sneakoscope 3.1.6 → 3.1.7

package/README.md

@@ -35,7 +35,7 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.6** removes external reference branding from user-visible release surfaces and routes Codex-native feature decisions through one broker for Loop, QA, Research, Image, MAD, and Doctor.
+SKS **3.1.7** closes Codex-native runtime-proof gaps with real routing blackboxes, neutral reference cache refresh, read-only broker checks, explicit managed-asset repair transactions, and final brand-neutral artifact scans.
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 
@@ -79,7 +79,7 @@ npm run runtime:ts-python-boundary
 npm run codex-control:all-pipelines
 ```
 
-Broader release checks still live behind `npm run release:check`. Detailed release history is in [CHANGELOG.md](CHANGELOG.md), and release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
+Change-aware release checks live behind `npm run release:check`; publish-authorizing full DAG checks use `npm run release:check:full`. Detailed release history is in [CHANGELOG.md](CHANGELOG.md), and release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
 
 ## 🍥 Parallelism, UX, And Integrations
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.6"
+version = "3.1.7"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.6"
+version = "3.1.7"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.6"),
+        Some("--version") => println!("sks-rs 3.1.7"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.6",
-  "source_digest": "98f9f4c6a64ddd6b1d43f757e16358768f24b27cd9c3285eab0bdacce7cbf5d6",
-  "source_file_count": 2543,
-  "built_at_source_time": 1781450666248
+  "package_version": "3.1.7",
+  "source_digest": "8927dd50bf67d1f2ce1df5744a3b21645a870f8f9182fe7b86a92affedf416aa",
+  "source_file_count": 2558,
+  "built_at_source_time": 1781491235171
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.6';
+const FAST_PACKAGE_VERSION = '3.1.7';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/commands/codex-app.js

@@ -9,12 +9,15 @@ import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js'
 import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
 import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.js';
 import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'remote-control' || action === 'remote')
         return codexAppRemoteControlCommand(args.slice(1));
-    if (action === 'harness-matrix')
-        return printCodexAppResult(args, await buildCodexAppHarnessMatrix({ root: await sksRoot(), applyRepairs: flag(args, '--fix') || flag(args, '--apply') }));
+    if (action === 'harness-matrix') {
+        const root = await sksRoot();
+        return printCodexAppResult(args, await maybeRepairThenReadOnlyHarness(args, root));
+    }
     if (action === 'skill-sync')
         return printCodexAppResult(args, await syncCodexSksSkills({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'agent-role-sync')
@@ -103,4 +106,19 @@ function printCodexAppResult(args = [], result) {
     if (result?.ok === false)
         process.exitCode = 1;
 }
+async function maybeRepairThenReadOnlyHarness(args = [], root) {
+    const wantsRepair = flag(args, '--fix') || flag(args, '--apply') || flag(args, '--repair-codex-native');
+    if (!wantsRepair)
+        return buildCodexAppHarnessMatrix({ root, mode: 'read-only' });
+    const repair = await repairCodexNativeManagedAssets({ root, requestedBy: 'manual', yes: flag(args, '--yes') });
+    const matrix = await buildCodexAppHarnessMatrix({ root, mode: 'read-only' });
+    return {
+        schema: 'sks.codex-app-harness-read-repair-split.v1',
+        ok: repair.ok && matrix?.ok !== false,
+        repair,
+        matrix,
+        blockers: [...(repair.blockers || []), ...(matrix?.blockers || [])],
+        warnings: [...(repair.warnings || []), 'harness_probe_after_explicit_repair_transaction']
+    };
+}
 //# sourceMappingURL=codex-app.js.map

package/dist/commands/codex-native.js

@@ -12,14 +12,15 @@ import { resolveCodexNativeInvocationPlan } from '../core/codex-native/codex-nat
 import { buildCodexNativeInteropPolicy } from '../core/codex-native/codex-native-interop-policy.js';
 import { analyzeCodexNativeReferenceSource } from '../core/codex-native/codex-native-reference-evidence.js';
 import { writeCodexNativePatternAnalysis } from '../core/codex-native/codex-native-pattern-analysis.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 export async function run(_command, args = []) {
