sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/hooks-managed-install-fixture-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { installManagedCodexHooks } from '../core/codex-hooks/codex-hook-managed-install.js';
+import { readCodexHookActualState } from '../core/codex-hooks/codex-hook-actual-discovery.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-hooks-managed-install-'));
+const install = await installManagedCodexHooks(root);
+const actual = await readCodexHookActualState(root);
+const requirements = fs.readFileSync(path.join(root, '.codex', 'requirements.toml'), 'utf8');
+const ok = install.ok
+    && requirements.includes('allow_managed_hooks_only = true')
+    && requirements.includes('[hooks]')
+    && actual.entries.filter((entry) => entry.trust_status === 'Managed').length >= 10
+    && actual.unsupported_handlers.length === 0
+    && actual.dual_representation.length === 0;
+console.log(JSON.stringify({ schema: 'sks.hooks-managed-install-fixture-check.v1', ok, install, actual_summary: { entries: actual.entries.length, unsupported_handlers: actual.unsupported_handlers.length, dual_representation: actual.dual_representation.length } }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=hooks-managed-install-fixture-check.js.map

package/dist/scripts/hooks-official-hash-oracle-check.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { installManagedCodexHooks } from '../core/codex-hooks/codex-hook-managed-install.js';
+import { codexHookOfficialParityReport } from '../core/codex-hooks/codex-hook-official-parity.js';
+import { resolveCodexHookHashOracle } from '../core/codex-hooks/codex-hook-official-hash-oracle.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-hooks-oracle-'));
+await installManagedCodexHooks(root);
+const oracle = await resolveCodexHookHashOracle(root, {
+    event: 'PreToolUse',
+    matcher: 'Read',
+    command: 'sks hook pre-tool',
+    timeout: 600,
+    async: false
+});
+const parity = await codexHookOfficialParityReport(root);
+const ok = parity.ok
+    && parity.schema === 'sks.codex-hook-official-parity.v2'
+    && parity.policy.sks_trusted_hash_fallback_allowed === false
+    && (oracle.schema === 'sks.codex-hook-hash-oracle.v1');
+const result = {
+    schema: 'sks.hooks-official-hash-oracle-check.v1',
+    ok,
+    oracle,
+    parity_status: parity.status,
+    official_hash_available: parity.official_hash_available,
+    unmanaged_trusted_hash_writer_enabled: parity.unmanaged_trusted_hash_writer_enabled,
+    managed_policy_used: parity.managed_policy_used
+};
+console.log(JSON.stringify(result, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=hooks-official-hash-oracle-check.js.map

package/dist/scripts/hooks-official-hash-parity-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { installManagedCodexHooks } from '../core/codex-hooks/codex-hook-managed-install.js';
+import { codexHookOfficialParityReport } from '../core/codex-hooks/codex-hook-official-parity.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-hooks-official-hash-'));
+await installManagedCodexHooks(root);
+const report = await codexHookOfficialParityReport(root);
+const ok = report.ok
+    && report.fixture_parity.ok === true
+    && report.policy.sks_trusted_hash_fallback_allowed === false;
+console.log(JSON.stringify({ schema: 'sks.hooks-official-hash-parity-check.v1', ok, status: report.status, fixture_parity: report.fixture_parity, policy: report.policy }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=hooks-official-hash-parity-check.js.map

package/dist/scripts/hooks-subagent-events-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { CODEX_HOOK_EVENTS } from '../core/codex-compat/codex-schema-snapshot.js';
+import { validateCodexFixtureOutputs } from '../core/codex-compat/codex-hook-schema.js';
+const fixtures = await validateCodexFixtureOutputs(process.cwd());
+const subagentEvents = ['SubagentStart', 'SubagentStop'];
+const ok = subagentEvents.every((event) => CODEX_HOOK_EVENTS.includes(event))
+    && subagentEvents.every((event) => fixtures.outputs.some((row) => row.event === event && row.ok));
+console.log(JSON.stringify({
+    schema: 'sks.hooks-subagent-events-check.v1',
+    ok,
+    subagent_events: subagentEvents,
+    fixture_counts: Object.fromEntries(subagentEvents.map((event) => [event, fixtures.outputs.filter((row) => row.event === event).length]))
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=hooks-subagent-events-check.js.map

