sneakoscope 3.1.8 → 3.1.9

package/README.md

@@ -35,7 +35,7 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.1.8** hardens update/setup/doctor safety around four operator-facing failure modes: immutable core skills, duplicate project skills, real native capability repair status, and Supabase/secret preservation.
+SKS **3.1.9** hardens update/setup/doctor safety around four operator-facing failure modes: immutable core skills, duplicate project skills, real native capability repair status, and Supabase/secret preservation.
 
 What changed in 3.1.8:
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.1.8"
+version = "3.1.9"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.1.8"
+version = "3.1.9"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.1.8"),
+        Some("--version") => println!("sks-rs 3.1.9"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.1.8",
-  "source_digest": "94742dc3eb63f280df98aa286ac2a94a14fd140f27c89db85880e4f92c630454",
-  "source_file_count": 2602,
-  "built_at_source_time": 1781513577024
+  "package_version": "3.1.9",
+  "source_digest": "dbfd5ddb700abfc4a008256b36e1743363164fd504bba959542ce79c25916dad",
+  "source_file_count": 2605,
+  "built_at_source_time": 1781537952236
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.1.8';
+const FAST_PACKAGE_VERSION = '3.1.9';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/args.js

@@ -28,6 +28,23 @@ export function positionalArgs(args = []) {
         '--command',
         '--project-ref',
         '--agent',
+        '--agents',
+        '--target-active-slots',
+        '--work-items',
+        '--minimum-work-items',
+        '--max-queue-expansion',
+        '--concurrency',
+        '--backend',
+        '--route',
+        '--mission',
+        '--mission-id',
+        '--profile',
+        '--write-mode',
+        '--max-write-agents',
+        '--service-tier',
+        '--zellij-session-name',
+        '--worker-placement',
+        '--zellij-visible-pane-cap',
         '--phase',
         '--message',
         '--role',

