sneakoscope 3.1.0 → 3.1.2

package/dist/core/commands/wiki-command.js

@@ -120,7 +120,17 @@ export async function wikiCommand(sub, args = []) {
             const { id, dir } = await createMission(root, { mode: 'wiki', prompt: 'sks wiki refresh' });
             const gate = { schema_version: 1, passed: validation.result.ok, ok: validation.result.ok, context_pack: '.sneakoscope/wiki/context-pack.json', anchors: wikiAnchorCount(pack.wiki), voxels: wikiVoxelRowCount(pack.wiki) };
             await writeJsonAtomic(path.join(dir, 'wiki-gate.json'), gate);
-            await maybeFinalizeRoute(root, { missionId: id, route: '$Wiki', gateFile: 'wiki-gate.json', gate, artifacts: ['wiki-gate.json', 'completion-proof.json'], statusHint: validation.result.ok ? 'verified_partial' : 'blocked', blockers: validation.result.ok ? [] : validation.result.issues, command: { cmd: 'sks wiki refresh', status: exitCode } });
+            await maybeFinalizeRoute(root, {
+                missionId: id,
+                route: '$Wiki',
+                gateFile: 'wiki-gate.json',
+                gate,
+                artifacts: ['wiki-gate.json', 'completion-proof.json'],
+                statusHint: validation.result.ok ? 'verified_partial' : 'blocked',
+                blockers: validation.result.ok ? [] : validation.result.issues,
+                command: { cmd: 'sks wiki refresh', status: exitCode },
+                failureAnalysis: wikiRefreshFailureAnalysis(validation.result, gate)
+            });
         }
         if (flag(args, '--json')) {
             process.exitCode = exitCode;
@@ -197,6 +207,30 @@ export async function wikiCommand(sub, args = []) {
     console.error('Usage: sks wiki coords|pack|refresh|publish|rebuild-index|rebuild-summary|validate|validate-shared|wrongness|image-ingest|anchor-add|relation-add|image-validate|image-summary');
     process.exitCode = 1;
 }
+function wikiRefreshFailureAnalysis(validationResult, gate = {}) {
+    if (validationResult?.ok) {
+        return {
+            status: 'complete',
+            root_cause: 'Wiki refresh intentionally finalizes as verified_partial because a context-pack refresh can verify TriWiki schema and anchors, but active wrongness memory may still prevent full trust verification.',
+            corrective_action: 'The Wiki route records the fresh context-pack validation, wiki gate counts, and completion-proof evidence while keeping the route below full verified status until wrongness memory is separately resolved.',
+            evidence: [
+                '.sneakoscope/wiki/context-pack.json',
+                'wiki-gate.json',
+                { anchors: gate.anchors || 0, voxels: gate.voxels || 0 }
+            ]
+        };
+    }
+    return {
+        status: 'complete',
+        root_cause: `Wiki context-pack validation failed during refresh: ${(validationResult?.issues || []).join(', ') || 'unknown validation issue'}.`,
+        corrective_action: 'The Wiki route finalized as blocked and preserved validation issues in the completion proof so the context pack can be corrected before any completion claim.',
+        evidence: [
+            '.sneakoscope/wiki/context-pack.json',
+            'wiki-gate.json',
+            ...(validationResult?.issues || [])
+        ]
+    };
+}
 async function wikiImageIngest(args = []) {
     const root = await sksRoot();
     const imagePath = args.find((arg, i) => i >= 0 && !String(arg).startsWith('--'));

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.1.0';
+export const PACKAGE_VERSION = '3.1.2';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/init.js

