-check.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const governorMod = await importDist('core/naruto/naruto-concurrency-governor.js');
+const normal = governorMod.decideNarutoConcurrency({
+    requestedClones: 200,
+    totalWorkItems: 340,
+    pendingWorkQueueSize: 340,
+    backend: 'codex-sdk',
+    zellijVisiblePaneCap: 12,
+    hardware: {
+        cores: 32,
+        freeMemoryBytes: 48 * 1024 * 1024 * 1024,
+        totalMemoryBytes: 64 * 1024 * 1024 * 1024,
+        fileDescriptorLimit: 4096,
+        localLlmMaxParallelRequests: 4,
+        remoteApiRateLimitBudget: 32,
+        terminalRows: 40,
+        terminalColumns: 140
+    }
+});
+const pressure = governorMod.decideNarutoConcurrency({
+    requestedClones: 200,
+    totalWorkItems: 340,
+    pendingWorkQueueSize: 340,
+    backend: 'codex-sdk',
+    zellijVisiblePaneCap: 12,
+    hardware: {
+        cores: 8,
+        loadAverage: [16, 16, 16],
+        freeMemoryBytes: 256 * 1024 * 1024,
+        totalMemoryBytes: 4 * 1024 * 1024 * 1024,
+        fileDescriptorLimit: 128,
+        localLlmMaxParallelRequests: 4,
+        remoteApiRateLimitBudget: 32,
+        zellijPaneCount: 12,
+        diskIoPressure: 0.9
+    }
+});
+assertGate(normal.safe_active_workers <= 32, 'requested_clones=200 fixture must cap active workers safely', { normal });
+assertGate(normal.safe_zellij_visible_panes === 12 && normal.headless_workers === normal.safe_active_workers - 12, 'zellij visible panes must stay within UI cap', { normal });
+assertGate(normal.local_llm_parallel <= 4, 'local LLM active requests must respect max_parallel_requests=4', { normal });
+assertGate(pressure.safe_active_workers < normal.safe_active_workers, 'memory/load pressure fixture must decrease active workers', { normal: normal.safe_active_workers, pressure: pressure.safe_active_workers });
+assertGate(pressure.backpressure === 'saturated' || pressure.backpressure === 'throttled', 'pressure fixture must report backpressure', { pressure });
+emitGate('naruto:concurrency-governor', {
+    requested_clones: normal.requested_clones,
+    total_work_items: normal.total_work_items,
+    safe_active_workers: normal.safe_active_workers,
+    safe_zellij_visible_panes: normal.safe_zellij_visible_panes,
+    pressure_safe_active_workers: pressure.safe_active_workers
+});
+//# sourceMappingURL=naruto-concurrency-governor-check.js.map

package/dist/scripts/naruto-gpt-final-pack-check.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const roles = await importDist('core/naruto/naruto-role-policy.js');
+const packMod = await importDist('core/naruto/naruto-gpt-final-pack.js');
+const graph = workGraph.buildNarutoWorkGraph({ requestedClones: 100, totalWorkItems: 120, writeCapable: true });
+const roleDistribution = roles.buildNarutoRoleDistribution(graph.work_items);
+const patchEnvelopes = Array.from({ length: 120 }, (_, index) => ({ id: index, token: 'sk-testsecret1234567890', file: `f-${index}.ts` }));
+const logs = Array.from({ length: 40 }, (_, index) => `log ${index} api_key=secret-${index}`);
+const pack = packMod.buildNarutoGptFinalPack({
+    missionId: 'M-naruto-pack',
+    graph,
+    roleDistribution,
+    changedFiles: ['src/a.ts', 'src/a.ts', 'src/b.ts'],
+    patchEnvelopes,
+    verificationResults: [{ ok: true }],
+    failedShards: [{ id: 'failed-1' }],
+    conflictMap: [{ path: 'src/a.ts' }],
+    rollbackPlan: { token: 'sk-abc12345678901234567' },
+    logs
+});
+const serialized = JSON.stringify(pack);
+assertGate(pack.bounded === true && pack.secrets_redacted === true, 'GPT final pack must be bounded and redacted', pack);
+assertGate(pack.patch_envelopes.length === 100, '100 worker results must compress to bounded patch envelope count', { count: pack.patch_envelopes.length });
+assertGate(pack.representative_logs.length === 12, 'representative logs must be bounded', { count: pack.representative_logs.length });
+assertGate(!serialized.includes('secret-') && !serialized.includes('sk-testsecret'), 'secrets must be redacted from final pack', pack);