package/dist/cli/command-registry.js

@@ -99,21 +99,16 @@ export const COMMANDS = {
     'codex-app': entry('beta', 'Check Codex App readiness', 'dist/commands/codex-app.js', directCommand(() => import('../commands/codex-app.js'), 'dist/commands/codex-app.js')),
     'codex-native': entry('beta', 'Inspect Codex Native broker and routing readiness', 'dist/commands/codex-native.js', directCommand(() => import('../commands/codex-native.js'), 'dist/commands/codex-native.js')),
     'codex-lb': entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js')),
-    auth: entry('beta', 'Alias for codex-lb auth commands', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js')),
     hooks: entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js')),
     tmux: entry('beta', 'Show removed-runtime migration notice', 'dist/commands/tmux.js', directCommand(() => import('../commands/tmux.js'), 'dist/commands/tmux.js')),
     'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
     'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),
     'zellij-slot-column-anchor': entry('beta', 'Render the compact SLOTS anchor pane for first-slot-down Zellij stacks', 'dist/commands/zellij-slot-column-anchor.js', directCommand(() => import('../commands/zellij-slot-column-anchor.js'), 'dist/commands/zellij-slot-column-anchor.js')),
     zellij: entry('beta', 'Inspect Zellij runtime status and explain repair (no auto-install)', 'dist/commands/zellij.js', directCommand(() => import('../commands/zellij.js'), 'dist/commands/zellij.js')),
-    mad: entry('beta', 'MAD-SKS Zellij permission launcher', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')),
     'mad-sks': entry('beta', 'MAD-SKS scoped permission modifier', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')),
     'mad-db': entry('beta', 'Create or inspect one-cycle Mad-DB break-glass capability tokens', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
-    autoreview: entry('beta', 'Alias for auto-review', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
     'dollar-commands': entry('stable', 'List Codex App dollar commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),
-    dollars: entry('stable', 'Alias for dollar-commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),
-    '$': entry('stable', 'Alias for dollar-commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),
     'fast-mode': entry('stable', 'Toggle SKS Fast mode default for dollar-command routes', 'dist/core/commands/fast-mode-command.js', argsCommand(() => import('../core/commands/fast-mode-command.js'), 'fastModeCommand', 'dist/core/commands/fast-mode-command.js')),
     commit: entry('stable', 'Create a simple git commit', 'dist/commands/commit.js', directCommand(() => import('../commands/commit.js'), 'dist/commands/commit.js')),
     'commit-and-push': entry('stable', 'Create a simple git commit and push', 'dist/commands/commit-and-push.js', directCommand(() => import('../commands/commit-and-push.js'), 'dist/commands/commit-and-push.js')),
@@ -128,14 +123,9 @@ export const COMMANDS = {
     autoresearch: entry('labs', 'Alias for research/autoresearch route', 'dist/core/commands/autoresearch-command.js', subcommand(() => import('../core/commands/autoresearch-command.js'), 'autoresearchCommand', 'dist/core/commands/autoresearch-command.js', 'status')),
     ppt: entry('labs', 'Inspect/build PPT artifacts', 'dist/core/commands/ppt-command.js', commandArgsCommand(() => import('../core/commands/ppt-command.js'), 'pptCommand', 'dist/core/commands/ppt-command.js')),
     'image-ux-review': entry('labs', 'Inspect image UX artifacts', 'dist/core/commands/image-ux-review-command.js', commandArgsCommand(() => import('../core/commands/image-ux-review-command.js'), 'imageUxReviewCommand', 'dist/core/commands/image-ux-review-command.js')),
-    'ux-review': entry('labs', 'Alias for image UX review', 'dist/core/commands/image-ux-review-command.js', commandArgsCommand(() => import('../core/commands/image-ux-review-command.js'), 'imageUxReviewCommand', 'dist/core/commands/image-ux-review-command.js')),
-    'visual-review': entry('labs', 'Alias for image UX review', 'dist/core/commands/image-ux-review-command.js', commandArgsCommand(() => import('../core/commands/image-ux-review-command.js'), 'imageUxReviewCommand', 'dist/core/commands/image-ux-review-command.js')),
-    'ui-ux-review': entry('labs', 'Alias for image UX review', 'dist/core/commands/image-ux-review-command.js', commandArgsCommand(() => import('../core/commands/image-ux-review-command.js'), 'imageUxReviewCommand', 'dist/core/commands/image-ux-review-command.js')),
     'computer-use': entry('beta', 'Record native Mac/non-web Computer Use visual evidence', 'dist/core/commands/computer-use-command.js', commandArgsCommand(() => import('../core/commands/computer-use-command.js'), 'computerUseCommand', 'dist/core/commands/computer-use-command.js')),
-    cu: entry('beta', 'Alias for native Computer Use', 'dist/core/commands/computer-use-command.js', commandArgsCommand(() => import('../core/commands/computer-use-command.js'), 'computerUseCommand', 'dist/core/commands/computer-use-command.js')),
     context7: entry('beta', 'Context7 checks and docs', 'dist/cli/context7-command.js', subcommand(() => import('./context7-command.js'), 'context7Command', 'dist/cli/context7-command.js', 'check')),
     xai: entry('beta', 'Set up and check xAI/Grok search MCP integration', 'dist/cli/xai-command.js', subcommand(() => import('./xai-command.js'), 'xaiCommand', 'dist/cli/xai-command.js', 'check')),
-    grok: entry('beta', 'Alias for xAI/Grok search setup', 'dist/cli/xai-command.js', subcommand(() => import('./xai-command.js'), 'xaiCommand', 'dist/cli/xai-command.js', 'check')),
     recallpulse: entry('labs', 'RecallPulse evidence route', 'dist/commands/recallpulse.js', directCommand(() => import('../commands/recallpulse.js'), 'dist/commands/recallpulse.js')),
     pipeline: entry('beta', 'Inspect pipeline missions', 'dist/commands/pipeline.js', directCommand(() => import('../commands/pipeline.js'), 'dist/commands/pipeline.js')),
     guard: entry('beta', 'Check harness guard', 'dist/commands/guard.js', directCommand(() => import('../commands/guard.js'), 'dist/commands/guard.js')),
@@ -156,7 +146,6 @@ export const COMMANDS = {
     'skill-dream': entry('labs', 'Track skill dream counters', 'dist/core/commands/skill-dream-command.js', subcommand(() => import('../core/commands/skill-dream-command.js'), 'skillDreamCommand', 'dist/core/commands/skill-dream-command.js', 'status')),
     'code-structure': entry('labs', 'Scan source structure', 'dist/core/commands/code-structure-command.js', subcommand(() => import('../core/commands/code-structure-command.js'), 'codeStructureCommand', 'dist/core/commands/code-structure-command.js', 'scan')),
     rust: entry('beta', 'Inspect optional Rust accelerator status and smoke parity', 'dist/commands/rust.js', directCommand(() => import('../commands/rust.js'), 'dist/commands/rust.js')),
-    memory: entry('labs', 'Run retention checks', 'dist/core/commands/gc-command.js', subcommand(() => import('../core/commands/gc-command.js'), 'memoryCommand', 'dist/core/commands/gc-command.js')),
     gx: entry('labs', 'Render/validate GX cartridges', 'dist/core/commands/gx-command.js', subcommand(() => import('../core/commands/gx-command.js'), 'gxCommand', 'dist/core/commands/gx-command.js', 'validate')),
     db: entry('beta', 'Inspect DB safety policy', 'dist/core/commands/db-command.js', subcommand(() => import('../core/commands/db-command.js'), 'dbCommand', 'dist/core/commands/db-command.js', 'policy')),
     eval: entry('labs', 'Run eval reports', 'dist/core/commands/eval-command.js', subcommand(() => import('../core/commands/eval-command.js'), 'evalCommand', 'dist/core/commands/eval-command.js', 'run')),
@@ -170,13 +159,27 @@ export const COMMANDS = {
     bench: entry('beta', 'Run core trust-kernel benchmark budgets', 'dist/core/commands/bench-command.js', argsCommand(() => import('../core/commands/bench-command.js'), 'benchCommand', 'dist/core/commands/bench-command.js'))
 };
 export const TYPED_COMMANDS = COMMANDS;
+export const LEGACY_COMMAND_ALIASES = {
+    auth: 'codex-lb',
+    mad: 'mad-sks',
+    autoreview: 'auto-review',
+    dollars: 'dollar-commands',
+    '$': 'dollar-commands',
+    'ux-review': 'image-ux-review',
+    'visual-review': 'image-ux-review',
+    'ui-ux-review': 'image-ux-review',
+    cu: 'computer-use',
+    grok: 'xai',
+    memory: 'gc'
+};
 export const COMMAND_ALIASES = {
+    ...LEGACY_COMMAND_ALIASES,
     '--help': 'help',
     '-h': 'help',
     '--version': 'version',
     '-v': 'version',
-    '--mad': 'mad',
-    '--MAD': 'mad',
+    '--mad': 'mad-sks',
+    '--MAD': 'mad-sks',
     '--mad-sks': 'mad-sks',
     '--agent': 'agent',
     '--naruto': 'naruto'

