sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/naruto-ssot-gate-aliases-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const proofPolicy = readText('src/core/proof/route-proof-policy.ts');
+const proofGate = readText('src/core/proof/route-proof-gate.ts');
+const runtimeGates = readText('src/core/pipeline-internals/runtime-gates.ts');
+assertGate(proofPolicy.includes('team') && proofPolicy.includes('$Naruto'), 'proof policy must normalize Team aliases to Naruto');
+assertGate(proofGate.includes('MAX_NARUTO_AGENT_COUNT') || proofGate.includes('100'), 'Naruto proof gate must allow Naruto clone ceiling');
+assertGate(runtimeGates.includes('naruto-gate.json'), 'runtime gates must recognize naruto-gate.json');
+emitGate('naruto:ssot-gate-aliases', { proof_aliases: true });
+//# sourceMappingURL=naruto-ssot-gate-aliases-check.js.map

package/dist/scripts/naruto-ssot-pipeline-default-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const runtimeCore = readText('src/core/pipeline-internals/runtime-core.ts');
+const agentPlan = readText('src/core/agents/agent-plan.ts');
+const routes = readText('src/core/routes.ts');
+assertGate(runtimeCore.includes('prepareNaruto') && runtimeCore.includes('naruto-gate.json'), 'pipeline runtime must prepare Naruto missions and gates');
+assertGate(runtimeCore.includes('materialize Naruto clone roster') && !runtimeCore.includes("route?.id === 'Naruto'\n      ? 'materialize full Team artifacts"), 'pipeline next-actions must describe Naruto artifacts for Naruto routes');
+assertGate(agentPlan.includes('Naruto') || agentPlan.includes('naruto'), 'agent intake planning must include Naruto route');
+assertGate(routes.includes('routeRequiresSubagents') && routes.includes('Naruto'), 'route defaults must require subagents for Naruto');
+emitGate('naruto:ssot-pipeline-default', { pipeline_default: 'Naruto' });
+//# sourceMappingURL=naruto-ssot-pipeline-default-check.js.map

package/dist/scripts/naruto-ssot-route-normalization-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const routes = await importDist('core/routes.js');
+const explicitTeam = routes.routePrompt('$Team fix a release bug');
+const explicitNaruto = routes.routePrompt('$Naruto fix a release bug');
+assertGate(explicitTeam?.id === 'Naruto', '$Team prompt must normalize to Naruto');
+assertGate(explicitNaruto?.id === 'Naruto', '$Naruto prompt must resolve to Naruto');
+emitGate('naruto:ssot-route-normalization', { team: explicitTeam?.id, naruto: explicitNaruto?.id });
+//# sourceMappingURL=naruto-ssot-route-normalization-check.js.map

package/dist/scripts/naruto-ssot-routing-check.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, importDist, readText } from './sks-1-18-gate-lib.js';
+const routes = await importDist('core/routes.js');
+const explicitTeam = routes.routePrompt('$Team fix the release gate');
+const ordinaryWork = routes.routePrompt('implement a fix for the release gate');
+const explicitNaruto = routes.routePrompt('$Naruto run release audit');
+assertGate(explicitTeam?.id === 'Naruto', '$Team must normalize to Naruto for new work', explicitTeam);
+assertGate(ordinaryWork?.id === 'Naruto', 'ordinary implementation work must default to Naruto', ordinaryWork);
+assertGate(explicitNaruto?.id === 'Naruto', '$Naruto must route to Naruto', explicitNaruto);
+const routeSource = readText('src/core/routes.ts');
+assertGate(routeSource.includes('hidden: true') && routeSource.includes("aliasTo: '$Naruto'"), 'Team route must be hidden deprecated alias');
+emitGate('naruto:ssot-routing', { team_alias: explicitTeam.id, ordinary: ordinaryWork.id });
+//# sourceMappingURL=naruto-ssot-routing-check.js.map

