sneakoscope 4.0.10 → 4.0.12

package/README.md

@@ -35,7 +35,15 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.8** makes the GLM 5.2 MAD path bounded by default: `sks --mad --glm` now returns readiness/status and exits when no task is supplied, while task forms use a direct GLM-only speed path with loop guards, request timeouts, and deterministic patch gates. Ordinary `sks --mad`, Naruto/Team, and non-GLM Codex paths keep their existing defaults.
+SKS **4.0.12** seals GLM Naruto's production runtime path: worktree workers apply extracted unified diffs only, patch workers launch through a bounded adaptive scheduler, live bench compares true direct GLM against Naruto worker counts, final apply runs dirty-tree and targeted-check guards, and stop-gates reference a final seal artifact.
+
+What changed in 4.0.12:
+
+- **Extracted worktree patches.** `--worktree` parses `<sks_patch_candidate>` and records candidate/extracted patch hashes before any worker worktree apply.
+- **Adaptive scheduler.** Patch workers use a finite launch queue with provider-health backpressure and retry-once handling for retryable 429/5xx/idle-timeout failures.
+- **True direct-vs-Naruto bench.** `--bench --live --no-apply` compares direct GLM, Naruto 1, 4, 8, and 12 worker cases without fake zero metrics.
+- **Transaction guards.** Final apply blocks dirty touched paths unless `--allow-dirty-apply` is explicit, runs targeted checks, and rolls back on validation failure by default.
+- **Seal artifacts.** GLM Naruto writes `final-seal.json`, stop-gate final-seal evidence, `merge-rationale.md`, and `bench-report.md` for auditability.
 
 What changed in 4.0.8:
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.9"
+version = "4.0.12"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.9"
+version = "4.0.12"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.9"),
+        Some("--version") => println!("sks-rs 4.0.12"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.10';
+const FAST_PACKAGE_VERSION = '4.0.12';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.10';
+export const PACKAGE_VERSION = '4.0.12';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/providers/glm/naruto/glm-naruto-apply-transaction.js

