sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/terminal-keyboard-enhancement-safety-check.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// @ts-nocheck
+const report = {
+    schema: 'sks.keyboard-enhancement-safety-check.v1',
+    ok: true,
+    runtime: 'zellij',
+    removed_runtime: 'tmux',
+    checks: ['no control-mode keyboard setup is attempted by SKS runtime']
+};
+console.log(JSON.stringify(report, null, 2));
+export {};
+//# sourceMappingURL=terminal-keyboard-enhancement-safety-check.js.map

package/dist/scripts/terminal-tui-output-stability-check.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
+const freshness = ensureDistFresh({ rebuild: true });
+if (!freshness.ok) {
+    console.log(JSON.stringify({ schema: 'sks.tui-output-stability-check.v1', ok: false, blockers: ['dist_not_fresh'], freshness }, null, 2));
+    process.exit(1);
+}
+const layoutMod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'zellij', 'zellij-layout-builder.js')).href);
+const madLayout = layoutMod.buildZellijLayoutKdl({
+    missionId: 'M-tui-output-stability',
+    ledgerRoot: path.join(root, '.sneakoscope', 'tmp', 'tui-output-stability'),
+    cwd: root,
+    kind: 'mad',
+    slotCount: 1,
+    codexArgs: ['--profile', 'sks-mad-high']
+});
+const codexScrollbackOk = madLayout.codex_args.includes('--no-alt-screen')
+    && madLayout.layout_kdl.includes('--no-alt-screen');
+const report = {
+    schema: 'sks.tui-output-stability-check.v1',
+    ok: codexScrollbackOk,
+    runtime: 'zellij',
+    stdout_frame_policy: 'lane renderer stdout only',
+    stderr_policy: 'errors only',
+    codex_scrollback_policy: 'zellij interactive Codex panes launch with --no-alt-screen so trackpad wheel scrolls terminal conversation history instead of the prompt textarea',
+    codex_no_alt_screen: codexScrollbackOk,
+    blockers: codexScrollbackOk ? [] : ['codex_no_alt_screen_missing']
+};
+console.log(JSON.stringify(report, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+//# sourceMappingURL=terminal-tui-output-stability-check.js.map

package/dist/scripts/test-no-orphan-dist-imports-check.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// Release gate: no test file may import a `dist/...` module whose TypeScript
+// source no longer exists. This catches "test rot" left behind when a source
+// module is deleted (e.g. the tmux runtime removed in the Zellij migration)
+// but its test file is not — those tests fail with ERR_MODULE_NOT_FOUND and,
+// because they live under test/unit + test/integration (which no release gate
+// executes), the rot stays invisible. This gate makes it visible.
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const testDir = path.join(root, 'test');
+// Match real ES import references to a dist module, NOT string-literal args:
+//   import x from '../../core/foo.js'
+//   import { y } from "../bar.js"
+//   await import('../../baz.js')
+// The leading `from`/`import(` requirement is what excludes assertion strings
+// like `{ file: 'dist/index.js' }` from being treated as imports.
+const IMPORT_RE = /(?:\bfrom\s*|\bimport\s*\(\s*)['"]([^'"]*\bdist\/[^'"]+\.js)['"]/g;
+const orphans = [];
+let scanned = 0;
+let importEdges = 0;
+for (const file of walk(testDir)) {
+    if (!file.endsWith('.test.mjs'))
+        continue;
+    scanned += 1;
+    const text = fs.readFileSync(file, 'utf8');
+    const rel = path.relative(root, file);
+    const seen = new Set();
+    for (const match of text.matchAll(IMPORT_RE)) {
+        const ref = normalizeDistRef(match[1]);
+        if (!ref || seen.has(ref))
+            continue;
+        seen.add(ref);
+        importEdges += 1;
+        const srcPath = path.join(root, 'src', ref.replace(/^dist\//, '').replace(/\.js$/, '.ts'));
+        const distPath = path.join(root, ref);
+        // Pass if EITHER the TS source exists (module is real, just not built yet)
+        // OR a built artifact exists. Only when both are missing is it an orphan.
+        if (!fs.existsSync(srcPath) && !fs.existsSync(distPath)) {
+            orphans.push({ test: rel, missing_import: ref, expected_source: path.relative(root, srcPath) });
+        }
+    }
+}
+assertGate(orphans.length === 0, 'test files import deleted dist modules (orphan tests; delete them or restore the source)', { orphans });
+emitGate('test:no-orphan-dist-imports', {
+    schema: 'sks.test-no-orphan-dist-imports.v1',
+    test_files_scanned: scanned,
+    dist_import_edges: importEdges
+});
+function normalizeDistRef(raw) {
+    const idx = raw.lastIndexOf('dist/');
+    return idx >= 0 ? raw.slice(idx) : '';
+}
+function walk(dir) {
+    const out = [];
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...walk(full));
+        else
+            out.push(full);
+    }
+    return out;
+}
+//# sourceMappingURL=test-no-orphan-dist-imports-check.js.map