@@ -591,7 +591,6 @@ export async function initProject(root, opts = {}) {
         // upgrade never clobbers a user's chosen model/service_tier. model_reasoning_effort
         // is intentionally left untouched at the top level.
         next = upsertTopLevelTomlStringIfAbsent(next, 'model', 'gpt-5.5');
-        next = upsertTopLevelTomlStringIfAbsent(next, 'service_tier', 'fast');
         next = upsertTopLevelTomlBooleanIfAbsent(next, 'suppress_unstable_features_warning', true);
         // Codex App feature flags: SET-IF-ABSENT only (see note above).
         for (const flag of MANAGED_CODEX_FEATURE_FLAGS) {
@@ -599,7 +598,7 @@ export async function initProject(root, opts = {}) {
         }
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'visible = true');
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'enabled = true');
-        next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'default_profile = "sks-fast-high"');
+        next = removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
         next = upsertTomlTableKeyIfAbsent(next, 'agents', 'max_threads = 6');
         next = upsertTomlTableKeyIfAbsent(next, 'agents', 'max_depth = 1');
         for (const block of managedCodexConfigBlocks()) {

package/dist/core/locks/file-lock.js

@@ -0,0 +1,88 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, randomId, writeJsonAtomic } from '../fsx.js';
+import { guardedRm, guardContextForRoute } from '../safety/mutation-guard.js';
+import { CONFIRMATION_REQUIRED, REQUESTED_SCOPE_CONTRACT_SCHEMA } from '../safety/requested-scope-contract.js';
+export async function withFileLock(input, fn) {
+    const lockPath = path.resolve(input.lockPath);
+    const timeoutMs = Math.max(1, input.timeoutMs);
+    const staleMs = Math.max(1, input.staleMs);
+    const started = Date.now();
+    const owner = `${process.pid}-${randomId(8)}`;
+    await ensureDir(path.dirname(lockPath));
+    while (true) {
+        try {
+            await fsp.mkdir(lockPath);
+            await writeJsonAtomic(path.join(lockPath, 'owner.json'), {
+                schema: 'sks.file-lock-owner.v1',
+                owner,
+                pid: process.pid,
+                acquired_at: nowIso(),
+                stale_ms: staleMs
+            });
+            break;
+        }
+        catch (err) {
+            const code = errorCode(err);
+            if (code !== 'EEXIST')
+                throw err;
+            await recoverStaleLock(lockPath, staleMs);
+            if (Date.now() - started > timeoutMs) {
+                throw new Error(`file_lock_timeout:${lockPath}`);
+            }
+            await sleep(jitterDelay());
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await removeLockDir(lockPath).catch(() => undefined);
+    }
+}
+async function recoverStaleLock(lockPath, staleMs) {
+    try {
+        const stat = await fsp.stat(lockPath);
+        if (Date.now() - stat.mtimeMs > staleMs) {
+            await removeLockDir(lockPath);
+        }
+    }
+    catch { }
+}
+async function removeLockDir(lockPath) {
+    await guardedRm(guardContextForRoute(process.cwd(), lockScopeContract(lockPath), 'remove SKS file lock directory'), lockPath, {
+        recursive: true,
+        force: true
+    });
+}
+function lockScopeContract(lockPath) {
+    const resolved = path.resolve(lockPath);
+    return {
+        schema: REQUESTED_SCOPE_CONTRACT_SCHEMA,
+        route: 'internal:file-lock',
+        user_request: 'Remove only the current SKS file-lock directory.',
+        allowed_mutations: {
+            project_files: true,
+            global_codex_config: false,
+            codex_app_process: false,
+            codex_lb_auth: false,
+            package_install: false,
+            zellij_install: false,
+            network: false,
+            skill_snapshot_promotion: false
+        },
+        allowed_paths: [resolved, `${resolved}/**`],
+        forbidden_paths: ['~/.codex/config.toml', '/Applications/**'],
+        requires_explicit_confirmation: [...CONFIRMATION_REQUIRED]
+    };
+}
+function jitterDelay() {
+    return 15 + Math.floor(Math.random() * 45);
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function errorCode(err) {
+    return err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+}
+//# sourceMappingURL=file-lock.js.map

