sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/core-skill-trainer-check.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// GATE: core-skill:trainer-loop
+// Proves the SkillOpt training loop (rollout → reflect → aggregate → select →
+// strict held-out gate → meta-update): a deficient rollout batch yields an
+// accepted bounded edit, lessons already covered yield no proposal, a
+// non-improving evaluator is rejected and decays the textual learning rate,
+// meta-update is clamped to [min, default], and the loop is forbidden in a
+// deployment context. The best held-out card is exported as best-skill.json.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const trainerMod = await importDist('core/skills/core-skill-trainer.js');
+const metaMod = await importDist('core/skills/core-skill-meta-update.js');
+const reflectionMod = await importDist('core/skills/core-skill-reflection.js');
+const cardMod = await importDist('core/skills/core-skill-card.js');
+const deploymentMod = await importDist('core/skills/core-skill-deployment.js');
+const epochMod = await importDist('core/skills/core-skill-epoch.js');
+const typesMod = await importDist('core/skills/core-skill-types.js');
+const baseCard = cardMod.createCandidateCard({
+    skillId: 'trainer-fixture',
+    route: 'team',
+    baseVersion: 0,
+    body: '# Skill\n\n## method\n- Do the task.\n'
+});
+const deficientTrace = {
+    schema: typesMod.CORE_ROLLOUT_TRACE_SCHEMA,
+    route: 'team',
+    prompt: 'fixture',
+    skill_id: baseCard.skill_id,
+    skill_version: baseCard.version,
+    backend: 'fake',
+    proof_artifacts: [],
+    gate_results: [],
+    side_effect_ledger: [],
+    latency_ms: 100,
+    failure_reason: null,
+    rollback_ready: false,
+    requested_scope_compliant: true
+};
+// 1) Reflection: a proof-less, rollback-weak rollout yields both deficiency dimensions.
+const reflections = reflectionMod.reflectOnTrace(deficientTrace);
+const dims = reflections.map((r) => r.dimension);
+assertGate(dims.includes('proof_completeness') && dims.includes('rollback_ready'), 'reflection must flag proof and rollback deficiencies', dims);
+// 2) Selection skips lessons the card already covers.
+const coveredCard = { ...baseCard, body: `${baseCard.body}\n- Always emit a proof artifact before reporting success.\n- Record a rollback-ready checkpoint before mutating anything.\n` };
+const coveredOps = reflectionMod.selectPatchOperations(coveredCard, reflectionMod.aggregateReflections(reflections), epochMod.DEFAULT_TEXTUAL_LEARNING_RATE);
+assertGate(coveredOps.length === 0, 'covered lessons must not be re-proposed', coveredOps);
+// 3) Training run with an improving held-out evaluator: epoch 0 accepts, epoch 1 has nothing left to propose.
+const improvingEvaluator = (card) => ({
+    heldout: 0.5 + (/proof artifact/i.test(card.body) ? 0.2 : 0) + (/rollback/i.test(card.body) ? 0.1 : 0),
+    sideEffectZero: true,
+    requestedScopeCompliant: true,
+    proofCompleteness: 1,
+    rollbackReady: 1,
+    latencyMs: 1000
+});
+const rootA = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-trainer-a-'));
+const runA = await trainerMod.trainSkill(rootA, {
+    card: baseCard,
+    epochs: [[deficientTrace], [deficientTrace]],
+    evaluateHeldout: improvingEvaluator
+});
+assertGate(runA.epochs[0].accepted === true && runA.epochs[0].reason === 'strict_improvement', 'deficient batch with improving held-out must be accepted', runA.epochs[0]);
+assertGate(runA.epochs[1].accepted === false && runA.epochs[1].reason === 'no_proposal', 'epoch after all lessons applied must yield no_proposal', runA.epochs[1]);
+assertGate(runA.accepted_count === 1 && runA.best_heldout > runA.baseline_heldout, 'best held-out must strictly improve over baseline', runA);
+assertGate(runA.best.version > baseCard.version, 'accepted training must bump the skill version', { best: runA.best.version, base: baseCard.version });
+assertGate(fs.existsSync(runA.report_path) && fs.existsSync(runA.best_skill_path), 'training report and best-skill artifact must exist', runA);
+const report = JSON.parse(fs.readFileSync(runA.report_path, 'utf8'));
+assertGate(report.schema === trainerMod.CORE_SKILL_TRAINING_REPORT_SCHEMA && report.accepted_count === 1, 'training report schema/accepted_count must match', report);
+// 4) Non-improving evaluator: rejected as heldout_not_improved and the learning rate decays epoch-wise.
+const flatEvaluator = () => ({ heldout: 0.5, sideEffectZero: true, requestedScopeCompliant: true, proofCompleteness: 1, rollbackReady: 1, latencyMs: 1000 });
+const rootB = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-trainer-b-'));
+const runB = await trainerMod.trainSkill(rootB, {
+    card: baseCard,
+    epochs: [[deficientTrace], [deficientTrace]],
+    evaluateHeldout: flatEvaluator
+});
+assertGate(runB.epochs[0].accepted === false && runB.epochs[0].reason === 'heldout_not_improved', 'flat held-out must be rejected', runB.epochs[0]);
+assertGate(runB.epochs[1].learning_rate.max_added_chars === Math.round(epochMod.DEFAULT_TEXTUAL_LEARNING_RATE.max_added_chars * metaMod.META_UPDATE_DECAY), 'rejection must decay the textual learning rate for the next epoch', runB.epochs[1]);
+assertGate(runB.accepted_count === 0 && runB.best.version === baseCard.version, 'no acceptance must leave the base card as best', runB);
+// 5) Meta-update clamps: repeated decay floors at MIN; growth caps at DEFAULT.
+let rate = { ...epochMod.DEFAULT_TEXTUAL_LEARNING_RATE };
+for (let i = 0; i < 10; i += 1)
+    rate = metaMod.metaUpdateLearningRate(rate, 'rejected');
+assertGate(rate.max_added_chars === metaMod.MIN_TEXTUAL_LEARNING_RATE.max_added_chars, 'repeated decay must floor at MIN_TEXTUAL_LEARNING_RATE', rate);
+for (let i = 0; i < 10; i += 1)
+    rate = metaMod.metaUpdateLearningRate(rate, 'accepted');
+assertGate(rate.max_added_chars === epochMod.DEFAULT_TEXTUAL_LEARNING_RATE.max_added_chars, 'repeated growth must cap at DEFAULT_TEXTUAL_LEARNING_RATE', rate);
+// 6) The trainer is forbidden in a deployment context.
+deploymentMod.setDeploymentContext(true);
+let deploymentBlocked = false;
+try {
+    await trainerMod.trainSkill(rootA, { card: baseCard, epochs: [[deficientTrace]], evaluateHeldout: improvingEvaluator });
+}
+catch (err) {
+    deploymentBlocked = err instanceof deploymentMod.SkillDeploymentViolationError || /deployment/i.test(String(err?.message));
+}
+finally {
+    deploymentMod.setDeploymentContext(false);
+}
+assertGate(deploymentBlocked, 'trainSkill must throw in deployment context', { deploymentBlocked });
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'core-skill-trainer-check.json'), `${JSON.stringify({ gate: 'core-skill:trainer-loop', accepted_epoch_reason: runA.epochs[0].reason, exhausted_reason: runA.epochs[1].reason, rejected_reason: runB.epochs[0].reason, decayed_max_added_chars: runB.epochs[1].learning_rate.max_added_chars, deployment_blocked: deploymentBlocked }, null, 2)}\n`);
+fs.rmSync(rootA, { recursive: true, force: true });
+fs.rmSync(rootB, { recursive: true, force: true });
+emitGate('core-skill:trainer-loop', {
+    reflect_aggregate_select: true,
+    strict_heldout_acceptance: runA.epochs[0].accepted,
+    no_proposal_when_covered: runA.epochs[1].reason === 'no_proposal',
+    rejection_decays_learning_rate: true,
+    meta_update_clamped: true,
+    deployment_blocked: deploymentBlocked
+});
+//# sourceMappingURL=core-skill-trainer-check.js.map

