sneakoscope 4.0.1 → 4.0.3

package/dist/core/providers/openrouter/openrouter-secret-store.js

@@ -0,0 +1,113 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+export const OPENROUTER_KEY_ENV_NAMES = ['OPENROUTER_API_KEY', 'SKS_OPENROUTER_API_KEY'];
+export function openRouterSecretPaths(env = process.env) {
+    const sksHome = path.resolve(env.SKS_HOME || path.join(env.HOME || os.homedir(), '.sneakoscope'));
+    const secretDir = path.join(sksHome, 'secrets');
+    return {
+        sksHome,
+        secretDir,
+        keyPath: path.join(secretDir, 'openrouter-api-key'),
+        metadataPath: path.join(secretDir, 'openrouter-api-key.json')
+    };
+}
+export async function resolveOpenRouterApiKey(input = {}) {
+    const env = input.env || process.env;
+    for (const name of OPENROUTER_KEY_ENV_NAMES) {
+        const value = String(env[name] || '').trim();
+        if (value) {
+            return {
+                key: value,
+                source: 'env',
+                env_var: name,
+                key_preview: redactOpenRouterKey(value),
+                blockers: [],
+                warnings: name === 'OPENROUTER_API_KEY' ? [] : ['using_sks_openrouter_api_key_env']
+            };
+        }
+    }
+    const stored = await readStoredOpenRouterKey(input.paths || openRouterSecretPaths(env));
+    if (stored) {
+        return {
+            key: stored,
+            source: 'user-secret-store',
+            key_preview: redactOpenRouterKey(stored),
+            blockers: [],
+            warnings: []
+        };
+    }
+    return {
+        key: null,
+        source: null,
+        key_preview: null,
+        blockers: ['glm_missing_openrouter_key'],
+        warnings: []
+    };
+}
+export async function readStoredOpenRouterKey(paths) {
+    try {
+        const text = await fs.readFile(paths.keyPath, 'utf8');
+        const key = text.trim();
+        return key || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeStoredOpenRouterKey(value, input = {}) {
+    const key = value.trim();
+    if (!key)
+        throw new Error('OpenRouter key is empty.');
+    const paths = input.paths || openRouterSecretPaths();
+    const nowIso = input.nowIso || (() => new Date().toISOString());
+    const timestamp = nowIso();
+    const previous = input.previousRecord ?? await readOpenRouterKeyRecord(paths);
+    await ensureSecretDir(paths.secretDir);
+    const tmp = `${paths.keyPath}.${process.pid}.${crypto.randomBytes(3).toString('hex')}.tmp`;
+    try {
+        const handle = await fs.open(tmp, 'w', 0o600);
+        try {
+            await handle.writeFile(`${key}\n`, 'utf8');
+            await handle.sync().catch(() => undefined);
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+        await fs.chmod(tmp, 0o600).catch(() => undefined);
+        await fs.rename(tmp, paths.keyPath);
+        await fs.chmod(paths.keyPath, 0o600).catch(() => undefined);
+    }
+    catch (err) {
+        await fs.rm(tmp, { force: true }).catch(() => undefined);
+        throw err;
+    }
+    const record = {
+        schema: 'sks.openrouter-key.v1',
+        created_at: previous?.created_at || timestamp,
+        updated_at: timestamp,
+        key_hash: crypto.createHash('sha256').update(key).digest('hex'),
+        key_preview: redactOpenRouterKey(key)
+    };
+    await fs.writeFile(paths.metadataPath, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await fs.chmod(paths.metadataPath, 0o600).catch(() => undefined);
+    return record;
+}
+export async function readOpenRouterKeyRecord(paths) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(paths.metadataPath, 'utf8'));
+        if (parsed.schema !== 'sks.openrouter-key.v1' || !parsed.key_hash || !parsed.key_preview)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+async function ensureSecretDir(secretDir) {
+    await fs.mkdir(secretDir, { recursive: true, mode: 0o700 });
+    await fs.chmod(secretDir, 0o700).catch(() => undefined);
+}
+//# sourceMappingURL=openrouter-secret-store.js.map

