sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/core-skill-card-schema-check.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:card-schema
+// Proves the Core Skill Card is read-only external state, that the checked-in
+// schema matches the runtime contract, and that an optimizer candidate can never
+// overwrite a deployed snapshot in place.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root, readJson } from './sks-1-18-gate-lib.js';
+const cardMod = await importDist('core/skills/core-skill-card.js');
+const typesMod = await importDist('core/skills/core-skill-types.js');
+const deployMod = await importDist('core/skills/core-skill-deployment.js');
+const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
+const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-card-schema-'));
+const promotionContract = createRequestedScopeContract({
+    route: 'core-skill-card-schema',
+    userRequest: 'release gate fixture skill promotion',
+    projectRoot: tempRoot,
+    overrides: { skill_snapshot_promotion: true }
+});
+// 1) A fresh candidate is structurally valid and read-only.
+const candidate = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 0, body: BODY });
+const shape = cardMod.validateCardShape(candidate);
+assertGate(shape.ok, 'candidate card must pass validateCardShape', shape);
+assertGate(candidate.status === 'candidate', 'fresh card status must be candidate', { status: candidate.status });
+assertGate(candidate.deployment_snapshot === false, 'candidate must not be a deployment snapshot', candidate);
+assertGate(candidate.side_effect_scope.read_only === true, 'candidate card must be read_only', candidate.side_effect_scope);
+assertGate(candidate.side_effect_scope.allowed_mutations.length === 0, 'candidate card must grant zero mutations', candidate.side_effect_scope);
+// 2) The checked-in schema parses and its const matches the runtime schema id.
+const cardSchema = readJson('schemas/skills/core-skill-card.schema.json');
+assertGate(cardSchema.properties?.schema?.const === typesMod.CORE_SKILL_CARD_SCHEMA, 'card schema const must match CORE_SKILL_CARD_SCHEMA', { const: cardSchema.properties?.schema?.const, expected: typesMod.CORE_SKILL_CARD_SCHEMA });
+// 3) Negative invariants.
+const notReadOnly = { ...candidate, side_effect_scope: { allowed_mutations: [], read_only: false } };
+const notReadOnlyShape = cardMod.validateCardShape(notReadOnly);
+assertGate(notReadOnlyShape.ok === false && notReadOnlyShape.blockers.includes('card_not_read_only'), 'read_only=false card must be blocked by card_not_read_only', notReadOnlyShape);
+const grantsMutations = { ...candidate, side_effect_scope: { allowed_mutations: ['x'], read_only: true } };
+const grantsShape = cardMod.validateCardShape(grantsMutations);
+assertGate(grantsShape.ok === false && grantsShape.blockers.includes('card_grants_mutations'), 'allowed_mutations card must be blocked by card_grants_mutations', grantsShape);
+const badDeployed = { ...candidate, status: 'deployed', deployment_snapshot: false };
+const badDeployedShape = cardMod.validateCardShape(badDeployed);
+assertGate(badDeployedShape.ok === false && badDeployedShape.blockers.includes('deployed_card_not_snapshot'), 'deployed card without snapshot flag must be blocked', badDeployedShape);
+// 4) A deployed snapshot cannot be overwritten by an optimizer candidate.
+//    The deployed snapshot lives in deployed.json; a candidate is a SEPARATE file.
+const accepted = { ...candidate, status: 'accepted' };
+const promotion = await deployMod.promoteToDeployedWithLedger(tempRoot, accepted, { contract: promotionContract, context: 'release' });
+assertGate(promotion.ok === true, 'ledger promotion must succeed for an accepted card', promotion);
+const deployedBefore = await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'demo-skill');
+assertGate(deployedBefore && deployedBefore.status === 'deployed' && deployedBefore.deployment_snapshot === true, 'loadDeployedSnapshot must return a deployed snapshot', deployedBefore);
+// Saving a candidate with the same skill_id must NOT touch deployed.json.
+const sneakyCandidate = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 9, body: '## Goal\nOverwrite me.\n' });
+await cardMod.saveCard(tempRoot, sneakyCandidate);
+const deployedAfter = await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'demo-skill');
+assertGate(deployedAfter && deployedAfter.status === 'deployed' && deployedAfter.deployment_snapshot === true, 'deployed snapshot must remain deployed after saving a candidate', deployedAfter);
+assertGate(deployedAfter.body === deployedBefore.body, 'deployed snapshot body must be unchanged by candidate save', { before: deployedBefore.body, after: deployedAfter.body });
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-card-schema-check.json'), `${JSON.stringify({ gate: 'core-skill:card-schema', candidate_ok: shape.ok, schema_const: cardSchema.properties?.schema?.const, deployed_protected: deployedAfter.body === deployedBefore.body }, null, 2)}\n`);
+fs.rmSync(tempRoot, { recursive: true, force: true });
+emitGate('core-skill:card-schema', { candidate_read_only: true, schema_const: cardSchema.properties?.schema?.const, deployed_snapshot_immutable: true });
+//# sourceMappingURL=core-skill-card-schema-check.js.map

package/dist/scripts/core-skill-deployment-snapshot-check.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:deployment-snapshot
+// Proves deployed snapshots are immutable (a changed body needs a higher version),
+// the previous snapshot is archived for rollback, rollback restores it, and only an
+// accepted card may be promoted.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const cardMod = await importDist('core/skills/core-skill-card.js');
+const deployMod = await importDist('core/skills/core-skill-deployment.js');
+const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
+const ROUTE = 'DFix';
+const SKILL = 'demo-skill';
+const BODY_V1 = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
+const BODY_V2 = '## Goal\nDo the task carefully.\n\n## Verification\nCheck output twice.\n\n## Rollback\nRevert on failure.\n';
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-deploy-'));
+const promotionContract = createRequestedScopeContract({
+    route: 'core-skill-deployment-snapshot',
+    userRequest: 'release gate fixture skill promotion',
+    projectRoot: tempRoot,
+    overrides: { skill_snapshot_promotion: true }
+});
+// 1) Promote an accepted card to a deployed snapshot.
