sneakoscope 4.0.13 → 4.0.15

package/README.md

@@ -35,9 +35,26 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.12** seals GLM Naruto's production runtime path: worktree workers apply extracted unified diffs only, patch workers launch through a bounded adaptive scheduler, live bench compares true direct GLM against Naruto worker counts, final apply runs dirty-tree and targeted-check guards, and stop-gates reference a final seal artifact.
+SKS **4.0.15** prepares the Codex `rust-v0.142.0` compatibility surface while preserving the existing GPT/Codex/MAD `sks --mad` route. The release pins `@openai/codex-sdk` to `0.142.0`, records a Codex release manifest, resolves one Codex binary identity per mission, isolates SDK child environment variables, and restores the published tarball script contract by shipping the verification scripts that package metadata exposes.
 
-What changed in 4.0.12:
+What changed in 4.0.15:
+
+- **Codex 0.142 release manifest.** `rust-v0.142.0`, `codex-cli 0.142.0`, SDK `0.142.0`, generated app-server schema hash, required probes, and supported platforms are captured as a single manifest.
+- **Runtime identity proof.** Codex compatibility now resolves the project/env/PATH binary through one resolver and records realpath, version, SHA-256, package root, platform, and arch.
+- **Safer SDK execution policy.** SDK tasks no longer inherit `process.env` wholesale and no longer hard-code `approvalPolicy: never`, `skipGitRepoCheck: true`, or network access from sandbox mode.
+- **0.142 app-server evidence.** Generated app-server TypeScript and JSON Schema snapshots are stored under versioned paths; app-server-v2 wraps `thread/list`, `thread/read`, list search, and `currentTime/read` handling, while capability gates reject `assumed_by_version` evidence.
+- **Transactional thread registry guard.** Codex thread registration now uses an atomic lock and append-only journal, with a 100-write gate covering concurrent updates and corruption preservation.
+- **Package contract repair.** The npm tarball includes `dist/scripts` verification targets so public package scripts do not point at files excluded from the package.
+
+What changed in 4.0.14:
+
+- **Real stage parallelism evidence.** GLM Naruto records bounded parallel stage timelines, overlap ratios, parallelism summaries, critical-path metrics, and speed diagnosis artifacts.
+- **Parallel gate/verifier/worktree stages.** Candidate gate, worktree materialization, and verifier checks no longer have to run candidate-by-candidate when multiple candidates are available.
+- **Requirement coverage seal.** GLM Naruto writes a requirement ledger and candidate coverage artifacts, and the final seal blocks when required requirements remain uncovered.
+- **MAD route isolation.** `sks --mad` without `--glm` remains the GPT/Codex/MAD route and does not resolve OpenRouter or run GLM-specific benchmark/Naruto code.
+- **Benchmark proof honesty.** GLM benchmark proof now reports request-summary availability separately from case-level model lock checks and fixes the no-mutation proof boolean.
+
+What changed in 4.0.13:
 
 - **Extracted worktree patches.** `--worktree` parses `<sks_patch_candidate>` and records candidate/extracted patch hashes before any worker worktree apply.
 - **Adaptive scheduler.** Patch workers use a finite launch queue with provider-health backpressure and retry-once handling for retryable 429/5xx/idle-timeout failures.

package/config/codex-releases/rust-v0.142.0.json

@@ -0,0 +1,39 @@
+{
+  "schema": "sks.codex-release-manifest.v1",
+  "targetTag": "rust-v0.142.0",
+  "requiredCliVersion": "0.142.0",
+  "sdkVersion": "0.142.0",
+  "minimumSupportedVersion": "0.142.0",
+  "protocolMode": "app-server-v2",
+  "generatedSchemaSha256": "fc3c48943de51865e81c8320876fd5310e9d96bd066fc63b74616d26c0e6dd12",
+  "upstreamCommit": "rust-v0.142.0",
+  "featurePolicies": {
+    "multiAgentMode": "probe",
+    "indexedWebSearch": "probe",
+    "currentTimeRead": "wrap",
+    "threadListSearchRead": "probe",
+    "pluginCatalogRefresh": "probe",
+    "terminalSubagentErrorPropagation": "probe",
+    "execMcpTransientRecovery": "probe",
+    "remoteNativeEnvironment": "probe",
+    "rolloutTokenBudget": "probe"
+  },
+  "requiredRealProbes": [
+    "runtime_identity",
+    "protocol_schema_generation",
+    "multi_agent_mode_schema",
+    "indexed_web_search_schema",
+    "current_time_read_schema",
+    "thread_list_search_schema",
+    "terminal_error_schema",
+    "rollout_budget_schema"
+  ],
+  "supportedPlatforms": [
+    "darwin-arm64",
+    "darwin-x64",
+    "linux-arm64",
+    "linux-x64",
+    "win32-arm64",
+    "win32-x64"
+  ]
+}