package/dist/core/providers/openrouter/openrouter-types.js

@@ -0,0 +1,2 @@
+export const OPENROUTER_CHAT_COMPLETIONS_URL = 'https://openrouter.ai/api/v1/chat/completions';
+//# sourceMappingURL=openrouter-types.js.map

package/dist/core/release/extreme-parallel-scheduler.js

@@ -2,6 +2,8 @@ import { buildGatePackManifest } from './gate-pack-manifest.js';
 import { executeGatePack } from './gate-pack-runner.js';
 import { buildCriticalPathLedger, writeCriticalPathLedger } from './critical-path-ledger.js';
 import { computeResourceClassBudget } from './resource-class-budget.js';
+import fs from 'node:fs';
+import path from 'node:path';
 export const EXTREME_PARALLEL_SCHEDULER_SCHEMA = 'sks.extreme-parallel-scheduler.v1';
 export function planExtremeParallelSchedule(root, graph, budget = computeResourceClassBudget()) {
     const manifest = buildGatePackManifest(root);
@@ -20,7 +22,7 @@ export function planExtremeParallelSchedule(root, graph, budget = computeResourc
     const sequential = packs.reduce((sum, pack) => sum + pack.estimated_ms, 0);
     const critical = batches.reduce((max, batch) => Math.max(max, batch.estimated_ms), 0);
     const ratio = sequential <= 0 ? 1 : critical / sequential;
-    const blockers = ratio <= 0.3 || packs.length <= 1 ? [] : ['critical_path_reduction_below_70_percent'];
+    const blockers = ratio <= 0.3 || packs.length < 4 ? [] : ['critical_path_reduction_below_70_percent'];
     return {
         schema: EXTREME_PARALLEL_SCHEDULER_SCHEMA,
         ok: blockers.length === 0,
@@ -36,18 +38,66 @@ export async function executeExtremeSchedule(input) {
     const planned = planExtremeParallelSchedule(input.root, input.graph, input.budget);
     const started = Date.now();
     const runId = `xs-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+    const manifest = buildGatePackManifest(input.root);
+    const packById = new Map(manifest.packs.map((pack) => [pack.id, pack]));
+    const queuedAt = new Map();
+    const pending = planned.batches.flatMap((batch) => batch.packs).filter((packId, index, all) => all.indexOf(packId) === index);
+    for (const packId of pending)
+        queuedAt.set(packId, Date.now());
+    const used = emptyUsedResources();
+    const waitingMs = {};
+    const timeline = [];
+    const running = new Map();
     const reports = [];
     let reused = 0;
     let executedGates = 0;
     let failedPacks = 0;
-    for (const batch of planned.batches) {
-        const results = await Promise.all(batch.packs.map((packId) => executeGatePack({
-            root: input.root,
-            packId,
-            mode: 'execute',
-            maxParallel: Math.max(1, Math.min(4, input.budget.cpu_light))
-        })));
-        for (const report of results) {
+    while (pending.length || running.size) {
+        let launched = false;
+        for (let i = 0; i < pending.length;) {
+            const packId = pending[i];
+            const resources = resourceKeysForPack(packById.get(packId)?.resource_classes || ['cpu-light']);
+            if (!canClaim(used, input.budget, resources)) {
+                i += 1;
+                continue;
+            }
+            pending.splice(i, 1);
+            const waitMs = Math.max(0, Date.now() - (queuedAt.get(packId) || Date.now()));
+            for (const resource of resources)
+                waitingMs[resource] = (waitingMs[resource] || 0) + waitMs;
+            claim(used, resources);
+            timeline.push({ event: 'claim', pack_id: packId, at: new Date().toISOString(), resources, used: { ...used }, wait_ms: waitMs });
+            launched = true;
+            const promise = executeGatePack({
+                root: input.root,
+                packId,
+                mode: 'execute',
+                maxParallel: Math.max(1, Math.min(4, input.budget.cpu_light))
+            }).then((report) => {
+                release(used, resources);
+                timeline.push({ event: 'release', pack_id: packId, at: new Date().toISOString(), resources, used: { ...used }, ok: report.ok });
+                return report;
+            });
+            running.set(packId, promise);
+        }
+        if (!running.size) {
+            if (!launched)
+                await sleep(5);
+            continue;
+        }
+        if (launched && pending.some((packId) => canClaim(used, input.budget, resourceKeysForPack(packById.get(packId)?.resource_classes || ['cpu-light'])))) {
