sneakoscope 3.1.5 → 3.1.7

package/README.md

@@ -27,7 +27,7 @@ Sneakoscope Codex (`sks`) is a Codex CLI/App harness that makes repeatable Codex
 
 ![Sneakoscope Codex Trust Layer](docs/assets/sneakoscope-architecture-pipeline.jpg)
 
-## LLM Init Prompt for Hermes / OpenClaw Agent Builders
+## LLM Init Prompt for Codex Native Agent Builders
 
 ```text
 Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-Codex](https://github.com/mandarange/Sneakoscope-Codex)] as the repo reference and [npm i -g sneakoscope] as the recommended global install command, then run the appropriate `sks` setup, doctor, Codex App, and proof checks for this repo. Keep generated SKS state out of source control unless documented, and record every version-facing change in CHANGELOG.md.
@@ -35,7 +35,7 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.5** productionizes the Codex App harness with typed probe surfaces, dry-run Zellij self-heal planning, hook approval and `agent_type` evidence, LazyCodex live-source analysis, init-deep directory memory hints, and execution profile routing across Loop, QA, Research, and Naruto artifacts.
+SKS **3.1.7** closes Codex-native runtime-proof gaps with real routing blackboxes, neutral reference cache refresh, read-only broker checks, explicit managed-asset repair transactions, and final brand-neutral artifact scans.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 
@@ -79,7 +79,7 @@ npm run runtime:ts-python-boundary
 npm run codex-control:all-pipelines
 ```
 
-Broader release checks still live behind `npm run release:check`. Detailed release history is in [CHANGELOG.md](CHANGELOG.md), and release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
+Change-aware release checks live behind `npm run release:check`; publish-authorizing full DAG checks use `npm run release:check:full`. Detailed release history is in [CHANGELOG.md](CHANGELOG.md), and release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
 
 ## 🍥 Parallelism, UX, And Integrations
 
@@ -292,7 +292,7 @@ sks selftest --mock
 
 ## 🎁 What Sneakoscope Adds
 
-`sks` adds a Zellij-backed Codex CLI runtime, Codex App `$` commands, Team/QA/PPT/Research/DB/GX/Wiki routes, OpenClaw and Hermes skill generation, Context7-gated current docs, TriWiki context packs, DB safety, design SSOT policy, skill dreaming, release checks, and Honest Mode.
+`sks` adds a Zellij-backed Codex CLI runtime, Codex App `$` commands, Codex Native broker routing, Team/QA/PPT/Research/DB/GX/Wiki routes, Context7-gated current docs, TriWiki context packs, DB safety, design SSOT policy, skill dreaming, release checks, and Honest Mode.
 
 ## Report-Only Planning Surfaces
 
@@ -618,43 +618,15 @@ SKS does not install Git pre-commit hooks. Release metadata is changed only by e
 
 TriWiki is intentionally sparse: `sks wiki sweep` records demote, soft-forget, archive, delete, promote-to-skill, and promote-to-rule candidates instead of injecting every old claim into future prompts. `sks harness fixture` validates the broader Harness Growth Factory contract: deliberate forgetting fixtures, skill card metadata, experiment schema, tool-error taxonomy, permission profiles, MultiAgentV2 defaults, and tmux cockpit view coverage. `sks code-structure scan` flags handwritten files above 1000/2000/3000-line thresholds so new logic can be extracted before command files become harder to maintain.
 
-## 🤖 OpenClaw And Hermes Agent Usage
-
-Sneakoscope can generate an OpenClaw skill package for agents that need to operate SKS-enabled repositories.
+## Codex Native Broker
 
 ```sh
-sks openclaw install
-sks openclaw path
+sks codex-native status --json
+sks codex-native invocation-plan --route '$Loop' --capability agent-role --json
+sks codex-native init-deep --apply --directory-local --json
 ```
 