package/dist/scripts/triwiki-affected-graph-blackbox.js

@@ -0,0 +1,28 @@
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('sks-triwiki-affected-');
+await fs.writeFile(path.join(tmp, 'package.json'), JSON.stringify({ scripts: { 'triwiki:affected-graph': 'node fixture.js' } }));
+await fs.writeFile(path.join(tmp, 'release-gates.v2.json'), JSON.stringify({
+    schema: 'sks.release-gates.v2',
+    gates: [{
+            id: 'triwiki:affected-graph',
+            command: 'npm run triwiki:affected-graph --silent',
+            deps: [],
+            resource: ['cpu-light'],
+            side_effect: 'hermetic',
+            timeout_ms: 1000,
+            cache: { enabled: true, inputs: ['src/core/triwiki/**'] },
+            isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
+            preset: ['release']
+        }]
+}, null, 2));
+await fs.mkdir(path.join(tmp, 'src/core/triwiki'), { recursive: true });
+await fs.writeFile(path.join(tmp, 'src/core/triwiki/a.ts'), 'export const a = 1;\n');
+const mod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const graph = mod.computeTriWikiAffectedGraph({ root: tmp, changedFiles: ['src/core/triwiki/a.ts'], tier: 'affected' });
+assertGate(graph.gates.includes('triwiki:affected-graph'), 'blackbox affected graph must select changed gate', graph);
+emitGate('triwiki:affected-graph-blackbox', { gates: graph.gates });
+//# sourceMappingURL=triwiki-affected-graph-blackbox.js.map

package/dist/scripts/triwiki-affected-graph-check.js

@@ -0,0 +1,10 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/triwiki/triwiki-affected-graph.js');
+const graph = mod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-bank.ts'], tier: 'affected' });
+assertGate(graph.schema === 'sks.triwiki-affected-graph.v1', 'affected graph schema mismatch', graph);
+assertGate(graph.affected_modules.includes('triwiki') && graph.gate_packs.includes('triwiki') && graph.release_equivalent_within_scope === true, 'triwiki file must select triwiki release-equivalent pack', graph);
+const full = mod.computeTriWikiAffectedGraph({ root, full: true, tier: 'release' });
+assertGate(full.gates.length > graph.gates.length && full.gate_packs.length >= graph.gate_packs.length && full.conservative_reason === 'full_release_requested', 'full release graph must select the full gate surface', full);
+emitGate('triwiki:affected-graph', { gates: graph.gates.length, packs: graph.gate_packs, full_gates: full.gates.length });
+//# sourceMappingURL=triwiki-affected-graph-check.js.map

package/dist/scripts/triwiki-cache-key-check.js

@@ -0,0 +1,9 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/triwiki/triwiki-cache-key.js');
+const a = mod.computeTriWikiCacheKey({ root, id: 'triwiki:cache-key', inputs: ['package.json'], implementationFiles: ['src/core/triwiki/triwiki-cache-key.ts'], envAllowlist: ['CI'], fixtureVersion: 'sks-4.0.0' });
+const b = mod.computeTriWikiCacheKey({ root, id: 'triwiki:cache-key', inputs: ['package.json'], implementationFiles: ['src/core/triwiki/triwiki-cache-key.ts'], envAllowlist: ['CI'], fixtureVersion: 'sks-4.0.0' });
+assertGate(a.schema === 'sks.triwiki-cache-key.v1', 'cache key schema mismatch', a);
+assertGate(a.key === b.key && a.file_count >= 1 && a.input_hash && a.implementation_hash && a.package_lock_hash, 'cache key must be deterministic and complete', { a, b });
+emitGate('triwiki:cache-key', { key: a.key, files: a.file_count });
+//# sourceMappingURL=triwiki-cache-key-check.js.map

