sneakoscope 2.0.9 → 2.0.11

package/dist/core/zellij/zellij-worker-pane-manager.js

@@ -4,7 +4,8 @@ import { providerPaneLabel } from '../provider/provider-badge.js';
 import { resolveProviderContext } from '../provider/provider-context.js';
 import { runZellij } from './zellij-command.js';
 import { extractZellijPaneIdFromOutput } from './zellij-lane-runtime.js';
-import { closeWorkerInRightColumn, prepareWorkerInRightColumn, recordWorkerPaneInRightColumn } from './zellij-right-column-manager.js';
+import { buildZellijSlotColumnAnchorCommand } from './zellij-slot-column-anchor.js';
+import { closeWorkerInRightColumn, prepareWorkerInRightColumn, recordSlotColumnAnchorInRightColumn, recordWorkerPaneInRightColumn } from './zellij-right-column-manager.js';
 export const ZELLIJ_WORKER_PANE_SCHEMA = 'sks.zellij-worker-pane.v1';
 export const ZELLIJ_WORKER_PANE_EVENT_SCHEMA = 'sks.zellij-worker-pane-event.v1';
 export function buildWorkerPaneName(slotId, generationIndex) {
@@ -25,11 +26,13 @@ export function buildWorkerPaneArtifact(input) {
     const blockers = input.blockers || [];
     const providerContext = normalizePaneProviderContext(input.providerContext, input.serviceTier);
     const paneTitle = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier, input.backend, input.statusLabel || input.status, input.worktree || null);
+    const directionRequested = input.directionRequested || 'right';
+    const directionApplied = input.directionApplied || 'not_applied';
     return {
         schema: ZELLIJ_WORKER_PANE_SCHEMA,
         generated_at: now,
         updated_at: now,
-        ok: blockers.length === 0 && isRealZellijWorkerPaneIdSource(paneIdSource) && Boolean(input.paneId),
+        ok: blockers.length === 0 && (paneIdSource === 'zellij_worker_headless_overflow' || (isRealZellijWorkerPaneIdSource(paneIdSource) && Boolean(input.paneId))),
         status: input.status || 'launching',
         mission_id: input.missionId,
         session_name: input.sessionName,
@@ -52,16 +55,21 @@ export function buildWorkerPaneArtifact(input) {
         stdout_log: input.stdoutLog,
         stderr_log: input.stderrLog,
         parent_child_transport: 'worker-result-json-and-heartbeat',
-        scaling_primitive: 'native_cli_process_in_zellij_worker_pane',
-        command: '<native-cli-worker-command>',
+        scaling_primitive: input.scalingPrimitive || 'native_cli_process_in_zellij_worker_pane',
+        command: String(input.workerCommand || '').includes('zellij-slot-pane') ? '<zellij-slot-pane-renderer-command>' : '<native-cli-worker-command>',
         create_session: input.createSession || null,
         launch: input.launch || null,
         pane_reconciliation: input.paneReconciliation || null,
         opened_at: now,
         closed_at: null,
         close: null,
-        direction_requested: input.directionRequested || 'right',
-        direction_applied: input.directionApplied || 'not_applied',
+        direction_requested: directionRequested,
+        direction_applied: directionApplied,
+        column_creation_direction_requested: input.columnCreationDirectionRequested ?? null,
+        column_creation_direction_applied: input.columnCreationDirectionApplied ?? null,
+        worker_direction_requested: input.workerDirectionRequested || 'down',
+        worker_direction_applied: input.workerDirectionApplied || (directionApplied === 'down' ? 'down' : directionApplied === 'unknown' ? 'unknown' : 'not_applied'),
+        slot_column_anchor_pane_id: input.slotColumnAnchorPaneId || null,
         right_column: input.rightColumn || null,
         sdk_thread_id: input.sdkThreadId || null,
         sdk_run_id: input.sdkRunId || null,
@@ -96,6 +104,7 @@ export async function openWorkerPane(input) {
             cwd,
             worker: { slotId: input.slotId, generationIndex: input.generationIndex },
             visiblePaneCap: input.visiblePaneCap || 1,
+            uiMode: input.uiMode || 'compact-slots',
             dashboardSnapshot: {
                 ...(input.dashboardSnapshot || {}),
                 mode: String(input.dashboardSnapshot?.mode || 'naruto'),
@@ -104,12 +113,80 @@ export async function openWorkerPane(input) {
             }
         })
         : null;
+    if (rightColumn?.placement === 'headless') {
+        const record = buildWorkerPaneArtifact({
+            ...input,
+            paneId: null,
+            paneIdSource: 'zellij_worker_headless_overflow',
+            createSession,
+            launch: null,
+            paneReconciliation: null,
+            directionRequested: 'down',
+            directionApplied: 'not_applied',
+            columnCreationDirectionRequested: null,
+            columnCreationDirectionApplied: 'not_applied',
+            workerDirectionRequested: 'down',
+            workerDirectionApplied: 'not_applied',
+            slotColumnAnchorPaneId: rightColumn.state.slot_column_anchor_pane_id || null,
+            rightColumn: {
+                mode: 'spawn-on-first-worker',
+                focus_pane_id: null,
+                y_order: null,
+                slot_column_anchor_pane_id: rightColumn.state.slot_column_anchor_pane_id || null
+            },
+            status: 'running',
+            providerContext,
+            serviceTier: input.serviceTier || providerContext.service_tier,
+            scalingPrimitive: 'native_cli_process_headless_with_slot_dashboard',
+            blockers: []
+        });
+        await writeWorkerPaneArtifact(root, record);
+        await appendWorkerPaneEvent(root, 'worker_headless_overflow', input, {
+            slot_id: input.slotId,
+            generation_index: input.generationIndex,
+            reason: `visible_pane_cap:${input.visiblePaneCap || 1}`
+        });
+        return record;
+    }
     const paneName = buildWorkerPaneTitle(input.slotId, input.generationIndex, providerContext, input.serviceTier, input.backend, input.statusLabel || 'running', input.worktree || null);
+    let slotColumnAnchorPaneId = rightColumn?.state.slot_column_anchor_pane_id || null;
+    let anchorLaunch = null;
+    let columnCreationDirectionRequested = null;
+    let columnCreationDirectionApplied = null;