@@ -0,0 +1,136 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { sha256, writeJsonAtomic, writeTextAtomic } from '../../../fsx.js';
+import { parseUnifiedDiffPatch } from '../glm-patch-parser.js';
+import { combineGlmNarutoPatches } from './glm-naruto-combined-patch.js';
+import { runGlmNarutoTargetedChecks } from './glm-naruto-targeted-checks.js';
+export async function runGlmNarutoApplyTransaction(input) {
+    const preStatus = await gitText(input.cwd, ['status', '--short']);
+    const preDiff = await gitText(input.cwd, ['diff', '--binary']);
+    const patch = combineGlmNarutoPatches(input.envelopes, input.selectedPatchIds);
+    const parsed = parseUnifiedDiffPatch(patch);
+    const dirtyTouchedPaths = await dirtyPaths(input.cwd, parsed.touchedPaths);
+    const patchPath = path.join(input.artifactDir, 'selected-combined.patch');
+    await writeTextAtomic(patchPath, patch);
+    const blockers = [];
+    let applyCheckPassed = false;
+    let applyPassed = false;
+    let targetedChecksPassed = null;
+    let rollbackAttempted = false;
+    let rollbackPassed = null;
+    let finalStatus = 'blocked';
+    if (!patch.trim()) {
+        blockers.push('combined_patch_empty');
+    }
+    else if (dirtyTouchedPaths.length > 0 && !input.allowDirtyApply) {
+        blockers.push(`dirty_touched_paths_before_apply:${dirtyTouchedPaths.join(',')}`);
+    }
+    else {
+        const checked = await gitApply(input.cwd, patch, ['apply', '--check', '--whitespace=nowarn', '-']);
+        applyCheckPassed = checked.code === 0;
+        if (!applyCheckPassed)
+            blockers.push(checked.stderr || checked.stdout || 'git_apply_check_failed');
+        if (applyCheckPassed) {
+            const applied = await gitApply(input.cwd, patch, ['apply', '--whitespace=nowarn', '-']);
+            applyPassed = applied.code === 0;
+            if (applyPassed) {
+                const targeted = await runGlmNarutoTargetedChecks({
+                    cwd: input.cwd,
+                    touchedPaths: parsed.touchedPaths,
+                    artifactDir: input.artifactDir,
+                    ...(input.strictChecks !== undefined ? { strictChecks: input.strictChecks } : {})
+                });
+                targetedChecksPassed = targeted.ok;
+                if (targeted.ok) {
+                    finalStatus = 'applied';
+                }
+                else {
+                    blockers.push(...targeted.blockers);
+                    if (!input.noRollback) {
+                        rollbackAttempted = true;
+                        const rollback = await gitApply(input.cwd, patch, ['apply', '-R', '--whitespace=nowarn', '-']);
+                        rollbackPassed = rollback.code === 0;
+                        finalStatus = rollbackPassed ? 'rolled_back' : 'blocked';
+                        if (!rollbackPassed)
+                            blockers.push(rollback.stderr || rollback.stdout || 'rollback_reverse_patch_failed');
+                    }
+                    else {
+                        finalStatus = 'blocked';
+                    }
+                }
+            }
+            else {
+                blockers.push(applied.stderr || applied.stdout || 'git_apply_failed');
+                if (!input.noRollback) {
+                    rollbackAttempted = true;
+                    const rollback = await gitApply(input.cwd, patch, ['apply', '-R', '--whitespace=nowarn', '-']);
+                    rollbackPassed = rollback.code === 0;
+                    finalStatus = rollbackPassed ? 'rolled_back' : 'blocked';
+                    if (!rollbackPassed)
+                        blockers.push(rollback.stderr || rollback.stdout || 'rollback_reverse_patch_failed');
+                }
+            }
+        }
+    }
+    const postDiff = await gitText(input.cwd, ['diff', '--binary']);
+    const transaction = {
+        schema: 'sks.glm-naruto-apply-transaction.v1',
+        mission_id: input.missionId,
+        selected_patch_ids: input.selectedPatchIds,
+        touched_paths: parsed.touchedPaths,
+        dirty_touched_paths_before_apply: dirtyTouchedPaths,
+        dirty_policy: input.allowDirtyApply ? 'allow' : 'block',
+        pre_status: preStatus,
+        pre_diff_sha256: sha256(preDiff),
+        post_diff_sha256: sha256(postDiff),
+        combined_patch_sha256: sha256(patch),
+        apply_check_passed: applyCheckPassed,
+        apply_passed: applyPassed,
+        targeted_checks_passed: targetedChecksPassed,
+        rollback_attempted: rollbackAttempted,
+        rollback_passed: rollbackPassed,
+        final_status: finalStatus,
+        blockers
+    };
+    await writeJsonAtomic(path.join(input.artifactDir, 'apply-transaction.json'), transaction);
+    await writeJsonAtomic(path.join(input.artifactDir, 'apply-transaction-diff-hashes.json'), {
+        schema: 'sks.glm-naruto-apply-transaction-diff-hashes.v1',
+        mission_id: input.missionId,
+        pre_diff_sha256: sha256(preDiff),
+        post_diff_sha256: sha256(postDiff),
+        combined_patch_sha256: sha256(patch)
+    });
+    return { ok: finalStatus === 'applied', applied: finalStatus === 'applied' ? input.selectedPatchIds : [], patch, transaction };
+}
+function gitText(cwd, args) {
+    return new Promise((resolve) => {
+        const child = spawn('git', [...args], { cwd, stdio: ['ignore', 'pipe', 'ignore'] });
+        let stdout = '';
+        child.stdout.on('data', (chunk) => { stdout += String(chunk); });
+        child.on('close', () => resolve(stdout));
+    });
+}
+async function dirtyPaths(cwd, paths) {
+    if (paths.length === 0)
+        return [];
+    const status = await gitText(cwd, ['status', '--short', '--', ...paths]);
+    return status.split(/\r?\n/)
+        .map((line) => line.trimEnd())
+        .filter(Boolean)
+        .map((line) => {
+        const raw = line.slice(3).trim();
+        return raw.includes(' -> ') ? raw.split(' -> ').pop().trim() : raw;
+    });
+}
+function gitApply(cwd, patch, args) {
+    return new Promise((resolve) => {
+        const child = spawn('git', [...args], { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => { stdout += String(chunk); });
+        child.stderr.on('data', (chunk) => { stderr += String(chunk); });
+        child.on('close', (code) => resolve({ code, stdout, stderr }));
+        child.stdin.end(patch);
+    });
+}
+//# sourceMappingURL=glm-naruto-apply-transaction.js.map

