sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/postinstall-safe-side-effects-check.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { root, assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+// Locks the guarantee that `postinstall` performs no heavy / network / process-kill
+// side-effects by default. This is STATIC source analysis only — we never execute
+// `postinstall`, because doing so would mutate the global Codex App / shell environment.
+const helpers = readText('src/cli/install-helpers.ts');
+// Heavy CLI tool installs (brew / npm globals) are opt-in only.
+assertGate(helpers.includes('SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS'), 'postinstall cli tool install must be gated behind SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS');
+// Killing a third-party app's processes is opt-in only.
+assertGate(helpers.includes("SKS_POSTINSTALL_RECONCILE_APP_PROCESSES === '1'"), 'postinstall process reconciliation must be gated behind SKS_POSTINSTALL_RECONCILE_APP_PROCESSES');
+// Config writes are gated (unparseable preserved / unsafe rewrite skipped) and backed up.
+assertGate(helpers.includes('unparseable_config_preserved'), 'postinstall must preserve unparseable config');
+assertGate(helpers.includes('skipped_unsafe_rewrite'), 'postinstall must skip unsafe config rewrites');
+assertGate(helpers.includes('backupCodexConfig'), 'postinstall config writes must back up the existing config');
+// User model / service_tier are set-if-absent, never overwritten.
+assertGate(helpers.includes('upsertTopLevelTomlStringIfAbsent'), 'postinstall must set user model/service_tier only when absent');
+// The postinstall() body must be wrapped in try/catch/finally so it never fails `npm install`.
+const postinstallStart = helpers.indexOf('export async function postinstall');
+assertGate(postinstallStart !== -1, 'postinstall function not found in install-helpers.ts');
+const afterStart = postinstallStart + 'export async function postinstall'.length;
+const nextExport = helpers.indexOf('\nexport ', afterStart);
+const nextAsync = helpers.indexOf('\nasync function ', afterStart);
+const candidates = [nextExport, nextAsync].filter((idx) => idx !== -1);
+const bodyEnd = candidates.length ? Math.min(...candidates) : helpers.length;
+const postinstallBody = helpers.slice(postinstallStart, bodyEnd);
+assertGate(postinstallBody.includes('try'), 'postinstall body must use try (never fail npm install)');
+assertGate(postinstallBody.includes('catch'), 'postinstall body must use catch (never fail npm install)');
+assertGate(postinstallBody.includes('finally'), 'postinstall body must use finally (never fail npm install)');
+// Explicit repair / opt-in paths must be surfaced to the user.
+assertGate(helpers.includes('sks bootstrap'), 'postinstall must surface `sks bootstrap` repair path');
+assertGate(helpers.includes('sks deps check'), 'postinstall must surface `sks deps check` repair path');
+assertGate(helpers.includes('sks doctor --fix'), 'postinstall must surface `sks doctor --fix` repair path');
+assertGate(helpers.includes('SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS=1'), 'postinstall hint must mention the SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS=1 opt-in');
+// init.ts hardening: managed Codex config merge is set-if-absent and never force-overwrites features.
+const init = readText('src/core/init.ts');
+const mergeStart = init.indexOf('mergeManagedCodexConfigToml(');
+assertGate(mergeStart !== -1, 'mergeManagedCodexConfigToml not found in init.ts');
+const afterMergeStart = mergeStart + 'mergeManagedCodexConfigToml('.length;
+const mergeNextExport = init.indexOf('\nexport ', afterMergeStart);
+const mergeNextAsync = init.indexOf('\nasync function ', afterMergeStart);
+const mergeNextFn = init.indexOf('\nfunction ', afterMergeStart);
+const mergeCandidates = [mergeNextExport, mergeNextAsync, mergeNextFn].filter((idx) => idx !== -1);
+const mergeEnd = mergeCandidates.length ? Math.min(...mergeCandidates) : init.length;
+const mergeBody = init.slice(mergeStart, mergeEnd);
+assertGate(mergeBody.includes('upsertTomlTableKeyIfAbsent'), 'managed config merge must set feature flags only when absent');
+assertGate(mergeBody.includes("SKS_MANAGE_CODEX_APP_PLUGINS === '1'"), 'managed config plugin auto-enable must be opt-in via SKS_MANAGE_CODEX_APP_PLUGINS=1');
+assertGate(!/upsertTomlTableKey\(next, 'features'/.test(mergeBody), 'managed config merge must NOT force-overwrite the features table');
+const report = {
+    schema: 'sks.postinstall-safe-side-effects.v1',
+    ok: true,
+    gated: ['cli_install', 'process_kill', 'config_write'],
+    try_catch_finally: true,
+    managed_config_set_if_absent: true
+};
+const out = path.join(root, '.sneakoscope/reports/postinstall-safe-side-effects.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+emitGate('postinstall:safe-side-effects', {
+    gated: ['cli_install', 'process_kill', 'config_write'],
+    try_catch_finally: true
+});
+//# sourceMappingURL=postinstall-safe-side-effects-check.js.map

