sneakoscope 2.0.8 → 2.0.10

package/dist/scripts/agent-role-config-repair-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/agents/agent-role-config.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-repair-'));
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+const plan = await mod.repairAgentRoleConfigs({ root, apply: false, codexHome: path.join(root, 'codex-home') });
+const repair = await mod.repairAgentRoleConfigs({ root, apply: true, codexHome: path.join(root, 'codex-home'), reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json') });
+const analysisScout = path.join(root, '.codex', 'agents', 'analysis-scout.toml');
+const staleRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-stale-'));
+fs.mkdirSync(path.join(staleRoot, '.codex', 'agents'), { recursive: true });
+fs.writeFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'model = "gpt-5-codex"\nsandbox_mode = "read-only"\n');
+const stalePlan = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: false, codexHome: path.join(staleRoot, 'codex-home') });
+const staleRepair = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: true, codexHome: path.join(staleRoot, 'codex-home') });
+const repairedText = fs.readFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
+const report = {
+    schema: 'sks.agent-role-config-repair-check.v1',
+    plan_ok: plan.ok === true && plan.missing.includes('analysis-scout.toml'),
+    repair_ok: repair.ok === true,
+    analysis_scout_created: fs.existsSync(analysisScout),
+    created_matches_model: fs.readFileSync(analysisScout, 'utf8').includes('model = "gpt-5.5"'),
+    stale_detected: stalePlan.stale.includes('analysis-scout.toml'),
+    stale_repaired: staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && repairedText.includes('name = "analysis_scout"') && repairedText.includes('model = "gpt-5.5"'),
+    warnings_suppressed: repair.warnings_suppressed === true,
+    artifact_written: fs.existsSync(path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json'))
+};
+const ok = report.plan_ok && report.repair_ok && report.analysis_scout_created && report.created_matches_model && report.stale_detected && report.stale_repaired && report.warnings_suppressed && report.artifact_written;
+assertGate(ok, 'doctor --fix must repair missing SKS-owned agent role configs', report);
+emitGate('agent:role-config-repair', report);
+//# sourceMappingURL=agent-role-config-repair-check.js.map

package/dist/scripts/codex-sdk-release-review-pipeline-check.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 // @ts-nocheck
-import { assertGate, emitGate, packageScripts, readText } from './lib/codex-sdk-gate-lib.js';
+import { assertGate, emitGate, packageScripts, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
 const scripts = packageScripts();
-const releaseCheck = String(scripts['release:check'] || '');
 const releaseRealCheck = String(scripts['release:real-check'] || '');
-assertGate(releaseCheck.includes('codex-sdk:capability'), 'release:check must include Codex SDK capability gate');
-assertGate(releaseCheck.includes('codex-sdk:all-pipelines'), 'release:check must include Codex SDK all-pipelines gate');
+const releaseGates = releaseGateIds();
+assertGate(releaseGates.has('codex-sdk:capability'), 'release gate DAG must include Codex SDK capability gate');
+assertGate(releaseGates.has('codex-sdk:all-pipelines'), 'release gate DAG must include Codex SDK all-pipelines gate');
 assertGate(releaseRealCheck.includes('codex-sdk:real-smoke'), 'release:real-check must include Codex SDK real smoke');
 assertGate(readText('src/core/agents/agent-orchestrator.ts').includes('legacy_codex_exec_runtime_removed'), 'orchestrator must block legacy codex-exec requests');
-emitGate('codex-sdk:release-review-pipeline', { release_check_contains_sdk: true });
+emitGate('codex-sdk:release-review-pipeline', { release_gate_dag_contains_sdk: true });
 //# sourceMappingURL=codex-sdk-release-review-pipeline-check.js.map