+            continue;
+        }
+        const report = await Promise.race([...running.values()]);
+        running.delete(report.pack_id);
+        reports.push(report);
+        reused += report.reused_proof_count || report.reused || 0;
+        executedGates += report.executed_gate_count || report.executed || 0;
+        if (!report.ok)
+            failedPacks += 1;
+    }
+    for (const report of await Promise.all([...running.values()])) {
+        if (!reports.some((row) => row.pack_id === report.pack_id)) {
             reports.push(report);
             reused += report.reused_proof_count || report.reused || 0;
             executedGates += report.executed_gate_count || report.executed || 0;
@@ -56,15 +106,16 @@ export async function executeExtremeSchedule(input) {
         }
     }
     const wallMs = Math.max(0, Date.now() - started);
-    const criticalPathMs = reports.reduce((max, report) => Math.max(max, report.critical_path_ms || 0), planned.critical_path_ms);
+    const criticalPathMs = Math.max(...reports.map((report) => report.critical_path_ms || 0), planned.critical_path_ms);
     const sequentialMs = reports.reduce((sum, report) => sum + (report.critical_path_ms || 0), planned.sequential_ms);
+    const timelineFile = writeResourceClaimTimeline(input.root, runId, timeline);
     writeCriticalPathLedger(input.root, buildCriticalPathLedger({
         run_id: runId,
         sequential_ms: sequentialMs,
         critical_path_ms: criticalPathMs,
         wall_ms: wallMs,
         parallelism_gain: wallMs > 0 ? Number((sequentialMs / wallMs).toFixed(2)) : 1,
-        resource_wait_ms: {},
+        resource_wait_ms: waitingMs,
         top_blockers: reports.filter((report) => !report.ok).map((report) => ({ id: report.pack_id, wait_ms: 0, run_ms: report.critical_path_ms || 0 }))
     }));
     return {
@@ -77,10 +128,72 @@ export async function executeExtremeSchedule(input) {
         executed_gate_count: executedGates,
         failed_pack_count: failedPacks,
         wall_ms: wallMs,
+        resource_wait_ms: waitingMs,
+        resource_claim_timeline: timelineFile,
         critical_path_ms: criticalPathMs,
         sequential_ms: sequentialMs,
         pack_reports: reports,
         blockers: [...planned.blockers, ...(wallMs > input.slaMs ? ['sla_actual_exceeds_budget'] : []), ...(failedPacks ? ['pack_execution_failed'] : [])]
     };
 }
+function emptyUsedResources() {
+    return {
+        cpu_light: 0,
+        cpu_heavy: 0,
+        io_light: 0,
+        io_heavy: 0,
+        fs_read: 0,
+        network: 0,
+        remote_model_real: 0,
+        zellij_real: 0,
+        browser_real: 0,
+        secret_sensitive: 0
+    };
+}
+function resourceKeysForPack(classes) {
+    const keys = classes.map((value) => {
+        if (value === 'cpu-light')
+            return 'cpu_light';
+        if (value === 'cpu-heavy')
+            return 'cpu_heavy';
+        if (value === 'io-light')
+            return 'io_light';
+        if (value === 'io-heavy')
+            return 'io_heavy';
+        if (value === 'fs-read')
+            return 'fs_read';
+        if (value === 'remote-model-real')
+            return 'remote_model_real';
+        if (value === 'zellij-real')
+            return 'zellij_real';
+        if (value === 'browser-real')
+            return 'browser_real';
+        if (value === 'secret-sensitive' || value === 'secret')
+            return 'secret_sensitive';
+        if (value === 'network')
+            return 'network';
+        return 'cpu_light';
+    });
+    return [...new Set(keys)];
+}
+function canClaim(used, budget, resources) {
+    return resources.every((resource) => (used[resource] || 0) < Number(budget[resource] || 1));
+}
+function claim(used, resources) {
+    for (const resource of resources)
+        used[resource] = (used[resource] || 0) + 1;
+}
+function release(used, resources) {
+    for (const resource of resources)
+        used[resource] = Math.max(0, (used[resource] || 0) - 1);
+}
+function writeResourceClaimTimeline(root, runId, timeline) {
+    const file = path.join(root, '.sneakoscope', 'reports', 'resource-claim-timeline.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify({ schema: 'sks.resource-claim-timeline.v1', run_id: runId, events: timeline }, null, 2)}\n`);
+    return file;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 //# sourceMappingURL=extreme-parallel-scheduler.js.map