package/dist/scripts/ppt-full-e2e-artifact-graph-check.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+const reportPath = path.join(process.cwd(), '.sneakoscope', 'reports', 'ppt-full-e2e-blackbox.json');
+if (!fs.existsSync(reportPath)) {
+    const run = spawnSync(process.execPath, ['./dist/scripts/ppt-full-e2e-blackbox-check.js'], { cwd: process.cwd(), env: process.env, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
+    if (run.status !== 0) {
+        console.log(JSON.stringify({ schema: 'sks.ppt-full-e2e-artifact-graph.v1', ok: false, blocker: 'blackbox_failed', stdout_tail: run.stdout.slice(-2000), stderr_tail: run.stderr.slice(-2000) }, null, 2));
+        process.exit(1);
+    }
+}
+const blackbox = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+const required = ['inventory', 'exportLedger', 'callouts', 'slideIssues', 'deckIssues'];
+const blockers = required.filter((key) => !blackbox.artifacts?.[key]).map((key) => `missing:${key}`);
+if (!blackbox.artifacts?.proof_schema)
+    blockers.push('missing:completion_proof');
+if (!blackbox.artifacts?.trust_schema)
+    blockers.push('missing:trust_report');
+if (blackbox.generated_slide_review_count < blackbox.exported_slide_images_count)
+    blockers.push('generated_review_count_lt_slide_count');
+if (blackbox.issue_extraction_count <= 0)
+    blockers.push('issue_extraction_empty');
+if (!blackbox.mock_fake_not_verified_real)
+    blockers.push('mock_promoted_to_real');
+const result = {
+    schema: 'sks.ppt-full-e2e-artifact-graph.v1',
+    ok: blockers.length === 0,
+    mission_id: blackbox.mission_id,
+    local_only_policy: true,
+    generated_slide_review_count: blackbox.generated_slide_review_count,
+    slide_count: blackbox.exported_slide_images_count,
+    issue_extraction_count: blackbox.issue_extraction_count,
+    blockers
+};
+console.log(JSON.stringify(result, null, 2));
+if (!result.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=ppt-full-e2e-artifact-graph-check.js.map

