sneakoscope 3.1.0 → 3.1.1

package/dist/scripts/loop-directive-check-lib.js

@@ -4,6 +4,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { COMMANDS } from '../cli/command-registry.js';
+import { runProcess } from '../core/fsx.js';
 import { compileGoalToLoopPlan } from '../core/loops/goal-to-loop-compat.js';
 import { loopGraphProofPath, loopPlanPath, loopProofPath, loopRoot, loopStatePath } from '../core/loops/loop-artifacts.js';
 import { decomposeRequestIntoLoopDomains } from '../core/loops/loop-decomposer.js';
@@ -29,7 +30,18 @@ export async function runLoopDirectiveCheck(id) {
     const request = 'fix zellij telemetry, release cache, and codex probe docs';
     const plan = await planLoopsFromRequest({ root, missionId, request, sourceCommand: 'loop' });
     const byId = new Map(plan.graph.nodes.map((node) => [node.loop_id, node]));
-    const result = await runLoopPlan({ root, plan, parallelism: 'extreme', noMutation: id.includes('runtime') ? false : true });
+    const realRuntimeMode = process.env.SKS_LOOP_RUNTIME_REAL === '1'
+        || id === 'loop:runtime-real-workers'
+        || id === 'loop:maker-checker-real'
+        || id === 'loop:integration-finalizer-real'
+        || id === 'loop:real-maker-checker-blackbox'
+        || id === 'naruto:loop-mesh-real-blackbox'
+        || id === 'goal:loop-runtime-real-blackbox';
+    if (!realRuntimeMode && process.env.SKS_LOOP_RUNTIME_FIXTURE !== '1') {
+        process.env.SKS_LOOP_RUNTIME_FIXTURE = '1';
+    }
+    const fixtureMode = process.env.SKS_LOOP_RUNTIME_FIXTURE === '1' || process.env.SKS_LOOP_GATE_FIXTURE === '1';
+    const result = await runLoopPlan({ root, plan, parallelism: 'extreme', noMutation: fixtureMode ? true : !realRuntimeMode });
     const assertions = [];
     const assert = (condition, message) => assertions.push({ ok: Boolean(condition), message });
     assert(validateLoopPlan(plan).ok, 'loop plan validates');
@@ -40,6 +52,9 @@ export async function runLoopDirectiveCheck(id) {
     }
     else if (id === 'loop:artifact-paths') {
         assert(loopRoot(root, missionId).includes('.sneakoscope/missions'), 'artifact root layout matches directive');
+        assert(throws(() => loopRoot(root, '../../escape')), 'loop artifact root rejects mission traversal');
+        assert(throws(() => loopRoot(root, 'bad/mission')), 'loop artifact root rejects path separators in mission id');
+        assert(throws(() => loopStatePath(root, missionId, '../loop-escape')), 'loop node artifact path rejects loop traversal');
     }
     else if (id === 'loop:state') {
         assert(await exists(loopStatePath(root, missionId, 'loop-zellij')), 'loop state exists');
@@ -47,6 +62,8 @@ export async function runLoopDirectiveCheck(id) {
     else if (id === 'loop:planner') {
         assert(byId.has('loop-integration'), 'integration loop always created');
         assert(plan.graph.nodes.length >= 2, 'planner creates action plus integration loops');
+        assert(plan.graph.nodes.some((node) => node.route !== '$Integration' && node.maker.worker_count > 2), 'planner scales maker workers above the old hardcoded two');
+        assert(plan.graph.nodes.some((node) => node.route !== '$Integration' && node.checker.worker_count > 1), 'planner scales checker reviewers above the old hardcoded one');
     }
     else if (id === 'loop:decomposer') {
         const domains = decomposeRequestIntoLoopDomains(request);
@@ -68,6 +85,118 @@ export async function runLoopDirectiveCheck(id) {
         assert(result.ok, 'loop runtime produces ok graph result');
         assert(await exists(loopGraphProofPath(root, missionId)), 'graph proof exists');
     }
+    else if (id === 'loop:fixture-safety') {
+        const runtimeSource = await fs.readFile(path.join(process.cwd(), 'src/core/loops/loop-runtime.ts'), 'utf8');
+        const workerSource = await fs.readFile(path.join(process.cwd(), 'src/core/loops/loop-worker-runtime.ts'), 'utf8');
+        assert(!/noMutation\s*\?\s*\{\s*fixture:\s*true\s*\}/.test(runtimeSource), 'noMutation must not force fixture mode');
+        assert(workerSource.includes('loopFixtureAllowed'), 'fixture runtime has an explicit test-context allow guard');
+        assert(workerSource.includes('loop_fixture_runtime_forbidden'), 'fixture runtime fails closed outside test context');
+        assert(workerSource.includes("process.env.SKS_LOOP_RUNTIME_FIXTURE === '1'"), 'fixture runtime remains opt-in through SKS_LOOP_RUNTIME_FIXTURE');
+        assert(!workerSource.includes('visualLaneCount: Math.min(4'), 'zellij visual lane count must use the configurable pane cap');
+        const negative = await productionFixtureNegativeCheck();
+        assert(negative.code === 0 && negative.stdout.includes('loop_fixture_runtime_forbidden'), 'production fixture request is blocked at runtime');
+    }
+    else if (id === 'loop:worker-runtime') {
+        const proof = await readJson(loopProofPath(root, missionId, 'loop-zellij'));