package/dist/cli/router.js

@@ -5,17 +5,20 @@ export function isCommandName(value) {
 export function normalizeCommand(args = []) {
     const cmd = args[0];
     if (!cmd)
-        return { command: null, args: [...args] };
-    let mapped = cmd in COMMAND_ALIASES ? COMMAND_ALIASES[cmd] : cmd;
+        return { command: null, rawCommand: null, aliasTarget: null, args: [...args] };
+    const mapped = cmd in COMMAND_ALIASES ? COMMAND_ALIASES[cmd] : cmd;
     const rest = args.slice(1);
+    const command = isCommandName(mapped) ? mapped : null;
     return {
-        command: isCommandName(mapped) ? mapped : null,
+        command,
+        rawCommand: cmd,
+        aliasTarget: command && mapped !== cmd ? command : null,
         args: rest,
     };
 }
 export async function dispatch(args) {
     const argv = args ?? process.argv.slice(2);
-    const { command, args: rest } = normalizeCommand(argv);
+    const { command, rawCommand, args: rest } = normalizeCommand(argv);
     if (!command) {
         if (!argv.length) {
             const mod = await import('../commands/doctor.js');
@@ -36,6 +39,6 @@ export async function dispatch(args) {
     const mod = await entry.lazy();
     if (typeof mod.run !== 'function')
         throw new Error(`Command ${command} must export run(command, args)`);
-    return mod.run(command, rest);
+    return mod.run(rawCommand || command, rest);
 }
 //# sourceMappingURL=router.js.map

package/dist/commands/doctor.js

@@ -28,6 +28,7 @@ import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-
 import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { runDoctorNativeCapabilityRepair } from '../core/doctor/doctor-native-capability-repair.js';
+import { runDoctorCommandAliasCleanup } from '../core/doctor/command-alias-cleanup.js';
 export async function run(_command, args = []) {
     const doctorFix = flag(args, '--fix');
     let setupRepair = null;
@@ -70,6 +71,23 @@ export async function run(_command, args = []) {
         };
     }
     const root = await projectRoot();
+    const commandAliasCleanup = await runDoctorCommandAliasCleanup({
+        root,
+        fix: doctorFix
+    }).catch((err) => ({
+        schema: 'sks.command-alias-cleanup.v1',
+        ok: false,
+        status: 'blocked',
+        root,
+        fix: doctorFix,
+        report_path: `${root}/.sneakoscope/reports/command-alias-cleanup.json`,
+        canonical_command_count: 0,
+        legacy_alias_count: 0,
+        aliases: [],
+        detected: { registered_alias_commands: [], catalog_alias_rows: [], missing_canonical_targets: [] },
+        actions: [],
+        blockers: [err?.message || String(err)]
+    }));
     const doctorNativeCapabilityRepair = await runDoctorNativeCapabilityRepair({
         root,
         fix: doctorFix || flag(args, '--repair-native-capabilities'),
@@ -287,7 +305,7 @@ export async function run(_command, args = []) {
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
         schema: 'sks.doctor-status.v1',
-        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false),
+        ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false,
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
@@ -305,6 +323,7 @@ export async function run(_command, args = []) {
         agent_role_config: agentRoleConfigRepair,
         zellij_readiness: zellijReadiness,
         codex_permission_profiles: permissionProfiles,
+        command_aliases: commandAliasCleanup,
         imagegen: {
             ok: imagegen.auth_readiness?.available_paths?.length > 0,
             auth_readiness: imagegen.auth_readiness || null,
@@ -323,7 +342,7 @@ export async function run(_command, args = []) {
         ready,
         sneakoscope: { ok: await exists(`${root}/.sneakoscope`) },
         package: { bytes: pkgBytes, human: formatBytes(pkgBytes) },
-        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair }
+        repair: { sks_update: sksUpdate, setup: setupRepair, codex_config: configRepair, migration_journal: migrationJournal, global_sks_installs: globalSksInstallCleanup, agent_role_config: agentRoleConfigRepair, zellij: zellijRepair, codex_native: codexNativeRepair, doctor_native_capability: doctorNativeCapabilityRepair, command_aliases: commandAliasCleanup }
     };
     if (flag(args, '--json')) {
         printJson(result);
@@ -381,6 +400,12 @@ export async function run(_command, args = []) {
     console.log('SKS Skills:');
     console.log(`  core skills: ${doctorSkillStatus(doctorNativeCapabilityRepair?.core_skills)}`);
     console.log(`  duplicate project skills: ${doctorDedupeStatus(doctorNativeCapabilityRepair?.skill_dedupe)}`);
+    console.log('SKS Command Aliases:');
+    console.log(`  status: ${commandAliasCleanup.status || (commandAliasCleanup.ok ? 'clean' : 'blocked')}`);
+    console.log(`  canonical commands: ${commandAliasCleanup.canonical_command_count ?? 0}`);
+    console.log(`  compatibility aliases: ${commandAliasCleanup.legacy_alias_count ?? 0}`);
+    if (commandAliasCleanup.report_path)
+        console.log(`  report: ${commandAliasCleanup.report_path}`);
     console.log('Secret preservation:');
     console.log(`  Supabase keys: ${doctorNativeCapabilityRepair?.ok === false && String((doctorNativeCapabilityRepair?.blockers || []).join(' ')).includes('secret_preservation_failed') ? 'blocked' : 'preserved'}`);
     console.log('  secret values: redacted');