     const root = await sksRoot();
     const action = String(args[0] || 'status');
     if (action === 'status' || action === 'check' || action === 'feature-broker' || action === 'feature-matrix') {
-        return printCodexNativeResult(args, await buildCodexNativeFeatureMatrix({ root, applyRepairs: flag(args, '--fix') || flag(args, '--apply') }));
+        return printCodexNativeResult(args, await maybeRepairThenReadOnlyMatrix(args, root, () => buildCodexNativeFeatureMatrix({ root, mode: 'read-only' })));
     }
     if (action === 'harness-matrix' || action === 'harness-compat') {
-        return printCodexNativeResult(args, await buildCodexAppHarnessMatrix({ root, applyRepairs: flag(args, '--fix') || flag(args, '--apply') }));
+        return printCodexNativeResult(args, await maybeRepairThenReadOnlyMatrix(args, root, () => buildCodexAppHarnessMatrix({ root, mode: 'read-only' })));
     }
     if (action === 'skill-sync')
         return printCodexNativeResult(args, await syncCodexSksSkills({ root, apply: flag(args, '--apply') || flag(args, '--fix') }));
@@ -46,6 +47,21 @@ export async function run(_command, args = []) {
     console.error('Usage: sks codex-native status|feature-broker|harness-compat|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|interop-policy|reference-evidence|pattern-analysis|invocation-plan [--json]');
     process.exitCode = 1;
 }
+async function maybeRepairThenReadOnlyMatrix(args = [], root, matrixFn) {
+    const wantsRepair = flag(args, '--fix') || flag(args, '--apply') || flag(args, '--repair-codex-native');
+    if (!wantsRepair)
+        return matrixFn();
+    const repair = await repairCodexNativeManagedAssets({ root, requestedBy: 'manual', yes: flag(args, '--yes') });
+    const matrix = await matrixFn();
+    return {
+        schema: 'sks.codex-native-read-repair-split.v1',
+        ok: repair.ok && matrix?.ok !== false,
+        repair,
+        matrix,
+        blockers: [...(repair.blockers || []), ...(matrix?.blockers || [])],
+        warnings: [...(repair.warnings || []), 'matrix_probe_after_explicit_repair_transaction']
+    };
+}
 function printCodexNativeResult(args = [], result) {
     if (flag(args, '--json')) {
         printJson(result);

package/dist/commands/doctor.js

@@ -26,6 +26,7 @@ import { writeMcpPluginInventoryArtifacts } from '../core/mcp/mcp-plugin-invento
 import { runDoctorZellijRepair, doctorZellijRepairConsoleLine } from '../core/doctor/doctor-zellij-repair.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 export async function run(_command, args = []) {
     const doctorFix = flag(args, '--fix');
     let setupRepair = null;
@@ -198,7 +199,23 @@ export async function run(_command, args = []) {
     const mcpPluginInventory = pluginInventory?.report
         ? await writeMcpPluginInventoryArtifacts(root, { inventory: pluginInventory.report }).catch((err) => ({ error: err?.message || String(err), candidates: null }))
         : null;
-    const codexAppHarnessMatrix = await buildCodexAppHarnessMatrix({ root, applyRepairs: doctorFix }).catch((err) => ({
+    const repairCodexNative = doctorFix && flag(args, '--repair-codex-native');
+    const codexNativeRepair = repairCodexNative
+        ? await repairCodexNativeManagedAssets({
+            root,
+            requestedBy: 'doctor --fix',
+            yes: flag(args, '--yes') || flag(args, '-y')
+        }).catch((err) => ({
+            schema: 'sks.codex-native-repair-transaction.v1',
+            ok: false,
+            generated_at: new Date().toISOString(),
+            requested_by: 'doctor --fix',
+            repaired: [],
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }))
+        : null;
+    const codexAppHarnessMatrix = await buildCodexAppHarnessMatrix({ root, mode: 'read-only' }).catch((err) => ({
         schema: 'sks.codex-app-harness-matrix.v1',
         ok: false,
         codex_cli: { available: false, version: null },
@@ -207,7 +224,7 @@ export async function run(_command, args = []) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
-    const codexNativeFeatureMatrix = await buildCodexNativeFeatureMatrix({ root, applyRepairs: doctorFix }).catch((err) => ({
+    const codexNativeFeatureMatrix = await buildCodexNativeFeatureMatrix({ root, mode: 'read-only' }).catch((err) => ({
