sneakoscope 3.1.0 → 3.1.2

package/dist/core/proof/route-finalizer.js

@@ -6,7 +6,7 @@ import { readAgentProofEvidence } from '../agents/agent-proof-evidence.js';
 import { wrongnessProofEvidence } from '../triwiki-wrongness/wrongness-proof-linker.js';
 import { computerUseStatusReport } from '../computer-use-status.js';
 import { readComputerUseLiveEvidence } from '../computer-use-live-evidence.js';
-export async function finalizeRouteWithProof(root, { missionId, route, gateFile = null, gate = null, artifacts = [], visualEvidence = null, dbEvidence = null, madSksEvidence = null, testEvidence = null, commandEvidence = null, claims = [], unverified = [], blockers = [], statusHint = 'verified_partial', strict = false, mock = false, fixClaim = false, requireRelation = false, visualClaim = undefined, agents = undefined, allowActiveWrongnessPartial = false } = {}) {
+export async function finalizeRouteWithProof(root, { missionId, route, gateFile = null, gate = null, artifacts = [], visualEvidence = null, dbEvidence = null, madSksEvidence = null, testEvidence = null, commandEvidence = null, claims = [], unverified = [], blockers = [], statusHint = 'verified_partial', strict = false, mock = false, fixClaim = false, requireRelation = false, visualClaim = undefined, agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null } = {}) {
     const policy = routeFinalizerPolicy(route, { strict, fixClaim, requireRelation, visualClaim });
     const localBlockers = [...blockers];
     const providedVisualEvidence = visualEvidence;
@@ -66,6 +66,24 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         ? (strict ? 'blocked' : statusHint === 'verified' ? 'verified_partial' : statusHint)
         : visualComputerUseDowngrade ? 'verified_partial'
             : statusHint;
+    const finalUnverified = [
+        ...unverified,
+        ...(imageEvidence?.mock ? ['Image voxel evidence is mock fixture evidence and does not claim a real visual run.'] : []),
+        ...(Number(wrongnessEvidence?.medium_severity_active || 0) > 0 ? ['Active medium-severity wrongness memory remains and prevents full verification claims.'] : [])
+    ];
+    const resolvedFailureAnalysis = failureAnalysis || inferRouteFailureAnalysis({
+        missionId,
+        route: policy.route,
+        status,
+        blockers: localBlockers,
+        unverified: finalUnverified,
+        wrongnessEvidence,
+        imageEvidence,
+        agentEvidence,
+        computerUse,
+        computerUseLive,
+        visualComputerUseDowngrade
+    });
     const evidence = {
         ...collected,
         ...(dbEvidence ? { db: dbEvidence } : {}),
@@ -109,12 +127,9 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         artifacts,
         evidence,
         claims,
-        unverified: [
-            ...unverified,
-            ...(imageEvidence?.mock ? ['Image voxel evidence is mock fixture evidence and does not claim a real visual run.'] : []),
-            ...(Number(wrongnessEvidence?.medium_severity_active || 0) > 0 ? ['Active medium-severity wrongness memory remains and prevents full verification claims.'] : [])
-        ],
+        unverified: finalUnverified,
         blockers: localBlockers,
+        failureAnalysis: resolvedFailureAnalysis,
         summary: {
             files_changed: collected.files?.length || 0,
             commands_run: evidence.commands?.length || 0,