+        assert(proof.maker_result.backend === 'deterministic-fixture' || proof.maker_result.backend === 'native-agent-orchestrator', 'maker backend recorded');
+        assert(proof.checker_result.backend === 'deterministic-fixture' || proof.checker_result.backend === 'native-agent-orchestrator', 'checker backend recorded');
+        assert(proof.maker_result.runtime_proof_path, 'maker runtime proof path recorded');
+        assert(proof.checker_result.runtime_proof_path, 'checker runtime proof path recorded');
+    }
+    else if (id === 'loop:worker-prompts') {
+        const prompts = await import('../core/loops/loop-worker-prompts.js');
+        const node = byId.get('loop-zellij');
+        assert(prompts.buildLoopMakerPrompt({ plan, node }).includes('Do not mutate outside the owner scope'), 'maker prompt constrains owner scope');
+        assert(prompts.buildLoopCheckerPrompt({ plan, node, makerArtifacts: ['maker.json'] }).includes('must not mutate source files'), 'checker prompt forbids mutation');
+        assert(prompts.buildLoopCheckerPrompt({ plan, node, makerArtifacts: ['maker.json'] }).includes('fresh session'), 'checker prompt requires fresh session');
+    }
+    else if (id === 'loop:runtime-real-workers' || id === 'loop:maker-checker-real') {
+        const proof = await readJson(loopProofPath(root, missionId, 'loop-zellij'));
+        assert(proof.maker_result.artifacts.length > 0, 'maker worker runtime artifacts exist');
+        assert(proof.checker_result.artifacts.length > 0, 'checker worker runtime artifacts exist');
+        assert(!proof.maker_result.artifacts.includes('fresh-checker-session'), 'placeholder checker string is not used');
+    }
+    else if (id === 'loop:checker-freshness') {
+        const proof = await readJson(loopProofPath(root, missionId, 'loop-zellij'));
+        const checker = await readJson(proof.checker_result.checker_findings[0]);
+        assert(checker.fresh_session === true, 'checker artifact proves fresh session');
+        assert(Array.isArray(checker.reviewed_maker_artifacts), 'checker reviewed maker artifacts');
+        assert(proof.checker_result.fresh_session === true, 'loop proof records checker freshness');
+    }
+    else if (id === 'loop:gate-registry') {
+        const registry = await import('../core/loops/loop-gate-registry.js');
+        const defs = await registry.listLoopGateDefinitions(process.cwd());
+        assert(defs.some((gate) => gate.id === 'gpt:final-arbiter' && gate.source === 'builtin-pseudo'), 'gpt final pseudo gate registered');
+        assert(await registry.resolveLoopGate(process.cwd(), 'definitely:unknown') === null, 'unknown gate does not resolve');
+    }
+    else if (id === 'loop:gate-runner-real' || id === 'loop:gate-artifacts') {
+        const proof = await readJson(loopProofPath(root, missionId, 'loop-zellij'));
+        assert(proof.gate_result.selected_gates.length > 0, 'gates selected');
+        assert(proof.gate_result.passed_gates.length > 0 || proof.gate_result.failed_gates.length > 0, 'gate outcomes recorded');
+        assert(await exists(path.join(loopRoot(root, missionId), 'loop-zellij', 'gates')), 'gate artifact directory exists');
+    }
+    else if (id === 'loop:worktree-runtime') {
+        assert(await exists(path.join(loopRoot(root, missionId), 'loop-zellij', 'worktree.json')), 'worktree record exists');
+    }
+    else if (id === 'loop:worktree-diff-scope') {
+        const mod = await import('../core/loops/loop-worktree-runtime.js');
+        assert(mod.enforceLoopOwnerScope(['src/core/zellij/zellij-slot-pane-renderer.ts'], byId.get('loop-zellij').owner_scope).length === 0, 'owner-scoped file passes');
+        assert(mod.enforceLoopOwnerScope(['README.md'], byId.get('loop-zellij').owner_scope).length > 0, 'outside owner scope blocks');
+    }
+    else if (id === 'loop:integration-merge') {
+        assert(await exists(path.join(loopRoot(root, missionId), 'integration-merge.json')), 'integration merge artifact exists');
+    }
+    else if (id === 'loop:integration-finalizer-real') {
+        const graph = await readJson(loopGraphProofPath(root, missionId));
+        assert(graph.integration_merge && typeof graph.integration_merge.ok === 'boolean', 'graph proof includes integration merge');
+    }
+    else if (id === 'file-lock:atomic') {
+        const lock = await import('../core/locks/file-lock.js');
+        let count = 0;
+        await lock.withFileLock({ lockPath: path.join(root, '.sneakoscope/locks/test.lock'), timeoutMs: 1000, staleMs: 10000 }, async () => { count += 1; });
+        assert(count === 1, 'file lock executes critical section');
+    }
+    else if (id === 'loop:lease-atomic') {
+        const node = byId.get('loop-zellij');
+        const lease = await acquireLoopLease(root, plan, node);
+        assert(lease.status === 'active' || lease.status === 'conflict', 'atomic lease returns status');
+    }
+    else if (id === 'loop:gpt-final-arbiter' || id === 'loop:integration-gpt-final') {