package/dist/scripts/dfix-fast-blackbox-check.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { emitGate } from './sks-1-12-real-execution-check-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-fast-blackbox-'));
+fs.mkdirSync(path.join(root, '.sneakoscope'), { recursive: true });
+fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({
+    private: true,
+    type: 'module',
+    scripts: {
+        test: 'node test.mjs',
+        'test:unit': 'node test.mjs',
+        'dfix:fixture': 'node test.mjs',
+        'dfix:verification': 'node test.mjs'
+    }
+}, null, 2));
+fs.writeFileSync(path.join(root, 'value.js'), 'export const value = "bad";\n');
+fs.writeFileSync(path.join(root, 'test.mjs'), 'import { value } from "./value.js"; if (value !== "good") throw new Error("expected good");\n');
+const sks = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
+const env = { ...process.env, SKS_DISABLE_UPDATE_CHECK: '1' };
+const diagnose = run(root, sks, ['dfix', 'diagnose', 'fix value', '--file', 'value.js', '--error', 'AssertionError: expected good at value.js:1', '--json'], env);
+const mission = JSON.parse(diagnose.stdout).mission_id;
+const patch = run(root, sks, ['dfix', 'patch', mission, '--file', 'value.js', '--find', 'bad', '--replace', 'good', '--apply', '--json'], env);
+const verify = run(root, sks, ['dfix', 'verify', mission, '--command', 'node test.mjs', '--verify-auto', '--json'], env);
+const ok = diagnose.status === 0 && patch.status === 0 && verify.status === 0 && fs.readFileSync(path.join(root, 'value.js'), 'utf8').includes('"good"');
+console.log(JSON.stringify({ schema: 'sks.dfix-fast-blackbox-check.v1', ok, mission_id: mission, root }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+else
+    emitGate('dfix:blackbox-fast', { mission_id: mission });
+function run(cwd, bin, args, env) {
+    return spawnSync(process.execPath, [bin, ...args], { cwd, env, encoding: 'utf8', timeout: 30_000 });
+}
+//# sourceMappingURL=dfix-fast-blackbox-check.js.map