package/dist/core/providers/glm/naruto/glm-naruto-bench.js

@@ -1,21 +1,25 @@
-import { nowIso } from '../../../fsx.js';
+import { nowIso, writeTextAtomic } from '../../../fsx.js';
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import { GLM_52_OPENROUTER_MODEL } from '../glm-52-settings.js';
+import { runGlmDirectSpeedRun } from '../glm-direct-run.js';
 import { resolveOpenRouterApiKey } from '../../openrouter/openrouter-secret-store.js';
 import { runGlmNarutoMission } from './glm-naruto-orchestrator.js';
-export async function runGlmNarutoBench(root, args = []) {
+import { summarizeGlmNarutoWorkerMetrics } from './glm-naruto-metrics.js';
+export async function runGlmNarutoBench(root, args = [], deps = {}) {
     const live = args.includes('--live');
     const execute = args.includes('--execute');
     const started = Date.now();
+    const runDirect = deps.runDirect ?? runGlmDirectSpeedRun;
+    const runNaruto = deps.runNaruto ?? runGlmNarutoMission;
     if (execute && !live) {
         return blocked(root, ['execute_requires_live_flag']);
     }
     if (!live) {
         return {
             schema: 'sks.glm-naruto-bench.v1',
-            version: '4.0.10',
+            version: '4.0.12',
             generated_at: nowIso(),
             status: 'dry_run',
             model: GLM_52_OPENROUTER_MODEL,
@@ -38,9 +42,17 @@ export async function runGlmNarutoBench(root, args = []) {
     await fsp.mkdir(path.join(fixture, 'src'), { recursive: true });
     await fsp.writeFile(path.join(fixture, 'src', 'bench-target.ts'), 'export const value = 1;\n', 'utf8');
     const cases = [];
+    const directStarted = Date.now();
+    const direct = await runDirect({
+        cwd: fixture,
+        task: 'Change src/bench-target.ts so value is 2. Return the smallest patch only.',
+        args: ['--bench', '--live', '--dry-run'],
+        dryRun: true
+    });
+    cases.push(directBenchCase(direct, Date.now() - directStarted));
     for (const workers of [1, 4, 8, 12]) {
         const caseStarted = Date.now();
-        const result = await runGlmNarutoMission({
+        const result = await runNaruto({
             cwd: fixture,
             task: 'Change src/bench-target.ts so value is 2. Return the smallest patch only.',
             args: ['--bench', '--live', '--no-apply'],
@@ -48,23 +60,33 @@ export async function runGlmNarutoBench(root, args = []) {
             maxWorkers: workers,
             noApply: true
         });
+        const traces = await readWorkerTraces(result.artifact_dir);
+        const metrics = summarizeGlmNarutoWorkerMetrics(traces);
         cases.push({
-            name: workers === 1 ? 'direct single GLM' : `GLM Naruto ${workers} workers`,
+            name: `GLM Naruto ${workers} worker${workers === 1 ? '' : 's'}`,
+            kind: 'glm-naruto',
             workers,
             wall_clock_ms: Date.now() - caseStarted,
-            p50_ttft_ms: null,
-            p90_ttft_ms: null,
+            p50_ttft_ms: metrics.p50_ttft_ms,
+            p90_ttft_ms: metrics.p90_ttft_ms,
+            p50_total_ms: metrics.p50_total_ms,
+            p90_total_ms: metrics.p90_total_ms,
             candidate_count: result.patch_candidates,
-            gate_pass_rate: result.patch_candidates ? result.gate_passed_candidates / result.patch_candidates : 0,
-            verifier_pass_rate: 0,
+            gate_pass_rate: result.patch_candidates ? result.gate_passed_candidates / result.patch_candidates : null,
+            verifier_pass_rate: metrics.verifier_pass_rate,
             merge_success: result.mergeable_candidates > 0,
-            cached_tokens: 0,
-            cache_write_tokens: 0
+            cached_tokens_sum: metrics.cached_tokens_sum,
+            cache_write_tokens_sum: metrics.cache_write_tokens_sum,
+            reasoning_tokens_sum: metrics.reasoning_tokens_sum,
