sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/runtime-ts-source-of-truth-check.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const issues = [];
+if (pkg.bin?.sks !== 'dist/bin/sks.js')
+    issues.push('package_bin_sks_not_dist');
+if (pkg.bin?.sneakoscope !== 'dist/bin/sks.js')
+    issues.push('package_bin_sneakoscope_not_dist');
+if ((pkg.files || []).includes('src'))
+    issues.push('package_files_include_src');
+if (!pkg.scripts?.['dev:sks'])
+    issues.push('missing_dev_sks');
+for (const file of walk(path.join(root, 'src'))) {
+    const rel = path.relative(root, file).split(path.sep).join('/');
+    if (rel.endsWith('.mjs'))
+        issues.push(`src_mjs_runtime_shadow:${rel}`);
+    if (!rel.endsWith('.ts'))
+        continue;
+    const text = fs.readFileSync(file, 'utf8');
+    if (/from\s+['"][^'"]+\.mjs['"]|import\(\s*['"][^'"]+\.mjs['"]\s*\)/.test(text)) {
+        issues.push(`ts_imports_mjs:${rel}`);
+    }
+}
+const binShim = path.join(root, 'bin', 'sks.mjs');
+if (fs.existsSync(binShim)) {
+    const text = fs.readFileSync(binShim, 'utf8');
+    if (text.includes('/src/') || text.includes('../src/') || text.includes('FAST_PACKAGE_VERSION')) {
+        issues.push('bin_sks_mjs_not_dist_only');
+    }
+}
+const result = {
+    schema: 'sks.runtime-ts-source-of-truth.v1',
+    ok: issues.length === 0,
+    issues
+};
+console.log(JSON.stringify(result, null, 2));
+if (!result.ok)
+    process.exitCode = 1;
+function walk(dir, out = []) {
+    if (!fs.existsSync(dir))
+        return out;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const file = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            walk(file, out);
+        else if (entry.isFile())
+            out.push(file);
+    }
+    return out;
+}
+//# sourceMappingURL=runtime-ts-source-of-truth-check.js.map

package/dist/scripts/safety-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runProcess } from '../core/fsx.js';
+const shards = [
+    ['node', ['--test', 'test/unit/db-safety.test.mjs', 'test/unit/db-safety-golden.test.mjs']],
+    ['node', ['--test', 'test/integration/hooks-replay.test.mjs', 'test/unit/hooks-replay-policy.test.mjs', 'test/unit/hook-command-output.test.mjs']],
+    ['node', ['--test', 'test/unit/proof-redaction.test.mjs', 'test/unit/codex-access-token-redaction.test.mjs']]
+];
+const results = [];
+for (const [cmd, args] of shards) {
+    const result = await runProcess(cmd, args, {
+        cwd: process.cwd(),
+        timeoutMs: 60_000,
+        maxOutputBytes: 512 * 1024,
+        env: { SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' }
+    });
+    results.push({ command: [cmd, ...args].join(' '), ok: result.code === 0, code: result.code, stderr_tail: result.stderr.slice(-1000), stdout_tail: result.stdout.slice(-1000) });
+}
+const ok = results.every((row) => row.ok);
+console.log(JSON.stringify({ schema: 'sks.safety-check.v1', ok, results }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=safety-check.js.map

package/dist/scripts/scheduler-batch-dispatch-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runAgentScheduler } from '../core/agents/agent-scheduler.js';
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+assertGate(readText('src/core/agents/agent-scheduler.ts').includes('collectLaunchBatch') && readText('src/core/agents/agent-scheduler.ts').includes('batch_work_items_dispatched'), 'batch scheduler source wiring missing');
+const missionId = 'M-scheduler-batch';
+const ledgerRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-scheduler-batch-'));
+const count = 6;
+const roster = { agent_count: count, roster: Array.from({ length: count }, (_, i) => ({ id: `a${i + 1}`, persona_id: `p${i + 1}`, role: 'verifier' })) };
+const partition = { slices: Array.from({ length: count }, (_, i) => ({ id: `w${i + 1}`, description: 'batch', write_paths: [], readonly_paths: [] })) };
+const result = await runAgentScheduler({ root: ledgerRoot, missionId, rootHash: 'fixture', roster, partition, targetActiveSlots: count, maxActiveSlots: count, launchSession: async ({ generation, agent, workItem }) => ({ schema: 'sks.agent-result.v1', mission_id: missionId, agent_id: agent.id, session_id: generation.session_id, persona_id: agent.persona_id, task_slice_id: workItem.id, status: 'done', backend: 'fake', summary: 'ok', findings: [], proposed_changes: [], changed_files: [], lease_compliance: { ok: true, violations: [] }, artifacts: [], blockers: [], confidence: 'high', handoff_notes: '', unverified: [], writes: [], recursion_guard: { ok: true, violations: [] }, verification: { status: 'passed', checks: [] } }) });
+assertGate(result.state.batch_dispatch_count >= 1 && result.state.largest_batch_size >= count, 'scheduler did not dispatch a full launch batch', result.state);
+emitGate('scheduler:batch-dispatch', result.state);
+//# sourceMappingURL=scheduler-batch-dispatch-check.js.map