+        const mod = await import('../core/loops/loop-gpt-final-arbiter.js');
+        const arbiter = await mod.runLoopGptFinalArbiter({ root, plan, proofs: result.proofs, integrationMerge: { schema: 'sks.loop-integration-merge.v1', ok: true, applied_loops: [], conflict_loops: [], changed_files: ['src/core/loops/loop-runtime.ts'], blockers: [] }, forceVerdict: 'approve' });
+        assert(arbiter.ok && arbiter.verdict === 'approve', 'loop GPT final arbiter can approve');
+    }
+    else if (id === 'loop:checkpoint') {
+        assert(await exists(path.join(loopRoot(root, missionId), 'loop-zellij', 'checkpoint-latest.json')), 'latest checkpoint exists');
+    }
+    else if (id === 'loop:kill-resume' || id === 'loop:cli-kill-resume') {
+        const control = await import('../core/loops/loop-runtime-control.js');
+        await control.writeLoopKillRequest(root, missionId, 'loop-zellij');
+        assert(await control.shouldKillLoop(root, missionId, 'loop-zellij'), 'kill request targets loop');
+    }
+    else if (id === 'loop:real-maker-checker-blackbox') {
+        const proof = await readJson(loopProofPath(root, missionId, 'loop-zellij'));
+        assert(proof.maker_result.worker_count > 0 && proof.checker_result.worker_count > 0, 'maker/checker worker counts recorded');
+        assert(proof.checker_result.checker_findings.length > 0, 'checker findings artifact exists');
+    }
+    else if (id === 'naruto:loop-mesh-real-blackbox') {
+        assert(plan.graph.nodes.length >= 5, 'at least four domain loops plus integration are planned');
+        assert(result.proofs.every((proof) => proof.maker_result.artifacts.length && proof.checker_result.artifacts.length), 'worker runtime artifacts exist for every loop');
+        assert(result.graph_proof.integration_merge, 'integration finalizer ran');
+    }
+    else if (id === 'goal:loop-runtime-real-blackbox') {
+        const goalPlan = await compileGoalToLoopPlan({ root, missionId: `${missionId}-goal-real`, goalText: 'fix release cache', legacyGoalOptions: {} });
+        const goalResult = await runLoopPlan({ root, plan: goalPlan, parallelism: 'balanced', noMutation: true });
+        assert(await exists(path.join(root, '.sneakoscope', 'missions', `${missionId}-goal-real`, 'goal-compat.json')), 'goal compat artifact exists');
+        assert(goalResult.proofs.some((proof) => proof.maker_result.artifacts.length), 'goal loop worker runtime artifacts exist');
+        assert(await exists(loopGraphProofPath(root, `${missionId}-goal-real`)), 'goal graph proof exists');
+    }
+    else if (id === 'loop:status-ux') {
+        assert(await exists(loopGraphProofPath(root, missionId)), 'status has graph proof source');
+    }
+    else if (id === 'loop:zellij-real-runtime-ui') {
+        assert(renderZellijSlotPane({ slotId: 'slot-003', generationIndex: 1, loopId: 'loop-zellij', loopRole: 'maker', loopGate: 'loop:test', backend: 'fixture', patchStatus: 'fixture', verifyStatus: 'pass' }).includes('fixture loop proof'), 'zellij marks fixture proof');
+    }
     else if (id === 'loop:proof') {
         assert(await exists(loopProofPath(root, missionId, 'loop-zellij')), 'loop proof exists');
     }
@@ -85,6 +214,48 @@ export async function runLoopDirectiveCheck(id) {
         const node = byId.get('loop-zellij');
         const gates = await runLoopGates({ root, missionId, node, gates: node.gates });
         assert(gates.skipped_gates.includes('release:check') === false, 'gate runner avoids full release check inside loop');
+        const checkerDir = path.join(root, '.sneakoscope', 'missions', missionId, 'agents', 'sessions');
+        await fs.mkdir(checkerDir, { recursive: true });
+        await fs.writeFile(path.join(checkerDir, 'checker-findings.json'), JSON.stringify({ fresh_session: true, approved: true }));
+        const checkerGate = await runLoopGates({
+            root,
+            missionId,
+            node,
+            gates: { triage: [], local: [], checker: ['loop:checker-fresh-session'], integration: [], final: [] },
+            checkerArtifacts: ['sessions/checker-findings.json']
+        });
+        assert(checkerGate.ok, 'builtin checker gate resolves mission-ledger relative artifacts');
+        const foreignChecker = path.join(path.dirname(root), `${missionId}-foreign-checker-findings.json`);
+        await fs.writeFile(foreignChecker, JSON.stringify({ fresh_session: true, approved: true }));
+        const foreignRelative = path.relative(path.join(root, '.sneakoscope', 'missions', missionId, 'agents'), foreignChecker);
+        const unsafeCheckerGate = await runLoopGates({
+            root,
+            missionId,
+            node,
+            gates: { triage: [], local: [], checker: ['loop:checker-fresh-session'], integration: [], final: [] },
+            checkerArtifacts: [foreignRelative, foreignChecker]
+        });
