sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/release-registry-check.js

@@ -0,0 +1,353 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const expectedRegistry = 'https://registry.npmjs.org/';
+const requireUnpublished = process.argv.includes('--require-unpublished');
+const requirePublishAuth = process.argv.includes('--require-publish-auth');
+const skipNetwork = process.env.SKS_SKIP_REGISTRY_NETWORK_CHECK === '1';
+const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+function fail(message, detail = '') {
+    console.error(`Release registry check failed: ${message}`);
+    if (detail)
+        console.error(detail.trim());
+    process.exit(2);
+}
+function normalizeRegistry(value) {
+    if (!value)
+        return '';
+    return String(value).trim().replace(/\/?$/, '/');
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
+    }
+    catch (err) {
+        fail(`unable to read ${file}`, err.message);
+    }
+}
+function run(cmd, args, options = {}) {
+    return spawnSync(cmd, args, {
+        cwd: root,
+        encoding: 'utf8',
+        timeout: 30000,
+        ...options
+    });
+}
+function npmRegistryReadEnv(overrides = {}) {
+    const env = { ...process.env, ...overrides };
+    delete env.npm_config_tag;
+    delete env.NPM_CONFIG_TAG;
+    return env;
+}
+function checkPackagePublishConfig(pkg) {
+    if (pkg.private)
+        fail('package.json private=true would block public npm publication');
+    if (pkg.publishConfig?.access !== 'public') {
+        fail('package.json publishConfig.access must be public', `found: ${pkg.publishConfig?.access || 'missing'}`);
+    }
+    const registry = normalizeRegistry(pkg.publishConfig?.registry);
+    if (registry !== expectedRegistry) {
+        fail('package.json publishConfig.registry must target npmjs', `found: ${registry || 'missing'}\nexpected: ${expectedRegistry}`);
+    }
+    const isPrerelease = /-/.test(String(pkg.version || ''));
+    if (isPrerelease && pkg.publishConfig?.tag !== 'rc') {
+        fail('package.json publishConfig.tag must be rc for prerelease versions', `found: ${pkg.publishConfig?.tag || 'missing'}\nversion: ${pkg.version}`);
+    }
+    if (!isPrerelease && pkg.publishConfig?.tag && pkg.publishConfig.tag !== 'latest') {
+        fail('package.json publishConfig.tag must be latest or omitted for stable versions', `found: ${pkg.publishConfig.tag}\nversion: ${pkg.version}`);
+    }
+}
+function checkRootNpmrc(pkg) {
+    const npmrcPath = path.join(root, '.npmrc');
+    if (!fs.existsSync(npmrcPath))
+        return;
+    const text = fs.readFileSync(npmrcPath, 'utf8');
+    const unsafe = [];
+    const isPrerelease = /-/.test(String(pkg.version || ''));
+    for (const [index, line] of text.split(/\r?\n/).entries()) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';'))
+            continue;
+        const match = trimmed.match(/^(?:@[^:]+:)?registry\s*=\s*(.+)$/);
+        if (match && normalizeRegistry(match[1]) !== expectedRegistry)
+            unsafe.push(`${index + 1}: ${trimmed}`);
+        const tagMatch = trimmed.match(/^tag\s*=\s*(.+)$/);
+        if (tagMatch) {
+            const tag = tagMatch[1].trim();
+            if (isPrerelease && tag !== 'rc')
+                unsafe.push(`${index + 1}: ${trimmed}`);
+            if (!isPrerelease && tag !== 'latest')
+                unsafe.push(`${index + 1}: ${trimmed}`);
+        }
+    }
+    if (unsafe.length) {
+        fail('root .npmrc contains publish config incompatible with this release', unsafe.join('\n'));
+    }
+}
+function checkLockfile(pkg) {
+    const lock = readJson('package-lock.json');
+    const rootPackage = lock.packages?.[''];
+    const mismatches = [
+        ['package-lock.json name', lock.name, pkg.name],
+        ['package-lock.json version', lock.version, pkg.version],
+        ['package-lock root package name', rootPackage?.name, pkg.name],
+        ['package-lock root package version', rootPackage?.version, pkg.version]