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.12"
+version = "4.0.15"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.12"
+version = "4.0.15"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.12"),
+        Some("--version") => println!("sks-rs 4.0.15"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.13';
+const FAST_PACKAGE_VERSION = '4.0.15';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/global-mode-router.js

@@ -6,8 +6,9 @@ export function detectGlobalMode(args = []) {
     const hasGlm = args.includes('--glm');
     if (hasMad && hasGlm)
         return { kind: 'mad-glm', args: stripGlobalModeFlags(args) };
-    if (hasGlm && !hasMad)
+    if (hasGlm && !hasMad && String(args[0]).startsWith('-')) {
         return { kind: 'glm-without-mad', args: stripGlobalModeFlags(args) };
+    }
     return null;
 }
 export function stripGlobalModeFlags(args) {

package/dist/commands/codex.js

@@ -4,6 +4,7 @@ import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compa
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
 import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
+import { detectCodex0142Capability } from '../core/codex-control/codex-0142-capability.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -38,6 +39,19 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
+    if (action === '0.142' || action === '0142' || action === 'rust-v0.142.0') {
+        const result = await detectCodex0142Capability({ requireReal: flag(args, '--require-real') });
+        if (flag(args, '--json'))
+            return printJson(result);
+        console.log(`Codex 0.142 compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
+        for (const blocker of result.blockers || [])
+            console.log(`- blocker: ${blocker}`);
+        for (const warning of result.warnings || [])
+            console.log(`- warning: ${warning}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === 'doctor') {
         const result = await codexDoctorReport();
         if (flag(args, '--json'))
@@ -56,7 +70,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema|0.141 [--json]');
+    console.error('Usage: sks codex compatibility|version|doctor|schema|0.142|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map

package/dist/core/codex-adapter.js

@@ -1,19 +1,14 @@
 import path from 'node:path';
-import { exists, packageRoot, runProcess, which } from './fsx.js';
+import { runProcess } from './fsx.js';
 import { forceGpt55CodexArgs } from './codex-model-guard.js';
 import { managedProxyEnvForChild } from './codex/managed-proxy-env.js';
+import { resolveCodexRuntime } from './codex-runtime/resolve-codex-runtime.js';
 export async function findCodexBinary() {
-    const env = process.env.SKS_CODEX_BIN || process.env.DCODEX_CODEX_BIN || process.env.CODEX_BIN;
-    if (env && await exists(env))
-        return env;
-    const global = await which('codex');
-    if (global)
-        return global;
-    const root = packageRoot();
-    const local = path.join(root, 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex');
-    if (await exists(local))
-        return local;
-    return null;
+    const resolved = await resolveCodexRuntime({
+        explicitPath: process.env.DCODEX_CODEX_BIN || null,
+        requestedBy: 'codex-adapter'
+    });
+    return resolved.identity?.realpath || null;
 }
 export async function codexVersion(bin) {
     if (!bin)