-By default this writes `~/.openclaw/skills/sneakoscope-codex/` with `manifest.yaml`, `SKILL.md`, a README, and `openclaw-agent-config.example.yaml`. Set `OPENCLAW_HOME` or pass `--dir` for a custom location. Attach the skill with the built-in `shell` tool enabled and set `SKS_OPENCLAW=1` so SKS can auto-approve update/install prompts that would otherwise wait for `Y/n`.
-
-```sh
-SKS_OPENCLAW=1 sks root
-SKS_OPENCLAW=1 sks commands
-SKS_OPENCLAW=1 sks dollar-commands
-SKS_OPENCLAW=1 sks deps check
-SKS_OPENCLAW=1 sks proof-field scan --intent "small CLI change" --changed src/cli/main.ts
-```
-
-If OpenClaw runs in a sandbox, grant shell execution only for trusted workspaces. Database, migration, and destructive work still follows SKS safety routes.
-
-Sneakoscope can also generate a Hermes Agent skill package for the Hermes `/skills` surface.
-
-```sh
-sks hermes install
-sks hermes status --json
-sks hermes path
-```
-
-By default this writes `~/.hermes/skills/sneakoscope-codex/` with `SKILL.md`, a README, `hermes-config.example.yaml`, and `skill-bundle.example.yaml`. Set `HERMES_HOME` or pass `--dir` for a custom location. Hermes agents should invoke `/sneakoscope-codex` with the terminal toolset enabled and run shell commands with `SKS_HERMES=1`; this enables non-interactive dependency/update prompts while leaving SKS DB, migration, and destructive-operation safety routes intact. If you use Hermes `skills.external_dirs`, remember writable external directories can be updated by Hermes, so protect shared skill folders with filesystem permissions when needed.
-
-```sh
-SKS_HERMES=1 sks root --json
-SKS_HERMES=1 sks commands --json
-SKS_HERMES=1 sks dollar-commands --json
-SKS_HERMES=1 sks status --json
-```
+The broker records Codex-native feature availability, invocation defaults, neutral pattern evidence, and managed memory setup without exposing reference implementation branding in user-facing artifacts.
 
 ## 💬 Prompt `$` Commands
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.5"
+version = "3.1.7"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.5"
+version = "3.1.7"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.5"),
+        Some("--version") => println!("sks-rs 3.1.7"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.5",
-  "source_digest": "89b81e91ec4d82c33320922ae0dc33bd6562ccf37c58171858e7f703d7767e4b",
-  "source_file_count": 2518,
-  "built_at_source_time": 1781439913355
+  "package_version": "3.1.7",
+  "source_digest": "8927dd50bf67d1f2ce1df5744a3b21645a870f8f9182fe7b86a92affedf416aa",
+  "source_file_count": 2558,
+  "built_at_source_time": 1781491235171
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.5';
+const FAST_PACKAGE_VERSION = '3.1.7';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -97,11 +97,10 @@ export const COMMANDS = {
     postinstall: entry('stable', 'Run postinstall bootstrap', 'dist/core/commands/basic-cli.js', basicArgs('postinstallCommand')),
     codex: entry('beta', 'Check Codex CLI compatibility and vendored hook schemas', 'dist/commands/codex.js', directCommand(() => import('../commands/codex.js'), 'dist/commands/codex.js')),
     'codex-app': entry('beta', 'Check Codex App readiness', 'dist/commands/codex-app.js', directCommand(() => import('../commands/codex-app.js'), 'dist/commands/codex-app.js')),
+    'codex-native': entry('beta', 'Inspect Codex Native broker and routing readiness', 'dist/commands/codex-native.js', directCommand(() => import('../commands/codex-native.js'), 'dist/commands/codex-native.js')),
     'codex-lb': entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js')),
     auth: entry('beta', 'Alias for codex-lb auth commands', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js')),
     hooks: entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js')),
-    openclaw: entry('labs', 'Create OpenClaw skill package', 'dist/commands/openclaw.js', directCommand(() => import('../commands/openclaw.js'), 'dist/commands/openclaw.js')),
-    hermes: entry('labs', 'Create Hermes Agent skill package', 'dist/commands/hermes.js', directCommand(() => import('../commands/hermes.js'), 'dist/commands/hermes.js')),
     tmux: entry('beta', 'Show removed-runtime migration notice', 'dist/commands/tmux.js', directCommand(() => import('../commands/tmux.js'), 'dist/commands/tmux.js')),
     'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
     'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),