package/dist/scripts/dfix-fast-kernel-check.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('dfix:fast-kernel', 'src/core/dfix.ts', [
+    'DFIX_ERROR_SIGNATURE_ARTIFACT',
+    'DFIX_PATH_DECISION_ARTIFACT',
+    'DFIX_PATCH_RUNNER_RESULT_ARTIFACT',
+    'DFIX_VERIFICATION_SELECTION_ARTIFACT',
+    'dfix-performance-report.json'
+]);
+for (const file of [
+    'src/core/dfix/error-signature.ts',
+    'src/core/dfix/dfix-cache.ts',
+    'src/core/dfix/path-decision.ts',
+    'src/core/dfix/root-cause-ranking.ts',
+    'src/core/dfix/patch-templates.ts',
+    'src/core/dfix/patch-runner.ts',
+    'src/core/dfix/codex-handoff.ts',
+    'src/core/dfix/verification-selector.ts',
+    'src/core/dfix/verification-runner.ts',
+    'src/core/dfix/performance.ts'
+]) {
+    requireContains('dfix:fast-kernel', file, ['sks.dfix']);
+}
+emitGate('dfix:fast-kernel', { paths: ['L0', 'L1', 'L2', 'L3'], artifacts: 10 });
+//# sourceMappingURL=dfix-fast-kernel-check.js.map

package/dist/scripts/dfix-fixture-check.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, runDfixFixture } from './sks-1-11-gate-lib.js';
+const result = runDfixFixture();
+emitGate('dfix:fixture', { mission_id: result.mission_id });
+//# sourceMappingURL=dfix-fixture-check.js.map