+assertGate(pack.role_distribution.ok === true && pack.work_graph_summary.write_allowed_count > 0, 'final pack must include role distribution and write work summary', pack);
+emitGate('naruto:gpt-final-pack', {
+    patch_envelopes: pack.patch_envelopes.length,
+    representative_logs: pack.representative_logs.length,
+    changed_files: pack.changed_files
+});
+//# sourceMappingURL=naruto-gpt-final-pack-check.js.map

package/dist/scripts/naruto-parallel-patch-apply-check.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const patchApply = await importDist('core/naruto/naruto-parallel-patch-apply.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-naruto-patch-'));
+const envelopes = Array.from({ length: 10 }, (_, index) => {
+    const file = `file-${index}.txt`;
+    return envelope(index + 1, file, `after-${index}`);
+});
+const result = await patchApply.applyNarutoPatchEnvelopes(root, envelopes, { dryRun: false });
+assertGate(result.ok === true, 'non-overlapping patch fixture must apply', result);
+assertGate(result.batch_count === 1 && result.parallel_apply_count === 1, 'non-overlapping patch fixture must group into a parallel batch', result);
+assertGate(result.results.every((row) => row.changed_files.length === 1 && Object.keys(row.before_hashes).length === 1 && Object.keys(row.after_hashes).length === 1), 'patch results must include before/after hashes and changed files', result);
+const rollback = await patchApply.rollbackNarutoPatchResult(root, result.results[0]);
+assertGate(rollback.ok === true && rollback.restored.length === 1, 'rollback must restore before content for a patch result', rollback);
+const conflict = await patchApply.applyNarutoPatchEnvelopes(root, [envelope(99, 'same.txt', 'a'), envelope(100, 'same.txt', 'b')], { dryRun: true });
+assertGate(conflict.conflicts.length >= 1, 'overlapping patch fixture must serialize or mark conflict', conflict);
+emitGate('naruto:parallel-patch-apply', {
+    batch_count: result.batch_count,
+    parallel_apply_count: result.parallel_apply_count,
+    conflict_count: conflict.conflicts.length,
+    rollback_restored: rollback.restored.length
+});
+function envelope(index, file, content) {
+    return {
+        schema: 'sks.agent-patch-envelope.v1',
+        source: 'fixture',
+        agent_id: `naruto-${index}`,
+        session_id: `session-${index}`,
+        slot_id: `slot-${index}`,
+        generation_index: 1,
+        task_slice_id: `NW-${index}`,
+        lease_id: `lease-${index}`,
+        allowed_paths: [file],
+        operations: [{ op: 'write', path: file, content }]
+    };
+}
+//# sourceMappingURL=naruto-parallel-patch-apply-check.js.map

package/dist/scripts/naruto-readonly-routing-check.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, exists, importDist, root } from './sks-1-18-gate-lib.js';
+const worker = await importDist('core/agents/agent-worker-pipeline.js');
+const cli = path.join(root, 'dist', 'bin', 'sks.js');
+assertGate(exists('dist/bin/sks.js'), 'dist/bin/sks.js missing (build first)');
+const readOnlyWorker = worker.validateAgentWorkerResult({
+    mission_id: 'M-readonly-routing',
+    agent_id: 'readonly-agent',
+    session_id: 'readonly-session',
+    persona_id: 'verifier',
+    task_slice_id: 'readonly-slice',
+    status: 'done',
+    backend: 'codex-sdk',
+    summary: 'Read-only worker inspected files without proposing a patch.',
+    findings: ['read-only inspection completed'],
+    proposed_changes: [],
+    changed_files: ['src/core/agents/agent-proof-evidence.ts'],
+    lease_compliance: { ok: true, violations: [] },
+    artifacts: [],
+    blockers: [],
+    confidence: 'fixture',
+    handoff_notes: '',
+    unverified: [],
+    writes: [],
+    no_patch_reason: {
+        ok: true,
+        reason: 'read_only_or_no_write_paths',
+        read_only_or_noop_evidence: true
+    },
+    verification: { status: 'passed', checks: ['readonly-no-patch-routing'] }
+});
+assertGate(readOnlyWorker.status === 'done' && !readOnlyWorker.blockers.includes('no_patch_generated'), 'read-only/no-write worker changed_files must not require patch envelopes', readOnlyWorker);
