sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/agent-multi-project-isolation-check.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const issues = [];
+for (const rel of ['src/core/session/project-namespace.ts', 'src/core/agents/agent-orchestrator.ts']) {
+    if (!fs.existsSync(path.join(root, rel)))
+        issues.push(`missing:${rel}`);
+}
+const orchestrator = read('src/core/agents/agent-orchestrator.ts');
+for (const token of ['buildProjectNamespace', 'namespacedAgentSessionId', 'writeProjectNamespaceArtifact']) {
+    if (!orchestrator.includes(token))
+        issues.push(`orchestrator_namespace_missing:${token}`);
+}
+await runFixture();
+const result = { schema: 'sks.agent-multi-project-isolation-check.v1', ok: issues.length === 0, issues };
+console.log(JSON.stringify(result, null, 2));
+if (!result.ok)
+    process.exitCode = 1;
+function read(rel) {
+    try {
+        return fs.readFileSync(path.join(root, rel), 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+async function runFixture() {
+    const built = path.join(root, 'dist', 'core', 'session', 'project-namespace.js');
+    const orchestratorBuilt = path.join(root, 'dist', 'core', 'agents', 'agent-orchestrator.js');
+    const janitorBuilt = path.join(root, 'dist', 'core', 'agents', 'agent-janitor.js');
+    if (!fs.existsSync(built) || !fs.existsSync(orchestratorBuilt) || !fs.existsSync(janitorBuilt)) {
+        issues.push('fixture_dist_namespace_or_orchestrator_missing_run_build_first');
+        return;
+    }
+    const mod = await import(pathToFileURL(built).href);
+    const orchestrator = await import(pathToFileURL(orchestratorBuilt).href);
+    const janitor = await import(pathToFileURL(janitorBuilt).href);
+    const a = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-proj-a-'));
+    const b = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-proj-b-'));
+    const nsA = await mod.buildProjectNamespace({ root: a, missionId: 'M-same' });
+    const nsB = await mod.buildProjectNamespace({ root: b, missionId: 'M-same' });
+    if (nsA.root_hash === nsB.root_hash)
+        issues.push('fixture_root_hash_collision');
+    if (nsA.mission_namespace_id === nsB.mission_namespace_id)
+        issues.push('fixture_mission_namespace_collision');
+    if (!nsA.temp_dir.includes(nsA.root_hash) || !nsB.temp_dir.includes(nsB.root_hash))
+        issues.push('fixture_temp_dir_missing_hash');
+    if (mod.namespacedZellijSessionName(nsA, 'team') === mod.namespacedZellijSessionName(nsB, 'team'))
+        issues.push('fixture_zellij_session_collision');
+    const sessionA = mod.namespacedAgentSessionId({ agentId: 'agent_1', missionId: 'M-same', rootHash: nsA.root_hash, index: 1 });
+    const sessionB = mod.namespacedAgentSessionId({ agentId: 'agent_1', missionId: 'M-same', rootHash: nsB.root_hash, index: 1 });
+    if (sessionA === sessionB)
+        issues.push('fixture_agent_session_collision');
+    const [runA, runB] = await Promise.all([
+        orchestrator.runNativeAgentOrchestrator({ root: a, missionId: 'M-same', prompt: 'fixture A', backend: 'fake', agents: 5, concurrency: 2, readonly: true }),
+        orchestrator.runNativeAgentOrchestrator({ root: b, missionId: 'M-same', prompt: 'fixture B', backend: 'fake', agents: 5, concurrency: 2, readonly: true })
+    ]);
+    if (!runA.ok || !runB.ok)
+        issues.push('fixture_concurrent_fake_agent_failed');
+    const proofA = JSON.parse(fs.readFileSync(path.join(a, '.sneakoscope', 'missions', 'M-same', 'agents', 'agent-proof-evidence.json'), 'utf8'));
+    const proofB = JSON.parse(fs.readFileSync(path.join(b, '.sneakoscope', 'missions', 'M-same', 'agents', 'agent-proof-evidence.json'), 'utf8'));
+    const liveNsA = JSON.parse(fs.readFileSync(path.join(a, '.sneakoscope', 'missions', 'M-same', 'project-session-namespace.json'), 'utf8'));
+    const liveNsB = JSON.parse(fs.readFileSync(path.join(b, '.sneakoscope', 'missions', 'M-same', 'project-session-namespace.json'), 'utf8'));
+    if (liveNsA.root_hash === liveNsB.root_hash)
+        issues.push('fixture_runtime_root_hash_collision');
+    if (proofA.mission_id !== 'M-same' || proofB.mission_id !== 'M-same')
+        issues.push('fixture_proof_mission_id_drift');