+    if (rightColumn && !rightColumn.focusPaneId && !slotColumnAnchorPaneId) {
+        columnCreationDirectionRequested = 'right';
+        const anchorCommand = buildZellijSlotColumnAnchorCommand({
+            cliPath: path.join(packageRoot(), 'dist', 'bin', 'sks.js'),
+            missionId: input.missionId,
+            mode: input.uiMode || 'compact-slots',
+            artifactRoot: root,
+            watch: true
+        });
+        anchorLaunch = createSession.ok
+            ? await runZellij(['--session', input.sessionName, 'action', 'new-pane', '--direction', 'right', '--name', 'SLOTS', '--', 'sh', '-lc', anchorCommand], {
+                cwd,
+                timeoutMs: 5000,
+                optional: false
+            })
+            : null;
+        slotColumnAnchorPaneId = anchorLaunch?.ok ? extractZellijPaneIdFromOutput(anchorLaunch.stdout_tail) : null;
+        columnCreationDirectionApplied = anchorLaunch?.ok ? (slotColumnAnchorPaneId ? 'right' : 'unknown') : 'not_applied';
+        if (slotColumnAnchorPaneId) {
+            await recordSlotColumnAnchorInRightColumn({
+                root,
+                ...(input.projectRoot ? { projectRoot: input.projectRoot } : {}),
+                missionId: input.missionId,
+                sessionName: input.sessionName,
+                paneId: slotColumnAnchorPaneId
+            });
+        }
+    }
+    const focusPaneId = rightColumn?.focusPaneId || slotColumnAnchorPaneId || null;
     const directionRequested = rightColumn ? 'down' : 'right';
-    const focus = rightColumn?.focusPaneId
-        ? await focusZellijPaneById(input.sessionName, rightColumn.focusPaneId, cwd)
+    const focus = focusPaneId
+        ? await focusZellijPaneById(input.sessionName, focusPaneId, cwd)
         : null;
-    const newPaneArgs = ['--session', input.sessionName, 'action', 'new-pane', '--direction', directionRequested, ...(rightColumn ? ['--near-current-pane'] : []), '--name', paneName, '--', 'sh', '-lc', input.workerCommand];
+    const newPaneArgs = ['--session', input.sessionName, 'action', 'new-pane', '--direction', directionRequested, ...(directionRequested === 'down' ? ['--near-current-pane'] : []), '--name', paneName, '--', 'sh', '-lc', input.workerCommand];
     let launch = createSession.ok
         ? await runZellij(newPaneArgs, {
             cwd,
@@ -119,9 +196,9 @@ export async function openWorkerPane(input) {
         : null;
     let directionApplied = launch?.ok ? directionRequested : 'not_applied';
     if (createSession.ok && launch && !launch.ok) {
-        const fallbackArgs = rightColumn
+        const fallbackArgs = rightColumn && directionRequested === 'down'
             ? ['--session', input.sessionName, 'action', 'new-pane', '--direction', 'down', '--name', paneName, '--', 'sh', '-lc', input.workerCommand]
-            : ['--session', input.sessionName, 'action', 'new-pane', '--name', paneName, '--', 'sh', '-lc', input.workerCommand];
+            : ['--session', input.sessionName, 'action', 'new-pane', '--direction', directionRequested, '--name', paneName, '--', 'sh', '-lc', input.workerCommand];
         const fallback = await runZellij(fallbackArgs, {
             cwd,
             timeoutMs: 5000,
@@ -146,6 +223,8 @@ export async function openWorkerPane(input) {
     const blockers = [
         ...(createSession.ok ? [] : createSession.blockers.map((blocker) => `zellij_worker_session_${blocker}`)),
         ...(rightColumn && rightColumn.placement !== 'zellij-pane' ? [`zellij_worker_right_column_${rightColumn.placement}`] : []),
+        ...(rightColumn && columnCreationDirectionRequested === 'right' && columnCreationDirectionApplied !== 'right' ? ['zellij_worker_slot_column_anchor_not_created'] : []),
+        ...(anchorLaunch && !anchorLaunch.ok ? anchorLaunch.blockers.map((blocker) => `zellij_worker_slot_column_anchor_${blocker}`) : []),
         ...(launch && !launch.ok ? launch.blockers.map((blocker) => `zellij_worker_pane_${blocker}`) : []),
         ...(launch?.ok && !isRealZellijWorkerPaneIdSource(paneIdSource) ? ['zellij_worker_pane_id_real_source_missing'] : [])
     ];
@@ -159,11 +238,18 @@ export async function openWorkerPane(input) {
             ...(reconciledPane || {}),
             focus_pane: focus,
             focus_degraded: focus ? focus.ok !== true : false,
+            slot_column_anchor_pane_id: slotColumnAnchorPaneId,
+            slot_column_anchor_launch: anchorLaunch,
             rename_pane: renamePane
         },
         directionRequested,
         directionApplied,
-        rightColumn: rightColumn ? { mode: 'spawn-on-first-worker', focus_pane_id: rightColumn.focusPaneId, y_order: rightColumn.yOrder } : null,
+        columnCreationDirectionRequested,
+        columnCreationDirectionApplied,
+        workerDirectionRequested: 'down',
+        workerDirectionApplied: directionApplied === 'down' ? 'down' : directionApplied === 'unknown' ? 'unknown' : 'not_applied',
+        slotColumnAnchorPaneId,
+        rightColumn: rightColumn ? { mode: 'spawn-on-first-worker', focus_pane_id: focusPaneId, y_order: rightColumn.yOrder, slot_column_anchor_pane_id: slotColumnAnchorPaneId } : null,
         status: blockers.length ? 'failed' : 'running',
         providerContext,
         serviceTier: input.serviceTier || providerContext.service_tier,
@@ -204,7 +290,12 @@ export async function openWorkerPane(input) {
         provider_context: record.provider_context,
         direction_requested: record.direction_requested,
         direction_applied: record.direction_applied,
-        command: '<native-cli-worker-command>',
+        column_creation_direction_requested: record.column_creation_direction_requested || null,
+        column_creation_direction_applied: record.column_creation_direction_applied || null,
+        worker_direction_requested: record.worker_direction_requested,
+        worker_direction_applied: record.worker_direction_applied,
+        slot_column_anchor_pane_id: record.slot_column_anchor_pane_id || null,
+        command: record.command,
         worker_artifact_dir: input.workerArtifactDir,
         worker_result_path: input.resultPath,
         heartbeat_path: input.heartbeatPath,