package/dist/scripts/dfix-parallel-write-blackbox.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-dfix-patch-'));
+fs.writeFileSync(path.join(tmp, 'copy.txt'), 'old label\n');
+const envelope = {
+    schema: 'sks.agent-patch-envelope.v1',
+    agent_id: 'dfix-fast-lane',
+    session_id: 'dfix-session',
+    slot_id: 'dfix-slot',
+    generation_index: 1,
+    lease_id: 'lease:dfix-fast-lane:copy.txt',
+    operations: [{ op: 'replace', path: 'copy.txt', search: 'old label', replace: 'new label' }]
+};
+const applied = await applyMod.applyAgentPatchEnvelope(tmp, envelope);
+const dfixFile = path.join(tmp, 'dfix-route.txt');
+fs.writeFileSync(dfixFile, 'old label\n');
+const diagnose = spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'diagnose', 'dfix parallel write route fixture', '--file', dfixFile, '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 });
+const diagnoseJson = parseJson(diagnose.stdout);
+const plan = diagnoseJson?.mission_id
+    ? spawnSync(process.execPath, ['dist/bin/sks.js', 'dfix', 'plan', diagnoseJson.mission_id, '--file', dfixFile, '--write-mode', 'parallel', '--apply-patches', '--dry-run-patches', '--max-write-agents', '1', '--json'], { cwd: root, encoding: 'utf8', maxBuffer: 1024 * 1024 })
+    : { status: 1, stdout: '', stderr: 'diagnose mission missing' };
+const planJson = parseJson(plan.stdout);
+const routePolicy = planJson?.patch_plan?.route_parallel_write || null;
+const report = { schema: 'sks.dfix-parallel-write-blackbox.v1', ok: applied.ok && diagnose.status === 0 && plan.status === 0 && routePolicy?.route_level_flags_wired === true, applied, route_command: { diagnose_status: diagnose.status, plan_status: plan.status, mission_id: diagnoseJson?.mission_id || null, route_policy: routePolicy, stderr_tail: `${diagnose.stderr || ''}${plan.stderr || ''}`.slice(-2000) } };
+const out = path.join(root, '.sneakoscope', 'reports', 'dfix-parallel-write-blackbox.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(applied.ok === true, 'DFix parallel write blackbox patch failed', report);
+assertGate(fs.readFileSync(path.join(tmp, 'copy.txt'), 'utf8') === 'new label\n', 'DFix parallel write blackbox content mismatch', report);
+assertGate(routePolicy?.write_mode === 'parallel', 'DFix route must record --write-mode parallel', report);
+assertGate(routePolicy?.apply_patches === true, 'DFix route must record --apply-patches', report);
+assertGate(routePolicy?.dry_run_patches === true, 'DFix route must record --dry-run-patches', report);
+emitGate('dfix:parallel-write-blackbox', { changed_files: applied.changed_files.length });
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=dfix-parallel-write-blackbox.js.map

package/dist/scripts/dfix-patch-handoff-check.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('dfix:patch-handoff', 'src/core/dfix.ts', [
+    'codex_patch_handoff',
+    'buildDfixCodexPatchPrompt',
+    'git_diff_before',
+    'git_diff_after',
+    'rollback_plan',
+    'explicit_apply_opt_in'
+]);
+emitGate('dfix:patch-handoff', { patch_mode: 'exact-find-replace-or-codex-handoff', diff_capture: true });
+//# sourceMappingURL=dfix-patch-handoff-check.js.map

package/dist/scripts/dfix-patch-swarm-route-blackbox.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runPatchSwarmRouteBlackbox } from './agent-patch-swarm-gate-lib.js';
+await runPatchSwarmRouteBlackbox({
+    gate: 'dfix:patch-swarm-route-blackbox',
+    route: '$DFix',
+    routeCommand: 'sks dfix',
+    reportName: 'dfix-patch-swarm-route-blackbox'
+});
+//# sourceMappingURL=dfix-patch-swarm-route-blackbox.js.map

package/dist/scripts/dfix-performance-check.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { DFIX_SPEED_BUDGETS_MS } from '../core/dfix/performance.js';
+const ok = DFIX_SPEED_BUDGETS_MS.diagnose_cold_source_local <= 500
+    && DFIX_SPEED_BUDGETS_MS.path_decision <= 100
+    && DFIX_SPEED_BUDGETS_MS.deterministic_patch_plan <= 300
+    && DFIX_SPEED_BUDGETS_MS.dry_run_patch_handoff_without_codex <= 500
+    && DFIX_SPEED_BUDGETS_MS.exact_patch_apply_small_file <= 1000
+    && DFIX_SPEED_BUDGETS_MS.verification_selector <= 300
+    && DFIX_SPEED_BUDGETS_MS.no_codex_full_loop_fixture <= 3000
+    && DFIX_SPEED_BUDGETS_MS.codex_handoff_timeout <= 60000;
+console.log(JSON.stringify({ schema: 'sks.dfix-performance-check.v1', ok, budgets_ms: DFIX_SPEED_BUDGETS_MS }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=dfix-performance-check.js.map

package/dist/scripts/dfix-verification-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readMissionJson, runDfixFixture } from './sks-1-11-gate-lib.js';
+const result = runDfixFixture();
+const verification = readMissionJson(result.mission_id, 'dfix-verification.json');
+const proof = readMissionJson(result.mission_id, 'completion-proof.json');
+assertGate(verification.status === 'passed' && proof.evidence?.dfix?.verification_status === 'passed', 'dfix verification evidence missing from proof', { verification, dfix: proof.evidence?.dfix });
+emitGate('dfix:verification', { mission_id: result.mission_id });
+//# sourceMappingURL=dfix-verification-check.js.map