+    if (JSON.stringify(proofA).includes(liveNsB.root_hash) || JSON.stringify(proofB).includes(liveNsA.root_hash))
+        issues.push('fixture_proof_cross_project_reference');
+    const currentA = JSON.parse(fs.readFileSync(path.join(a, '.sneakoscope', 'state', 'current.json'), 'utf8'));
+    const currentB = JSON.parse(fs.readFileSync(path.join(b, '.sneakoscope', 'state', 'current.json'), 'utf8'));
+    if (currentA.mission_id !== 'M-same' || currentB.mission_id !== 'M-same')
+        issues.push('fixture_current_state_not_project_local');
+    fs.mkdirSync(liveNsA.temp_dir, { recursive: true });
+    fs.mkdirSync(liveNsB.temp_dir, { recursive: true });
+    await janitor.runAgentJanitor({ missionDir: path.join(a, '.sneakoscope', 'missions', 'M-same'), missionId: 'M-same', projectHash: liveNsA.root_hash, cleanup: true });
+    if (!fs.existsSync(liveNsA.temp_dir))
+        issues.push('fixture_janitor_deleted_active_project_temp');
+    if (!fs.existsSync(liveNsB.temp_dir))
+        issues.push('fixture_janitor_cross_project_deleted_temp');
+}
+//# sourceMappingURL=agent-multi-project-isolation-check.js.map

package/dist/scripts/agent-native-cli-session-proof-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate } from './sks-1-18-gate-lib.js';
+import { runNativeCliSwarmCheck } from './lib/native-cli-session-swarm-check-lib.js';
+const report = runNativeCliSwarmCheck({ agents: 5, workItems: 5, reportName: 'agent-native-cli-session-proof.json' });
+emitGate('agent:native-cli-session-proof', { spawned: report.native_cli_session_proof.spawned_worker_process_count });
+//# sourceMappingURL=agent-native-cli-session-proof-check.js.map

package/dist/scripts/agent-native-cli-session-swarm-10-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate } from './sks-1-18-gate-lib.js';
+import { runNativeCliSwarmCheck } from './lib/native-cli-session-swarm-check-lib.js';
+const report = runNativeCliSwarmCheck({ agents: 10, workItems: 10, reportName: 'agent-native-cli-session-swarm-10.json' });
+emitGate('agent:native-cli-session-swarm-10', { agents: report.agents, max_observed: report.native_cli_session_proof.max_observed_worker_process_count });
+//# sourceMappingURL=agent-native-cli-session-swarm-10-check.js.map

package/dist/scripts/agent-native-cli-session-swarm-20-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate } from './sks-1-18-gate-lib.js';
+import { runNativeCliSwarmCheck } from './lib/native-cli-session-swarm-check-lib.js';
+const report = runNativeCliSwarmCheck({ agents: 20, workItems: 20, reportName: 'agent-native-cli-session-swarm-20.json' });
+emitGate('agent:native-cli-session-swarm-20', { agents: report.agents, max_observed: report.native_cli_session_proof.max_observed_worker_process_count });
+//# sourceMappingURL=agent-native-cli-session-swarm-20-check.js.map

package/dist/scripts/agent-native-cli-session-swarm-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate } from './sks-1-18-gate-lib.js';
+import { runNativeCliSwarmCheck } from './lib/native-cli-session-swarm-check-lib.js';
+const report = runNativeCliSwarmCheck({ agents: 5, workItems: 5, reportName: 'agent-native-cli-session-swarm.json' });
+emitGate('agent:native-cli-session-swarm', { agents: report.agents, max_observed: report.native_cli_session_proof.max_observed_worker_process_count });
+//# sourceMappingURL=agent-native-cli-session-swarm-check.js.map

package/dist/scripts/agent-no-subagent-scaling-check.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { emitGate } from './sks-1-18-gate-lib.js';
+import { runNativeCliSwarmCheck } from './lib/native-cli-session-swarm-check-lib.js';
+const report = runNativeCliSwarmCheck({ agents: 5, workItems: 5, reportName: 'agent-no-subagent-scaling.json' });
+emitGate('agent:no-subagent-scaling', { native_worker_process_count: report.no_subagent_scaling_policy.native_worker_process_count });
+//# sourceMappingURL=agent-no-subagent-scaling-check.js.map

package/dist/scripts/agent-official-subagent-helper-policy-check.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-official-subagent-helper-'));
+const nativeProof = {
+    schema: 'sks.native-cli-session-proof.v1',
+    ok: true,
+    spawned_worker_process_count: 3,
+    max_observed_worker_process_count: 3,