package/dist/scripts/agent-role-config-repair-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/agents/agent-role-config.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-repair-'));
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+const plan = await mod.repairAgentRoleConfigs({ root, apply: false, codexHome: path.join(root, 'codex-home') });
+const repair = await mod.repairAgentRoleConfigs({ root, apply: true, codexHome: path.join(root, 'codex-home'), reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json') });
+const analysisScout = path.join(root, '.codex', 'agents', 'analysis-scout.toml');
+const staleRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-stale-'));
+fs.mkdirSync(path.join(staleRoot, '.codex', 'agents'), { recursive: true });
+fs.writeFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'model = "gpt-5-codex"\nsandbox_mode = "read-only"\n');
+const stalePlan = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: false, codexHome: path.join(staleRoot, 'codex-home') });
+const staleRepair = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: true, codexHome: path.join(staleRoot, 'codex-home') });
+const repairedText = fs.readFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
+const report = {
+    schema: 'sks.agent-role-config-repair-check.v1',
+    plan_ok: plan.ok === true && plan.missing.includes('analysis-scout.toml'),
+    repair_ok: repair.ok === true,
+    analysis_scout_created: fs.existsSync(analysisScout),
+    created_matches_model: fs.readFileSync(analysisScout, 'utf8').includes('model = "gpt-5.5"'),
+    stale_detected: stalePlan.stale.includes('analysis-scout.toml'),
+    stale_repaired: staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && repairedText.includes('name = "analysis_scout"') && repairedText.includes('model = "gpt-5.5"'),
+    warnings_suppressed: repair.warnings_suppressed === true,
+    artifact_written: fs.existsSync(path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json'))
+};
+const ok = report.plan_ok && report.repair_ok && report.analysis_scout_created && report.created_matches_model && report.stale_detected && report.stale_repaired && report.warnings_suppressed && report.artifact_written;
+assertGate(ok, 'doctor --fix must repair missing SKS-owned agent role configs', report);
+emitGate('agent:role-config-repair', report);
+//# sourceMappingURL=agent-role-config-repair-check.js.map

