sneakoscope 3.1.12 → 3.1.14

package/README.md

@@ -35,18 +35,16 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.12** is a release-ready repair pass for `sks doctor --fix` production recovery, Codex 0.140 capability coverage, and MAD Zellij right-column stack reliability.
-
-What changed in 3.1.12:
-
-- **MAD Zellij panes are stack-reconciled.** Second and later visible workers still launch with native `new-pane --stacked`, then SKS calls Zellij `stack-panes` with the observed worker pane ids so the right column stays one stack instead of drifting into automatic split geometry.
-- **Codex 0.140 readiness is gated.** The release records hermetic coverage for usage metadata, goal attachment preservation, session delete/import, unified mentions, Bedrock managed auth, MCP reliability, SQLite recovery, non-TTY interrupt behavior, large-repo performance, and optional real-probe enforcement.
-- **Doctor production repair is transactional.** `sks doctor --fix` now writes a doctor fix transaction and postcheck report so startup config, Context7 MCP, Supabase MCP, command alias, and native capability repair results are visible in JSON output instead of disappearing into console-only repair steps.
-- **Context7 stdio lockups are doctor-repairable.** `sks doctor --fix` detects local `@upstash/context7-mcp` stdio config and migrates it to the remote Context7 MCP endpoint so Codex launches do not stall at the stdio server banner.
-- **Codex startup warnings are repaired more completely.** `sks doctor --fix` rewrites stale SKS agent `config_file` paths, removes unsupported managed `message_role_prefix` role fields, preserves optional `supabase_sauron`, and now repairs `node_repl` to a valid Codex App command when available or removes both the stale parent table and child env table when it is not.
-- **Doctor JSON exposes the Context7, startup, Supabase, and production postcheck reports.** `context7_repair`, `codex_startup_repair`, `startup_config_repair`, `context7_mcp_repair`, `supabase_mcp_repair`, `doctor_fix_transaction`, `doctor_fix_postcheck`, and their `repair.*` entries carry migration status, backups, actions, warnings, and any manual auth actions.
-- **Secret rollback is stricter.** The secret-preservation guard treats protected-value changes the same way as missing values, rolls back affected files from redacted backups, and records rollback status without writing raw secret values.
-- **Release metadata is aligned for 3.1.12.** Package, lockfile, CLI version constants, Rust helper metadata, README, and changelog all point at the same release.
+SKS **3.1.14** is a production-hardening release for Codex 0.140 evidence, transactional `sks doctor --fix` repair, MCP readiness, native capability proof, and protected-secret rollback.
+
+What changed in 3.1.14:
+
+- **Codex 0.140 readiness carries evidence.** Capability reports now expose per-feature state and certainty, real usage parsing, goal attachment roundtrip proof, and usage-budget provenance for loop/Naruto runtime decisions.
+- **Doctor repair is phase-based.** `sks doctor --fix` records phase durations, postchecks, optional manual readiness, and rollback evidence instead of collapsing repair work into a summary writer.
+- **Startup and MCP repair are safer.** Managed agent TOML blocks are repaired without touching unrelated config, missing role files are regenerated from real managed templates, Context7 disabled servers stay disabled, and Supabase write scope is separated from read-only readiness.
+- **Secret rollback is line-level when possible.** Protected key changes are restored without discarding unrelated operator edits, nested guard operations are recorded, and backup artifacts remain ignored.
+- **Native capability proof is stricter.** Computer Use and Chrome/web review no longer become verified from environment variables outside explicit fixture/test modes.