package/dist/scripts/dfix-verification-recommendation-check.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('dfix:verification-recommendation', 'src/core/dfix.ts', [
+    'DFIX_VERIFICATION_SUGGESTION_ARTIFACT',
+    'writeDfixVerificationSuggestion',
+    'suggested_verification_commands',
+    'auto_run_requires_opt_in',
+    'recovery_action'
+]);
+requireContains('dfix:verification-recommendation', 'src/core/commands/dfix-command.ts', [
+    '--verify-auto'
+]);
+emitGate('dfix:verification-recommendation', { artifact: 'dfix-verification-suggestion.json' });
+//# sourceMappingURL=dfix-verification-recommendation-check.js.map

package/dist/scripts/docs-brand-neutrality-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('docs:brand-neutrality');
+//# sourceMappingURL=docs-brand-neutrality-check.js.map

package/dist/scripts/docs-codex-0139-wording-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const files = ['README.md', 'docs/codex-0.139-compat.md', 'CHANGELOG.md'];
+const text = files.map((file) => `\n# ${file}\n${readText(file)}`).join('\n');
+for (const required of [
+    'bundles @openai/codex-sdk 0.138.0',
+    'external Codex CLI',
+    'Codex 0.139-aware',
+    'release gates include hermetic fixtures and optional real probes'
+]) {
+    assertGate(text.includes(required), `Codex 0.139 wording missing: ${required}`);
+}
+for (const forbidden of [
+    'bundled Codex 0.139',
+    'always supports Codex 0.139 web search'
+]) {
+    assertGate(!text.includes(forbidden), `forbidden Codex 0.139 wording present: ${forbidden}`);
+}
+emitGate('docs:codex-0139-wording', { files });
+//# sourceMappingURL=docs-codex-0139-wording-check.js.map

package/dist/scripts/docs-loop-productionization-check.js

@@ -0,0 +1,3 @@
+import { runLoopHardeningCheck } from './loop-hardening-check-lib.js';
+await runLoopHardeningCheck('docs:loop-productionization');
+//# sourceMappingURL=docs-loop-productionization-check.js.map

package/dist/scripts/docs-loop-runtime-check.js

@@ -0,0 +1,3 @@
+import { runLoopDirectiveCheck } from './loop-directive-check-lib.js';
+await runLoopDirectiveCheck('docs:loop-runtime');
+//# sourceMappingURL=docs-loop-runtime-check.js.map

package/dist/scripts/docs-truthfulness-check.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const files = [
+    'README.md',
+    'CHANGELOG.md',
+    'docs/computer-use-evidence.md',
+    'docs/codex-lb.md',
+    'docs/codex-0.136-compat.md',
+    'docs/codex-0.135-compat.md',
+    'docs/codex-cli-compat.md',
+    'docs/official-docs-compat.md',
+    'docs/hooks-pat.md',
+    'docs/known-gaps.md',
+    'docs/release-readiness.md'
+];
+const required = {
+    'README.md': ['CHANGELOG.md', 'docs/release-readiness.md', 'gpt-image-2'],
+    'CHANGELOG.md': ['1.14.0', 'DFix Extreme Speed Kernel', 'hook trust doctor', 'warning-zero'],
+    'docs/computer-use-evidence.md': ['sks.computer-use-live-evidence.v1', 'probe_only', 'live_capture_blocked', 'local-only', 'Codex Chrome Extension'],
+    'docs/codex-lb.md': ['durable_env_file', 'durable_keychain', 'durable_launchctl', 'shell_profile', 'process_only_ephemeral'],
+    'docs/codex-0.136-compat.md': ['rust-v0.136.0', 'codex:0.136-compat', 'codex archive', 'codex app-server --stdio', 'CODEX_API_KEY', 'server tokens'],
+    'docs/codex-0.135-compat.md': ['rust-v0.135.0', 'codex:0.135-compat', 'named permission profiles'],
+    'docs/codex-cli-compat.md': ['rust-v0.136.0', 'session_archive_restore', 'profile_primary_selector', 'managed_network_proxy_env', 'goals_default_enabled', 'permission_profiles_requirements', 'SubagentStart', 'sks_zero_warning_disallowed', 'strict subset'],
+    'docs/official-docs-compat.md': ['official-docs:compat', 'rust-v0.136.0', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
+    'docs/hooks-pat.md': ['SubagentStop', 'strict subset', 'zero-warning'],
+    'docs/known-gaps.md': ['No P0', 'P1'],
+    'docs/release-readiness.md': ['sks.release-readiness.v1', 'release:readiness', 'official-docs:compat']
+};
+const forbidden = [
+    /Computer Use is always available/i,
+    /live evidence is guaranteed/i,
+    /Browser Use evidence is Computer Use evidence/i,
+    /process-only setup is durable/i,
+    /screenshots are published to shared TriWiki automatically/i
+];
+const results = [];
+for (const file of files) {
+    const full = path.join(root, file);
+    const text = fs.existsSync(full) ? fs.readFileSync(full, 'utf8') : '';
+    const missing = (required[file] || []).filter((needle) => !text.includes(needle));
+    const forbiddenMatches = forbidden.filter((pattern) => pattern.test(text)).map(String);
+    results.push({
+        file,
+        ok: Boolean(text) && missing.length === 0 && forbiddenMatches.length === 0,
+        missing,
+        forbidden: forbiddenMatches
+    });
+}
+const ok = results.every((row) => row.ok);
+console.log(JSON.stringify({
+    schema: 'sks.docs-truthfulness-check.v1',
+    ok,
+    results
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=docs-truthfulness-check.js.map