package/dist/core/release/gate-pack-assertion.js

@@ -0,0 +1,58 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const GATE_PACK_SHARED_ARTIFACT_SCHEMA = 'sks.gate-pack-shared-artifact.v1';
+export function writeGatePackSharedArtifact(input) {
+    const artifact = {
+        schema: GATE_PACK_SHARED_ARTIFACT_SCHEMA,
+        pack_id: input.pack.id,
+        fixture_path: input.fixturePath,
+        setup_once: true,
+        assertions: {
+            gate_count: input.pack.gate_ids.length,
+            resource_classes: input.pack.resource_classes,
+            ...sharedAssertionsForPack(input.root, input.pack),
+            ...(input.assertions || {})
+        }
+    };
+    const file = path.join(input.fixturePath, 'gate-pack-shared-artifact.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(artifact, null, 2)}\n`);
+    return file;
+}
+export function readGatePackSharedArtifact(file) {
+    try {
+        const json = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return json.schema === GATE_PACK_SHARED_ARTIFACT_SCHEMA ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function assertGateFromSharedArtifact(file, gateId) {
+    const artifact = readGatePackSharedArtifact(file);
+    if (!artifact)
+        return { ok: false, blockers: ['shared_artifact_missing_or_invalid'], artifact: null };
+    const gateIds = artifact.assertions.gate_ids;
+    if (Array.isArray(gateIds) && !gateIds.map(String).includes(gateId)) {
+        return { ok: false, blockers: [`gate_not_in_shared_artifact:${gateId}`], artifact };
+    }
+    return { ok: true, blockers: [], artifact };
+}
+function sharedAssertionsForPack(root, pack) {
+    const packageJson = readJson(path.join(root, 'package.json'));
+    return {
+        gate_ids: pack.gate_ids,
+        package_version: typeof packageJson?.version === 'string' ? packageJson.version : null,
+        release_manifest_present: fs.existsSync(path.join(root, 'release-gates.v2.json')),
+        proof_bank_present: fs.existsSync(path.join(root, '.sneakoscope', 'triwiki', 'proof-bank'))
+    };
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=gate-pack-assertion.js.map