package/dist/scripts/doctor-fix-proves-codex-read-check.js

@@ -25,19 +25,40 @@ const run = spawnSync(process.execPath, [
         SKS_DISABLE_UPDATE_CHECK: '1'
     },
     encoding: 'utf8',
-    timeout: 60000
+    timeout: 180000
 });
 const parsed = parseLastJson(run.stdout || '{}');
 const ok = run.status !== 0
     && parsed.ready?.ready === false
     && parsed.ready?.blockers?.includes('codex_cli_config_eperm')
     && parsed.ready?.next_actions?.length > 0;
-console.log(JSON.stringify({ schema: 'sks.doctor-fix-proves-codex-read-check.v1', ok, status: run.status, parsed }, null, 2));
+console.log(JSON.stringify({
+    schema: 'sks.doctor-fix-proves-codex-read-check.v1',
+    ok,
+    status: run.status,
+    signal: run.signal,
+    error: run.error ? String(run.error.message || run.error) : null,
+    parsed,
+    stdout_tail: String(run.stdout || '').slice(-1000),
+    stderr_tail: String(run.stderr || '').slice(-1000)
+}, null, 2));
 if (!ok)
     process.exitCode = 1;
 function parseLastJson(text) {
-    const index = String(text).lastIndexOf('\n{');
-    const jsonText = index >= 0 ? String(text).slice(index + 1) : String(text).slice(String(text).indexOf('{'));
-    return JSON.parse(jsonText || '{}');
+    const source = String(text || '').trim();
+    if (!source)
+        return {};
+    const starts = [];
+    for (let index = source.indexOf('{'); index >= 0; index = source.indexOf('{', index + 1))
+        starts.push(index);
+    for (let i = starts.length - 1; i >= 0; i -= 1) {
+        try {
+            return JSON.parse(source.slice(starts[i]));
+        }
+        catch {
+            // Continue searching for the outer JSON object; pretty JSON may contain nested objects.
+        }
+    }
+    return {};
 }
 //# sourceMappingURL=doctor-fix-proves-codex-read-check.js.map

package/dist/scripts/git-worktree-integration-primary-check.js

@@ -17,6 +17,8 @@ const integrationPath = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-integration-'
 fs.rmSync(integrationPath, { recursive: true, force: true });
 const integration = await managerMod.allocateWorkerWorktree({ repoRoot: repo, missionId: 'M-integrate', workerId: 'integration', slotId: 'integration' });
 const report = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktreePath: integration.worktree_path, diffs: [diff] });
-assertGate(report.ok === true && report.applied_count === 1, 'git-worktree-diff must apply through merge queue', report);
-emitGate('git:worktree-integration-primary', { applied_count: report.applied_count });
+const mainReport = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktreePath: repo, diffs: [diff] });
+const mainContent = fs.readFileSync(path.join(repo, 'a.txt'), 'utf8');
+assertGate(report.ok === true && report.applied_count === 1 && mainReport.ok === true && mainReport.applied_count === 1 && mainContent.includes('integrated'), 'git-worktree-diff must prevalidate in integration worktree and apply to main repo', { report, mainReport, mainContent });
+emitGate('git:worktree-integration-primary', { applied_count: report.applied_count, main_applied_count: mainReport.applied_count });
 //# sourceMappingURL=git-worktree-integration-primary-check.js.map

package/dist/scripts/git-worktree-integration-primary-runtime-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const orchestrator = fs.readFileSync(path.join(root, 'src/core/agents/agent-orchestrator.ts'), 'utf8');
+const report = {
+    schema: 'sks.git-worktree-integration-primary-runtime-check.v1',
+    splits_worktree_entries: orchestrator.includes("entry.envelope?.source === 'git-worktree-diff'"),
+    uses_integration_worktree: orchestrator.includes('createGitIntegrationWorktree'),
+    uses_merge_queue: orchestrator.includes('applyGitWorktreeMergeQueue'),
+    applies_to_main_repo: orchestrator.includes('main_repo_apply') && orchestrator.includes('integrationWorktreePath: repoRoot'),
+    rollback_evidence: orchestrator.includes('rollback_evidence') && orchestrator.includes('captureGitWorktreeRollbackPlan') && orchestrator.includes('completeGitWorktreeRollbackPlan'),
+    bypasses_normal_apply: orchestrator.includes('const normalEntries') && orchestrator.includes('applyAgentPatchQueueEntry(root, entry') && orchestrator.includes('parallelEntries = disjointEntries'),
+    writes_report: orchestrator.includes('git-worktree-merge-queue-report.json')
+};
+const ok = report.splits_worktree_entries && report.uses_integration_worktree && report.uses_merge_queue && report.applies_to_main_repo && report.rollback_evidence && report.bypasses_normal_apply && report.writes_report;
+assertGate(ok, 'git-worktree-diff entries must use integration merge queue primary path', report);
+emitGate('git:worktree-integration-primary-runtime', report);
+//# sourceMappingURL=git-worktree-integration-primary-runtime-check.js.map

package/dist/scripts/lib/codex-sdk-gate-lib.js

@@ -59,6 +59,10 @@ export async function runFakeCodexSdkTaskFixture(label = 'fixture', extra = {})
 export function packageScripts() {
     return readJson('package.json').scripts || {};
 }
+export function releaseGateIds() {
+    const manifest = readJson('release-gates.v2.json');
+    return new Set((manifest.gates || []).map((gate) => gate.id));
+}
 export function assertSourceIncludes(file, tokens) {
     const text = readText(file);
     for (const token of tokens)

