sneakoscope 3.0.4 → 3.1.1

package/dist/core/pipeline-internals/runtime-core.js

@@ -1213,9 +1213,17 @@ export async function recordContext7Evidence(root, state, payload) {
         return null;
     if (!await shouldWritePipelineEvidence(root, state))
         return null;
-    const record = { ts: nowIso(), stage, tool: context7ToolName(payload), payload_keys: Object.keys(payload || {}).sort() };
     const id = state?.mission_id;
     const file = id ? path.join(missionDir(root, id), 'context7-evidence.jsonl') : path.join(root, '.sneakoscope', 'state', 'context7-evidence.jsonl');
+    const record = {
+        ts: nowIso(),
+        stage,
+        tool: context7ToolName(payload),
+        payload_keys: Object.keys(payload || {}).sort(),
+        dedupe_key: context7DedupeKey(stage, payload)
+    };
+    if (await hasContext7EvidenceRecord(file, record.dedupe_key))
+        return null;
     await appendJsonl(file, record);
     if (id) {
         const evidence = await context7Evidence(root, state);
@@ -1297,7 +1305,11 @@ function context7ToolName(payload) {
     return String(obj.tool_name || obj.name || obj.tool?.name || obj.mcp_tool || obj.command || obj.type || '');
 }
 function context7Stage(payload) {
-    const hay = JSON.stringify(payload || {});
+    const tool = context7ToolName(payload);
+    const direct = context7DirectSignal(payload);
+    if (!direct && !context7ToolLooksRelevant(tool))
+        return null;
+    const hay = [tool, direct].filter(Boolean).join('\n');
     if (!/(context7|resolve[-_]?library[-_]?id|get[-_]?library[-_]?docs|query[-_]?docs)/i.test(hay))
         return null;
     if (/resolve[-_]?library[-_]?id/i.test(hay))
@@ -1306,6 +1318,74 @@ function context7Stage(payload) {
         return 'get-library-docs';
     return 'context7';
 }
+function context7ToolLooksRelevant(tool) {
+    return /(^|[_:/.-])(context7|resolve[-_]?library[-_]?id|get[-_]?library[-_]?docs|query[-_]?docs)($|[_:/.-])/i.test(String(tool || ''));
+}
+function context7DirectSignal(payload = {}) {
+    const source = String(payload.source || '');
+    const tool = context7ToolName(payload);
+    if (/^sks context7 evidence/i.test(source)) {
+        return [
+            tool,
+            source,
+            payload.library,
+            payload.library_id,
+            payload.docs_tool
+        ].filter(Boolean).join('\n');
+    }
+    if (context7ToolLooksRelevant(tool)) {
+        const input = payload.tool_input || payload.toolInput || payload.input || payload.tool?.input || {};
+        return JSON.stringify({
+            tool,
+            library: payload.library,
+            library_id: payload.library_id,
+            docs_tool: payload.docs_tool,
+            input: context7SafeInput(input)
+        });
+    }
+    return '';
+}
+function context7SafeInput(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return input ?? null;
+    const out = {};
+    for (const key of ['name', 'tool', 'library', 'libraryName', 'library_id', 'libraryId', 'context7CompatibleLibraryID', 'query', 'topic', 'tokens']) {
+        if (Object.prototype.hasOwnProperty.call(input, key))
+            out[key] = input[key];
+    }
+    return out;
+}
+function context7DedupeKey(stage, payload = {}) {
+    const input = payload.tool_input || payload.toolInput || payload.input || payload.tool?.input || {};
+    const library = payload.library_id
+        || payload.library
+        || input.libraryId
+        || input.context7CompatibleLibraryID
+        || input.libraryName
+        || input.library
+        || '';
+    const query = input.query || input.topic || payload.query || payload.topic || '';
+    return [
+        stage,
+        context7ToolName(payload),
+        String(library).trim().toLowerCase(),
+        String(query).trim().toLowerCase()
+    ].join('|');
+}
+async function hasContext7EvidenceRecord(file, key) {
+    const text = await readText(file, '');
+    for (const line of text.split(/\n/)) {
+        if (!line.trim())
+            continue;
+        try {
+            const entry = JSON.parse(line);
+            if (entry.dedupe_key === key)
+                return true;
+        }
+        catch { }
+    }
+    return false;
+}
 export async function context7Evidence(root, state) {
     const id = state?.mission_id;
     if (!id)