package/dist/commands/codex-app.js

@@ -9,13 +9,15 @@ import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js'
 import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
 import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.js';
 import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
-import { buildLazyCodexInteropPolicy } from '../core/codex-app/lazycodex-interop-policy.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'remote-control' || action === 'remote')
         return codexAppRemoteControlCommand(args.slice(1));
-    if (action === 'harness-matrix')
-        return printCodexAppResult(args, await buildCodexAppHarnessMatrix({ root: await sksRoot(), applyRepairs: flag(args, '--fix') || flag(args, '--apply') }));
+    if (action === 'harness-matrix') {
+        const root = await sksRoot();
+        return printCodexAppResult(args, await maybeRepairThenReadOnlyHarness(args, root));
+    }
     if (action === 'skill-sync')
         return printCodexAppResult(args, await syncCodexSksSkills({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'agent-role-sync')
@@ -26,11 +28,6 @@ export async function run(_command, args = []) {
         return printCodexAppResult(args, await buildCodexHookLifecycle({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'execution-profile')
         return printCodexAppResult(args, await resolveCodexAppExecutionProfile({ root: await sksRoot() }));
-    if (action === 'interop' && args[1] === 'lazycodex') {
-        const modeArg = readOption(args, '--mode', 'coexist');
-        const mode = modeArg === 'sks-primary' || modeArg === 'handoff-to-omo' ? modeArg : 'coexist';
-        return printCodexAppResult(args, await buildLazyCodexInteropPolicy({ root: await sksRoot(), mode }));
-    }
     if (action === 'product-design' || action === 'design-product' || action === 'ensure-product-design') {
         const checkOnly = flag(args, '--check-only') || flag(args, '--no-install');
         const status = await codexProductDesignPluginStatus({
@@ -91,7 +88,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|interop lazycodex [--mode coexist]|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     process.exitCode = 1;
 }
 function printCodexAppResult(args = [], result) {
@@ -109,8 +106,19 @@ function printCodexAppResult(args = [], result) {
     if (result?.ok === false)
         process.exitCode = 1;
 }
-function readOption(args = [], name, fallback) {
-    const index = args.indexOf(name);
-    return index >= 0 && args[index + 1] ? String(args[index + 1]) : fallback;
+async function maybeRepairThenReadOnlyHarness(args = [], root) {
+    const wantsRepair = flag(args, '--fix') || flag(args, '--apply') || flag(args, '--repair-codex-native');
+    if (!wantsRepair)
+        return buildCodexAppHarnessMatrix({ root, mode: 'read-only' });
+    const repair = await repairCodexNativeManagedAssets({ root, requestedBy: 'manual', yes: flag(args, '--yes') });
+    const matrix = await buildCodexAppHarnessMatrix({ root, mode: 'read-only' });
+    return {
+        schema: 'sks.codex-app-harness-read-repair-split.v1',
+        ok: repair.ok && matrix?.ok !== false,
+        repair,
+        matrix,
+        blockers: [...(repair.blockers || []), ...(matrix?.blockers || [])],
+        warnings: [...(repair.warnings || []), 'harness_probe_after_explicit_repair_transaction']
+    };
 }
 //# sourceMappingURL=codex-app.js.map