package/dist/scripts/hooks-trust-state-check.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { codexHookTrustDoctor } from '../core/codex-hooks/codex-hook-trust-doctor.js';
+const report = await codexHookTrustDoctor(process.cwd(), { managed: true });
+console.log(JSON.stringify({
+    schema: 'sks.hooks-trust-state-check.v1',
+    ok: report.ok,
+    current_hash_count: report.current_hash_count,
+    trust: report.trust,
+    warnings: report.warnings
+}, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=hooks-trust-state-check.js.map

package/dist/scripts/image-artifact-path-contract-check.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/image/image-artifact-path-contract.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-image-contract-'));
+const png = path.join(root, 'fixture.png');
+await fs.writeFile(png, Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAFgwJ/lp8S2wAAAABJRU5ErkJggg==', 'base64'));
+const result = await mod.writeImageArtifactPathContract(root, { missionId: 'M-image', images: [{ id: 'fixture', kind: 'generated_image', filePath: png }] });
+assertGate(result.contract.images[0].exists === true && result.contract.images[0].model_visible_path === png && result.contract.blockers.length === 0, 'image artifact path contract must expose real saved model-visible paths', result.contract);
+emitGate('image:artifact-path-contract', { image_count: result.contract.images.length });
+//# sourceMappingURL=image-artifact-path-contract-check.js.map

package/dist/scripts/image-artifact-registry-check.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/image/image-artifact-registry.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-image-registry-'));
+const png = path.join(root, 'fixture.png');
+await fs.writeFile(png, Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAFgwJ/lp8S2wAAAABJRU5ErkJggg==', 'base64'));
+const contract = await mod.registerImageArtifact(root, { missionId: 'M-image', id: 'img-1', kind: 'generated_image', filePath: png, route: '$Image-UX-Review', stage: 'fixture' });
+assertGate(contract.images[0].model_visible_path === png && contract.images[0].route === '$Image-UX-Review' && contract.blockers.length === 0, 'image artifact registry must append saved model-visible paths with route/stage metadata', contract);
+emitGate('image:artifact-registry');
+//# sourceMappingURL=image-artifact-registry-check.js.map

package/dist/scripts/image-fidelity-fixture-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+const root = process.cwd();
+const mod = await import(pathToFileURL(path.join(root, 'dist/core/image-ux-review.js')));
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-image-fidelity-'));
+const pngPath = path.join(tmp, 'one-by-one.png');
+await fs.writeFile(pngPath, Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMB/axX7V8AAAAASUVORK5CYII=', 'base64'));
+const contract = {
+    prompt: 'image fidelity fixture',
+    answers: { IMAGE_UX_REVIEW_SOURCE_IMAGES: [pngPath] }
+};
+const inventory = await mod.hydrateImageUxScreenInventory(root, mod.buildImageUxScreenInventory(contract));
+const screen = inventory.source_screens[0];
+assert.equal(screen.width, 1);
+assert.equal(screen.height, 1);
+assert.match(screen.sha256, /^[a-f0-9]{64}$/);
+assert.equal(screen.original_resolution.preserved, true);
+console.log(JSON.stringify({ schema: 'sks.image-fidelity-fixture.v1', ok: true, screen }, null, 2));
+//# sourceMappingURL=image-fidelity-fixture-check.js.map

package/dist/scripts/image-followup-edit-path-check.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/image/image-artifact-path-contract.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-image-followup-'));
+const png = path.join(root, 'followup.png');
+await fs.writeFile(png, Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAFgwJ/lp8S2wAAAABJRU5ErkJggg==', 'base64'));
+const contract = await mod.buildImageArtifactPathContract(root, { missionId: 'M-followup', images: [{ id: 'followup', kind: 'edited_image', filePath: png }] });
+assertGate(contract.images[0].followup_edit_hint.includes(png), 'follow-up edit hint must include exact saved local image path', contract.images[0]);
+emitGate('image:followup-edit-path');
+//# sourceMappingURL=image-followup-edit-path-check.js.map

package/dist/scripts/image-generation-path-handoff-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const adapter = readText('src/core/image-ux-review/imagegen-adapter.ts');
+assertGate(adapter.includes('writeGeneratedImagePathContract') && adapter.includes('image_artifact_path_contract'), 'imagegen adapter must hand off saved generated image path contract');
+assertGate(adapter.includes("model: 'gpt-image-2'") || adapter.includes('model: "gpt-image-2"'), 'imagegen adapter must keep gpt-image-2 model evidence');
+emitGate('image:generation-path-handoff');
+//# sourceMappingURL=image-generation-path-handoff-check.js.map