package/dist/scripts/git-worktree-checkpoint-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { checkpointWorkerWorktree } from '../core/git/git-worktree-checkpoint.js';
+import { runGitCommand } from '../core/git/git-worktree-runner.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-worktree-checkpoint-'));
+await runGitCommand(root, ['init']);
+await runGitCommand(root, ['config', 'user.email', 'sks@example.test']);
+await runGitCommand(root, ['config', 'user.name', 'SKS Test']);
+fs.writeFileSync(path.join(root, 'a.txt'), 'a\n');
+await runGitCommand(root, ['add', 'a.txt']);
+await runGitCommand(root, ['commit', '-m', 'base']);
+fs.writeFileSync(path.join(root, 'a.txt'), 'a2\n');
+fs.writeFileSync(path.join(root, 'b.txt'), 'b\n');
+const report = await checkpointWorkerWorktree({ worktreePath: root, repoRoot: root, workerId: 'W1', taskId: 'T1', mode: 'auto' });
+assertGate(report.ok && report.mode_applied === 'checkpoint-commit' && Boolean(report.commit_hash), 'Git worktree checkpoint must create checkpoint commits for multi-file changes', report);
+emitGate('git:worktree-checkpoint', report);
+//# sourceMappingURL=git-worktree-checkpoint-check.js.map

package/dist/scripts/git-worktree-cross-rebase-check.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { crossRebaseIdleWorktrees } from '../core/git/git-worktree-cross-rebase.js';
+import { runGitCommand, gitOutputLine } from '../core/git/git-worktree-runner.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-worktree-cross-rebase-'));
+await runGitCommand(root, ['init']);
+await runGitCommand(root, ['config', 'user.email', 'sks@example.test']);
+await runGitCommand(root, ['config', 'user.name', 'SKS Test']);
+fs.writeFileSync(path.join(root, 'base.txt'), 'base\n');
+await runGitCommand(root, ['add', 'base.txt']);
+await runGitCommand(root, ['commit', '-m', 'base']);
+const workerPath = path.join(root, '..', `worker-${process.pid}`);
+await runGitCommand(root, ['worktree', 'add', workerPath, 'HEAD']);
+fs.writeFileSync(path.join(root, 'integration.txt'), 'integration\n');
+await runGitCommand(root, ['add', 'integration.txt']);
+await runGitCommand(root, ['commit', '-m', 'integration']);
+const head = gitOutputLine(await runGitCommand(root, ['rev-parse', 'HEAD']));
+const report = await crossRebaseIdleWorktrees({
+    integrationHead: head,
+    workers: [{ worker_id: 'W1', worktree_path: workerPath, state: 'idle' }]
+});
+assertGate(report.ok && report.applied_count === 1, 'Idle worktrees must cross-rebase to the integration head', report);
+emitGate('git:worktree-cross-rebase', report);
+//# sourceMappingURL=git-worktree-cross-rebase-check.js.map

package/dist/scripts/git-worktree-integration-primary-check.js

@@ -17,6 +17,8 @@ const integrationPath = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-integration-'
 fs.rmSync(integrationPath, { recursive: true, force: true });
 const integration = await managerMod.allocateWorkerWorktree({ repoRoot: repo, missionId: 'M-integrate', workerId: 'integration', slotId: 'integration' });
 const report = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktreePath: integration.worktree_path, diffs: [diff] });
-assertGate(report.ok === true && report.applied_count === 1, 'git-worktree-diff must apply through merge queue', report);
-emitGate('git:worktree-integration-primary', { applied_count: report.applied_count });
+const mainReport = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktreePath: repo, diffs: [diff] });
+const mainContent = fs.readFileSync(path.join(repo, 'a.txt'), 'utf8');
+assertGate(report.ok === true && report.applied_count === 1 && mainReport.ok === true && mainReport.applied_count === 1 && mainContent.includes('integrated'), 'git-worktree-diff must prevalidate in integration worktree and apply to main repo', { report, mainReport, mainContent });
+emitGate('git:worktree-integration-primary', { applied_count: report.applied_count, main_applied_count: mainReport.applied_count });
 //# sourceMappingURL=git-worktree-integration-primary-check.js.map