package/dist/core/commands/basic-cli.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { COMMANDS } from '../../cli/command-registry.js';
+import { COMMANDS, LEGACY_COMMAND_ALIASES } from '../../cli/command-registry.js';
 import { flag } from '../../cli/args.js';
 import { printJson, sksTextLogo } from '../../cli/output.js';
 import { PACKAGE_VERSION, ensureDir, exists, nowIso, projectRoot, readJson, sksRoot, tmpdir, writeJsonAtomic } from '../fsx.js';
@@ -55,6 +55,9 @@ export function dollarCommandsCommand(args = []) {
 export function aliasesCommand() {
     console.log('Aliases');
     console.log('- sks, sneakoscope');
+    console.log('- CLI compatibility aliases:');
+    for (const [alias, canonical] of Object.entries(LEGACY_COMMAND_ALIASES))
+        console.log(`  sks ${alias} -> sks ${canonical}`);
     console.log('- $ aliases:');
     for (const entry of DOLLAR_COMMAND_ALIASES)
         console.log(`  ${entry.app_skill} -> ${entry.canonical}`);

package/dist/core/commands/mad-sks-command.js

@@ -30,6 +30,7 @@ export async function madHighCommand(args = [], deps = {}) {
         return madSksSubcommand(subcommand, args.filter((arg) => String(arg) !== subcommand));
     const cleanArgs = stripMadLaunchOnlyArgs(args);
     const rawArgs = (args || []).map((arg) => String(arg));
+    const madDbGrant = resolveMadLaunchMadDbGrant(rawArgs);
     const dryRun = rawArgs.includes('--dry-run');
     if (args.includes('--json') && !dryRun) {
         const profile = buildMadHighLaunchProfileNoWrite();
@@ -133,13 +134,6 @@ export async function madHighCommand(args = [], deps = {}) {
     // later when the Zellij session opens. All filesystem/permission/EPERM/symlink/ACL
     // readability + repair checks still run. SKS_LAUNCH_FULL_CODEX_PROBE=1 restores the
     // old behavior.
-    const madDbRequested = rawArgs.includes('--mad-db');
-    const madDbAck = readOption(rawArgs, '--ack', '');
-    if (madDbRequested && madDbAck !== MAD_DB_ACK) {
-        console.error(`SKS MAD-DB launch blocked. Required --ack ${JSON.stringify(MAD_DB_ACK)}`);
-        process.exitCode = 2;
-        return { ok: false, status: 'blocked', reason: 'mad_db_ack_phrase_required', required_ack: MAD_DB_ACK };
-    }
     const allowMadRepair = rawArgs.includes('--repair-config') || rawArgs.includes('--fix') || rawArgs.includes('--yes-repair');
     const launchPreflight = await runCodexLaunchPreflight(launchRoot, { fix: allowMadRepair, launchFast: process.env.SKS_LAUNCH_FULL_CODEX_PROBE !== '1', profile: profile.profile_name, sandbox: 'danger-full-access', serviceTier: 'fast' });
     const afterPreflightUi = beforeUi ? await writeCodexAppUiSnapshot(launchRoot, `mad-after-preflight-${uiSnapshotId}`).catch(() => null) : null;
@@ -160,18 +154,38 @@ export async function madHighCommand(args = [], deps = {}) {
         return launchPreflight;
     }
     const madLaunch = await activateMadZellijPermissionState(process.cwd(), args);
-    const madDbCapability = madDbRequested
-        ? await createMadDbCapability(madLaunch.root, { missionId: madLaunch.mission_id, ack: madDbAck, cwd: process.cwd() })
+    const madDbCapability = madDbGrant.enabled
+        ? await createMadDbCapability(madLaunch.root, { missionId: madLaunch.mission_id, ack: madDbGrant.ack, cwd: process.cwd() })
         : null;
     if (madDbCapability) {
+        const grantReport = {
+            schema: 'sks.mad-sks-launch-grants.v1',
+            generated_at: nowIso(),
+            mission_id: madLaunch.mission_id,
+            mad_sks_active: true,
+            mad_db_active: true,
+            mad_db_default_grant: madDbGrant.source === 'sks_mad_default',
+            mad_db_grant_source: madDbGrant.source,
+            mad_db_one_cycle_only: true,
+            mad_db_capability_file: 'mad-db-capability.json',
+            mad_db_cycle_id: madDbCapability.cycle_id,
+            mad_db_expires_at: madDbCapability.expires_at,
+            standalone_mad_db_enable_still_requires_ack: true
+        };
+        await writeJsonAtomic(path.join(madLaunch.dir, 'mad-sks-launch-grants.json'), grantReport);
         await setCurrent(madLaunch.root, {
             mission_id: madLaunch.mission_id,
             mad_db_active: true,
             mad_db_cycle_id: madDbCapability.cycle_id,
             mad_db_capability_file: 'mad-db-capability.json',
-            mad_db_break_glass: true
+            mad_db_break_glass: true,
+            mad_db_default_grant: madDbGrant.source === 'sks_mad_default',
+            mad_db_grant_source: madDbGrant.source,
+            mad_db_one_cycle_only: true,
+            mad_db_priority_override_active: true,
+            mad_sks_launch_grants_file: 'mad-sks-launch-grants.json'
         });
-        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_db.capability_created', cycle_id: madDbCapability.cycle_id, expires_at: madDbCapability.expires_at });
+        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_db.capability_created', grant_source: madDbGrant.source, cycle_id: madDbCapability.cycle_id, expires_at: madDbCapability.expires_at });