package/dist/scripts/naruto-verification-pool-check.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const governorMod = await importDist('core/naruto/naruto-concurrency-governor.js');
+const verificationDag = await importDist('core/naruto/naruto-verification-dag.js');
+const verificationPool = await importDist('core/naruto/naruto-verification-pool.js');
+const graph = workGraph.buildNarutoWorkGraph({ requestedClones: 8, totalWorkItems: 12, writeCapable: true });
+const governor = governorMod.decideNarutoConcurrency({
+    requestedClones: 8,
+    totalWorkItems: 12,
+    backend: 'fake',
+    hardware: {
+        cores: 4,
+        loadAverage: [0, 0, 0],
+        remoteApiRateLimitBudget: 8,
+        fileDescriptorLimit: 4096,
+        processCount: 1,
+        zellijPaneCount: 0,
+        diskIoPressure: 0,
+        freeMemoryBytes: 8 * 1024 * 1024 * 1024,
+        totalMemoryBytes: 16 * 1024 * 1024 * 1024
+    }
+});
+const dag = verificationDag.buildNarutoVerificationDag(graph, { cwd: root, command: 'node -e "process.exit(0)"' });
+const report = await verificationPool.runNarutoVerificationPool(dag, { ...governor, verification_parallel: 4 }, { cwd: root });
+assertGate(report.ok === true, 'verification pool must pass all fixture shards', report);
+assertGate(report.safe_concurrency === 4, 'verification pool must use its own safe concurrency', report);
+assertGate(report.task_count > 1, 'verification pool must run multiple shards', report);
+assertGate(report.cpu_heavy_cap_respected && report.io_heavy_cap_respected && report.api_rate_cap_respected, 'verification pool must respect resource caps', report);
+emitGate('naruto:verification-pool', {
+    task_count: report.task_count,
+    safe_concurrency: report.safe_concurrency,
+    passed: report.passed
+});
+//# sourceMappingURL=naruto-verification-pool-check.js.map

package/dist/scripts/naruto-visible-vs-active-workers-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const decision = decideNarutoConcurrency({ requestedClones: 32, totalWorkItems: 64, backend: 'fake', zellijVisiblePaneCap: 8, parallelismMode: 'extreme' });
+assertGate(decision.safe_active_workers >= decision.safe_zellij_visible_panes && decision.headless_workers === decision.safe_active_workers - decision.safe_zellij_visible_panes, 'active workers must be separate from visible panes', decision);
+const src = readText('src/core/commands/naruto-command.ts');
+assertGate(src.includes('target active workers') && src.includes('visible panes') && src.includes('headless workers'), 'Naruto UX must print active/visible/headless counts');
+emitGate('naruto:visible-vs-active-workers', decision);
+//# sourceMappingURL=naruto-visible-vs-active-workers-check.js.map

package/dist/scripts/naruto-work-graph-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const workGraph = await importDist('core/naruto/naruto-work-graph.js');
+const graph = workGraph.buildNarutoWorkGraph({
+    requestedClones: 24,
+    totalWorkItems: 30,
+    writeCapable: true,
+    targetPaths: Array.from({ length: 30 }, (_, index) => `src/fixture-${index}.ts`),
+    maxActiveWorkers: 8
+});
+const validation = workGraph.validateNarutoWorkGraph(graph);
+assertGate(graph.ok === true && validation.ok === true, 'Naruto work graph must validate', { graph_blockers: graph.blockers, validation });
+assertGate(graph.total_work_items >= graph.requested_clones * 2, 'write-capable work graph must create at least 2x requested clone count', { total: graph.total_work_items, requested: graph.requested_clones });
+assertGate(graph.mixed_work_kinds.length > 4, 'work graph must contain mixed work kinds, not only verification', { kinds: graph.mixed_work_kinds });
+assertGate(graph.write_allowed_count > 0, 'write-capable Naruto graph must include write_allowed work items', { write_allowed_count: graph.write_allowed_count });
+assertGate(graph.active_waves.every((wave) => wave.conflict_count === 0), 'active waves must not overlap write leases', { waves: graph.active_waves });
+emitGate('naruto:work-graph', {
+    total_work_items: graph.total_work_items,
+    mixed_work_kinds: graph.mixed_work_kinds,
+    write_allowed_count: graph.write_allowed_count,
+    wave_count: graph.active_waves.length
+});
+//# sourceMappingURL=naruto-work-graph-check.js.map