package/dist/core/loops/loop-artifacts.js

@@ -1,9 +1,10 @@
 import path from 'node:path';
 export function loopRoot(root, missionId) {
-    return path.join(root, '.sneakoscope', 'missions', missionId, 'loops');
+    const missionsRoot = path.resolve(root, '.sneakoscope', 'missions');
+    return containedJoin(missionsRoot, safeArtifactId('mission', missionId), 'loops');
 }
 export function loopNodeRoot(root, missionId, loopId) {
-    return path.join(loopRoot(root, missionId), loopId);
+    return containedJoin(loopRoot(root, missionId), safeArtifactId('loop', loopId));
 }
 export function loopPlanPath(root, missionId) {
     return path.join(loopRoot(root, missionId), 'loop-plan.json');
@@ -20,9 +21,45 @@ export function loopProofPath(root, missionId, loopId) {
 export function loopBudgetPath(root, missionId, loopId) {
     return path.join(loopNodeRoot(root, missionId, loopId), 'loop-budget.json');
 }
+export function loopCheckpointPath(root, missionId, loopId, iteration, phase) {
+    return path.join(loopNodeRoot(root, missionId, loopId), 'checkpoints', `${String(Math.max(1, Math.floor(iteration))).padStart(4, '0')}-${sanitizeArtifactPart(phase)}.json`);
+}
+export function loopLatestCheckpointPath(root, missionId, loopId) {
+    return path.join(loopNodeRoot(root, missionId, loopId), 'checkpoint-latest.json');
+}
 export function loopGraphProofPath(root, missionId) {
     return path.join(loopRoot(root, missionId), 'loop-graph-proof.json');
 }
+export function loopIntegrationMergePath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'integration-merge.json');
+}
+export function loopGptFinalArbiterPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'loop-gpt-final-arbiter.json');
+}
+export function loopFinalArbiterGateContractPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'gpt-final-arbiter-gate-contract.json');
+}
+export function loopFixturePolicyPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'fixture-policy.json');
+}
+export function loopMutationLedgerPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'mutation-ledger.jsonl');
+}
+export function loopSideEffectReportPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'loop-side-effect-report.json');
+}
+export function loopActiveWorkerHandlesPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'active-worker-handles.jsonl');
+}
+export function loopInterruptResultPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'interrupt-result.json');
+}
+export function loopConcurrencyBudgetPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'concurrency-budget.json');
+}
+export function loopKillRequestPath(root, missionId) {
+    return path.join(loopRoot(root, missionId), 'kill-request.json');
+}
 export function loopGatePath(root, missionId, loopId, gateId) {
     return path.join(loopNodeRoot(root, missionId, loopId), 'gates', `${sanitizeArtifactPart(gateId)}.json`);
 }
@@ -38,4 +75,19 @@ export function loopOwnerLedgerPath(root, missionId) {
 export function sanitizeArtifactPart(value) {
     return String(value || 'artifact').replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 96) || 'artifact';
 }
+function safeArtifactId(kind, value) {
+    const text = String(value || '').trim();
+    const sanitized = sanitizeArtifactPart(text);
+    if (!text || sanitized !== text)
+        throw new Error(`invalid_loop_${kind}_id:${text || 'empty'}`);
+    return sanitized;
+}
+function containedJoin(base, ...parts) {
+    const resolvedBase = path.resolve(base);
+    const target = path.resolve(resolvedBase, ...parts);
+    if (target !== resolvedBase && !target.startsWith(`${resolvedBase}${path.sep}`)) {
+        throw new Error(`loop_artifact_path_escape:${target}`);
+    }
+    return target;
+}
 //# sourceMappingURL=loop-artifacts.js.map