package/dist/scripts/mad-sks-zellij-default-pane-worker-check.js

@@ -17,10 +17,10 @@ const checks = {
     zellij_session_before_swarm: launchIndex >= 0 && swarmIndex >= 0 && launchIndex < swarmIndex,
     main_only_session: mad.includes('slotCount: 0'),
     zellij_default_backend: /return 'zellij'/.test(mad) && mad.includes("list.includes('--json')") && mad.includes("list.includes('--no-attach')"),
-    worker_command_real_zellij: mad.includes("command.push('--real')") && mad.includes("command.push('--zellij-session-name'") && mad.includes("command.push('--zellij-pane-worker')"),
+    worker_command_real_zellij: mad.includes("command.push('--real')") && mad.includes("command.push('--zellij-session-name'") && mad.includes("command.push('--zellij-pane-worker')") && mad.includes("command.push('--worker-placement'"),
     parser_accepts_worker_flags: parser.includes('--zellij-session-name') && parser.includes('--zellij-pane-worker') && parser.includes('--no-zellij-pane-worker'),
     native_worker_pane_path: swarm.includes("this.input.backend === 'zellij'") && swarm.includes('ctx.opts.zellijPaneWorker !== false') && swarm.includes('openWorkerPane({'),
-    right_pane_requested: manager.includes("'--direction', 'right'")
+    right_pane_requested: manager.includes("'--direction', directionRequested") && manager.includes("'--near-current-pane'")
 };
 const ok = Object.values(checks).every(Boolean);
 emit({

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -17,6 +17,7 @@ const uncovered = [];
 const GUARD_CALL = /\bguarded(WriteFile|Rm|Rename|Chmod|Xattr|Chflags|GlobalCodexConfigWrite|ProcessKill|PackageInstall|SkillSnapshotPromotion|Apply)\(/;
 const RISKY = [
     { kind: 'write_file', token: 'fs.writeFile', re: /\bfs\.writeFile\(/ },
+    { kind: 'write_file', token: 'fs.promises.writeFile', re: /\bfs\.promises\.writeFile\(/ },
     { kind: 'write_file', token: 'fsp.writeFile', re: /\bfsp\.writeFile\(/ },
     { kind: 'write_file', token: 'writeFileSync', re: /\b(?:fs\.)?writeFileSync\(/ },
     { kind: 'rm', token: 'fs.rm', re: /\bfs\.rm\(/ },
@@ -167,7 +168,7 @@ function processKillIsLivenessProbe(line) {
     return /\bprocess\.kill\([^,\n]+,\s*0\s*\)/.test(line);
 }
 function codexHomeMutationOnLine(line) {
-    return /\b(?:writeTextAtomic|writeJsonAtomic|writeFileSync|fs\.writeFile|fsp\.writeFile|fs\.rm|fsp\.rm|fs\.rename|fsp\.rename|fs\.chmod|fsp\.chmod|copyFile|open)\b/.test(line)
+    return /\b(?:writeTextAtomic|writeJsonAtomic|writeFileSync|fs\.writeFile|fs\.promises\.writeFile|fsp\.writeFile|fs\.rm|fsp\.rm|fs\.rename|fsp\.rename|fs\.chmod|fsp\.chmod|copyFile|open)\b/.test(line)
         && /(?:~\/\.codex|CODEX_HOME|codexHome|codexLbHome|auth\.json|config\.toml)/.test(line);
 }
 function snippet(line) {

package/dist/scripts/naruto-concurrency-governor-check.js

@@ -10,6 +10,7 @@ const normal = governorMod.decideNarutoConcurrency({
     zellijVisiblePaneCap: 12,
     hardware: {
         cores: 32,
+        loadAverage: [0, 0, 0],
         freeMemoryBytes: 48 * 1024 * 1024 * 1024,
         totalMemoryBytes: 64 * 1024 * 1024 * 1024,
         fileDescriptorLimit: 4096,
@@ -37,7 +38,7 @@ const pressure = governorMod.decideNarutoConcurrency({
         diskIoPressure: 0.9
     }
 });
-assertGate(normal.safe_active_workers <= 32, 'requested_clones=200 fixture must cap active workers safely', { normal });
+assertGate(normal.safe_active_workers >= 32 && normal.safe_active_workers <= 100, 'requested_clones=200 fixture must cap active workers safely while allowing aggressive process-pool fanout', { normal });
 assertGate(normal.safe_zellij_visible_panes === 12 && normal.headless_workers === normal.safe_active_workers - 12, 'zellij visible panes must stay within UI cap', { normal });
 assertGate(normal.local_llm_parallel <= 4, 'local LLM active requests must respect max_parallel_requests=4', { normal });
 assertGate(pressure.safe_active_workers < normal.safe_active_workers, 'memory/load pressure fixture must decrease active workers', { normal: normal.safe_active_workers, pressure: pressure.safe_active_workers });