+            metric_status: metrics.p50_total_ms === null && metrics.p50_ttft_ms === null ? 'unavailable' : 'measured',
+            workers_completed: metrics.workers_completed,
+            workers_failed: metrics.workers_failed
         });
     }
+    await writeBenchReport(root, cases).catch(() => undefined);
     return {
         schema: 'sks.glm-naruto-bench.v1',
-        version: '4.0.10',
+        version: '4.0.12',
         generated_at: nowIso(),
         status: 'live',
         model: GLM_52_OPENROUTER_MODEL,
@@ -74,17 +96,48 @@ export async function runGlmNarutoBench(root, args = []) {
             simulated_workers: Math.max(...cases.map((row) => row.workers)),
             simulated_waves: cases.length,
             simulated_patch_candidates: cases.reduce((sum, row) => sum + row.candidate_count, 0),
-            simulated_gate_passed: cases.reduce((sum, row) => sum + Math.round(row.candidate_count * row.gate_pass_rate), 0),
+            simulated_gate_passed: cases.reduce((sum, row) => sum + Math.round(row.candidate_count * (row.gate_pass_rate ?? 0)), 0),
             simulated_mergeable: cases.filter((row) => row.merge_success).length,
             wall_clock_ms: Date.now() - started
         },
         warnings: ['live_bench_no_apply_temp_repo']
     };
 }
+async function writeBenchReport(root, cases) {
+    const rows = cases.map((row) => [
+        row.name,
+        row.kind,
+        String(row.workers),
+        String(row.wall_clock_ms),
+        String(row.p50_ttft_ms ?? 'unavailable'),
+        String(row.p90_ttft_ms ?? 'unavailable'),
+        String(row.p50_total_ms ?? 'unavailable'),
+        String(row.p90_total_ms ?? 'unavailable'),
+        String(row.gate_pass_rate ?? 'n/a'),
+        String(row.verifier_pass_rate ?? 'n/a'),
+        String(row.metric_status)
+    ]);
+    const fastest = [...cases].sort((a, b) => a.wall_clock_ms - b.wall_clock_ms)[0] ?? null;
+    const md = [
+        '# GLM Naruto Bench Report',
+        '',
+        `Generated: ${nowIso()}`,
+        `Model: ${GLM_52_OPENROUTER_MODEL}`,
+        '',
+        '| Case | Kind | Workers | Wall ms | TTFT p50 | TTFT p90 | Total p50 | Total p90 | Gate pass | Verifier pass | Metric status |',
+        '| --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | --- |',
+        ...rows.map((row) => `| ${row.join(' | ')} |`),
+        '',
+        `Fastest wall-clock case: ${fastest ? fastest.name : 'unavailable'}`,
+        'Missing usage metrics are reported as `unavailable` or `n/a`, never as fake zero.',
+        ''
+    ].join('\n');
+    await writeTextAtomic(path.join(root, '.sneakoscope', 'glm-naruto', 'bench-report.md'), md);
+}
 function blocked(root, warnings) {
     return {
         schema: 'sks.glm-naruto-bench.v1',
-        version: '4.0.10',
+        version: '4.0.12',
         generated_at: nowIso(),
         status: 'blocked',
         model: GLM_52_OPENROUTER_MODEL,
@@ -100,4 +153,34 @@ function blocked(root, warnings) {
         warnings
     };
 }
+function directBenchCase(result, wallClockMs) {
+    return {
+        name: 'direct GLM speed path',
+        kind: 'direct-glm',
+        workers: 1,
+        wall_clock_ms: wallClockMs,
+        p50_ttft_ms: null,
+        p90_ttft_ms: null,
+        p50_total_ms: null,
+        p90_total_ms: null,
+        candidate_count: result.ok ? 1 : 0,
+        gate_pass_rate: result.ok ? 1 : null,
+        verifier_pass_rate: null,
+        merge_success: result.ok,
+        cached_tokens_sum: null,
+        cache_write_tokens_sum: null,
+        reasoning_tokens_sum: null,
+        metric_status: 'unavailable'
+    };
+}
+async function readWorkerTraces(artifactDir) {
+    if (!artifactDir)
+        return [];
+    try {
+        return JSON.parse(await fsp.readFile(path.join(artifactDir, 'worker-traces.json'), 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
 //# sourceMappingURL=glm-naruto-bench.js.map