package/dist/core/proof/proof-schema.js

@@ -38,6 +38,12 @@ export function emptyCompletionProof(overrides = {}) {
         claims: [],
         unverified: [],
         blockers: [],
+        failure_analysis: {
+            status: 'not_required',
+            root_cause: null,
+            corrective_action: null,
+            evidence: []
+        },
         next_human_actions: [],
         ...overrides
     };

package/dist/core/proof/proof-writer.js

@@ -76,10 +76,13 @@ export function renderProofMarkdown(proof = {}, validation = validateCompletionP
         `- Wrongness: ${proof.evidence?.wrongness?.active_count ?? 0} active (${proof.evidence?.wrongness?.high_severity_active ?? 0} high)`,
         `- Evidence router: ${proof.evidence?.evidence_router?.records ?? 0} record(s)`,
         `- Trust report: ${proof.evidence?.trust_report || 'not_recorded'}`,
-        '',
-        '## Unverified',
         ''
     ];
+    const failureAnalysis = proof.failure_analysis;
+    if (failureAnalysis && (failureAnalysis.status !== 'not_required' || failureAnalysis.root_cause || failureAnalysis.corrective_action)) {
+        lines.push('## Failure Analysis', '', `- Status: ${failureAnalysis.status || 'unknown'}`, `- Root cause: ${failureAnalysis.root_cause || 'not_recorded'}`, `- Corrective action: ${failureAnalysis.corrective_action || 'not_recorded'}`, `- Evidence: ${Array.isArray(failureAnalysis.evidence) ? failureAnalysis.evidence.length : failureAnalysis.evidence ? 1 : 0}`, '');
+    }
+    lines.push('## Unverified', '');
     const unverified = proof.unverified?.length ? proof.unverified : ['No unverified claims recorded.'];
     for (const item of unverified)
         lines.push(`- ${typeof item === 'string' ? item : JSON.stringify(item)}`);

package/dist/core/proof/root-cause-policy.js

@@ -0,0 +1,70 @@
+const PROBLEM_PATTERN = /\b(fallback|workaround|bypass|temporary|synthetic|stale|missing|failed|failure|error|blocked|not_ok|not ok|fixture_child_missing|native_agent_proof_false)\b/i;
+const COMPLETE_STATUSES = new Set(['complete', 'completed', 'corrected', 'resolved', 'fixed']);
+const BLOCKING_STATUSES = new Set(['blocked', 'failed', 'not_verified']);
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function asList(value) {
+    return Array.isArray(value) ? value : [];
+}
+function meaningfulString(value, minLength = 12) {
+    return typeof value === 'string' && value.trim().length >= minLength;
+}
+function hasEvidence(value) {
+    if (typeof value === 'string')
+        return value.trim().length >= 6;
+    if (Array.isArray(value))
+        return value.length > 0;
+    if (value && typeof value === 'object')
+        return Object.keys(value).length > 0;
+    return false;
+}
+export function rootCauseAnalysisRequired(proof = {}, validationIssues = []) {
+    const proofRecord = asRecord(proof);
+    if (!Object.keys(proofRecord).length)
+        return false;
+    const evidence = asRecord(proofRecord.evidence);
+    const agents = asRecord(evidence.agents);
+    const routeGate = asRecord(evidence.route_gate);
+    if (BLOCKING_STATUSES.has(String(proofRecord.status || '')))
+        return true;
+    if (asList(proofRecord.blockers).length > 0)
+        return true;
+    if (validationIssues.some((issue) => String(issue) !== 'root_cause_analysis_missing'))
+        return true;
+    const problemSurface = {
+        status: proofRecord.status,
+        unverified: proofRecord.unverified,
+        blockers: proofRecord.blockers,
+        claims: proofRecord.claims,
+        route_gate: routeGate,
+        agents: {
+            ok: agents.ok,
+            status: agents.status,
+            blockers: agents.blockers,
+            issues: agents.issues
+        },
+        wrongness: evidence.wrongness,
+        trust_report: evidence.trust_report
+    };
+    return PROBLEM_PATTERN.test(JSON.stringify(problemSurface));
+}
+export function rootCauseAnalysisComplete(proof = {}) {
+    const proofRecord = asRecord(proof);
+    const analysis = asRecord(proofRecord.failure_analysis || asRecord(proofRecord.evidence).root_cause_analysis);
+    if (!Object.keys(analysis).length)
+        return false;
+    const status = String(analysis.status || '').toLowerCase();
+    if (!COMPLETE_STATUSES.has(status))
+        return false;
+    const rootCause = analysis.root_cause ?? analysis.cause;
+    const correctiveAction = analysis.corrective_action ?? analysis.fix ?? analysis.correction;
+    const evidence = analysis.evidence ?? analysis.proof ?? analysis.references;
+    return meaningfulString(rootCause) && meaningfulString(correctiveAction) && hasEvidence(evidence);
+}
+export function rootCauseAnalysisIssue(proof = {}, validationIssues = []) {
+    if (!rootCauseAnalysisRequired(proof, validationIssues))
+        return null;
+    return rootCauseAnalysisComplete(proof) ? null : 'root_cause_analysis_missing';
+}
+//# sourceMappingURL=root-cause-policy.js.map