package/dist/scripts/image-global-path-contract-check.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, readText } from './sks-1-18-gate-lib.js';
+const adapter = readText('src/core/image-ux-review/imagegen-adapter.ts');
+const registry = readText('src/core/image/image-artifact-registry.ts');
+assertGate(adapter.includes('registerImageArtifact') && registry.includes('image-artifact-path-contract.json'), 'global image generation/edit paths must register saved files in mission path contract registry');
+const mod = await importDist('core/image-ux-review/imagegen-adapter.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-image-global-root-'));
+const subdir = path.join(root, 'subdir');
+await fs.mkdir(path.join(root, '.git'), { recursive: true });
+await fs.mkdir(subdir, { recursive: true });
+const png = path.join(root, 'fixture.png');
+await fs.writeFile(png, Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAFgwJ/lp8S2wAAAABJRU5ErkJggg==', 'base64'));
+const oldCwd = process.cwd();
+process.chdir(subdir);
+try {
+    const result = await mod.generateGptImage2CalloutReview({
+        mission_id: 'M-subdir',
+        source_screen_id: 'screen-1',
+        source_image_path: png,
+        output_dir: path.join(root, 'out'),
+        prompt: mod.buildCalloutPrompt('screen-1'),
+        requested_fidelity: 'original',
+        privacy: 'local-only'
+    }, { fake: true });
+    assertGate(result.ok === true, 'fixture imagegen must produce a generated image before registry root check', result);
+}
+finally {
+    process.chdir(oldCwd);
+}
+const projectRegistry = await fs.stat(path.join(root, '.sneakoscope', 'missions', 'M-subdir', 'image-artifact-path-contract.json')).then(() => true, () => false);
+const subdirRegistry = await fs.stat(path.join(subdir, '.sneakoscope', 'missions', 'M-subdir', 'image-artifact-path-contract.json')).then(() => true, () => false);
+assertGate(projectRegistry === true && subdirRegistry === false, 'image generation registry must use project root, not invocation subdirectory', { projectRegistry, subdirRegistry });
+emitGate('image:global-path-contract');
+//# sourceMappingURL=image-global-path-contract-check.js.map

package/dist/scripts/imagegen-capability-check.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
+const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+const report = await detectImagegenCapability();
+const out = path.join(process.cwd(), '.sneakoscope', 'reports', `imagegen-capability-${pkg.version}.json`);
+const stableOut = path.join(process.cwd(), '.sneakoscope', 'reports', 'imagegen-capability.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+fs.writeFileSync(stableOut, `${JSON.stringify(report, null, 2)}\n`);
+const ok = report.ok
+    && report.core_feature === true
+    && report.core_ready === true
+    && report.codex_app?.available === true
+    && report.codex_app_builtin_output_required === true
+    && report.capability_detection_is_not_output_proof === true
+    && report.real_generation_available === true
+    && report.model === 'gpt-image-2'
+    && report.openai_images_api?.official_codex_app_substitute === false
+    && report.api_fallback_satisfies_codex_app_evidence === false
+    && report.input_fidelity_must_be_omitted === true
+    && report.gpt_image_2_input_fidelity_automatic === true
+    && Array.isArray(report.core_blockers)
+    && report.core_blockers.length === 0;
+console.log(JSON.stringify({ ...report, ok, path: out, stable_path: stableOut }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=imagegen-capability-check.js.map