+const acceptedV1 = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 0, body: BODY_V1 }), status: 'accepted' };
+const promoteV1 = await deployMod.promoteToDeployedWithLedger(tempRoot, acceptedV1, { contract: promotionContract, context: 'release' });
+assertGate(promoteV1.ok === true, 'promoting an accepted card must succeed', promoteV1);
+assertGate(promoteV1.snapshot && promoteV1.snapshot.status === 'deployed' && promoteV1.snapshot.deployment_snapshot === true, 'snapshot must be deployed + flagged', promoteV1.snapshot);
+// 2) Immutability: a changed body at version <= existing must be rejected.
+const changedSameVersion = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 0, body: BODY_V2 }), status: 'accepted' };
+assertGate(changedSameVersion.version === acceptedV1.version, 'changed-body card must share the existing version for this check', { changed: changedSameVersion.version, existing: acceptedV1.version });
+const promoteSame = await deployMod.promoteToDeployedWithLedger(tempRoot, changedSameVersion, { contract: promotionContract, context: 'release' });
+assertGate(promoteSame.ok === false && promoteSame.blockers.includes('snapshot_changed_without_version_increment'), 'changed body without version bump must be rejected', promoteSame);
+// 3) A changed body at a HIGHER version succeeds, archives the previous snapshot.
+const acceptedV2 = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 1, body: BODY_V2 }), status: 'accepted' };
+assertGate(acceptedV2.version > acceptedV1.version, 'v2 must have a higher version than v1', { v2: acceptedV2.version, v1: acceptedV1.version });
+const promoteV2 = await deployMod.promoteToDeployedWithLedger(tempRoot, acceptedV2, { contract: promotionContract, context: 'release' });
+assertGate(promoteV2.ok === true, 'higher-version changed snapshot must promote', promoteV2);
+assertGate(typeof promoteV2.archived_path === 'string' && promoteV2.archived_path.length > 0, 'previous snapshot must be archived', promoteV2);
+const hasRollback = await deployMod.hasRollbackSnapshot(tempRoot, ROUTE, SKILL);
+assertGate(hasRollback === true, 'a rollback snapshot must exist after a version bump', { hasRollback });
+// 4) Rollback restores the previous (v1) snapshot.
+const rolled = await deployMod.rollbackDeployment(tempRoot, ROUTE, SKILL);
+assertGate(rolled.ok === true && rolled.restored_version === acceptedV1.version, 'rollback must restore the previous version', rolled);
+// 5) Promotion requires accepted status.
+const candidate = cardMod.createCandidateCard({ skillId: 'other-skill', route: ROUTE, baseVersion: 0, body: BODY_V1 });
+const promoteCandidate = await deployMod.promoteToDeployedWithLedger(tempRoot, candidate, { contract: promotionContract, context: 'release' });
+assertGate(promoteCandidate.ok === false && promoteCandidate.blockers.includes('promote_requires_accepted_status'), 'a candidate card must not be promotable', promoteCandidate);
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-deployment-snapshot-check.json'), `${JSON.stringify({ gate: 'core-skill:deployment-snapshot', restored_version: rolled.restored_version, archived_path: Boolean(promoteV2.archived_path) }, null, 2)}\n`);
+fs.rmSync(tempRoot, { recursive: true, force: true });
+emitGate('core-skill:deployment-snapshot', { immutable_without_version_bump: true, archived_on_bump: true, rollback_restores_previous: rolled.restored_version === acceptedV1.version, promote_requires_accepted: true });
+//# sourceMappingURL=core-skill-deployment-snapshot-check.js.map

package/dist/scripts/core-skill-heldout-validation-check.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:heldout-validation
+// Proves strict held-out acceptance: a candidate is accepted ONLY on strict
+// held-out improvement with no safety regression, train-only gains are rejected,
+// and rejected patches are buffered so the same failed edit is not retried.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const validationMod = await importDist('core/skills/core-skill-validation.js');
+const bufferMod = await importDist('core/skills/rejected-skill-patch-buffer.js');
+const baseInput = {
+    baselineHeldout: 0.76,
+    candidateHeldout: 0.82,
+    sideEffectZero: true,
+    requestedScopeCompliant: true,
+    proofCompletenessBaseline: 1,
+    proofCompletenessCandidate: 1,
+    rollbackReadyBaseline: 1,
+    rollbackReadyCandidate: 1,
+    latencyBaselineMs: 1000,
+    latencyCandidateMs: 1100
+};
+// 1) Accept on strict improvement with no regression.