package/dist/commands/codex-native.js

@@ -0,0 +1,84 @@
+import { flag } from '../cli/args.js';
+import { printJson } from '../cli/output.js';
+import { sksRoot } from '../core/fsx.js';
+import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js';
+import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
+import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
+import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.js';
+import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
+import { syncCodexSksSkills } from '../core/codex-app/codex-skill-sync.js';
+import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
+import { resolveCodexNativeInvocationPlan } from '../core/codex-native/codex-native-invocation-router.js';
+import { buildCodexNativeInteropPolicy } from '../core/codex-native/codex-native-interop-policy.js';
+import { analyzeCodexNativeReferenceSource } from '../core/codex-native/codex-native-reference-evidence.js';
+import { writeCodexNativePatternAnalysis } from '../core/codex-native/codex-native-pattern-analysis.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
+export async function run(_command, args = []) {
+    const root = await sksRoot();
+    const action = String(args[0] || 'status');
+    if (action === 'status' || action === 'check' || action === 'feature-broker' || action === 'feature-matrix') {
+        return printCodexNativeResult(args, await maybeRepairThenReadOnlyMatrix(args, root, () => buildCodexNativeFeatureMatrix({ root, mode: 'read-only' })));
+    }
+    if (action === 'harness-matrix' || action === 'harness-compat') {
+        return printCodexNativeResult(args, await maybeRepairThenReadOnlyMatrix(args, root, () => buildCodexAppHarnessMatrix({ root, mode: 'read-only' })));
+    }
+    if (action === 'skill-sync')
+        return printCodexNativeResult(args, await syncCodexSksSkills({ root, apply: flag(args, '--apply') || flag(args, '--fix') }));
+    if (action === 'agent-role-sync')
+        return printCodexNativeResult(args, await syncCodexAgentRoles({ root, apply: flag(args, '--apply') || flag(args, '--fix') }));
+    if (action === 'init-deep')
+        return printCodexNativeResult(args, await runCodexInitDeep({ root, apply: flag(args, '--apply') || flag(args, '--fix'), directoryLocal: flag(args, '--directory-local') }));
+    if (action === 'hook-lifecycle')
+        return printCodexNativeResult(args, await buildCodexHookLifecycle({ root, apply: flag(args, '--apply') || flag(args, '--fix') }));
+    if (action === 'execution-profile')
+        return printCodexNativeResult(args, await resolveCodexAppExecutionProfile({ root }));
+    if (action === 'interop-policy')
+        return printCodexNativeResult(args, await buildCodexNativeInteropPolicy({ root }));
+    if (action === 'reference-evidence')
+        return printCodexNativeResult(args, await analyzeCodexNativeReferenceSource({ root, writeReport: true }));
+    if (action === 'pattern-analysis')
+        return printCodexNativeResult(args, await writeCodexNativePatternAnalysis(root));
+    if (action === 'route' || action === 'invocation-plan') {
+        const route = readOption(args, '--route', '$Loop');
+        const desiredCapability = readOption(args, '--capability', 'agent-role');
+        const missionId = readOption(args, '--mission', null);
+        return printCodexNativeResult(args, await resolveCodexNativeInvocationPlan({ root, missionId, route, desiredCapability }));
+    }
+    console.error('Usage: sks codex-native status|feature-broker|harness-compat|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|interop-policy|reference-evidence|pattern-analysis|invocation-plan [--json]');
+    process.exitCode = 1;
+}
+async function maybeRepairThenReadOnlyMatrix(args = [], root, matrixFn) {
+    const wantsRepair = flag(args, '--fix') || flag(args, '--apply') || flag(args, '--repair-codex-native');
+    if (!wantsRepair)
+        return matrixFn();
+    const repair = await repairCodexNativeManagedAssets({ root, requestedBy: 'manual', yes: flag(args, '--yes') });
+    const matrix = await matrixFn();
+    return {
+        schema: 'sks.codex-native-read-repair-split.v1',
+        ok: repair.ok && matrix?.ok !== false,
+        repair,
+        matrix,
+        blockers: [...(repair.blockers || []), ...(matrix?.blockers || [])],
+        warnings: [...(repair.warnings || []), 'matrix_probe_after_explicit_repair_transaction']
+    };
+}
+function printCodexNativeResult(args = [], result) {
+    if (flag(args, '--json')) {
+        printJson(result);
+        if (result?.ok === false)
+            process.exitCode = 1;
+        return;
+    }
+    console.log(`${result?.schema || 'sks.codex-native-result'}: ${result?.ok === false ? 'blocked' : 'ok'}`);
+    for (const blocker of result?.blockers || [])
+        console.log(`- blocker: ${blocker}`);
+    for (const warning of result?.warnings || [])
+        console.log(`- warning: ${warning}`);
+    if (result?.ok === false)
+        process.exitCode = 1;
+}
+function readOption(args = [], name, fallback) {
+    const index = args.indexOf(name);
+    return index >= 0 && args[index + 1] ? String(args[index + 1]) : fallback;
+}
+//# sourceMappingURL=codex-native.js.map