package/dist/scripts/git-worktree-integration-primary-runtime-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const orchestrator = fs.readFileSync(path.join(root, 'src/core/agents/agent-orchestrator.ts'), 'utf8');
+const report = {
+    schema: 'sks.git-worktree-integration-primary-runtime-check.v1',
+    splits_worktree_entries: orchestrator.includes("entry.envelope?.source === 'git-worktree-diff'"),
+    uses_integration_worktree: orchestrator.includes('createGitIntegrationWorktree'),
+    uses_merge_queue: orchestrator.includes('applyGitWorktreeMergeQueue'),
+    applies_to_main_repo: orchestrator.includes('main_repo_apply') && orchestrator.includes('integrationWorktreePath: repoRoot'),
+    rollback_evidence: orchestrator.includes('rollback_evidence') && orchestrator.includes('captureGitWorktreeRollbackPlan') && orchestrator.includes('completeGitWorktreeRollbackPlan'),
+    bypasses_normal_apply: orchestrator.includes('const normalEntries') && orchestrator.includes('applyAgentPatchQueueEntry(root, entry') && orchestrator.includes('parallelEntries = disjointEntries'),
+    writes_report: orchestrator.includes('git-worktree-merge-queue-report.json')
+};
+const ok = report.splits_worktree_entries && report.uses_integration_worktree && report.uses_merge_queue && report.applies_to_main_repo && report.rollback_evidence && report.bypasses_normal_apply && report.writes_report;
+assertGate(ok, 'git-worktree-diff entries must use integration merge queue primary path', report);
+emitGate('git:worktree-integration-primary-runtime', report);
+//# sourceMappingURL=git-worktree-integration-primary-runtime-check.js.map

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -17,6 +17,7 @@ const uncovered = [];
 const GUARD_CALL = /\bguarded(WriteFile|Rm|Rename|Chmod|Xattr|Chflags|GlobalCodexConfigWrite|ProcessKill|PackageInstall|SkillSnapshotPromotion|Apply)\(/;
 const RISKY = [
     { kind: 'write_file', token: 'fs.writeFile', re: /\bfs\.writeFile\(/ },
+    { kind: 'write_file', token: 'fs.promises.writeFile', re: /\bfs\.promises\.writeFile\(/ },
     { kind: 'write_file', token: 'fsp.writeFile', re: /\bfsp\.writeFile\(/ },
     { kind: 'write_file', token: 'writeFileSync', re: /\b(?:fs\.)?writeFileSync\(/ },
     { kind: 'rm', token: 'fs.rm', re: /\bfs\.rm\(/ },
@@ -167,7 +168,7 @@ function processKillIsLivenessProbe(line) {
     return /\bprocess\.kill\([^,\n]+,\s*0\s*\)/.test(line);
 }
 function codexHomeMutationOnLine(line) {
-    return /\b(?:writeTextAtomic|writeJsonAtomic|writeFileSync|fs\.writeFile|fsp\.writeFile|fs\.rm|fsp\.rm|fs\.rename|fsp\.rename|fs\.chmod|fsp\.chmod|copyFile|open)\b/.test(line)
+    return /\b(?:writeTextAtomic|writeJsonAtomic|writeFileSync|fs\.writeFile|fs\.promises\.writeFile|fsp\.writeFile|fs\.rm|fsp\.rm|fs\.rename|fsp\.rename|fs\.chmod|fsp\.chmod|copyFile|open)\b/.test(line)
         && /(?:~\/\.codex|CODEX_HOME|codexHome|codexLbHome|auth\.json|config\.toml)/.test(line);
 }
 function snippet(line) {

package/dist/scripts/naruto-actual-worker-control-plane-check.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { collectActualNarutoWorker, spawnActualNarutoWorker } from '../core/naruto/naruto-real-worker-runtime.js';
+process.env.SKS_CODEX_SDK_FAKE = '1';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-actual-worker-'));
+const graph = buildNarutoWorkGraph({ requestedClones: 1, totalWorkItems: 1, readonly: true, writeCapable: false });
+const item = graph.work_items[0];
+const handle = await spawnActualNarutoWorker({
+    root,
+    missionId: `M-naruto-actual-worker-${process.pid}`,
+    item,
+    placement: { placement: 'headless', visible_index: null, reason: 'check' },
+    backend: 'fake',
+    visiblePaneCap: 0
+});
+const collected = await collectActualNarutoWorker(handle);
+const result = JSON.parse(fs.readFileSync(path.join(handle.worker_artifact_dir, 'worker-result.json'), 'utf8'));
+const ok = collected.ok === true
+    && result.ok === true
+    && result.control_plane_result?.worker_result_path
+    && result.control_plane_result?.structured_output_valid === true;
+assertGate(ok, 'Naruto actual worker must call Codex Control Plane and write structured result evidence', { collected, result });
+emitGate('naruto:actual-worker-control-plane', { collected, result });
+//# sourceMappingURL=naruto-actual-worker-control-plane-check.js.map