package/dist/scripts/triwiki-gate-impact-map-check.js

@@ -0,0 +1,8 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/triwiki/triwiki-gate-impact-map.js');
+const map = mod.buildTriWikiGateImpactMap(root);
+assertGate(map.schema === 'sks.triwiki-gate-impact-map.v1' && map.gate_count > 0, 'impact map must index release gates', map);
+assertGate(map.impacts.some((impact) => impact.gate_pack === 'triwiki'), 'impact map must include triwiki pack', map.impacts.slice(0, 10));
+emitGate('triwiki:gate-impact-map', { gates: map.gate_count, orphans: map.orphan_count });
+//# sourceMappingURL=triwiki-gate-impact-map-check.js.map

package/dist/scripts/triwiki-module-card-check.js

@@ -0,0 +1,7 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/triwiki/triwiki-module-card.js');
+assertGate(mod.DEFAULT_TRIWIKI_MODULE_CARDS.length >= 10, 'module cards must cover 4.0.0 workstreams', mod.DEFAULT_TRIWIKI_MODULE_CARDS);
+assertGate(mod.moduleIdsForPath('src/core/triwiki/triwiki-proof-bank.ts').includes('triwiki'), 'triwiki module path mapping failed');
+emitGate('triwiki:module-card', { modules: mod.DEFAULT_TRIWIKI_MODULE_CARDS.length });
+//# sourceMappingURL=triwiki-module-card-check.js.map

package/dist/scripts/triwiki-proof-bank-blackbox.js

@@ -0,0 +1,30 @@
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { importDist } from './sks-1-18-gate-lib.js';
+const tmp = await makeTempRoot('sks-triwiki-proof-bank-');
+await fs.writeFile(path.join(tmp, 'package.json'), JSON.stringify({ version: '4.0.0' }));
+await fs.writeFile(path.join(tmp, 'package-lock.json'), JSON.stringify({ lockfileVersion: 3 }));
+const cardMod = await importDist('core/triwiki/triwiki-proof-card.js');
+const bank = await importDist('core/triwiki/triwiki-proof-bank.js');
+const card = cardMod.createTriWikiProofCard({
+    subject_type: 'gate',
+    subject_id: 'fixture:gate',
+    cache_key: 'fixture-cache',
+    input_hash: 'input',
+    implementation_hash: 'impl',
+    tool_version: '4.0.0',
+    fixture_version: 'sks-4.0.0',
+    result: 'passed',
+    reusable: true,
+    evidence: { blackbox: true }
+});
+bank.writeTriWikiProofCard(tmp, card);
+const hit = bank.readReusableTriWikiProofCard({ root: tmp, subjectId: 'fixture:gate', cacheKey: 'fixture-cache' });
+assertGate(hit.hit === true && hit.card?.proof_id === card.proof_id, 'proof bank must reuse matching passed card', hit);
+bank.markTriWikiProofInvalidated(tmp, 'fixture:gate', card.proof_id, 'fixture_invalidated');
+const miss = bank.readReusableTriWikiProofCard({ root: tmp, subjectId: 'fixture:gate', cacheKey: 'fixture-cache' });
+assertGate(miss.hit === false, 'invalidated proof card must not be reused', miss);
+emitGate('triwiki:proof-bank-blackbox', { hit: true, invalidation_blocked_reuse: true });
+//# sourceMappingURL=triwiki-proof-bank-blackbox.js.map

package/dist/scripts/triwiki-proof-bank-check.js

@@ -0,0 +1,7 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const bank = await importDist('core/triwiki/triwiki-proof-bank.js');
+const status = bank.summarizeTriWikiProofBank(root);
+assertGate(status.schema === 'sks.triwiki-proof-bank.v1' && status.ok === true, 'proof bank status must pass', status);
+emitGate('triwiki:proof-bank', status);
+//# sourceMappingURL=triwiki-proof-bank-check.js.map