+        assert(!unsafeCheckerGate.ok && unsafeCheckerGate.blockers.includes('loop_checker_fresh_session_missing'), 'builtin checker gate rejects foreign absolute and traversal artifacts');
+        const repoLocalChecker = path.join(root, 'repo-local-checker-findings.json');
+        await fs.writeFile(repoLocalChecker, JSON.stringify({ fresh_session: true, approved: true }));
+        const repoLocalCheckerGate = await runLoopGates({
+            root,
+            missionId,
+            node,
+            gates: { triage: [], local: [], checker: ['loop:checker-fresh-session'], integration: [], final: [] },
+            checkerArtifacts: ['repo-local-checker-findings.json', repoLocalChecker]
+        });
+        assert(!repoLocalCheckerGate.ok && repoLocalCheckerGate.blockers.includes('loop_checker_fresh_session_missing'), 'builtin checker gate rejects repo-local non-mission artifacts');
+        const symlinkChecker = path.join(checkerDir, 'checker-findings-symlink.json');
+        await fs.symlink(repoLocalChecker, symlinkChecker);
+        const symlinkCheckerGate = await runLoopGates({
+            root,
+            missionId,
+            node,
+            gates: { triage: [], local: [], checker: ['loop:checker-fresh-session'], integration: [], final: [] },
+            checkerArtifacts: ['sessions/checker-findings-symlink.json']
+        });
+        assert(!symlinkCheckerGate.ok && symlinkCheckerGate.blockers.includes('loop_checker_fresh_session_missing'), 'builtin checker gate rejects mission-local symlinks that escape the mission root');
     }
     else if (id === 'loop:gate-ladder') {
         const node = byId.get('loop-zellij');
@@ -108,7 +279,7 @@ export async function runLoopDirectiveCheck(id) {
         assert(docsA.status === 'active' && docsB.status === 'active', 'docs overlap is allowed when non-exclusive');
     }
     else if (id === 'naruto:loop-mesh' || id === 'naruto:loop-maker-checker') {
-        const mesh = await runNarutoLoopMesh({ root, plan, parallelism: 'balanced' });
+        const mesh = await runNarutoLoopMesh({ root, plan, parallelism: 'balanced', noMutation: fixtureMode ? true : !realRuntimeMode });
         assert(mesh.proofs.every((proof) => proof.maker_result.worker_count > 0 && proof.checker_result.worker_count > 0), 'maker/checker artifacts exist for each loop');
     }
     else if (id === 'naruto:loop-worker-router') {
@@ -159,7 +330,59 @@ async function exists(file) {
         return false;
     }
 }
+function throws(fn) {
+    try {
+        fn();
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
 async function readJson(file) {
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
+async function productionFixtureNegativeCheck() {
+    const code = `
+import { runLoopMakerWorkers } from './dist/core/loops/loop-worker-runtime.js';
+const node = {
+  mission_id: 'M-production-fixture-negative',
+  loop_id: 'loop-production-fixture-negative',
+  owner_scope: { files: ['README.md'], directories: [], package_scripts: [], release_gate_ids: [], exclusive: true, collision_policy: 'handoff' },
+  maker: { worker_count: 1 },
+  checker: { worker_count: 1 },
+  risk: { requires_gpt_final: false },
+  worktree: { required: false }
+};
+const plan = { mission_id: 'M-production-fixture-negative' };
+try {
+  await runLoopMakerWorkers({ root: process.cwd(), plan, node, fixture: true });
+  console.error('fixture unexpectedly allowed outside test context');
+  process.exit(1);
+} catch (err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (!message.includes('loop_fixture_runtime_forbidden')) {
+    console.error(message);
+    process.exit(2);
+  }
+  console.log(message);
+}
+`;
+    return runProcess('/usr/bin/env', [
+        '-u', 'NODE_ENV',
+        '-u', 'SKS_TEST_RUNTIME_FIXTURE_ALLOWED',
+        '-u', 'VITEST_WORKER_ID',
+        '-u', 'JEST_WORKER_ID',
+        '-u', 'NODE_V8_COVERAGE',
+        'SKS_LOOP_RUNTIME_FIXTURE=1',
+        process.execPath,
+        '--input-type=module',
+        '-e',
+        code
+    ], {
+        cwd: process.cwd(),
+        timeoutMs: 30000,
+        maxOutputBytes: 8192
+    });
+}
 //# sourceMappingURL=loop-directive-check-lib.js.map

package/dist/scripts/loop-worker-fixture-child.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const intakePath = process.argv[2];
+if (!intakePath)
+    throw new Error('Usage: loop-worker-fixture-child <intake.json>');
+const intake = JSON.parse(await fs.readFile(intakePath, 'utf8'));
+const dir = path.dirname(intake.result_path);
+await fs.mkdir(dir, { recursive: true });
+const workerIds = Array.from({ length: Math.max(1, Number(intake.worker_count || 1)) }, (_, index) => `${intake.loop_id}-${intake.phase}-fixture-worker-${index + 1}`);
+const sessionIds = workerIds.map((id) => `${id}-${process.pid}`);
+const artifactPath = path.join(dir, intake.phase === 'maker' ? 'maker-patch-candidate.json' : 'checker-findings.json');
+const changedFiles = intake.phase === 'maker' ? [] : [];
+const artifact = intake.phase === 'maker'