     }
     const updateNotice = await checkSksUpdateNotice({
         packageName: deps.packageName || 'sneakoscope',
@@ -192,10 +206,10 @@ export async function madHighCommand(args = [], deps = {}) {
     await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_sks.update_notice_checked', non_blocking: true, update_available: updateNotice.update_available === true, source: updateNotice.source });
     console.log(`SKS MAD ready: ${madHighProfileName()} | gate ${madLaunch.mission_id}`);
     if (madDbCapability)
-        console.log(`MAD-DB one-cycle capability active; expires ${madDbCapability.expires_at}.`);
+        console.log(`MAD-DB one-cycle capability active (${madDbGrant.source}); expires ${madDbCapability.expires_at}.`);
     if (updateNotice.update_available === true)
         console.log(`SKS update notice: ${updateNotice.latest_version} available (non-blocking).`);
-    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, DB writes, or system/admin scopes. Catastrophic guards remain.');
+    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. MAD-DB one-cycle DB break-glass is already active for this launch; protected-core, audit, and one-cycle bounds remain.');
     const launchLb = lb.status === 'present' ? { ...lb, status: 'configured' } : lb;
     const madSksEnv = {
         SKS_PROTECTED_CORE_POLICY: madLaunch.gate.protected_core_policy,
@@ -260,6 +274,15 @@ export async function madHighCommand(args = [], deps = {}) {
         console.log('MAD launch running headless: live_panes=false.');
     return launch;
 }
+export function resolveMadLaunchMadDbGrant(args = []) {
+    const list = (args || []).map((arg) => String(arg));
+    return {
+        enabled: true,
+        source: list.includes('--mad-db') ? 'sks_mad_explicit_redundant_flag' : 'sks_mad_default',
+        ack: MAD_DB_ACK,
+        one_cycle_only: true
+    };
+}
 export async function startMadNativeSwarm(root, madLaunch, args = [], profile = {}, opts = {}) {
     const swarm = resolveMadNativeSwarmOptions(args, profile, opts);
     const dir = madLaunch.dir || missionDirLike(root, madLaunch.mission_id);

package/dist/core/commands/naruto-command.js

@@ -114,6 +114,7 @@ async function narutoRun(parsed) {
         prompt: parsed.prompt,
         requestedClones: roster.agent_count,
         totalWorkItems: parsed.workItems,
+        honorExplicitTotalWorkItems: parsed.workItemsExplicit,
         readonly: parsed.readonly,
         writeCapable,
         leaseBasePath: patchEnvelopeBasePath,
@@ -127,6 +128,7 @@ async function narutoRun(parsed) {
         prompt: parsed.prompt,
         requestedClones: roster.agent_count,
         totalWorkItems: parsed.workItems,
+        honorExplicitTotalWorkItems: parsed.workItemsExplicit,
         readonly: parsed.readonly,
         writeCapable,
         leaseBasePath: patchEnvelopeBasePath,
@@ -791,6 +793,7 @@ function parseNarutoArgs(args = []) {
     const json = hasFlag(args, '--json');
     const requestedClones = Number(readOption(args, '--clones', readOption(args, '--agents', DEFAULT_NARUTO_CLONES)));
     const clones = clampClones(requestedClones);
+    const workItemsExplicit = hasOption(args, '--work-items');
     const workItems = clampWorkItems(Number(readOption(args, '--work-items', clones * 2)), clones);
     const concurrency = normalizeConcurrency(readOption(args, '--concurrency', readOption(args, '--target-active-slots', null)), clones);
     const useOllama = hasFlag(args, '--ollama') || hasFlag(args, '--local-model');
@@ -831,7 +834,7 @@ function parseNarutoArgs(args = []) {
     const messages = normalizeMessages(readOption(args, '--messages', '8'));
     const valueFlags = new Set(['--clones', '--agents', '--work-items', '--concurrency', '--target-active-slots', '--backend', '--write-mode', '--max-write-agents', '--service-tier', '--mission', '--mission-id', '--ollama-model', '--local-model-model', '--ollama-base-url', '--local-model-base-url', '--parallelism', '--messages']);
     const prompt = positionalArgs(rest, valueFlags).join(' ').trim() || 'Naruto shadow clone swarm run';
-    return { action, prompt, clones, workItems, concurrency, backend, backendExplicit, mock, real, readonly, ollamaEnabled: useOllama && !noOllama, noOllama, ollamaModel, ollamaBaseUrl, writeMode, applyPatches, dryRunPatches, maxWriteAgents, fastMode, serviceTier, noFast, json, missionId, noOpenZellij, attach, smoke, parallelism, messages };
+    return { action, prompt, clones, workItems, workItemsExplicit, concurrency, backend, backendExplicit, mock, real, readonly, ollamaEnabled: useOllama && !noOllama, noOllama, ollamaModel, ollamaBaseUrl, writeMode, applyPatches, dryRunPatches, maxWriteAgents, fastMode, serviceTier, noFast, json, missionId, noOpenZellij, attach, smoke, parallelism, messages };
 }
 function normalizeParallelism(value) {
     const text = String(value || 'extreme').toLowerCase();