package/dist/scripts/naruto-worktree-coding-blackbox.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { makeGitFixture, run } from './lib/git-worktree-fixture.js';
+const managerMod = await importDist('core/git/git-worktree-manager.js');
+const diffMod = await importDist('core/git/git-worktree-diff.js');
+const mergeMod = await importDist('core/git/git-worktree-merge-queue.js');
+const repo = makeGitFixture('naruto-worktree-blackbox');
+process.env.SKS_WORKTREE_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-blackbox-'));
+const allocations = [];
+for (const file of ['a.txt', 'b.txt']) {
+    const allocation = await managerMod.allocateWorkerWorktree({ repoRoot: repo, missionId: 'M-naruto-blackbox', workerId: file.replace('.txt', ''), slotId: file.replace('.txt', '') });
+    fs.writeFileSync(path.join(allocation.worktree_path, file), `${file}\nworker-change\n`);
+    allocations.push(allocation);
+}
+assertGate(run('git', ['status', '--porcelain=v1'], repo).trim() === '', 'main worktree must remain unchanged before integration');
+const diffs = [];
+for (const allocation of allocations) {
+    diffs.push(await diffMod.exportGitWorktreeDiff({ mainRepoRoot: repo, worktreePath: allocation.worktree_path, missionId: 'M-naruto-blackbox', workerId: allocation.worker_id }));
+}
+const integration = await managerMod.allocateWorkerWorktree({ repoRoot: repo, missionId: 'M-naruto-blackbox', workerId: 'integration', slotId: 'integration' });
+const report = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktreePath: integration.worktree_path, diffs });
+assertGate(report.ok === true && report.applied_count === 2, 'integration worktree merge report must apply worker diffs', report);
+assertGate(run('git', ['status', '--porcelain=v1'], repo).trim() === '', 'main worktree must remain unchanged after integration queue');
+emitGate('naruto:worktree-coding:blackbox', { allocations: allocations.length, applied_count: report.applied_count });
+//# sourceMappingURL=naruto-worktree-coding-blackbox.js.map

package/dist/scripts/naruto-worktree-coding-check.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { makeGitFixture, makeNonGitFixture } from './lib/git-worktree-fixture.js';
+const capabilityMod = await importDist('core/git/git-worktree-capability.js');
+const workGraphMod = await importDist('core/naruto/naruto-work-graph.js');
+const activePoolMod = await importDist('core/naruto/naruto-active-pool.js');
+const governorMod = await importDist('core/naruto/naruto-concurrency-governor.js');
+const repo = makeGitFixture('naruto-worktree-coding');
+process.env.SKS_WORKTREE_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-wt-'));
+const capability = await capabilityMod.evaluateGitWorktreeCapability({ root: repo, missionId: 'M-naruto-wt', requireGitWorktree: process.argv.includes('--require-real') });
+const policy = {
+    mode: capability.mode,
+    required: capability.mode === 'git-worktree',
+    main_repo_root: capability.detection.root,
+    worktree_root: capability.root_resolution?.root || null,
+    fallback_reason: capability.mode === 'git-worktree' ? null : capability.blockers.join(';')
+};
+const graph = workGraphMod.buildNarutoWorkGraph({
+    requestedClones: 8,
+    totalWorkItems: 12,
+    writeCapable: true,
+    targetPaths: Array.from({ length: 12 }, (_, index) => `src/wt-${index}.ts`),
+    maxActiveWorkers: 4,
+    worktreePolicy: policy
+});
+const governor = governorMod.decideNarutoConcurrency({ requestedClones: 8, totalWorkItems: 12, pendingWorkQueueSize: 12, backend: 'fake' });
+const pool = await activePoolMod.runNarutoActivePool({ graph, governor: { ...governor, safe_active_workers: 4 } });
+assertGate(capability.ok === true && capability.mode === 'git-worktree', 'Git Naruto coding fixture must use git-worktree mode', capability);
+assertGate(graph.worktree_policy.mode === 'git-worktree', 'Naruto work graph must carry git-worktree policy', graph.worktree_policy);
+assertGate(graph.work_items.filter((item) => item.write_allowed).every((item) => item.worktree?.allocation_required === true), 'write-capable work items must require worktree allocation', graph.work_items);
+assertGate(pool.worktree_allocation_required_count > 0, 'active pool must plan worktree allocations for write work', pool);
+const nonGit = makeNonGitFixture('naruto-worktree-non-git');
+const nonGitCapability = await capabilityMod.evaluateGitWorktreeCapability({ root: nonGit, missionId: 'M-naruto-non-git' });
+assertGate(nonGitCapability.mode === 'patch-envelope-only' && nonGitCapability.worktree_probe_attempted === false, 'non-Git Naruto must degrade without worktree probe', nonGitCapability);
+emitGate('naruto:worktree-coding', {
+    worktree_mode: graph.worktree_policy.mode,
+    allocation_required_count: pool.worktree_allocation_required_count,
+    non_git_mode: nonGitCapability.mode
+});
+//# sourceMappingURL=naruto-worktree-coding-check.js.map