+    unique_worker_session_count: 3,
+    worker_proof_is_only_subagent_events: false,
+    blockers: []
+};
+await fs.writeFile(path.join(tmp, 'native-cli-session-proof.json'), `${JSON.stringify(nativeProof, null, 2)}\n`);
+await fs.writeFile(path.join(tmp, 'agent-native-cli-session-swarm.json'), `${JSON.stringify({
+    schema: 'sks.agent-native-cli-session-swarm.v1',
+    ok: true,
+    scaling_primitive: 'native_cli_process',
+    spawned_worker_process_count: 3,
+    process_ids: [101, 102, 103],
+    blockers: []
+}, null, 2)}\n`);
+await fs.writeFile(path.join(tmp, 'agent-events.jsonl'), [
+    JSON.stringify({ event_type: 'SubagentStart', agent_type: 'explorer' }),
+    JSON.stringify({ event_type: 'SubagentStop', agent_type: 'explorer' })
+].join('\n') + '\n');
+const helperMod = await importDist('core/agents/official-subagent-helper-policy.js');
+const noSubagentMod = await importDist('core/agents/no-subagent-scaling-policy.js');
+const helper = await helperMod.writeOfficialSubagentHelperPolicy(tmp, { nativeProof });
+const noSubagent = await noSubagentMod.writeNoSubagentScalingPolicy(tmp, { nativeProof, officialSubagentHelperPolicy: helper });
+assertGate(helper.ok === true, 'official subagent helper policy must pass', helper);
+assertGate(helper.official_codex_subagent_helper_lane_enabled === true, 'official helper lane must be enabled', helper);
+assertGate(helper.helper_lane_may_run_in_parallel_with_native_workers === true, 'official helper lane must be parallel-capable', helper);
+assertGate(helper.subagent_events_counted_as_worker_sessions === false, 'subagent helper events must not count as worker sessions', helper);
+assertGate(helper.worker_capacity_credit === 0, 'official helper lane must have zero worker capacity credit', helper);
+assertGate(helper.observed_subagent_event_count === 2, 'official helper lane must report observed subagent events without granting capacity', helper);
+assertGate(helper.codex_builtin_imagegen_helper_allowed === true, 'Codex built-in imagegen helper must be allowed', helper);
+assertGate(helper.codex_app_builtin_evidence_class === 'codex_app_builtin', 'Codex App builtin evidence class must be explicit', helper);
+assertGate(helper.api_fallback_evidence_class === 'api_fallback', 'API fallback evidence class must be explicit', helper);
+assertGate(helper.provider_surface_evidence_required === true, 'provider surface evidence must be required', helper);
+assertGate(helper.imagegen_api_fallback_counts_as_codex_app_evidence === false, 'API fallback must not count as Codex App evidence', helper);
+assertGate(Array.isArray(helper.required_output_proof_for_generated_images) && helper.required_output_proof_for_generated_images.includes('sha256'), 'image output proof must require hashes', helper);
+assertGate(noSubagent.ok === true, 'no-subagent scaling policy must still pass with helper lane', noSubagent);
+assertGate(noSubagent.official_codex_subagent_helper_lane_allowed === true, 'no-subagent policy must allow official helper lane', noSubagent);
+assertGate(noSubagent.official_helper_lane_worker_capacity_credit === 0, 'no-subagent policy must keep helper worker capacity credit at zero', noSubagent);
+assertGate(noSubagent.official_helper_lane_observed_subagent_event_count === 2, 'no-subagent policy must expose observed helper events separately', noSubagent);
+assertGate(noSubagent.official_helper_lane_events_counted_as_worker_sessions === false, 'no-subagent policy must keep helper events out of worker sessions', noSubagent);
+assertGate(noSubagent.subagent_events_counted_as_worker_sessions === false, 'no-subagent policy must keep subagent events out of worker counts', noSubagent);
+assertGate(noSubagent.native_worker_process_count === 3, 'native worker count must come from native proof only', noSubagent);
+const report = {
+    schema: 'sks.agent-official-subagent-helper-policy-check.v1',
+    ok: true,
+    helper,
+    no_subagent_scaling_policy: noSubagent,
+    live_codex_app_output_proof_required_for_generated_images: true,
+    live_codex_app_output_proof_ran: false,
+    live_codex_app_output_proof_note: 'Deterministic release gate validates policy wiring only; generated image claims still require live Codex App output proof when enabled.'