package/dist/core/codex-compat/codex-compat-report.js

@@ -1,6 +1,7 @@
 import { projectRoot } from '../fsx.js';
 import { codexVersionReport } from './codex-version.js';
 import { CODEX_COMPAT_SCHEMA, CODEX_HOOK_SCHEMA_BASELINE_TAG, CODEX_REQUIRED_BASELINE_TAG } from './codex-version-policy.js';
+import { codexReleaseManifestParity } from './codex-release-manifest.js';
 import { codexSchemaSnapshotReport } from './codex-schema-snapshot.js';
 import { codexHookWarningCheck } from './codex-hook-warning-detector.js';
 import { codex0133Matrix } from './codex-0-133.js';
@@ -11,6 +12,14 @@ import { collectCodex0136LocalEvidence, codex0136Matrix } from '../codex/codex-0
 export async function codexCompatibilityReport(opts = {}) {
     const root = opts.root || await projectRoot();
     const version = await codexVersionReport(opts);
+    const releaseManifest = await codexReleaseManifestParity(root).catch((err) => ({
+        ok: false,
+        mismatches: ['manifest_load_failed'],
+        manifest: null,
+        manifest_path: null,
+        manifest_sha256: null,
+        error: err?.message || String(err)
+    }));
     const snapshot = await codexSchemaSnapshotReport();
     const hooks = await codexHookWarningCheck(root, { recordWrongness: false });
     const outputSchema = await detectCodexExecResumeOutputSchema(opts).catch((err) => ({
@@ -80,10 +89,11 @@ export async function codexCompatibilityReport(opts = {}) {
         available: version.detected?.available,
         execResumeHelp: outputSchema.output_schema_supported ? '--output-schema' : ''
     });
-    const ok = Boolean(version.policy.ok && snapshot.ok && hooks.ok && matrix0136.ok && matrix0135.ok && matrix0134.ok);
+    const ok = Boolean(version.policy.ok && releaseManifest.ok && snapshot.ok && hooks.ok && matrix0136.ok && matrix0135.ok && matrix0134.ok);
     return {
         schema: CODEX_COMPAT_SCHEMA,
         required_baseline: opts.requiredBaseline || opts.require || CODEX_REQUIRED_BASELINE_TAG,
+        release_manifest: releaseManifest,
         detected: version.detected,
         hooks_schema: {
             snapshot: CODEX_HOOK_SCHEMA_BASELINE_TAG,

package/dist/core/codex-compat/codex-release-manifest.js

@@ -0,0 +1,66 @@
+import path from 'node:path';
+import { packageRoot, readJson, readText, sha256 } from '../fsx.js';
+export const CODEX_RELEASE_MANIFEST_SCHEMA = 'sks.codex-release-manifest.v1';
+export const CURRENT_CODEX_RELEASE_MANIFEST = {
+    schema: CODEX_RELEASE_MANIFEST_SCHEMA,
+    targetTag: 'rust-v0.142.0',
+    requiredCliVersion: '0.142.0',
+    sdkVersion: '0.142.0',
+    minimumSupportedVersion: '0.142.0',
+    protocolMode: 'app-server-v2',
+    generatedSchemaSha256: 'fc3c48943de51865e81c8320876fd5310e9d96bd066fc63b74616d26c0e6dd12',
+    upstreamCommit: 'rust-v0.142.0',
+    featurePolicies: {
+        multiAgentMode: 'probe',
+        indexedWebSearch: 'probe',
+        currentTimeRead: 'wrap',
+        threadListSearchRead: 'probe',
+        pluginCatalogRefresh: 'probe',
+        terminalSubagentErrorPropagation: 'probe',
+        execMcpTransientRecovery: 'probe',
+        remoteNativeEnvironment: 'probe',
+        rolloutTokenBudget: 'probe'
+    },
+    requiredRealProbes: [
+        'runtime_identity',
+        'protocol_schema_generation',
+        'multi_agent_mode_schema',
+        'indexed_web_search_schema',
+        'current_time_read_schema',
+        'thread_list_search_schema',
+        'terminal_error_schema',
+        'rollout_budget_schema'
+    ],
+    supportedPlatforms: [
+        'darwin-arm64',
+        'darwin-x64',
+        'linux-arm64',
+        'linux-x64',
+        'win32-arm64',
+        'win32-x64'
+    ]
+};
+export function currentCodexReleaseManifestPath(root = packageRoot()) {
+    return path.join(root, 'config', 'codex-releases', `${CURRENT_CODEX_RELEASE_MANIFEST.targetTag}.json`);
+}
+export async function loadCurrentCodexReleaseManifest(root = packageRoot()) {
+    return await readJson(currentCodexReleaseManifestPath(root));
+}
+export async function codexReleaseManifestParity(root = packageRoot()) {
+    const file = await loadCurrentCodexReleaseManifest(root);
+    const mismatches = [];
+    for (const key of Object.keys(CURRENT_CODEX_RELEASE_MANIFEST)) {
+        if (JSON.stringify(file[key]) !== JSON.stringify(CURRENT_CODEX_RELEASE_MANIFEST[key])) {
+            mismatches.push(String(key));
+        }
+    }
+    const text = await readText(currentCodexReleaseManifestPath(root));
+    return {
+        ok: mismatches.length === 0,
+        mismatches,
+        manifest: file,
+        manifest_path: currentCodexReleaseManifestPath(root),
+        manifest_sha256: sha256(text)
+    };
+}
+//# sourceMappingURL=codex-release-manifest.js.map