+    ? {
+        schema: 'sks.loop-patch-candidate.v1',
+        loop_id: intake.loop_id,
+        worker_ids: workerIds,
+        changed_files: changedFiles,
+        fixture_child_pid: process.pid,
+        generated_at: new Date().toISOString()
+    }
+    : {
+        schema: 'sks.loop-checker-findings.v1',
+        loop_id: intake.loop_id,
+        fresh_session: true,
+        reviewed_maker_artifacts: intake.maker_artifacts || [],
+        side_effects_detected: [],
+        approved: true,
+        worker_ids: workerIds,
+        fixture_child_pid: process.pid,
+        generated_at: new Date().toISOString()
+    };
+await fs.writeFile(artifactPath, `${JSON.stringify(artifact, null, 2)}\n`);
+await fs.writeFile(intake.result_path, `${JSON.stringify({
+    schema: 'sks.loop-worker-run-result.v1',
+    ok: true,
+    mission_id: intake.mission_id,
+    loop_id: intake.loop_id,
+    phase: intake.phase,
+    worker_count: workerIds.length,
+    backend: 'deterministic-fixture',
+    artifacts: [artifactPath],
+    patch_candidates: intake.phase === 'maker' ? [artifactPath] : [],
+    checker_findings: intake.phase === 'checker' ? [artifactPath] : [],
+    changed_files: changedFiles,
+    blockers: [],
+    runtime_proof_path: intake.result_path,
+    worker_ids: workerIds,
+    session_ids: sessionIds
+}, null, 2)}\n`);
+//# sourceMappingURL=loop-worker-fixture-child.js.map

package/dist/scripts/naruto-real-local-gpt-final-smoke.js

@@ -1,16 +1,25 @@
 #!/usr/bin/env node
 // @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const finalizer = await importDist('core/naruto/naruto-finalizer.js');
 const draft = finalizer.evaluateNarutoFinalizer({ localParticipated: true, gptFinalStatus: null, applyPatches: true });
 const approved = finalizer.evaluateNarutoFinalizer({ localParticipated: true, gptFinalStatus: 'approved', applyPatches: true });
 const deterministic = finalizer.evaluateNarutoFinalizer({ localParticipated: false, applyPatches: true });
+const deterministicDraft = finalizer.evaluateNarutoFinalizer({ localParticipated: false, applyPatches: false });
+const narutoCommandSource = await fs.readFile(path.join(process.cwd(), 'src/core/commands/naruto-command.ts'), 'utf8');
 assertGate(draft.ok === false && draft.blockers.includes('naruto_local_worker_output_needs_gpt_final_arbiter'), 'local worker patch must be blocked until GPT final arbiter', draft);
 assertGate(approved.ok === true && approved.final_patch_source === 'gpt_final_arbiter', 'GPT-approved local output must become final patch source', approved);
 assertGate(deterministic.ok === true && deterministic.gpt_final_required === false, 'no-local deterministic run must not require GPT final', deterministic);
+assertGate(deterministicDraft.final_status === 'draft', 'no-apply Naruto run must remain draft even when writes were possible', deterministicDraft);
+assertGate(deterministicDraft.ok === false && deterministicDraft.run_ok === true && deterministicDraft.release_proof_allowed === false, 'no-apply Naruto draft must not masquerade as an accepted finalizer', deterministicDraft);
+assertGate(narutoCommandSource.includes('applyPatches: parsed.applyPatches') && !narutoCommandSource.includes('applyPatches: writeCapable'), 'Naruto command finalizer must use explicit apply-patches flag, not write capability');
+assertGate(narutoCommandSource.includes('parsed.applyPatches === true ? finalizer.ok === true : finalizer.run_ok === true') && narutoCommandSource.includes('ok: summaryOk'), 'Naruto command top-level ok must separate patch finality from readonly/no-apply run success');
 emitGate('naruto:real-local-gpt-final-smoke', {
     require_real_env: process.env.SKS_REQUIRE_LOCAL_LLM === '1' || process.env.SKS_REQUIRE_GPT_FINAL === '1',
     draft_status: draft.final_status,
-    approved_status: approved.final_status
+    approved_status: approved.final_status,
+    deterministic_no_apply_status: deterministicDraft.final_status
 });
 //# sourceMappingURL=naruto-real-local-gpt-final-smoke.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -99,6 +99,7 @@
     "core-skill:route-runtime-integration": "node ./dist/scripts/core-skill-route-runtime-integration-check.js",
     "core-skill:promotion-side-effect-ledger": "node ./dist/scripts/core-skill-promotion-side-effect-ledger-check.js",
     "core-skill:legacy-promotion-api-audit": "node ./dist/scripts/core-skill-legacy-promotion-api-audit.js",
+    "core-skill:trainer-loop": "node ./dist/scripts/core-skill-trainer-check.js",
     "safety:side-effect-zero": "node ./dist/scripts/side-effect-zero-gate-check.js",
     "safety:mutation-callsite-coverage": "node ./dist/scripts/mutation-callsite-coverage-check.js",
     "safety:mutation-callsite-coverage:repo-wide": "node ./dist/scripts/mutation-callsite-coverage-check.js --repo-wide",
@@ -159,6 +160,7 @@
     "all-features:execute-fixtures": "node ./dist/bin/sks.js all-features selftest --mock --execute-fixtures --strict-artifacts --json",