package/dist/scripts/imagegen-real-smoke-check.js

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { osTempPngFixtureArg } from './lib/valid-png-fixture.js';
+const enabled = process.env.SKS_TEST_REAL_IMAGEGEN === '1' || process.env.SKS_REAL_IMAGEGEN === '1';
+const reportDir = path.join(process.cwd(), '.sneakoscope', 'reports');
+const out = path.join(reportDir, 'real-imagegen-smoke-1.14.1.json');
+const stableOut = path.join(reportDir, 'real-imagegen-smoke.json');
+fs.mkdirSync(reportDir, { recursive: true });
+function writeReport(report) {
+    const text = `${JSON.stringify(report, null, 2)}\n`;
+    fs.writeFileSync(out, text);
+    fs.writeFileSync(stableOut, text);
+}
+function parseUxReviewJson(stdout) {
+    const text = String(stdout || '').trim();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch { }
+    const first = text.indexOf('{');
+    const last = text.lastIndexOf('}');
+    if (first >= 0 && last > first) {
+        try {
+            return JSON.parse(text.slice(first, last + 1));
+        }
+        catch { }
+    }
+    return null;
+}
+function missionIdFromRun(stdout, parsed) {
+    const direct = parsed?.mission_id || parsed?.mission?.mission_id || parsed?.mission?.id || parsed?.contract?.mission_id || null;
+    if (direct)
+        return String(direct);
+    const matches = String(stdout || '').match(/M-\d{8}-\d{6}-[a-f0-9]+/g);
+    return matches?.length ? matches[matches.length - 1] : null;
+}
+function readJsonIfExists(file) {
+    try {
+        if (!file || !fs.existsSync(file))
+            return null;
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function imagegenRequestEvidence(missionId) {
+    if (!missionId)
+        return { request_artifact: null, response_artifact: null, request: null, response: null };
+    const missionRoot = path.join(process.cwd(), '.sneakoscope', 'missions', missionId);
+    const requestCandidates = [
+        path.join(missionRoot, 'generated-callouts', 'image-ux-gpt-image-2-request.json'),
+        path.join(missionRoot, 'image-ux-gpt-image-2-request.json')
+    ];
+    const requestArtifact = requestCandidates.find((candidate) => fs.existsSync(candidate)) || null;
+    const responseArtifact = requestArtifact
+        ? requestArtifact.replace(/request\.json$/, 'response.json')
+        : null;
+    return {
+        request_artifact: requestArtifact,
+        response_artifact: responseArtifact && fs.existsSync(responseArtifact) ? responseArtifact : null,
+        request: readJsonIfExists(requestArtifact),
+        response: readJsonIfExists(responseArtifact)
+    };
+}
+function verifiedGeneratedOutput(response) {
+    const outputPath = response?.output_image_path ? path.resolve(String(response.output_image_path)) : null;
+    const exists = Boolean(outputPath && fs.existsSync(outputPath));
+    const fake = response?.fake_adapter === true || response?.mock === true || response?.provider === 'fake_imagegen_adapter';
+    return {
+        output_image_path: outputPath,
+        output_image_exists: exists,
+        output_image_sha256: response?.output_image_sha256 || null,
+        output_dimensions: response?.dimensions || null,
+        provider: response?.provider || null,
+        response_ok: response?.ok === true,
+        response_status: response?.status || null,
+        fake_adapter: fake,
+        real_generated_output_verified: response?.ok === true && response?.status === 'generated' && exists && !fake
+    };
+}
+if (!enabled) {
+    const skipped = {
+        schema: 'sks.imagegen-real-smoke.v1',
+        ok: true,
+        status: 'skipped',
+        reason: 'Set SKS_TEST_REAL_IMAGEGEN=1 with OPENAI_API_KEY or Codex App imagegen output to run live smoke.',
+        compatibility_env_alias: 'SKS_REAL_IMAGEGEN=1',
+        release_gate: 'release:real-check_only',
+        request_validator_checked: false,
+        input_fidelity_present: false,
+        local_only_artifact_policy: true
+    };
+    writeReport(skipped);
+    console.log(JSON.stringify(skipped, null, 2));
+    process.exit(0);
+}
+const started = Date.now();
+const sourceImage = osTempPngFixtureArg('imagegen-real-smoke-source.png');
+const run = spawnSync(process.execPath, ['./dist/bin/sks.js', 'ux-review', 'run', '--image', sourceImage, '--generate-callouts', '--fix', '--json'], {
+    cwd: process.cwd(),
+    env: process.env,
+    encoding: 'utf8',
+    timeout: Number(process.env.SKS_IMAGEGEN_SMOKE_TIMEOUT_MS || 180000),
+    maxBuffer: 8 * 1024 * 1024
+});
+const parsed = parseUxReviewJson(run.stdout);
+const missionId = missionIdFromRun(run.stdout, parsed);
+const evidence = imagegenRequestEvidence(missionId);
+const inputFidelityPresent = evidence.request?.validation?.params_checked?.input_fidelity_present === true;
+const generatedOutput = verifiedGeneratedOutput(evidence.response);
+const report = {
+    schema: 'sks.imagegen-real-smoke.v1',
+    ok: run.status === 0 && generatedOutput.real_generated_output_verified === true,
+    status: run.status === 0 && generatedOutput.real_generated_output_verified === true ? 'passed' : 'blocked',
+    env_flag: 'SKS_TEST_REAL_IMAGEGEN',
+    mission_id: missionId,
+    latency_ms: Date.now() - started,
+    cost: 'not_reported_by_adapter',
+    source_image: sourceImage,
+    request_validator_checked: Boolean(evidence.request?.validation),
+    request_artifact: evidence.request_artifact,
+    response_artifact: evidence.response_artifact,
+    imagegen_provider: evidence.request?.provider || evidence.response?.provider || null,
+    imagegen_blocker: evidence.response?.blocker || null,
+    generated_output: generatedOutput,
+    process_error: run.error?.message || null,
+    process_signal: run.signal || null,
+    input_fidelity_present: inputFidelityPresent,
+    local_only_artifact_policy: true,
+    stdout_tail: run.stdout.slice(-4000),
+    stderr_tail: run.stderr.slice(-4000)
+};
+if (run.status === 0 && !generatedOutput.real_generated_output_verified) {
+    report.blocker = generatedOutput.fake_adapter
+        ? 'fake_imagegen_output_not_real_smoke'
+        : generatedOutput.output_image_exists
+            ? 'generated_output_not_marked_real'
+            : 'generated_output_file_missing';
+}
+if (report.input_fidelity_present) {
+    report.ok = false;
+    report.status = 'blocked';
+    report.blocker = 'input_fidelity_must_not_be_sent_for_gpt_image_2';
+}
+writeReport(report);
+console.log(JSON.stringify(report, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=imagegen-real-smoke-check.js.map