@@ -124,4 +139,54 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         }
     });
 }
+function inferRouteFailureAnalysis({ missionId, route, status, blockers, unverified, wrongnessEvidence, imageEvidence, agentEvidence, computerUse, computerUseLive, visualComputerUseDowngrade } = {}) {
+    if (status === 'verified' && !blockers?.length && !unverified?.length)
+        return null;
+    const evidence = [
+        missionId ? `.sneakoscope/missions/${missionId}/completion-proof.json#unverified` : 'completion-proof.json#unverified',
+        ...(wrongnessEvidence?.mission_ledger ? [wrongnessEvidence.mission_ledger] : []),
+        ...(agentEvidence ? [missionId ? `.sneakoscope/missions/${missionId}/agents/agent-proof-evidence.json` : 'agents/agent-proof-evidence.json'] : []),
+        ...(imageEvidence?.ledger ? ['image_voxels'] : []),
+        ...(computerUse ? ['computer_use_status'] : []),
+        ...(computerUseLive?.path ? [computerUseLive.path] : [])
+    ];
+    if (blockers?.length) {
+        return {
+            status: 'complete',
+            root_cause: `Route ${route || 'unknown'} could not be fully verified because finalization recorded blocking conditions: ${blockers.join(', ')}.`,
+            corrective_action: 'Preserved the non-verified completion status, recorded blockers in Completion Proof, and linked the available route evidence instead of claiming full completion.',
+            evidence
+        };
+    }
+    if (Number(wrongnessEvidence?.medium_severity_active || 0) > 0) {
+        return {
+            status: 'complete',
+            root_cause: `Route ${route || 'unknown'} remains verified_partial because active medium-severity wrongness memory is still present even though no high-severity blocker remains.`,
+            corrective_action: 'Kept the Completion Proof at verified_partial, recorded the wrongness caveat in unverified evidence, and avoided a full verified claim until the memory is resolved or explicitly accepted.',
+            evidence
+        };
+    }
+    if (visualComputerUseDowngrade) {
+        return {
+            status: 'complete',
+            root_cause: 'Native Computer Use visual confidence was downgraded because live capture or Image Voxel linkage was unavailable or incomplete.',
+            corrective_action: 'Kept the Completion Proof at verified_partial and recorded the missing native visual evidence instead of claiming high-confidence visual verification.',
+            evidence
+        };
+    }
+    if (imageEvidence?.mock) {
+        return {
+            status: 'complete',
+            root_cause: 'Visual evidence was produced from a mock fixture, which cannot support a real fully verified visual route claim.',
+            corrective_action: 'Kept the Completion Proof at verified_partial and recorded the mock-evidence caveat in unverified evidence.',
+            evidence
+        };
+    }
+    return {
+        status: 'complete',
+        root_cause: `Route ${route || 'unknown'} generated a non-verified completion status because unresolved caveats remained in final unverified evidence.`,
+        corrective_action: 'Recorded those caveats in Completion Proof and preserved the partial status instead of upgrading the route to verified.',
+        evidence
+    };
+}
 //# sourceMappingURL=route-finalizer.js.map