package/dist/core/loops/loop-checkpoint.js

@@ -0,0 +1,22 @@
+import { readJson, writeJsonAtomic } from '../fsx.js';
+import { loopCheckpointPath, loopLatestCheckpointPath } from './loop-artifacts.js';
+export async function writeLoopCheckpoint(input) {
+    const checkpoint = {
+        schema: 'sks.loop-checkpoint.v1',
+        mission_id: input.mission_id,
+        loop_id: input.loop_id,
+        iteration: input.iteration,
+        phase: input.phase,
+        state_path: input.state_path,
+        proof_path: input.proof_path,
+        resumable: input.resumable,
+        created_at: new Date().toISOString()
+    };
+    await writeJsonAtomic(loopCheckpointPath(input.root, input.mission_id, input.loop_id, input.iteration, input.phase), checkpoint);
+    await writeJsonAtomic(loopLatestCheckpointPath(input.root, input.mission_id, input.loop_id), checkpoint);
+    return checkpoint;
+}
+export async function readLatestLoopCheckpoint(root, missionId, loopId) {
+    return readJson(loopLatestCheckpointPath(root, missionId, loopId), null);
+}
+//# sourceMappingURL=loop-checkpoint.js.map

package/dist/core/loops/loop-concurrency-budget.js

@@ -0,0 +1,55 @@
+import os from 'node:os';
+import { writeJsonAtomic } from '../fsx.js';
+import { loopConcurrencyBudgetPath } from './loop-artifacts.js';
+export function computeLoopConcurrencyBudget(input) {
+    const env = input.env || process.env;
+    const cores = Math.max(1, os.cpus().length || 1);
+    const requestedLoops = input.parallelism === 'safe' ? 2 : input.parallelism === 'extreme' ? Math.min(16, cores) : Math.min(8, cores);
+    const envLoops = positiveInt(env.SKS_LOOP_MAX_ACTIVE_LOOPS);
+    const envWorkers = positiveInt(env.SKS_LOOP_MAX_ACTIVE_WORKERS);
+    const envModelCalls = positiveInt(env.SKS_LOOP_MAX_MODEL_CALLS);
+    const maxActiveLoops = envLoops || requestedLoops;
+    const maxActiveWorkers = envWorkers || (input.parallelism === 'safe' ? Math.min(8, cores) : input.parallelism === 'extreme' ? Math.min(32, Math.max(4, cores * 2)) : Math.min(16, Math.max(4, cores)));
+    const maxModelCalls = envModelCalls || Math.max(1, Math.min(maxActiveWorkers, input.plan.global_budget.max_model_calls || maxActiveWorkers));
+    let remainingWorkers = maxActiveWorkers;
+    let remainingModelCalls = maxModelCalls;
+    const perLoop = input.plan.graph.nodes.map((node) => {
+        const requested = Math.max(1, node.maker.worker_count + node.checker.worker_count);
+        const fairShare = Math.max(1, Math.floor(maxActiveWorkers / Math.max(1, input.plan.graph.nodes.length)));
+        const allocation = Math.min(requested, Math.max(1, fairShare), Math.max(1, remainingWorkers));
+        const maker = Math.min(node.maker.worker_count, Math.max(1, Math.ceil(allocation / 2)));
+        const checker = Math.min(node.checker.worker_count, Math.max(0, allocation - maker));
+        const modelCalls = Math.min(Math.max(1, node.budget.max_model_calls), Math.max(1, remainingModelCalls));
+        remainingWorkers = Math.max(0, remainingWorkers - maker - checker);
+        remainingModelCalls = Math.max(0, remainingModelCalls - modelCalls);
+        return {
+            loop_id: node.loop_id,
+            maker_workers: maker,
+            checker_workers: checker,
+            model_call_budget: modelCalls
+        };
+    });
+    return {
+        schema: 'sks.loop-concurrency-budget.v1',
+        mission_id: input.plan.mission_id,
+        max_active_loops: maxActiveLoops,
+        max_active_workers: maxActiveWorkers,
+        max_model_calls: maxModelCalls,
+        per_loop_worker_budget: perLoop,
+        headroom_workers: Math.max(0, maxActiveWorkers - perLoop.reduce((sum, row) => sum + row.maker_workers + row.checker_workers, 0)),
+        blockers: []
+    };
+}
+export async function writeLoopConcurrencyBudget(root, budget) {
+    await writeJsonAtomic(loopConcurrencyBudgetPath(root, budget.mission_id), { ...budget, generated_at: new Date().toISOString() });
+}
+export function loopWorkerBudgetFor(budget, loopId, phase, requested) {
+    const row = budget.per_loop_worker_budget.find((item) => item.loop_id === loopId);
+    const allowed = phase === 'maker' ? row?.maker_workers : row?.checker_workers;
+    return Math.max(1, Math.min(Math.max(1, requested), Math.max(1, allowed || requested)));
+}
+function positiveInt(value) {
+    const number = Number(value);
+    return Number.isFinite(number) && number >= 1 ? Math.floor(number) : null;
+}
+//# sourceMappingURL=loop-concurrency-budget.js.map