package/dist/scripts/naruto-extreme-parallelism-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+const graph = buildNarutoWorkGraph({ requestedClones: 100, writeCapable: true, maxActiveWorkers: 32 });
+const governor = decideNarutoConcurrency({
+    requestedClones: 100,
+    totalWorkItems: graph.total_work_items,
+    pendingWorkQueueSize: graph.total_work_items,
+    backend: 'codex-sdk',
+    hardware: { cores: 16, loadAverage: [1, 1, 1], freeMemoryBytes: 64 * 1024 * 1024 * 1024, totalMemoryBytes: 128 * 1024 * 1024 * 1024, fileDescriptorLimit: 8192, processCount: 100, terminalRows: 48, remoteApiRateLimitBudget: 32, localLlmMaxParallelRequests: 8 }
+});
+const report = {
+    schema: 'sks.naruto-extreme-parallelism-check.v1',
+    ok: graph.total_work_items >= 200 && governor.safe_active_workers >= 16 && governor.safe_zellij_visible_panes <= governor.safe_active_workers && governor.safe_zellij_visible_panes <= 8 && graph.mixed_work_kinds.length >= 6,
+    graph: { total_work_items: graph.total_work_items, mixed_work_kinds: graph.mixed_work_kinds, write_allowed_count: graph.write_allowed_count },
+    governor
+};
+assertGate(report.ok, 'Naruto extreme parallelism must fan out >=2x clones and keep a high safe active pool', report);
+emitGate('naruto:extreme-parallelism', report);
+//# sourceMappingURL=naruto-extreme-parallelism-check.js.map

package/dist/scripts/naruto-extreme-parallelism-real-check.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { runNarutoRealActivePool } from '../core/naruto/naruto-active-pool.js';
+import { collectActualNarutoWorker, spawnActualNarutoWorker } from '../core/naruto/naruto-real-worker-runtime.js';
+const graph = buildNarutoWorkGraph({ requestedClones: 100, totalWorkItems: 200, writeCapable: true, maxActiveWorkers: 32 });
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-extreme-real-'));
+const missionId = `M-naruto-extreme-real-${process.pid}`;
+const governor = decideNarutoConcurrency({
+    requestedClones: 100,
+    totalWorkItems: graph.total_work_items,
+    pendingWorkQueueSize: graph.total_work_items,
+    backend: 'codex-sdk',
+    hardware: { cores: 16, loadAverage: [1, 1, 1], freeMemoryBytes: 64 * 1024 * 1024 * 1024, totalMemoryBytes: 128 * 1024 * 1024 * 1024, fileDescriptorLimit: 8192, processCount: 100, terminalRows: 48, remoteApiRateLimitBudget: 32, localLlmMaxParallelRequests: 8 }
+});
+const target = { ...governor, safe_active_workers: Math.min(32, governor.safe_active_workers), safe_zellij_visible_panes: Math.min(8, governor.safe_zellij_visible_panes) };
+const report = await runNarutoRealActivePool({
+    graph,
+    governor: target,
+    spawnWorker: async (item, placement) => spawnActualNarutoWorker({
+        root: tempRoot,
+        missionId,
+        item,
+        placement,
+        backend: 'codex-sdk',
+        visiblePaneCap: target.safe_zellij_visible_panes,
+        zellijSessionName: `sks-${missionId}`
+    }),
+    collectWorker: async (handle) => collectActualNarutoWorker(handle),
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const actualArtifacts = report.worker_lifecycle.every((row) => row.pid && row.worker_artifact_dir && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json')));
+const ok = report.ok && report.max_observed_active_workers >= Math.ceil(target.safe_active_workers * 0.8) && report.active_pool_utilization >= 0.8 && report.headless_workers > 0 && report.visible_workers <= graph.total_work_items && actualArtifacts;
+assertGate(ok, 'Naruto extreme parallelism must use actual child process active-pool lifecycle near cap with headless overflow', { report, target, actualArtifacts, tempRoot });
+emitGate('naruto:extreme-parallelism-real', report);
+//# sourceMappingURL=naruto-extreme-parallelism-real-check.js.map