package/dist/core/proof/route-proof-gate.js

@@ -3,6 +3,7 @@ import { readRouteProof } from './proof-reader.js';
 import { validateCompletionProof } from './validation.js';
 import { normalizeProofRoute, proofStatusBlocks, routeRequiresCompletionProof, routeRequiresImageVoxelAnchors } from './route-proof-policy.js';
 import { routeRequiresAgentIntake } from '../agents/agent-plan.js';
+import { rootCauseAnalysisIssue } from './root-cause-policy.js';
 export async function validateRouteCompletionProof(root, { missionId = null, route = null, state = {}, visualClaim = undefined } = {}) {
     const proofRequired = state.proof_required === true || routeRequiresCompletionProof(route);
     if (!proofRequired)
@@ -61,6 +62,9 @@ export async function validateRouteCompletionProof(root, { missionId = null, rou
         issues.push('active_wrongness_high');
     if (proof.status === 'verified' && Number(wrongness?.active_count || 0) > 0)
         issues.push('active_wrongness_requires_partial');
+    const rootCauseIssue = rootCauseAnalysisIssue(proof, issues);
+    if (rootCauseIssue)
+        issues.push(rootCauseIssue);
     return {
         ok: issues.length === 0,
         required: true,

package/dist/core/release/release-gate-batch-runner.js

@@ -1,7 +1,10 @@
 import { spawn } from 'node:child_process';
 import path from 'node:path';
+import { createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { writeReleaseGateJson } from './release-gate-report.js';
-const DISALLOWED_BATCH_RESOURCES = new Set(['zellij-real', 'git-worktree', 'local-llm-real', 'remote-model-real', 'publish', 'global-config']);
+import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+const DISALLOWED_BATCH_RESOURCES = new Set(['zellij-real', 'git-worktree', 'local-llm-real', 'remote-model-real', 'publish', 'global-config', 'timing-sensitive']);
 export function isReleaseGateBatchable(gate) {
     if (gate.side_effect !== 'hermetic')
         return false;
@@ -11,6 +14,8 @@ export function isReleaseGateBatchable(gate) {
 }
 export async function runReleaseGateBatch(root, gates, input = {}) {
     const concurrency = Math.max(1, Math.floor(Number(input.concurrency || process.env.SKS_RELEASE_BATCH_CONCURRENCY || 4)));
+    const runId = `rgb-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+    const reportRoot = input.reportRoot || path.join(root, '.sneakoscope', 'reports', 'release-gate-batches', runId);
     const nonBatchable = gates.filter((gate) => !isReleaseGateBatchable(gate));
     if (nonBatchable.length) {
         return {
@@ -19,7 +24,7 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
             batch_size: gates.length,
             completed: 0,
             failed: nonBatchable.length,
-            results: nonBatchable.map((gate) => ({ id: gate.id, ok: false, exit_code: null, duration_ms: 0 }))
+            results: nonBatchable.map((gate) => ({ id: gate.id, ok: false, exit_code: null, signal: null, timed_out: false, duration_ms: 0 }))
         };
     }
     const queue = [...gates];
@@ -29,7 +34,7 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
             const gate = queue.shift();
             if (!gate)
                 continue;
-            const result = await runOne(root, gate);
+            const result = await runOne(root, runId, reportRoot, gate);
             results.push(result);
             if (input.reportRoot)
                 writeChildResult(input.reportRoot, result);
@@ -46,19 +51,60 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
         results
     };
 }
-function runOne(root, gate) {
+function runOne(root, runId, reportRoot, gate) {
     const started = Date.now();
+    const hermetic = createReleaseGateHermeticEnv({ root, runId, gate, reportRoot });
     return new Promise((resolve) => {
-        const child = spawn(gate.command, { cwd: root, shell: true, stdio: ['ignore', 'ignore', 'ignore'] });
-        const timer = setTimeout(() => child.kill('SIGTERM'), gate.timeout_ms);
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({ id: gate.id, ok: code === 0, exit_code: code, duration_ms: Date.now() - started });
+        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'ignore', 'ignore'], detached: process.platform !== 'win32' });
+        let timedOut = false;
+        let timeoutCleanup = null;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            timeoutCleanup = cleanupTimedOutGateProcessTree(root, child);
+        }, gate.timeout_ms);
+        timer.unref?.();
+        child.on('close', (code, signal) => {
+            void (async () => {
+                clearTimeout(timer);
+                if (timeoutCleanup)
+                    await timeoutCleanup;
+                const exitCode = timedOut ? 124 : code;
+                resolve({ id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: Date.now() - started, report_dir: hermetic.report_dir });
+            })();
         });
     });
 }
+async function cleanupTimedOutGateProcessTree(root, child) {
+    await killGateProcessTree(root, child, 'SIGTERM');
+    await sleep(1500);
+    await killGateProcessTree(root, child, 'SIGKILL');
+    await sleep(100);
+}
+async function killGateProcessTree(root, child, signal) {
+    if (!child.pid)
+        return;
+    const pid = process.platform !== 'win32' ? -child.pid : child.pid;
+    const contract = createRequestedScopeContract({
+        route: 'release:gate-batch-runner',
+        userRequest: 'Terminate only the batched release gate child process tree after its configured timeout.',
+        projectRoot: root,
+        overrides: { codex_app_process: true }
+    });
+    try {
+        await guardedProcessKill(guardContextForRoute(root, contract, 'release gate batch timeout cleanup'), pid, { signal, confirmed: true });
+    }
+    catch {
+        try {
+            child.kill(signal);
+        }
+        catch { }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function writeChildResult(reportRoot, result) {
-    const dir = path.join(reportRoot, result.id.replace(/[^A-Za-z0-9_.:-]/g, '_'));
+    const dir = result.report_dir || path.join(reportRoot, result.id.replace(/[^A-Za-z0-9_.:-]/g, '_'));
     writeReleaseGateJson(path.join(dir, 'result.json'), {
         schema: 'sks.release-gate-batch-child-result.v1',
         ...result