package/dist/core/commands/pipeline-command.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
-import { projectRoot, readJson, writeJsonAtomic } from '../fsx.js';
+import { projectRoot, readJson } from '../fsx.js';
 import { missionDir, stateFile } from '../mission.js';
-import { buildPipelinePlan, PIPELINE_PLAN_ARTIFACT, projectGateStatus } from '../pipeline.js';
+import { PIPELINE_PLAN_ARTIFACT, projectGateStatus, writePipelinePlan } from '../pipeline.js';
 import { routePrompt } from '../routes.js';
 import { flag, positionalArgs, readFlagValue, resolveMissionId } from './command-utils.js';
 export async function pipelineCommand(args = []) {
@@ -33,14 +33,13 @@ export async function pipelineCommand(args = []) {
                 force: flag(args, '--force-agents'),
                 noAgents: flag(args, '--no-agents')
             };
-            const plan = buildPipelinePlan({
+            const plan = await writePipelinePlan(dir, {
                 missionId: id,
                 route,
                 task: routeContext.task || mission.prompt || state.prompt || '',
                 required: Boolean(routeContext.context7_required || state.context7_required),
                 agents
             });
-            await writeJsonAtomic(path.join(dir, PIPELINE_PLAN_ARTIFACT), plan);
             if (flag(args, '--json'))
                 return console.log(JSON.stringify({ schema: 'sks.pipeline-plan.v1', ok: true, mission_id: id, plan }, null, 2));
             console.log(`Pipeline plan written: .sneakoscope/missions/${id}/${PIPELINE_PLAN_ARTIFACT}`);