package/dist/scripts/naruto-real-active-pool-check.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { runNarutoRealActivePool } from '../core/naruto/naruto-active-pool.js';
+const graph = buildNarutoWorkGraph({ requestedClones: 12, totalWorkItems: 24, writeCapable: true, maxActiveWorkers: 6 });
+const governor = decideNarutoConcurrency({
+    requestedClones: 12,
+    totalWorkItems: graph.total_work_items,
+    pendingWorkQueueSize: graph.total_work_items,
+    backend: 'codex-sdk',
+    hardware: { cpuCoreCount: 8, freeMemoryBytes: 32 * 1024 * 1024 * 1024, totalMemoryBytes: 64 * 1024 * 1024 * 1024, fileDescriptorLimit: 4096, processCount: 100, terminalRows: 40, remoteApiRateLimitBudget: 8 }
+});
+const target = { ...governor, safe_active_workers: Math.min(6, governor.safe_active_workers), safe_zellij_visible_panes: 3 };
+let spawned = 0;
+let collected = 0;
+let dashboardEvents = 0;
+const report = await runNarutoRealActivePool({
+    graph,
+    governor: target,
+    spawnWorker: async (item, placement) => {
+        spawned += 1;
+        return { id: item.id, item, placement, started_at: Date.now() };
+    },
+    collectWorker: async (handle) => {
+        collected += 1;
+        return { id: handle.id, ok: true, item: handle.item, placement: handle.placement, completed_at: Date.now() };
+    },
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => {
+        dashboardEvents += 1;
+    }
+});
+const processEvidence = report.worker_lifecycle.every((row) => row.pid == null || row.worker_artifact_dir != null);
+const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && dashboardEvents > graph.total_work_items && report.active_cap === target.safe_active_workers && processEvidence;
+assertGate(ok, 'Naruto real active pool must run spawn/collect lifecycle and refill to cap', { report, spawned, collected, dashboardEvents, target });
+emitGate('naruto:real-active-pool', { spawned, collected, active_cap: report.active_cap, max_observed_active_workers: report.max_observed_active_workers, refill_latency_ms_p95: report.refill_latency_ms_p95, active_pool_utilization: report.active_pool_utilization });
+//# sourceMappingURL=naruto-real-active-pool-check.js.map

package/dist/scripts/naruto-real-active-pool-runtime-check.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { runNarutoRealActivePool } from '../core/naruto/naruto-active-pool.js';
+import { collectActualNarutoWorker, spawnActualNarutoWorker } from '../core/naruto/naruto-real-worker-runtime.js';
+const graph = buildNarutoWorkGraph({ requestedClones: 12, totalWorkItems: 24, writeCapable: false, maxActiveWorkers: 6 });
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-real-runtime-'));
+const missionId = `M-naruto-real-runtime-${process.pid}`;
+const governor = decideNarutoConcurrency({
+    requestedClones: 12,
+    totalWorkItems: graph.total_work_items,
+    pendingWorkQueueSize: graph.total_work_items,
+    backend: 'codex-sdk',
+    hardware: { cores: 8, freeMemoryBytes: 32 * 1024 * 1024 * 1024, totalMemoryBytes: 64 * 1024 * 1024 * 1024, fileDescriptorLimit: 4096, processCount: 100, terminalRows: 40, remoteApiRateLimitBudget: 8 }
+});
+let spawned = 0;
+let collected = 0;
+const target = { ...governor, safe_active_workers: Math.min(6, governor.safe_active_workers), safe_zellij_visible_panes: 3 };
+const report = await runNarutoRealActivePool({
+    graph,
+    governor: target,
+    spawnWorker: async (item, placement) => {
+        spawned += 1;
+        return spawnActualNarutoWorker({
+            root: tempRoot,
+            missionId,
+            item,
+            placement,
+            backend: 'codex-sdk',
+            visiblePaneCap: target.safe_zellij_visible_panes,
+            zellijSessionName: `sks-${missionId}`
+        });
+    },
+    collectWorker: async (handle) => {
+        collected += 1;
+        return collectActualNarutoWorker(handle);
+    },
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const processEvidence = report.worker_lifecycle.every((row) => row.pid && row.worker_artifact_dir);
+const artifactEvidence = report.worker_lifecycle.every((row) => row.worker_artifact_dir
+    && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-heartbeat.jsonl'))
+    && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json')));
+const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && report.active_pool_utilization >= 0.8 && processEvidence && artifactEvidence;
+assertGate(ok, 'Naruto real active pool runtime must include actual child process, heartbeat, and result evidence', { report, spawned, collected, processEvidence, artifactEvidence, tempRoot });
+emitGate('naruto:real-active-pool-runtime', report);
+//# sourceMappingURL=naruto-real-active-pool-runtime-check.js.map