package/dist/scripts/scheduler-critical-path-check.js

@@ -0,0 +1,9 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const scheduler = await importDist('core/release/extreme-parallel-scheduler.js');
+const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-bank.ts'], tier: 'affected' });
+const schedule = scheduler.planExtremeParallelSchedule(root, graph);
+assertGate(schedule.critical_path_ms <= schedule.sequential_ms, 'critical path cannot exceed sequential estimate', schedule);
+emitGate('scheduler:critical-path', { critical_path_ms: schedule.critical_path_ms, sequential_ms: schedule.sequential_ms });
+//# sourceMappingURL=scheduler-critical-path-check.js.map

package/dist/scripts/scheduler-extreme-parallel-check.js

@@ -0,0 +1,7 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const scheduler = await importDist('core/release/extreme-parallel-scheduler.js');
+const schedule = scheduler.planExtremeParallelSchedule(root);
+assertGate(schedule.schema === 'sks.extreme-parallel-scheduler.v1' && schedule.batches.length > 0, 'scheduler must produce batches', schedule);
+emitGate('scheduler:extreme-parallel', { batches: schedule.batches.length, reduction_ratio: schedule.reduction_ratio, ok: schedule.ok });
+//# sourceMappingURL=scheduler-extreme-parallel-check.js.map

package/dist/scripts/scheduler-no-false-pending-block-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/agents/agent-scheduler.ts');
+assertGate(src.includes('batchDispatchInProgress') && src.includes('!batchDispatchInProgress && active.size === 0'), 'scheduler pending block guard must account for batch dispatch');
+emitGate('scheduler:no-false-pending-block');
+//# sourceMappingURL=scheduler-no-false-pending-block-check.js.map

package/dist/scripts/scheduler-parallel-proof-consistency-check.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runAgentScheduler } from '../core/agents/agent-scheduler.js';
+import { appendParallelRuntimeEvent, writeParallelRuntimeProof } from '../core/agents/parallel-runtime-proof.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-scheduler-proof-consistency-'));
+const missionId = 'M-scheduler-proof-consistency';
+const workers = 4;
+const sleepMs = 300;
+const roster = { agent_count: workers, concurrency: workers, roster: Array.from({ length: workers }, (_, i) => ({ id: `agent_${i + 1}`, persona_id: `p${i + 1}`, role: 'verifier', write_policy: 'read-only' })) };
+const partition = { slices: Array.from({ length: workers }, (_, i) => ({ id: `work-${i + 1}`, role: 'verifier', description: `sleep ${i + 1}`, write_paths: [], readonly_paths: [] })) };
+await runAgentScheduler({
+    root,
+    missionId,
+    rootHash: 'fixture',
+    roster,
+    partition,
+    targetActiveSlots: workers,
+    maxActiveSlots: workers,
+    launchSession: async ({ generation, slot, agent, workItem }) => {
+        const pid = 7000 + Number(slot.slot_id.match(/\d+/)?.[0] || 0);
+        await appendParallelRuntimeEvent(root, missionId, { event_type: 'worker_process_spawned', slot_id: slot.slot_id, generation_index: generation.generation_index, session_id: generation.session_id, pid, backend: 'fixture', placement: 'process' });
+        await new Promise((resolve) => setTimeout(resolve, sleepMs));
+        await appendParallelRuntimeEvent(root, missionId, { event_type: 'worker_completed', slot_id: slot.slot_id, generation_index: generation.generation_index, session_id: generation.session_id, pid, backend: 'fixture', placement: 'process' });
+        return {
+            schema: 'sks.agent-result.v1',
+            mission_id: missionId,
+            agent_id: agent.id,
+            session_id: generation.session_id,
+            persona_id: agent.persona_id,
+            task_slice_id: workItem.id,
+            status: 'done',
+            backend: 'fixture',
+            summary: 'done',
+            findings: [],
+            proposed_changes: [],
+            changed_files: [],
+            lease_compliance: { ok: true, violations: [] },
+            artifacts: [],
+            blockers: [],
+            confidence: 'high',
+            handoff_notes: '',
+            unverified: [],
+            writes: [],
+            recursion_guard: { ok: true, violations: [] },
+            verification: { status: 'passed', checks: ['sleep'] }
+        };
+    }
+});
+const proof = await writeParallelRuntimeProof(root, missionId, {
+    proofMode: 'mock-process',
+    requireWorkerPids: true,
+    requestedWorkers: workers,
+    targetActiveSlots: workers,
+    expectedWorkerRuntimeMs: sleepMs,
+    minActiveWorkers: workers,
+    minSpeedupRatio: 1
+});
+assertGate(proof.utilization_proof_consistency?.ok === true, 'scheduler/proof consistency must pass', proof);
+assertGate(proof.utilization_proof_consistency.scheduler_max_active >= workers - 1 && proof.utilization_proof_consistency.proof_max_active >= workers - 1, 'scheduler and proof max active counts must roughly agree', proof);
+emitGate('scheduler:parallel-proof-consistency', proof.utilization_proof_consistency);
+//# sourceMappingURL=scheduler-parallel-proof-consistency-check.js.map