package/dist/scripts/naruto-worktree-gpt-final-check.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const workGraphMod = await importDist('core/naruto/naruto-work-graph.js');
+const rolesMod = await importDist('core/naruto/naruto-role-policy.js');
+const packMod = await importDist('core/naruto/naruto-gpt-final-pack.js');
+const policy = {
+    mode: 'git-worktree',
+    required: true,
+    main_repo_root: '/repo',
+    worktree_root: '/cache/sks/worktrees/repo/M-final',
+    fallback_reason: null
+};
+const graph = workGraphMod.buildNarutoWorkGraph({ requestedClones: 6, totalWorkItems: 8, writeCapable: true, worktreePolicy: policy });
+const roleDistribution = rolesMod.buildNarutoRoleDistribution(graph.work_items);
+const worktreeDiff = {
+    schema: 'sks.git-worktree-diff.v1',
+    ok: true,
+    mission_id: 'M-final',
+    worker_id: 'worker-1',
+    main_repo_root: '/repo',
+    worktree_path: '/cache/wt/worker-1',
+    branch: 'sks/M/worker-1',
+    changed_files: ['src/a.ts'],
+    diff: 'diff --git a/src/a.ts b/src/a.ts\n',
+    diff_bytes: 37
+};
+const pack = packMod.buildNarutoGptFinalPack({
+    missionId: 'M-final',
+    graph,
+    roleDistribution,
+    changedFiles: ['src/a.ts'],
+    worktreePolicy: policy,
+    worktreeDiffs: [worktreeDiff],
+    localLlmMetrics: { participated: true, final_status: 'draft_until_gpt_final' }
+});
+assertGate(pack.worktree_policy.mode === 'git-worktree', 'GPT final pack must include worktree policy', pack.worktree_policy);
+assertGate(pack.worktree_diffs.length === 1, 'GPT final pack must include bounded worktree diffs', pack);
+assertGate(pack.local_llm_metrics.final_status === 'draft_until_gpt_final', 'local LLM output must remain draft until GPT final', pack.local_llm_metrics);
+assertGate(pack.bounded === true && pack.secrets_redacted === true, 'GPT final pack must stay bounded/redacted', pack);
+emitGate('naruto:worktree-gpt-final', {
+    worktree_mode: pack.worktree_policy.mode,
+    worktree_diffs: pack.worktree_diffs.length
+});
+//# sourceMappingURL=naruto-worktree-gpt-final-check.js.map

package/dist/scripts/naruto-worktree-zellij-ui-check.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const dashboardMod = await importDist('core/zellij/zellij-naruto-dashboard.js');
+const plan = dashboardMod.planNarutoZellijDashboard({
+    targetActiveWorkers: 10,
+    visiblePaneCap: 6,
+    roles: ['implementer', 'verifier'],
+    backend: 'codex-sdk',
+    worktreePolicy: {
+        mode: 'git-worktree',
+        required: true,
+        main_repo_root: '/repo',
+        worktree_root: '/cache/sks/worktrees/repo/M',
+        fallback_reason: null
+    }
+});
+assertGate(plan.ok === true, 'Naruto worktree Zellij dashboard must pass', plan);
+assertGate(plan.worktree_mode === 'git-worktree', 'dashboard must carry worktree mode', plan);
+assertGate(plan.worktree_labels.length === plan.visible_worker_panes, 'visible panes must have worktree labels', plan);
+assertGate(plan.pane_titles.every((title) => title.includes('WT:') && title.includes('branch:')), 'pane titles must include worktree id and branch', plan.pane_titles);
+assertGate(plan.headless_workers === 4, 'dashboard must still expose headless worker count', plan);
+emitGate('naruto:worktree-zellij-ui', {
+    visible_worker_panes: plan.visible_worker_panes,
+    headless_workers: plan.headless_workers,
+    sample_title: plan.pane_titles[0]
+});
+//# sourceMappingURL=naruto-worktree-zellij-ui-check.js.map