package/dist/scripts/naruto-work-graph-check.js

@@ -11,7 +11,7 @@ const graph = workGraph.buildNarutoWorkGraph({
 });
 const validation = workGraph.validateNarutoWorkGraph(graph);
 assertGate(graph.ok === true && validation.ok === true, 'Naruto work graph must validate', { graph_blockers: graph.blockers, validation });
-assertGate(graph.total_work_items >= graph.requested_clones, 'work graph must create at least requested clone count', { total: graph.total_work_items, requested: graph.requested_clones });
+assertGate(graph.total_work_items >= graph.requested_clones * 2, 'write-capable work graph must create at least 2x requested clone count', { total: graph.total_work_items, requested: graph.requested_clones });
 assertGate(graph.mixed_work_kinds.length > 4, 'work graph must contain mixed work kinds, not only verification', { kinds: graph.mixed_work_kinds });
 assertGate(graph.write_allowed_count > 0, 'write-capable Naruto graph must include write_allowed work items', { write_allowed_count: graph.write_allowed_count });
 assertGate(graph.active_waves.every((wave) => wave.conflict_count === 0), 'active waves must not overlap write leases', { waves: graph.active_waves });

package/dist/scripts/naruto-zellij-dynamic-right-column-check.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_ZELLIJ === '1';
+const naruto = fs.readFileSync(path.join(root, 'src/core/commands/naruto-command.ts'), 'utf8');
+const worker = fs.readFileSync(path.join(root, 'src/core/zellij/zellij-worker-pane-manager.ts'), 'utf8');
+const swarm = fs.readFileSync(path.join(root, 'src/core/agents/native-cli-session-swarm.ts'), 'utf8');
+const realGeometryProof = requireReal ? runRealGeometryProof() : null;
+const report = {
+    schema: 'sks.naruto-zellij-dynamic-right-column-check.v1',
+    ok: true,
+    require_real: requireReal,
+    initial_main_only: /slotCount:\s*0/.test(naruto),
+    passes_session_name: naruto.includes('zellijSessionName: liveZellij?.session_name'),
+    passes_worker_placement: naruto.includes("workerPlacement: parsed.json || parsed.noOpenZellij ? 'process' : 'zellij-pane'"),
+    passes_visible_cap: naruto.includes('zellijVisiblePaneCap: zellijVisiblePanes'),
+    worker_uses_right_column: worker.includes("rightColumnMode: 'spawn-on-first-worker'") || swarm.includes("rightColumnMode: 'spawn-on-first-worker'"),
+    real_geometry_proof: realGeometryProof
+};
+report.ok = report.initial_main_only
+    && report.passes_session_name
+    && report.passes_worker_placement
+    && report.passes_visible_cap
+    && report.worker_uses_right_column
+    && (!requireReal || realGeometryProof?.ok === true);
+assertGate(report.ok, 'Naruto must use dynamic right-column worker panes in interactive mode', report);
+emitGate('naruto:zellij-dynamic-right-column', report);
+function runRealGeometryProof() {
+    const res = spawnSync('npm', ['run', 'zellij:right-column-real-geometry', '--silent', '--', '--require-real'], {
+        cwd: root,
+        env: { ...process.env, SKS_REQUIRE_ZELLIJ: '1' },
+        encoding: 'utf8',
+        maxBuffer: 20 * 1024 * 1024
+    });
+    return {
+        ok: res.status === 0,
+        exit_code: res.status,
+        stdout_tail: tail(res.stdout),
+        stderr_tail: tail(res.stderr)
+    };
+}
+function tail(text) {
+    return String(text || '').split('\n').slice(-30).join('\n');
+}
+//# sourceMappingURL=naruto-zellij-dynamic-right-column-check.js.map

package/dist/scripts/product-design-auto-install-check.js

@@ -2,7 +2,7 @@
 // @ts-nocheck
 import { ensureProductDesignPluginInstalledWithRequest, findProductDesignPluginSummaryFromMarketplaces, productDesignAutoInstallRequested } from '../core/product-design-app-server.js';
 import { PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS } from '../core/product-design-plugin.js';
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+import { assertGate, emitGate, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
 function pluginReadResponse({ installed, enabled }) {
     return {
         plugin: {
@@ -92,7 +92,7 @@ const codexAppSource = readText('src/core/codex-app.ts');
 const commandSource = readText('src/commands/codex-app.ts');
 const appServerSource = readText('src/core/product-design-app-server.ts');
 const pkg = JSON.parse(readText('package.json'));
-const releaseCheck = String(pkg.scripts?.['release:check'] || '');
+const releaseGates = releaseGateIds();
 for (const token of [
     'ensureProductDesignPluginInstalled',
     'PRODUCT_DESIGN_AUTO_INSTALL_ENV',
@@ -109,7 +109,7 @@ for (const token of [
     assertGate(commandSource.includes(token), `sks codex-app command missing Product Design token: ${token}`);
 }
 assertGate(Boolean(pkg.scripts?.['codex:product-design-auto-install']), 'package script missing codex:product-design-auto-install');
-assertGate(releaseCheck.includes('codex:product-design-auto-install'), 'release:check must include Product Design auto-install gate');
+assertGate(releaseGates.has('codex:product-design-auto-install'), 'release gate DAG must include Product Design auto-install gate');
 emitGate('codex:product-design-auto-install', {
     install_calls: installCalls.map((call) => call.method),
     dry_calls: dryCalls.map((call) => call.method),