package/dist/core/loops/loop-final-arbiter-contract.js

@@ -0,0 +1,28 @@
+import { writeJsonAtomic } from '../fsx.js';
+import { loopFinalArbiterGateContractPath, loopGptFinalArbiterPath } from './loop-artifacts.js';
+export async function writeLoopFinalArbiterGateContract(root, missionId) {
+    const contract = buildLoopFinalArbiterGateContract(root, missionId);
+    await writeJsonAtomic(loopFinalArbiterGateContractPath(root, missionId), { ...contract, generated_at: new Date().toISOString() });
+    return contract;
+}
+export function buildLoopFinalArbiterGateContract(root, missionId) {
+    return {
+        schema: 'sks.loop-final-arbiter-gate-contract.v1',
+        mission_id: missionId,
+        gate_id: 'gpt:final-arbiter',
+        handled_by: 'loop-finalizer',
+        gate_runner_status: 'deferred',
+        finalizer_artifact_path: relativeMissionArtifact(root, loopGptFinalArbiterPath(root, missionId)),
+        required_when: ['source_mutation_exists', 'selected_gates_include_gpt_final_arbiter'],
+        production_fixture_allowed: false
+    };
+}
+export function loopFinalArbiterGateContractRelativePath(missionId) {
+    return `.sneakoscope/missions/${missionId}/loops/gpt-final-arbiter-gate-contract.json`;
+}
+function relativeMissionArtifact(root, absolute) {
+    const normalizedRoot = root.replace(/\\/g, '/').replace(/\/+$/, '');
+    const normalized = absolute.replace(/\\/g, '/');
+    return normalized.startsWith(`${normalizedRoot}/`) ? normalized.slice(normalizedRoot.length + 1) : normalized;
+}
+//# sourceMappingURL=loop-final-arbiter-contract.js.map