package/dist/scripts/ppt-full-e2e-blackbox-check.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-ppt-e2e-'));
+const deck = path.join(tmp, 'synthetic-two-slide.pptx');
+fs.writeFileSync(deck, [
+    'ppt/slides/slide1.xml',
+    '<p:sld><p:cSld><p:spTree><a:t>SKS 1.14.1 Synthetic Slide 1</a:t></p:spTree></p:cSld></p:sld>',
+    'ppt/slides/slide2.xml',
+    '<p:sld><p:cSld><p:spTree><a:t>SKS 1.14.1 Synthetic Slide 2</a:t></p:spTree></p:cSld></p:sld>'
+].join('\n'));
+const repoRoot = process.cwd();
+const run = spawnSync(process.execPath, [path.join(repoRoot, 'dist/bin/sks.js'), 'ppt', 'review', '--deck', deck, '--mock', '--imagegen', '--json'], {
+    cwd: tmp,
+    env: { ...process.env, SKS_TEST_FAKE_IMAGEGEN: '1', SKS_TEST_FAKE_EXTRACTOR: '1' },
+    encoding: 'utf8',
+    maxBuffer: 8 * 1024 * 1024
+});
+const parsed = parseJson(run.stdout);
+const missionDir = parsed?.mission_id ? path.join(tmp, '.sneakoscope', 'missions', parsed.mission_id) : null;
+const inventory = (missionDir ? readJson(path.join(missionDir, 'ppt-deck-inventory.json')) : null)
+    || parsed?.artifacts?.deck_inventory
+    || parsed?.artifacts?.deckInventory
+    || null;
+const exportLedger = (missionDir ? readJson(path.join(missionDir, 'ppt-slide-export-ledger.json')) : null)
+    || parsed?.artifacts?.slide_export_ledger
+    || parsed?.artifacts?.slideExportLedger
+    || null;
+const callouts = missionDir ? readJson(path.join(missionDir, 'ppt-slide-callout-ledger.json')) : null;
+const slideIssues = missionDir ? readJson(path.join(missionDir, 'ppt-slide-issue-ledger.json')) : null;
+const deckIssues = missionDir ? readJson(path.join(missionDir, 'ppt-deck-issue-ledger.json')) : null;
+const proof = missionDir ? readJson(path.join(missionDir, 'completion-proof.json')) : null;
+const trust = missionDir ? readJson(path.join(missionDir, 'trust-report.json')) : null;
+const fakeNotReal = !JSON.stringify(callouts || {}).includes('"real_generated":true');
+const proofStatusOk = proof?.schema === 'sks.completion-proof.v1' && ['verified', 'verified_partial'].includes(String(proof?.status || ''));
+const trustStatusOk = trust?.schema === 'sks.trust-report.v1' && trust?.ok === true && !['blocked', 'failed', 'not_verified'].includes(String(trust?.status || ''));
+const ok = Boolean(parsed?.mission_id)
+    && inventory?.deck_present === true
+    && inventory?.slide_count >= 1
+    && exportLedger?.exported_slide_images_count >= 1
+    && callouts?.generated_slide_callout_images_count >= exportLedger.exported_slide_images_count
+    && Array.isArray(slideIssues?.issues)
+    && slideIssues.issues.length > 0
+    && deckIssues?.schema === 'sks.ppt-deck-issue-ledger.v1'
+    && proofStatusOk
+    && trustStatusOk
+    && fakeNotReal;
+const result = {
+    schema: 'sks.ppt-full-e2e-blackbox.v1',
+    ok,
+    process_status: run.status,
+    mission_id: parsed?.mission_id || null,
+    deck,
+    synthetic_deck: true,
+    manual_slide_images_used: false,
+    slide_count: inventory?.slide_count || 0,
+    exported_slide_images_count: exportLedger?.exported_slide_images_count || 0,
+    generated_slide_review_count: callouts?.generated_slide_callout_images_count || 0,
+    issue_extraction_count: slideIssues?.issues?.length || 0,
+    mock_fake_not_verified_real: fakeNotReal,
+    completion_proof_linked: proofStatusOk,
+    trust_report_linked: trustStatusOk,
+    wrongness_linked: true,
+    proof_status: proof?.status || null,
+    trust_ok: trust?.ok ?? null,
+    trust_status: trust?.status || null,
+    trust_blockers: trust?.blockers || [],
+    blockers: [
+        ...(!proofStatusOk ? [`completion_proof_status_${proof?.status || 'missing'}`] : []),
+        ...(!trustStatusOk ? [`trust_report_status_${trust?.status || 'missing'}`] : []),
+        ...(!fakeNotReal ? ['mock_or_fake_marked_real'] : [])
+    ],
+    artifacts: {
+        inventory,
+        exportLedger,
+        callouts,
+        slideIssues,
+        deckIssues,
+        proof_schema: proof?.schema || null,
+        proof_status: proof?.status || null,
+        trust_schema: trust?.schema || null,
+        trust_ok: trust?.ok ?? null,
+        trust_status: trust?.status || null
+    },
+    stdout_tail: run.stdout.slice(-2000),
+    stderr_tail: run.stderr.slice(-2000)
+};
+const out = path.join(repoRoot, '.sneakoscope', 'reports', 'ppt-full-e2e-blackbox.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(result, null, 2)}\n`);
+console.log(JSON.stringify(result, null, 2));
+if (!ok)
+    process.exitCode = 1;
+function parseJson(text) { try {
+    return JSON.parse(text);
+}
+catch {
+    return null;
+} }
+function readJson(file) { try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+catch {
+    return null;
+} }
+//# sourceMappingURL=ppt-full-e2e-blackbox-check.js.map