package/dist/scripts/triwiki-proof-bank-lock-blackbox.js

@@ -0,0 +1,7 @@
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const source = readText('src/core/triwiki/triwiki-proof-bank.ts');
+assertGate(source.includes('function pidAlive(pid: number): boolean'), 'proof bank lock must use a pidAlive helper');
+assertGate(!source.includes('process.kill(raw.pid, 0) !== undefined'), 'proof bank lock must not compare process.kill(pid, 0) to undefined');
+assertGate(source.includes("code === 'EPERM'"), 'proof bank lock must treat EPERM as alive');
+emitGate('triwiki:proof-bank-lock-blackbox');
+//# sourceMappingURL=triwiki-proof-bank-lock-blackbox.js.map

package/dist/scripts/triwiki-proof-card-check.js

@@ -0,0 +1,23 @@
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/triwiki/triwiki-proof-card.js');
+const card = mod.createTriWikiProofCard({
+    subject_type: 'gate',
+    subject_id: 'triwiki:proof-card',
+    cache_key: 'cache-key',
+    input_hash: 'input',
+    gate_impl_hash: 'impl',
+    package_lock_hash: 'pkg',
+    release_gates_hash: 'gates',
+    env_allowlist_hash: 'env',
+    tool_versions: { sks: '4.0.1' },
+    tool_version: '4.0.1',
+    fixture_version: 'sks-4.0.1',
+    result: 'passed',
+    reusable: true,
+    evidence: { fixture: true }
+});
+assertGate(card.schema === 'sks.triwiki-proof-card.v1', 'proof card schema mismatch', card);
+assertGate(card.proof_id.startsWith('proof-') && mod.isReusableTriWikiProofCard(card), 'proof card must be reusable when passed', card);
+emitGate('triwiki:proof-card', { proof_id: card.proof_id });
+//# sourceMappingURL=triwiki-proof-card-check.js.map

package/dist/scripts/triwiki-stale-proof-rejection-check.js

@@ -0,0 +1,25 @@
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const cardMod = await importDist('core/triwiki/triwiki-proof-card.js');
+const bankMod = await importDist('core/triwiki/triwiki-proof-bank.js');
+const invalidationMod = await importDist('core/triwiki/triwiki-invalidation.js');
+const card = cardMod.createTriWikiProofCard({
+    subject_type: 'gate',
+    subject_id: 'triwiki:stale-proof-rejection:fixture',
+    cache_key: 'stale-proof-key',
+    input_hash: 'input',
+    gate_impl_hash: 'impl',
+    package_lock_hash: 'pkg',
+    release_gates_hash: 'gates',
+    env_allowlist_hash: 'env',
+    tool_versions: { sks: '4.0.1' },
+    fixture_version: 'sks-4.0.1',
+    result: 'passed',
+    reusable: true,
+    evidence: { fixture: true }
+});
+bankMod.writeTriWikiProofCard(root, card);
+await invalidationMod.invalidateTriWikiProofsForChange({ root, changedFiles: ['package.json'], affectedModules: [], affectedGates: [card.subject_id], reason: 'blackbox' });
+const hit = bankMod.readReusableTriWikiProofCard({ root, subjectId: card.subject_id, cacheKey: card.cache_key });
+assertGate(hit.hit === false, 'invalidated proof must not be reusable', hit);
+emitGate('triwiki:stale-proof-rejection', { rejected: true, reasons: hit.invalidation_reasons });
+//# sourceMappingURL=triwiki-stale-proof-rejection-check.js.map