package/dist/core/loops/loop-finalizer.js

@@ -1,6 +1,10 @@
 import { readJson, writeJsonAtomic } from '../fsx.js';
 import { loopGraphProofPath, loopProofPath } from './loop-artifacts.js';
+import { writeLoopFinalArbiterGateContract } from './loop-final-arbiter-contract.js';
+import { runLoopGptFinalArbiter } from './loop-gpt-final-arbiter.js';
+import { mergeLoopWorktrees } from './loop-integration-merge.js';
 import { graphProofFromLoopProofs } from './loop-scheduler.js';
+import { buildLoopSideEffectReport } from './loop-side-effect-scanner.js';
 export async function finalizeLoopGraph(input) {
     const proofs = input.proofs || await Promise.all(input.plan.graph.nodes.map((node) => readJson(loopProofPath(input.root, input.plan.mission_id, node.loop_id), null)));
     const realProofs = proofs.filter((proof) => Boolean(proof));
@@ -11,16 +15,60 @@ export async function finalizeLoopGraph(input) {
         maxActiveWorkers: input.maxActiveWorkers || Math.max(1, realProofs.reduce((sum, proof) => sum + proof.maker_result.worker_count + proof.checker_result.worker_count, 0)),
         wallMs: input.wallMs || 1
     });
+    const integrationMerge = await mergeLoopWorktrees({
+        root: input.root,
+        plan: input.plan,
+        proofs: realProofs
+    });
     const anyHandoff = realProofs.some((proof) => proof.handoff.required);
-    const anySourceMutation = realProofs.some((proof) => proof.changed_files.length > 0);
+    const anySourceMutation = realProofs.some((proof) => proof.changed_files.some((file) => !file.startsWith('.sneakoscope/')));
+    const selectedGptFinal = graph.gates.selected.includes('gpt:final-arbiter');
+    const contract = anySourceMutation || selectedGptFinal
+        ? await writeLoopFinalArbiterGateContract(input.root, input.plan.mission_id)
+        : null;
+    const sideEffectReport = await buildLoopSideEffectReport({
+        root: input.root,
+        missionId: input.plan.mission_id,
+        proofs: realProofs,
+        integrationMerge
+    });
+    const arbiter = anySourceMutation
+        ? await runLoopGptFinalArbiter({ root: input.root, plan: input.plan, proofs: realProofs, integrationMerge, sideEffectReport })
+        : null;
+    const blockers = [
+        ...graph.blockers,
+        ...(anyHandoff ? ['loop_handoff_required'] : []),
+        ...(integrationMerge.ok ? [] : integrationMerge.blockers),
+        ...(sideEffectReport.ok ? [] : sideEffectReport.blockers),
+        ...(anySourceMutation && !arbiter ? ['gpt_final_arbiter_missing'] : []),
+        ...(selectedGptFinal && anySourceMutation && (!contract || !arbiter) ? ['gpt_final_arbiter_contract_unfulfilled'] : []),
+        ...(arbiter && !arbiter.ok ? ['gpt_final_arbiter_not_approved', ...arbiter.blockers] : [])
+    ];
     const finalGraph = {
         ...graph,
-        ok: graph.ok && !anyHandoff && (!anySourceMutation || graph.gates.selected.includes('gpt:final-arbiter')),
-        blockers: [
-            ...graph.blockers,
-            ...(anyHandoff ? ['loop_handoff_required'] : []),
-            ...(anySourceMutation && !graph.gates.selected.includes('gpt:final-arbiter') ? ['gpt_final_arbiter_missing'] : [])
-        ]
+        ok: graph.ok && blockers.length === 0,
+        blockers: [...new Set(blockers)],
+        integration_merge: {
+            ok: integrationMerge.ok,
+            artifact_path: `.sneakoscope/missions/${input.plan.mission_id}/loops/integration-merge.json`,
+            applied_loops: integrationMerge.applied_loops,
+            conflict_loops: integrationMerge.conflict_loops,
+            ...(integrationMerge.strategy_summary ? { strategy_summary: integrationMerge.strategy_summary } : {})
+        },
+        side_effect_report: {
+            ok: sideEffectReport.ok,
+            artifact_path: `.sneakoscope/missions/${input.plan.mission_id}/loops/loop-side-effect-report.json`,
+            blockers: sideEffectReport.blockers
+        },
+        ...(arbiter ? {
+            gpt_final_arbiter: {
+                ok: arbiter.ok,
+                artifact_path: arbiter.artifact_path,
+                verdict: arbiter.verdict,
+                gate_contract_path: `.sneakoscope/missions/${input.plan.mission_id}/loops/gpt-final-arbiter-gate-contract.json`,
+                handled_by: 'loop-finalizer'
+            }
+        } : {})
     };
     await writeJsonAtomic(loopGraphProofPath(input.root, input.plan.mission_id), finalGraph);
     return finalGraph;