+    ].filter(([, actual, expected]) => actual !== expected);
+    if (mismatches.length) {
+        fail('package-lock metadata is not synchronized', mismatches.map(([label, actual, expected]) => `${label}: ${actual || 'missing'} (expected ${expected})`).join('\n'));
+    }
+    const unsafeResolved = [];
+    for (const [entry, meta] of Object.entries(lock.packages || {})) {
+        const resolved = meta?.resolved;
+        if (!resolved || resolved.startsWith('file:') || resolved.startsWith('link:'))
+            continue;
+        let parsed;
+        try {
+            parsed = new URL(resolved);
+        }
+        catch {
+            unsafeResolved.push(`${entry || '<root>'}: ${resolved}`);
+            continue;
+        }
+        if (parsed.protocol === 'https:' && parsed.hostname === 'registry.npmjs.org')
+            continue;
+        unsafeResolved.push(`${entry || '<root>'}: ${resolved}`);
+    }
+    if (unsafeResolved.length) {
+        fail('package-lock contains dependencies resolved outside registry.npmjs.org', unsafeResolved.join('\n'));
+    }
+}
+function checkPackedMetadata(pkg) {
+    const env = npmRegistryReadEnv({
+        npm_config_cache: process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache')
+    });
+    const result = run(npmBin, ['pack', '--dry-run', '--json', '--ignore-scripts', '--registry', expectedRegistry], { env });
+    if (result.status !== 0)
+        fail('npm pack dry-run failed', `${result.stdout || ''}\n${result.stderr || ''}`);
+    let info;
+    try {
+        info = JSON.parse(result.stdout)[0];
+    }
+    catch {
+        fail('npm pack dry-run returned non-json output', result.stdout || '');
+    }
+    if (!info)
+        fail('npm pack dry-run returned no package metadata');
+    if (info.name !== pkg.name || info.version !== pkg.version) {
+        fail('packed package metadata differs from package.json', `pack: ${info.name || 'missing'}@${info.version || 'missing'}\npackage.json: ${pkg.name}@${pkg.version}`);
+    }
+}
+function compareVersions(a, b) {
+    const pa = String(a || '').split(/[.-]/).map((part) => Number.parseInt(part, 10));
+    const pb = String(b || '').split(/[.-]/).map((part) => Number.parseInt(part, 10));
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i += 1) {
+        const da = Number.isFinite(pa[i]) ? pa[i] : 0;
+        const db = Number.isFinite(pb[i]) ? pb[i] : 0;
+        if (da !== db)
+            return da > db ? 1 : -1;
+    }
+    return 0;
+}
+function checkPublishedVersion(pkg) {
+    if (skipNetwork) {
+        console.log('Registry network check skipped by SKS_SKIP_REGISTRY_NETWORK_CHECK=1.');
+        return;
+    }
+    const env = npmRegistryReadEnv({
+        npm_config_cache: process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache')
+    });
+    const result = run(npmBin, ['view', `${pkg.name}@latest`, 'version', 'dist-tags', '--json', '--registry', expectedRegistry], { env });
+    if (result.status !== 0)
+        fail('npm registry metadata lookup failed', `${result.stdout || ''}\n${result.stderr || ''}`);
+    let info;
+    try {
+        info = JSON.parse(result.stdout);
+    }
+    catch {
+        fail('npm registry metadata lookup returned non-json output', result.stdout || '');
+    }
+    const latest = info?.['dist-tags']?.latest || info?.version || null;
+    if (!latest)
+        fail('npm registry metadata lookup did not return a latest version');
+    const exact = run(npmBin, ['view', `${pkg.name}@${pkg.version}`, 'version', '--json', '--registry', expectedRegistry], { env });
+    let exactPublished = false;
+    if (exact.status === 0) {
+        try {
+            const exactInfo = JSON.parse(exact.stdout);
+            exactPublished = Array.isArray(exactInfo) ? exactInfo.includes(pkg.version) : exactInfo === pkg.version;
+        }
+        catch {
+            exactPublished = String(exact.stdout || '').includes(pkg.version);