+- **Release metadata is aligned for 3.1.14.** Package, lockfile, CLI version constants, Rust helper metadata, README, changelog, docs, built output, and release stamp all point at the same release.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.12"
+version = "3.1.14"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.12"
+version = "3.1.14"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.12"),
+        Some("--version") => println!("sks-rs 3.1.14"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.12';
+const FAST_PACKAGE_VERSION = '3.1.14';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/doctor.js

@@ -34,7 +34,7 @@ import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-clean
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
 import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
 import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
-import { writeDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
 import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 export async function run(_command, args = []) {
@@ -271,8 +271,12 @@ async function runDoctor(args = [], root, doctorFix) {
             apply: true,
             configured: false,
             disabled: false,
+            disabled_preserved: false,
             token_env_present: false,
             unsafe_write_access: false,
+            read_only_migrated: false,
+            write_scope_requires_confirmation: false,
+            ready_blocking: true,
             manual_required: true,
             next_action: 'Review Supabase MCP configuration manually.',
             blockers: [err?.message || String(err)],
@@ -281,62 +285,88 @@ async function runDoctor(args = [], root, doctorFix) {
         }))
         : null;
     const doctorFixTransaction = doctorFix
-        ? await writeDoctorFixTransaction({
+        ? await runDoctorFixTransaction({
             root,
             phases: [
                 {
                     id: 'setup',
-                    ok: setupRepair !== null,
-                    repaired: setupRepair !== null,
-                    blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                    run: async () => ({
+                        id: 'setup',
+                        ok: setupRepair !== null,
+                        repaired: setupRepair !== null,
+                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                    })
                 },
                 {
                     id: 'codex_startup_repair',
-                    ok: codexStartupRepair?.ok !== false,
-                    repaired: doctorFix,
-                    blockers: codexStartupRepair?.blockers || [],
-                    warnings: codexStartupRepair?.warnings || []
+                    run: async () => ({
+                        id: 'codex_startup_repair',
+                        ok: codexStartupRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: codexStartupRepair?.blockers || [],
+                        warnings: codexStartupRepair?.warnings || []
+                    })
                 },
                 {
                     id: 'startup_config_repair',
-                    ok: startupConfigRepair?.ok === true,
-                    repaired: startupConfigRepair?.apply === true,
-                    blockers: startupConfigRepair?.blockers || []
+                    run: async () => ({
+                        id: 'startup_config_repair',
+                        ok: startupConfigRepair?.ok === true,
+                        repaired: startupConfigRepair?.apply === true,
+                        blockers: startupConfigRepair?.blockers || []
+                    })
                 },
                 {
                     id: 'context7_repair',
-                    ok: context7Repair?.ok !== false,
-                    repaired: doctorFix,
-                    blockers: context7Repair?.blockers || [],
-                    warnings: context7Repair?.warnings || []
+                    run: async () => ({
+                        id: 'context7_repair',
+                        ok: context7Repair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: context7Repair?.blockers || [],
+                        warnings: context7Repair?.warnings || []
+                    })