package/dist/core/proof/route-adapter.js

@@ -5,7 +5,7 @@ import { normalizeProofRoute, routeRequiresImageVoxelAnchors } from './route-pro
 import { linkProofClaimsToEvidence, proofEvidenceSummary } from '../evidence/evidence-proof-linker.js';
 import { writeTrustArtifactsForProof } from '../trust-kernel/trust-report.js';
 import { enforceRetention } from '../retention.js';
-export async function writeRouteCompletionProof(root, { missionId = null, route = null, status = 'verified_partial', gate = null, summary = {}, artifacts = [], evidence = {}, claims = [], unverified = [], blockers = [], nextHumanActions = [] } = {}) {
+export async function writeRouteCompletionProof(root, { missionId = null, route = null, status = 'verified_partial', gate = null, summary = {}, artifacts = [], evidence = {}, claims = [], unverified = [], blockers = [], failureAnalysis = null, nextHumanActions = [] } = {}) {
     const collected = await collectProofEvidence(root);
     const normalizedRoute = normalizeProofRoute(route);
     const mergedEvidence = {
@@ -36,6 +36,7 @@ export async function writeRouteCompletionProof(root, { missionId = null, route
         claims,
         unverified,
         blockers,
+        failure_analysis: normalizeFailureAnalysis(failureAnalysis || evidence.failure_analysis || evidence.root_cause_analysis),
         next_human_actions: nextHumanActions
     }, {
         command: {
@@ -68,6 +69,22 @@ export async function writeRouteCompletionProof(root, { missionId = null, route
     const retention = await runPostRouteRetention(root, missionId);
     return { ...enriched, trust, retention };
 }
+function normalizeFailureAnalysis(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return {
+            status: 'not_required',
+            root_cause: null,
+            corrective_action: null,
+            evidence: []
+        };
+    }
+    return {
+        status: value.status || 'complete',
+        root_cause: value.root_cause || value.cause || null,
+        corrective_action: value.corrective_action || value.fix || value.correction || null,
+        evidence: value.evidence || value.proof || value.references || []
+    };
+}
 function normalizeRouteProofStatus(status, { route, evidence, blockers, unverified }) {
     if (blockers?.length)
         return status === 'failed' ? 'failed' : 'blocked';

package/dist/core/proof/route-proof-gate.js

@@ -3,6 +3,7 @@ import { readRouteProof } from './proof-reader.js';
 import { validateCompletionProof } from './validation.js';
 import { normalizeProofRoute, proofStatusBlocks, routeRequiresCompletionProof, routeRequiresImageVoxelAnchors } from './route-proof-policy.js';
 import { routeRequiresAgentIntake } from '../agents/agent-plan.js';
+import { rootCauseAnalysisIssue } from './root-cause-policy.js';
 export async function validateRouteCompletionProof(root, { missionId = null, route = null, state = {}, visualClaim = undefined } = {}) {
     const proofRequired = state.proof_required === true || routeRequiresCompletionProof(route);
     if (!proofRequired)
@@ -61,6 +62,9 @@ export async function validateRouteCompletionProof(root, { missionId = null, rou
         issues.push('active_wrongness_high');
     if (proof.status === 'verified' && Number(wrongness?.active_count || 0) > 0)
         issues.push('active_wrongness_requires_partial');
+    const rootCauseIssue = rootCauseAnalysisIssue(proof, issues);
+    if (rootCauseIssue)
+        issues.push(rootCauseIssue);
     return {
         ok: issues.length === 0,
         required: true,