package/dist/core/codex-compat/codex-version-policy.js

@@ -1,8 +1,9 @@
+import { CURRENT_CODEX_RELEASE_MANIFEST } from './codex-release-manifest.js';
 export const CODEX_COMPAT_SCHEMA = 'sks.codex-compat.v2';
-export const CODEX_REQUIRED_BASELINE_TAG = 'rust-v0.136.0';
-export const CODEX_REQUIRED_VERSION = '0.136.0';
-export const CODEX_HOOK_SCHEMA_BASELINE_TAG = 'latest';
-export const CODEX_HOOK_SCHEMA_VERSION = 'main-2026-06-01';
+export const CODEX_REQUIRED_BASELINE_TAG = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
+export const CODEX_REQUIRED_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+export const CODEX_HOOK_SCHEMA_BASELINE_TAG = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
+export const CODEX_HOOK_SCHEMA_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
 export function compareSemverLike(a, b) {
     const pa = parseVersionParts(a);
     const pb = parseVersionParts(b);

package/dist/core/codex-compat/codex-version.js

@@ -1,9 +1,12 @@
 import { runProcess, which } from '../fsx.js';
+import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
 import { codexVersionPolicy, parseCodexVersionText } from './codex-version-policy.js';
 export async function detectCodexVersion(opts = {}) {
-    const codexBin = opts.codexBin || await which('codex').catch(() => null);
+    const runtime = await resolveCodexRuntime({ explicitPath: opts.codexBin || null, requestedBy: 'codex-version-report' }).catch(() => null);
+    const codexBin = runtime?.identity?.realpath || opts.codexBin || await which('codex').catch(() => null);
     if (codexBin) {
-        const fromVersion = await detectFromCommand(codexBin, ['--version'], 'codex --version', opts);
+        const source = runtime?.identity ? `codex runtime ${runtime.identity.source}` : 'codex --version';
+        const fromVersion = await detectFromCommand(codexBin, ['--version'], source, opts);
         if (fromVersion.version)
             return fromVersion;
         const fromHelp = await detectFromCommand(codexBin, ['--help'], 'codex --help', opts);