+const writeWorker = worker.validateAgentWorkerResult({
+    ...readOnlyWorker,
+    agent_id: 'write-agent',
+    session_id: 'write-session',
+    task_slice_id: 'write-slice',
+    changed_files: ['src/core/agents/agent-proof-evidence.ts'],
+    no_patch_reason: undefined
+});
+assertGate(writeWorker.status === 'blocked' && writeWorker.blockers.includes('no_patch_generated'), 'write-capable changed_files without patch envelope must still block', writeWorker);
+const readonlyRun = spawnSync(process.execPath, [
+    cli,
+    'naruto',
+    'run',
+    'readonly routing must inspect `src/core/agents/agent-proof-evidence.ts` and `package.json` without writes',
+    '--clones',
+    '4',
+    '--work-items',
+    '4',
+    '--backend',
+    'fake',
+    '--readonly',
+    '--json'
+], { cwd: root, encoding: 'utf8', timeout: 120000, maxBuffer: 6 * 1024 * 1024 });
+const readonlyJson = parseJson(readonlyRun.stdout);
+assertGate(readonlyRun.status === 0 && readonlyJson?.ok === true, 'readonly Naruto fake blackbox must exit ok', { status: readonlyRun.status, stdout: tail(readonlyRun.stdout), stderr: tail(readonlyRun.stderr) });
+assertGate(readonlyJson.proof === 'passed', 'readonly Naruto proof must pass', { proof: readonlyJson.proof, blockers: readonlyJson.run?.proof?.blockers });
+assertGate(readonlyJson.work_graph?.write_allowed_count === 0, 'readonly Naruto work graph must have zero write-allowed items', readonlyJson.work_graph);
+assertGate(Number(readonlyJson.role_distribution?.implementation_like_workers || 0) === 0, 'readonly Naruto role distribution must have zero implementation-like workers', readonlyJson.role_distribution);
+assertGate((readonlyJson.role_distribution?.entries || []).every((entry) => entry.write_allowed === false), 'readonly Naruto role distribution must deny writes for every role', readonlyJson.role_distribution);
+const readonlyRoot = path.join(root, '.sneakoscope', 'missions', readonlyJson.mission_id, 'agents');
+const readonlyProof = readJson(path.join(readonlyRoot, 'agent-proof-evidence.json'));
+const readonlyStrategy = readJson(path.join(readonlyRoot, 'user-request-strategy.json'));
+const readonlyPolicy = readJson(path.join(readonlyRoot, 'agent-parallel-write-policy.json'));
+assertGate(readonlyPolicy.write_mode === 'off' && readonlyPolicy.readonly === true, 'readonly run must force native write policy off', readonlyPolicy);
+assertGate(readonlyStrategy.gate?.write_task_count === 0, 'readonly strategy must not infer write targets from file mentions', readonlyStrategy.gate);
+assertGate(readonlyProof.changed_files_lease_checked === false, 'readonly no-write proof must skip changed_files write-lease checks', readonlyProof);
+assertGate(!(readonlyProof.blockers || []).some((blocker) => /no_patch_generated|lease_changed_file_violation/.test(String(blocker))), 'readonly proof must not contain patch/lease write blockers', readonlyProof.blockers || []);
+const writeRun = spawnSync(process.execPath, [
+    cli,
+    'naruto',
+    'run',
+    'write-capable routing must patch `README.md` through leased envelopes',
+    '--clones',
+    '3',
+    '--work-items',
+    '3',
+    '--backend',
+    'fake',
+    '--parallel-write',
+    '--json'
+], { cwd: root, encoding: 'utf8', timeout: 120000, maxBuffer: 6 * 1024 * 1024 });
+const writeJson = parseJson(writeRun.stdout);
+assertGate(writeRun.status === 0 && writeJson?.ok === true, 'write-capable Naruto fake blackbox must exit ok', { status: writeRun.status, stdout: tail(writeRun.stdout), stderr: tail(writeRun.stderr) });
+const writeRoot = path.join(root, '.sneakoscope', 'missions', writeJson.mission_id, 'agents');
+const writeStrategy = readJson(path.join(writeRoot, 'user-request-strategy.json'));
+const writePolicy = readJson(path.join(writeRoot, 'agent-parallel-write-policy.json'));
+assertGate(writePolicy.write_mode === 'parallel' && writePolicy.readonly === false, 'write-capable Naruto run must carry parallel write policy', writePolicy);
+assertGate(writeStrategy.gate?.write_task_count >= 1, 'write-capable strategy must retain explicit write target inference', writeStrategy.gate);