                 },
                 {
                     id: 'context7_mcp_repair',
-                    ok: context7McpRepair?.ok === true,
-                    repaired: context7McpRepair?.repaired === true,
-                    manual_required: context7McpRepair?.manual_required === true,
-                    blockers: context7McpRepair?.blockers || [],
-                    warnings: context7McpRepair?.warnings || []
+                    run: async () => ({
+                        id: 'context7_mcp_repair',
+                        ok: context7McpRepair?.ok === true,
+                        repaired: context7McpRepair?.repaired === true,
+                        manual_required: context7McpRepair?.manual_required === true,
+                        blockers: context7McpRepair?.blockers || [],
+                        warnings: context7McpRepair?.warnings || []
+                    })
                 },
                 {
                     id: 'supabase_mcp_repair',
-                    ok: supabaseMcpRepair?.ok === true,
-                    repaired: false,
-                    manual_required: supabaseMcpRepair?.manual_required === true,
-                    blockers: supabaseMcpRepair?.blockers || [],
-                    warnings: supabaseMcpRepair?.warnings || []
+                    required_for_ready: false,
+                    run: async () => ({
+                        id: 'supabase_mcp_repair',
+                        ok: supabaseMcpRepair?.ok === true,
+                        repaired: false,
+                        manual_required: supabaseMcpRepair?.manual_required === true,
+                        required_for_ready: false,
+                        blockers: supabaseMcpRepair?.blockers || [],
+                        warnings: supabaseMcpRepair?.warnings || []
+                    })
                 },
                 {
                     id: 'command_alias_cleanup',
-                    ok: commandAliasCleanup?.ok !== false,
-                    repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
-                    blockers: commandAliasCleanup?.blockers || []
+                    run: async () => ({
+                        id: 'command_alias_cleanup',
+                        ok: commandAliasCleanup?.ok !== false,
+                        repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
+                        blockers: commandAliasCleanup?.blockers || []
+                    })
                 },
                 {
                     id: 'native_capability_repair',
-                    ok: doctorNativeCapabilityRepair?.ok !== false,
-                    repaired: doctorFix,
-                    blockers: doctorNativeCapabilityRepair?.blockers || []
+                    run: async () => ({
+                        id: 'native_capability_repair',
+                        ok: doctorNativeCapabilityRepair?.ok !== false,
+                        repaired: doctorFix,
+                        blockers: doctorNativeCapabilityRepair?.blockers || []
+                    })
                 }
             ]
         }).catch((err) => ({

package/dist/core/agents/agent-cleanup-executor.js

@@ -1,8 +1,9 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
-import { appendJsonl, exists, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { appendJsonl, exists, nowIso, packageRoot, readJson, writeJsonAtomic } from '../fsx.js';
 import { drainZellijLaneSupervisor } from './zellij-lane-supervisor.js';
 import { normalizeAgentSessionRows } from './agent-session-rows.js';
+import { closeZellijPaneById } from '../zellij/zellij-worker-pane-manager.js';
 export const AGENT_CLEANUP_PROOF_SCHEMA = 'sks.agent-cleanup-proof.v2';
 export const AGENT_CLEANUP_ACTION_LEDGER_SCHEMA = 'sks.agent-cleanup-action-ledger.v1';
 const TERMINAL_STATUSES = new Set(['closed', 'completed', 'done', 'failed', 'blocked', 'killed', 'timed_out']);
@@ -50,6 +51,7 @@ export async function runAgentCleanupExecutor(opts) {
             killEscalation
         }));
     }
+    const seenZellijPaneIds = new Set();
     const zellijReports = await listNamedFiles(path.join(agentRoot, 'sessions'), 'agent-zellij-report.json');
     for (const file of zellijReports) {
         const report = await readJson(file, null);