package/dist/core/release/release-gate-cache-v2.js

@@ -114,15 +114,29 @@ export function hashDirectoryRecursive(dir) {
     return out.sort();
 }
 export function readReleaseGateCacheHit(root, gate) {
+    return Boolean(readReleaseGateCacheRecord(root, gate));
+}
+export function readReleaseGateCacheRecord(root, gate) {
     try {
         const parsed = JSON.parse(fs.readFileSync(releaseGateCacheFile(root), 'utf8'));
-        return parsed.schema === RELEASE_GATE_CACHE_V2_SCHEMA && parsed.records?.[releaseGateCacheKey(root, gate)]?.ok === true;
+        const record = parsed.schema === RELEASE_GATE_CACHE_V2_SCHEMA ? parsed.records?.[releaseGateCacheKey(root, gate)] : null;
+        if (record?.ok !== true)
+            return null;
+        return {
+            ok: true,
+            gate_id: String(record.gate_id || gate.id),
+            command: String(record.command || gate.command),
+            resource: Array.isArray(record.resource) ? record.resource.map(String) : gate.resource,
+            preset: Array.isArray(record.preset) ? record.preset.map(String) : gate.preset,
+            duration_ms: Math.max(0, Math.floor(Number(record.duration_ms) || 0)),
+            recorded_at: String(record.recorded_at || '')
+        };
     }
     catch {
-        return false;
+        return null;
     }
 }
-export function writeReleaseGateCacheHit(root, gate) {
+export function writeReleaseGateCacheHit(root, gate, durationMs = 0) {
     const file = releaseGateCacheFile(root);
     let parsed = { schema: RELEASE_GATE_CACHE_V2_SCHEMA, records: {} };
     try {
@@ -137,6 +151,7 @@ export function writeReleaseGateCacheHit(root, gate) {
         command: gate.command,
         resource: gate.resource,
         preset: gate.preset,
+        duration_ms: Math.max(0, Math.floor(Number(durationMs) || 0)),
         recorded_at: new Date().toISOString()
     };
     fs.mkdirSync(path.dirname(file), { recursive: true });