package/dist/scripts/naruto-zellij-dynamic-right-column-check.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_ZELLIJ === '1';
+const naruto = fs.readFileSync(path.join(root, 'src/core/commands/naruto-command.ts'), 'utf8');
+const worker = fs.readFileSync(path.join(root, 'src/core/zellij/zellij-worker-pane-manager.ts'), 'utf8');
+const swarm = fs.readFileSync(path.join(root, 'src/core/agents/native-cli-session-swarm.ts'), 'utf8');
+const realGeometryProof = requireReal ? runRealGeometryProof() : null;
+const report = {
+    schema: 'sks.naruto-zellij-dynamic-right-column-check.v1',
+    ok: true,
+    require_real: requireReal,
+    initial_main_only: /slotCount:\s*0/.test(naruto),
+    passes_session_name: naruto.includes('zellijSessionName: liveZellij?.session_name'),
+    passes_worker_placement: naruto.includes("workerPlacement: parsed.json || parsed.noOpenZellij ? 'process' : 'zellij-pane'"),
+    passes_visible_cap: naruto.includes('zellijVisiblePaneCap: zellijVisiblePanes'),
+    worker_uses_right_column: worker.includes("rightColumnMode: 'spawn-on-first-worker'") || swarm.includes("rightColumnMode: 'spawn-on-first-worker'"),
+    real_geometry_proof: realGeometryProof
+};
+report.ok = report.initial_main_only
+    && report.passes_session_name
+    && report.passes_worker_placement
+    && report.passes_visible_cap
+    && report.worker_uses_right_column
+    && (!requireReal || realGeometryProof?.ok === true);
+assertGate(report.ok, 'Naruto must use dynamic right-column worker panes in interactive mode', report);
+emitGate('naruto:zellij-dynamic-right-column', report);
+function runRealGeometryProof() {
+    const res = spawnSync('npm', ['run', 'zellij:right-column-real-geometry', '--silent', '--', '--require-real'], {
+        cwd: root,
+        env: { ...process.env, SKS_REQUIRE_ZELLIJ: '1' },
+        encoding: 'utf8',
+        maxBuffer: 20 * 1024 * 1024
+    });
+    return {
+        ok: res.status === 0,
+        exit_code: res.status,
+        stdout_tail: tail(res.stdout),
+        stderr_tail: tail(res.stderr)
+    };
+}
+function tail(text) {
+    return String(text || '').split('\n').slice(-30).join('\n');
+}
+//# sourceMappingURL=naruto-zellij-dynamic-right-column-check.js.map

package/dist/scripts/naruto-zellij-massive-ui-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const dashboardMod = await importDist('core/zellij/zellij-naruto-dashboard.js');
+const plan = dashboardMod.planNarutoZellijDashboard({
+    targetActiveWorkers: 32,
+    visiblePaneCap: 12,
+    completed: 8,
+    failed: 1,
+    backpressure: 'normal',
+    roles: ['implementer', 'modifier', 'test_writer', 'verifier'],
+    backend: 'codex-sdk'
+});
+assertGate(plan.ok === true, 'Naruto Zellij dashboard plan must pass', plan);
+assertGate(plan.visible_worker_panes === 12, 'targetActiveWorkers=32 and visiblePaneCap=12 must create 12 visible panes', plan);
+assertGate(plan.headless_workers === 20, 'remaining active workers must be listed as headless', plan);
+assertGate(plan.pane_titles.every((title) => /slot-\d+\/gen-1 · .+ · codex-sdk · active/.test(title)), 'pane titles must include slot/gen/role/backend/status', plan);
+emitGate('naruto:zellij-massive-ui', {
+    visible_worker_panes: plan.visible_worker_panes,
+    headless_workers: plan.headless_workers,
+    dashboard: plan.dashboard
+});
+//# sourceMappingURL=naruto-zellij-massive-ui-check.js.map

package/dist/scripts/native-app-screenshot-repair-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+const root = await makeTempRoot('sks-native-appshot-');
+const report = await repairNativeCapabilities({ root, fix: true, yes: true, capabilities: ['codex_app_screenshot'], fixture: 'all-repairable' });
+const registry = await fs.stat(path.join(root, '.sneakoscope', 'app-screenshots', 'screenshot-registry.json')).then(() => true, () => false);
+assertGate(registry && report.capabilities[0]?.after === 'verified', 'app screenshot repair must create registry and verify writable path', report);
+emitGate('native:app-screenshot-repair');
+//# sourceMappingURL=native-app-screenshot-repair-check.js.map