@@ -57,6 +59,7 @@ export async function runAgentCleanupExecutor(opts) {
         const sessionId = String(report?.session_id || '');
         if (!paneId)
             continue;
+        seenZellijPaneIds.add(paneId);
         if (!processReportInNamespace(report, projectHash)) {
             actions.push({ kind: 'skip_foreign_namespace', target: paneId, status: 'skipped', reason: 'zellij_pane_outside_project_namespace' });
             continue;
@@ -77,6 +80,77 @@ export async function runAgentCleanupExecutor(opts) {
             }
         }));
     }
+    const workerPaneReports = await listNamedFiles(path.join(agentRoot, 'sessions'), 'zellij-worker-pane.json');
+    for (const file of workerPaneReports) {
+        const report = await readJson(file, null);
+        const paneId = String(report?.pane_id || '');
+        const sessionName = String(report?.session_name || '');
+        const sessionId = String(report?.session_id || '');
+        const status = String(report?.status || '');
+        if (!paneId || !sessionName || seenZellijPaneIds.has(paneId))
+            continue;
+        seenZellijPaneIds.add(paneId);
+        if (opts.missionId && report?.mission_id && String(report.mission_id) !== String(opts.missionId)) {
+            actions.push({ kind: 'skip_foreign_namespace', target: paneId, status: 'skipped', reason: 'zellij_pane_wrong_mission' });
+            continue;
+        }
+        const terminal = TERMINAL_STATUSES.has(status) || Boolean(report?.closed_at);
+        if (activeSessionIds.has(sessionId) && !terminal && opts.drain !== true) {
+            actions.push({ kind: 'skip_active_session', target: sessionId || paneId, status: 'skipped', reason: 'managed_zellij_worker_active' });
+            continue;
+        }
+        actions.push(await applyAction({
+            kind: 'close_zellij_pane',
+            target: paneId,
+            reason: terminal ? 'managed_worker_zellij_pane_terminal' : 'managed_worker_zellij_pane_stale',
+            apply,
+            before: async () => ({ listed: true, pane_id: paneId, session_name: sessionName, source: path.relative(agentRoot, file), status }),
+            after: async () => ({ listed: false, pane_id: paneId, session_name: sessionName }),
+            run: async () => {
+                const close = await closeZellijPaneById(sessionName, paneId, packageRoot());
+                if (close && close.ok !== true)
+                    throw new Error(close.blockers.join(',') || close.stderr_tail || 'zellij_pane_close_failed');
+            }
+        }));
+    }
+    const rightColumnReports = await listNamedFiles(opts.missionDir, 'zellij-right-column-state.json');
+    for (const file of rightColumnReports) {
+        const report = await readJson(file, null);
+        const sessionName = String(report?.session_name || '');
+        if (!sessionName)
+            continue;
+        const visibleActive = (Array.isArray(report?.visible_worker_panes) ? report.visible_worker_panes : [])
+            .some((pane) => pane?.status === 'launching' || pane?.status === 'running');
+        const headlessActive = (Array.isArray(report?.headless_workers) ? report.headless_workers : [])
+            .some((row) => !row?.status || row.status === 'running');
+        const anchorPaneIds = [...new Set([
+                report?.slot_column_anchor_pane_id,
+                report?.right_anchor_pane_id,
+                report?.dashboard_pane_id
+            ].map(String).filter((paneId) => paneId && paneId !== 'null' && paneId !== 'undefined'))];
+        for (const paneId of anchorPaneIds) {
+            if (seenZellijPaneIds.has(paneId))
+                continue;
+            seenZellijPaneIds.add(paneId);
+            if ((visibleActive || headlessActive) && opts.drain !== true) {
+                actions.push({ kind: 'skip_active_session', target: paneId, status: 'skipped', reason: 'zellij_right_column_anchor_active' });
+                continue;
+            }
+            actions.push(await applyAction({
+                kind: 'close_zellij_pane',
+                target: paneId,
+                reason: 'zellij_right_column_anchor_terminal',
+                apply,