+        }
+    }
+    else if (!/E404|No match found|not in this registry/i.test(`${exact.stdout || ''}\n${exact.stderr || ''}`)) {
+        fail('npm exact-version lookup failed', `${exact.stdout || ''}\n${exact.stderr || ''}`);
+    }
+    if (requireUnpublished && exactPublished) {
+        fail('package version is already published on npm', `${pkg.name}@${pkg.version}`);
+    }
+    const cmp = compareVersions(pkg.version, latest);
+    if (requireUnpublished && cmp <= 0) {
+        fail('package version is not newer than the npm latest dist-tag', `package.json: ${pkg.version}\nnpm latest: ${latest}`);
+    }
+    const note = exactPublished
+        ? `exact version already exists; current npm latest is ${latest}`
+        : (cmp > 0 ? `ready for new publish over npm latest ${latest}` : `current npm latest is ${latest}`);
+    console.log(`Registry metadata check passed: ${pkg.name}@${pkg.version}; ${note}.`);
+}
+function checkPublishAuth(pkg) {
+    if (skipNetwork) {
+        fail('publish auth check cannot run when SKS_SKIP_REGISTRY_NETWORK_CHECK=1 is set');
+    }
+    const env = npmRegistryReadEnv({
+        npm_config_cache: process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache')
+    });
+    const whoami = run(npmBin, ['whoami', '--registry', expectedRegistry], { env });
+    if (whoami.status !== 0) {
+        const authHints = npmAuthSourceHints(env);
+        fail('npm publish auth is missing or invalid', [
+            tail(`${whoami.stdout || ''}\n${whoami.stderr || ''}`),
+            '',
+            ...publishAuthRepairInstructions(pkg, authHints)
+        ].join('\n'));
+    }
+    const user = normalizeNpmUser(whoami.stdout);
+    if (!user)
+        fail('npm whoami returned an empty username', whoami.stdout || '');
+    const maintainers = packageMaintainers(pkg, env);
+    if (maintainers.length > 0 && !maintainers.includes(user)) {
+        fail('authenticated npm user is not a package maintainer', [
+            `npm whoami: ${user}`,
+            `${pkg.name} maintainers: ${maintainers.join(', ')}`,
+            `Log in as one of the listed maintainers or ask an owner to run \`npm owner add ${user} ${pkg.name}\`.`
+        ].join('\n'));
+    }
+    const report = {
+        schema: 'sks.release-publish-auth.v1',
+        ok: true,
+        package: pkg.name,
+        version: pkg.version,
+        registry: expectedRegistry,
+        npm_user: user,
+        maintainers,
+        maintainer_match: maintainers.length === 0 ? null : maintainers.includes(user),
+        generated_at: new Date().toISOString()
+    };
+    const out = path.join(root, '.sneakoscope', 'reports', 'release-publish-auth.json');
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+    console.log(`Publish auth check passed: ${pkg.name}@${pkg.version} as ${user}.`);
+}
+function publishAuthRepairInstructions(pkg, authHints) {
+    const lines = [];
+    if (authHints.length > 0) {
+        lines.push(`npm auth config was found (${authHints.join(', ')}), but the npm registry rejected it.`);
+        lines.push('That usually means the token is expired, revoked, not valid for npmjs.org, or not publish-capable for this package.');
+    }
+    else {
+        lines.push('No npm auth token was found in the checked npm config/env locations.');
+    }
+    lines.push(`Refresh local auth: \`npm logout --registry ${expectedRegistry}\`, then \`npm login --registry ${expectedRegistry}\` as a maintainer of ${pkg.name}.`);
+    lines.push(`Verify before publishing: \`npm whoami --registry ${expectedRegistry}\`.`);
+    lines.push('For token-based publishing, configure npm itself with a registry token, for example `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` in the npm userconfig/project .npmrc and export a publish-capable token. A raw `NPM_TOKEN` environment variable alone is not enough unless npm config references it.');
+    return lines;
+}
+function npmAuthSourceHints(env) {