package/dist/core/codex-control/codex-0142-capability.js

@@ -0,0 +1,243 @@
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { compareSemverLike } from '../codex-compat/codex-version-policy.js';
+import { ensureDir, nowIso, runProcess, sha256, writeJsonAtomic } from '../fsx.js';
+import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
+export const CODEX_0142_FEATURE_KEYS = [
+    'runtime_identity',
+    'protocol_schema_generation',
+    'multi_agent_mode_schema',
+    'rollout_budget_schema',
+    'indexed_web_search_schema',
+    'current_time_read_schema',
+    'native_thread_list_search_schema',
+    'plugin_catalog_refresh_schema',
+    'terminal_subagent_error_schema',
+    'exec_mcp_reconnect_schema',
+    'remote_native_environment_schema',
+    'app_server_overload_schema'
+];
+export async function detectCodex0142Capability(input = {}) {
+    if (process.env.SKS_CODEX_0142_FAKE === '1')
+        return fakeCapability();
+    const root = input.root || process.cwd();
+    const runtime = await resolveCodexRuntime({
+        explicitPath: input.codexBin || null,
+        requestedBy: 'codex-0142-capability'
+    });
+    if (!runtime.identity) {
+        return blockedCapability('blocked', null, null, [...runtime.blockers]);
+    }
+    const versionOk = compareSemverLike(runtime.identity.version, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0;
+    const schemaProbe = await generateSchemaProbe(root, runtime.identity.realpath);
+    const appServerClientText = await fsp.readFile(path.join(root, 'src', 'core', 'codex-control', 'codex-app-server-v2-client.ts'), 'utf8').catch(() => '');
+    const states = featureStatesFromSchema(schemaProbe.text, schemaProbe.ok, appServerClientText);
+    const blockers = [
+        ...(versionOk ? [] : ['codex_0_142_required']),
+        ...(schemaProbe.ok ? [] : ['codex_0142_schema_generation_failed']),
+        ...Object.values(states).flatMap((state) => state.blockers)
+    ];
+    const realEnough = blockers.length === 0
+        && schemaProbe.sha256 !== null
+        && CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256 !== 'pending-generated-schema'
+        && schemaProbe.sha256 === CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256
+        && Object.values(states).every((state) => state.certainty === 'actual' || state.certainty === 'discovered');
+    return {
+        schema: 'sks.codex-0142-capability.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        release_authorizing: realEnough,
+        target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
+        required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        runtime_identity: runtime.identity,
+        generated_schema_sha256: schemaProbe.sha256,
+        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
+        probe_mode: schemaProbe.ok ? 'real-schema' : 'blocked',
+        feature_states: states,
+        blockers,
+        warnings: [
+            ...(realEnough ? [] : ['codex_0142_not_release_authorizing_until_schema_hash_and_all_required_real_probes_match']),
+            ...(input.requireReal && blockers.length ? ['required_real_probe_blocked'] : [])
+        ]
+    };
+}
+export async function writeCodex0142CapabilityArtifacts(root, input = {}) {
+    const probeInput = { root };
+    if (input.codexBin !== undefined)
+        probeInput.codexBin = input.codexBin || null;
+    if (input.requireReal !== undefined)
+        probeInput.requireReal = input.requireReal;
+    const report = await detectCodex0142Capability(probeInput);
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex', 'codex-0142-capability.json');
+    await writeJsonAtomic(rootArtifact, report);
+    let missionArtifact = null;
+    if (input.missionId) {
+        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0142-capability.json');
+        await writeJsonAtomic(missionArtifact, report);
+    }
+    return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
+}
+function featureStatesFromSchema(schemaText, schemaOk, appServerClientText = '') {
+    const lower = schemaText.toLowerCase();
+    const actual = (key, needles) => {
+        const found = schemaOk && needles.every((needle) => lower.includes(needle.toLowerCase()));
+        return {
+            supported: found,
+            certainty: found ? 'actual' : schemaOk ? 'unverified' : 'failed',
+            evidence: found ? needles.map((needle) => `generated_schema_contains:${needle}`) : [],
+            blockers: found ? [] : [`codex_0142_${key}_not_verified`]
+        };
+    };
+    return {
+        runtime_identity: {
+            supported: true,
+            certainty: 'actual',
+            evidence: ['runtime_identity_realpath_version_sha256'],
+            blockers: []
+        },
+        protocol_schema_generation: {
+            supported: schemaOk,
+            certainty: schemaOk ? 'actual' : 'failed',
+            evidence: schemaOk ? ['codex_app_server_generate_json_schema'] : [],
+            blockers: schemaOk ? [] : ['codex_app_server_schema_generation_failed']
+        },
+        multi_agent_mode_schema: actual('multi_agent_mode_schema', ['MultiAgentMode']),
+        rollout_budget_schema: actual('rollout_budget_schema', ['budgetLimited']),
+        indexed_web_search_schema: actual('indexed_web_search_schema', ['indexed']),
+        current_time_read_schema: currentTimeState(lower, schemaOk, appServerClientText),
+        native_thread_list_search_schema: actual('native_thread_list_search_schema', ['thread/list', 'ThreadSearchResult', 'thread/read']),