         schema: 'sks.codex-native-feature-matrix.v1',
         ok: false,
         codex_cli: { available: Boolean(codex.bin), version: codex.version || null, bin: codex.bin || null },
@@ -288,7 +305,7 @@ export async function run(_command, args = []) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -324,8 +341,14 @@ export async function run(_command, args = []) {
     console.log(`  Loop Mesh: ${runtimeReadiness.loop_mesh}`);
     console.log(`  QA Visual: ${runtimeReadiness.qa_visual}`);
     console.log(`  Research Sources: ${runtimeReadiness.research_sources}`);
-    for (const action of runtimeReadiness.repair_actions)
-        console.log(`  Repair: ${action}`);
+    console.log(`  Image Follow-up: ${runtimeReadiness.image_followup}`);
+    for (const note of runtimeReadiness.notes)
+        console.log(`  ${note}`);
+    if (runtimeReadiness.repair_actions.length) {
+        console.log('Repair actions:');
+        for (const action of runtimeReadiness.repair_actions)
+            console.log(`  - ${action}`);
+    }
     console.log('Codex App Harness:');
     console.log(`  plugins: ${codexAppHarnessMatrix.app_features?.plugin_json ? 'ok' : 'degraded'}`);
     console.log(`  hook approval: ${codexAppHarnessMatrix.app_features?.hook_approval_state_detectable ? 'ok' : 'unknown'}`);
@@ -424,14 +447,14 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         ? 'ok'
         : matrix?.codex_cli?.available ? 'degraded' : 'blocked';
     const repairActions = [];
-    if (zellijStatus === 'repair_required')
-        repairActions.push('sks doctor --fix --yes');
+    if (zellijStatus !== 'ok') {
+        repairActions.push('Zellij: sks doctor --fix --yes');
+        repairActions.push('Homebrew + Zellij: sks doctor --fix --install-homebrew --yes');
+    }
     if (codexNative !== 'ok')
-        repairActions.push('sks doctor --fix --repair-codex-native --yes');
+        repairActions.push('Codex Native managed assets: sks doctor --fix --repair-codex-native --yes');
     if (matrix?.features?.project_memory?.ok !== true)
-        repairActions.push('sks codex-native init-deep --apply --directory-local');
-    if (hookPolicy !== 'approved-only')
-        repairActions.push('hook-derived evidence will not count until Codex hook approval is approved');
+        repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
     return {
         schema: 'sks.runtime-readiness-story.v1',
         zellij: zellijStatus,
@@ -439,6 +462,7 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         loop_mesh: agentStrategy === 'agent_type' ? 'ok' : 'fallback',
         qa_visual: defaults.qa_visual_review_strategy || 'blocked',
         research_sources: defaults.research_source_strategy || 'local-files',
+        image_followup: defaults.image_followup_strategy || 'blocked',
         hook_evidence_policy: hookPolicy,
         agent_role_strategy: agentStrategy,
         notes: [
@@ -446,7 +470,7 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
             ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
             ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : [])
         ],
-        repair_actions: repairActions
+        repair_actions: [...new Set(repairActions)]
     };
 }
 // Assemble the explicit Zellij readiness block for `doctor --json` from the

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -56,7 +56,7 @@ export async function syncCodexAgentRoles(input) {
         for (const role of DIRECTIVE_ROLES) {
             const file = path.join(targetDir, `${role}.toml`);
             const current = await fs.readFile(file, 'utf8').catch(() => '');
-            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role'))
+            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role') && !current.includes('SKS managed 3.1.7 directive role'))
                 continue;
             await writeTextAtomic(file, roleToml(role, rolePayloads[role]));
             created.push(file);
@@ -69,6 +69,9 @@ export async function syncCodexAgentRoles(input) {
         apply: input.apply === true,
         agent_type_supported: agentTypeProbe.supported,
         fallback: agentTypeProbe.supported ? 'agent_type' : 'message-role',
+        strategy: agentTypeProbe.supported ? 'agent_type' : 'message-role',
+        probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json',