+                before: async () => ({ listed: true, pane_id: paneId, session_name: sessionName, source: path.relative(opts.missionDir, file), visible_active: visibleActive, headless_active: headlessActive }),
+                after: async () => ({ listed: false, pane_id: paneId, session_name: sessionName }),
+                run: async () => {
+                    const close = await closeZellijPaneById(sessionName, paneId, packageRoot());
+                    if (close && close.ok !== true)
+                        throw new Error(close.blockers.join(',') || close.stderr_tail || 'zellij_anchor_close_failed');
+                }
+            }));
+        }
+    }
     for (const dir of Array.isArray(namespace?.orphan_temp_dirs) ? namespace.orphan_temp_dirs.map(String) : []) {
         if (!namespaceOwnsPath(dir, projectHash)) {
             actions.push({ kind: 'skip_foreign_namespace', target: dir, status: 'skipped', reason: 'path_outside_project_namespace' });

package/dist/core/agents/agent-command-surface.js

@@ -12,10 +12,19 @@ export function parseAgentCommandArgs(command, args = []) {
     const minimumWorkItems = Number(readOption(args, '--minimum-work-items', targetActiveSlots));
     const maxQueueExpansion = Number(readOption(args, '--max-queue-expansion', 10));
     const concurrency = Number(readOption(args, '--concurrency', Math.min(agents, 5)));
-    const useOllama = hasFlag(args, '--ollama') || hasFlag(args, '--local-model');
+    const useOllamaProtocol = hasFlag(args, '--ollama');
+    const useLocalModel = hasFlag(args, '--local-model');
+    const useOllama = useOllamaProtocol || useLocalModel;
     const noOllama = hasFlag(args, '--no-ollama') || hasFlag(args, '--no-local-model');
-    const backendExplicit = hasOption(args, '--backend');
-    const backend = String(readOption(args, '--backend', hasFlag(args, '--mock') ? 'fake' : useOllama && !noOllama ? 'ollama' : 'codex-sdk'));
+    const backendExplicit = hasOption(args, '--backend') || useOllamaProtocol || useLocalModel || noOllama;
+    const defaultBackend = hasFlag(args, '--mock')
+        ? 'fake'
+        : useLocalModel && !noOllama
+            ? 'local-llm'
+            : useOllamaProtocol && !noOllama
+                ? 'ollama'
+                : 'codex-sdk';
+    const backend = String(readOption(args, '--backend', defaultBackend));
     const route = String(readOption(args, '--route', '$Agent'));
     const mock = hasFlag(args, '--mock') || backend === 'fake';
     const real = hasFlag(args, '--real');
@@ -34,7 +43,7 @@ export function parseAgentCommandArgs(command, args = []) {
     const zellijSessionName = String(readOption(args, '--zellij-session-name', '') || '') || null;
     const zellijPaneWorker = hasFlag(args, '--no-zellij-pane-worker') ? false : hasFlag(args, '--zellij-pane-worker') ? true : undefined;
     const workerPlacement = String(readOption(args, '--worker-placement', zellijPaneWorker === true ? 'zellij-pane' : '') || '') || undefined;
-    const zellijVisiblePaneCap = Number(readOption(args, '--zellij-visible-pane-cap', process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || 12));
+    const zellijVisiblePaneCap = resolveZellijVisiblePaneCap(readOption(args, '--zellij-visible-pane-cap', process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || ''), hasOption(args, '--zellij-visible-pane-cap') || Boolean(process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP));
     const apply = hasFlag(args, '--apply');
     const dryRun = hasFlag(args, '--dry-run') || hasFlag(args, '--dryrun');
     const drain = hasFlag(args, '--drain');
@@ -52,6 +61,22 @@ export function parseAgentCommandArgs(command, args = []) {
     const prompt = promptPositionals.join(' ').trim() || 'Native agent run';
     return { command, action, prompt, route, agents, targetActiveSlots, desiredWorkItemCount, minimumWorkItems, maxQueueExpansion, concurrency, backend, backendExplicit, mock, real, readonly, profile, writeMode, applyPatches, dryRunPatches, maxWriteAgents, fastMode, serviceTier, noFast, ollamaEnabled: useOllama && !noOllama, noOllama, ollamaModel, ollamaBaseUrl, zellijSessionName, zellijPaneWorker, workerPlacement, zellijVisiblePaneCap, apply, dryRun, drain, staleMs, graceMs, killEscalation, json, missionId, lane, codexApp, patchEntryId };
 }
+export function resolveZellijVisiblePaneCap(value = '', explicit = false) {