+};
+await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+await fs.writeFile(path.join(root, '.sneakoscope', 'reports', 'agent-official-subagent-helper-policy.json'), `${JSON.stringify(report, null, 2)}\n`);
+emitGate('agent:official-subagent-helper-policy', {
+    helper_lane_enabled: helper.official_codex_subagent_helper_lane_enabled,
+    worker_capacity_credit: helper.worker_capacity_credit,
+    subagent_events_counted_as_worker_sessions: helper.subagent_events_counted_as_worker_sessions,
+    native_worker_process_count: noSubagent.native_worker_process_count,
+    observed_subagent_event_count: helper.observed_subagent_event_count
+});
+//# sourceMappingURL=agent-official-subagent-helper-policy-check.js.map

package/dist/scripts/agent-parallel-write-blackbox.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const schemaMod = await importDist('core/agents/agent-patch-schema.js');
+const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-agent-blackbox-'));
+fs.writeFileSync(path.join(tmp, 'fixture.txt'), 'before\n');
+const envelope = schemaMod.normalizeAgentPatchEnvelope({
+    agent_id: 'blackbox-agent',
+    session_id: 'blackbox-session',
+    slot_id: 'blackbox-slot',
+    generation_index: 1,
+    lease_id: 'lease:blackbox-agent:fixture.txt',
+    operations: [{ op: 'replace', path: 'fixture.txt', search: 'before', replace: 'after' }]
+});
+const dry = await applyMod.applyAgentPatchEnvelope(tmp, envelope, { dryRun: true });
+const applied = await applyMod.applyAgentPatchEnvelope(tmp, envelope);
+const agentRun = spawnSync(process.execPath, [
+    'dist/bin/sks.js',
+    'agent',
+    'run',
+    'agent parallel write blackbox route fixture',
+    '--mock',
+    '--write-mode',
+    'parallel',
+    '--apply-patches',
+    '--dry-run-patches',
+    '--max-write-agents',
+    '1',
+    '--json'
+], { cwd: root, encoding: 'utf8', maxBuffer: 2 * 1024 * 1024 });
+const agentJson = parseJson(agentRun.stdout);
+const routePolicy = agentJson?.parallel_write_policy || null;
+const report = { schema: 'sks.agent-parallel-write-blackbox.v1', ok: dry.ok && applied.ok && agentRun.status === 0 && routePolicy?.route_level_flags_wired === true, dry, applied, route_command: { status: agentRun.status, mission_id: agentJson?.mission_id || null, route_policy: routePolicy, stderr_tail: agentRun.stderr.slice(-2000) } };
+const out = path.join(root, '.sneakoscope', 'reports', 'agent-parallel-write-blackbox.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(dry.status === 'dry_run', 'agent parallel write blackbox dry-run status mismatch', report);
+assertGate(applied.ok === true, 'agent parallel write blackbox apply failed', report);
+assertGate(fs.readFileSync(path.join(tmp, 'fixture.txt'), 'utf8') === 'after\n', 'agent parallel write blackbox content mismatch', report);
+assertGate(routePolicy?.write_mode === 'parallel', 'Agent route must carry --write-mode parallel into native agent policy', report);
+assertGate(routePolicy?.apply_patches === true, 'Agent route must carry --apply-patches into native agent policy', report);
+emitGate('agent:parallel-write-blackbox', { changed_files: applied.changed_files.length });
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=agent-parallel-write-blackbox.js.map

package/dist/scripts/agent-parallel-write-kernel-check.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const queueMod = await importDist('core/agents/agent-patch-queue.js');
+const applyMod = await importDist('core/agents/agent-patch-apply-worker.js');
+const mergeMod = await importDist('core/agents/agent-merge-coordinator.js');
+const proofMod = await importDist('core/agents/agent-patch-proof.js');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-agent-patch-'));
+fs.writeFileSync(path.join(tmp, 'a.txt'), 'alpha\n');
+fs.writeFileSync(path.join(tmp, 'b.txt'), 'bravo\n');
+const queue = new queueMod.InMemoryAgentPatchQueue();
+const envelope = (agent, file, operation) => ({
+    schema: 'sks.agent-patch-envelope.v1',
+    agent_id: agent,
+    session_id: `${agent}-session`,
+    slot_id: `${agent}-slot`,
+    generation_index: 1,
+    lease_id: `lease:${agent}:${file}`,
+    task_slice_id: `task:${agent}:${file}`,
+    verification_hint: { node_id: `verify:${agent}` },