     "feature-fixtures:strict": "node ./dist/bin/sks.js all-features selftest --mock --execute-fixtures --strict-artifacts --hermetic --json",
     "trust:check": "node ./dist/bin/sks.js trust validate latest --json || node ./dist/scripts/trust-fixture-check.js",
+    "proof:root-cause-policy": "node ./dist/scripts/proof-root-cause-policy-check.js",
     "wrongness:fixtures": "node --test test/wrongness/*.test.mjs",
     "wrongness:check": "node ./dist/bin/sks.js wrongness validate project --json && node ./dist/scripts/wrongness-fixture-check.js",
     "git-hygiene:check": "node ./dist/bin/sks.js git doctor --json",
@@ -557,7 +559,7 @@
     "python-tools:smoke": "node ./dist/scripts/python-tools-smoke-check.js",
     "agent:zellij-dynamic-backfill-panes": "node ./dist/scripts/agent-zellij-dynamic-backfill-panes-check.js",
     "agent:real-codex-in-zellij-worker-pane": "node ./dist/scripts/agent-real-codex-in-zellij-worker-pane-check.js",
-    "release:check:legacy": "npm run release:check:parallel && npm run mad-sks:app-ui-no-mutation && npm run codex-app:fast-ui-preservation && npm run codex-app:ui-clobber-guard && npm run doctor:fixes-codex-app-fast-ui && npm run provider:badge-context && npm run provider:context-config-toml && npm run codex-app:provider-badge && npm run zellij:spawn-on-demand-layout && npm run zellij:worker-pane-manager && npm run zellij:worker-pane-manager-single-owner && npm run agent:worker-pane-communication-contract && npm run runtime:no-mjs-scripts && npm run runtime:ts-python-boundary && npm run codex-sdk:capability && npm run codex-sdk:no-legacy-fallback && npm run codex-sdk:backend-router && npm run codex-sdk:structured-output && npm run codex-sdk:event-stream-ledger && npm run codex-sdk:thread-registry && npm run codex-sdk:sandbox-policy && npm run codex-sdk:zellij-pane-binding && npm run codex-sdk:all-pipelines && npm run codex-sdk:dfix-pipeline && npm run codex-sdk:qa-pipeline && npm run codex-sdk:research-pipeline && npm run codex-sdk:team-naruto-agent-pipeline && npm run codex-sdk:release-review-pipeline && npm run codex-sdk:ux-ppt-review-pipeline && npm run codex-sdk:core-skill-pipeline && npm run codex-control:capability && npm run codex-control:no-legacy-fallback && npm run codex-control:structured-output && npm run codex-control:event-stream-ledger && npm run codex-control:thread-registry && npm run codex-control:side-effect-scope && npm run codex-control:all-pipelines && npm run codex-control:empty-result-retry && npm run codex-control:stream-idle-watchdog && npm run codex-control:tool-call-sequence-repair && npm run codex-control:keepalive-no-cot-leak && npm run local-collab:policy && npm run local-collab:gpt-final-arbiter && npm run local-collab:no-local-only-final && npm run local-collab:gpt-final-availability && npm run local-llm:capability && npm run local-llm:structured-output && npm run local-llm:tool-call-repair && npm run local-llm:all-pipelines && npm run local-collab:all-pipelines-final-gpt && npm run python-sdk:capability && npm run python-sdk:stream-bridge && npm run python-sdk:sandbox-policy && npm run python-sdk:all-pipelines && npm run codex:plugin-list-json && npm run codex:product-design-plugin-routing && npm run codex:product-design-auto-install && npm run codex:thread-runtime-choice && npm run codex:environment-scoped-approvals && npm run ultra-router:classification && npm run ultra-router:auto-router && npm run release:version-truth && npm run release:worktree-gates && npm run codex:0.137-compat && npm run codex:0.136-compat && npm run codex:0.135-compat && npm run doctor:codex-doctor-parity && npm run codex:permission-profiles && npm run codex:legacy-profile-consumers-removed && npm run terminal:keyboard-enhancement-safety && npm run terminal:tui-output-stability && npm run codex:resume-cwd-truth && npm run mcp:tool-naming-parity && npm run responses:retry-policy-centralized && npm run runtime:no-tmux && npm run zellij:layout-valid && npm run agent:zellij-dynamic-backfill-panes && npm run agent:worker-pane-communication-contract && npm run agent:slot-pane-binding-proof && npm run zellij:worker-pane-manager && npm run zellij:spawn-on-demand-layout && npm run zellij:lane-renderer && npm run mad-sks:zellij-launch && npm run mad-sks:zellij-default-pane-worker && npm run agent:zellij-runtime && npm run codex:config-eperm-fixture && npm run doctor:fix-proves-codex-read && npm run mad:preflight-blocks-unreadable-config && npm run fast:codex-service-tier-proof && npm run codex:project-config-policy-splitter && npm run test:no-orphan-dist-imports && npm run agent:patch-envelope-extraction && npm run agent:patch-queue-runtime && npm run agent:strategy-to-lease-wiring && npm run agent:patch-swarm-runtime && npm run agent:patch-transaction-journal && npm run agent:patch-conflict-rebase && npm run agent:strategy-to-patch-strict && npm run agent:patch-swarm-runtime-truth && npm run agent:rollback-command && npm run agent:patch-verification-dag && npm