package/dist/core/commands/qa-loop-command.js

@@ -5,7 +5,7 @@ import { getCodexInfo, runCodexExec } from '../codex-adapter.js';
 import { createMission, loadMission, setCurrent, stateFile } from '../mission.js';
 import { writeQuestions } from '../questions.js';
 import { sealContract } from '../decision-contract.js';
-import { buildQaLoopQuestionSchema, buildQaLoopPrompt, evaluateQaGate, qaStatus, qaUiRequired, writeMockQaResult, writeQaLoopArtifacts, writeQaNativeAgentLedger } from '../qa-loop.js';
+import { buildQaLoopQuestionSchema, buildQaLoopPrompt, ensureQaLoopVisualEvidenceContract, evaluateQaGate, qaGptImage2AnnotatedReviewRequired, qaStatus, qaUiRequired, writeMockQaResult, writeQaLoopArtifacts, writeQaNativeAgentLedger } from '../qa-loop.js';
 import { containsUserQuestion, noQuestionContinuationReason } from '../no-question-guard.js';
 import { ROUTES, routePrompt, stripVisibleDecisionAnswerBlocks } from '../routes.js';
 import { codexChromeExtensionStatus } from '../codex-app.js';
@@ -124,6 +124,8 @@ async function qaLoopRun(args) {
     const contract = await readJson(contractPath, {});
     if (!(await exists(path.join(dir, 'qa-ledger.json'))))
         await writeQaLoopArtifacts(dir, mission, contract);
+    else
+        await ensureQaLoopVisualEvidenceContract(dir, mission, contract);
     const safetyScan = await scanDbSafety(root);
     if (!safetyScan.ok) {
         console.error('QA-LOOP cannot run: SKS safety scan found unsafe project data-tool configuration.');
@@ -148,6 +150,7 @@ async function qaLoopRun(args) {
     const reportFile = qaGate.qa_report_file;
     const executionProfile = await readJson(path.join(dir, 'qa-loop', 'execution-profile.json'), null);
     const uiRequired = qaUiRequired(contract.answers || {});
+    const gptImage2ReviewRequired = qaGptImage2AnnotatedReviewRequired(contract, mission.prompt);
     const capabilityArtifact = await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch((err) => ({ error: err?.message || String(err), report: null }));
     const usageArtifact = await writeCodexAccountUsageArtifacts(root, { missionId: id }).catch((err) => ({ error: err?.message || String(err), snapshot: null }));
     const budgetPolicy = buildQaLoopBudgetPolicy({ usage: usageArtifact?.snapshot || null, provider: 'codex-sdk' });
@@ -253,6 +256,16 @@ async function qaLoopRun(args) {
                 ui_chrome_extension_evidence: false,
                 ui_computer_use_evidence: false,
                 ui_evidence_source: 'blocked_chrome_extension_setup_required',
+                ui_chrome_extension_screenshot_required: true,
+                ui_chrome_extension_screenshot_captured: false,
+                ui_chrome_extension_screenshot_artifact: null,
+                ui_chrome_extension_screenshot_sha256: null,
+                gpt_image_2_annotated_review_required: gptImage2ReviewRequired,
+                gpt_image_2_annotated_review_generated: false,
+                gpt_image_2_annotated_review_artifact: null,
+                gpt_image_2_annotated_review_sha256: null,
+                gpt_image_2_annotated_review_model: gptImage2ReviewRequired ? null : 'not_required',
+                gpt_image_2_annotated_review_provider: gptImage2ReviewRequired ? null : 'not_required',
                 blocker: 'codex_chrome_extension_setup_required',
                 blockers: Array.from(new Set([...(qaGate.blockers || []), 'codex_chrome_extension_setup_required', ...(chrome.blockers || [])])),
                 evidence: [...(qaGate.evidence || []), 'Codex Chrome Extension preflight failed before web QA execution.'],
@@ -277,6 +290,28 @@ async function qaLoopRun(args) {
     const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: '$QA-LOOP', prompt: mission.prompt || 'QA-LOOP run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount, minimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: !(applyPatches && writeMode !== 'off'), profile, writeMode: writeMode, applyPatches, dryRunPatches, maxWriteAgents, roster: nativeRoster, routeCommand: 'sks qa-loop run', routeBlackboxKind: 'actual_qa_command', env: { SKS_CODEX_APP_EXECUTION_PROFILE: executionProfile?.mode || 'unknown', SKS_CODEX_AGENT_ROLE_STRATEGY: executionProfile?.agent_role_strategy || 'message-role' } });
     await writeJsonAtomic(path.join(dir, 'qa-native-agent-run.json'), nativeAgentRun);
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'qaloop.native_agents.completed', backend: nativeAgentRun.backend, ok: nativeAgentRun.ok, proof: nativeAgentRun.proof?.status });
+    if (flag(args, '--native-proof-only')) {
+        const proofOnlyGate = {
+            schema: 'sks.qa-native-proof-only-gate.v1',
+            ok: nativeAgentRun.proof?.ok === true,
+            native_agent_proof: nativeAgentRun.proof?.ok === true,
+            proof_status: nativeAgentRun.proof?.status || null,
+            blockers: nativeAgentRun.proof?.blockers || []
+        };
+        if (flag(args, '--json'))
+            return console.log(JSON.stringify({
+                schema: 'sks.qa-loop-run.v1',
+                ok: proofOnlyGate.ok,
+                status: proofOnlyGate.ok ? 'native_proof_ready' : 'blocked',
+                mission_id: id,
+                gate: proofOnlyGate,
+                proof: nativeAgentRun.proof,
+                native_agent_run: nativeAgentRun,
+                native_proof_only: true
+            }, null, 2));
+        console.log(`QA-LOOP native proof ready: ${id}`);
+        return;
+    }
     if (mock) {
         let gate = await writeMockQaResult(dir, mission, contract);
         const needsVisual = uiRequired;