package/dist/scripts/naruto-allocation-policy-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { allocateNarutoTasksToWorkers, chooseNarutoTaskOwner } from '../core/naruto/naruto-allocation-policy.js';
+const base = {
+    kind: 'implementation',
+    title: 'impl',
+    target_paths: ['src/core/naruto/runtime.ts'],
+    readonly_paths: [],
+    write_paths: ['src/core/naruto/runtime.ts'],
+    required_role: 'implementer',
+    write_allowed: true,
+    verification_required: true,
+    dependencies: [],
+    can_run_in_parallel_with: [],
+    conflicts_with: [],
+    estimated_cost: { tokens: 1, latency_ms: 1, cpu_weight: 1, memory_mb: 1, gpu_weight: 0 },
+    lease_requirements: [{ path: 'src/core/naruto/runtime.ts', kind: 'write' }],
+    acceptance: { requires_patch_envelope: true, requires_verification: true, requires_gpt_final: true }
+};
+const workers = [
+    { id: 'w1', role: 'implementer', lane: 'src/core' },
+    { id: 'w2', role: 'verifier', lane: 'src/scripts' }
+];
+const decision = chooseNarutoTaskOwner({ ...base, id: 'T1' }, workers);
+const blocked = chooseNarutoTaskOwner({ ...base, id: 'T2', dependencies: ['T0'] }, workers);
+const assignments = allocateNarutoTasksToWorkers([{ ...base, id: 'T1' }, { ...base, id: 'T2', required_role: 'verifier' }], workers);
+const ok = decision.owner === 'w1'
+    && decision.score >= 24
+    && blocked.score === Number.NEGATIVE_INFINITY
+    && assignments.length === 2;
+assertGate(ok, 'Naruto allocation policy must score role/lane overlap and block incomplete dependencies with -Infinity', { decision, blocked, assignments });
+emitGate('naruto:allocation-policy', { decision, blocked, assignments });
+//# sourceMappingURL=naruto-allocation-policy-check.js.map

package/dist/scripts/naruto-extreme-parallelism-check.js

@@ -13,7 +13,7 @@ const governor = decideNarutoConcurrency({
 });
 const report = {
     schema: 'sks.naruto-extreme-parallelism-check.v1',
-    ok: graph.total_work_items >= 200 && governor.safe_active_workers >= 16 && governor.safe_zellij_visible_panes <= governor.safe_active_workers && graph.mixed_work_kinds.length >= 6,
+    ok: graph.total_work_items >= 200 && governor.safe_active_workers >= 16 && governor.safe_zellij_visible_panes <= governor.safe_active_workers && governor.safe_zellij_visible_panes <= 8 && graph.mixed_work_kinds.length >= 6,
     graph: { total_work_items: graph.total_work_items, mixed_work_kinds: graph.mixed_work_kinds, write_allowed_count: graph.write_allowed_count },
     governor
 };

package/dist/scripts/naruto-extreme-parallelism-real-check.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { runNarutoRealActivePool } from '../core/naruto/naruto-active-pool.js';
+import { collectActualNarutoWorker, spawnActualNarutoWorker } from '../core/naruto/naruto-real-worker-runtime.js';
+process.env.SKS_CODEX_SDK_FAKE = '1';
+const graph = buildNarutoWorkGraph({ requestedClones: 100, totalWorkItems: 48, writeCapable: true, maxActiveWorkers: 12 });
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-extreme-real-'));
+const missionId = `M-naruto-extreme-real-${process.pid}`;
+const governor = decideNarutoConcurrency({
+    requestedClones: 100,
+    totalWorkItems: graph.total_work_items,
+    pendingWorkQueueSize: graph.total_work_items,
+    backend: 'fake',
+    hardware: { cores: 16, loadAverage: [1, 1, 1], freeMemoryBytes: 64 * 1024 * 1024 * 1024, totalMemoryBytes: 128 * 1024 * 1024 * 1024, fileDescriptorLimit: 8192, processCount: 100, terminalRows: 48, remoteApiRateLimitBudget: 32, localLlmMaxParallelRequests: 8 }
+});
+const target = { ...governor, safe_active_workers: Math.min(12, governor.safe_active_workers), safe_zellij_visible_panes: Math.min(4, governor.safe_zellij_visible_panes) };
+const report = await runNarutoRealActivePool({
+    graph,
+    governor: target,
+    spawnWorker: async (item, placement) => spawnActualNarutoWorker({
+        root: tempRoot,
+        missionId,
+        item,
+        placement,
+        backend: 'fake',
+        visiblePaneCap: target.safe_zellij_visible_panes,
+        zellijSessionName: `sks-${missionId}`
+    }),
+    collectWorker: async (handle) => collectActualNarutoWorker(handle),
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const actualArtifacts = report.worker_lifecycle.every((row) => row.pid && row.worker_artifact_dir && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json')));
+const ok = report.ok && report.max_observed_active_workers >= Math.ceil(target.safe_active_workers * 0.8) && report.active_pool_utilization >= 0.8 && report.headless_workers > 0 && report.visible_workers <= graph.total_work_items && actualArtifacts;
+assertGate(ok, 'Naruto extreme parallelism must use actual child process active-pool lifecycle near cap with headless overflow', { report, target, actualArtifacts, tempRoot });
+emitGate('naruto:extreme-parallelism-real', report);
+//# sourceMappingURL=naruto-extreme-parallelism-real-check.js.map