package/dist/scripts/product-design-plugin-routing-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // @ts-nocheck
 import { PRODUCT_DESIGN_PIPELINE_STAGES, PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS, normalizeProductDesignPluginEvidence, productDesignPluginVisibilityFromCodexPluginList } from '../core/product-design-plugin.js';
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
+import { assertGate, emitGate, readText, releaseGateIds } from './lib/codex-sdk-gate-lib.js';
 const routesSource = readText('src/core/routes.ts');
 const productDesignSource = readText('src/core/product-design-plugin.ts');
 const runtimeSource = readText('src/core/pipeline-internals/runtime-core.ts');
@@ -9,7 +9,7 @@ const pptSource = readText('src/core/ppt.ts');
 const codexAppSource = readText('src/core/codex-app.ts');
 const initSource = readText('src/core/init.ts');
 const pkg = JSON.parse(readText('package.json'));
-const releaseCheck = String(pkg.scripts?.['release:check'] || '');
+const releaseGates = releaseGateIds();
 assertGate(PRODUCT_DESIGN_PLUGIN.id === 'product-design@openai-curated-remote', 'Product Design plugin id must use the remote marketplace');
 assertGate(PRODUCT_DESIGN_PLUGIN.marketplace === 'openai-curated-remote', 'Product Design marketplace must be openai-curated-remote');
 assertGate(PRODUCT_DESIGN_PLUGIN.marketplace_kind === 'vertical', 'Product Design marketplace kind must be vertical');
@@ -90,7 +90,7 @@ for (const token of [
     assertGate(codexAppSource.includes(token), `codex-app.ts missing Product Design readiness token: ${token}`);
 }
 assertGate(Boolean(pkg.scripts?.['codex:product-design-plugin-routing']), 'package script missing codex:product-design-plugin-routing');
-assertGate(releaseCheck.includes('codex:product-design-plugin-routing'), 'release:check must include Product Design routing gate');
+assertGate(releaseGates.has('codex:product-design-plugin-routing'), 'release gate DAG must include Product Design routing gate');
 emitGate('codex:product-design-plugin-routing', {
     plugin_id: PRODUCT_DESIGN_PLUGIN.id,
     remote_plugin_id: PRODUCT_DESIGN_PLUGIN.remote_plugin_id,

package/dist/scripts/readme-architecture-imagegen-official-check.js

@@ -5,6 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
+import { writeTextAtomic } from '../core/fsx.js';
 const root = process.cwd();
 const args = process.argv.slice(2);
 const reportPath = path.join(root, '.sneakoscope', 'reports', 'readme-architecture-imagegen-attempt-1.18.8.json');
@@ -139,12 +140,12 @@ else {
 }
 async function ensurePromptContract() {
     if (!promptExistedBeforeRun) {
-        await fs.promises.writeFile(promptPath, prompt);
+        await writeTextAtomic(promptPath, prompt);
         return { changed: true, reason: 'created' };
     }
     const existing = await fs.promises.readFile(promptPath, 'utf8').catch(() => null);
     if (existing !== prompt) {
-        await fs.promises.writeFile(promptPath, prompt);
+        await writeTextAtomic(promptPath, prompt);
         return { changed: true, reason: 'refreshed_prompt_changed' };
     }
     return { changed: false, reason: 'unchanged' };
@@ -334,7 +335,7 @@ async function textArtifactMeta(file, promptWrite = null) {
     };
 }
 async function writeReport(report) {
-    await fs.promises.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`);
+    await writeTextAtomic(reportPath, `${JSON.stringify(report, null, 2)}\n`);
 }
 async function sha256File(file) {
     return new Promise((resolve, reject) => {