package/dist/core/loops/loop-fixture-policy.js

@@ -0,0 +1,58 @@
+import os from 'node:os';
+import path from 'node:path';
+import { writeJsonAtomic } from '../fsx.js';
+import { loopFixturePolicyPath } from './loop-artifacts.js';
+export function decideLoopFixturePolicy(input) {
+    const env = input.env || process.env;
+    const argv = input.argv || process.argv;
+    const scriptPath = argv.find((arg) => /(?:^|[\\/])(?:dist|src)[\\/]scripts[\\/]/.test(arg)) || argv[1] || '';
+    const scriptName = path.basename(scriptPath);
+    const scriptIsCheck = /(?:^|[\\/])(?:dist|src)[\\/]scripts[\\/]/.test(scriptPath)
+        && /(check|blackbox)/.test(scriptName);
+    const missionIsCheck = /^M-check-/.test(input.missionId);
+    const tempRoot = isUnderTempRoot(input.root);
+    const explicitTestEnv = env.NODE_ENV === 'test'
+        || env.SKS_TEST_RUNTIME_FIXTURE_ALLOWED === '1'
+        || env.VITEST_WORKER_ID !== undefined
+        || env.JEST_WORKER_ID !== undefined
+        || env.NODE_V8_COVERAGE !== undefined;
+    const commandText = argv.join(' ');
+    const productionCommand = /\bsks\s+(?:loop\s+run|goal|naruto)\b/.test(commandText);
+    const requestedByEnv = env.SKS_LOOP_GATE_FIXTURE === '1'
+        || env.SKS_LOOP_RUNTIME_FIXTURE === '1'
+        || env.SKS_LOOP_GPT_FINAL_FIXTURE === '1';
+    const allowReasons = [
+        scriptIsCheck ? 'release_check_script' : null,
+        missionIsCheck ? 'check_mission_id' : null,
+        tempRoot ? 'temp_project_root' : null,
+        explicitTestEnv ? 'test_environment' : null
+    ].filter((value) => Boolean(value));
+    const allowed = input.requested && allowReasons.length > 0 && !productionCommand;
+    const productionLike = !scriptIsCheck && !missionIsCheck && !tempRoot && !explicitTestEnv;
+    const blockers = input.requested && !allowed
+        ? [
+            'loop_fixture_forbidden_in_production',
+            `loop_${input.mode.replace(/-/g, '_')}_fixture_forbidden_in_production`,
+            ...(productionCommand ? ['loop_fixture_forbidden_for_production_command'] : []),
+            ...(requestedByEnv && productionLike ? ['loop_fixture_env_without_allowed_reason'] : [])
+        ]
+        : [];
+    return {
+        schema: 'sks.loop-fixture-policy-decision.v1',
+        allowed,
+        mode: input.mode,
+        requested: input.requested,
+        production_like: productionLike || productionCommand,
+        reason: allowed ? allowReasons.join('+') : input.requested ? 'fixture_requires_check_or_test_context' : 'fixture_not_requested',
+        blockers: [...new Set(blockers)]
+    };
+}
+export async function writeLoopFixturePolicyDecision(root, missionId, decision) {
+    await writeJsonAtomic(loopFixturePolicyPath(root, missionId), { ...decision, generated_at: new Date().toISOString() });
+}
+export function isUnderTempRoot(root) {
+    const normalizedRoot = path.resolve(root);
+    const tempRoot = path.resolve(os.tmpdir());
+    return normalizedRoot === tempRoot || normalizedRoot.startsWith(`${tempRoot}${path.sep}`);
+}
+//# sourceMappingURL=loop-fixture-policy.js.map