package/dist/scripts/ppt-image-voxel-relations-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, hasRelationType, runPptReview } from './sks-1-11-gate-lib.js';
+const result = runPptReview('review');
+for (const type of ['slide_callout_review_of', 'slide_issue_detected_in', 'deck_patch_attempt_for_issue', 'fixed_slide_after', 'slide_re_review_of_after', 'slide_issue_resolved_by_recheck']) {
+    assertGate(hasRelationType(result.mission_id, type), `ppt image voxel relation missing: ${type}`, { mission_id: result.mission_id });
+}
+emitGate('ppt:image-voxel-relations', { mission_id: result.mission_id });
+//# sourceMappingURL=ppt-image-voxel-relations-check.js.map

package/dist/scripts/ppt-imagegen-blackbox-check.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { osTempPngFixtureArg } from './lib/valid-png-fixture.js';
+const sourceImage = osTempPngFixtureArg('ppt-imagegen-blackbox-source.png');
+const run = spawnSync(process.execPath, ['./dist/bin/sks.js', 'ppt', 'review', '--manual-slide-images', sourceImage, '--json'], {
+    cwd: process.cwd(),
+    env: { ...process.env, SKS_TEST_FAKE_IMAGEGEN: '1', SKS_TEST_FAKE_EXTRACTOR: '1' },
+    encoding: 'utf8',
+    maxBuffer: 4 * 1024 * 1024
+});
+const parsed = parseJson(run.stdout);
+const missionDir = parsed?.mission_id ? path.join(process.cwd(), '.sneakoscope', 'missions', parsed.mission_id) : null;
+const callouts = missionDir ? readJson(path.join(missionDir, 'ppt-slide-callout-ledger.json')) : null;
+const slideIssues = missionDir ? readJson(path.join(missionDir, 'ppt-slide-issue-ledger.json')) : null;
+const deckIssues = missionDir ? readJson(path.join(missionDir, 'ppt-deck-issue-ledger.json')) : null;
+const proofEvidence = parsed?.proof_evidence || null;
+const ok = Boolean(parsed?.mission_id)
+    && callouts?.generated_slide_callout_images_count === 1
+    && callouts?.generated_review_images?.[0]?.mock === true
+    && Array.isArray(slideIssues?.issues)
+    && slideIssues.issues.length > 0
+    && deckIssues?.schema === 'sks.ppt-deck-issue-ledger.v1'
+    && proofEvidence?.schema === 'sks.ppt-review-proof-evidence.v1';
+console.log(JSON.stringify({ schema: 'sks.ppt-imagegen-blackbox-check.v1', ok, process_status: run.status, mission_id: parsed?.mission_id || null, gate_status: parsed?.status || null, source_image: sourceImage, generated_count: callouts?.generated_slide_callout_images_count || 0, issue_count: slideIssues?.issues?.length || 0, proof_status: proofEvidence?.status || null }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ppt-imagegen-blackbox-check.js.map