+const acceptRes = validationMod.validateHeldout(baseInput);
+assertGate(acceptRes.accept === true && acceptRes.reason === 'strict_improvement', 'strict improvement must be accepted', acceptRes);
+// 2) Held-out not improved -> reject.
+const notImproved = validationMod.validateHeldout({ ...baseInput, candidateHeldout: 0.74 });
+assertGate(notImproved.accept === false && notImproved.reason === 'heldout_not_improved', 'non-improving held-out must be rejected', notImproved);
+// 3) Train-improves-but-held-out-worse maps to heldout_not_improved.
+//    (Held-out is the only acceptance signal; a worse held-out is rejected regardless of train gains.)
+const trainGainHeldoutWorse = validationMod.validateHeldout({ ...baseInput, candidateHeldout: 0.70 });
+assertGate(trainGainHeldoutWorse.accept === false && trainGainHeldoutWorse.reason === 'heldout_not_improved', 'train-gain/held-out-worse must reject as heldout_not_improved', trainGainHeldoutWorse);
+// 4) Side-effect violation with improved held-out -> reject.
+const sideEffect = validationMod.validateHeldout({ ...baseInput, sideEffectZero: false });
+assertGate(sideEffect.accept === false && sideEffect.reason === 'side_effect_zero_failed', 'side-effect failure must reject as side_effect_zero_failed', sideEffect);
+// 5) Rejected-patch buffer dedupes by hash.
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-heldout-'));
+await bufferMod.recordRejectedPatch(tempRoot, { skill_id: 's', base_version: 3, patch_hash: 'abc', reason: 'heldout_not_improved', score_delta: -0.03 });
+const knownRejected = await bufferMod.isPatchRejected(tempRoot, 'abc');
+const unknownRejected = await bufferMod.isPatchRejected(tempRoot, 'zzz');
+assertGate(knownRejected === true, 'recorded patch hash must be reported as rejected', { knownRejected });
+assertGate(unknownRejected === false, 'unknown patch hash must not be reported as rejected', { unknownRejected });
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-heldout-validation-check.json'), `${JSON.stringify({ gate: 'core-skill:heldout-validation', accept_delta: acceptRes.score_delta, reject_reasons: [notImproved.reason, trainGainHeldoutWorse.reason, sideEffect.reason] }, null, 2)}\n`);
+fs.rmSync(tempRoot, { recursive: true, force: true });
+emitGate('core-skill:heldout-validation', { accept_strict_improvement: true, heldout_not_improved_rejected: true, side_effect_rejected: true, rejected_buffer_dedupes: knownRejected && !unknownRejected });
+//# sourceMappingURL=core-skill-heldout-validation-check.js.map

package/dist/scripts/core-skill-immutable-sync-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
+import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+const root = await makeTempRoot('sks-core-immutable-');
+const skillsRoot = path.join(root, '.agents', 'skills');
+const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+assertGate(first.installed.length === 8, 'first immutable sync must install missing managed core skills', first);
+const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+assertGate(second.installed.length === 0 && second.restored.length === 0, 'second immutable sync must be idempotent', second);
+await writeText(path.join(skillsRoot, 'loop', 'SKILL.md'), `${renderCoreSkillTemplate('loop')}\ncorruption\n`);
+const restored = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+const loopText = await fs.readFile(path.join(skillsRoot, 'loop', 'SKILL.md'), 'utf8');
+assertGate(restored.restored.length === 1 && loopText === renderCoreSkillTemplate('loop'), 'corrupted managed core skill must restore exactly', restored);
+emitGate('core-skill:immutable-sync', { installed: first.installed.length, restored: restored.restored.length });
+//# sourceMappingURL=core-skill-immutable-sync-check.js.map

package/dist/scripts/core-skill-integrity-blackbox.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
+import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { initProject } from '../core/init.js';
+const root = await makeTempRoot('sks-core-blackbox-');
+const skillsRoot = path.join(root, '.agents', 'skills');
+const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+await writeText(path.join(skillsRoot, 'research', 'SKILL.md'), `${renderCoreSkillTemplate('research')}\nmutated\n`);
+const third = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+const restoredText = await fs.readFile(path.join(skillsRoot, 'research', 'SKILL.md'), 'utf8');
+const userRoot = path.join(root, 'user-skills');
+await writeUserSkill(root, 'user-skills', 'research', 'research');
+const user = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot: userRoot });
+const setupRoot = await makeTempRoot('sks-core-setup-blackbox-');
+const setup = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
+const setupIntegrity = await syncCoreSkillsIntegrity({ root: setupRoot, apply: false, skillsRoot: path.join(setupRoot, '.agents', 'skills') });
+await writeText(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md'), `${renderCoreSkillTemplate('loop')}\nmutated by setup blackbox\n`);
+const setupRestore = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
+const restoredSetupText = await fs.readFile(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md'), 'utf8');
+assertGate(first.installed.length === 8, 'blackbox A: first sync installs missing core skills', first);
+assertGate(second.installed.length === 0 && second.restored.length === 0, 'blackbox B: second sync changes nothing', second);
+assertGate(third.restored.length === 1 && restoredText === renderCoreSkillTemplate('research'), 'blackbox C: managed drift restored exactly', third);