package/dist/scripts/naruto-orchestrator-runtime-source-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const source = fs.readFileSync(path.join(process.cwd(), 'src/core/commands/naruto-command.ts'), 'utf8');
+const ok = source.includes("runtime_source_of_truth: 'agent-orchestrator-scheduler'")
+    && source.includes("production_runtime_source_of_truth: 'agent-orchestrator-scheduler'")
+    && source.includes('pre_run_smoke_never_owns_production_runtime');
+assertGate(ok, 'Naruto production runtime source of truth must be the native agent orchestrator scheduler, not pre-run active-pool smoke', { ok });
+emitGate('naruto:orchestrator-runtime-source', { ok });
+//# sourceMappingURL=naruto-orchestrator-runtime-source-check.js.map

package/dist/scripts/naruto-real-active-pool-check.js

@@ -32,7 +32,8 @@ const report = await runNarutoRealActivePool({
         dashboardEvents += 1;
     }
 });
-const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && dashboardEvents > graph.total_work_items;
+const processEvidence = report.worker_lifecycle.every((row) => row.pid == null || row.worker_artifact_dir != null);
+const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && dashboardEvents > graph.total_work_items && report.active_cap === target.safe_active_workers && processEvidence;
 assertGate(ok, 'Naruto real active pool must run spawn/collect lifecycle and refill to cap', { report, spawned, collected, dashboardEvents, target });
-emitGate('naruto:real-active-pool', { spawned, collected, max_observed_active_workers: report.max_observed_active_workers, refill_latency_ms_p95: report.refill_latency_ms_p95 });
+emitGate('naruto:real-active-pool', { spawned, collected, active_cap: report.active_cap, max_observed_active_workers: report.max_observed_active_workers, refill_latency_ms_p95: report.refill_latency_ms_p95, active_pool_utilization: report.active_pool_utilization });
 //# sourceMappingURL=naruto-real-active-pool-check.js.map

package/dist/scripts/naruto-real-active-pool-runtime-check.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { runNarutoRealActivePool } from '../core/naruto/naruto-active-pool.js';
+import { collectActualNarutoWorker, spawnActualNarutoWorker } from '../core/naruto/naruto-real-worker-runtime.js';
+process.env.SKS_CODEX_SDK_FAKE = '1';
+const graph = buildNarutoWorkGraph({ requestedClones: 12, totalWorkItems: 24, writeCapable: false, maxActiveWorkers: 6 });
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-real-runtime-'));
+const missionId = `M-naruto-real-runtime-${process.pid}`;
+const governor = decideNarutoConcurrency({
+    requestedClones: 12,
+    totalWorkItems: graph.total_work_items,
+    pendingWorkQueueSize: graph.total_work_items,
+    backend: 'codex-sdk',
+    hardware: { cores: 8, freeMemoryBytes: 32 * 1024 * 1024 * 1024, totalMemoryBytes: 64 * 1024 * 1024 * 1024, fileDescriptorLimit: 4096, processCount: 100, terminalRows: 40, remoteApiRateLimitBudget: 8 }
+});
+let spawned = 0;
+let collected = 0;
+const target = { ...governor, safe_active_workers: Math.min(6, governor.safe_active_workers), safe_zellij_visible_panes: 3 };
+const report = await runNarutoRealActivePool({
+    graph,
+    governor: target,
+    spawnWorker: async (item, placement) => {
+        spawned += 1;
+        return spawnActualNarutoWorker({
+            root: tempRoot,
+            missionId,
+            item,
+            placement,
+            backend: 'fake',
+            visiblePaneCap: target.safe_zellij_visible_panes,
+            zellijSessionName: `sks-${missionId}`
+        });
+    },
+    collectWorker: async (handle) => {
+        collected += 1;
+        return collectActualNarutoWorker(handle);
+    },
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const processEvidence = report.worker_lifecycle.every((row) => row.pid && row.worker_artifact_dir);
+const artifactEvidence = report.worker_lifecycle.every((row) => row.worker_artifact_dir
+    && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-heartbeat.jsonl'))
+    && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json'))
+    && fs.existsSync(path.join(row.worker_artifact_dir, 'codex-control', 'codex-control-proof.json')));
+const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && report.active_pool_utilization >= 0.8 && processEvidence && artifactEvidence;
+assertGate(ok, 'Naruto real active pool runtime must include actual child process, heartbeat, and result evidence', { report, spawned, collected, processEvidence, artifactEvidence, tempRoot });
+emitGate('naruto:real-active-pool-runtime', report);
+//# sourceMappingURL=naruto-real-active-pool-runtime-check.js.map