package/dist/scripts/ppt-imagegen-review-fixture-check.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, runPptReview } from './sks-1-11-gate-lib.js';
+const result = runPptReview('review');
+emitGate('ppt:imagegen-review-fixture', { mission_id: result.mission_id, relations: result.proof_evidence.image_voxel_relation_count });
+//# sourceMappingURL=ppt-imagegen-review-fixture-check.js.map

package/dist/scripts/ppt-issue-extraction-fixture-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runPptReview } from './sks-1-11-gate-lib.js';
+const result = runPptReview('extract-issues');
+assertGate(result.artifacts.slideIssues?.issues?.length > 0 && result.proof_evidence.slide_issue_extraction_status === 'valid', 'ppt issue extraction fixture invalid', result.artifacts.slideIssues);
+emitGate('ppt:issue-extraction-fixture', { mission_id: result.mission_id, issues: result.artifacts.slideIssues.issues.length });
+//# sourceMappingURL=ppt-issue-extraction-fixture-check.js.map

package/dist/scripts/ppt-no-mock-as-real-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readMissionJson, runPptReview } from './sks-1-11-gate-lib.js';
+const result = runPptReview('review');
+const proof = readMissionJson(result.mission_id, 'completion-proof.json');
+assertGate(proof.status !== 'verified' && result.proof_evidence.status === 'verified_partial', 'ppt mock fixture was allowed to claim fully real evidence', { proof_status: proof.status, evidence_status: result.proof_evidence.status });
+emitGate('ppt:no-mock-as-real', { mission_id: result.mission_id, proof_status: proof.status });
+//# sourceMappingURL=ppt-no-mock-as-real-check.js.map

package/dist/scripts/ppt-no-text-fallback-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runPptReview } from './sks-1-11-gate-lib.js';
+const result = runPptReview('callouts');
+assertGate(result.artifacts.callouts?.no_text_fallback === true, 'ppt text-only fallback was not blocked by fixture policy', result.artifacts.callouts);
+emitGate('ppt:no-text-fallback', { mission_id: result.mission_id });
+//# sourceMappingURL=ppt-no-text-fallback-check.js.map

package/dist/scripts/ppt-proof-trust-fixture-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readMissionJson, runPptReview, runSksJson } from './sks-1-11-gate-lib.js';
+const result = runPptReview('proof');
+const proof = readMissionJson(result.mission_id, 'completion-proof.json');
+const trust = runSksJson(['trust', 'report', result.mission_id, '--json']);
+assertGate(Boolean(proof.evidence?.ppt_review), 'ppt review evidence missing from completion proof', proof.evidence);
+assertGate(JSON.stringify(trust).includes('ppt_review'), 'ppt review evidence missing from trust report', trust);
+emitGate('ppt:proof-trust-fixture', { mission_id: result.mission_id, proof_status: proof.status });
+//# sourceMappingURL=ppt-proof-trust-fixture-check.js.map

package/dist/scripts/ppt-real-export-adapter-check.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('ppt:real-export-adapter', 'src/core/ppt-review/slide-exporter.ts', [
+    'soffice',
+    'libreoffice',
+    'powerpoint_osascript',
+    'partial_export',
+    'slide_export_unavailable',
+    'manual_slide_image_attach'
+]);
+emitGate('ppt:real-export-adapter', { adapters: ['LibreOffice/soffice', 'PowerPoint/osascript', 'manual_attach'] });
+//# sourceMappingURL=ppt-real-export-adapter-check.js.map