package/dist/commands/doctor.js

@@ -25,6 +25,8 @@ import { writeCodexPluginInventoryArtifacts, pluginAppTemplatePolicy } from '../
 import { writeMcpPluginInventoryArtifacts } from '../core/mcp/mcp-plugin-inventory.js';
 import { runDoctorZellijRepair, doctorZellijRepairConsoleLine } from '../core/doctor/doctor-zellij-repair.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
+import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 export async function run(_command, args = []) {
     const doctorFix = flag(args, '--fix');
     let setupRepair = null;
@@ -197,7 +199,23 @@ export async function run(_command, args = []) {
     const mcpPluginInventory = pluginInventory?.report
         ? await writeMcpPluginInventoryArtifacts(root, { inventory: pluginInventory.report }).catch((err) => ({ error: err?.message || String(err), candidates: null }))
         : null;
-    const codexAppHarnessMatrix = await buildCodexAppHarnessMatrix({ root, applyRepairs: doctorFix }).catch((err) => ({
+    const repairCodexNative = doctorFix && flag(args, '--repair-codex-native');
+    const codexNativeRepair = repairCodexNative
+        ? await repairCodexNativeManagedAssets({
+            root,
+            requestedBy: 'doctor --fix',
+            yes: flag(args, '--yes') || flag(args, '-y')
+        }).catch((err) => ({
+            schema: 'sks.codex-native-repair-transaction.v1',
+            ok: false,
+            generated_at: new Date().toISOString(),
+            requested_by: 'doctor --fix',
+            repaired: [],
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }))
+        : null;
+    const codexAppHarnessMatrix = await buildCodexAppHarnessMatrix({ root, mode: 'read-only' }).catch((err) => ({
         schema: 'sks.codex-app-harness-matrix.v1',
         ok: false,
         codex_cli: { available: false, version: null },
@@ -206,6 +224,22 @@ export async function run(_command, args = []) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
+    const codexNativeFeatureMatrix = await buildCodexNativeFeatureMatrix({ root, mode: 'read-only' }).catch((err) => ({
+        schema: 'sks.codex-native-feature-matrix.v1',
+        ok: false,
+        codex_cli: { available: Boolean(codex.bin), version: codex.version || null, bin: codex.bin || null },
+        features: {},
+        invocation_defaults: {
+            loop_worker_role_strategy: 'message-role',
+            qa_visual_review_strategy: 'blocked',
+            research_source_strategy: 'local-files',
+            image_followup_strategy: 'blocked',
+            hook_evidence_policy: 'unknown-do-not-count',
+            skill_bridge_strategy: 'cli-only'
+        },
+        blockers: [err?.message || String(err)],
+        warnings: []
+    }));
     const pkgBytes = await dirSize(root).catch(() => 0);
     const ready = await writeDoctorReadinessMatrix(root, {
         codex,
@@ -232,6 +266,7 @@ export async function run(_command, args = []) {
         ]
     });
     const zellijReadiness = buildZellijReadiness(root, zellij, ready);
+    const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
         ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false),
@@ -265,10 +300,12 @@ export async function run(_command, args = []) {
             mcp_plugin_inventory: mcpPluginInventory?.candidates || null
         },
         codex_app_harness_matrix: codexAppHarnessMatrix,
+        codex_native_feature_matrix: codexNativeFeatureMatrix,
+        runtime_readiness: runtimeReadiness,