+    const hints = [];
+    if (env.NODE_AUTH_TOKEN)
+        hints.push('NODE_AUTH_TOKEN env');
+    if (env.NPM_TOKEN)
+        hints.push('NPM_TOKEN env (requires npmrc interpolation)');
+    for (const file of npmConfigCandidateFiles(env)) {
+        for (const hint of npmAuthHintsFromFile(file))
+            hints.push(hint);
+    }
+    return [...new Set(hints)];
+}
+function npmConfigCandidateFiles(env) {
+    const files = [
+        path.join(root, '.npmrc'),
+        env.npm_config_userconfig,
+        env.NPM_CONFIG_USERCONFIG,
+        path.join(os.homedir(), '.npmrc')
+    ].filter(Boolean);
+    return [...new Set(files.map((file) => path.resolve(String(file))))];
+}
+function npmAuthHintsFromFile(file) {
+    if (!fs.existsSync(file))
+        return [];
+    let text = '';
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const hints = [];
+    for (const [index, line] of text.split(/\r?\n/).entries()) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';'))
+            continue;
+        const lower = trimmed.toLowerCase();
+        const hasAuthKey = /(?::|^)_authtoken\s*=|(?::|^)_auth\s*=|(?::|^)username\s*=|(?::|^)_password\s*=/.test(lower);
+        if (!hasAuthKey)
+            continue;
+        const scopedToExpectedRegistry = lower.includes('//registry.npmjs.org/') || lower.startsWith('_auth');
+        if (scopedToExpectedRegistry)
+            hints.push(`${file}:${index + 1}`);
+    }
+    return hints;
+}
+function packageMaintainers(pkg, env) {
+    const result = run(npmBin, ['view', pkg.name, 'maintainers', '--json', '--registry', expectedRegistry], { env });
+    if (result.status !== 0) {
+        const text = `${result.stdout || ''}\n${result.stderr || ''}`;
+        if (/E404|not in this registry|No match found/i.test(text))
+            return [];
+        fail('npm maintainer lookup failed', text);
+    }
+    try {
+        const parsed = JSON.parse(result.stdout);
+        const rows = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : []);
+        return [...new Set(rows.map(normalizeNpmUser).filter(Boolean))].sort();
+    }
+    catch {
+        return [...new Set(String(result.stdout || '').split(/\r?\n/).map(normalizeNpmUser).filter(Boolean))].sort();
+    }
+}
+function normalizeNpmUser(value) {
+    if (!value)
+        return '';
+    if (typeof value === 'object')
+        return normalizeNpmUser(value.name || value.username || '');
+    const text = String(value).trim();
+    if (/^["[{]/.test(text)) {
+        try {
+            return normalizeNpmUser(JSON.parse(text));
+        }
+        catch {
+            // Fall through for legacy plain-text npm output.
+        }
+    }
+    return text.replace(/^@/, '').split(/\s+/)[0].toLowerCase();
+}
+function tail(value, limit = 1200) {
+    const text = String(value || '').trim();
+    return text.length > limit ? text.slice(-limit) : text;
+}
+const pkg = readJson('package.json');
+checkPackagePublishConfig(pkg);
+checkRootNpmrc(pkg);
+checkLockfile(pkg);
+checkPackedMetadata(pkg);
+checkPublishedVersion(pkg);
+if (requirePublishAuth)
+    checkPublishAuth(pkg);
+console.log(`Release registry check passed: ${pkg.name}@${pkg.version} -> ${expectedRegistry}`);
+//# sourceMappingURL=release-registry-check.js.map

package/dist/scripts/release-runtime-truth-matrix-check.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root, readJson } from './sks-1-18-gate-lib.js';
+const releaseVersion = readJson('package.json').version;
+const mod = await importDist('core/proof/runtime-truth-matrix.js');
+const matrix = await mod.buildRuntimeTruthMatrix({ root, releaseVersion });
+await mod.writeRuntimeTruthMatrix(root, matrix);
+const requiredRows = [
+    'zellij_pane',
+    'codex_dynamic',
+    'cleanup',
+    'intelligent_work_graph',
+    'source_intelligence',
+    'goal_mode',
+    'route_blackbox',
+    'dynamic_scheduler',
+    'warp_mad_lanes',
+    'codex_0_134',
+    'mcp_0_134',