+assertGate(user.skipped_user_authored.length === 1, 'blackbox D: user skill is not overwritten', user);
+assertGate(setup.skill_install?.core_skill_integrity?.installed_count > 0, 'blackbox E: setup installs core skills through integrity sync', setup.skill_install);
+assertGate(setupIntegrity.restored.length === 0 && setupIntegrity.skipped_user_authored.length === 0, 'blackbox F: setup-produced core skills are current', setupIntegrity);
+assertGate(setupRestore.skill_install?.core_skill_integrity?.restored_count > 0 && restoredSetupText === renderCoreSkillTemplate('loop'), 'blackbox G: setup restores managed core drift through integrity sync', setupRestore.skill_install);
+emitGate('core-skill:integrity-blackbox');
+//# sourceMappingURL=core-skill-integrity-blackbox.js.map

package/dist/scripts/core-skill-manifest-check.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { assertGate, emitGate } from './sks-3-1-8-check-lib.js';
+import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { sha256 } from '../core/fsx.js';
+const manifest = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z');
+assertGate(manifest.schema === 'sks.core-skill-manifest.v1', 'manifest schema mismatch', manifest);
+assertGate(manifest.skills.length === 8, 'manifest must list eight immutable core skills', manifest.skills.map((skill) => skill.canonical_name));
+assertGate(CORE_SKILL_TEMPLATE_VERSION === 'sks-core-skill-template.v1', 'core skill template version must be content-schema based, not package-version based', { CORE_SKILL_TEMPLATE_VERSION });
+for (const skill of manifest.skills) {
+    const content = renderCoreSkillTemplate(skill.canonical_name);
+    assertGate(sha256(content) === skill.content_sha256, `content hash mismatch for ${skill.canonical_name}`, skill);
+    assertGate(skill.mutable_by_doctor === false && skill.mutable_by_setup === false && skill.mutable_by_update === false, 'core skill mutability flags must be false', skill);
+}
+emitGate('core-skill:manifest', { skills: manifest.skills.length });
+//# sourceMappingURL=core-skill-manifest-check.js.map

package/dist/scripts/core-skill-no-drift-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
+import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { sha256 } from '../core/fsx.js';
+const root = await makeTempRoot('sks-core-no-drift-');
+const skillsRoot = path.join(root, '.agents', 'skills');
+const manifest = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z');
+await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+for (const skill of manifest.skills) {
+    const text = await fs.readFile(path.join(skillsRoot, skill.canonical_name, 'SKILL.md'), 'utf8');
+    assertGate(sha256(text) === skill.content_sha256, `rendered core skill drifted: ${skill.canonical_name}`, skill);
+}
+await writeText(path.join(skillsRoot, 'qa-loop', 'SKILL.md'), `${renderCoreSkillTemplate('qa-loop')}\n# drift\n`);
+const restored = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
+assertGate(restored.restored.length === 1, 'managed drift must be restored', restored);
+const userRoot = path.join(root, 'user-skills');
+await writeUserSkill(root, 'user-skills', 'loop', 'loop');
+const user = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot: userRoot });
+assertGate(user.skipped_user_authored.length === 1, 'user-authored same-name core skill must be preserved', user);
+emitGate('core-skill:no-drift', { skills: manifest.skills.length });
+//# sourceMappingURL=core-skill-no-drift-check.js.map

package/dist/scripts/core-skill-no-inference-optimizer-check.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:no-inference-optimizer
+// Proves the optimizer NEVER runs in deployment/inference context: deployed-snapshot
+// reads are allowed and carry route proof (skill id/version/hash), while any
+// optimizer/epoch call throws a SkillDeploymentViolationError. Out of context the
+// optimizer works normally.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const cardMod = await importDist('core/skills/core-skill-card.js');
+const runtimeMod = await importDist('core/skills/core-skill-runtime.js');
+const deployMod = await importDist('core/skills/core-skill-deployment.js');
+const epochMod = await importDist('core/skills/core-skill-epoch.js');
+const traceMod = await importDist('core/skills/core-rollout-trace.js');
+const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-no-opt-'));
+const card = cardMod.createCandidateCard({ skillId: 'x', route: 'DFix', baseVersion: 0, body: BODY });
+const trace = traceMod.createRolloutTrace({ route: 'DFix', backend: 'fake', proof_artifacts: [], rollback_ready: false, requested_scope_compliant: true, latency_ms: 1000, failure_reason: null });
+// Enter deployment / inference context.
+deployMod.setDeploymentContext(true);
+process.env.SKS_SKILL_DEPLOYMENT_CONTEXT = '1';
+assertGate(deployMod.isDeploymentContext() === true, 'deployment context must be active', { active: deployMod.isDeploymentContext() });
+// 1) Deployment reads are allowed and never throw.
+let selection = null;
+let readThrew = false;
+try {
+    await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'x');
+    selection = await runtimeMod.selectRouteSkill(tempRoot, 'DFix', 'x');
+}
+catch {
+    readThrew = true;
+}
+assertGate(readThrew === false, 'deployment-path reads must not throw in deployment context', { readThrew });
+assertGate(selection !== null, 'selectRouteSkill must return a selection', { selection });
+assertGate(selection.source === 'fallback' || selection.source === 'deployed', 'selection source must be fallback or deployed', selection);
+// 2) Route proof record: no optimizer invocation, and skill id/version/hash keys present (Task 4.7).