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -298,6 +335,20 @@ export async function run(_command, args = []) {
     console.log(`  codex doctor:    ${codexDoctor.available ? (codexDoctor.exit_code === 0 ? 'ok' : 'warning') : 'unavailable'}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
+    console.log('SKS Runtime Readiness:');
+    console.log(`  Zellij: ${runtimeReadiness.zellij}`);
+    console.log(`  Codex Native: ${runtimeReadiness.codex_native}`);
+    console.log(`  Loop Mesh: ${runtimeReadiness.loop_mesh}`);
+    console.log(`  QA Visual: ${runtimeReadiness.qa_visual}`);
+    console.log(`  Research Sources: ${runtimeReadiness.research_sources}`);
+    console.log(`  Image Follow-up: ${runtimeReadiness.image_followup}`);
+    for (const note of runtimeReadiness.notes)
+        console.log(`  ${note}`);
+    if (runtimeReadiness.repair_actions.length) {
+        console.log('Repair actions:');
+        for (const action of runtimeReadiness.repair_actions)
+            console.log(`  - ${action}`);
+    }
     console.log('Codex App Harness:');
     console.log(`  plugins: ${codexAppHarnessMatrix.app_features?.plugin_json ? 'ok' : 'degraded'}`);
     console.log(`  hook approval: ${codexAppHarnessMatrix.app_features?.hook_approval_state_detectable ? 'ok' : 'unknown'}`);
@@ -385,6 +436,43 @@ export async function run(_command, args = []) {
     if (!result.ok)
         process.exitCode = 1;
 }
+function buildRuntimeReadiness(zellijReadiness, matrix) {
+    const defaults = matrix?.invocation_defaults || {};
+    const hookPolicy = defaults.hook_evidence_policy || 'unknown-do-not-count';
+    const agentStrategy = defaults.loop_worker_role_strategy || 'message-role';
+    const zellijStatus = zellijReadiness?.status === 'ok'
+        ? 'ok'
+        : zellijReadiness?.cli_ready ? 'headless_available' : 'repair_required';
+    const codexNative = matrix?.ok === true
+        ? 'ok'
+        : matrix?.codex_cli?.available ? 'degraded' : 'blocked';
+    const repairActions = [];
+    if (zellijStatus !== 'ok') {
+        repairActions.push('Zellij: sks doctor --fix --yes');
+        repairActions.push('Homebrew + Zellij: sks doctor --fix --install-homebrew --yes');
+    }
+    if (codexNative !== 'ok')
+        repairActions.push('Codex Native managed assets: sks doctor --fix --repair-codex-native --yes');
+    if (matrix?.features?.project_memory?.ok !== true)
+        repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
+    return {
+        schema: 'sks.runtime-readiness-story.v1',
+        zellij: zellijStatus,
+        codex_native: codexNative,
+        loop_mesh: agentStrategy === 'agent_type' ? 'ok' : 'fallback',
+        qa_visual: defaults.qa_visual_review_strategy || 'blocked',
+        research_sources: defaults.research_source_strategy || 'local-files',
+        image_followup: defaults.image_followup_strategy || 'blocked',
+        hook_evidence_policy: hookPolicy,
+        agent_role_strategy: agentStrategy,
+        notes: [
+            ...(zellijStatus === 'headless_available' ? ['MAD can run with --headless; live panes require repair'] : []),
+            ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
+            ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : [])
+        ],
+        repair_actions: [...new Set(repairActions)]
+    };
+}
 // Assemble the explicit Zellij readiness block for `doctor --json` from the
 // capability probe + readiness matrix. Proof statuses are availability-derived:
 // `verified` is reserved for a real environment run (SKS_REQUIRE_ZELLIJ=1 gates);