package/dist/core/commands/research-command.js

@@ -40,6 +40,38 @@ export async function researchCommand(sub, args = []) {
 export async function autoresearchCommand(sub, args = []) {
     return researchCommand(sub || 'status', args);
 }
+function hasFlagOption(args = [], name) {
+    return args.includes(name) || args.some((arg) => String(arg).startsWith(`${name}=`));
+}
+function limitResearchNativeWorkGraph(graph, limit) {
+    const count = Math.max(1, Math.min(Number(graph?.work_items?.length || 0) || 1, Math.floor(Number(limit) || 1)));
+    const workItems = (graph.work_items || []).slice(0, count).map((item) => {
+        const selectedIds = new Set((graph.work_items || []).slice(0, count).map((row) => String(row.id || '')));
+        return {
+            ...item,
+            dependencies: (item.dependencies || []).map(String).filter((id) => selectedIds.has(id)),
+            can_run_in_parallel_with: (item.can_run_in_parallel_with || []).map(String).filter((id) => selectedIds.has(id))
+        };
+    });
+    const selectedIds = new Set(workItems.map((item) => String(item.id || '')));
+    const activeWaves = (graph.active_waves || [])
+        .map((wave) => ({
+        ...wave,
+        work_item_ids: (wave.work_item_ids || []).map(String).filter((id) => selectedIds.has(id)),
+        write_paths: (wave.write_paths || []).map(String),
+        conflict_count: Number(wave.conflict_count || 0)
+    }))
+        .filter((wave) => wave.work_item_ids.length > 0);
+    return {
+        ...graph,
+        requested_clones: Math.min(Number(graph.requested_clones || count), count),
+        total_work_items: workItems.length,
+        work_items: workItems,
+        active_waves: activeWaves,
+        mixed_work_kinds: [...new Set(workItems.map((item) => item.kind))],
+        write_allowed_count: workItems.filter((item) => item.write_allowed === true).length
+    };
+}
 async function researchPrepare(args) {
     const root = await sksRoot();
     if (!(await exists(path.join(root, '.sneakoscope'))))
@@ -139,10 +171,16 @@ async function researchRun(args) {
     const mock = flag(args, '--mock');
     const researchWorkGraph = await writeResearchWorkGraph(dir, plan);
     const graphWorkItemCount = Math.max(1, Number(researchWorkGraph.total_work_items || researchWorkGraph.work_items?.length || 0));
+    const explicitWorkItems = hasFlagOption(args, '--work-items');
+    const effectiveDesiredWorkItemCount = explicitWorkItems ? desiredWorkItemCount : Math.max(desiredWorkItemCount, graphWorkItemCount);
+    const effectiveMinimumWorkItems = Math.min(effectiveDesiredWorkItemCount, explicitWorkItems ? minimumWorkItems : Math.max(minimumWorkItems, Math.min(graphWorkItemCount, targetActiveSlots)));
+    const nativeResearchWorkGraph = explicitWorkItems
+        ? limitResearchNativeWorkGraph(researchWorkGraph, effectiveDesiredWorkItemCount)
+        : researchWorkGraph;
     await runResearchCycle(dir, researchWorkGraph, { cycle: 0, status: mock ? 'mock_native_orchestrator_planned' : 'native_orchestrator_planned' });
     await setCurrent(root, { mission_id: id, mode: 'RESEARCH', phase: 'RESEARCH_RUNNING_NO_QUESTIONS', questions_allowed: false, implementation_allowed: false, research_real_run_required: !mock, research_cycle_timeout_minutes: cycleTimeoutMinutes });
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.run.started', maxCycles, mock, cycleTimeoutMinutes, real_run_required: !mock });
-    const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: flag(args, '--autoresearch') ? '$AutoResearch' : '$Research', prompt: mission.prompt || plan.prompt || 'Research run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount: Math.max(desiredWorkItemCount, graphWorkItemCount), minimumWorkItems: Math.max(minimumWorkItems, Math.min(graphWorkItemCount, targetActiveSlots)), maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: true, profile, writeMode: writeMode, applyPatches: false, dryRunPatches, maxWriteAgents, roster: plan.native_agent_plan, routeCommand: 'sks research run', routeBlackboxKind: 'actual_research_command', narutoWorkGraph: researchWorkGraph });
+    const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: flag(args, '--autoresearch') ? '$AutoResearch' : '$Research', prompt: mission.prompt || plan.prompt || 'Research run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount: effectiveDesiredWorkItemCount, minimumWorkItems: effectiveMinimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: true, profile, writeMode: writeMode, applyPatches: false, dryRunPatches, maxWriteAgents, roster: plan.native_agent_plan, routeCommand: 'sks research run', routeBlackboxKind: 'actual_research_command', narutoWorkGraph: nativeResearchWorkGraph });
     await writeJsonAtomic(path.join(dir, 'research-native-agent-run.json'), nativeAgentRun);
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.native_agents.completed', backend: nativeAgentRun.backend, ok: nativeAgentRun.ok, proof: nativeAgentRun.proof?.status });
     if (!nativeAgentRun.ok) {
@@ -151,6 +189,28 @@ async function researchRun(args) {
         process.exitCode = 2;
         return;
     }
+    if (flag(args, '--native-proof-only')) {
+        const proofOnlyGate = {
+            schema: 'sks.research-native-proof-only-gate.v1',
+            ok: nativeAgentRun.proof?.ok === true,
+            native_agent_proof: nativeAgentRun.proof?.ok === true,
+            proof_status: nativeAgentRun.proof?.status || null,
+            blockers: nativeAgentRun.proof?.blockers || []
+        };
+        if (flag(args, '--json'))
+            return console.log(JSON.stringify({
+                schema: flag(args, '--autoresearch') ? 'sks.autoresearch-run.v1' : 'sks.research-run.v1',
+                ok: proofOnlyGate.ok,
+                mission_id: id,
+                gate: proofOnlyGate,
+                proof: nativeAgentRun.proof,
+                native_agent_run: nativeAgentRun,
+                research_work_graph: nativeResearchWorkGraph,
+                native_proof_only: true
+            }, null, 2));
+        console.log(`Research native proof ready: ${id}`);
+        return;
+    }
     const legacyResearchCycle = flag(args, '--legacy-research-cycle') || process.env.SKS_RESEARCH_LEGACY_CYCLE === '1';
     const sourceMutationBaseline = await researchCodeMutationSnapshot(root, id);
     if (!legacyResearchCycle) {