+const proof = runtimeMod.skillProofRecord(selection);
+assertGate(proof.optimizer_invoked === false, 'route proof must show optimizer was not invoked', proof);
+assertGate('skill_id' in proof && 'version' in proof && 'hash' in proof, 'route proof must include skill_id/version/hash keys', proof);
+// 3) Optimizer calls are forbidden in deployment context.
+let proposeThrew = null;
+try {
+    epochMod.proposeSkillPatch(card, [trace]);
+}
+catch (err) {
+    proposeThrew = err;
+}
+assertGate(proposeThrew !== null && proposeThrew.name === 'SkillDeploymentViolationError', 'proposeSkillPatch must throw SkillDeploymentViolationError in deployment context', { name: proposeThrew?.name });
+let epochThrew = null;
+try {
+    await epochMod.runSkillEpoch(tempRoot, { card, trainTraces: [trace], validation: { baselineHeldout: 0.5, candidateHeldout: 0.6, sideEffectZero: true, requestedScopeCompliant: true, proofCompletenessBaseline: 0, proofCompletenessCandidate: 1, rollbackReadyBaseline: 0, rollbackReadyCandidate: 1, latencyBaselineMs: 1000, latencyCandidateMs: 1000 } });
+}
+catch (err) {
+    epochThrew = err;
+}
+assertGate(epochThrew !== null && epochThrew.name === 'SkillDeploymentViolationError', 'runSkillEpoch must throw SkillDeploymentViolationError in deployment context', { name: epochThrew?.name });
+// 4) Reset: out of deployment context the optimizer works (does not throw).
+deployMod.setDeploymentContext(false);
+delete process.env.SKS_SKILL_DEPLOYMENT_CONTEXT;
+assertGate(deployMod.isDeploymentContext() === false, 'deployment context must be cleared', { active: deployMod.isDeploymentContext() });
+let proposeOk = true;
+try {
+    epochMod.proposeSkillPatch(card, [trace]);
+}
+catch {
+    proposeOk = false;
+}
+assertGate(proposeOk === true, 'proposeSkillPatch must not throw out of deployment context', { proposeOk });
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-no-inference-optimizer-check.json'), `${JSON.stringify({ gate: 'core-skill:no-inference-optimizer', source: selection.source, optimizer_invoked: proof.optimizer_invoked, proof_keys: Object.keys(proof) }, null, 2)}\n`);
+fs.rmSync(tempRoot, { recursive: true, force: true });
+emitGate('core-skill:no-inference-optimizer', { deployment_read_allowed: true, optimizer_forbidden_in_deployment: true, route_proof_has_id_version_hash: 'skill_id' in proof && 'version' in proof && 'hash' in proof, optimizer_runs_out_of_context: proposeOk });
+//# sourceMappingURL=core-skill-no-inference-optimizer-check.js.map

package/dist/scripts/core-skill-patch-check.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:patch
+// Proves a SkillPatch edits ONLY the single skill document within the textual
+// learning-rate budget, and rejects budget overruns, external/code targets, and
+// cross-skill (multi-doc) edits.
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root, readJson } from './sks-1-18-gate-lib.js';
+const cardMod = await importDist('core/skills/core-skill-card.js');
+const patchMod = await importDist('core/skills/core-skill-patch.js');
+const applyMod = await importDist('core/skills/core-skill-patch-apply.js');
+const typesMod = await importDist('core/skills/core-skill-types.js');
+const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
+// Base card at version N (createCandidateCard from baseVersion 2 -> version 3).
+const baseCard = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 2, body: BODY });
+const N = baseCard.version;
+// 1) Valid patch within budget: one small add to the verification section.
+const validPatch = {
+    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
+    skill_id: 'demo-skill',
+    base_version: N,
+    operations: [{ op: 'add', target: 'section:verification', text: '- Confirm exit code is zero.' }],
+    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
+};
+const validRes = patchMod.validatePatch(validPatch, baseCard);
+assertGate(validRes.ok === true, 'valid in-budget patch must pass validatePatch', validRes);
+const applied = applyMod.applyPatch(baseCard, validPatch);
+assertGate(applied.ok === true, 'valid patch must apply', applied);
+assertGate(applied.candidate && applied.candidate.body !== baseCard.body, 'applied patch must change the candidate body', { changed: applied.candidate?.body !== baseCard.body });
+assertGate(applied.before_hash !== applied.after_hash, 'applied patch must change the body hash', { before: applied.before_hash, after: applied.after_hash });
+// 2) Budget overrun: add text longer than max_added_chars.
+const overPatch = {
+    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
+    skill_id: 'demo-skill',
+    base_version: N,
+    operations: [{ op: 'add', target: 'section:verification', text: 'x'.repeat(50) }],
+    textual_learning_rate: { max_added_chars: 10, max_deleted_chars: 400, max_replaced_chars: 600 }
+};
+const overRes = patchMod.validatePatch(overPatch, baseCard);
+assertGate(overRes.ok === false && overRes.blockers.includes('budget_added_chars_exceeded'), 'over-budget add must be blocked by budget_added_chars_exceeded', overRes);
+// 3) Code/external target reject.