package/dist/scripts/scheduler-resource-budget-check.js

@@ -0,0 +1,7 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/release/resource-class-budget.js');
+const budget = mod.computeResourceClassBudget({ SKS_RESOURCE_CPU_LIGHT: '3' });
+assertGate(budget.schema === 'sks.resource-class-budget.v1' && budget.cpu_light === 3 && budget.secret_sensitive === 1, 'resource budget env/defaults mismatch', budget);
+emitGate('scheduler:resource-budget', budget);
+//# sourceMappingURL=scheduler-resource-budget-check.js.map

package/dist/scripts/scheduler-resource-claim-blackbox.js

@@ -0,0 +1,24 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('sks-scheduler-claim-');
+await writeText(path.join(tmp, 'package.json'), JSON.stringify({ version: '4.0.2', scripts: { 'secret:one': 'node -e "setTimeout(()=>process.exit(0),20)"', 'zellij:one': 'node -e "setTimeout(()=>process.exit(0),20)"' } }, null, 2));
+await writeText(path.join(tmp, 'package-lock.json'), JSON.stringify({ lockfileVersion: 3 }, null, 2));
+await writeText(path.join(tmp, 'release-gates.v2.json'), JSON.stringify({ schema: 'sks.release-gates.v2', gates: [gate('secret:one', ['secret-sensitive']), gate('zellij:one', ['zellij-real'])] }, null, 2));
+const scheduler = await importDist('core/release/extreme-parallel-scheduler.js');
+const report = await scheduler.executeExtremeSchedule({
+    root: tmp,
+    graph: { schema: 'sks.triwiki-affected-graph.v1', root: tmp, tier: 'confidence', changed_files: [], affected_modules: [], gate_packs: ['secret', 'zellij'], gates: ['secret:one', 'zellij:one'], release_equivalent_within_scope: true, confidence: 'affected-release-equivalent', conservative_reason: null, reused_proofs: [], invalidated_proofs: [], required_new_proofs: [] },
+    slaMs: 30_000,
+    budget: { schema: 'sks.resource-class-budget.v1', cpu_light: 4, cpu_heavy: 1, io_light: 4, io_heavy: 1, fs_read: 4, network: 1, remote_model_real: 1, zellij_real: 1, browser_real: 1, secret_sensitive: 1 },
+    useProofBank: false
+});
+const timeline = JSON.parse(await fs.readFile(report.resource_claim_timeline, 'utf8'));
+assertGate(report.ok === true && report.executed_packs.length === 2, 'scheduler must execute selected packs', report);
+assertGate(timeline.events.some((event) => event.event === 'claim') && timeline.events.some((event) => event.event === 'release'), 'scheduler must write claim/release timeline', timeline);
+emitGate('scheduler:resource-claim-blackbox', { packs: report.executed_packs.length, timeline: timeline.events.length });
+function gate(id, resource) {
+    return { id, command: `npm run ${id} --silent`, deps: [], resource, side_effect: 'hermetic', timeout_ms: 5000, cache: { enabled: false, inputs: ['package.json'] }, isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' }, preset: ['release'] };
+}
+//# sourceMappingURL=scheduler-resource-claim-blackbox.js.map