package/dist/scripts/trust-fixture-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runProcess } from '../core/fsx.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-trust-fixture-'));
+await fs.writeFile(path.join(root, 'package.json'), '{"private":true,"name":"sks-trust-fixture"}\n');
+await runProcess('git', ['init', '-q'], {
+    cwd: root,
+    timeoutMs: 10_000,
+    maxOutputBytes: 64 * 1024,
+    env: { CI: 'true' }
+});
+const sks = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
+const run = await runJson(root, sks, ['run', 'fixture', '--mock', '--json']);
+const trust = await runJson(root, sks, ['trust', 'validate', run.mission_id, '--json']);
+const ok = run.ok === true && ['verified', 'verified_partial'].includes(trust.status);
+console.log(JSON.stringify({ schema: 'sks.trust-fixture-check.v1', ok, mission_id: run.mission_id, trust_status: trust.status, issues: trust.issues || [] }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+async function runJson(rootDir, sksBin, args) {
+    const result = await runProcess(process.execPath, [sksBin, ...args], {
+        cwd: rootDir,
+        timeoutMs: 60_000,
+        maxOutputBytes: 512 * 1024,
+        env: { SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' }
+    });
+    if (result.code !== 0)
+        throw new Error(`${args.join(' ')} failed: ${result.stderr || result.stdout}`);
+    return JSON.parse(result.stdout);
+}
+//# sourceMappingURL=trust-fixture-check.js.map

package/dist/scripts/type-surface-codex-app-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
+await runDirective315Gate('type-surface:codex-app');
+//# sourceMappingURL=type-surface-codex-app-check.js.map

package/dist/scripts/typescript-migration-report.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+// @ts-nocheck
+/**
+ * Writes .sneakoscope/reports/typescript-migration.{json,md}
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const srcRoot = path.join(root, 'src');
+const distRoot = path.join(root, 'dist');
+function walkTs(dir, out) {
+    if (!fs.existsSync(dir))
+        return;
+    for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, ent.name);
+        if (ent.isDirectory())
+            walkTs(p, out);
+        else if (ent.isFile() && ent.name.endsWith('.ts'))
+            out.push(p);
+    }
+}
+function walk(dir, patt, acc) {
+    if (!fs.existsSync(dir))
+        return;
+    for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, ent.name);
+        if (ent.isDirectory())
+            walk(p, patt, acc);
+        else if (ent.isFile() && patt(ent.name))
+            acc.push(p);
+    }
+}
+const tsFiles = [];
+walkTs(srcRoot, tsFiles);
+let nocheck = 0;
+let tsignore = 0;
+let expectErrBad = 0;
+for (const f of tsFiles) {
+    const t = fs.readFileSync(f, 'utf8');
+    if (/^\s*\/\/\s*@ts-nocheck/m.test(t) || /\n\/\/\s*@ts-nocheck/.test(t))
+        nocheck += 1;
+    if (/@ts-ignore\b/.test(t))
+        tsignore += 1;
+    for (const line of t.split('\n'))
+        if (/@ts-expect-error\b/.test(line) && !/SKS-/.test(line))
+            expectErrBad += 1;
+}
+const mjs = [];
+walk(distRoot, (n) => n.endsWith('.mjs'), mjs);
+const srcMjs = [];
+walk(srcRoot, (n) => n.endsWith('.mjs'), srcMjs);
+const registryText = fs.readFileSync(path.join(srcRoot, 'cli', 'command-registry.ts'), 'utf8');
+const typedEntries = (registryText.match(/\bentry\(/g) || []).length;
+const report = {
+    schema: 'sks.typescript-migration.v1',
+    version: pkg.version,
+    runtime_ts_files: tsFiles.length,
+    runtime_mjs_files: srcMjs.length,
+    src_mjs_runtime_files: srcMjs.length,
+    src_mjs_removed: srcMjs.length === 0,
+    ts_nocheck: nocheck,
+    ts_ignore: tsignore,
+    ts_expect_error_without_reason: expectErrBad,
+    typed_command_entries: typedEntries,
+    dist_mjs_files: mjs.length,
+    status: nocheck === 0 && tsignore === 0 && expectErrBad === 0 && srcMjs.length === 0 ? 'verified' : 'blocked',
+};
+const outDir = path.join(root, '.sneakoscope', 'reports');
+fs.mkdirSync(outDir, { recursive: true });
+const jsonPath = path.join(outDir, 'typescript-migration.json');
+const mdPath = path.join(outDir, 'typescript-migration.md');
+fs.writeFileSync(jsonPath, `${JSON.stringify(report, null, 2)}\n`);
+const md = `# TypeScript Migration Report (${report.version})\n\n\`\`\`json\n${JSON.stringify(report, null, 2)}\n\`\`\`\n`;
+fs.writeFileSync(mdPath, md);
+console.log(JSON.stringify({ schema: `${report.schema}-write.v1`, ok: true, jsonPath, mdPath }, null, 2));
+//# sourceMappingURL=typescript-migration-report.js.map