package/dist/core/providers/glm/naruto/glm-naruto-command.js

@@ -2,7 +2,6 @@ import { flag, readOption, positionalArgs } from '../../../../cli/args.js';
 import { printJson } from '../../../../cli/output.js';
 import { runGlmNarutoMission } from './glm-naruto-orchestrator.js';
 import { runGlmNarutoBench } from './glm-naruto-bench.js';
-import { resolveOpenRouterApiKey } from '../../openrouter/openrouter-secret-store.js';
 export async function glmNarutoCommand(args = []) {
     if (flag(args, '--bench')) {
         const result = await runGlmNarutoBench(process.cwd(), args);
@@ -36,34 +35,20 @@ export async function glmNarutoCommand(args = []) {
         process.exitCode = 1;
         return result;
     }
-    const key = await resolveOpenRouterApiKey({ env: process.env });
-    if (!key.key) {
-        const result = {
-            schema: 'sks.glm-naruto-result.v1',
-            ok: false,
-            status: 'blocked',
-            mission_id: 'none',
-            task,
-            model: 'z-ai/glm-5.2',
-            gpt_fallback_allowed: false,
-            termination_reason: 'glm_missing_openrouter_key',
-            blockers: ['glm_missing_openrouter_key'],
-            warnings: ['set_OPENROUTER_API_KEY_or_run_sks_--mad_--glm_--repair']
-        };
-        if (flag(args, '--json'))
-            printJson(result);
-        else
-            console.error('GLM Naruto blocked: missing OpenRouter API key. Run: sks --mad --glm --repair');
-        process.exitCode = 1;
-        return result;
-    }
     const maxWorkers = parseInt(readOption(args, '--clones', readOption(args, '--workers', '12')), 10) || 12;
     const deep = flag(args, '--deep');
     const useJudge = flag(args, '--judge');
     const xhighFinalizer = flag(args, '--xhigh-finalizer');
     const useWorktree = flag(args, '--worktree');
     const patchEnvelopeOnly = flag(args, '--patch-envelope-only');
+    const keepWorktrees = flag(args, '--keep-worktrees');
+    const cleanupWorktrees = flag(args, '--cleanup-worktrees') || !keepWorktrees;
+    const allowPatchEnvelopeFallback = flag(args, '--allow-patch-envelope-fallback');
     const noApply = flag(args, '--no-apply');
+    const skipVerifier = flag(args, '--skip-verifier');
+    const allowDirtyApply = flag(args, '--allow-dirty-apply');
+    const noRollback = flag(args, '--no-rollback');
+    const strictChecks = flag(args, '--strict-checks');
     const mergeStrategy = readOption(args, '--merge-strategy', 'deterministic');
     const result = await runGlmNarutoMission({
         cwd: process.cwd(),
@@ -74,7 +59,15 @@ export async function glmNarutoCommand(args = []) {
         useJudge,
         xhighFinalizer,
         useWorktree: useWorktree && !patchEnvelopeOnly,
+        patchEnvelopeOnly,
+        allowPatchEnvelopeFallback,
+        keepWorktrees,
+        cleanupWorktrees,
         noApply: noApply || flag(args, '--dry-run'),
+        skipVerifier,
+        allowDirtyApply,
+        noRollback,
+        strictChecks,
         mergeStrategy
     });
     if (flag(args, '--json')) {