package/dist/core/release/release-gate-dag.js

@@ -4,10 +4,13 @@ import { spawn } from 'node:child_process';
 import { createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { appendReleaseGateJsonl, writeReleaseGateJson } from './release-gate-report.js';
 import { findReadyReleaseGateNodes, findReleaseGatesBlockedByFailedDeps, pickReadyLaunchableReleaseGates } from './release-gate-scheduler.js';
-import { readReleaseGateCacheHit, writeReleaseGateCacheHit } from './release-gate-cache-v2.js';
+import { readReleaseGateCacheRecord, writeReleaseGateCacheHit } from './release-gate-cache-v2.js';
 import { RELEASE_GATE_NODE_SCHEMA, validateReleaseGateManifest } from './release-gate-node.js';
 import { countReleaseGateResources, defaultReleaseGateBudget, summarizeReleaseGateBudget } from './release-gate-resource-governor.js';
 import { selectAffectedReleaseGates } from './release-gate-affected-selector.js';
+import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+import { rmrf } from '../fsx.js';
 export function loadReleaseGateManifest(root, file = 'release-gates.v2.json') {
     const manifestPath = path.join(root, file);
     const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
@@ -31,9 +34,11 @@ export async function runReleaseGateDag(input) {
         ? new Set(selected.flatMap((gate) => gate.deps || []).filter((dep) => !selectedIds.has(dep)))
         : new Set();
     const runId = `rg-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+    const retentionBefore = await pruneOldReleaseGateRunDirs(root);
     const reportDir = path.join(root, '.sneakoscope', 'reports', 'release-gates', runId);
     fs.mkdirSync(reportDir, { recursive: true });
     const timeline = path.join(reportDir, 'timeline.jsonl');
+    appendReleaseGateJsonl(timeline, { event: 'retention', phase: 'before_run', ...retentionBefore, at: new Date().toISOString() });
     const started = Date.now();
     const pending = new Map(selected.map((gate) => [gate.id, gate]));
     const running = new Map();
@@ -48,7 +53,7 @@ export async function runReleaseGateDag(input) {
     let peakRunning = 0;
     const writeSummarySnapshot = (finished = false) => {
         const wallMs = Date.now() - started;
-        const failures = [...failed.values()].map((row) => ({ id: row.id, exit_code: row.exit_code, stderr_tail: row.stderr_tail }));
+        const failures = [...failed.values()].map((row) => ({ id: row.id, exit_code: row.exit_code, stderr_tail: row.stderr_tail, timed_out: row.timed_out, signal: row.signal }));
         const snapshot = {
             schema: 'sks.release-gate-dag-run.v1',
             ok: failures.length === 0,
@@ -97,14 +102,15 @@ export async function runReleaseGateDag(input) {
         let progressed = false;
         for (const gate of launchable) {
             pending.delete(gate.id);
-            const cacheHit = !input.noCache && gate.cache.enabled && readReleaseGateCacheHit(root, gate);
+            const cacheHit = !input.noCache && gate.cache.enabled ? readReleaseGateCacheRecord(root, gate) : null;
             if (cacheHit) {
-                const result = { id: gate.id, ok: true, exit_code: 0, duration_ms: 0, cached: true, stderr_tail: '' };
+                const result = { id: gate.id, ok: true, exit_code: 0, signal: null, timed_out: false, duration_ms: cacheHit.duration_ms, cached: true, stderr_tail: '' };
                 completed.set(gate.id, result);
                 cached += 1;
                 cachedGates.push(gate.id);
+                sumGateMs += result.duration_ms;
                 progressed = true;
-                appendReleaseGateJsonl(timeline, { event: 'cache_hit', gate_id: gate.id, at: new Date().toISOString() });