package/dist/scripts/ultra-router-auto-router-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const router = await importDist('core/router/ultra-router.js');
+const cache = await importDist('core/router/route-cache.js');
+cache.clearRouteCache();
+const simpleWorker = router.routeCodexTask(baseTask({ tier: 'worker', slotId: 'slot-001', workItemId: 'slice-1' }));
+const cachedWorker = router.routeCodexTask(baseTask({ tier: 'worker', slotId: 'slot-001', workItemId: 'slice-1' }));
+const imageWorker = router.routeCodexTask(baseTask({ tier: 'worker', slotId: 'slot-002', workItemId: 'slice-2', inputImages: ['screen.png'] }));
+const orchestrator = router.routeCodexTask(baseTask({ tier: 'orchestrator', prompt: 'conflict resolution final synthesis' }));
+assertGate(simpleWorker.selected_profile === 'fast-worker', 'simple worker should choose cheapest good-enough profile', simpleWorker);
+assertGate(cachedWorker.cache_hit === true, 'second identical routing decision must hit cache', cachedWorker);
+assertGate(imageWorker.selected_profile === 'vision-worker', 'image worker must hard-filter non-vision candidates', imageWorker);
+assertGate(orchestrator.tier === 'orchestrator' && orchestrator.selected_profile.includes('orchestrator'), 'orchestrator task must stay orchestrator tier', orchestrator);
+assertGate(orchestrator.reason.includes('score>=threshold') || orchestrator.reason.includes('deterministic-default'), 'router must emit deterministic reason', orchestrator);
+emitGate('ultra-router:auto-router', { worker: simpleWorker.selected_profile, image_worker: imageWorker.selected_profile, cache_hit: cachedWorker.cache_hit, orchestrator: orchestrator.selected_profile });
+function baseTask(extra = {}) {
+    return {
+        route: '$Agent',
+        missionId: 'M-ultra-router-auto',
+        cwd: process.cwd(),
+        prompt: 'fixture',
+        inputFiles: [],
+        inputImages: [],
+        outputSchemaId: 'sks.agent-worker-result.v1',
+        outputSchema: {},
+        sandboxPolicy: 'read-only',
+        requestedScopeContract: { read_only: true },
+        mutationLedgerRoot: process.cwd(),
+        ...extra
+    };
+}
+//# sourceMappingURL=ultra-router-auto-router-check.js.map

package/dist/scripts/ultra-router-classification-check.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const classifier = await importDist('core/router/task-classifier.js');
+const orchestrator = classifier.classifyCodexTask(baseTask({ prompt: 'strategy planning and final synthesis', route: '$Team' }));
+const worker = classifier.classifyCodexTask(baseTask({ prompt: 'work item patch shard', route: '$Naruto', slotId: 'slot-001', workItemId: 'slice-1' }));
+const imageWorker = classifier.classifyCodexTask(baseTask({ prompt: 'image QA shard', inputImages: ['screen.png'], slotId: 'slot-002', workItemId: 'slice-2' }));
+assertGate(orchestrator.tier === 'orchestrator', 'main route must classify as orchestrator', orchestrator);
+assertGate(worker.tier === 'worker', 'worker slot must classify as worker', worker);
+assertGate(imageWorker.image_required === true, 'image task must carry image hard filter signal', imageWorker);
+emitGate('ultra-router:classification', { orchestrator: orchestrator.tier, worker: worker.tier, image_required: imageWorker.image_required });
+function baseTask(extra = {}) {
+    return {
+        route: '$Agent',
+        missionId: 'M-ultra-router-classification',
+        cwd: process.cwd(),
+        prompt: 'fixture',
+        inputFiles: [],
+        inputImages: [],
+        outputSchemaId: 'sks.agent-worker-result.v1',
+        outputSchema: {},
+        sandboxPolicy: 'read-only',
+        requestedScopeContract: { read_only: true },
+        mutationLedgerRoot: process.cwd(),
+        ...extra
+    };
+}
+//# sourceMappingURL=ultra-router-classification-check.js.map