+emitGate('naruto:readonly-routing', {
+    readonly_mission_id: readonlyJson.mission_id,
+    write_mission_id: writeJson.mission_id,
+    readonly_write_tasks: readonlyStrategy.gate?.write_task_count,
+    write_write_tasks: writeStrategy.gate?.write_task_count
+});
+function readJson(file) {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function tail(value, limit = 2000) {
+    const text = String(value || '');
+    return text.length <= limit ? text : text.slice(-limit);
+}
+//# sourceMappingURL=naruto-readonly-routing-check.js.map

package/dist/scripts/naruto-real-local-gpt-final-smoke.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const finalizer = await importDist('core/naruto/naruto-finalizer.js');
+const draft = finalizer.evaluateNarutoFinalizer({ localParticipated: true, gptFinalStatus: null, applyPatches: true });
+const approved = finalizer.evaluateNarutoFinalizer({ localParticipated: true, gptFinalStatus: 'approved', applyPatches: true });
+const deterministic = finalizer.evaluateNarutoFinalizer({ localParticipated: false, applyPatches: true });
+assertGate(draft.ok === false && draft.blockers.includes('naruto_local_worker_output_needs_gpt_final_arbiter'), 'local worker patch must be blocked until GPT final arbiter', draft);
+assertGate(approved.ok === true && approved.final_patch_source === 'gpt_final_arbiter', 'GPT-approved local output must become final patch source', approved);
+assertGate(deterministic.ok === true && deterministic.gpt_final_required === false, 'no-local deterministic run must not require GPT final', deterministic);
+emitGate('naruto:real-local-gpt-final-smoke', {
+    require_real_env: process.env.SKS_REQUIRE_LOCAL_LLM === '1' || process.env.SKS_REQUIRE_GPT_FINAL === '1',
+    draft_status: draft.final_status,
+    approved_status: approved.final_status
+});
+//# sourceMappingURL=naruto-real-local-gpt-final-smoke.js.map

package/dist/scripts/naruto-role-distribution-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const roles = await importDist('core/naruto/naruto-role-policy.js');
+const roster = await importDist('core/agents/agent-roster.js');
+const graph = workGraph.buildNarutoWorkGraph({ requestedClones: 30, totalWorkItems: 30, writeCapable: true });
+const distribution = roles.buildNarutoRoleDistribution(graph.work_items);
+const cloneRoster = roster.buildNarutoCloneRoster({ clones: 30, prompt: 'implement, modify, test, verify, document, and resolve conflicts' });
+const writeCapableRoster = cloneRoster.roster.filter((row) => row.write_allowed === true);
+assertGate(distribution.ok === true, 'write-capable Naruto role distribution must pass', distribution);
+assertGate(distribution.verifier_only === false, 'default Naruto must not be verifier-only', distribution);
+assertGate(distribution.implementation_like_ratio >= 0.4, 'default Naruto must keep at least 40% implementation/modification/test roles', distribution);
+assertGate(writeCapableRoster.length >= Math.floor(cloneRoster.roster.length * 0.4), 'Naruto roster must include write-capable clone roles by default', { writeCapableRoster: writeCapableRoster.length, total: cloneRoster.roster.length });
+const readonlyGraph = workGraph.buildNarutoWorkGraph({ requestedClones: 8, readonly: true, writeCapable: false });
+const readonlyDistribution = roles.buildNarutoRoleDistribution(readonlyGraph.work_items, { readonly: true });
+assertGate(readonlyDistribution.ok === true, 'readonly Naruto route may use read-only verifier/research roles', readonlyDistribution);
+emitGate('naruto:role-distribution', {
+    implementation_like_ratio: distribution.implementation_like_ratio,
+    entries: distribution.entries,
+    write_capable_roster_count: writeCapableRoster.length
+});
+//# sourceMappingURL=naruto-role-distribution-check.js.map

package/dist/scripts/naruto-shadow-clone-swarm-check.js

@@ -5,6 +5,7 @@
 // changing it for any other route, and that an end-to-end `sks naruto run` actually
 // schedules >20 concurrent clone sessions to completion with proof.