package/dist/core/release/gate-pack-fixture-cache.js

@@ -1,15 +1,20 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { hashJson } from '../triwiki/triwiki-cache-key.js';
 export const GATE_PACK_FIXTURE_SCHEMA = 'sks.gate-pack-fixture.v1';
 export async function prepareGatePackFixture(input) {
     const base = path.join(input.root, '.sneakoscope', 'fixture-cache', 'gate-packs', safe(input.packId), safe(input.fixtureVersion));
-    const reusedBase = fs.existsSync(path.join(base, 'fixture.json'));
+    const expectedHash = hashJson({ schema: GATE_PACK_FIXTURE_SCHEMA, pack_id: input.packId, fixture_version: input.fixtureVersion });
+    const reusedBase = validateBaseFixture(base, input.packId, input.fixtureVersion, expectedHash);
+    if (!reusedBase)
+        fs.rmSync(base, { recursive: true, force: true });
     fs.mkdirSync(base, { recursive: true });
     if (!reusedBase) {
-        fs.writeFileSync(path.join(base, 'fixture.json'), `${JSON.stringify({ schema: GATE_PACK_FIXTURE_SCHEMA, pack_id: input.packId, fixture_version: input.fixtureVersion, created_at: new Date().toISOString() }, null, 2)}\n`);
+        fs.writeFileSync(path.join(base, 'fixture.json'), `${JSON.stringify({ schema: GATE_PACK_FIXTURE_SCHEMA, pack_id: input.packId, fixture_version: input.fixtureVersion, base_fixture_hash: expectedHash, created_at: new Date().toISOString() }, null, 2)}\n`);
     }
     const runPath = path.join(input.root, '.sneakoscope', 'fixture-cache', 'runs', `${safe(input.packId)}-${process.pid}-${Date.now()}`);
     fs.mkdirSync(path.dirname(runPath), { recursive: true });
+    cleanupOldRuns(path.dirname(runPath), 20);
     copyDir(base, runPath);
     return {
         schema: GATE_PACK_FIXTURE_SCHEMA,
@@ -18,6 +23,7 @@ export async function prepareGatePackFixture(input) {
         fixture_version: input.fixtureVersion,
         base_path: base,
         run_path: runPath,
+        base_fixture_hash: expectedHash,
         reused_base: reusedBase,
         setup_count: reusedBase ? 0 : 1
     };
@@ -29,6 +35,13 @@ function copyDir(from, to) {
         const dst = path.join(to, entry.name);
         if (entry.isDirectory())
             copyDir(src, dst);
+        else if (entry.isSymbolicLink()) {
+            const target = fs.readlinkSync(src);
+            const resolved = path.resolve(path.dirname(src), target);
+            if (!resolved.startsWith(path.resolve(from) + path.sep))
+                throw new Error(`gate_pack_fixture_symlink_outside_root:${src}`);
+            fs.symlinkSync(target, dst);
+        }
         else if (entry.isFile())
             fs.copyFileSync(src, dst);
     }
@@ -36,4 +49,27 @@ function copyDir(from, to) {
 function safe(value) {
     return value.replace(/[^a-zA-Z0-9._-]+/g, '_');
 }
+function validateBaseFixture(base, packId, fixtureVersion, expectedHash) {
+    try {
+        const file = path.join(base, 'fixture.json');
+        const json = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return json.schema === GATE_PACK_FIXTURE_SCHEMA && json.pack_id === packId && json.fixture_version === fixtureVersion && json.base_fixture_hash === expectedHash;
+    }
+    catch {
+        return false;
+    }
+}
+function cleanupOldRuns(runsDir, keep) {
+    if (!fs.existsSync(runsDir))
+        return;
+    const runs = fs.readdirSync(runsDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => {
+        const dir = path.join(runsDir, entry.name);
+        return { dir, mtimeMs: fs.statSync(dir).mtimeMs };
+    })
+        .sort((a, b) => b.mtimeMs - a.mtimeMs);
+    for (const run of runs.slice(Math.max(0, keep)))
+        fs.rmSync(run.dir, { recursive: true, force: true });
+}
 //# sourceMappingURL=gate-pack-fixture-cache.js.map

package/dist/core/release/gate-pack-manifest.js

@@ -106,11 +106,11 @@ function estimatedMsForPack(id) {
 }
 function resourceClassesForPack(id) {
     if (id === 'secret')
-        return ['fs-read'];
+        return ['secret-sensitive', 'fs-read'];
     if (id === 'zellij')
         return ['zellij-real'];
     if (id === 'qa-research-image')
-        return ['cpu-heavy', 'io-heavy'];
+        return ['browser-real', 'cpu-heavy', 'io-heavy'];
     if (id === 'codex-0140')
         return ['remote-model-real'];
     return ['cpu-light', 'fs-read'];