+        clobbered_user_roles: false,
         codex_home: codexHome,
         directive_roles: DIRECTIVE_ROLES,
         role_payloads: rolePayloads,
@@ -86,21 +89,22 @@ function roleToml(role, payload) {
         : `message_role_prefix = "${escapeToml(payload?.message_role_prefix || `Role: ${role}.`)}"`;
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.6 directive role: ${role}"`,
+        `description = "SKS managed 3.1.7 directive role: ${role}"`,
         strategyLine,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
         'developer_instructions = """',
-        `You are ${role}. SKS managed 3.1.6 directive role with bounded ownership.`,
+        `You are ${role}. SKS managed 3.1.7 directive role with bounded ownership.`,
         'Bounded ownership: use only the assigned owner files/directories and treat memory as guidance, not permission.',
         role.includes('implementer') ? 'Maker/checker separation: implementer may patch only owner scope and cannot self-approve.' : 'Maker/checker separation: checker is read-only and must reject missing gates or missing proof artifacts.',
+        role.includes('implementer') ? 'Allowed sandbox: workspace-write only within assigned owner scope.' : 'Allowed sandbox: read-only; checker roles cannot mutate.',
         role.includes('release') ? 'Release verifier: verify version truth, release DAG coverage, package scripts, packlist, and changelog evidence.' : '',
         role.includes('zellij') ? 'UI/Zellij verifier: inspect readiness status, headless fallback, repair_required, pane proof, and slot telemetry without mutating unrelated UI state.' : '',
         role.includes('codex') ? 'Codex native verifier: inspect hook approval, agent_type, skill sync, plugin inventory, MCP candidates, and invocation plan artifacts.' : '',
-        'Side effects: no destructive shell, package publish, global config mutation, database mutation, or external service write unless the sealed route contract explicitly allows it.',
+        'Side-effect restrictions: no destructive shell, package publish, global config mutation, database mutation, or external service write unless the sealed route contract explicitly allows it.',
         'Required proof artifacts: cite concrete repo paths, command outputs, and route-local JSON proof before claiming completion.',
-        'Final arbiter: parent integration owns final acceptance; this role supplies evidence and cannot override missing gates.',
+        'Final arbiter constraints: parent integration owns final acceptance; this role supplies evidence and cannot override missing gates.',
         `Execution role strategy: ${payload?.strategy || 'message-role'}. Probe: ${payload?.probe_artifact_path || '.sneakoscope/reports/codex-agent-type-probe.json'}.`,
         '"""',
         ''

package/dist/core/codex-app/codex-init-deep.js

@@ -28,7 +28,7 @@ export async function runCodexInitDeep(input = {}) {
                     }
                     if (existing.trim()) {
                         const beforeHash = hashText(existing);
-                        const backup = `${agentsPath}.sks-backup-${beforeHash.slice(0, 12)}-${Date.now()}`;
+                        const backup = `${agentsPath}.sks-backup-${Date.now()}-${beforeHash.slice(0, 12)}`;
                         await fs.copyFile(agentsPath, backup);
                         directoryLocalAgents.backup_paths.push(path.relative(root, backup));
                         directoryLocalAgents.backups_created += 1;
@@ -83,9 +83,10 @@ async function pruneBackups(root, agentsPath, keep) {
         return [];
     const dir = path.dirname(agentsPath);
     const base = path.basename(agentsPath);
+    const backupPattern = new RegExp(`^${escapeRegExp(base)}\\.sks-backup-\\d{13}-[0-9a-f]{8,12}$`);
     const rows = await fs.readdir(dir).catch(() => []);
     const backups = rows
-        .filter((name) => name.startsWith(`${base}.sks-backup-`))
+        .filter((name) => backupPattern.test(name))
         .map((name) => path.join(dir, name))
         .sort();
     const remove = backups.slice(0, Math.max(0, backups.length - keep));
@@ -99,6 +100,9 @@ async function pruneBackups(root, agentsPath, keep) {
         await guardedRm(guard, file, { force: true }).catch(() => undefined);
     return remove;
 }
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 function hashText(text) {
     let hash = 2166136261;