+    rollback_hint: { node_id: `rollback:${agent}` },
+    lease_proof: {
+        lease_id: `lease:${agent}:${file}`,
+        owner_agent: agent,
+        strategy_task_id: `strategy:${agent}`,
+        micro_win_id: `micro:${agent}:${file}`,
+        verification_node_id: `verify:${agent}`,
+        rollback_node_id: `rollback:${agent}`,
+        allowed_paths: [file],
+        protected_path_check: 'passed'
+    },
+    operations: [operation]
+});
+const first = queue.enqueue(envelope('agent-a', 'a.txt', { op: 'replace', path: 'a.txt', search: 'alpha', replace: 'alpha-1' }));
+const second = queue.enqueue(envelope('agent-b', 'b.txt', { op: 'replace', path: 'b.txt', search: 'bravo', replace: 'bravo-1' }));
+const merge = mergeMod.coordinateAgentPatchMerge(queue.queued());
+const applyResults = [];
+for (const entry of queue.queued()) {
+    const applyResult = await applyMod.applyAgentPatchEnvelope(tmp, entry.envelope);
+    applyResults.push({ ...applyResult, entry_id: entry.id });
+    if (applyResult.ok)
+        queue.markApplied(entry.id);
+}
+const proof = proofMod.buildAgentPatchProof({
+    queue: queue.toJSON(),
+    merge,
+    applyResults,
+    verification: ['fixture-files-mutated'],
+    transactionJournal: {
+        schema: 'sks.agent-patch-transaction-journal-summary.v1',
+        ok: true,
+        event_count: 8,
+        blockers: []
+    },
+    verificationRollbackDag: {
+        nodes: [
+            { id: 'verify:agent-a', kind: 'verification' },
+            { id: 'rollback:agent-a', kind: 'rollback' },
+            { id: 'verify:agent-b', kind: 'verification' },
+            { id: 'rollback:agent-b', kind: 'rollback' }
+        ]
+    }
+});
+const atomicProbeFile = path.join(tmp, 'atomic.txt');
+fs.writeFileSync(atomicProbeFile, 'before\n');
+const atomicBlocked = await applyMod.applyAgentPatchEnvelope(tmp, {
+    schema: 'sks.agent-patch-envelope.v1',
+    agent_id: 'atomic-probe',
+    session_id: 'atomic-session',
+    slot_id: 'atomic-slot',
+    generation_index: 1,
+    lease_id: 'lease:atomic-probe:atomic.txt',
+    rollback_hint: { node_id: 'rollback:atomic' },
+    operations: [
+        { op: 'replace', path: 'atomic.txt', search: 'before', replace: 'after' },
+        { op: 'write', path: '.codex/blocked.txt', content: 'blocked' }
+    ]
+});
+const normalizedConflict = mergeMod.coordinateAgentPatchMerge([
+    envelope('agent-a', 'same.txt', { op: 'write', path: 'same.txt', content: 'a' }),
+    envelope('agent-b', 'same.txt', { op: 'write', path: './same.txt', content: 'b' })
+]);
+const parentChildConflict = mergeMod.coordinateAgentPatchMerge([
+    envelope('agent-a', 'dir', { op: 'write', path: 'dir', content: 'a' }),
+    envelope('agent-b', 'dir/file.txt', { op: 'write', path: 'dir/file.txt', content: 'b' })
+]);
+const report = { schema: 'sks.agent-parallel-write-kernel-check.v1', ok: proof.ok, first, second, merge, applyResults, proof, atomicBlocked, normalizedConflict, parentChildConflict };
+const out = path.join(root, '.sneakoscope', 'reports', 'agent-parallel-write-kernel.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(merge.ok === true, 'parallel write merge should not report conflicts for disjoint files', report);
+assertGate(applyResults.every((result) => result.ok), 'parallel write apply results must all pass', report);
+assertGate(proof.ok === true, 'parallel write proof must pass', report);
+assertGate(fs.readFileSync(path.join(tmp, 'a.txt'), 'utf8').includes('alpha-1'), 'first patch did not apply', report);
+assertGate(fs.readFileSync(path.join(tmp, 'b.txt'), 'utf8').includes('bravo-1'), 'second patch did not apply', report);
+assertGate(atomicBlocked.ok === false && fs.readFileSync(atomicProbeFile, 'utf8') === 'before\n', 'blocked patch must not partially mutate files', report);
+assertGate(normalizedConflict.ok === false, 'merge coordinator must catch normalized path collisions', report);
+assertGate(parentChildConflict.ok === false, 'merge coordinator must catch parent/child path overlaps', report);
+emitGate('agent:parallel-write-kernel', { changed_files: proof.changed_files.length });
+//# sourceMappingURL=agent-parallel-write-kernel-check.js.map

package/dist/scripts/agent-patch-conflict-rebase-check.js