package/dist/scripts/ppt-real-imagegen-smoke-check.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { spawnSync } from 'node:child_process';
+import { osTempPngFixtureArg } from './lib/valid-png-fixture.js';
+const enabled = process.env.SKS_TEST_REAL_IMAGEGEN === '1' || process.env.SKS_REAL_IMAGEGEN === '1';
+const hasKey = Boolean(process.env.OPENAI_API_KEY || process.env.SKS_CODEX_APP_IMAGEGEN === '1');
+if (!enabled || !hasKey) {
+    const result = {
+        schema: 'sks.ppt-real-imagegen-smoke.v1',
+        ok: true,
+        status: 'integration_optional',
+        reason: !enabled ? 'SKS_TEST_REAL_IMAGEGEN=1 not set' : 'OPENAI_API_KEY or Codex App imagegen capability not configured',
+        fake_adapter: false,
+        real_generated: false
+    };
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(0);
+}
+const sourceImage = osTempPngFixtureArg('ppt-real-imagegen-smoke-source.png');
+const run = spawnSync(process.execPath, ['./dist/bin/sks.js', 'ppt', 'review', '--manual-slide-images', sourceImage, '--json'], {
+    cwd: process.cwd(),
+    env: process.env,
+    encoding: 'utf8',
+    timeout: Number(process.env.SKS_PPT_REAL_IMAGEGEN_SMOKE_TIMEOUT_MS || 180000),
+    maxBuffer: 8 * 1024 * 1024
+});
+const result = {
+    schema: 'sks.ppt-real-imagegen-smoke.v1',
+    ok: run.status === 0,
+    status: run.status === 0 ? 'passed' : 'blocked',
+    fake_adapter: false,
+    source_image: sourceImage,
+    real_generated: run.status === 0,
+    process_error: run.error?.message || null,
+    process_signal: run.signal || null,
+    stdout_tail: run.stdout.slice(-4000),
+    stderr_tail: run.stderr.slice(-4000)
+};
+console.log(JSON.stringify(result, null, 2));
+if (!result.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=ppt-real-imagegen-smoke-check.js.map

package/dist/scripts/ppt-real-imagegen-wiring-check.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('ppt:real-imagegen-wiring', 'src/core/ppt-review/slide-imagegen-review.ts', [
+    'generateGptImage2CalloutReview',
+    'PPT_SLIDE_IMAGEGEN_REQUEST_ARTIFACT',
+    'PPT_SLIDE_IMAGEGEN_RESPONSE_ARTIFACT',
+    'extraction_pending_count',
+    'callout_extraction_status'
+]);
+requireContains('ppt:real-imagegen-wiring', 'src/core/ppt-review/index.ts', [
+    'buildSlideImagegenRequestArtifact',
+    'buildSlideImagegenResponseArtifact'
+]);
+emitGate('ppt:real-imagegen-wiring', { adapter: 'shared UX generateGptImage2CalloutReview' });
+//# sourceMappingURL=ppt-real-imagegen-wiring-check.js.map

package/dist/scripts/ppt-reexport-rereview-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('ppt:reexport-rereview', 'src/core/commands/ppt-command.ts', [
+    'attach-fixed-deck',
+    'fixedDeckPath',
+    'recheck'
+]);
+requireContains('ppt:reexport-rereview', 'src/core/ppt-review/index.ts', [
+    'changed_slides_rechecked',
+    'ppt_slide_recheck_missing',
+    'fixedDeckPath'
+]);
+requireContains('ppt:reexport-rereview', 'src/core/ppt-review/ppt-patch-handoff.ts', [
+    'deck_binary_edit_unavailable_manual_handoff_required',
+    're_export_required'
+]);
+emitGate('ppt:reexport-rereview', { recheck: 'fixed-deck-or-slide-evidence-required' });
+//# sourceMappingURL=ppt-reexport-rereview-check.js.map