 import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, root, exists } from './sks-1-18-gate-lib.js';
 const schema = await importDist('core/agents/agent-schema.js');
@@ -71,6 +72,9 @@ assertGate(bigMemoryHost.cap >= 64, 'a 64 GB host must allow >= 64 parallel code
 const proofClones = 24;
 const cli = path.join(root, 'dist', 'bin', 'sks.js');
 assertGate(exists('dist/bin/sks.js'), 'dist/bin/sks.js missing (build first)');
+const helpRun = spawnSync(process.execPath, [cli, 'naruto', '--help', '--json'], { cwd: root, encoding: 'utf8', timeout: 30000, maxBuffer: 1024 * 1024 });
+const helpParsed = parseJson(helpRun.stdout);
+assertGate(helpRun.status === 0 && helpParsed?.action === 'help', 'sks naruto --help must emit help instead of launching a run', { status: helpRun.status, stdout: tail(helpRun.stdout), stderr: tail(helpRun.stderr) });
 const run = spawnSync(process.execPath, [
     cli, 'naruto', 'run', 'shadow clone swarm gate proof',
     '--clones', String(proofClones),
@@ -94,6 +98,15 @@ assertGate(parsed.target_active_slots <= fakeSafe.cap, 'active slots must be thr
 assertGate(typeof parsed.concurrency_capped === 'boolean', 'naruto run must report concurrency_capped', { concurrency_capped: parsed.concurrency_capped });
 assertGate(parsed.concurrency_capped === (parsed.clones > parsed.target_active_slots), 'concurrency_capped must reflect clones > live slots', { clones: parsed.clones, target_active_slots: parsed.target_active_slots, concurrency_capped: parsed.concurrency_capped });
 assertGate(parsed.system && Number(parsed.system.safe_concurrency) >= 1, 'naruto run must report system safe_concurrency (host-derived cap)', { system: parsed.system });
+assertGate(parsed.work_graph?.write_allowed_count > 0 && parsed.work_graph?.mixed_work_kinds?.length > 1, 'naruto run must report a mixed work graph with write-capable items', { work_graph: parsed.work_graph });
+assertGate(Number(parsed.work_graph?.parallel_write_wave_count || 0) > 0, 'naruto run must expose at least one parallel write-capable wave with non-overlapping leases', { work_graph: parsed.work_graph });
+assertGate(parsed.role_distribution?.verifier_only === false, 'naruto run proof/status must distinguish active worker roles beyond verifier-only', { role_distribution: parsed.role_distribution });
+assertGate(Number(parsed.role_distribution?.implementation_like_ratio || 0) >= 0.4, 'naruto run must include implementation-like role distribution', { role_distribution: parsed.role_distribution });
+const commandGraphPath = path.join(root, '.sneakoscope', 'missions', parsed.mission_id, 'agents', 'naruto-work-graph.json');
+const commandGraph = JSON.parse(fs.readFileSync(commandGraphPath, 'utf8'));
+const writePaths = commandGraph.work_items.filter((row) => row.write_allowed).flatMap((row) => row.write_paths);
+assertGate(new Set(writePaths).size > 1, 'naruto command default patch-envelope leases must be per work item, not one shared write path', { sample: writePaths.slice(0, 8), unique: new Set(writePaths).size });
+assertGate(commandGraph.active_waves.some((wave) => wave.write_paths.length > 1), 'naruto command graph must contain a parallel write wave when route-local patch envelopes do not overlap', { waves: commandGraph.active_waves.slice(0, 3) });
 const state = parsed.run?.scheduler?.state || parsed.run?.scheduler || {};
 assertGate(Number(state.completed_count) === proofClones, 'all clone work items must complete despite throttling', { completed_count: state.completed_count });
 const explicitConcurrency = spawnSync(process.execPath, [cli, 'naruto', 'run', 'explicit concurrency', '--clones', '6', '--backend', 'fake', '--work-items', '6', '--concurrency', '6', '--json'], { cwd: root, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 });