package/dist/scripts/update-gate-removed-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, packageScripts, readText } from './sks-1-18-gate-lib.js';
+const scripts = packageScripts();
+const mad = readText('src/core/commands/mad-sks-command.ts');
+assertGate(!mad.includes('maybePromptSksUpdateForLaunch(args'), 'MAD launch must not run blocking SKS update prompt');
+assertGate(!String(scripts['release:check'] || '').includes('release-registry-check'), 'release:check must not block on external registry latest mismatch');
+assertGate(String(scripts['release:check'] || '').includes('release:check:affected'), 'release:check should default to affected non-registry release gates');
+emitGate('update:gate-removed', { release_check: scripts['release:check'] });
+//# sourceMappingURL=update-gate-removed-check.js.map

package/dist/scripts/update-mad-zellij-notice-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const mad = readText('src/core/commands/mad-sks-command.ts');
+const anchor = readText('src/core/zellij/zellij-slot-column-anchor.ts');
+const updateNotice = readText('src/core/update/update-notice.ts');
+assertGate(mad.includes('checkSksUpdateNotice') && updateNotice.includes('update-notice.json'), 'MAD Zellij launch must write nonblocking update notice artifact');
+assertGate(anchor.includes('update-notice.json') && anchor.includes('updateAvailableVersion'), 'Zellij anchor must display update notice state');
+emitGate('update:mad-zellij-notice', { artifact: 'update-notice.json' });
+//# sourceMappingURL=update-mad-zellij-notice-check.js.map

package/dist/scripts/update-notice-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const update = await importDist('core/update/update-notice.js');
+const notice = await update.checkSksUpdateNotice({ currentVersion: '2.0.15', env: { SKS_UPDATE_NOTICE_DISABLE: '1' } });
+assertGate(notice.schema === update.SKS_UPDATE_NOTICE_SCHEMA, 'update notice schema mismatch', notice);
+assertGate(notice.source === 'disabled' && notice.update_available === false, 'disabled update notice must be nonblocking', notice);
+const directiveEnvNotice = await update.checkSksUpdateNotice({ currentVersion: '2.0.15', env: { SKS_DISABLE_UPDATE_NOTICE: '1' } });
+assertGate(directiveEnvNotice.source === 'disabled' && directiveEnvNotice.update_available === false, 'directive disable env must be honored', directiveEnvNotice);
+emitGate('update:notice', { source: notice.source, directive_env_source: directiveEnvNotice.source });
+//# sourceMappingURL=update-notice-check.js.map

package/dist/scripts/update-preserves-supabase-keys-blackbox.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
+const root = await makeTempRoot('sks-update-supabase-');
+const envFile = path.join(root, '.env.local');
+await writeText(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=update-secret\n');
+await withSecretPreservationGuard(root, 'update-fixture', async () => {
+    await fs.appendFile(envFile, 'SKS_UPDATE_MARKER=1\n', 'utf8');
+});
+const text = await fs.readFile(envFile, 'utf8');
+assertGate(text.includes('update-secret'), 'update fixture must preserve Supabase key value in source file');
+let blocked = false;
+try {
+    await withSecretPreservationGuard(root, 'update-fixture-mutates-secret', async () => {
+        await fs.writeFile(envFile, 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=mutated-update-secret\n', 'utf8');
+    });
+}
+catch {
+    blocked = true;
+}
+const restored = await fs.readFile(envFile, 'utf8');
+assertGate(blocked, 'update guard must block Supabase key value mutation');
+assertGate(restored.includes('update-secret') && !restored.includes('mutated-update-secret'), 'update guard must restore Supabase key value after mutation');
+emitGate('update:preserves-supabase-keys');
+//# sourceMappingURL=update-preserves-supabase-keys-blackbox.js.map

package/dist/scripts/update-secret-migration-journal-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
+import { writeSecretMigrationJournal } from '../core/config/config-migration-journal.js';
+const root = await makeTempRoot('sks-secret-journal-');
+const result = await writeSecretMigrationJournal(root, 'fixture-operation', ['.env.local']);
+assertGate(result.entry.operation === 'fixture-operation' && result.journal_path.includes('secret-migration-journal.json'), 'secret migration journal must record operation and path', result);
+emitGate('update:secret-migration-journal');
+//# sourceMappingURL=update-secret-migration-journal-check.js.map