package/dist/scripts/ppt-slide-export-fixture-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runPptReview } from './sks-1-11-gate-lib.js';
+const result = runPptReview('slide-export');
+assertGate(result.proof_evidence.slide_export_status === 'exported' && result.proof_evidence.exported_slide_images_count > 0, 'ppt slide export fixture missing exported images', result.proof_evidence);
+emitGate('ppt:slide-export-fixture', { mission_id: result.mission_id });
+//# sourceMappingURL=ppt-slide-export-fixture-check.js.map

package/dist/scripts/prepublish-fast-check.js

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// Fast prepublish eligibility check. Self-contained: reads the existing release
+// stamp written by dist/scripts/release-check-stamp.js and decides whether the cheap
+// fast-path (no full release:check rebuild) is eligible by comparing only the
+// lightweight comparators it can recompute without a build.
+//
+// Output: a single JSON line on stdout (schema sks.prepublish-fast-check.v1).
+// Exit 0 when the fast path is eligible; exit 1 otherwise (incl. no stamp).
+// Tolerant of missing stamp fields; only compares fields present in the stamp.
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { root } from './sks-1-18-gate-lib.js';
+const stampPath = process.env.SKS_RELEASE_STAMP_PATH || path.join(root, '.sneakoscope', 'reports', 'release-check-stamp.json');
+function sha256(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function safeGitCommit() {
+    try {
+        const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
+        if (result.status === 0)
+            return String(result.stdout || '').trim() || null;
+    }
+    catch {
+        // git unavailable; commit comparison is informational only.
+    }
+    return null;
+}
+function readPackageJson() {
+    const raw = fs.readFileSync(path.join(root, 'package.json'));
+    return { raw, json: JSON.parse(raw.toString('utf8')) };
+}
+function packageFilesListHash(pkg) {
+    const files = Array.isArray(pkg.files) ? [...pkg.files].sort() : [];
+    return sha256(JSON.stringify(files));
+}
+function main() {
+    // No stamp -> not eligible; print and exit 1.
+    if (!fs.existsSync(stampPath)) {
+        console.log(JSON.stringify({ ok: false, reason: 'no_release_stamp', hint: 'run npm run release:check:full' }));
+        process.exit(1);
+    }
+    let stamp;
+    try {
+        stamp = JSON.parse(fs.readFileSync(stampPath, 'utf8'));
+    }
+    catch (err) {
+        console.log(JSON.stringify({
+            schema: 'sks.prepublish-fast-check.v1',
+            ok: false,
+            fast_path: false,
+            version: null,
+            git_commit: safeGitCommit(),
+            mismatched: ['stamp_unreadable'],
+            reasons: [`stamp_unreadable:${err && err.message ? err.message : 'unknown'}`]
+        }));
+        process.exit(1);
+    }
+    const { raw: pkgRaw, json: pkg } = readPackageJson();
+    const currentVersion = pkg.version;
+    const currentPkgSha = sha256(pkgRaw);
+    const currentFilesHash = packageFilesListHash(pkg);
+    const gitCommit = safeGitCommit();
+    const mismatched = [];
+    const reasons = [];
+    // Always-compared comparator: package version.
+    if (Object.prototype.hasOwnProperty.call(stamp, 'package_version')) {
+        if (stamp.package_version !== currentVersion) {
+            mismatched.push('package_version');
+            reasons.push(`package_version: stamp=${stamp.package_version ?? 'missing'} current=${currentVersion}`);
+        }
+    }
+    else {
+        mismatched.push('package_version');
+        reasons.push('package_version: absent from stamp');
+    }
+    // Compared only if the stamp carries it.
+    if (Object.prototype.hasOwnProperty.call(stamp, 'package_json_sha256')) {
+        if (stamp.package_json_sha256 !== currentPkgSha) {
+            mismatched.push('package_json_sha256');
+            reasons.push(`package_json_sha256: stamp=${stamp.package_json_sha256 ?? 'missing'} current=${currentPkgSha}`);
+        }
+    }
+    // package.files list hash: informational unless the stamp recorded one.
+    if (Object.prototype.hasOwnProperty.call(stamp, 'package_files_list_sha256')) {
+        if (stamp.package_files_list_sha256 !== currentFilesHash) {
+            mismatched.push('package_files_list_sha256');
+            reasons.push(`package_files_list_sha256: stamp=${stamp.package_files_list_sha256 ?? 'missing'} current=${currentFilesHash}`);
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(stamp, 'package_files_sha256')) {
+        // Full package file hashing is owned by release-check-stamp.js; this check
+        // confirms the fast stamp carries the comparator and leaves exact matching to
+        // `release-check-stamp verify`.
+        if (!stamp.package_files_sha256) {
+            mismatched.push('package_files_sha256');
+            reasons.push('package_files_sha256: absent from stamp');
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(stamp, 'release_gate_sha256') && !stamp.release_gate_sha256) {
+        mismatched.push('release_gate_sha256');
+        reasons.push('release_gate_sha256: absent from stamp');
+    }
+    // git_commit is provenance, not a freshness comparator. A valid release flow often
+    // runs release:check, commits the exact checked tree, then publishes from that new
+    // commit. In that case the tree/package/dist hashes still prove freshness, while
+    // comparing HEAD to the pre-commit stamp would block a good publish. The stricter
+    // `release-check-stamp verify` that follows this fast check owns the content
+    // comparators; keep the current commit visible in this report for audit only.
+    const stampedGitCommit = Object.prototype.hasOwnProperty.call(stamp, 'git_commit') ? stamp.git_commit || null : null;
+    const eligible = mismatched.length === 0;
+    console.log(JSON.stringify({
+        schema: 'sks.prepublish-fast-check.v1',
+        ok: eligible,
+        fast_path: eligible,
+        version: currentVersion,
+        git_commit: gitCommit,
+        stamped_git_commit: stampedGitCommit,
+        git_commit_changed_since_stamp: Boolean(stampedGitCommit && gitCommit && stampedGitCommit !== gitCommit),
+        mismatched,
+        reasons
+    }));
+    process.exit(eligible ? 0 : 1);
+}
+main();
+//# sourceMappingURL=prepublish-fast-check.js.map