     for (let index = 0; index < text.length; index += 1) {

package/dist/core/codex-app/codex-skill-sync.js

@@ -56,7 +56,9 @@ export async function syncCodexSksSkills(input) {
         interop: {
             mode: 'coexist',
             clobbered_external_routes: false,
-            clobbered_user_skills: false
+            clobbered_user_skills: false,
+            skipped_user_skills: skipped,
+            managed_skills: desired
         },
         blockers: []
     };
@@ -84,7 +86,7 @@ function skillContent(name) {
         `Use when: ${profile.when}`,
         `Route: ${profile.command}`,
         `Evidence: ${profile.evidence}`,
-        'Safety: keep route state bounded, preserve user and external route assets, and stop on hard blockers instead of fabricating fallback behavior.',
+        'Safety rules: keep route state bounded, preserve user and external route assets, and stop on hard blockers instead of fabricating fallback behavior.',
         'Proof paths: write the route-local mission artifact named in Evidence before claiming completion.',
         'Failure recovery: if a proof path cannot be produced, record the blocker and continue only when the selected SKS route has another allowed evidence path.',
         `Fallback: ${profile.fallback}`,

package/dist/core/codex-control/codex-0138-capability.js

@@ -22,6 +22,7 @@ export async function detectCodex0138Capability(input = {}) {
         };
     const pluginJsonOk = atLeast138 && (probeMode === 'version-only' || featureProbeResults.plugin_json !== 'failed');
     const appHandoffOk = atLeast138 && (probeMode === 'version-only' || featureProbeResults.app_handoff_platform === 'passed');
+    const imagePathExposureOk = atLeast138 && process.env.SKS_CODEX_0138_FAKE_IMAGE_PATH_FAIL !== '1';
     const blockers = [
         ...(!codexBin ? ['codex_cli_missing'] : []),
         ...(atLeast138 ? [] : ['codex_0_138_required_for_app_plugin_features']),
@@ -36,7 +37,7 @@ export async function detectCodex0138Capability(input = {}) {
         parsed_version: parsed,
         supports_app_handoff: appHandoffOk,
         supports_plugin_json: pluginJsonOk,
-        supports_image_path_exposure: atLeast138,
+        supports_image_path_exposure: imagePathExposureOk,
         supports_model_defined_efforts: atLeast138,
         supports_app_server_token_usage: atLeast138,
         supports_v2_pat_auth: atLeast138,
@@ -78,7 +79,9 @@ async function probeCodex0138Features(codexBin, opts = {}) {
     if (opts.fake) {
         return {
             plugin_json: process.env.SKS_CODEX_0138_FAKE_PLUGIN_JSON_FAIL === '1' ? 'failed' : 'passed',
-            app_handoff_platform: process.platform === 'darwin' || process.platform === 'win32' ? 'passed' : 'failed',
+            app_handoff_platform: process.env.SKS_CODEX_0138_FAKE_APP_HANDOFF_FAIL === '1'
+                ? 'failed'
+                : process.platform === 'darwin' || process.platform === 'win32' ? 'passed' : 'failed',
             image_path_exposure_contract: 'sks-enforced'
         };
     }

package/dist/core/codex-native/codex-native-feature-broker.js

@@ -1,10 +1,9 @@
 import path from 'node:path';
+import fs from 'node:fs/promises';
 import { findCodexBinary } from '../codex-adapter.js';
 import { codexAppIntegrationStatus } from '../codex-app.js';
-import { syncCodexAgentRoles } from '../codex-app/codex-agent-role-sync.js';
 import { probeCodexAgentTypeSupport } from '../codex-app/codex-agent-type-probe.js';
 import { probeCodexHookApprovalState } from '../codex-app/codex-hook-approval-probe.js';
-import { syncCodexSksSkills } from '../codex-app/codex-skill-sync.js';
 import { detectCodex0138Capability } from '../codex-control/codex-0138-capability.js';
 import { detectCodex0139Capability } from '../codex-control/codex-0139-capability.js';
 import { buildCodexPluginInventory } from '../codex-plugins/codex-plugin-json.js';
@@ -12,8 +11,13 @@ import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
 import { buildMcpPluginServerCandidates } from '../mcp/mcp-plugin-inventory.js';
 import { codexNativeFeatureState, computeCodexNativeInvocationDefaults } from './codex-native-feature-matrix.js';
 const REPORT_PATH = '.sneakoscope/reports/codex-native-feature-matrix.json';
+const REQUIRED_SKILL_NAMES = ['loop', 'naruto', 'qa-loop', 'research', 'dfix', 'image-ux-review', 'computer-use', 'init-deep'];