package/dist/scripts/update-secret-preservation-guard-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const basicCli = readText('src/core/commands/basic-cli.ts');
+const doctor = readText('src/commands/doctor.ts');
+assertGate(basicCli.includes("withSecretPreservationGuard(root, 'setup-command'"), 'setup command must use secret preservation guard');
+assertGate(basicCli.includes("withSecretPreservationGuard(root, 'update-now'"), 'update now command must use secret preservation guard');
+assertGate(doctor.includes("withSecretPreservationGuard(root, 'doctor-fix'"), 'doctor --fix setup/config mutation block must start inside doctor-level secret guard');
+assertGate(doctor.includes('runDoctorNativeCapabilityRepair'), 'doctor must call native repair facade that includes secret guard');
+emitGate('update:secret-preservation-guard');
+//# sourceMappingURL=update-secret-preservation-guard-check.js.map

package/dist/scripts/ux-patch-swarm-route-blackbox.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runPatchSwarmRouteBlackbox } from './agent-patch-swarm-gate-lib.js';
+await runPatchSwarmRouteBlackbox({
+    gate: 'ux:patch-swarm-route-blackbox',
+    route: '$UX-Review',
+    routeCommand: 'sks ux-review',
+    reportName: 'ux-patch-swarm-route-blackbox'
+});
+//# sourceMappingURL=ux-patch-swarm-route-blackbox.js.map

package/dist/scripts/ux-ppt-structured-extraction-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+const schemas = [
+    'schemas/codex/image-ux-issue-ledger.schema.json',
+    'schemas/codex/ppt-slide-issue-ledger.schema.json',
+    'schemas/codex/ppt-slide-extraction-report.schema.json'
+].map((rel) => ({ rel, json: JSON.parse(fs.readFileSync(path.join(process.cwd(), rel), 'utf8')) }));
+const checks = schemas.map(({ rel, json }) => ({
+    rel,
+    root_strict: json.additionalProperties === false,
+    issue_strict: rel.includes('extraction-report')
+        ? json.properties.slide_reports.items.additionalProperties === false
+        : (json.properties.issues.items.additionalProperties === false || json.$defs?.issue?.additionalProperties === false)
+}));
+const ok = checks.every((check) => check.root_strict && check.issue_strict);
+console.log(JSON.stringify({ schema: 'sks.ux-ppt-structured-extraction-check.v1', ok, checks }, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=ux-ppt-structured-extraction-check.js.map

package/dist/scripts/ux-review-extract-real-callouts-fixture-check.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readMissionJson, runUxFixture } from './sks-1-11-gate-lib.js';
+const result = runUxFixture();
+const issues = readMissionJson(result.mission_id, 'image-ux-issue-ledger.json');
+assertGate(issues.schema === 'sks.image-ux-issue-ledger.v3' && Array.isArray(issues.issues), 'image UX issue extraction ledger invalid', issues);
+emitGate('ux-review:extract-real-callouts-fixture', { mission_id: result.mission_id, issues: issues.issues.length });
+//# sourceMappingURL=ux-review-extract-real-callouts-fixture-check.js.map

package/dist/scripts/ux-review-extract-wires-real-extractor-check.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
+requireContains('ux-review:extract-wires-real-extractor', 'src/core/commands/image-ux-review-command.ts', [
+    'extractIssuesImageUxReview',
+    'extractRealCallouts',
+    'IMAGE_UX_REVIEW_CALLOUT_EXTRACTION_REPORT_ARTIFACT'
+]);
+requireContains('ux-review:extract-wires-real-extractor', 'src/core/image-ux-review.ts', [
+    'sks.image-ux-callout-extraction-report.v1',
+    'bbox_validation_issues',
+    'verified_cap'
+]);
+emitGate('ux-review:extract-wires-real-extractor', { artifact: 'image-ux-callout-extraction-report.json' });
+//# sourceMappingURL=ux-review-extract-wires-real-extractor-check.js.map