package/dist/core/release/release-gate-batch-runner.js

@@ -1,7 +1,10 @@
 import { spawn } from 'node:child_process';
 import path from 'node:path';
+import { createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { writeReleaseGateJson } from './release-gate-report.js';
-const DISALLOWED_BATCH_RESOURCES = new Set(['zellij-real', 'git-worktree', 'local-llm-real', 'remote-model-real', 'publish', 'global-config']);
+import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+const DISALLOWED_BATCH_RESOURCES = new Set(['zellij-real', 'git-worktree', 'local-llm-real', 'remote-model-real', 'publish', 'global-config', 'timing-sensitive']);
 export function isReleaseGateBatchable(gate) {
     if (gate.side_effect !== 'hermetic')
         return false;
@@ -11,6 +14,8 @@ export function isReleaseGateBatchable(gate) {
 }
 export async function runReleaseGateBatch(root, gates, input = {}) {
     const concurrency = Math.max(1, Math.floor(Number(input.concurrency || process.env.SKS_RELEASE_BATCH_CONCURRENCY || 4)));
+    const runId = `rgb-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+    const reportRoot = input.reportRoot || path.join(root, '.sneakoscope', 'reports', 'release-gate-batches', runId);
     const nonBatchable = gates.filter((gate) => !isReleaseGateBatchable(gate));
     if (nonBatchable.length) {
         return {
@@ -19,7 +24,7 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
             batch_size: gates.length,
             completed: 0,
             failed: nonBatchable.length,
-            results: nonBatchable.map((gate) => ({ id: gate.id, ok: false, exit_code: null, duration_ms: 0 }))
+            results: nonBatchable.map((gate) => ({ id: gate.id, ok: false, exit_code: null, signal: null, timed_out: false, duration_ms: 0 }))
         };
     }
     const queue = [...gates];
@@ -29,7 +34,7 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
             const gate = queue.shift();
             if (!gate)
                 continue;
-            const result = await runOne(root, gate);
+            const result = await runOne(root, runId, reportRoot, gate);
             results.push(result);
             if (input.reportRoot)
                 writeChildResult(input.reportRoot, result);
@@ -46,19 +51,60 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
         results
     };
 }
-function runOne(root, gate) {
+function runOne(root, runId, reportRoot, gate) {
     const started = Date.now();
+    const hermetic = createReleaseGateHermeticEnv({ root, runId, gate, reportRoot });
     return new Promise((resolve) => {
-        const child = spawn(gate.command, { cwd: root, shell: true, stdio: ['ignore', 'ignore', 'ignore'] });
-        const timer = setTimeout(() => child.kill('SIGTERM'), gate.timeout_ms);
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({ id: gate.id, ok: code === 0, exit_code: code, duration_ms: Date.now() - started });
+        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'ignore', 'ignore'], detached: process.platform !== 'win32' });
+        let timedOut = false;
+        let timeoutCleanup = null;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            timeoutCleanup = cleanupTimedOutGateProcessTree(root, child);
+        }, gate.timeout_ms);
+        timer.unref?.();
+        child.on('close', (code, signal) => {
+            void (async () => {
+                clearTimeout(timer);
+                if (timeoutCleanup)
+                    await timeoutCleanup;
+                const exitCode = timedOut ? 124 : code;
+                resolve({ id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: Date.now() - started, report_dir: hermetic.report_dir });
+            })();
         });
     });
 }
+async function cleanupTimedOutGateProcessTree(root, child) {
+    await killGateProcessTree(root, child, 'SIGTERM');
+    await sleep(1500);
+    await killGateProcessTree(root, child, 'SIGKILL');
+    await sleep(100);
+}
+async function killGateProcessTree(root, child, signal) {
+    if (!child.pid)
+        return;
+    const pid = process.platform !== 'win32' ? -child.pid : child.pid;
+    const contract = createRequestedScopeContract({
+        route: 'release:gate-batch-runner',
+        userRequest: 'Terminate only the batched release gate child process tree after its configured timeout.',
+        projectRoot: root,
+        overrides: { codex_app_process: true }
+    });
+    try {
+        await guardedProcessKill(guardContextForRoute(root, contract, 'release gate batch timeout cleanup'), pid, { signal, confirmed: true });
+    }
+    catch {
+        try {
+            child.kill(signal);
+        }
+        catch { }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function writeChildResult(reportRoot, result) {
-    const dir = path.join(reportRoot, result.id.replace(/[^A-Za-z0-9_.:-]/g, '_'));
+    const dir = result.report_dir || path.join(reportRoot, result.id.replace(/[^A-Za-z0-9_.:-]/g, '_'));
     writeReleaseGateJson(path.join(dir, 'result.json'), {
         schema: 'sks.release-gate-batch-child-result.v1',
         ...result