+        plugin_catalog_refresh_schema: actual('plugin_catalog_refresh_schema', ['plugin/list', 'plugin/install', 'AppListUpdatedNotification']),
+        terminal_subagent_error_schema: actual('terminal_subagent_error_schema', ['subagentStart', 'subagentStop', 'error']),
+        exec_mcp_reconnect_schema: actual('exec_mcp_reconnect_schema', ['mcp']),
+        remote_native_environment_schema: actual('remote_native_environment_schema', ['remote']),
+        app_server_overload_schema: actual('app_server_overload_schema', ['JSONRPCError'])
+    };
+}
+function currentTimeState(schemaTextLower, schemaOk, appServerClientText) {
+    const schemaHasCurrentTime = schemaOk && schemaTextLower.includes('currenttime') && schemaTextLower.includes('read');
+    if (schemaHasCurrentTime) {
+        return {
+            supported: true,
+            certainty: 'actual',
+            evidence: ['generated_schema_contains:currentTime/read'],
+            blockers: []
+        };
+    }
+    const clientHandlesCurrentTime = appServerClientText.includes('currentTime/read') && appServerClientText.includes('currentTimeResponse');
+    return {
+        supported: clientHandlesCurrentTime,
+        certainty: clientHandlesCurrentTime ? 'discovered' : schemaOk ? 'unverified' : 'failed',
+        evidence: clientHandlesCurrentTime ? ['sks_app_server_v2_client_handles:currentTime/read'] : [],
+        blockers: clientHandlesCurrentTime ? [] : ['codex_0142_current_time_read_handler_not_verified']
+    };
+}
+async function generateSchemaProbe(root, codexBin) {
+    const out = path.join(os.tmpdir(), `sks-codex-0142-schema-${process.pid}-${Date.now()}`);
+    await ensureDir(out);
+    const result = await runProcess(codexBin, ['app-server', 'generate-json-schema', '--out', out], {
+        cwd: root,
+        timeoutMs: 60_000,
+        maxOutputBytes: 256 * 1024
+    }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err instanceof Error ? err.message : String(err),
+        stdoutBytes: 0,
+        stderrBytes: 0,
+        truncated: false,
+        timedOut: false
+    }));
+    if (result.code !== 0)
+        return { ok: false, text: `${result.stdout}\n${result.stderr}`, sha256: null };
+    const files = await listFiles(out);
+    const rows = await Promise.all(files.map(async (file) => {
+        const text = await fsp.readFile(file, 'utf8');
+        return {
+            relative: path.relative(out, file),
+            text,
+            canonicalText: canonicalSchemaContent(file, text)
+        };
+    }));
+    const joined = rows.map((row) => `${row.relative}\n${row.text}`).join('\n');
+    const canonicalJoined = rows.map((row) => `${row.relative}\n${row.canonicalText}`).join('\n');
+    await fsp.rm(out, { recursive: true, force: true }).catch(() => { });
+    return { ok: true, text: joined, sha256: sha256(canonicalJoined) };
+}
+function canonicalSchemaContent(file, text) {
+    if (!file.endsWith('.json'))
+        return text;
+    try {
+        return JSON.stringify(sortJsonKeys(JSON.parse(text)));
+    }
+    catch {
+        return text;
+    }
+}
+function sortJsonKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortJsonKeys);
+    if (!value || typeof value !== 'object')
+        return value;
+    const record = value;
+    return Object.fromEntries(Object.keys(record).sort().map((key) => [key, sortJsonKeys(record[key])]));
+}
+async function listFiles(dir) {
+    const out = [];
+    for (const entry of await fsp.readdir(dir, { withFileTypes: true })) {
+        const absolute = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...await listFiles(absolute));
+        else if (entry.isFile())
+            out.push(absolute);
+    }
+    return out.sort();
+}
+function blockedCapability(probeMode, runtime, schemaSha, blockers) {
+    const state = Object.fromEntries(CODEX_0142_FEATURE_KEYS.map((key) => [key, {
+            supported: false,
+            certainty: 'failed',
+            evidence: [],
+            blockers
+        }]));
+    return {
+        schema: 'sks.codex-0142-capability.v1',
+        generated_at: nowIso(),
+        ok: false,
+        release_authorizing: false,
+        target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
+        required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        runtime_identity: runtime,
+        generated_schema_sha256: schemaSha,
+        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
+        probe_mode: probeMode,
+        feature_states: state,
+        blockers,
+        warnings: []
+    };
+}
+function fakeCapability() {
+    const state = Object.fromEntries(CODEX_0142_FEATURE_KEYS.map((key) => [key, {
+            supported: true,
+            certainty: 'hermetic_fixture',
+            evidence: [`fixture:${key}`],
+            blockers: []
+        }]));
+    return {
+        schema: 'sks.codex-0142-capability.v1',
+        generated_at: nowIso(),
+        ok: true,
+        release_authorizing: false,
+        target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
+        required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        runtime_identity: null,
+        generated_schema_sha256: 'fixture',
+        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
+        probe_mode: 'hermetic-fixture',
+        feature_states: state,
+        blockers: [],
+        warnings: ['fixture_capability_is_not_release_authorizing']
+    };
+}
+//# sourceMappingURL=codex-0142-capability.js.map