package/dist/scripts/scheduler-utilization-integral-check.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runAgentScheduler } from '../core/agents/agent-scheduler.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const sleepMs = 2000;
+async function runFixture(targetActiveSlots) {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), `sks-scheduler-util-${targetActiveSlots}-`));
+    const missionId = `M-scheduler-util-${targetActiveSlots}`;
+    const roster = {
+        agent_count: 10,
+        concurrency: targetActiveSlots,
+        roster: Array.from({ length: 10 }, (_, i) => ({ id: `agent_${i + 1}`, persona_id: `p${i + 1}`, role: 'verifier', write_policy: 'read-only' }))
+    };
+    const partition = {
+        slices: Array.from({ length: 10 }, (_, i) => ({ id: `work-${i + 1}`, role: 'verifier', description: `sleep ${i + 1}`, write_paths: [], readonly_paths: [] }))
+    };
+    const started = Date.now();
+    const result = await runAgentScheduler({
+        root,
+        missionId,
+        rootHash: 'fixture',
+        roster,
+        partition,
+        targetActiveSlots,
+        maxActiveSlots: 10,
+        launchSession: async ({ generation, agent, workItem }) => {
+            await new Promise((resolve) => setTimeout(resolve, sleepMs));
+            return {
+                schema: 'sks.agent-result.v1',
+                mission_id: missionId,
+                agent_id: agent.id,
+                session_id: generation.session_id,
+                persona_id: agent.persona_id,
+                task_slice_id: workItem.id,
+                status: 'done',
+                backend: 'fixture',
+                summary: 'done',
+                findings: [],
+                proposed_changes: [],
+                changed_files: [],
+                lease_compliance: { ok: true, violations: [] },
+                artifacts: [],
+                blockers: [],
+                confidence: 'high',
+                handoff_notes: '',
+                unverified: [],
+                writes: [],
+                recursion_guard: { ok: true, violations: [] },
+                verification: { status: 'passed', checks: ['sleep'] }
+            };
+        }
+    });
+    return { wall: Date.now() - started, state: result.state };
+}
+function assertActiveTimeIntegral(label, run) {
+    const expectedActiveSlotTimeMs = 10 * sleepMs;
+    const expectedWallMs = Math.ceil(10 / run.state.target_active_slots) * sleepMs;
+    const wallOvershootMs = Math.max(0, run.wall - expectedWallMs);
+    const launchSpanMs = Number(run.state.first_batch_launch_span_ms || 0);
+    const lowerBoundMs = Math.floor(expectedActiveSlotTimeMs * 0.75);
+    const upperBoundMs = expectedActiveSlotTimeMs + Math.max(12_000, Math.ceil(wallOvershootMs * run.state.target_active_slots), Math.ceil(launchSpanMs * run.state.target_active_slots));
+    assertGate(run.state.active_slot_time_ms >= lowerBoundMs && run.state.active_slot_time_ms <= upperBoundMs, `${label} active time integral must approximate worker runtime under scheduler load`, {
+        ...run.state,
+        expected_active_slot_time_ms: expectedActiveSlotTimeMs,
+        expected_wall_ms: expectedWallMs,
+        wall_overshoot_ms: wallOvershootMs,
+        active_slot_time_bounds_ms: { lower: lowerBoundMs, upper: upperBoundMs }
+    });
+}
+function assertSchedulerShape(label, run, utilizationFloor) {
+    const launchSpanMs = Number(run.state.first_batch_launch_span_ms || 0);
+    const utilizationPenalty = Math.min(0.2, launchSpanMs / 10_000);
+    const dynamicUtilizationFloor = Number(Math.max(0.55, utilizationFloor - utilizationPenalty).toFixed(3));
+    assertGate(run.state.completed_count === 10 && run.state.failed_count === 0, `${label} scheduler must complete all fixture work`, run.state);
+    assertGate(run.state.max_observed_active_slots === run.state.target_active_slots, `${label} scheduler must fill target active slots`, run.state);
+    assertGate(run.state.scheduler_utilization >= dynamicUtilizationFloor, `${label} scheduler utilization too low`, {
+        ...run.state,
+        dynamic_utilization_floor: dynamicUtilizationFloor
+    });
+}
+function assertFixtureWallTime(label, run) {
+    const expectedWallMs = Math.ceil(10 / run.state.target_active_slots) * sleepMs;
+    const launchSpanMs = Number(run.state.first_batch_launch_span_ms || 0);
+    const wallBudgetMs = Math.max(expectedWallMs + 5_000, expectedWallMs + launchSpanMs + 4_000);
+    assertGate(run.wall < wallBudgetMs, `${label} scheduler wall time too slow`, {
+        wall: run.wall,
+        wall_budget_ms: wallBudgetMs,
+        expected_wall_ms: expectedWallMs,
+        state: run.state
+    });
+}
+const ten = await runFixture(10);
+assertFixtureWallTime('10-slot', ten);
+assertActiveTimeIntegral('10-slot', ten);
+assertSchedulerShape('10-slot', ten, 0.65);
+const two = await runFixture(2);
+assertGate(two.wall >= 8000, '2-slot scheduler wall time must not run all work at once', two);
+assertFixtureWallTime('2-slot', two);
+assertActiveTimeIntegral('2-slot', two);
+assertSchedulerShape('2-slot', two, 0.75);
+emitGate('scheduler:utilization-integral', { ten: ten.state, two: two.state });
+//# sourceMappingURL=scheduler-utilization-integral-check.js.map