package/dist/core/release/release-gate-cache-v2.js

@@ -114,15 +114,29 @@ export function hashDirectoryRecursive(dir) {
     return out.sort();
 }
 export function readReleaseGateCacheHit(root, gate) {
+    return Boolean(readReleaseGateCacheRecord(root, gate));
+}
+export function readReleaseGateCacheRecord(root, gate) {
     try {
         const parsed = JSON.parse(fs.readFileSync(releaseGateCacheFile(root), 'utf8'));
-        return parsed.schema === RELEASE_GATE_CACHE_V2_SCHEMA && parsed.records?.[releaseGateCacheKey(root, gate)]?.ok === true;
+        const record = parsed.schema === RELEASE_GATE_CACHE_V2_SCHEMA ? parsed.records?.[releaseGateCacheKey(root, gate)] : null;
+        if (record?.ok !== true)
+            return null;
+        return {
+            ok: true,
+            gate_id: String(record.gate_id || gate.id),
+            command: String(record.command || gate.command),
+            resource: Array.isArray(record.resource) ? record.resource.map(String) : gate.resource,
+            preset: Array.isArray(record.preset) ? record.preset.map(String) : gate.preset,
+            duration_ms: Math.max(0, Math.floor(Number(record.duration_ms) || 0)),
+            recorded_at: String(record.recorded_at || '')
+        };
     }
     catch {
-        return false;
+        return null;
     }
 }
-export function writeReleaseGateCacheHit(root, gate) {
+export function writeReleaseGateCacheHit(root, gate, durationMs = 0) {
     const file = releaseGateCacheFile(root);
     let parsed = { schema: RELEASE_GATE_CACHE_V2_SCHEMA, records: {} };
     try {
@@ -137,6 +151,7 @@ export function writeReleaseGateCacheHit(root, gate) {
         command: gate.command,
         resource: gate.resource,
         preset: gate.preset,
+        duration_ms: Math.max(0, Math.floor(Number(durationMs) || 0)),
         recorded_at: new Date().toISOString()
     };
     fs.mkdirSync(path.dirname(file), { recursive: true });