package/dist/scripts/naruto-rebalance-policy-check.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { rebalanceNarutoReadyWork } from '../core/naruto/naruto-rebalance-policy.js';
+const item = (id, dependencies = []) => ({
+    id,
+    kind: 'verification',
+    title: id,
+    target_paths: ['src/core/naruto/runtime.ts'],
+    readonly_paths: ['src/core/naruto/runtime.ts'],
+    write_paths: [],
+    required_role: 'verifier',
+    write_allowed: false,
+    verification_required: true,
+    dependencies,
+    can_run_in_parallel_with: [],
+    conflicts_with: [],
+    estimated_cost: { tokens: 1, latency_ms: 1, cpu_weight: 1, memory_mb: 1, gpu_weight: 0 },
+    lease_requirements: [],
+    acceptance: { requires_patch_envelope: false, requires_verification: true, requires_gpt_final: false }
+});
+const decisions = rebalanceNarutoReadyWork({
+    tasks: [item('A'), item('B', ['A'])],
+    workers: [{ id: 'idle-1', role: 'verifier', lane: 'src/core', alive: true, state: 'idle' }],
+    completedTaskIds: []
+});
+assertGate(decisions.length === 1 && decisions[0]?.task_id === 'A', 'Naruto rebalance must assign only dependency-ready pending work to idle workers', { decisions });
+emitGate('naruto:rebalance-policy', { decisions });
+//# sourceMappingURL=naruto-rebalance-policy-check.js.map

package/dist/scripts/naruto-shadow-clone-swarm-check.js

@@ -68,9 +68,10 @@ assertGate(lowFreeButCapable.cap >= 4, 'capable hosts must not collapse Naruto c
 // heavy backend scales well past the old 16-core-derived ceiling toward 100.
 const bigMemoryHost = roster.systemSafeNarutoConcurrency({ backend: 'codex-sdk', cores: 4, freeBytes: 48 * 1024 * 1024 * 1024, totalBytes: 64 * 1024 * 1024 * 1024 });
 assertGate(bigMemoryHost.cap >= 64, 'a 64 GB host must allow >= 64 parallel codex-sdk workers regardless of core count (network-bound, memory-budgeted)', { bigMemoryHost });
-// 6) End-to-end run: 24 clones (> standard 20 → ceiling lifted) all complete, but live
-//    concurrency is throttled to the host-safe cap (never the full 24 unless the host allows).
+// 6) End-to-end run: 24 clones (> standard 20 -> ceiling lifted) all complete, while
+//    release verification keeps live slots bounded so the gate stays hermetic under DAG load.
 const proofClones = 24;
+const proofConcurrency = 6;
 const cli = path.join(root, 'dist', 'bin', 'sks.js');
 const isolatedWorktreeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-shadow-wt-'));
 const childEnv = { ...process.env, SKS_WORKTREE_ROOT: isolatedWorktreeRoot };
@@ -83,8 +84,9 @@ const run = spawnSync(process.execPath, [
     '--clones', String(proofClones),
     '--backend', 'fake',
     '--work-items', String(proofClones),
+    '--concurrency', String(proofConcurrency),
     '--json'
-], { cwd: root, env: childEnv, encoding: 'utf8', timeout: 240000, maxBuffer: 8 * 1024 * 1024 });
+], { cwd: root, env: childEnv, encoding: 'utf8', timeout: 300000, maxBuffer: 8 * 1024 * 1024 });
 assertGate(run.status === 0, 'sks naruto run must exit 0', { status: run.status, stderr: tail(run.stderr) });
 const parsed = parseJson(run.stdout);
 assertGate(parsed !== null, 'sks naruto run must emit JSON', { stdout: tail(run.stdout) });
@@ -96,6 +98,7 @@ assertGate(parsed.proof === 'passed', 'naruto run proof must pass', { proof: par
 // Throttle invariant: active concurrency never exceeds the requested count nor the host cap.
 assertGate(parsed.target_active_slots >= 1 && parsed.target_active_slots <= proofClones, 'active slots must be in [1, clones]', { target_active_slots: parsed.target_active_slots });
 assertGate(parsed.target_active_slots <= fakeSafe.cap, 'active slots must be throttled to the system-safe cap', { target_active_slots: parsed.target_active_slots, cap: fakeSafe.cap });
+assertGate(parsed.target_active_slots === proofConcurrency, 'release proof must keep Naruto live slots bounded while fan-out stays >20', { target_active_slots: parsed.target_active_slots, proofConcurrency });
 // Task 9.1: fan-out (clones) and live concurrency (target_active_slots) are reported
 // distinctly, and concurrency_capped truthfully reflects "N clones, running M at a time".
 assertGate(typeof parsed.concurrency_capped === 'boolean', 'naruto run must report concurrency_capped', { concurrency_capped: parsed.concurrency_capped });
@@ -125,6 +128,7 @@ emitGate('naruto:shadow-clone-swarm', {
     default_clamp: defaultSlots,
     naruto_slots_at_100: narutoSlots,
     proof_clones: proofClones,
+    proof_concurrency: proofConcurrency,
     target_active_slots: parsed.target_active_slots,
     fake_safe_cap: fakeSafe.cap,
     heavy_safe_cap: heavySafe.cap,