+const REQUIRED_AGENT_ROLES = ['sks-explorer', 'sks-planner', 'sks-implementer', 'sks-checker', 'sks-release-verifier', 'sks-zellij-ui-verifier', 'sks-codex-probe-verifier'];
 export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd() }) {
     const root = path.resolve(input.root || process.cwd());
+    const deprecatedApplyRepairs = input.applyRepairs === true;
+    const mode = input.mode || (deprecatedApplyRepairs || input.repairManagedAssets === true ? 'repair' : 'read-only');
+    const repairManagedAssets = mode === 'repair' && (input.repairManagedAssets === true || deprecatedApplyRepairs);
     const fixtureMode = process.env.SKS_CODEX_0138_FAKE === '1' || process.env.SKS_CODEX_0139_FAKE === '1' || process.env.SKS_CODEX_PLUGIN_JSON_FAKE === '1';
     const codexBin = fixtureMode ? process.env.CODEX_BIN || 'codex' : await findCodexBinary().catch(() => null);
     const version = codexBin ? await codexVersion(codexBin) : null;
@@ -57,8 +61,8 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
         blockers: [messageOf(err)],
         warnings: ['agent_type_probe_failed_message_role_fallback']
     }));
-    const skillSync = await syncCodexSksSkills({ root, apply: input.applyRepairs === true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
-    const agentRoles = await syncCodexAgentRoles({ root, apply: input.applyRepairs === true }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
+    const skillSync = await inspectManagedSkillState(root);
+    const agentRoles = await inspectManagedAgentRoleState(root);
     const appRecord = isRecord(app) ? app : {};
     const requiredSkills = isRecord(appRecord.required_skills) ? appRecord.required_skills : {};
     const skills = isRecord(appRecord.skills) ? appRecord.skills : {};
@@ -91,7 +95,7 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
             unavailableStatus: 'fallback'
         }),
         mcp_inventory: codexNativeFeatureState({
-            ok: mcpCandidates.candidates.length > 0 || Array.isArray(plugins.plugins),
+            ok: mcpCandidates.candidates.length > 0,
             source: 'plugin-inventory',
             artifact_path: '.sneakoscope/mcp-plugin-server-candidates.json',
             evidence: [`candidate_count:${mcpCandidates.candidates.length}`],
@@ -134,7 +138,11 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
             ...(!codexBin ? ['codex_cli_missing'] : []),
             ...Object.values(features).flatMap((feature) => feature.blockers)
         ],
-        warnings: Object.values(features).flatMap((feature) => feature.warnings)
+        warnings: [
+            ...Object.values(features).flatMap((feature) => feature.warnings),
+            ...(deprecatedApplyRepairs ? ['deprecated_apply_repairs_input'] : []),
+            ...(mode === 'repair' && !repairManagedAssets ? ['repair_mode_without_managed_asset_repair'] : [])
+        ]
     };
     const matrix = {
         ...matrixBase,
@@ -144,6 +152,66 @@ export async function buildCodexNativeFeatureMatrix(input = { root: process.cwd(
     await writeCodexNativeFeatureMatrix(root, matrix, input.missionDir);
     return matrix;
 }
+async function inspectManagedSkillState(root) {
+    const skillRoots = [
+        path.join(root, '.agents', 'skills'),
+        ...(process.env.CODEX_HOME ? [path.join(process.env.CODEX_HOME, 'skills')] : [])
+    ];
+    let existingCount = 0;
+    const managed = new Set();
+    for (const dir of skillRoots) {
+        const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+        existingCount += rows.filter((row) => row.isDirectory()).length;
+        for (const name of REQUIRED_SKILL_NAMES) {
+            if (managed.has(name))
+                continue;
+            const text = await fs.readFile(path.join(dir, name, 'SKILL.md'), 'utf8').catch(() => '');
+            if (text.includes('BEGIN SKS MANAGED SKILL'))
+                managed.add(name);
+        }
+    }
+    const missing = REQUIRED_SKILL_NAMES.filter((name) => !managed.has(name));
+    return {
+        ok: missing.length === 0,
+        apply: false,
+        artifact_path: '.sneakoscope/reports/codex-skill-sync.json',
+        existing_count: existingCount,
+        managed_count: managed.size,
+        missing_required: missing,
+        blockers: missing.length ? [`managed_skills_missing:${missing.join(',')}`] : [],