package/dist/core/loops/loop-gate-registry.js

@@ -0,0 +1,96 @@
+import path from 'node:path';
+import { readJson } from '../fsx.js';
+export async function resolveLoopGate(root, gateId) {
+    const builtin = builtinLoopGate(gateId);
+    if (builtin)
+        return builtin;
+    const releaseGate = await resolveReleaseGate(root, gateId);
+    if (releaseGate)
+        return releaseGate;
+    const packageGate = await resolvePackageScriptGate(root, gateId);
+    if (packageGate)
+        return packageGate;
+    return null;
+}
+export async function listLoopGateDefinitions(root) {
+    const packageJson = await readJson(path.join(root, 'package.json'), {});
+    const release = await readJson(path.join(root, 'release-gates.v2.json'), {});
+    const packageScripts = packageJson && typeof packageJson === 'object' && packageJson.scripts && typeof packageJson.scripts === 'object'
+        ? Object.keys(packageJson.scripts)
+        : [];
+    const releaseGates = Array.isArray(release.gates) ? release.gates : [];
+    const definitions = [
+        ...['gpt:final-arbiter', 'human:handoff-required', 'loop:checker-fresh-session', 'loop:state-valid', 'loop:budget-valid'].map((id) => builtinLoopGate(id)).filter((row) => Boolean(row)),
+        ...releaseGates.map((gate) => normalizeReleaseGate(gate)).filter((row) => Boolean(row)),
+        ...packageScripts.map((id) => ({
+            id,
+            command: `npm run ${shellQuote(id)} --silent`,
+            source: 'package-json',
+            side_effect: 'hermetic',
+            timeout_ms: 300000,
+            cache_allowed: true
+        }))
+    ];
+    const byId = new Map();
+    for (const definition of definitions)
+        if (!byId.has(definition.id))
+            byId.set(definition.id, definition);
+    return [...byId.values()];
+}
+function builtinLoopGate(gateId) {
+    if (gateId === 'gpt:final-arbiter') {
+        return { id: gateId, command: 'builtin:gpt-final-arbiter', source: 'builtin-pseudo', side_effect: 'read-only', timeout_ms: 300000, cache_allowed: false };
+    }
+    if (gateId === 'human:handoff-required') {
+        return { id: gateId, command: 'builtin:human-handoff-required', source: 'builtin-pseudo', side_effect: 'human', timeout_ms: 0, cache_allowed: false };
+    }
+    if (gateId === 'loop:checker-fresh-session') {
+        return { id: gateId, command: 'builtin:loop-checker-fresh-session', source: 'builtin-pseudo', side_effect: 'read-only', timeout_ms: 30000, cache_allowed: false };
+    }
+    if (gateId === 'loop:state-valid') {
+        return { id: gateId, command: 'builtin:loop-state-valid', source: 'builtin-pseudo', side_effect: 'read-only', timeout_ms: 30000, cache_allowed: true };
+    }
+    if (gateId === 'loop:budget-valid') {
+        return { id: gateId, command: 'builtin:loop-budget-valid', source: 'builtin-pseudo', side_effect: 'read-only', timeout_ms: 30000, cache_allowed: true };
+    }
+    return null;
+}
+async function resolveReleaseGate(root, gateId) {
+    const release = await readJson(path.join(root, 'release-gates.v2.json'), {});
+    const gate = Array.isArray(release.gates) ? release.gates.find((row) => row.id === gateId) : null;
+    return gate ? normalizeReleaseGate(gate) : null;
+}
+function normalizeReleaseGate(gate) {
+    const id = String(gate.id || '');
+    const command = String(gate.command || '');
+    if (!id || !command)
+        return null;
+    return {
+        id,
+        command,
+        source: 'release-gates-v2',
+        side_effect: normalizeSideEffect(gate.side_effect),
+        timeout_ms: Number.isFinite(Number(gate.timeout_ms)) ? Math.max(1, Number(gate.timeout_ms)) : 300000,
+        cache_allowed: gate.cache?.enabled !== false
+    };
+}
+async function resolvePackageScriptGate(root, gateId) {
+    const packageJson = await readJson(path.join(root, 'package.json'), {});
+    if (!packageJson?.scripts || typeof packageJson.scripts !== 'object' || !(gateId in packageJson.scripts))
+        return null;
+    return {
+        id: gateId,
+        command: `npm run ${shellQuote(gateId)} --silent`,
+        source: 'package-json',
+        side_effect: 'hermetic',
+        timeout_ms: 300000,
+        cache_allowed: true
+    };
+}
+function normalizeSideEffect(value) {
+    return value === 'read-only' || value === 'mutation' || value === 'human' ? value : 'hermetic';
+}
+function shellQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=loop-gate-registry.js.map