package/dist/scripts/naruto-verification-pool-check.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const governorMod = await importDist('core/naruto/naruto-concurrency-governor.js');
+const verificationDag = await importDist('core/naruto/naruto-verification-dag.js');
+const verificationPool = await importDist('core/naruto/naruto-verification-pool.js');
+const graph = workGraph.buildNarutoWorkGraph({ requestedClones: 8, totalWorkItems: 12, writeCapable: true });
+const governor = governorMod.decideNarutoConcurrency({
+    requestedClones: 8,
+    totalWorkItems: 12,
+    backend: 'fake',
+    hardware: {
+        cores: 4,
+        loadAverage: [0, 0, 0],
+        remoteApiRateLimitBudget: 8,
+        fileDescriptorLimit: 4096,
+        processCount: 1,
+        zellijPaneCount: 0,
+        diskIoPressure: 0,
+        freeMemoryBytes: 8 * 1024 * 1024 * 1024,
+        totalMemoryBytes: 16 * 1024 * 1024 * 1024
+    }
+});
+const dag = verificationDag.buildNarutoVerificationDag(graph, { cwd: root, command: 'node -e "process.exit(0)"' });
+const report = await verificationPool.runNarutoVerificationPool(dag, { ...governor, verification_parallel: 4 }, { cwd: root });
+assertGate(report.ok === true, 'verification pool must pass all fixture shards', report);
+assertGate(report.safe_concurrency === 4, 'verification pool must use its own safe concurrency', report);
+assertGate(report.task_count > 1, 'verification pool must run multiple shards', report);
+assertGate(report.cpu_heavy_cap_respected && report.io_heavy_cap_respected && report.api_rate_cap_respected, 'verification pool must respect resource caps', report);
+emitGate('naruto:verification-pool', {
+    task_count: report.task_count,
+    safe_concurrency: report.safe_concurrency,
+    passed: report.passed
+});
+//# sourceMappingURL=naruto-verification-pool-check.js.map

package/dist/scripts/naruto-work-graph-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const graph = workGraph.buildNarutoWorkGraph({
+    requestedClones: 24,
+    totalWorkItems: 30,
+    writeCapable: true,
+    targetPaths: Array.from({ length: 30 }, (_, index) => `src/fixture-${index}.ts`),
+    maxActiveWorkers: 8
+});
+const validation = workGraph.validateNarutoWorkGraph(graph);
+assertGate(graph.ok === true && validation.ok === true, 'Naruto work graph must validate', { graph_blockers: graph.blockers, validation });
+assertGate(graph.total_work_items >= graph.requested_clones, 'work graph must create at least requested clone count', { total: graph.total_work_items, requested: graph.requested_clones });
+assertGate(graph.mixed_work_kinds.length > 4, 'work graph must contain mixed work kinds, not only verification', { kinds: graph.mixed_work_kinds });
+assertGate(graph.write_allowed_count > 0, 'write-capable Naruto graph must include write_allowed work items', { write_allowed_count: graph.write_allowed_count });
+assertGate(graph.active_waves.every((wave) => wave.conflict_count === 0), 'active waves must not overlap write leases', { waves: graph.active_waves });
+emitGate('naruto:work-graph', {
+    total_work_items: graph.total_work_items,
+    mixed_work_kinds: graph.mixed_work_kinds,
+    write_allowed_count: graph.write_allowed_count,
+    wave_count: graph.active_waves.length
+});
+//# sourceMappingURL=naruto-work-graph-check.js.map

package/dist/scripts/naruto-zellij-massive-ui-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const dashboardMod = await importDist('core/zellij/zellij-naruto-dashboard.js');
+const plan = dashboardMod.planNarutoZellijDashboard({
+    targetActiveWorkers: 32,
+    visiblePaneCap: 12,
+    completed: 8,
+    failed: 1,
+    backpressure: 'normal',
+    roles: ['implementer', 'modifier', 'test_writer', 'verifier'],