+        warnings: existingCount > managed.size ? ['non_sks_skill_dirs_ignored'] : []
+    };
+}
+async function inspectManagedAgentRoleState(root) {
+    const dirs = [
+        path.join(root, '.codex', 'agents'),
+        ...(process.env.CODEX_HOME ? [path.join(process.env.CODEX_HOME, 'agents')] : [])
+    ];
+    let existingCount = 0;
+    const managed = new Set();
+    for (const dir of dirs) {
+        const rows = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+        existingCount += rows.filter((row) => row.isFile() && row.name.endsWith('.toml')).length;
+        for (const role of REQUIRED_AGENT_ROLES) {
+            if (managed.has(role))
+                continue;
+            const text = await fs.readFile(path.join(dir, `${role}.toml`), 'utf8').catch(() => '');
+            if (text.includes('SKS managed 3.1.7 directive role'))
+                managed.add(role);
+        }
+    }
+    const missing = REQUIRED_AGENT_ROLES.filter((role) => !managed.has(role));
+    return {
+        ok: missing.length === 0,
+        apply: false,
+        artifact_path: '.sneakoscope/reports/codex-agent-role-sync.json',
+        existing_count: existingCount,
+        managed_count: managed.size,
+        missing_required: missing,
+        blockers: missing.length ? [`managed_agent_roles_missing:${missing.join(',')}`] : [],
+        warnings: existingCount > managed.size ? ['non_sks_agent_roles_ignored'] : []
+    };
+}
 export async function writeCodexNativeFeatureMatrix(root, matrix, missionDir) {
     await writeJsonAtomic(path.join(root, REPORT_PATH), matrix);
     if (missionDir)

package/dist/core/codex-native/codex-native-pattern-analysis.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { analyzeCodexNativeReferenceSource, renderCodexNativeReferenceMarkdown } from './codex-native-reference-source.js';
 const PATTERN_ROWS = [
@@ -19,22 +20,26 @@ export async function buildCodexNativePatternAnalysis(input) {
     const root = path.resolve(input.root);
     const evidence = input.evidence || await analyzeCodexNativeReferenceSource({ root, sourceDir: input.sourceDir || null, writeReport: true }).catch(() => null);
     const evidenceByPattern = new Map();
+    const confidenceByPattern = new Map();
     for (const item of evidence?.evidence || []) {
         const list = evidenceByPattern.get(item.pattern_id) || [];
         list.push(item.snippet_hash);
         evidenceByPattern.set(item.pattern_id, list);
+        confidenceByPattern.set(item.pattern_id, strongerConfidence(confidenceByPattern.get(item.pattern_id), item.confidence));
     }
     return {
         schema: 'sks.codex-native-pattern-analysis.v1',
         generated_at: nowIso(),
         source_kind: 'external-reference-source',
-        source_ref: evidence?.source_ref || input.sourceDir || '.sneakoscope/cache/codex-native-reference',
+        source_ref: evidence?.source_ref || neutralSourceRef(input.sourceDir || '.sneakoscope/cache/codex-native-reference'),
         source_sha: evidence?.source_sha || null,
+        source_url_hash: evidence?.source_url_hash || null,
+        cache_report_path: evidence?.cache_report_path || null,
         patterns: PATTERN_ROWS.map((pattern) => {
             const hashes = evidenceByPattern.get(pattern.id) || [];
             return {
                 ...pattern,
-                confidence: hashes.length ? 'high' : evidence ? 'medium' : 'low',
+                confidence: confidenceByPattern.get(pattern.id) || (hashes.length ? 'medium' : evidence ? 'low' : 'low'),
                 evidence_hashes: hashes
             };
         }),
@@ -42,6 +47,13 @@ export async function buildCodexNativePatternAnalysis(input) {
         warnings: evidence?.warnings || ['reference_evidence_unavailable']
     };
 }
+function neutralSourceRef(value) {
+    return `source:${createHash('sha256').update(value).digest('hex').slice(0, 16)}`;
+}
+function strongerConfidence(current, next) {
+    const rank = { low: 0, medium: 1, high: 2 };
+    return current && rank[current] >= rank[next] ? current : next;
+}
 export async function writeCodexNativePatternAnalysis(root, input = {}) {
     const evidence = await analyzeCodexNativeReferenceSource({ root, sourceDir: input.sourceDir || null, writeReport: true }).catch(() => null);
     const report = await buildCodexNativePatternAnalysis({ root, evidence, sourceDir: input.sourceDir || null });