package/dist/scripts/scheduler-utilization-proof-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const src = readText('src/core/agents/agent-scheduler.ts');
+for (const token of ['batch_dispatch_count', 'largest_batch_size', 'first_batch_launch_span_ms', 'average_batch_launch_span_ms', 'scheduler_utilization', 'active_slot_time_ms', 'wall_time_ms'])
+    assertGate(src.includes(token), `scheduler metric missing: ${token}`);
+emitGate('scheduler:utilization-proof');
+//# sourceMappingURL=scheduler-utilization-proof-check.js.map

package/dist/scripts/secret-line-rollback-check.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, readJson, writeText } from './sks-3-1-8-check-lib.js';
+import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
+const root = await makeTempRoot('sks-secret-line-rollback-');
+const envFile = path.join(root, '.env.local');
+await writeText(envFile, [
+    'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co',
+    'NEXT_PUBLIC_SUPABASE_ANON_KEY=original-secret',
+    'UNRELATED=value',
+    ''
+].join('\n'));
+let blocked = false;
+try {
+    await withSecretPreservationGuard(root, 'fixture-line-rollback', async () => {
+        await writeText(envFile, [
+            'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co',
+            'NEXT_PUBLIC_SUPABASE_ANON_KEY=mutated-secret',
+            'UNRELATED=operator-change',
+            ''
+        ].join('\n'));
+    });
+}
+catch {
+    blocked = true;
+}
+const restored = await fs.readFile(envFile, 'utf8');
+const report = await readJson(path.join(root, '.sneakoscope', 'reports', 'secret-preservation-guard.json'));
+assertGate(blocked, 'secret line rollback must block protected value mutation after restoring it');
+assertGate(restored.includes('NEXT_PUBLIC_SUPABASE_ANON_KEY=original-secret'), 'secret line rollback must restore protected line');
+assertGate(restored.includes('UNRELATED=operator-change'), 'secret line rollback must preserve unrelated line changes');
+assertGate(report.restore_mode === 'line-level' && report.unrelated_changes_preserved === true, 'secret guard report must record line-level restoration', report);
+emitGate('secret:line-rollback', { changed_or_missing: (report.changed_or_missing || []).length });
+//# sourceMappingURL=secret-line-rollback-check.js.map

package/dist/scripts/secret-preservation-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { captureSecretPreservationSnapshot } from '../core/config/secret-preservation.js';
+const root = await makeTempRoot('sks-secret-snapshot-');
+await writeText(path.join(root, '.env.local'), 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=secret-value-123\n');
+const snapshot = await captureSecretPreservationSnapshot({ root });
+assertGate(snapshot.fingerprints.length >= 2, 'secret snapshot must capture protected Supabase keys', snapshot);
+assertGate(!JSON.stringify(snapshot).includes('secret-value-123'), 'secret snapshot must not store raw values', snapshot);
+emitGate('secret:preservation', { fingerprints: snapshot.fingerprints.length });
+//# sourceMappingURL=secret-preservation-check.js.map