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -56,7 +56,7 @@ export async function syncCodexAgentRoles(input) {
         for (const role of DIRECTIVE_ROLES) {
             const file = path.join(targetDir, `${role}.toml`);
             const current = await fs.readFile(file, 'utf8').catch(() => '');
-            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role'))
+            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role') && !current.includes('SKS managed 3.1.7 directive role'))
                 continue;
             await writeTextAtomic(file, roleToml(role, rolePayloads[role]));
             created.push(file);
@@ -69,6 +69,9 @@ export async function syncCodexAgentRoles(input) {
         apply: input.apply === true,
         agent_type_supported: agentTypeProbe.supported,
         fallback: agentTypeProbe.supported ? 'agent_type' : 'message-role',
+        strategy: agentTypeProbe.supported ? 'agent_type' : 'message-role',
+        probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json',
+        clobbered_user_roles: false,
         codex_home: codexHome,
         directive_roles: DIRECTIVE_ROLES,
         role_payloads: rolePayloads,
@@ -86,15 +89,22 @@ function roleToml(role, payload) {
         : `message_role_prefix = "${escapeToml(payload?.message_role_prefix || `Role: ${role}.`)}"`;
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.5 directive role: ${role}"`,
+        `description = "SKS managed 3.1.7 directive role: ${role}"`,
         strategyLine,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
         'developer_instructions = """',
-        `You are ${role}. SKS managed 3.1.5 directive role.`,
-        'Use the assigned scope only, cite concrete repo evidence, keep mutation surfaces bounded, and never clobber user files.',
-        'Report blockers as evidence-backed findings and write route artifacts before claiming completion.',
+        `You are ${role}. SKS managed 3.1.7 directive role with bounded ownership.`,
+        'Bounded ownership: use only the assigned owner files/directories and treat memory as guidance, not permission.',
+        role.includes('implementer') ? 'Maker/checker separation: implementer may patch only owner scope and cannot self-approve.' : 'Maker/checker separation: checker is read-only and must reject missing gates or missing proof artifacts.',
+        role.includes('implementer') ? 'Allowed sandbox: workspace-write only within assigned owner scope.' : 'Allowed sandbox: read-only; checker roles cannot mutate.',
+        role.includes('release') ? 'Release verifier: verify version truth, release DAG coverage, package scripts, packlist, and changelog evidence.' : '',
+        role.includes('zellij') ? 'UI/Zellij verifier: inspect readiness status, headless fallback, repair_required, pane proof, and slot telemetry without mutating unrelated UI state.' : '',
+        role.includes('codex') ? 'Codex native verifier: inspect hook approval, agent_type, skill sync, plugin inventory, MCP candidates, and invocation plan artifacts.' : '',
+        'Side-effect restrictions: no destructive shell, package publish, global config mutation, database mutation, or external service write unless the sealed route contract explicitly allows it.',
+        'Required proof artifacts: cite concrete repo paths, command outputs, and route-local JSON proof before claiming completion.',
+        'Final arbiter constraints: parent integration owns final acceptance; this role supplies evidence and cannot override missing gates.',
         `Execution role strategy: ${payload?.strategy || 'message-role'}. Probe: ${payload?.probe_artifact_path || '.sneakoscope/reports/codex-agent-type-probe.json'}.`,
         '"""',
         ''