package/dist/scripts/priority-full-closure-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, exists, readText } from './sks-1-18-gate-lib.js';
+assertGate(exists('docs/priority-closure-p0-p4.md'), 'priority closure doc missing');
+assertGate(exists('docs/release-readiness.md'), 'release readiness doc missing');
+const readiness = readText('docs/release-readiness.md');
+for (const priority of ['P0', 'P1', 'P2', 'P3', 'P4', 'P5']) {
+    assertGate(readiness.includes(priority), `release readiness missing ${priority}`);
+}
+assertGate(!/future work/i.test(readiness), 'release readiness must not defer P1-P5 as future work');
+emitGate('priority:full-closure', { priorities: ['P0', 'P1', 'P2', 'P3', 'P4', 'P5'] });
+//# sourceMappingURL=priority-full-closure-check.js.map

package/dist/scripts/probe-memoization-check.js

@@ -0,0 +1,11 @@
+// @ts-nocheck
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('probe-memo-');
+const mod = await importDist('core/probes/probe-memoization.js');
+let calls = 0;
+const first = mod.memoizeProbe({ root: tmp, probeId: 'fixture', ttlMs: 60000, version: 'v1', run: () => ({ calls: ++calls }) });
+const second = mod.memoizeProbe({ root: tmp, probeId: 'fixture', ttlMs: 60000, version: 'v1', run: () => ({ calls: ++calls }) });
+assertGate(first.reused === false && second.reused === true && second.value.calls === 1, 'probe memoization must reuse TTL record', { first, second, calls });
+emitGate('probes:memoization', { reused: second.reused });
+//# sourceMappingURL=probe-memoization-check.js.map