+    backend: 'codex-sdk'
+});
+assertGate(plan.ok === true, 'Naruto Zellij dashboard plan must pass', plan);
+assertGate(plan.visible_worker_panes === 12, 'targetActiveWorkers=32 and visiblePaneCap=12 must create 12 visible panes', plan);
+assertGate(plan.headless_workers === 20, 'remaining active workers must be listed as headless', plan);
+assertGate(plan.pane_titles.every((title) => /slot-\d+\/gen-1 · .+ · codex-sdk · active/.test(title)), 'pane titles must include slot/gen/role/backend/status', plan);
+emitGate('naruto:zellij-massive-ui', {
+    visible_worker_panes: plan.visible_worker_panes,
+    headless_workers: plan.headless_workers,
+    dashboard: plan.dashboard
+});
+//# sourceMappingURL=naruto-zellij-massive-ui-check.js.map

package/dist/scripts/product-design-auto-install-check.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { ensureProductDesignPluginInstalledWithRequest, findProductDesignPluginSummaryFromMarketplaces, productDesignAutoInstallRequested } from '../core/product-design-app-server.js';
+import { PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS } from '../core/product-design-plugin.js';
+import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+function pluginReadResponse({ installed, enabled }) {
+    return {
+        plugin: {
+            marketplaceName: PRODUCT_DESIGN_PLUGIN.marketplace,
+            marketplacePath: null,
+            summary: {
+                id: PRODUCT_DESIGN_PLUGIN.id,
+                remotePluginId: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,
+                name: PRODUCT_DESIGN_PLUGIN.name,
+                installed,
+                enabled,
+                interface: {
+                    displayName: PRODUCT_DESIGN_PLUGIN.display_name
+                }
+            },
+            skills: PRODUCT_DESIGN_REQUIRED_SKILLS.map((name) => ({ name, enabled: true }))
+        }
+    };
+}
+let installed = false;
+const installCalls = [];
+const installResult = await ensureProductDesignPluginInstalledWithRequest(async (method, params) => {
+    installCalls.push({ method, params });
+    if (method === 'plugin/read')
+        return pluginReadResponse({ installed, enabled: installed });
+    if (method === 'plugin/install') {
+        assertGate(params.pluginName === PRODUCT_DESIGN_PLUGIN.remote_plugin_id, 'plugin/install must use Product Design remote plugin id', params);
+        installed = true;
+        return { authPolicy: 'ON_USE', appsNeedingAuth: [] };
+    }
+    if (method === 'plugin/installed')
+        return { marketplaces: [], marketplaceLoadErrors: [] };
+    throw new Error(`unexpected method: ${method}`);
+}, { autoInstallProductDesign: true, env: {} });
+assertGate(installResult.ok, 'Product Design ensure must pass after fake plugin/install', installResult);
+assertGate(installResult.install_attempted === true, 'Product Design ensure must attempt install when read evidence is not ready', installResult);
+assertGate(installCalls.some((call) => call.method === 'plugin/install'), 'Product Design ensure did not call plugin/install', installCalls);
+assertGate(installResult.after_evidence.ok, 'Product Design after_evidence must be ready after install', installResult);
+installed = false;
+const dryCalls = [];
+const dryResult = await ensureProductDesignPluginInstalledWithRequest(async (method, params) => {
+    dryCalls.push({ method, params });
+    if (method === 'plugin/read')
+        return pluginReadResponse({ installed: false, enabled: false });
+    throw new Error(`unexpected dry method: ${method}`);
+}, { autoInstallProductDesign: false, env: {} });
+assertGate(!dryResult.ok, 'Product Design dry ensure must not claim ready when read evidence is not ready', dryResult);