+const externalPatch = {
+    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
+    skill_id: 'demo-skill',
+    base_version: N,
+    operations: [{ op: 'add', target: 'section:../../src/evil.ts', text: 'pwned' }],
+    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
+};
+const externalRes = patchMod.validatePatch(externalPatch, baseCard);
+const externalBlocked = externalRes.ok === false && externalRes.blockers.some((b) => b.startsWith('patch_target_is_external') || b.startsWith('patch_target_invalid'));
+assertGate(externalBlocked, 'external/code target must be rejected', externalRes);
+const filePatch = {
+    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
+    skill_id: 'demo-skill',
+    base_version: N,
+    operations: [{ op: 'add', target: 'file:src/x.ts', text: 'pwned' }],
+    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
+};
+const fileRes = patchMod.validatePatch(filePatch, baseCard);
+const fileBlocked = fileRes.ok === false && fileRes.blockers.some((b) => b.startsWith('patch_target_is_external') || b.startsWith('patch_target_invalid'));
+assertGate(fileBlocked, 'file:-targeted patch must be rejected', fileRes);
+// 4) Multi-doc / other-skill reject (same base_version so the only difference is skill_id).
+const otherSkillPatch = {
+    schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
+    skill_id: 'a-different-skill',
+    base_version: N,
+    operations: [{ op: 'add', target: 'section:verification', text: '- hi' }],
+    textual_learning_rate: { max_added_chars: 800, max_deleted_chars: 400, max_replaced_chars: 600 }
+};
+const otherRes = patchMod.validatePatch(otherSkillPatch, baseCard);
+assertGate(otherRes.ok === false && otherRes.blockers.includes('patch_targets_other_skill'), 'patch for another skill must be blocked by patch_targets_other_skill', otherRes);
+// 5) Checked-in patch schema parses and const matches the runtime contract.
+const patchSchema = readJson('schemas/skills/core-skill-patch.schema.json');
+assertGate(patchSchema.properties?.schema?.const === typesMod.CORE_SKILL_PATCH_SCHEMA, 'patch schema const must match CORE_SKILL_PATCH_SCHEMA', { const: patchSchema.properties?.schema?.const, expected: typesMod.CORE_SKILL_PATCH_SCHEMA });
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-patch-check.json'), `${JSON.stringify({ gate: 'core-skill:patch', valid_added_chars: validRes.added_chars, schema_const: patchSchema.properties?.schema?.const }, null, 2)}\n`);
+emitGate('core-skill:patch', { valid_patch_applies: applied.ok, budget_enforced: true, external_target_rejected: externalBlocked && fileBlocked, other_skill_rejected: true });
+//# sourceMappingURL=core-skill-patch-check.js.map

package/dist/scripts/core-skill-promotion-side-effect-ledger-check.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// core-skill:promotion-side-effect-ledger (1.20.2 Area 3.3).
+//
+// Proves release-owned skill snapshot promotion is recorded in the mutation
+// ledger as a 'skill_snapshot_promotion' entry with a backup/rollback pointer,
+// and that ledger write failure blocks deployment instead of succeeding.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const { createCandidateCard, routeSkillId } = await importDist('core/skills/core-skill-card.js');
+const { promoteToDeployedWithLedger, promoteToDeployedLegacyForCompatibility } = await importDist('core/skills/core-skill-deployment.js');
+const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
+const { mutationLedgerPath } = await importDist('core/safety/mutation-ledger.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-promo-'));
+const route = '$DFix';
+const skillId = routeSkillId(route);
+const contract = createRequestedScopeContract({
+    route: 'skill-promotion', userRequest: 'deploy accepted skill', projectRoot: root,
+    overrides: { skill_snapshot_promotion: true }
+});
+// First deploy (no previous snapshot → no backup, uses no_op reason).
+const c1 = { ...createCandidateCard({ skillId, route, baseVersion: 0, body: 'v1 body' }), status: 'accepted' };
+const p1 = await promoteToDeployedWithLedger(root, c1, { contract, context: 'release' });
+assertGate(p1.ok === true, 'first promotion must succeed', { p1 });
+// Second deploy (higher version) → archives previous as the rollback pointer.
+const c2 = { ...createCandidateCard({ skillId, route, baseVersion: 1, body: 'v2 body' }), status: 'accepted' };
+const p2 = await promoteToDeployedWithLedger(root, c2, { contract, context: 'release' });
+assertGate(p2.ok === true, 'second promotion must succeed', { p2 });
+assertGate(typeof p2.archived_path === 'string' && p2.archived_path.length > 0, 'second promotion must produce a rollback pointer (archived_path)', { p2 });
+// Ledger must contain skill_snapshot_promotion entries, none in violation, the
+// versioned one carrying the archived backup_path.
+const ledgerText = fs.readFileSync(mutationLedgerPath(root), 'utf8');
+const entries = ledgerText.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+const promotions = entries.filter((e) => e.kind === 'skill_snapshot_promotion');
+assertGate(promotions.length >= 2, 'each promotion must be recorded in the mutation ledger', { count: promotions.length });
+assertGate(promotions.every((e) => e.violation === false), 'in-scope confirmed promotions must not be violations', { promotions });
+assertGate(promotions.some((e) => e.backup_path && /deployed-history/.test(String(e.backup_path))), 'a promotion entry must reference the archived rollback pointer', { promotions });
+// Release-owned ledger failure must block the deployment and roll back the pointer.