+                appendReleaseGateJsonl(timeline, { event: 'cache_hit', gate_id: gate.id, duration_ms: result.duration_ms, at: new Date().toISOString() });
                 writeSummarySnapshot(false);
                 continue;
             }
@@ -127,6 +133,8 @@ export async function runReleaseGateDag(input) {
                         id: gate.id,
                         ok: false,
                         exit_code: null,
+                        signal: null,
+                        timed_out: false,
                         duration_ms: 0,
                         cached: false,
                         stderr_tail: `blocked by failed dependency: ${gate.deps.filter((dep) => failed.has(dep)).join(', ')}`
@@ -148,7 +156,7 @@ export async function runReleaseGateDag(input) {
             completed.set(result.id, result);
             const gate = selected.find((row) => row.id === result.id);
             if (gate?.cache.enabled && !input.noCache)
-                writeReleaseGateCacheHit(root, gate);
+                writeReleaseGateCacheHit(root, gate, result.duration_ms);
         }
         else {
             failed.set(result.id, result);
@@ -161,7 +169,11 @@ export async function runReleaseGateDag(input) {
         writeSummarySnapshot(false);
     }
     const result = writeSummarySnapshot(true);
-    return result;
+    const retentionAfter = await pruneOldReleaseGateRunDirs(root, { preserveRunId: runId });
+    const finalResult = { ...result, retention: mergeReleaseGateRetention(retentionBefore, retentionAfter) };
+    appendReleaseGateJsonl(timeline, { event: 'retention', phase: 'after_run', ...retentionAfter, at: new Date().toISOString() });
+    writeReleaseGateJson(path.join(reportDir, 'summary.json'), finalResult);
+    return finalResult;
 }
 export function selectReleaseGatePreset(manifest, preset) {
     const effectivePreset = preset === 'affected' || preset === 'fast' ? 'release' : preset;
@@ -175,22 +187,65 @@ function runGate(root, runId, reportRoot, gate) {
     const out = fs.createWriteStream(stdoutFile);
     const err = fs.createWriteStream(stderrFile);
     return new Promise((resolve) => {
-        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'] });
-        const timer = setTimeout(() => child.kill('SIGTERM'), gate.timeout_ms);
+        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' });
+        let timedOut = false;
+        let timeoutCleanup = null;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            timeoutCleanup = cleanupTimedOutGateProcessTree(root, child);
+        }, gate.timeout_ms);
+        timer.unref?.();
         child.stdout.pipe(out);
         child.stderr.pipe(err);
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            out.end();
-            err.end();
-            const durationMs = Date.now() - started;
-            const stderrTail = tail(fs.existsSync(stderrFile) ? fs.readFileSync(stderrFile, 'utf8') : '');
-            const result = { id: gate.id, ok: code === 0, exit_code: code, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
-            writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), { schema: 'sks.release-gate-result.v1', ...result, stdout_log: stdoutFile, stderr_log: stderrFile });
-            resolve(result);
+        child.on('close', (code, signal) => {
+            void (async () => {
+                clearTimeout(timer);
+                if (timeoutCleanup)
+                    await timeoutCleanup;
+                out.end();
+                err.end();
+                const durationMs = Date.now() - started;
+                const stderrText = fs.existsSync(stderrFile) ? fs.readFileSync(stderrFile, 'utf8') : '';
+                const timeoutTail = timedOut ? `release_gate_timeout:${gate.id}:${gate.timeout_ms}ms` : '';