package/dist/core/release/release-gate-dag.js

@@ -4,10 +4,12 @@ import { spawn } from 'node:child_process';
 import { createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { appendReleaseGateJsonl, writeReleaseGateJson } from './release-gate-report.js';
 import { findReadyReleaseGateNodes, findReleaseGatesBlockedByFailedDeps, pickReadyLaunchableReleaseGates } from './release-gate-scheduler.js';
-import { readReleaseGateCacheHit, writeReleaseGateCacheHit } from './release-gate-cache-v2.js';
+import { readReleaseGateCacheRecord, writeReleaseGateCacheHit } from './release-gate-cache-v2.js';
 import { RELEASE_GATE_NODE_SCHEMA, validateReleaseGateManifest } from './release-gate-node.js';
 import { countReleaseGateResources, defaultReleaseGateBudget, summarizeReleaseGateBudget } from './release-gate-resource-governor.js';
 import { selectAffectedReleaseGates } from './release-gate-affected-selector.js';
+import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
 export function loadReleaseGateManifest(root, file = 'release-gates.v2.json') {
     const manifestPath = path.join(root, file);
     const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
@@ -48,7 +50,7 @@ export async function runReleaseGateDag(input) {
     let peakRunning = 0;
     const writeSummarySnapshot = (finished = false) => {
         const wallMs = Date.now() - started;
-        const failures = [...failed.values()].map((row) => ({ id: row.id, exit_code: row.exit_code, stderr_tail: row.stderr_tail }));
+        const failures = [...failed.values()].map((row) => ({ id: row.id, exit_code: row.exit_code, stderr_tail: row.stderr_tail, timed_out: row.timed_out, signal: row.signal }));
         const snapshot = {
             schema: 'sks.release-gate-dag-run.v1',
             ok: failures.length === 0,
@@ -97,14 +99,15 @@ export async function runReleaseGateDag(input) {
         let progressed = false;
         for (const gate of launchable) {
             pending.delete(gate.id);
-            const cacheHit = !input.noCache && gate.cache.enabled && readReleaseGateCacheHit(root, gate);
+            const cacheHit = !input.noCache && gate.cache.enabled ? readReleaseGateCacheRecord(root, gate) : null;
             if (cacheHit) {
-                const result = { id: gate.id, ok: true, exit_code: 0, duration_ms: 0, cached: true, stderr_tail: '' };
+                const result = { id: gate.id, ok: true, exit_code: 0, signal: null, timed_out: false, duration_ms: cacheHit.duration_ms, cached: true, stderr_tail: '' };
                 completed.set(gate.id, result);
                 cached += 1;
                 cachedGates.push(gate.id);
+                sumGateMs += result.duration_ms;
                 progressed = true;
-                appendReleaseGateJsonl(timeline, { event: 'cache_hit', gate_id: gate.id, at: new Date().toISOString() });
+                appendReleaseGateJsonl(timeline, { event: 'cache_hit', gate_id: gate.id, duration_ms: result.duration_ms, at: new Date().toISOString() });
                 writeSummarySnapshot(false);
                 continue;
             }
@@ -127,6 +130,8 @@ export async function runReleaseGateDag(input) {
                         id: gate.id,
                         ok: false,
                         exit_code: null,
+                        signal: null,
+                        timed_out: false,
                         duration_ms: 0,
                         cached: false,
                         stderr_tail: `blocked by failed dependency: ${gate.deps.filter((dep) => failed.has(dep)).join(', ')}`
@@ -148,7 +153,7 @@ export async function runReleaseGateDag(input) {
             completed.set(result.id, result);
             const gate = selected.find((row) => row.id === result.id);
             if (gate?.cache.enabled && !input.noCache)
-                writeReleaseGateCacheHit(root, gate);
+                writeReleaseGateCacheHit(root, gate, result.duration_ms);
         }
         else {
             failed.set(result.id, result);
@@ -175,22 +180,65 @@ function runGate(root, runId, reportRoot, gate) {
     const out = fs.createWriteStream(stdoutFile);
     const err = fs.createWriteStream(stderrFile);
     return new Promise((resolve) => {
-        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'] });
-        const timer = setTimeout(() => child.kill('SIGTERM'), gate.timeout_ms);
+        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' });
+        let timedOut = false;
+        let timeoutCleanup = null;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            timeoutCleanup = cleanupTimedOutGateProcessTree(root, child);
+        }, gate.timeout_ms);
+        timer.unref?.();
         child.stdout.pipe(out);
         child.stderr.pipe(err);
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            out.end();
-            err.end();
-            const durationMs = Date.now() - started;
-            const stderrTail = tail(fs.existsSync(stderrFile) ? fs.readFileSync(stderrFile, 'utf8') : '');
-            const result = { id: gate.id, ok: code === 0, exit_code: code, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
-            writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), { schema: 'sks.release-gate-result.v1', ...result, stdout_log: stdoutFile, stderr_log: stderrFile });
-            resolve(result);
+        child.on('close', (code, signal) => {
+            void (async () => {
+                clearTimeout(timer);
+                if (timeoutCleanup)
+                    await timeoutCleanup;
+                out.end();
+                err.end();
+                const durationMs = Date.now() - started;
+                const stderrText = fs.existsSync(stderrFile) ? fs.readFileSync(stderrFile, 'utf8') : '';
+                const timeoutTail = timedOut ? `release_gate_timeout:${gate.id}:${gate.timeout_ms}ms` : '';
+                const signalTail = !timedOut && signal ? `release_gate_signal:${gate.id}:${signal}` : '';
+                const stderrTail = tail([stderrText, timeoutTail, signalTail].filter(Boolean).join('\n'));
+                const exitCode = timedOut ? 124 : code;
+                const result = { id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
+                writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), { schema: 'sks.release-gate-result.v1', ...result, stdout_log: stdoutFile, stderr_log: stderrFile });
+                resolve(result);
+            })();
         });
     });
 }
+async function cleanupTimedOutGateProcessTree(root, child) {
+    await killGateProcessTree(root, child, 'SIGTERM');
+    await sleep(1500);
+    await killGateProcessTree(root, child, 'SIGKILL');
+    await sleep(100);
+}
+async function killGateProcessTree(root, child, signal) {
+    if (!child.pid)
+        return;
+    const pid = process.platform !== 'win32' ? -child.pid : child.pid;
+    const contract = createRequestedScopeContract({
+        route: 'release:gate-runner',
+        userRequest: 'Terminate only the release gate child process tree after its configured timeout.',
+        projectRoot: root,
+        overrides: { codex_app_process: true }
+    });
+    try {
+        await guardedProcessKill(guardContextForRoute(root, contract, 'release gate timeout cleanup'), pid, { signal, confirmed: true });
+    }
+    catch {
+        try {
+            child.kill(signal);
+        }
+        catch { }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function estimateCriticalPath(gates, completed) {
     const byId = new Map(gates.map((gate) => [gate.id, gate]));
     const memo = new Map();