+const ledgerFailureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-promo-ledgerfail-'));
+const ledgerBlocker = path.join(ledgerFailureRoot, 'not-a-dir');
+fs.writeFileSync(ledgerBlocker, 'block ledger directory creation');
+const cFail = { ...createCandidateCard({ skillId, route, baseVersion: 0, body: 'ledger fail body' }), status: 'accepted' };
+const pFail = await promoteToDeployedWithLedger(ledgerFailureRoot, cFail, { contract, context: 'release', ledgerRoot: ledgerBlocker });
+assertGate(pFail.ok === false && pFail.blockers.some((b) => String(b).startsWith('promotion_ledger_write_failed')), 'ledger write failure must hard-fail release promotion', { pFail });
+assertGate(!fs.existsSync(path.join(ledgerFailureRoot, '.sneakoscope', 'skills', routeSkillId(route), skillId, 'deployed.json')), 'failed first deployment must not leave deployed snapshot behind', { pFail });
+// Regression: explicit legacy wrapper remains available only for compatibility fixtures.
+const fresh = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-promo-2arg-'));
+const c3 = { ...createCandidateCard({ skillId, route, baseVersion: 0, body: 'b' }), status: 'accepted' };
+const p3 = await promoteToDeployedLegacyForCompatibility(fresh, c3);
+assertGate(p3.ok === true && p3.snapshot !== null, 'legacy compatibility promotion must still return ok', { p3 });
+assertGate(!fs.existsSync(mutationLedgerPath(fresh)), 'legacy compatibility promotion must not write a ledger', {});
+fs.rmSync(root, { recursive: true, force: true });
+fs.rmSync(fresh, { recursive: true, force: true });
+fs.rmSync(ledgerFailureRoot, { recursive: true, force: true });
+emitGate('core-skill:promotion-side-effect-ledger', {
+    promotions: promotions.length,
+    rollback_pointer: true,
+    two_arg_safe: true,
+    ledger_failure_hard_fail: true,
+    legacy_wrapper_safe: true
+});
+//# sourceMappingURL=core-skill-promotion-side-effect-ledger-check.js.map

package/dist/scripts/core-skill-rollout-scoring-check.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:rollout-scoring
+// Proves the rollout scorer rewards proof + zero side effects, treats a
+// requested-scope/side-effect violation as a hard fail, and persists a score report.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root, exists } from './sks-1-18-gate-lib.js';
+const traceMod = await importDist('core/skills/core-rollout-trace.js');
+const scorerMod = await importDist('core/skills/core-skill-scorer.js');
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-rollout-score-'));
+// 1) Clean rollout: proof present, no side effects, rollback ready, scope compliant.
+const cleanTrace = traceMod.createRolloutTrace({
+    route: 'DFix',
+    backend: 'fake',
+    prompt: 'fix the bug',
+    proof_artifacts: ['p.json'],
+    side_effect_ledger: [],
+    rollback_ready: true,
+    requested_scope_compliant: true,
+    latency_ms: 1000,
+    failure_reason: null
+});
+const cleanScore = scorerMod.scoreRollout(cleanTrace);
+assertGate(cleanScore.score > 0, 'clean rollout score must be positive', cleanScore);
+assertGate(cleanScore.side_effect_violation === false, 'clean rollout must not be a side-effect violation', cleanScore);
+assertGate(cleanScore.components.proof_completeness === 1, 'clean rollout proof_completeness must be 1', cleanScore.components);
+assertGate(cleanScore.components.side_effect_zero === 1, 'clean rollout side_effect_zero must be 1', cleanScore.components);
+// 2) Side-effect violation: out-of-scope global write is a HARD fail.
+const violationTrace = traceMod.createRolloutTrace({
+    route: 'DFix',
+    backend: 'fake',
+    prompt: 'fix the bug',
+    proof_artifacts: ['p.json'],
+    side_effect_ledger: ['global_config_write'],
+    rollback_ready: true,
+    requested_scope_compliant: false,
+    latency_ms: 1000,
+    failure_reason: null
+});
+const violationScore = scorerMod.scoreRollout(violationTrace);
+assertGate(violationScore.side_effect_violation === true, 'out-of-scope rollout must flag side_effect_violation', violationScore);
+assertGate(violationScore.score < 0, 'side-effect violation must drive score negative (hard fail)', violationScore);
+// 3) Proof-less success scores lower (proof_completeness 0).
+const prooflessTrace = traceMod.createRolloutTrace({
+    route: 'DFix',
+    backend: 'fake',
+    prompt: 'fix the bug',
+    proof_artifacts: [],
+    side_effect_ledger: [],
+    rollback_ready: true,
+    requested_scope_compliant: true,
+    latency_ms: 1000,
+    failure_reason: null
+});
+const prooflessScore = scorerMod.scoreRollout(prooflessTrace);
+assertGate(prooflessScore.components.proof_completeness === 0, 'proof-less rollout proof_completeness must be 0', prooflessScore.components);
+assertGate(prooflessScore.score < cleanScore.score, 'proof-less rollout must score lower than clean rollout', { proofless: prooflessScore.score, clean: cleanScore.score });
+// 4) Baseline vs candidate aggregate comparison.