run agent:patch-rollback-dag && npm run agent:patch-proof-runtime && npm run agent:patch-swarm-route-blackbox && npm run team:patch-swarm-route-blackbox && npm run dfix:patch-swarm-route-blackbox && npm run appshots:thread-attachment-discovery && npm run mcp:readonly-runtime-scheduler && npm run naruto:work-graph && npm run naruto:readonly-routing && npm run naruto:concurrency-governor && npm run naruto:active-pool && npm run naruto:role-distribution && npm run naruto:parallel-patch-apply && npm run naruto:verification-pool && npm run naruto:zellij-massive-ui && npm run naruto:gpt-final-pack && npm run prompt:placeholder-guard && npm run codex:0.134-runner-truth && npm run agent:native-cli-session-swarm && npm run naruto:shadow-clone-swarm && npm run agent:native-cli-session-swarm-10 && npm run agent:native-cli-session-swarm-20 && npm run agent:no-subagent-scaling && npm run agent:native-cli-session-proof && npm run agent:worker-backend-router && npm run agent:codex-child-overlap && npm run agent:model-authored-patch-envelope && npm run agent:fast-mode-default && npm run agent:fast-mode-worker-propagation && npm run codex:fast-mode-profile-propagation && npm run mad-sks:fast-mode-propagation && npm run zellij:launch-command-truth && npm run zellij:real-session-heartbeat && npm run zellij:ui-design && npm run zellij:doctor-readiness && npm run legacy:upgrade-zero-break && npm run publish:packlist-performance && npm run postinstall:safe-side-effects && npm run runtime:ts-rust-boundary && npm run core-skill:card-schema && npm run core-skill:rollout-scoring && npm run core-skill:patch && npm run core-skill:heldout-validation && npm run core-skill:deployment-snapshot && npm run core-skill:no-inference-optimizer && npm run core-skill:route-runtime-integration && npm run core-skill:promotion-side-effect-ledger && npm run core-skill:legacy-promotion-api-audit && npm run safety:side-effect-zero && npm run safety:mutation-callsite-coverage && npm run safety:mutation-callsite-coverage:repo-wide && npm run side-effect:runtime-report && npm run release:gate-planner && npm run release:dynamic-performance && npm run release:provenance && npm run release:gate-budget && npm run agent:wiki-context-proof && npm run shared-memory:check && npm run wrongness:check && npm run wrongness:fixtures && npm run trust:check && npm run git-collaboration:e2e && node ./dist/scripts/release-check-stamp.js write && npm run release:readiness --silent && node ./dist/scripts/release-check-stamp.js write",
+    "release:check:legacy": "npm run release:check:parallel && npm run mad-sks:app-ui-no-mutation && npm run codex-app:fast-ui-preservation && npm run codex-app:ui-clobber-guard && npm run doctor:fixes-codex-app-fast-ui && npm run provider:badge-context && npm run provider:context-config-toml && npm run codex-app:provider-badge && npm run zellij:spawn-on-demand-layout && npm run zellij:worker-pane-manager && npm run zellij:worker-pane-manager-single-owner && npm run agent:worker-pane-communication-contract && npm run runtime:no-mjs-scripts && npm run runtime:ts-python-boundary && npm run codex-sdk:capability && npm run codex-sdk:no-legacy-fallback && npm run codex-sdk:backend-router && npm run codex-sdk:structured-output && npm run codex-sdk:event-stream-ledger && npm run codex-sdk:thread-registry && npm run codex-sdk:sandbox-policy && npm run codex-sdk:zellij-pane-binding && npm run codex-sdk:all-pipelines && npm run codex-sdk:dfix-pipeline && npm run codex-sdk:qa-pipeline && npm run codex-sdk:research-pipeline && npm run codex-sdk:team-naruto-agent-pipeline && npm run codex-sdk:release-review-pipeline && npm run codex-sdk:ux-ppt-review-pipeline && npm run codex-sdk:core-skill-pipeline && npm run codex-control:capability && npm run codex-control:no-legacy-fallback && npm run codex-control:structured-output && npm run codex-control:event-stream-ledger && npm run codex-control:thread-registry && npm run codex-control:side-effect-scope && npm run codex-control:all-pipelines && npm run codex-control:empty-result-retry && npm run codex-control:stream-idle-watchdog && npm run codex-control:tool-call-sequence-repair && npm run codex-control:keepalive-no-cot-leak && npm run local-collab:policy && npm run local-collab:gpt-final-arbiter && npm run local-collab:no-local-only-final && npm run local-collab:gpt-final-availability && npm run local-llm:capability && npm run local-llm:structured-output && npm run local-llm:tool-call-repair && npm run local-llm:all-pipelines && npm run local-collab:all-pipelines-final-gpt && npm run python-sdk:capability && npm run python-sdk:stream-bridge && npm run python-sdk:sandbox-policy && npm run python-sdk:all-pipelines && npm run codex:plugin-list-json && npm run codex:product-design-plugin-routing && npm run codex:product-design-auto-install && npm run codex:thread-runtime-choice && npm run codex:environment-scoped-approvals && npm run ultra-router:classification && npm run ultra-router:auto-router && npm run release:version-truth && npm run release:worktree-gates && npm run codex:0.137-compat && npm run codex:0.136-compat && npm run codex:0.135-compat && npm run doctor:codex-doctor-parity && npm run codex:permission-profiles && npm run codex:legacy-profile-consumers-removed && npm run terminal:keyboard-enhancement-safety && npm run terminal:tui-output-stability && npm run codex:resume-cwd-truth && npm run mcp:tool-naming-parity && npm run responses:retry-policy-centralized && npm run runtime:no-tmux && npm run zellij:layout-valid && npm run agent:zellij-dynamic-backfill-panes && npm run agent:worker-pane-communication-contract && npm run agent:slot-pane-binding-proof && npm run zellij:worker-pane-manager && npm run zellij:spawn-on-demand-layout && npm run zellij:lane-renderer && npm run mad-sks:zellij-launch && npm run mad-sks:zellij-default-pane-worker && npm run agent:zellij-runtime && npm run codex:config-eperm-fixture && npm run doctor:fix-proves-codex-read && npm run mad:preflight-blocks-unreadable-config && npm run fast:codex-service-tier-proof && npm run codex:project-config-policy-splitter && npm run test:no-orphan-dist-imports && npm run agent:patch-envelope-extraction && npm run agent:patch-queue-runtime && npm run agent:strategy-to-lease-wiring && npm run agent:patch-swarm-runtime && npm run agent:patch-transaction-journal && npm run agent:patch-conflict-rebase && npm run agent:strategy-to-patch-strict && npm run agent:patch-swarm-runtime-truth && npm run agent:rollback-command && npm run agent:patch-verification-dag && npm run agent:patch-rollback-dag && npm run agent:patch-proof-runtime && npm run agent:patch-swarm-route-blackbox && npm run team:patch-swarm-route-blackbox && npm run dfix:patch-swarm-route-blackbox && npm run appshots:thread-attachment-discovery && npm run mcp:readonly-runtime-scheduler && npm run naruto:work-graph && npm run naruto:readonly-routing && npm run naruto:concurrency-governor && npm run naruto:active-pool && npm run naruto:role-distribution && npm run naruto:parallel-patch-apply && npm run naruto:verification-pool && npm run naruto:zellij-massive-ui && npm run naruto:gpt-final-pack && npm run prompt:placeholder-guard && npm run codex:0.134-runner-truth && npm run agent:native-cli-session-swarm && npm run naruto:shadow-clone-swarm && npm run agent:native-cli-session-swarm-10 && npm run agent:native-cli-session-swarm-20 && npm run agent:no-subagent-scaling && npm run agent:native-cli-session-proof && npm run agent:worker-backend-router && npm run agent:codex-child-overlap && npm run agent:model-authored-patch-envelope && npm run agent:fast-mode-default && npm run agent:fast-mode-worker-propagation && npm run codex:fast-mode-profile-propagation && npm run mad-sks:fast-mode-propagation && npm run zellij:launch-command-truth && npm run zellij:real-session-heartbeat && npm run zellij:ui-design && npm run zellij:doctor-readiness && npm run legacy:upgrade-zero-break && npm run publish:packlist-performance && npm run postinstall:safe-side-effects && npm run runtime:ts-rust-boundary && npm run core-skill:card-schema && npm run core-skill:rollout-scoring && npm run core-skill:patch && npm run core-skill:heldout-validation && npm run core-skill:deployment-snapshot && npm run core-skill:no-inference-optimizer && npm run core-skill:route-runtime-integration && npm run core-skill:promotion-side-effect-ledger && npm run core-skill:legacy-promotion-api-audit && npm run core-skill:trainer-loop && npm run safety:side-effect-zero && npm run safety:mutation-callsite-coverage && npm run safety:mutation-callsite-coverage:repo-wide && npm run side-effect:runtime-report && npm run release:gate-planner && npm run release:dynamic-performance && npm run release:provenance && npm run release:gate-budget && npm run agent:wiki-context-proof && npm run shared-memory:check && npm run wrongness:check && npm run wrongness:fixtures && npm run trust:check && npm run git-collaboration:e2e && node ./dist/scripts/release-check-stamp.js write && npm run release:readiness --silent && node ./dist/scripts/release-check-stamp.js write",
     "release:check:dag": "node ./dist/scripts/release-gate-dag-runner.js --preset release",
     "release:check:dag:explain": "node ./dist/scripts/release-gate-dag-runner.js --preset release --explain",
     "release:check:dag:no-cache": "node ./dist/scripts/release-gate-dag-runner.js --preset release --no-cache",
@@ -755,6 +757,7 @@
     "loop:owner-inference": "node ./dist/scripts/loop-owner-inference-check.js",
     "loop:scheduler": "node ./dist/scripts/loop-scheduler-check.js",
     "loop:runtime": "node ./dist/scripts/loop-runtime-check.js",
+    "loop:fixture-safety": "node ./dist/scripts/loop-fixture-safety-check.js",
     "loop:proof": "node ./dist/scripts/loop-proof-check.js",
     "loop:integration-finalizer": "node ./dist/scripts/loop-integration-finalizer-check.js",
     "loop:gate-selector": "node ./dist/scripts/loop-gate-selector-check.js",