package/dist/scripts/native-capability-postcheck-check.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { buildNativeCapabilityRepairMatrix } from '../core/codex-native/native-capability-repair-matrix.js';
+import { postcheckNativeCapabilities } from '../core/codex-native/native-capability-postcheck.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+const root = await makeTempRoot('sks-native-postcheck-');
+const matrix = await buildNativeCapabilityRepairMatrix({ root, fixture: 'manual-required', reportPath: null });
+const postcheck = await postcheckNativeCapabilities({ root, matrix, fixture: 'manual-required' });
+const chrome = postcheck.capabilities.find((state) => state.id === 'chrome_web_review');
+const repairedManual = await repairNativeCapabilities({ root, fix: true, yes: true, fixture: 'manual-required' });
+const imagePath = repairedManual.capabilities.find((state) => state.id === 'image_path_exposure');
+assertGate(chrome?.after !== 'verified', 'postcheck must not verify Chrome/web review without extension readiness', postcheck);
+assertGate(imagePath?.after === 'degraded', 'saved artifact path fallback must be degraded, not verified native image path exposure', repairedManual);
+assertGate(postcheck.capabilities.every((state) => state.after !== null), 'postcheck must set after state for each capability', postcheck);
+emitGate('native-capability:postcheck');
+//# sourceMappingURL=native-capability-postcheck-check.js.map

package/dist/scripts/native-capability-repair-check.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+const root = await makeTempRoot('sks-native-repair-');
+process.env.SKS_CHROME_EXTENSION_READY = '1';
+process.env.SKS_COMPUTER_USE_CAPABILITY = 'verified';
+const report = await repairNativeCapabilities({ root, fix: true, yes: true, fixture: 'all-repairable' });
+const imageRegistry = await fs.stat(path.join(root, '.sneakoscope', 'image-artifacts', 'image-artifact-registry.json')).then(() => true, () => false);
+const screenshotRegistry = await fs.stat(path.join(root, '.sneakoscope', 'app-screenshots', 'screenshot-registry.json')).then(() => true, () => false);
+assertGate(report.ok === true, 'repairable native capabilities must verify after repair fixture', report);
+assertGate(imageRegistry && screenshotRegistry, 'native repair must create image and screenshot registries', { imageRegistry, screenshotRegistry });
+emitGate('native-capability:repair');
+//# sourceMappingURL=native-capability-repair-check.js.map

package/dist/scripts/native-capability-repair-matrix-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { buildNativeCapabilityRepairMatrix, NATIVE_CAPABILITY_IDS } from '../core/codex-native/native-capability-repair-matrix.js';
+const root = await makeTempRoot('sks-native-matrix-');
+const matrix = await buildNativeCapabilityRepairMatrix({ root, fixture: 'manual-required' });
+assertGate(matrix.schema === 'sks.native-capability-repair-matrix.v1', 'native repair matrix schema mismatch', matrix);
+assertGate(matrix.capabilities.length === NATIVE_CAPABILITY_IDS.length, 'native repair matrix must cover every capability', matrix);
+assertGate(matrix.capabilities.some((state) => state.id === 'chrome_web_review' && state.repairability === 'manual-required'), 'Chrome extension readiness must be manual-required when missing', matrix);
+emitGate('native-capability:repair-matrix', { capabilities: matrix.capabilities.length });
+//# sourceMappingURL=native-capability-repair-matrix-check.js.map

package/dist/scripts/native-chrome-web-review-repair-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+const root = await makeTempRoot('sks-native-chrome-');
+delete process.env.SKS_CHROME_EXTENSION_READY;
+const report = await repairNativeCapabilities({ root, fix: true, yes: true, capabilities: ['chrome_web_review'], fixture: 'manual-required' });
+const state = report.capabilities[0];
+assertGate(state?.repairability === 'manual-required' && state.after !== 'verified', 'Chrome/web review must not verify without extension readiness', report);
+emitGate('native:chrome-web-review-repair');
+//# sourceMappingURL=native-chrome-web-review-repair-check.js.map

package/dist/scripts/native-computer-use-repair-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+const root = await makeTempRoot('sks-native-computer-');
+delete process.env.SKS_COMPUTER_USE_CAPABILITY;
+const report = await repairNativeCapabilities({ root, fix: true, yes: true, capabilities: ['computer_use'], fixture: 'manual-required' });
+const state = report.capabilities[0];
+assertGate(state?.repairability === 'manual-required' && state.after !== 'verified', 'computer use must stay manual-required when OS permission/capability is unknown', report);
+emitGate('native:computer-use-repair');
+//# sourceMappingURL=native-computer-use-repair-check.js.map