package/dist/scripts/doctor-codex-0138-fix-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const doctor = readText('src/commands/doctor.ts');
+const matrix = readText('src/core/doctor/doctor-readiness-matrix.ts');
+assertGate(doctor.includes('runCodex0138Doctor(root, { fix: doctorFix })') && doctor.includes('Codex 0.138 features:'), 'doctor --fix must integrate Codex 0.138 doctor and human-readable feature output');
+assertGate(doctor.includes('writeCodexPluginInventoryArtifacts') && doctor.includes('Remote MCP servers:'), 'doctor must surface Codex plugin inventory and remote MCP candidates');
+assertGate(matrix.includes('codex_0138_doctor') && matrix.includes('codex_plugin_app_template_policy'), 'readiness matrix must carry 0.138 doctor/plugin warnings');
+emitGate('doctor:codex-0138-fix');
+//# sourceMappingURL=doctor-codex-0138-fix-check.js.map

package/dist/scripts/doctor-codex-0139-real-probes-check.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const real = readJson('.sneakoscope/codex-0139-real-probes.json');
+const summary = readJson('.sneakoscope/codex-0139-real-probe-summary.json');
+const doctorSource = fs.readFileSync(path.join(root, 'src/core/doctor/codex-0139-doctor.ts'), 'utf8');
+const readinessSource = fs.readFileSync(path.join(root, 'src/core/doctor/doctor-readiness-matrix.ts'), 'utf8');
+assertGate(doctorSource.includes('npm run codex:0139-real-probes:require-real'), 'doctor Codex 0.139 guidance must mention strict real probe command');
+assertGate(readinessSource.includes('codex_0139_real_probes'), 'doctor readiness matrix must surface Codex 0.139 real probes');
+emitGate('doctor:codex-0139-real-probes', {
+    real_probe_artifact_present: Boolean(real),
+    summary_artifact_present: Boolean(summary),
+    skipped: real?.skipped || summary?.skipped_count || []
+});
+function readJson(rel) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(root, rel), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=doctor-codex-0139-real-probes-check.js.map

package/dist/scripts/doctor-codex-app-harness-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
+await runDirective314Gate('doctor:codex-app-harness');
+//# sourceMappingURL=doctor-codex-app-harness-check.js.map

package/dist/scripts/doctor-codex-doctor-parity-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
+const freshness = ensureDistFresh({ rebuild: true });
+if (!freshness.ok)
+    fail('dist_not_fresh', { freshness });
+const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'doctor', 'codex-doctor-bridge.js')).href);
+const report = await mod.runCodexDoctorBridge({ cwd: root, required: process.argv.includes('--actual-codex') });
+const requiredFields = ['available', 'exit_code', 'environment_diagnostics_ok', 'git_diagnostics_ok', 'terminal_diagnostics_ok', 'app_server_diagnostics_ok', 'thread_inventory_ok', 'blockers', 'warnings'];
+const ok = requiredFields.every((field) => Object.prototype.hasOwnProperty.call(report, field)) && (!process.argv.includes('--actual-codex') || report.blockers.length === 0);
+emit({ schema: 'sks.doctor-codex-doctor-parity-check.v1', ok, report, required_fields: requiredFields });
+function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
+    process.exitCode = 1; }
+function fail(blocker, detail) { emit({ schema: 'sks.doctor-codex-doctor-parity-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
+//# sourceMappingURL=doctor-codex-doctor-parity-check.js.map