+    const requested = Number(value);
+    if (explicit && Number.isFinite(requested) && requested >= 1)
+        return Math.max(1, Math.floor(requested));
+    const columns = Number(process.env.SKS_ZELLIJ_TERMINAL_COLUMNS || process.env.COLUMNS || process.stdout?.columns || 0);
+    const unknownFallback = Number(process.env.SKS_ZELLIJ_UNKNOWN_VISIBLE_PANE_CAP || 3);
+    if (!Number.isFinite(columns) || columns < 120) {
+        return Math.max(1, Math.floor(Number.isFinite(unknownFallback) ? unknownFallback : 3));
+    }
+    const reservedColumns = Number(process.env.SKS_ZELLIJ_RESERVED_COLUMNS || 108);
+    const minWorkerColumns = Number(process.env.SKS_ZELLIJ_MIN_WORKER_PANE_COLUMNS || 72);
+    const maxAutoVisible = Number(process.env.SKS_ZELLIJ_MAX_AUTO_VISIBLE_PANES || 8);
+    const available = Math.max(0, columns - Math.max(80, reservedColumns));
+    const computed = Math.floor(available / Math.max(40, minWorkerColumns));
+    return Math.max(1, Math.min(Math.max(1, Math.floor(maxAutoVisible || 8)), computed || Math.floor(unknownFallback) || 3));
+}
 function hasFlag(args, flag) {
     return args.includes(flag);
 }

package/dist/core/agents/agent-orchestrator.js

@@ -1676,7 +1676,8 @@ async function runAgentByBackend(backend, agent, slice, opts) {
         return runProcessAgent(agent, slice, opts);
     if (backend === 'ollama')
         return runOllamaAgent(agent, slice, opts);
-    if (backend === 'codex-sdk' || backend === 'zellij') {
+    if (backend === 'codex-sdk' || backend === 'zellij' || backend === 'local-llm') {
+        const localPreferred = backend === 'local-llm';
         const ledgerRoot = path.resolve(opts.agentRoot || opts.cwd || process.cwd());
         const workerDir = path.join(ledgerRoot, 'codex-sdk-workers', String(agent.session_id || agent.id || 'agent'), String(slice?.id || 'slice'));
         const writePaths = sdkWritePaths(slice, opts);
@@ -1703,6 +1704,9 @@ async function runAgentByBackend(backend, agent, slice, opts) {
                 user_confirmed_full_access: false,
                 mad_sks_authorized: opts.madSksAuthorized === true || process.env.SKS_MAD_SKS_ACTIVE === '1'
             },
+            backendPreference: localPreferred ? ['local-llm', 'codex-sdk'] : ['codex-sdk'],
+            allowLocalLlm: localPreferred,
+            ...(localPreferred ? { localLlmPolicy: { mode: 'local_preferred', requiresGptFinal: true } } : {}),
             mutationLedgerRoot: workerDir,
             zellijPaneId: null
         });
@@ -1710,9 +1714,11 @@ async function runAgentByBackend(backend, agent, slice, opts) {
         const patchEnvelopes = normalizeDirectSdkPatchEnvelopes(sdkWorkerResult?.patch_envelopes || [], agent, opts, sdkTask.sdkThreadId);
         const sdkReport = {
             schema: 'sks.codex-sdk-worker-adapter.v1',
-            backend: 'codex-sdk',
+            backend: sdkTask.backend === 'local-llm' ? 'local-llm' : 'codex-sdk',
+            backend_family: sdkTask.backend_family,
             sdk_thread_id: sdkTask.sdkThreadId,
             sdk_run_id: sdkTask.sdkRunId,
+            local_llm_proof_path: sdkTask.localLlmProofPath || null,
             stream_event_count: sdkTask.streamEventCount,
             structured_output_valid: sdkTask.structuredOutputValid,
             worker_result_path: path.relative(ledgerRoot, sdkTask.workerResultPath),
@@ -1723,18 +1729,31 @@ async function runAgentByBackend(backend, agent, slice, opts) {
         };
         return validateAgentWorkerResult({
             ...sdkWorkerResult,
-            backend: 'codex-sdk',
+            backend: sdkTask.backend === 'local-llm' ? 'local-llm' : 'codex-sdk',
             patch_envelopes: patchEnvelopes,
             ...(patchEnvelopes.length ? {} : { no_patch_reason: buildDirectNoPatchReason(slice, opts) }),
             codex_child_report: sdkReport,
             codex_sdk_thread: sdkReport,
             model_authored_patch_envelopes: patchEnvelopes.length > 0,
             fixture_patch_envelopes: false,
-            artifacts: [...new Set([...(sdkWorkerResult?.artifacts || []), path.relative(ledgerRoot, sdkTask.workerResultPath), path.join(path.relative(ledgerRoot, workerDir), 'codex-control-proof.json'), path.join(path.relative(ledgerRoot, workerDir), 'codex-thread-registry.json'), path.join(path.relative(ledgerRoot, workerDir), 'codex-sdk-events.jsonl')])],