package/dist/scripts/init-deep-backup-retention-check.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-init-deep-retention-'));
+const target = path.join(root, 'src', 'core', 'zellij');
+await fs.mkdir(target, { recursive: true });
+for (let index = 0; index < 18; index += 1)
+    await fs.writeFile(path.join(target, `f${index}.ts`), 'export {}\n', 'utf8');
+await fs.writeFile(path.join(target, 'AGENTS.md'), '# User local guidance\nKeep me.\n', 'utf8');
+const previous = process.env.SKS_INIT_DEEP_BACKUP_RETENTION;
+process.env.SKS_INIT_DEEP_BACKUP_RETENTION = '1';
+try {
+    const first = await runCodexInitDeep({ root, apply: true, directoryLocal: true });
+    const second = await runCodexInitDeep({ root, apply: true, directoryLocal: true });
+    assertGate(first.directory_local_agents.changed_only_backup === true, 'changed-only backup flag missing');
+    assertGate(first.directory_local_agents.backup_paths.every((file) => /AGENTS\.md\.sks-backup-\d{13}-[0-9a-f]{8,12}$/.test(file)), 'backup filename must be timestamp-hash pattern', first);
+    assertGate(second.directory_local_agents.unchanged_files.length >= 1 && second.directory_local_agents.backup_paths.length === 0, 'unchanged second run should not create backup', second);
+}
+finally {
+    if (previous === undefined)
+        delete process.env.SKS_INIT_DEEP_BACKUP_RETENTION;
+    else
+        process.env.SKS_INIT_DEEP_BACKUP_RETENTION = previous;
+}
+emitGate('init-deep:backup-retention');
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=init-deep-backup-retention-check.js.map

package/dist/scripts/init-deep-memory-scope-safety-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { root } from './sks-3-1-7-directive-check-lib.js';
+const planner = fs.readFileSync(path.join(root, 'src/core/loops/loop-planner.ts'), 'utf8');
+const schema = fs.readFileSync(path.join(root, 'src/core/loops/loop-schema.ts'), 'utf8');
+const prompts = fs.readFileSync(path.join(root, 'src/core/loops/loop-worker-prompts.ts'), 'utf8');
+const owner = fs.readFileSync(path.join(root, 'src/core/loops/loop-owner-inference.ts'), 'utf8');
+assertGate(planner.includes('memory_hints_used: hints'), 'loop planner must store actual memory hints used');
+assertGate(schema.includes('memory_hints_used?: SksLoopMemoryHint[]'), 'loop schema must type memory_hints_used as hint array');
+assertGate(owner.includes('memoryHintMayExpandOwnerScope(): false'), 'owner inference must expose no-expand memory contract');
+assertGate(prompts.includes('Memory hints are guidance only; memory never grants write permission or expands owner scope.'), 'worker prompt must state memory cannot expand write permission');
+emitGate('init-deep:memory-scope-safety');
+function assertGate(condition, message) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=init-deep-memory-scope-safety-check.js.map