package/dist/scripts/doctor-codex-native-readiness-ux-check.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { root } from './sks-3-1-7-directive-check-lib.js';
+const source = fs.readFileSync(path.join(root, 'src/commands/doctor.ts'), 'utf8');
+for (const token of [
+    'SKS Runtime Readiness:',
+    'Zellij:',
+    'Codex Native:',
+    'Loop Mesh:',
+    'QA Visual:',
+    'Research Sources:',
+    'Image Follow-up:',
+    'hook-derived evidence will not count',
+    'message-role fallback active',
+    'MAD can run with --headless; live panes require repair'
+])
+    assertGate(source.includes(token), `doctor readiness token missing:${token}`);
+emitGate('doctor:codex-native-readiness-ux');
+function assertGate(condition, message) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=doctor-codex-native-readiness-ux-check.js.map

package/dist/scripts/doctor-codex-native-repair-actions-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { root } from './sks-3-1-7-directive-check-lib.js';
+const source = fs.readFileSync(path.join(root, 'src/commands/doctor.ts'), 'utf8');
+for (const token of [
+    'Repair actions:',
+    'Zellij: sks doctor --fix --yes',
+    'Homebrew + Zellij: sks doctor --fix --install-homebrew --yes',
+    'Codex Native managed assets: sks doctor --fix --repair-codex-native --yes',
+    'Project memory: sks codex-native init-deep --apply --directory-local'
+])
+    assertGate(source.includes(token), `doctor repair action missing:${token}`);
+emitGate('doctor:codex-native-repair-actions');
+function assertGate(condition, message) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=doctor-codex-native-repair-actions-check.js.map