+assertGate(dryResult.install_attempted === false, 'Product Design dry ensure must not attempt install', dryResult);
+assertGate(!dryCalls.some((call) => call.method === 'plugin/install'), 'Product Design dry ensure must not call plugin/install', dryCalls);
+const marketplaceList = {
+    marketplaces: [{
+            name: PRODUCT_DESIGN_PLUGIN.marketplace,
+            plugins: [{
+                    id: PRODUCT_DESIGN_PLUGIN.id,
+                    remotePluginId: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,
+                    name: PRODUCT_DESIGN_PLUGIN.name,
+                    installed: true,
+                    enabled: true,
+                    interface: {
+                        displayName: PRODUCT_DESIGN_PLUGIN.display_name
+                    }
+                }]
+        }],
+    marketplaceLoadErrors: []
+};
+const discovered = findProductDesignPluginSummaryFromMarketplaces(marketplaceList);
+assertGate(discovered?.remotePluginId === PRODUCT_DESIGN_PLUGIN.remote_plugin_id, 'Product Design vertical plugin/list discovery must return remote id', discovered);
+let readCount = 0;
+const listCalls = [];
+const listFallbackResult = await ensureProductDesignPluginInstalledWithRequest(async (method, params) => {
+    listCalls.push({ method, params });
+    if (method === 'plugin/read') {
+        readCount += 1;
+        if (readCount === 1)
+            throw new Error('simulated stale read id');
+        return pluginReadResponse({ installed: true, enabled: true });
+    }
+    if (method === 'plugin/list')
+        return marketplaceList;
+    throw new Error(`unexpected list fallback method: ${method}`);
+}, { autoInstallProductDesign: true, env: {} });
+assertGate(listFallbackResult.ok, 'Product Design ensure must recover through vertical plugin/list discovery', listFallbackResult);
+assertGate(listFallbackResult.install_attempted === false, 'Product Design ensure must not install when list-discovered read is already ready', listFallbackResult);
+assertGate(listCalls.some((call) => call.method === 'plugin/list'), 'Product Design ensure must query vertical plugin/list when direct read fails', listCalls);
+assertGate(productDesignAutoInstallRequested({ env: { SKS_PRODUCT_DESIGN_AUTO_INSTALL: '1' } }), 'Product Design auto-install env gate must be honored');
+const codexAppSource = readText('src/core/codex-app.ts');
+const commandSource = readText('src/commands/codex-app.ts');
+const appServerSource = readText('src/core/product-design-app-server.ts');
+const pkg = JSON.parse(readText('package.json'));
+const releaseCheck = String(pkg.scripts?.['release:check'] || '');
+for (const token of [
+    'ensureProductDesignPluginInstalled',
+    'PRODUCT_DESIGN_AUTO_INSTALL_ENV',
+    'autoInstallProductDesign'
+]) {
+    assertGate(codexAppSource.includes(token) || appServerSource.includes(token), `Product Design auto-install source missing token: ${token}`);
+}
+for (const token of [
+    'product-design',
+    'ensure-product-design',
+    '--check-only',
+    '--install-product-design'
+]) {
+    assertGate(commandSource.includes(token), `sks codex-app command missing Product Design token: ${token}`);
+}
+assertGate(Boolean(pkg.scripts?.['codex:product-design-auto-install']), 'package script missing codex:product-design-auto-install');
+assertGate(releaseCheck.includes('codex:product-design-auto-install'), 'release:check must include Product Design auto-install gate');
+emitGate('codex:product-design-auto-install', {
+    install_calls: installCalls.map((call) => call.method),
+    dry_calls: dryCalls.map((call) => call.method),
+    list_fallback_calls: listCalls.map((call) => call.method),
+    env_gate: true
+});
+//# sourceMappingURL=product-design-auto-install-check.js.map