package/dist/scripts/native-image-generation-repair-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { repairNativeCapabilities } from '../core/codex-native/native-capability-repair.js';
+const root = await makeTempRoot('sks-native-image-');
+const report = await repairNativeCapabilities({ root, fix: true, yes: true, capabilities: ['image_generation', 'image_followup_edit', 'saved_artifact_path_contract'], fixture: 'all-repairable' });
+assertGate(report.capabilities.some((state) => state.id === 'image_generation' && state.after === 'verified'), 'image generation fixture should verify after repair', report);
+assertGate(report.capabilities.some((state) => state.id === 'saved_artifact_path_contract' && state.after === 'verified'), 'saved artifact path contract should verify after repair', report);
+emitGate('native:image-generation-repair');
+//# sourceMappingURL=native-image-generation-repair-check.js.map

package/dist/scripts/native-swarm-heartbeat-does-not-serialize-launch-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/agents/native-cli-session-swarm.ts');
+assertGate(src.includes('SKS_ZELLIJ_WORKER_HEARTBEAT_TIMEOUT_MS || 5000'), 'heartbeat launch proof timeout must default to 5000ms');
+assertGate(src.includes('zellij_worker_heartbeat_missing_launch_warning') && !src.includes("...(heartbeatOk ? [] : ['zellij_worker_heartbeat_missing'])"), 'missing heartbeat must be warning before result timeout, not launch failure');
+emitGate('native-swarm:heartbeat-does-not-serialize-launch');
+//# sourceMappingURL=native-swarm-heartbeat-does-not-serialize-launch-check.js.map

package/dist/scripts/native-swarm-process-spawn-proof-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/agents/native-cli-session-swarm.ts');
+assertGate(src.includes('worker_process_spawned') && src.includes('child.pid') && src.includes('spawnCompactSlotWorkerProcess'), 'native swarm process spawn proof missing');
+emitGate('native-swarm:process-spawn-proof');
+//# sourceMappingURL=native-swarm-process-spawn-proof-check.js.map

package/dist/scripts/native-swarm-zellij-does-not-block-workers-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/agents/native-cli-session-swarm.ts');
+const processRunStart = src.indexOf('const processRun = liveWorkerPane');
+const compactBlock = src.slice(processRunStart, src.indexOf('const launchBlockers'));
+assertGate(processRunStart >= 0, 'native swarm must branch compact worker process from liveWorkerPane mode');
+assertGate(compactBlock.includes('spawnCompactSlotWorkerProcess') && compactBlock.indexOf('spawnCompactSlotWorkerProcess') < compactBlock.indexOf('openWorkerPane'), 'compact worker process should spawn before pane renderer path');
+assertGate(src.includes("process.env.SKS_REQUIRE_ZELLIJ === '1'") && src.includes('launchWarnings'), 'Zellij pane failure must only block when required');
+emitGate('native-swarm:zellij-does-not-block-workers');
+//# sourceMappingURL=native-swarm-zellij-does-not-block-workers-check.js.map

package/dist/scripts/no-ts-nocheck-core-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('lint:no-ts-nocheck-core');
+//# sourceMappingURL=no-ts-nocheck-core-check.js.map

package/dist/scripts/no-ts-nocheck-release-scripts-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective317Gate } from './sks-3-1-7-directive-check-lib.js';
+await runDirective317Gate('lint:no-ts-nocheck-release-scripts');
+//# sourceMappingURL=no-ts-nocheck-release-scripts-check.js.map