package/dist/scripts/doctor-codex-startup-repair-check.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root as repoRoot } from './lib/ensure-dist-fresh.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { writeTextAtomic } from '../core/fsx.js';
+const freshness = ensureDistFresh({ rebuild: true });
+assertGate(freshness.ok, 'dist must be fresh for doctor startup repair check', freshness);
+const mod = await import(pathToFileURL(path.join(repoRoot, 'dist', 'core', 'doctor', 'doctor-codex-startup-repair.js')).href);
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-startup-doctor-'));
+const codexHome = path.join(tmp, 'codex-home');
+await fs.mkdir(path.join(tmp, '.codex', 'agents'), { recursive: true });
+await fs.mkdir(path.join(codexHome, 'agents'), { recursive: true });
+const staleConfig = [
+    'model = "gpt-5.5"',
+    '',
+    '[agents.analysis_scout]',
+    'description = "Read-only SKS scout."',
+    'config_file = "/Users/alfredo/.codex/agents/analysis-scout.toml"',
+    'nickname_candidates = ["Scout", "Mapper"]',
+    '',
+    '[mcp_servers.node_repl]',
+    'command = "/definitely/missing/node_repl"',
+    'args = []',
+    '',
+    '[mcp_servers.supabase_sauron]',
+    'command = "npx"',
+    'args = ["-y", "fixture"]',
+    '',
+    '[features]',
+    'hooks = true',
+    '',
+    '[mcp_servers.node_repl.env]',
+    'NODE_REPL_NODE_PATH = "/Applications/Codex.app/Contents/Resources/node"',
+    ''
+].join('\n');
+await writeTextAtomic(path.join(tmp, '.codex', 'config.toml'), staleConfig);
+await writeTextAtomic(path.join(codexHome, 'config.toml'), staleConfig);
+await writeTextAtomic(path.join(codexHome, 'agents', 'sks-checker.toml'), [
+    'name = "sks-checker"',
+    'description = "SKS managed 3.1.7 directive role: sks-checker"',
+    'message_role_prefix = "Role: sks-checker."',
+    'developer_instructions = """',
+    'Execution role strategy: message-role.',
+    '"""',
+    ''
+].join('\n'));
+const planned = await mod.runDoctorCodexStartupRepair({ root: tmp, codexHome, fix: false });
+assertGate(planned.configs.every((entry) => entry.warnings.some((warning) => warning.includes('agent_config_file_stale'))), 'dry inspect must detect stale agent config_file paths', planned);
+const repaired = await mod.runDoctorCodexStartupRepair({ root: tmp, codexHome, fix: true, includeDefaultNodeReplCandidates: false });
+const projectText = await fs.readFile(path.join(tmp, '.codex', 'config.toml'), 'utf8');
+const globalText = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
+const checkerText = await fs.readFile(path.join(codexHome, 'agents', 'sks-checker.toml'), 'utf8');
+for (const [scope, text, expectedDir] of [
+    ['project', projectText, path.join(tmp, '.codex', 'agents')],
+    ['global', globalText, path.join(codexHome, 'agents')]
+]) {
+    assertGate(!text.includes('/Users/alfredo/'), `${scope} config must drop stale home path`, text);
+    assertGate(text.includes(`config_file = "${path.join(expectedDir, 'analysis-scout.toml').replace(/\\/g, '\\\\')}"`), `${scope} config_file must point at an existing absolute role file`, text);
+    assertGate(!text.includes('[mcp_servers.node_repl]'), `${scope} stale node_repl MCP block must be removed`, text);
+    assertGate(!text.includes('[mcp_servers.node_repl.env]'), `${scope} stale node_repl child MCP block must be removed`, text);
+    assertGate(text.includes('[mcp_servers.supabase_sauron]'), `${scope} optional sauron MCP block must be preserved`, text);
+    assertGate(text.includes('[features]') && text.includes('hooks = true'), `${scope} unrelated tables must be preserved`, text);
+}
+assertGate(!checkerText.includes('message_role_prefix'), 'managed directive agent role must remove unsupported message_role_prefix', checkerText);
+assertGate(repaired.ok === true, 'startup repair must pass when only optional sauron remains', repaired);
+assertGate(repaired.configs.every((entry) => entry.changed === true && entry.backup_path), 'startup repair must back up changed configs', repaired);
+assertGate(repaired.agent_role_files.created.length >= 10, 'startup repair must create missing project/global role configs', repaired);
+assertGate(repaired.configs.every((entry) => !entry.warnings.some((warning) => warning.includes('agent_config_file_stale'))), 'startup repair must not keep stale agent config warnings after repair', repaired);
+const tmpCandidate = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-startup-node-repl-'));
+const codexHomeCandidate = path.join(tmpCandidate, 'codex-home');
+const fakeNodeRepl = path.join(tmpCandidate, 'Codex.app', 'Contents', 'Resources', 'cua_node', 'bin', 'node_repl');
+await fs.mkdir(path.dirname(fakeNodeRepl), { recursive: true });
+await writeTextAtomic(fakeNodeRepl, '#!/bin/sh\n');
+await fs.mkdir(path.join(tmpCandidate, '.codex'), { recursive: true });
+await fs.mkdir(codexHomeCandidate, { recursive: true });
+const missingNodeReplConfig = [
+    '[mcp_servers.node_repl]',
+    'command = "/definitely/missing/node_repl"',
+    'args = []',
+    '',
+    '[mcp_servers.node_repl.env]',
+    'NODE_REPL_NODE_PATH = "/Applications/Codex.app/Contents/Resources/node"',
+    ''
+].join('\n');
+await writeTextAtomic(path.join(tmpCandidate, '.codex', 'config.toml'), missingNodeReplConfig);
+await writeTextAtomic(path.join(codexHomeCandidate, 'config.toml'), missingNodeReplConfig);
+const candidateRepaired = await mod.runDoctorCodexStartupRepair({
+    root: tmpCandidate,
+    codexHome: codexHomeCandidate,
+    fix: true,
+    nodeReplCommandCandidates: [fakeNodeRepl],
+    includeDefaultNodeReplCandidates: false
+});
+const candidateText = await fs.readFile(path.join(tmpCandidate, '.codex', 'config.toml'), 'utf8');
+assertGate(candidateText.includes(`command = "${fakeNodeRepl.replace(/\\/g, '\\\\')}"`), 'node_repl must be repaired to an existing Codex App command when available', candidateText);
+assertGate(candidateText.includes('[mcp_servers.node_repl.env]'), 'node_repl env must be preserved when command is repaired', candidateText);
+assertGate(candidateRepaired.configs.every((entry) => entry.mcp_blocks_repaired.includes('node_repl')), 'node_repl repair action must be recorded', candidateRepaired);
+emitGate('doctor:codex-startup-repair', { configs: repaired.configs.length, actions: repaired.actions.length, node_repl_candidate_repaired: true });
+//# sourceMappingURL=doctor-codex-startup-repair-check.js.map