package/dist/scripts/release-cache-glob-hashing-check.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { expandGlob, releaseGateCacheKey } from '../core/release/release-gate-cache-v2.js';
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-cache-glob-'));
+fs.mkdirSync(path.join(tmp, 'src/core/release'), { recursive: true });
+fs.writeFileSync(path.join(tmp, 'package.json'), JSON.stringify({ version: '0.0.0' }));
+fs.writeFileSync(path.join(tmp, 'release-gates.v2.json'), JSON.stringify({ schema: 'sks.release-gates.v2', gates: [] }));
+fs.writeFileSync(path.join(tmp, 'src/core/release/a.ts'), 'a');
+const gate = {
+    id: 'release:cache-glob-hashing-fixture',
+    command: 'node fixture',
+    deps: [],
+    resource: ['cpu-light'],
+    side_effect: 'hermetic',
+    timeout_ms: 1000,
+    cache: { enabled: true, inputs: ['src/core/release/**'] },
+    isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
+    preset: ['release']
+};
+const before = releaseGateCacheKey(tmp, gate);
+const expandedBefore = expandGlob(tmp, 'src/core/release/**');
+fs.writeFileSync(path.join(tmp, 'src/core/release/b.ts'), 'b');
+const afterAdd = releaseGateCacheKey(tmp, gate);
+fs.writeFileSync(path.join(tmp, 'src/core/release/a.ts'), 'changed');
+const afterChange = releaseGateCacheKey(tmp, gate);
+const expandedAfter = expandGlob(tmp, 'src/core/release/**');
+const report = {
+    schema: 'sks.release-cache-glob-hashing-check.v1',
+    ok: expandedBefore.length === 1 && expandedAfter.length === 2 && before !== afterAdd && afterAdd !== afterChange,
+    expanded_before: expandedBefore.map((file) => path.basename(file)),
+    expanded_after: expandedAfter.map((file) => path.basename(file)),
+    before,
+    after_add: afterAdd,
+    after_change: afterChange
+};
+assertGate(report.ok, 'release cache key must hash recursive glob file paths and contents', report);
+emitGate('release:cache-glob-hashing', report);
+//# sourceMappingURL=release-cache-glob-hashing-check.js.map

package/dist/scripts/release-check-dynamic-execute.js

@@ -40,7 +40,7 @@ const invariants = {
 };
 const distHash = distHashValue();
 const gitCommit = gitHead();
-const manifestHash = fileHash('release-gates.json');
+const manifestHash = fileHash(fs.existsSync(path.join(root, 'release-gates.v2.json')) ? 'release-gates.v2.json' : 'release-gates.json');
 const packageScriptsHash = sha256(JSON.stringify(pkg.scripts || {}));
 const nodeVersion = process.version;
 const npmVersion = npmVersionValue();
@@ -134,6 +134,25 @@ emitGate('release:check:dynamic:execute', {
 });
 // ---- helpers ----------------------------------------------------------------
 function loadManifest() {
+    const v2Path = path.join(root, 'release-gates.v2.json');
+    if (fs.existsSync(v2Path)) {
+        const parsed = JSON.parse(fs.readFileSync(v2Path, 'utf8'));
+        const releaseNodes = (Array.isArray(parsed.gates) ? parsed.gates : []).filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('release'));
+        const byId = new Map(releaseNodes.map((gate) => [gate.id, gate]));
+        const dynamic = buildGateManifest(releaseNodes.map((gate) => gate.id));
+        return {
+            schema: 'sks.release-gate-manifest.v1.from-v2',
+            gates: dynamic.gates.map((entry) => {
+                const node = byId.get(entry.id);
+                const resource = Array.isArray(node?.resource) ? node.resource.join(',') : '';
+                return {
+                    ...entry,
+                    affected_by: usefulCacheInputs(node?.cache?.inputs, entry.affected_by),
+                    cost: node?.side_effect === 'real-env' || resource.includes('real') ? 'real' : entry.cost
+                };
+            })
+        };
+    }
     const p = path.join(root, 'release-gates.json');
     if (fs.existsSync(p))
         return JSON.parse(fs.readFileSync(p, 'utf8'));
@@ -143,6 +162,13 @@ function loadManifest() {
     const ids = [...new Set([...dagIds, ...releaseCheckIds])].filter((id) => id && id !== 'build' && id !== 'release:check:parallel');
     return buildGateManifest(ids);
 }
+function usefulCacheInputs(inputs, fallback) {
+    if (!Array.isArray(inputs) || !inputs.length)
+        return fallback;
+    if (inputs.some((input) => ['src/**', 'package.json', 'release-gates.v2.json', 'schemas/**'].includes(input)))
+        return fallback;
+    return inputs;
+}
 function hashAffectedFiles(globs) {
     const regexes = (globs || []).map(globToRegExp);
     const hashes = [];