+                const signalTail = !timedOut && signal ? `release_gate_signal:${gate.id}:${signal}` : '';
+                const stderrTail = tail([stderrText, timeoutTail, signalTail].filter(Boolean).join('\n'));
+                const exitCode = timedOut ? 124 : code;
+                const result = { id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
+                writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), { schema: 'sks.release-gate-result.v1', ...result, stdout_log: stdoutFile, stderr_log: stderrFile });
+                resolve(result);
+            })();
         });
     });
 }
+async function cleanupTimedOutGateProcessTree(root, child) {
+    await killGateProcessTree(root, child, 'SIGTERM');
+    await sleep(1500);
+    await killGateProcessTree(root, child, 'SIGKILL');
+    await sleep(100);
+}
+async function killGateProcessTree(root, child, signal) {
+    if (!child.pid)
+        return;
+    const pid = process.platform !== 'win32' ? -child.pid : child.pid;
+    const contract = createRequestedScopeContract({
+        route: 'release:gate-runner',
+        userRequest: 'Terminate only the release gate child process tree after its configured timeout.',
+        projectRoot: root,
+        overrides: { codex_app_process: true }
+    });
+    try {
+        await guardedProcessKill(guardContextForRoute(root, contract, 'release gate timeout cleanup'), pid, { signal, confirmed: true });
+    }
+    catch {
+        try {
+            child.kill(signal);
+        }
+        catch { }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function estimateCriticalPath(gates, completed) {
     const byId = new Map(gates.map((gate) => [gate.id, gate]));
     const memo = new Map();
@@ -210,4 +265,52 @@ function estimateCriticalPath(gates, completed) {
 function tail(value, limit = 1200) {
     return value.length > limit ? value.slice(-limit) : value;
 }
+export async function pruneOldReleaseGateRunDirs(root, opts = {}) {
+    const keep = Math.max(1, Math.floor(Number(opts.keep ?? process.env.SKS_RELEASE_GATE_RUN_RETENTION ?? 20) || 20));
+    const preserveRunId = opts.preserveRunId || null;
+    const base = path.join(root, '.sneakoscope', 'reports', 'release-gates');
+    const report = {
+        schema: 'sks.release-gate-run-retention.v1',
+        keep,
+        scanned: 0,
+        kept: 0,
+        removed: 0,
+        preserve_run_id: preserveRunId,
+        removed_run_ids: []
+    };
+    if (!fs.existsSync(base))
+        return report;
+    const runs = fs.readdirSync(base, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && /^rg-\d{4}-/.test(entry.name))
+        .map((entry) => {
+        const dir = path.join(base, entry.name);
+        const summary = path.join(dir, 'summary.json');
+        const stat = fs.statSync(fs.existsSync(summary) ? summary : dir);
+        return { id: entry.name, dir, mtimeMs: stat.mtimeMs };
+    })
+        .sort((a, b) => b.mtimeMs - a.mtimeMs);
+    report.scanned = runs.length;
+    const keepIds = new Set(runs.slice(0, keep).map((run) => run.id));
+    if (preserveRunId)
+        keepIds.add(preserveRunId);
+    for (const run of runs) {
+        if (keepIds.has(run.id)) {
+            report.kept += 1;
+            continue;
+        }
+        await rmrf(run.dir);
+        report.removed += 1;
+        report.removed_run_ids.push(run.id);
+    }
+    return report;
+}
+function mergeReleaseGateRetention(before, after) {
+    return {
+        ...after,
+        scanned: Math.max(before.scanned, after.scanned),
+        kept: after.kept,
+        removed: before.removed + after.removed,
+        removed_run_ids: [...before.removed_run_ids, ...after.removed_run_ids]
+    };
+}
 //# sourceMappingURL=release-gate-dag.js.map