package/dist/core/providers/glm/naruto/glm-naruto-concurrency-governor.js

@@ -2,24 +2,25 @@ import { GLM_NARUTO_DEFAULTS } from './glm-naruto-types.js';
 export function decideConcurrency(input) {
     const maxClones = Math.min(input.operatorMax || GLM_NARUTO_DEFAULTS.max_clones, GLM_NARUTO_DEFAULTS.max_clones);
     const requested = Math.min(input.requestedClones || GLM_NARUTO_DEFAULTS.default_clones, maxClones);
-    if (input.rateLimited429 > 0.05 || input.ttftP90Ms > 15_000) {
+    const active = input.activeWorkers > 0 ? input.activeWorkers : Math.min(requested, GLM_NARUTO_DEFAULTS.safe_active_start);
+    if (input.failureRate > 0.10) {
         return {
-            target_active_workers: Math.max(1, Math.floor(input.activeWorkers * 0.5)),
+            target_active_workers: 0,
             burst_workers: 0,
             backpressure: true,
-            reason: 'scale_down_high_latency_or_rate_limit'
+            reason: 'pause_high_5xx_or_failure_rate'
         };
     }
-    if (input.failureRate > 0.3) {
+    if (input.rateLimited429 > 0 || input.ttftP90Ms > 15_000) {
         return {
-            target_active_workers: Math.max(1, Math.floor(input.activeWorkers * 0.7)),
+            target_active_workers: Math.max(1, Math.floor(active * 0.5)),
             burst_workers: 0,
             backpressure: true,
-            reason: 'scale_down_high_failure_rate'
+            reason: 'scale_down_high_latency_or_rate_limit'
         };
     }
-    if (input.ttftP90Ms < 5_000 && input.rateLimited429 === 0 && input.activeWorkers < requested) {
-        const target = Math.min(requested, input.activeWorkers + Math.max(1, Math.floor(requested * 0.2)));
+    if (input.ttftP90Ms < 5_000 && input.rateLimited429 === 0 && input.failureRate < 0.05 && active < requested) {
+        const target = Math.min(requested, active + 2);
         return {
             target_active_workers: target,
             burst_workers: Math.min(2, requested - target),
@@ -28,7 +29,7 @@ export function decideConcurrency(input) {
         };
     }
     return {
-        target_active_workers: Math.min(input.activeWorkers, requested),
+        target_active_workers: Math.min(active, requested),
         burst_workers: 0,
         backpressure: false,
         reason: 'steady_state'

package/dist/core/providers/glm/naruto/glm-naruto-decomposer.js

@@ -5,9 +5,32 @@ export function decomposeTask(input) {
     const dependencies = [];
     const mutableShardIds = [];
     const verificationShardIds = [];
-    const paths = input.mentionedPaths.length > 0
-        ? input.mentionedPaths
-        : ['src/'];
+    const paths = discoverTargetPaths(input);
+    if (paths.length === 0) {
+        const scoutShard = {
+            id: 'shard-scout-paths',
+            kind: 'verification',
+            task: `Discover target paths before mutation for: ${input.task}`,
+            target_paths: [],
+            forbidden_paths: ['.github/', 'dist/', 'node_modules/'],
+            base_digest: digestBase(input),
+            strategy: 'minimal_patch',
+            patches_per_shard: 0,
+            max_tokens: 2048,
+            reasoning: 'low',
+            mutable: false
+        };
+        return {
+            schema: 'sks.glm-naruto-work-graph.v1',
+            mission_id: input.missionId,
+            task: input.task,
+            shards: [scoutShard],
+            dependencies,
+            parallel_groups: [],
+            mutable_shards: [],
+            verification_shards: [scoutShard.id]
+        };
+    }
     let shardIndex = 0;
     for (const targetPath of paths) {
         const shardId = `shard-${shardIndex}`;
@@ -64,6 +87,33 @@ export function decomposeTask(input) {
         verification_shards: verificationShardIds
     };
 }
+function discoverTargetPaths(input) {
+    const candidates = new Set();
+    for (const mentioned of input.mentionedPaths)
+        candidates.add(mentioned);
+    for (const line of (input.gitStatus || '').split(/\r?\n/)) {
+        const match = line.match(/^\s*(?:[AMDRCU?!]{1,2})\s+(.+)$/);
+        if (!match)
+            continue;
+        const file = match[1].split(/\s+->\s+/).pop().trim();
+        if (isMutableCandidate(file))
+            candidates.add(file);
+    }
+    for (const source of [input.task, input.lastError || '']) {
+        for (const match of source.matchAll(/\b([A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+\.(?:ts|tsx|js|mjs|cjs|json|md|yml|yaml|toml))\b/g)) {
+            if (isMutableCandidate(match[1]))
+                candidates.add(match[1]);
+        }
+    }
+    return [...candidates];
+}
+function isMutableCandidate(file) {
+    return Boolean(file)
+        && !file.startsWith('.github/')
+        && !file.startsWith('dist/')
+        && !file.startsWith('node_modules/')
+        && !file.endsWith('/');
+}
 function classifyShardKind(path) {
     if (path.includes('test') || path.includes('__tests__') || path.includes('.test.'))
         return 'test_fix';
@@ -87,7 +137,7 @@ export function validateWorkGraph(graph, isVerifyOnly) {
         return { ok: true };
     const mutableCount = graph.mutable_shards.length;
     if (mutableCount === 0)
-        return { ok: false, reason: 'glm_naruto_invalid_verify_only_plan' };
+        return { ok: false, reason: 'glm_naruto_needs_target_path_context' };
     // Check ratio of mutable shards to total shards (excluding verification shards from the denominator)
     const totalWorkShards = graph.shards.filter(s => s.mutable || s.kind !== 'verification').length;
     const ratio = totalWorkShards > 0 ? mutableCount / totalWorkShards : 0;