package/dist/scripts/secret-preservation-guard-check.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
+const root = await makeTempRoot('sks-secret-guard-');
+const envFile = path.join(root, '.env.local');
+await writeText(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=guard-secret\n');
+await withSecretPreservationGuard(root, 'fixture-preserve', async () => {
+    await fs.appendFile(envFile, 'SKS_MANAGED=1\n', 'utf8');
+});
+let deleteBlocked = false;
+try {
+    await withSecretPreservationGuard(root, 'fixture-delete', async () => {
+        await fs.writeFile(envFile, 'SKS_MANAGED=1\n', 'utf8');
+    });
+}
+catch {
+    deleteBlocked = true;
+}
+const restoredAfterDelete = await fs.readFile(envFile, 'utf8');
+assertGate(deleteBlocked, 'secret preservation guard must block missing protected keys after mutation');
+assertGate(restoredAfterDelete.includes('guard-secret'), 'secret preservation guard must roll back deleted protected keys');
+let changeBlocked = false;
+try {
+    await withSecretPreservationGuard(root, 'fixture-change', async () => {
+        await fs.writeFile(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=changed-secret\n', 'utf8');
+    });
+}
+catch {
+    changeBlocked = true;
+}
+const restoredAfterChange = await fs.readFile(envFile, 'utf8');
+assertGate(changeBlocked, 'secret preservation guard must block changed protected key values');
+assertGate(restoredAfterChange.includes('guard-secret') && !restoredAfterChange.includes('changed-secret'), 'secret preservation guard must roll back changed protected values');
+emitGate('secret:preservation-guard');
+//# sourceMappingURL=secret-preservation-guard-check.js.map

package/dist/scripts/shared-memory-fixture-check.js

@@ -0,0 +1,27 @@
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import assert from 'node:assert/strict';
+import { runProcess } from '../core/fsx.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-shared-memory-fixture-'));
+const bin = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
+await fs.writeFile(path.join(root, 'package.json'), '{"name":"fixture","private":true}\n');
+await runProcess('git', ['init'], { cwd: root });
+await runSks(['git', 'install', '--json']);
+await fs.mkdir(path.join(root, '.sneakoscope', 'wiki'), { recursive: true });
+await fs.writeFile(path.join(root, '.sneakoscope', 'wiki', 'context-pack.json'), JSON.stringify({
+    schema: 'fixture',
+    claims: [{ id: 'shared-memory-check-claim', text: 'Shared memory check claim.', status: 'supported', source: 'docs/shared-triwiki.md' }]
+}, null, 2));
+const publish = await runSks(['wiki', 'publish', 'latest', '--shared', '--json']);
+assert.equal(publish.ok, true);
+const validation = await runSks(['wiki', 'validate-shared', '--json']);
+assert.equal(validation.ok, true);
+console.log(JSON.stringify({ ok: true, schema: 'sks.shared-memory-fixture.v1', files: validation.files.length }, null, 2));
+async function runSks(args) {
+    const result = await runProcess(process.execPath, [bin, ...args], { cwd: root, env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' } });
+    assert.equal(result.code, 0, result.stdout || result.stderr);
+    return JSON.parse(result.stdout);
+}
+//# sourceMappingURL=shared-memory-fixture-check.js.map

package/dist/scripts/side-effect-runtime-report-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const { buildSideEffectRuntimeReport } = await importDist('core/safety/side-effect-runtime-report.js');
+const report = await buildSideEffectRuntimeReport(root);
+const out = path.join(root, '.sneakoscope', 'reports', 'side-effect-runtime-report.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(report.unexpected_applied_mutations === 0, 'unexpected applied mutations must be zero', report);
+assertGate(report.global_mutations_without_confirmation === 0, 'global mutations without confirmation must be zero', report);
+assertGate(report.config_mutations_without_backup_or_noop === 0, 'config/global mutations without backup or noop must be zero', report);
+emitGate('side-effect:runtime-report', {
+    ledgers: report.ledger_paths.length,
+    applied: report.applied_entries,
+    unexpected_applied_mutations: report.unexpected_applied_mutations
+});
+//# sourceMappingURL=side-effect-runtime-report-check.js.map