package/dist/core/release/gate-pack-runner.js

@@ -1,4 +1,4 @@
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { computeTriWikiCacheKey } from '../triwiki/triwiki-cache-key.js';
@@ -6,97 +6,12 @@ import { createTriWikiProofCard } from '../triwiki/triwiki-proof-card.js';
 import { readReusableTriWikiProofCard, writeTriWikiProofCard } from '../triwiki/triwiki-proof-bank.js';
 import { buildGatePackManifest } from './gate-pack-manifest.js';
 import { prepareGatePackFixture } from './gate-pack-fixture-cache.js';
+import { writeGatePackSharedArtifact } from './gate-pack-assertion.js';
 import { loadPackageScripts, loadReleaseGateManifest } from '../triwiki/triwiki-gate-impact-map.js';
 export const GATE_PACK_RUNNER_SCHEMA = 'sks.gate-pack-runner.v1';
 export function runGatePack(input) {
-    const manifest = buildGatePackManifest(input.root);
-    const pack = manifest.packs.find((candidate) => candidate.id === input.packId);
-    if (!pack) {
-        return { schema: GATE_PACK_RUNNER_SCHEMA, ok: false, root: input.root, pack_id: input.packId, mode: input.execute ? 'execute' : 'plan', reused: 0, executed: 0, failed: 0, proof_paths: [], blockers: ['pack_missing'] };
-    }
-    const gates = loadReleaseGateManifest(input.root).gates.filter((gate) => pack.gate_ids.includes(gate.id));
-    const scripts = loadPackageScripts(input.root);
-    const blockers = [];
-    const proofPaths = [];
-    let reused = 0;
-    let executed = 0;
-    let failed = 0;
-    for (const gate of gates) {
-        if (!input.execute)
-            continue;
-        const cacheKey = computeTriWikiCacheKey({
-            root: input.root,
-            id: gate.id,
-            inputs: gate.cache.inputs,
-            implementationFiles: [`src/scripts/${scriptFileForCommand(gate.command) || ''}`].filter(Boolean),
-            envAllowlist: ['CI', 'SKS_FAST_MODE', 'SKS_RELEASE_PRESET'],
-            fixtureVersion: 'sks-4.0.0'
-        });
-        const hit = readReusableTriWikiProofCard({ root: input.root, subjectId: gate.id, cacheKey: cacheKey.key });
-        if (hit.hit) {
-            reused += 1;
-            if (hit.path)
-                proofPaths.push(hit.path);
-            continue;
-        }
-        const scriptName = scriptNameForCommand(gate.command);
-        if (!scriptName || !scripts[scriptName]) {
-            failed += 1;
-            blockers.push(`script_missing:${gate.id}`);
-            continue;
-        }
-        const started = Date.now();
-        const run = spawnSync('npm', ['run', scriptName, '--silent'], {
-            cwd: input.root,
-            encoding: 'utf8',
-            maxBuffer: 1024 * 1024 * 10,
-            env: { ...process.env, ...(input.env || {}), CI: process.env.CI || 'true' }
-        });
-        executed += 1;
-        const passed = run.status === 0;
-        if (!passed) {
-            failed += 1;
-            blockers.push(`gate_failed:${gate.id}`);
-        }
-        const card = createTriWikiProofCard({
-            subject_type: 'gate',
-            subject_id: gate.id,
-            cache_key: cacheKey.key,
-            input_hash: cacheKey.input_hash,
-            implementation_hash: cacheKey.implementation_hash,
-            gate_impl_hash: cacheKey.implementation_hash,
-            package_lock_hash: cacheKey.package_lock_hash,
-            release_gates_hash: cacheKey.release_gates_hash,
-            env_allowlist_hash: cacheKey.env_allowlist_hash,
-            tool_versions: cacheKey.tool_versions,
-            tool_version: cacheKey.tool_version,
-            fixture_version: cacheKey.fixture_version,
-            result: passed ? 'passed' : 'failed',