+    'parallel_write',
+    'patch_proof',
+    'native_cli_session_swarm',
+    'real_codex_parallel_workers',
+    'native_worker_backend_router',
+    'codex_child_overlap',
+    'model_authored_patch_envelopes',
+    'fast_mode_child_propagation',
+    'cleanup_v4',
+    'ast_type_work_graph',
+    'warp_mad_right_lanes'
+];
+assertGate(matrix.schema === 'sks.runtime-truth-matrix.v1', 'runtime truth matrix schema mismatch', matrix);
+for (const subsystem of requiredRows) {
+    const row = matrix.rows.find((item) => item.subsystem === subsystem);
+    assertGate(Boolean(row), `runtime truth matrix missing subsystem ${subsystem}`, matrix);
+    assertGate(typeof row.proof_level === 'string', `runtime truth row missing proof level: ${subsystem}`, row);
+    assertGate(Array.isArray(row.evidence_artifacts), `runtime truth row missing evidence artifacts: ${subsystem}`, row);
+    assertGate(Array.isArray(row.blockers), `runtime truth row missing blockers: ${subsystem}`, row);
+    assertGate(typeof row.next_action === 'string', `runtime truth row missing next action: ${subsystem}`, row);
+    assertGate(typeof row.required_mode === 'boolean', `runtime truth row missing required mode: ${subsystem}`, row);
+}
+for (const priority of ['P0', 'P1', 'P2', 'P3', 'P4', 'P5', 'P6']) {
+    assertGate(['closed', 'blocked', 'not_applicable_with_proof'].includes(matrix.priorities[priority]?.status), `runtime truth matrix missing ${priority}`, matrix);
+}
+assertGate(matrix.ok === true, 'runtime truth matrix has required blockers', matrix);
+emitGate('release:runtime-truth-matrix', { subsystems: matrix.rows.length, version: releaseVersion });
+//# sourceMappingURL=release-runtime-truth-matrix-check.js.map

package/dist/scripts/release-script-type-safety-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective317Gate } from './sks-3-1-7-directive-check-lib.js';
+await runDirective317Gate('release-scripts:type-safe');
+//# sourceMappingURL=release-script-type-safety-check.js.map

package/dist/scripts/release-speed-summary-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, packageScripts, readText, root } from './sks-1-18-gate-lib.js';
+assertGate(readText('src/scripts/release-speed-summary.ts').includes('sks.release-speed-summary.v1'), 'release speed summary script missing schema');
+assertGate(readText('src/scripts/release-speed-summary.ts').includes('selected_gate_ids') && readText('src/scripts/release-speed-summary.ts').includes('cached_gates') && readText('src/scripts/release-speed-summary.ts').includes('Affected mode: true'), 'release speed summary must include gate lists and affected-mode warning');
+assertGate(readText('src/scripts/release-speed-summary.ts').includes('completion_certificate') && readText('src/scripts/release-speed-summary.ts').includes('proof_bank_file') && readText('src/scripts/release-speed-summary.ts').includes('five_minute_sla_met'), 'release speed summary must expose proof bank and five-minute certificate fields');
+assertGate(Boolean(packageScripts()['release:speed-summary']), 'release:speed-summary package script missing');
+const res = spawnSync(process.execPath, ['dist/scripts/release-speed-summary.js'], { cwd: root, encoding: 'utf8', timeout: 30000 });
+assertGate(res.status === 0, 'release speed summary command failed', { stderr: res.stderr });
+const summary = JSON.parse(res.stdout);
+for (const key of ['mode', 'selected_gate_ids', 'skipped_gate_ids', 'cached_gates', 'executed_gates', 'max_running', 'parallelism_gain', 'slowest_gates', 'proof_file_path', 'proof_bank_file', 'completion_certificate', 'five_minute_sla_met'])
+    assertGate(Object.prototype.hasOwnProperty.call(summary, key), `release speed summary missing ${key}`, summary);
+assertGate(typeof summary.proof_bank_file === 'string' && summary.proof_bank_file.includes('.sneakoscope/proof-bank/gates/cache-v2.json'), 'release speed summary must point at proof bank cache', summary);
+if (summary.affected_mode === true)