package/dist/core/providers/glm/naruto/glm-naruto-final-seal.js

@@ -0,0 +1,75 @@
+import path from 'node:path';
+import { writeJsonAtomic } from '../../../fsx.js';
+import { GLM_52_OPENROUTER_MODEL } from '../glm-52-settings.js';
+export async function writeGlmNarutoFinalSeal(input) {
+    const mismatches = [
+        ...input.envelopes.filter((env) => env.model !== GLM_52_OPENROUTER_MODEL || env.gpt_fallback_allowed !== false).map((env) => `envelope:${env.worker_id}`),
+        ...input.traces.filter((trace) => trace.model !== GLM_52_OPENROUTER_MODEL).map((trace) => `trace:${trace.worker_id}`)
+    ];
+    const isolationViolations = input.isolationPolicy.selected === 'blocked' ? input.isolationPolicy.blockers : [];
+    const status = finalSealStatus({
+        result: input.result,
+        secretOk: input.secretAudit.ok,
+        mismatches,
+        isolationViolations,
+        queueDrained: input.scheduler.queue_drained
+    });
+    const seal = {
+        schema: 'sks.glm-naruto-final-seal.v1',
+        mission_id: input.missionId,
+        status,
+        model_lock: {
+            model: GLM_52_OPENROUTER_MODEL,
+            gpt_fallback_allowed: false,
+            requests_checked: input.envelopes.length + input.traces.length,
+            mismatches
+        },
+        isolation: {
+            selected: input.isolationPolicy.selected,
+            workers_write_main_workspace: false,
+            violations: isolationViolations
+        },
+        scheduler: {
+            bounded: true,
+            max_observed_active_workers: input.scheduler.max_observed_active_workers,
+            queue_drained: input.scheduler.queue_drained,
+            backpressure_events: input.scheduler.backpressure_events
+        },
+        candidates: {
+            total: input.envelopes.length,
+            gate_passed: input.envelopes.filter((env) => env.status === 'gate_passed').length,
+            verifier_passed: input.envelopes.filter((env) => env.verification_passed === true).length,
+            selected: input.selectedPatchIds
+        },
+        apply: {
+            attempted: input.applyTransaction !== null,
+            transaction_path: input.applyTransaction ? path.join(input.artifactDir, 'apply-transaction.json') : null,
+            final_status: input.applyTransaction?.final_status ?? null,
+            rollback_attempted: input.applyTransaction?.rollback_attempted ?? false,
+            rollback_passed: input.applyTransaction?.rollback_passed ?? null
+        },
+        secret_audit: {
+            ok: input.secretAudit.ok,
+            findings: input.secretAudit.findings ?? []
+        },
+        stop_gate: {
+            path: input.stopGatePath,
+            passed: input.stopGatePassed
+        }
+    };
+    const out = path.join(input.artifactDir, 'final-seal.json');
+    await writeJsonAtomic(out, seal);
+    return { seal, path: out, passed: seal.status === 'passed' };
+}
+function finalSealStatus(input) {
+    if (!input.secretOk || input.mismatches.length > 0 || input.isolationViolations.length > 0 || !input.queueDrained)
+        return 'blocked';
+    if (input.result.ok)
+        return 'passed';
+    if (input.result.status === 'partial_candidates')
+        return 'partial';
+    if (input.result.status === 'blocked')
+        return 'blocked';
+    return 'failed';
+}
+//# sourceMappingURL=glm-naruto-final-seal.js.map

package/dist/core/providers/glm/naruto/glm-naruto-finalizer.js

@@ -15,6 +15,7 @@ export function finalizeMergePlan(input) {
     return planMerge({
         missionId: input.missionId,
         graph: conflictGraph,
+        ...(input.scoreboard ? { scoreboard: input.scoreboard } : {}),
         strategy,
         ...(input.judgeResult ? { judgeRanking: input.judgeResult.ranked_patch_ids } : {})
     });