package/dist/core/codex-app/codex-app-execution-profile.js

@@ -2,38 +2,60 @@ import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { buildCodexAppHarnessMatrix } from './codex-app-harness-matrix.js';
 import { isCodexAppHarnessMatrix } from './codex-app-types.js';
+import { buildCodexNativeFeatureMatrix } from '../codex-native/codex-native-feature-broker.js';
 export async function resolveCodexAppExecutionProfile(input = { root: process.cwd() }) {
     const root = path.resolve(input.root || process.cwd());
-    const maybeMatrix = input.matrix || await buildCodexAppHarnessMatrix({ root }).catch(() => null);
+    const nativeMatrix = await buildCodexNativeFeatureMatrix({ root }).catch(() => null);
+    const maybeMatrix = input.matrix || (nativeMatrix ? null : await buildCodexAppHarnessMatrix({ root }).catch(() => null));
     const matrix = isCodexAppHarnessMatrix(maybeMatrix) ? maybeMatrix : null;
-    const mode = !matrix?.codex_cli.available
-        ? 'degraded-no-app'
-        : matrix.app_features.app_handoff_ready && matrix.app_features.agent_type_supported
-            ? 'codex-app-native'
-            : matrix.codex_cli.available
-                ? 'codex-cli-headless'
-                : 'sks-loop-headless';
+    const mode = nativeMatrix
+        ? modeFromNative(nativeMatrix)
+        : !matrix?.codex_cli.available
+            ? 'degraded-no-app'
+            : matrix.app_features.app_handoff_ready && matrix.app_features.agent_type_supported
+                ? 'codex-app-native'
+                : matrix.codex_cli.available
+                    ? 'codex-cli-headless'
+                    : 'sks-loop-headless';
+    const agentRoleStrategy = nativeMatrix?.invocation_defaults.loop_worker_role_strategy || (matrix?.app_features.agent_type_supported ? 'agent_type' : 'message-role');
+    const hookApprovalState = hookApprovalStateFrom(nativeMatrix) || matrix?.app_features.hook_approval_state || 'unknown';
     const profile = {
         schema: 'sks.codex-app-execution-profile.v1',
         generated_at: nowIso(),
         ok: mode !== 'degraded-no-app',
         mode,
-        agent_role_strategy: matrix?.app_features.agent_type_supported ? 'agent_type' : 'message-role',
+        agent_role_strategy: agentRoleStrategy,
         hooks_assumed_running: false,
-        hooks_approval_required: matrix?.app_features.hook_approval_state !== 'approved',
-        hook_approval_state: matrix?.app_features.hook_approval_state || 'unknown',
-        app_handoff_ready: matrix?.app_features.app_handoff_ready === true,
-        image_path_exposure_ready: matrix?.app_features.image_path_exposure_ready === true,
-        plugin_mcp_inventory_ready: matrix?.app_features.mcp_inventory_ready === true,
+        hooks_approval_required: hookApprovalState !== 'approved',
+        hook_approval_state: hookApprovalState,
+        app_handoff_ready: nativeMatrix?.features.app_handoff.ok === true || matrix?.app_features.app_handoff_ready === true,
+        image_path_exposure_ready: nativeMatrix?.features.image_path_exposure.ok === true || matrix?.app_features.image_path_exposure_ready === true,
+        plugin_mcp_inventory_ready: nativeMatrix?.features.mcp_inventory.ok === true || matrix?.app_features.mcp_inventory_ready === true,
         loop_mesh_app_profile_available: true,
         artifact_path: '.sneakoscope/reports/codex-app-execution-profile.json',
-        matrix_artifact_path: '.sneakoscope/reports/codex-app-harness-matrix.json',
+        matrix_artifact_path: nativeMatrix ? '.sneakoscope/reports/codex-native-feature-matrix.json' : '.sneakoscope/reports/codex-app-harness-matrix.json',
         agent_type_probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json',
         hook_approval_probe_artifact_path: '.sneakoscope/reports/codex-hook-approval-probe.json',
         blockers: mode === 'degraded-no-app' ? ['codex_cli_missing'] : [],
-        warnings: matrix?.warnings || []
+        warnings: nativeMatrix?.warnings || matrix?.warnings || []
     };
     await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-app-execution-profile.json'), profile).catch(() => undefined);
     return profile;
 }
+function modeFromNative(matrix) {
+    if (!matrix.codex_cli.available)
+        return 'degraded-no-app';
+    if (matrix.features.app_handoff.ok && matrix.features.agent_type.ok)
+        return 'codex-app-native';
+    return 'codex-cli-headless';
+}
+function hookApprovalStateFrom(matrix) {
+    const probe = matrix?.probes.hook_approval;
+    if (!probe || typeof probe !== 'object' || Array.isArray(probe))
+        return null;
+    const state = probe.approval_state;
+    return state === 'approved' || state === 'pending_review' || state === 'modified_requires_reapproval' || state === 'not_installed' || state === 'unknown'
+        ? state
+        : null;
+}
 //# sourceMappingURL=codex-app-execution-profile.js.map