+    assertGate(String(summary.affected_mode_warning || '').includes('release:check:full'), 'affected mode warning must point to full release check', summary);
+if (summary.mode === 'full' && summary.selected_gates > 1) {
+    assertGate(summary.parallelism_gain >= 3 || summary.max_running >= Math.min(8, summary.selected_gates), 'full release speed summary must prove parallelism', summary);
+}
+emitGate('release:speed-summary', { script: 'release:speed-summary', mode: summary.mode, selected_gates: summary.selected_gates, skipped_by_affected: summary.skipped_by_affected });
+//# sourceMappingURL=release-speed-summary-check.js.map

package/dist/scripts/release-stability-report-check.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, readJson, root } from './sks-1-18-gate-lib.js';
+const manifest = readJson('release-gates.v2.json');
+const currentRunDir = process.env.SKS_REPORT_DIR ? path.dirname(process.env.SKS_REPORT_DIR) : null;
+const latestReleaseRun = currentRunDir || latestDir(path.join(root, '.sneakoscope', 'reports', 'release-gates'));
+const latestSummary = currentRunDir ? summarizeCurrentRun(currentRunDir) : latestReleaseRun ? readJsonIfExists(path.join(latestReleaseRun, 'summary.json')) : null;
+const zellijReportPath = path.join(root, '.sneakoscope', 'reports', 'zellij-worker-pane-real-ui-blackbox.json');
+const zellij = fs.existsSync(zellijReportPath) ? JSON.parse(fs.readFileSync(zellijReportPath, 'utf8')) : null;
+const requiredGateIds = [
+    'release:dag-runner',
+    'release:parallel-speed-budget',
+    'git:worktree-manifest-append',
+    'git:worktree-dirty-main-detection',
+    'git:worktree-untracked-diff',
+    'git:worktree-diff-envelope',
+    'git:worktree-integration-primary',
+    'git:worktree-dirty-lock',
+    'naruto:worktree-coding:blackbox',
+    'release:version-truth'
+];
+const manifestIds = new Set(manifest.gates.map((gate) => gate.id));
+const missing = requiredGateIds.filter((id) => !manifestIds.has(id));
+const score = computeScore({ missing, latestSummary, zellij });
+const report = {
+    schema: 'sks.release-stability-report.v1',
+    ok: score >= 9.5 && missing.length === 0 && latestSummary?.ok === true && zellij?.ok === true,
+    target_score: 9.5,
+    score,
+    manifest_gate_count: manifest.gates.length,
+    latest_release_summary: latestSummary ? path.relative(root, path.join(latestReleaseRun, 'summary.json')) : null,
+    release_check_ok: latestSummary?.ok === true,
+    release_check_passed: latestSummary?.completed || 0,
+    release_check_failed: latestSummary?.failed || 0,
+    zellij_real_worker_panes_ok: zellij?.ok === true,
+    zellij_real_worker_panes: zellij?.real_pane_ids || 0,
+    missing_required_gates: missing,
+    blockers: []
+};
+if (!report.ok) {
+    report.blockers = [
+        ...(score >= 9.5 ? [] : ['stability_score_below_target']),
+        ...(missing.length ? ['required_release_gate_missing'] : []),
+        ...(latestSummary?.ok === true ? [] : ['latest_release_check_not_green']),
+        ...(zellij?.ok === true ? [] : ['zellij_real_worker_panes_not_green'])
+    ];
+}
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+fs.writeFileSync(path.join(root, '.sneakoscope', 'reports', 'release-stability-report.json'), `${JSON.stringify(report, null, 2)}\n`);
+assertGate(report.ok, 'release stability report must meet 9.5+ target', report);
+emitGate('release:stability-report', report);
+function computeScore({ missing, latestSummary, zellij }) {
+    let score = 10;
+    score -= missing.length * 0.25;
+    if (latestSummary?.ok !== true)
+        score -= 1.5;
+    if ((latestSummary?.failed || 0) > 0)
+        score -= 1;
+    if (zellij?.ok !== true)
+        score -= 1;
+    return Number(Math.max(0, score).toFixed(2));
+}
+function latestDir(dir) {
+    if (!fs.existsSync(dir))
+        return null;
+    const dirs = fs.readdirSync(dir)
+        .map((name) => path.join(dir, name))