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { writeReport } from './agent-patch-swarm-gate-lib.js';
+const queueMod = await importDist('core/agents/agent-patch-queue-store.js');
+const mergeMod = await importDist('core/agents/agent-merge-coordinator.js');
+const rebaseMod = await importDist('core/agents/agent-patch-conflict-rebase.js');
+const proofMod = await importDist('core/agents/agent-patch-proof.js');
+const journalMod = await importDist('core/agents/agent-patch-transaction-journal.js');
+const sameFileSuccess = await runFixture('same-file-success', {
+    files: { 'same.txt': 'base\n' },
+    envelopes: [
+        makeEnvelope('agent-a', [replaceOp('same.txt', 'base', 'agent-a')]),
+        makeEnvelope('agent-b', [replaceOp('same.txt', 'agent-a', 'agent-b')])
+    ]
+});
+const proof = await buildProofForSuccessfulRebase(sameFileSuccess);
+const unreconcilable = await runFixture('same-file-unreconcilable', {
+    files: { 'miss.txt': 'base\n' },
+    envelopes: [
+        makeEnvelope('agent-c', [replaceOp('miss.txt', 'base', 'agent-c')]),
+        makeEnvelope('agent-d', [replaceOp('miss.txt', 'never-present', 'agent-d')])
+    ]
+});
+const subtree = await runFixture('subtree-conflict', {
+    envelopes: [
+        makeEnvelope('agent-e', [writeOp('tree/child.txt', 'child\n')]),
+        makeEnvelope('agent-f', [writeOp('tree', 'parent-as-file\n')])
+    ]
+});
+const domainBlocked = await runFixture('domain-conflict-blocked', {
+    envelopes: [
+        makeEnvelope('agent-g', [writeOp('domain-a.txt', 'a\n')], { conflict_prediction_id: 'shared-domain' }),
+        makeEnvelope('agent-h', [writeOp('domain-b.txt', 'b\n')], { conflict_prediction_id: 'shared-domain' })
+    ]
+});
+const domainRetry = await runFixture('domain-conflict-retry', {
+    envelopes: [
+        makeEnvelope('agent-i', [writeOp('domain-c.txt', 'c\n')], { conflict_prediction_id: 'retry-domain' }),
+        makeEnvelope('agent-j', [writeOp('domain-d.txt', 'd\n')], { conflict_prediction_id: 'retry-domain' })
+    ],
+    rebaseOptions: { allowDomainRetry: true }
+});
+const protectedPath = await runFixture('protected-path-conflict', {
+    envelopes: [
+        makeEnvelope('agent-k', [writeOp('.codex/protected.txt', 'blocked\n')], { allowed_paths: ['.codex/protected.txt'] })
+    ]
+});
+const unleased = await runFixture('unleased-path-conflict', {
+    envelopes: [
+        makeEnvelope('agent-l', [writeOp('outside.txt', 'blocked\n')], { allowed_paths: ['allowed.txt'] })
+    ]
+});
+const dirty = await runFixture('dirty-unrelated-change', {
+    files: { 'dirty.txt': 'changed by somebody else\n' },
+    envelopes: [makeEnvelope('agent-m', [writeOp('dirty.txt', 'agent write\n')])],
+    mergeFactory: (entries) => manualMerge(entries, 'dirty_unrelated_change:dirty.txt', 'dirty.txt')
+});
+const stale = await runFixture('stale-context-rebase', {
+    files: { 'stale.txt': 'current\n' },
+    envelopes: [makeEnvelope('agent-n', [replaceOp('stale.txt', 'current', 'rebased')])],
+    mergeFactory: (entries) => manualMerge(entries, 'stale_context:stale.txt', 'stale.txt')
+});
+const checks = {
+    same_file_group_created: sameFileSuccess.merge.serial_merge_groups.length === 1,
+    same_file_rebase_succeeds: sameFileSuccess.rebase.ok === true && sameFileSuccess.rebase.rebase_attempt_count === 2 && sameFileSuccess.rebase.succeeded_entry_ids.length === 2,
+    same_file_rollback_dry_run_recorded: sameFileSuccess.rebase.apply_results.every((row) => row.rollback_dry_run?.ok === true),
+    proof_accepts_successful_rebase: proof.conflict_rebase_ok === true && proof.ok === true,
+    unreconcilable_blocks: unreconcilable.rebase.ok === false && textOf(unreconcilable.rebase).includes('search_not_found'),
+    subtree_blocks_without_throwing: subtree.rebase.ok === false && textOf(subtree.rebase).includes('serial_rebase_exception'),
+    domain_blocks_by_default: domainBlocked.rebase.ok === false && domainBlocked.rebase.blocked_entry_ids.length === 2,
+    domain_retry_can_succeed_when_allowed: domainRetry.rebase.ok === true && domainRetry.rebase.succeeded_entry_ids.length === 2,
+    protected_path_blocks: protectedPath.rebase.ok === false && textOf(protectedPath.rebase).includes('protected_path'),
+    unleased_path_blocks: unleased.rebase.ok === false && textOf(unleased.rebase).includes('lease_path_not_allowed'),