-            reusable: passed,
-            duration_ms: Math.max(0, Date.now() - started),
-            evidence: {
-                status: run.status,
-                stdout_tail: tail(String(run.stdout || '')),
-                stderr_tail: tail(String(run.stderr || ''))
-            },
-            invalidation_reasons: passed ? [] : ['gate_failed']
-        });
-        proofPaths.push(writeTriWikiProofCard(input.root, card));
-    }
-    const report = {
-        schema: GATE_PACK_RUNNER_SCHEMA,
-        ok: blockers.length === 0,
-        root: input.root,
-        pack_id: input.packId,
-        mode: input.execute ? 'execute' : 'plan',
-        reused,
-        executed,
-        failed,
-        proof_paths: proofPaths,
-        blockers
-    };
-    writeGatePackReport(input.root, report);
-    return report;
+    void input;
+    throw new Error('gate_pack_legacy_sync_runner_removed');
 }
 export async function executeGatePack(input) {
     const mode = input.mode || 'execute';
@@ -109,7 +24,8 @@ export async function executeGatePack(input) {
     if (mode === 'plan') {
         return { schema: GATE_PACK_RUNNER_SCHEMA, ok: true, root: input.root, pack_id: input.packId, mode: 'plan', reused: 0, executed: 0, failed: 0, proof_paths: [], blockers: [], shared_setup_count: 0, parallelism_gain: 1, critical_path_ms: pack.estimated_ms, reused_proof_count: 0, executed_gate_count: 0 };
     }
-    const fixture = await prepareGatePackFixture({ root: input.root, packId: input.packId, fixtureVersion: 'sks-4.0.1' });
+    const fixture = await prepareGatePackFixture({ root: input.root, packId: input.packId, fixtureVersion: 'sks-4.0.2' });
+    const artifactPath = writeGatePackSharedArtifact({ root: input.root, pack, fixturePath: fixture.run_path });
     const scripts = loadPackageScripts(input.root);
     const blockers = [];
     const proofPaths = [];
@@ -152,7 +68,7 @@ export async function executeGatePack(input) {
                 continue;
             }
             const started = Date.now();
-            const run = await spawnNpmScript(input.root, scriptName, input.env);
+            const run = await spawnNpmScript(input.root, scriptName, { ...(input.env || {}), SKS_GATE_PACK_ARTIFACT: artifactPath });
             const duration = Math.max(0, Date.now() - started);
             sumMs += duration;
             criticalPathMs = Math.max(criticalPathMs, duration);
@@ -178,7 +94,7 @@ export async function executeGatePack(input) {
                 result: passed ? 'passed' : 'failed',
                 reusable: passed,
                 duration_ms: duration,
-                evidence: { status: run.status, stdout_tail: tail(run.stdout), stderr_tail: tail(run.stderr), fixture_path: fixture.run_path },
+                evidence: { status: run.status, stdout_tail: tail(run.stdout), stderr_tail: tail(run.stderr), fixture_path: fixture.run_path, shared_artifact_path: artifactPath },
                 invalidation_reasons: passed ? [] : ['gate_failed']
             });
             proofPaths.push(writeTriWikiProofCard(input.root, card));
@@ -198,7 +114,7 @@ export async function executeGatePack(input) {
         fixture_version: fixture.fixture_version,
         result: failed === 0 ? 'passed' : 'failed',
         reusable: failed === 0,
-        evidence: { gate_count: gates.length, reused, executed, failed },
+        evidence: { gate_count: gates.length, reused, executed, failed, shared_artifact_path: artifactPath },
         invalidation_reasons: failed === 0 ? [] : ['pack_gate_failed']
     });
     proofPaths.push(writeTriWikiProofCard(input.root, packCard));