package/dist/core/release/release-gate-node.js

@@ -13,7 +13,8 @@ export const RELEASE_GATE_RESOURCE_CLASSES = [
     'network',
     'global-config',
     'publish',
-    'fs-read'
+    'fs-read',
+    'timing-sensitive'
 ];
 export function validateReleaseGateManifest(input) {
     const errors = [];

package/dist/core/release/release-gate-resource-governor.js

@@ -1,8 +1,9 @@
 import os from 'node:os';
+const EXCLUSIVE_RESOURCES = new Set(['timing-sensitive']);
 export function defaultReleaseGateBudget() {
     const cores = Math.max(1, os.cpus().length || 1);
     const base = {
-        'cpu-light': Math.min(48, cores * 6),
+        'cpu-light': Math.min(24, cores * 3),
         'cpu-heavy': Math.max(1, cores),
         'io-light': Math.min(96, cores * 10),
         'io-heavy': Math.min(12, Math.max(1, cores)),
@@ -15,11 +16,12 @@ export function defaultReleaseGateBudget() {
         'remote-model-real': 6,
         'global-config': 1,
         publish: 1,
-        'fs-read': Math.min(96, cores * 10)
+        'fs-read': Math.min(96, cores * 10),
+        'timing-sensitive': 1
     };
     for (const key of Object.keys(base)) {
         const envName = `SKS_RELEASE_MAX_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`;
-        base[key] = envInt(envName, base[key]);
+        base[key] = envInt(envName, base[key], { max: base[key] });
     }
     return base;
 }
@@ -34,23 +36,39 @@ export function countReleaseGateResources(running) {
 }
 export function pickLaunchableReleaseGates(input) {
     const budget = input.budget || defaultReleaseGateBudget();
+    if (input.running.some(isExclusiveGate))
+        return [];
     const used = usedResources(input.running);
     const launchable = [];
-    const maxTotal = envInt('SKS_RELEASE_MAX_TOTAL', Number.POSITIVE_INFINITY);
+    const maxTotal = envInt('SKS_RELEASE_MAX_TOTAL', defaultReleaseGateMaxTotal(), { max: defaultReleaseGateMaxTotal() });
     for (const gate of input.ready) {
         if (input.running.length + launchable.length >= maxTotal)
             break;
+        const exclusive = isExclusiveGate(gate);
+        if (exclusive && (input.running.length > 0 || launchable.length > 0))
+            continue;
+        if (!exclusive && launchable.some(isExclusiveGate))
+            continue;
         if (fits(gate, used, budget)) {
             launchable.push(gate);
             for (const resource of gate.resource)
                 used[resource] = (used[resource] || 0) + 1;
+            if (exclusive)
+                break;
         }
     }
     return launchable;
 }
-function envInt(name, fallback) {
+export function defaultReleaseGateMaxTotal() {
+    const cores = Math.max(1, os.cpus().length || 1);
+    return Math.max(8, Math.min(32, cores * 3));
+}
+function envInt(name, fallback, opts = {}) {
     const parsed = Number(process.env[name]);
-    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    const value = Math.floor(parsed);
+    return typeof opts.max === 'number' ? Math.min(value, opts.max) : value;
 }
 function usedResources(running) {
     const used = {};
@@ -63,4 +81,7 @@ function usedResources(running) {
 function fits(gate, used, budget) {
     return gate.resource.every((resource) => (used[resource] || 0) < budget[resource]);
 }
+function isExclusiveGate(gate) {
+    return gate.resource.some((resource) => EXCLUSIVE_RESOURCES.has(resource));
+}
 //# sourceMappingURL=release-gate-resource-governor.js.map