+    dirty_unrelated_change_blocks: dirty.rebase.ok === false && textOf(dirty.rebase).includes('dirty_unrelated_change'),
+    stale_context_rebases: stale.rebase.ok === true && stale.rebase.succeeded_entry_ids.length === 1,
+    fixtures_produce_conflict_graphs: [sameFileSuccess, unreconcilable, subtree, domainBlocked, domainRetry, protectedPath, unleased].every((fixture) => fixture.merge.conflict_graph?.edges?.length >= 1),
+    fixtures_produce_serial_groups: [sameFileSuccess, unreconcilable, subtree, domainBlocked, domainRetry, protectedPath, unleased, dirty, stale].every((fixture) => fixture.merge.serial_merge_groups?.length >= 1),
+    fixtures_produce_rebase_artifacts: [sameFileSuccess, unreconcilable, subtree, domainBlocked, domainRetry, protectedPath, unleased, dirty, stale].every((fixture) => fs.existsSync(path.join(fixture.dir, 'agent-patch-conflict-rebase-results.json')))
+};
+const report = {
+    schema: 'sks.agent-patch-conflict-rebase-check.v1',
+    ok: Object.values(checks).every(Boolean),
+    checks,
+    proof,
+    fixtures: {
+        sameFileSuccess,
+        unreconcilable,
+        subtree,
+        domainBlocked,
+        domainRetry,
+        protectedPath,
+        unleased,
+        dirty,
+        stale
+    }
+};
+writeReport('agent-patch-conflict-rebase', report);
+for (const [name, ok] of Object.entries(checks)) {
+    assertGate(ok === true, `conflict rebase fixture failed: ${name}`, report);
+}
+emitGate('agent:patch-conflict-rebase', { rebase_attempt_count: sameFileSuccess.rebase.rebase_attempt_count, fixture_count: Object.keys(report.fixtures).length });
+async function buildProofForSuccessfulRebase(fixture) {
+    const journal = new journalMod.AgentPatchTransactionJournal(fixture.dir);
+    for (const id of fixture.rebase.succeeded_entry_ids) {
+        const applyResult = fixture.rebase.apply_results.find((row) => row.entry_id === id);
+        await fixture.store.markApplying(id);
+        await fixture.store.markApplied(id);
+        await journal.append({ event_type: 'verification_started', entry_id: id, agent_id: applyResult?.agent_id || null, lease_id: applyResult?.lease_id || null, status: 'started', changed_files: applyResult?.changed_files || [], rollback_digest: applyResult?.rollback_digest || null });
+        await journal.append({ event_type: 'verification_finished', entry_id: id, agent_id: applyResult?.agent_id || null, lease_id: applyResult?.lease_id || null, status: 'verified', verification_status: applyResult?.verification?.status || 'verified', changed_files: applyResult?.changed_files || [], rollback_digest: applyResult?.rollback_digest || null });
+        await fixture.store.markVerified(id);
+    }
+    const journalSummary = await journal.writeSummary();
+    return proofMod.buildAgentPatchProof({
+        queue: fixture.store.queue.toJSON(),
+        merge: { ...fixture.merge, ok: true, blockers: [], unresolved_conflict_entry_ids: [] },
+        applyResults: fixture.rebase.apply_results,
+        verification: ['verified'],
+        parallelWritePolicy: { write_mode: 'serial' },
+        transactionJournal: journalSummary,
+        conflictRebase: fixture.rebase
+    });
+}
+async function runFixture(name, input) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `sks-conflict-rebase-${name}-`));
+    writeFiles(dir, input.files || {});
+    const store = new queueMod.PersistentAgentPatchQueueStore(dir);
+    const entries = [];
+    for (const envelope of input.envelopes)
+        entries.push(await store.enqueue(envelope, { mission_id: `M-${name}`, route: '$Agent' }));
+    const merge = input.mergeFactory ? input.mergeFactory(entries) : mergeMod.coordinateAgentPatchMerge(entries);
+    const rebase = await rebaseMod.executeAgentPatchConflictRebase(dir, entries, merge, { artifactsDir: dir, ...(input.rebaseOptions || {}) });
+    return { name, dir, store, merge, rebase };
+}
+function makeEnvelope(agent, operations, extraLease = {}) {
+    const allowedPaths = extraLease.allowed_paths || operations.map((operation) => operation.path);
+    return {
+        schema: 'sks.agent-patch-envelope.v1',
+        agent_id: agent,
+        session_id: `session-${agent}`,
+        slot_id: `slot-${agent}`,