package/dist/scripts/non-recursive-pipeline-check.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { nonRecursivePipelineMarkdown, scanNonRecursivePipelinePolicy } from '../core/agents/agent-recursion-guard.js';
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const defaultRoot = path.resolve(scriptDir, '..');
+const args = process.argv.slice(2);
+const root = path.resolve(readFlag('--root') || defaultRoot);
+const json = args.includes('--json');
+const noWrite = args.includes('--no-write');
+const outputDir = path.join(root, '.sneakoscope', 'reports');
+const report = scanNonRecursivePipelinePolicy(collectScanRecords(root));
+if (!noWrite) {
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(path.join(outputDir, 'non-recursive-pipeline-report.json'), `${JSON.stringify(report, null, 2)}\n`);
+    fs.writeFileSync(path.join(outputDir, 'non-recursive-pipeline-report.md'), nonRecursivePipelineMarkdown(report));
+}
+if (json)
+    console.log(JSON.stringify(report, null, 2));
+else
+    console.log(`non-recursive-pipeline: ${report.ok ? 'pass' : 'blocked'} (${report.violations.length} violation(s), ${report.scanned_records.length} record(s), ${report.elapsed_ms}ms)`);
+if (!report.ok || !report.performance_ok || !report.secret_redaction_ok)
+    process.exitCode = 1;
+function readFlag(name) {
+    const idx = args.indexOf(name);
+    return idx >= 0 ? args[idx + 1] : null;
+}
+function collectScanRecords(scanRoot) {
+    const candidates = [
+        ['src/core/agents/agent-worker-pipeline.ts', 'source'],
+        ['src/core/agents/agent-recursion-guard.ts', 'source'],
+        ['src/core/agents/agent-runner-process.ts', 'source'],
+        ['src/core/agents/agent-runner-codex-exec.ts', 'source'],
+        ['docs/agent-non-recursive-pipeline.md', 'docs'],
+        ['docs/native-agent-kernel.md', 'docs']
+    ];
+    const records = [];
+    for (const [rel, channel] of candidates) {
+        const full = path.join(scanRoot, rel);
+        if (!fs.existsSync(full) || !fs.statSync(full).isFile())
+            continue;
+        records.push({ path: rel, channel, text: fs.readFileSync(full, 'utf8') });
+    }
+    records.push({
+        path: '.sneakoscope/reports/agent-worker.stdout.fixture.txt',
+        channel: 'stdout',
+        text: 'agent worker completed local slice; no nested route requested'
+    });
+    records.push({
+        path: '.sneakoscope/reports/agent-worker.stderr.fixture.txt',
+        channel: 'stderr',
+        text: 'agent worker stderr clean; no recursive SKS command emitted'
+    });
+    records.push({
+        path: '.sneakoscope/reports/agent-result.fixture.json',
+        channel: 'agent_result',
+        text: JSON.stringify({
+            schema: 'sks.agent-result.v1',
+            status: 'done',
+            recursion_guard: { ok: true, violations: [] },
+            blockers: []
+        })
+    });
+    return records;
+}
+//# sourceMappingURL=non-recursive-pipeline-check.js.map

package/dist/scripts/npm-publish-performance-check.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
+const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2300 * 1024);
+const BUDGET_MS = Number(process.env.SKS_PACK_BUDGET_MS || 30000);
+function runNpmPack() {
+    const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
+    const argv = ['pack', '--dry-run', '--json', '--ignore-scripts'];
+    const res = npmCli
+        ? spawnSync(process.execPath, [npmCli, ...argv], { cwd: root, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 })
+        : spawnSync('npm', argv, { cwd: root, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+    return res;
+}
+function writeReport(report) {
+    const out = path.join(root, '.sneakoscope', 'reports', 'npm-publish-performance.json');
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+}
+const t0 = Date.now();
+const res = runNpmPack();
+const packMs = Date.now() - t0;
+let info;
+if (res.status === 0) {
+    try {
+        const parsed = JSON.parse(res.stdout);
+        info = Array.isArray(parsed) ? parsed[0] : parsed;
+    }
+    catch {
+        info = undefined;
+    }
+}
+if (!info) {
+    // Real-check gate: never fail when npm is unreachable / pack unavailable.
+    const report = { ok: true, integration_optional: true, reason: 'npm_pack_unavailable' };
+    writeReport(report);
+    emitGate('publish:dry-run-performance', { integration_optional: true });
+    process.exit(0);
+}
+const report = {
+    schema: 'sks.npm-publish-performance.v1',
+    ok: info.entryCount <= MAX_FILES && info.size <= MAX_PACKED,
+    pack_ms: packMs,
+    slowest_phase: 'pack',
+    file_count: info.entryCount,
+    packed_bytes: info.size,
+    unpacked_bytes: info.unpackedSize,
+    over_budget: packMs > BUDGET_MS,
+    warnings: packMs > BUDGET_MS ? ['pack_slower_than_budget'] : [],
+    blockers: [
+        ...(info.entryCount > MAX_FILES ? ['pack_file_count_over_limit'] : []),
+        ...(info.size > MAX_PACKED ? ['pack_size_over_limit'] : [])
+    ]
+};
+writeReport(report);
+if (report.blockers.length) {
+    assertGate(false, 'npm_publish_performance_blockers', { blockers: report.blockers, report });
+}
+// A slow pack is a WARNING only, not a blocker.
+console.log(JSON.stringify(report, null, 2));
+process.exit(0);
+//# sourceMappingURL=npm-publish-performance-check.js.map