package/dist/core/release/release-gate-node.js

@@ -13,7 +13,8 @@ export const RELEASE_GATE_RESOURCE_CLASSES = [
     'network',
     'global-config',
     'publish',
-    'fs-read'
+    'fs-read',
+    'timing-sensitive'
 ];
 export function validateReleaseGateManifest(input) {
     const errors = [];

package/dist/core/release/release-gate-resource-governor.js

@@ -1,8 +1,9 @@
 import os from 'node:os';
+const EXCLUSIVE_RESOURCES = new Set(['timing-sensitive']);
 export function defaultReleaseGateBudget() {
     const cores = Math.max(1, os.cpus().length || 1);
     const base = {
-        'cpu-light': Math.min(48, cores * 6),
+        'cpu-light': Math.min(24, cores * 3),
         'cpu-heavy': Math.max(1, cores),
         'io-light': Math.min(96, cores * 10),
         'io-heavy': Math.min(12, Math.max(1, cores)),
@@ -15,11 +16,12 @@ export function defaultReleaseGateBudget() {
         'remote-model-real': 6,
         'global-config': 1,
         publish: 1,
-        'fs-read': Math.min(96, cores * 10)
+        'fs-read': Math.min(96, cores * 10),
+        'timing-sensitive': 1
     };
     for (const key of Object.keys(base)) {
         const envName = `SKS_RELEASE_MAX_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`;
-        base[key] = envInt(envName, base[key]);
+        base[key] = envInt(envName, base[key], { max: base[key] });
     }
     return base;
 }
@@ -34,23 +36,39 @@ export function countReleaseGateResources(running) {
 }
 export function pickLaunchableReleaseGates(input) {
     const budget = input.budget || defaultReleaseGateBudget();
+    if (input.running.some(isExclusiveGate))
+        return [];
     const used = usedResources(input.running);
     const launchable = [];
-    const maxTotal = envInt('SKS_RELEASE_MAX_TOTAL', Number.POSITIVE_INFINITY);
+    const maxTotal = envInt('SKS_RELEASE_MAX_TOTAL', defaultReleaseGateMaxTotal(), { max: defaultReleaseGateMaxTotal() });
     for (const gate of input.ready) {
         if (input.running.length + launchable.length >= maxTotal)
             break;
+        const exclusive = isExclusiveGate(gate);
+        if (exclusive && (input.running.length > 0 || launchable.length > 0))
+            continue;
+        if (!exclusive && launchable.some(isExclusiveGate))
+            continue;
         if (fits(gate, used, budget)) {
             launchable.push(gate);
             for (const resource of gate.resource)
                 used[resource] = (used[resource] || 0) + 1;
+            if (exclusive)
+                break;
         }
     }
     return launchable;
 }
-function envInt(name, fallback) {
+export function defaultReleaseGateMaxTotal() {
+    const cores = Math.max(1, os.cpus().length || 1);
+    return Math.max(8, Math.min(32, cores * 3));
+}
+function envInt(name, fallback, opts = {}) {
     const parsed = Number(process.env[name]);
-    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    const value = Math.floor(parsed);
+    return typeof opts.max === 'number' ? Math.min(value, opts.max) : value;
 }
 function usedResources(running) {
     const used = {};
@@ -63,4 +81,7 @@ function usedResources(running) {
 function fits(gate, used, budget) {
     return gate.resource.every((resource) => (used[resource] || 0) < budget[resource]);
 }
+function isExclusiveGate(gate) {
+    return gate.resource.some((resource) => EXCLUSIVE_RESOURCES.has(resource));
+}
 //# sourceMappingURL=release-gate-resource-governor.js.map

package/dist/core/skills/core-skill-meta-update.js

@@ -0,0 +1,24 @@
+// SKS Core Skill Engine — SkillOpt-style epoch-wise meta-update.
+//
+// SkillOpt adjusts its textual learning rate between epochs: rejected edits decay
+// the budget (smaller, safer proposals), accepted edits regrow it toward the
+// default ceiling. Deterministic, bounded, never exceeds the configured maximum.
+import { DEFAULT_TEXTUAL_LEARNING_RATE } from './core-skill-epoch.js';
+export const MIN_TEXTUAL_LEARNING_RATE = { max_added_chars: 100, max_deleted_chars: 50, max_replaced_chars: 75 };
+export const META_UPDATE_DECAY = 0.5;
+export const META_UPDATE_GROWTH = 1.25;
+/** Epoch-wise textual learning-rate adjustment: decay on rejection, bounded regrowth on acceptance. */
+export function metaUpdateLearningRate(rate, outcome, opts = {}) {
+    const decay = opts.decay ?? META_UPDATE_DECAY;
+    const growth = opts.growth ?? META_UPDATE_GROWTH;
+    const min = opts.min ?? MIN_TEXTUAL_LEARNING_RATE;
+    const max = opts.max ?? DEFAULT_TEXTUAL_LEARNING_RATE;
+    const factor = outcome === 'rejected' ? decay : growth;
+    const adjust = (value, lo, hi) => Math.min(hi, Math.max(lo, Math.round(value * factor)));
+    return {
+        max_added_chars: adjust(rate.max_added_chars, min.max_added_chars, max.max_added_chars),
+        max_deleted_chars: adjust(rate.max_deleted_chars, min.max_deleted_chars, max.max_deleted_chars),
+        max_replaced_chars: adjust(rate.max_replaced_chars, min.max_replaced_chars, max.max_replaced_chars)
+    };
+}
+//# sourceMappingURL=core-skill-meta-update.js.map