+const cleanAgg = scorerMod.scoreRollouts([cleanTrace]);
+const prooflessAgg = scorerMod.scoreRollouts([prooflessTrace]);
+assertGate(cleanAgg.score > prooflessAgg.score, 'aggregate clean score must beat aggregate proof-less score', { clean: cleanAgg.score, proofless: prooflessAgg.score });
+// 5) Persist the score report and confirm the artifact exists under a temp root.
+const writtenPath = await scorerMod.writeRolloutScore(tempRoot, cleanScore);
+assertGate(fs.existsSync(writtenPath), 'writeRolloutScore must create the report file', { writtenPath });
+assertGate(fs.existsSync(path.join(tempRoot, '.sneakoscope', 'reports', 'core-skill-rollout-score.json')), 'report must live at .sneakoscope/reports/core-skill-rollout-score.json', { tempRoot });
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-rollout-scoring-check.json'), `${JSON.stringify({ gate: 'core-skill:rollout-scoring', clean_score: cleanScore.score, violation_score: violationScore.score, proofless_score: prooflessScore.score }, null, 2)}\n`);
+fs.rmSync(tempRoot, { recursive: true, force: true });
+emitGate('core-skill:rollout-scoring', { clean_score: cleanScore.score, violation_hard_fail: violationScore.score < 0, proofless_lower: prooflessScore.score < cleanScore.score, report_written: exists('.sneakoscope/reports/core-skill-rollout-scoring-check.json') });
+//# sourceMappingURL=core-skill-rollout-scoring-check.js.map

package/dist/scripts/core-skill-route-runtime-integration-check.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// core-skill:route-runtime-integration (1.20.2 Area 3.1).
+//
+// Proves the route runtime reads the deployed Core Skill snapshot and records it
+// in proof: (1) selectRouteSkill returns source:'deployed' + optimizer_invoked:false
+// for a deployed snapshot, (2) a missing snapshot is a graceful 'fallback' with a
+// warning (route still runs), and (3) the agent-proof-evidence builder emits the
+// selected_core_skill field.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const { createCandidateCard, routeSkillId } = await importDist('core/skills/core-skill-card.js');
+const { promoteToDeployedWithLedger } = await importDist('core/skills/core-skill-deployment.js');
+const { selectRouteSkill, skillProofRecord } = await importDist('core/skills/core-skill-runtime.js');
+const { createRequestedScopeContract } = await importDist('core/safety/requested-scope-contract.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-skill-rt-'));
+const route = '$Agent';
+const skillId = routeSkillId(route);
+const promotionContract = createRequestedScopeContract({
+    route: 'core-skill-route-runtime-integration',
+    userRequest: 'release gate fixture skill promotion',
+    projectRoot: root,
+    overrides: { skill_snapshot_promotion: true }
+});
+// Missing snapshot → graceful fallback.
+const missing = await selectRouteSkill(root, route, skillId);
+assertGate(missing.source === 'fallback', 'missing snapshot must be a graceful fallback', { missing });
+assertGate(typeof missing.warning === 'string' && missing.warning.length > 0, 'missing snapshot must carry a warning', { missing });
+// Deploy a snapshot, then select it.
+const candidate = createCandidateCard({ skillId, route, baseVersion: 0, body: 'Route skill body.' });
+const accepted = { ...candidate, status: 'accepted' };
+const promoted = await promoteToDeployedWithLedger(root, accepted, { contract: promotionContract, context: 'release' });
+assertGate(promoted.ok === true, 'ledger promotion must succeed', { promoted });
+const selection = await selectRouteSkill(root, route, skillId);
+assertGate(selection.source === 'deployed', 'deployed snapshot must be selected', { selection });
+assertGate(typeof selection.instruction === 'string', 'deployed selection must carry an instruction fragment', { selection });
+const proof = skillProofRecord(selection);
+assertGate(proof.optimizer_invoked === false, 'route skill selection must never invoke the optimizer', { proof });
+assertGate(proof.skill_id === skillId && typeof proof.hash === 'string', 'proof record must carry skill_id + hash', { proof });
+// The agent-proof-evidence builder must surface a selected_core_skill field.
+const evidenceSource = fs.readFileSync(path.join(process.cwd(), 'src/core/agents/agent-proof-evidence.ts'), 'utf8');
+assertGate(/selected_core_skill\s*:/.test(evidenceSource), 'agent-proof-evidence must emit selected_core_skill', {});
+const orchestratorSource = fs.readFileSync(path.join(process.cwd(), 'src/core/agents/agent-orchestrator.ts'), 'utf8');
+assertGate(/selectRouteSkill\(/.test(orchestratorSource) && /selectedCoreSkill/.test(orchestratorSource), 'orchestrator must wire selectRouteSkill into the proof', {});
+fs.rmSync(root, { recursive: true, force: true });
+emitGate('core-skill:route-runtime-integration', { route, skill_id: skillId, deployed_selected: true, fallback_graceful: true });
+//# sourceMappingURL=core-skill-route-runtime-integration-check.js.map