+        .filter((candidate) => fs.statSync(candidate).isDirectory())
+        .sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs);
+    return dirs[0] || null;
+}
+function summarizeCurrentRun(runDir) {
+    const results = [];
+    for (const entry of fs.readdirSync(runDir)) {
+        const result = readJsonIfExists(path.join(runDir, entry, 'result.json'));
+        if (result && result.id !== 'release:stability-report')
+            results.push(result);
+    }
+    if (!results.length)
+        return null;
+    const failed = results.filter((result) => result.ok !== true);
+    return {
+        schema: 'sks.release-gate-current-run-summary.v1',
+        ok: failed.length === 0,
+        completed: results.filter((result) => result.ok === true).length,
+        failed: failed.length
+    };
+}
+function readJsonIfExists(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=release-stability-report-check.js.map

package/dist/scripts/release-triwiki-first-runner-blackbox.js

@@ -0,0 +1,44 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('sks-triwiki-first-');
+await writeText(path.join(tmp, 'package.json'), JSON.stringify({
+    version: '4.0.2',
+    scripts: {
+        'triwiki:proof-card': 'node -e "process.exit(0)"',
+        'release:version-truth': 'node -e "process.exit(0)"',
+        'scheduler:resource-budget': 'node -e "process.exit(0)"'
+    }
+}, null, 2));
+await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ lockfileVersion: 3 }, null, 2));
+await writeText(path.join(tmp, 'release-gates.v2.json'), JSON.stringify({
+    schema: 'sks.release-gates.v2',
+    gates: [
+        gate('triwiki:proof-card', ['src/core/triwiki/**']),
+        gate('release:version-truth', ['package.json']),
+        gate('scheduler:resource-budget', ['src/core/release/**'])
+    ]
+}, null, 2));
+await fs.mkdir(path.join(tmp, 'src/core/triwiki'), { recursive: true });
+await writeText(path.join(tmp, 'src/core/triwiki/triwiki-proof-card.ts'), 'export const x = 1;\n');
+const dag = await importDist('core/release/release-gate-dag.js');
+const result = await dag.runReleaseGateDag({ root: tmp, preset: 'confidence', changedFiles: ['src/core/triwiki/triwiki-proof-card.ts'], noCache: true });
+assertGate(result.triwiki_selection_used === true, 'TriWiki selection must be marked used', result);
+assertGate(result.selected_gate_ids.includes('triwiki:proof-card'), 'TriWiki graph must select the TriWiki gate', result.selected_gate_ids);
+assertGate(!result.selected_gate_ids.includes('scheduler:resource-budget'), 'unaffected scheduler gate must be skipped by TriWiki selection', result);
+emitGate('release:triwiki-first-runner-blackbox', { selected: result.selected_gate_ids, skipped: result.triwiki_skipped_gates });
+function gate(id, inputs) {
+    return {
+        id,
+        command: `npm run ${id} --silent`,
+        deps: [],
+        resource: ['cpu-light'],
+        side_effect: 'hermetic',
+        timeout_ms: 5000,
+        cache: { enabled: false, inputs },
+        isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
+        preset: ['release']
+    };
+}
+//# sourceMappingURL=release-triwiki-first-runner-blackbox.js.map

package/dist/scripts/release-triwiki-first-runner-check.js

@@ -0,0 +1,9 @@
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const schedulerMod = await importDist('core/release/extreme-parallel-scheduler.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-card.ts'], tier: 'confidence' });
+const plan = schedulerMod.planExtremeParallelSchedule(root, graph);
+assertGate(graph.schema === 'sks.triwiki-affected-graph.v1' && graph.gate_packs.length > 0, 'TriWiki graph must select gate packs', graph);
+assertGate(plan.schema === 'sks.extreme-parallel-scheduler.v1', 'scheduler plan schema mismatch', plan);
+emitGate('release:triwiki-first-runner', { packs: graph.gate_packs, critical_path_ms: plan.critical_path_ms });
+//# sourceMappingURL=release-triwiki-first-runner-check.js.map