+            artifacts: [...new Set([
+                    ...(sdkWorkerResult?.artifacts || []),
+                    path.relative(ledgerRoot, sdkTask.workerResultPath),
+                    path.join(path.relative(ledgerRoot, workerDir), 'codex-control-proof.json'),
+                    path.join(path.relative(ledgerRoot, workerDir), 'codex-thread-registry.json'),
+                    path.join(path.relative(ledgerRoot, workerDir), sdkTask.backend === 'local-llm' ? 'local-llm-events.jsonl' : 'codex-sdk-events.jsonl'),
+                    ...(sdkTask.localLlmProofPath ? [path.relative(ledgerRoot, sdkTask.localLlmProofPath)] : [])
+                ])],
             blockers: [...(sdkWorkerResult?.blockers || []), ...sdkTask.blockers],
             verification: {
                 status: sdkTask.ok ? 'passed' : 'failed',
-                checks: [...(sdkWorkerResult?.verification?.checks || []), 'codex-sdk-control-plane', 'codex-sdk-event-stream', 'codex-sdk-structured-output']
+                checks: [
+                    ...(sdkWorkerResult?.verification?.checks || []),
+                    sdkTask.backend === 'local-llm' ? 'local-llm-control-plane' : 'codex-sdk-control-plane',
+                    sdkTask.backend === 'local-llm' ? 'local-llm-event-stream' : 'codex-sdk-event-stream',
+                    sdkTask.backend === 'local-llm' ? 'local-llm-structured-output' : 'codex-sdk-structured-output',
+                    ...(sdkTask.backend === 'local-llm' ? ['gpt-final-required-before-acceptance'] : [])
+                ]
             }
         });
     }
@@ -1753,7 +1772,7 @@ async function maybeSelectOllamaBackend(backend, agent, slice, opts) {
     if (!config?.ok || config.enabled !== true)
         return backend;
     const policy = classifyOllamaWorkerSlice(slice, { route: opts.route, agent });
-    return policy.ok ? 'ollama' : backend;
+    return policy.ok ? 'local-llm' : backend;
 }
 function buildDirectSdkWorkerPrompt(slice) {
     const write = sdkWritePaths(slice, {});

package/dist/core/agents/agent-role-config.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
-const SKS_OWNED_AGENT_CONFIGS = new Map([
+export const SKS_OWNED_AGENT_CONFIGS = new Map([
     ['analysis-scout.toml', roleConfig('analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only')],
     ['native-agent-intake.toml', roleConfig('native_agent', 'Read-only Team native agent for repository/docs/tests/API/risk slices.', 'read-only')],
     ['team-consensus.toml', roleConfig('team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only')],
@@ -11,6 +11,17 @@ const SKS_OWNED_AGENT_CONFIGS = new Map([
     ['db-safety-reviewer.toml', roleConfig('db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only')],
     ['qa-reviewer.toml', roleConfig('qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only')]
 ]);
+export function managedAgentRoleConfigForFile(file) {
+    return SKS_OWNED_AGENT_CONFIGS.get(path.basename(file))?.content || null;
+}
+export function managedAgentRoleConfigForRole(role) {
+    const normalized = String(role || '').trim().replace(/-/g, '_');
+    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
+        if (config.name === normalized || path.basename(file, '.toml').replace(/-/g, '_') === normalized)
+            return { file, content: config.content };
+    }
+    return null;
+}
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
     const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || '', '.codex');

package/dist/core/agents/native-cli-session-swarm.js

@@ -66,7 +66,7 @@ class NativeCliSessionSwarmRecorder {
             patch_envelope_path: patchRel,
             service_tier: this.input.fastModePolicy.service_tier,
             fast_mode: this.input.fastModePolicy.fast_mode,
-            ollama_enabled: ctx.opts.ollamaEnabled === true || this.input.backend === 'ollama',
+            ollama_enabled: ctx.opts.ollamaEnabled === true || this.input.backend === 'ollama' || this.input.backend === 'local-llm',
             ollama_model: ctx.opts.ollamaModel || null,
             ollama_base_url: ctx.opts.ollamaBaseUrl || null,
             source_intelligence_refs: ctx.agent.source_intelligence_refs || null,