+        generation_index: 1,
+        lease_id: `lease-${agent}`,
+        lease_proof: {
+            lease_id: `lease-${agent}`,
+            owner_agent: agent,
+            owner_persona: 'fixture',
+            allowed_paths: allowedPaths,
+            strategy_task_id: `task-${agent}`,
+            micro_win_id: `win-${agent}`,
+            verification_node_id: `verify-${agent}`,
+            rollback_node_id: `rollback-${agent}`,
+            protected_path_check: 'passed',
+            ...extraLease
+        },
+        verification_hint: { node_id: `verify-${agent}` },
+        rollback_hint: { node_id: `rollback-${agent}` },
+        operations
+    };
+}
+function writeOp(file, content) {
+    return { op: 'write', path: file, content };
+}
+function replaceOp(file, search, replace) {
+    return { op: 'replace', path: file, search, replace };
+}
+function manualMerge(entries, reason, file) {
+    return {
+        schema: 'sks.agent-merge-coordinator.v1',
+        ok: false,
+        merge_order: entries.map((entry) => entry.agent_id),
+        apply_order: ['serial-001'],
+        touched_files: [file],
+        conflicts: [{ type: 'manual-fixture', file, entries: entries.map((entry) => entry.id), agents: entries.map((entry) => entry.agent_id), reason }],
+        conflict_graph: {
+            nodes: entries.map((entry) => ({ entry_id: entry.id, agent_id: entry.agent_id, lease_id: entry.lease_id })),
+            edges: [{ file, entries: entries.map((entry) => entry.id), reason }]
+        },
+        parallel_apply_groups: [],
+        serial_merge_groups: [{ group_id: 'serial-001', entry_ids: entries.map((entry) => entry.id), agents: entries.map((entry) => entry.agent_id), reason, file }],
+        blocked_conflicts: [{ type: 'manual-fixture', file, entries: entries.map((entry) => entry.id), agents: entries.map((entry) => entry.agent_id), reason }],
+        blockers: [reason]
+    };
+}
+function writeFiles(root, files) {
+    for (const [rel, content] of Object.entries(files)) {
+        const file = path.join(root, rel);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, content);
+    }
+}
+function textOf(value) {
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=agent-patch-conflict-rebase-check.js.map

package/dist/scripts/agent-patch-envelope-extraction-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { writeReport } from './agent-patch-swarm-gate-lib.js';
+const fake = await importDist('core/agents/agent-runner-fake.js');
+const schema = await importDist('core/agents/agent-patch-schema.js');
+const result = await fake.runFakeAgent({ id: 'agent-a', session_id: 'session-a', slot_id: 'slot-a', generation_index: 1, persona_id: 'implementer' }, { id: 'slice-a', write_paths: ['fixture-a.txt'], micro_win_id: 'micro-win-a' }, { missionId: 'mission-a', route: '$Agent' });
+const envelope = result.patch_envelopes?.[0];
+const validation = envelope ? schema.validateAgentPatchEnvelope(envelope) : { ok: false, violations: ['missing_envelope'] };
+const report = { schema: 'sks.agent-patch-envelope-extraction-check.v1', ok: validation.ok, result, envelope, validation };
+writeReport('agent-patch-envelope-extraction', report);
+assertGate(Array.isArray(result.patch_envelopes) && result.patch_envelopes.length === 1, 'fake agent must emit one patch envelope for a write slice', report);
+assertGate(validation.ok === true, 'emitted patch envelope must validate', report);
+assertGate(envelope.session_id && envelope.slot_id && Number.isFinite(envelope.generation_index), 'patch envelope must include session/slot/generation metadata', report);
+assertGate(envelope.lease_id || envelope.lease_proof?.lease_id, 'patch envelope must include a lease id', report);
+emitGate('agent:patch-envelope-extraction', { envelope_count: result.patch_envelopes.length });
+//# sourceMappingURL=agent-patch-envelope-extraction-check.js.map

package/dist/scripts/agent-patch-proof-check.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+const proofMod = await importDist('core/agents/agent-patch-proof.js');
+const proof = proofMod.buildAgentPatchProof({
+    queue: {
+        queued_count: 0,
+        entries: [
+            { id: 'entry-a', status: 'applied', violations: [] },
+            { id: 'entry-b', status: 'applied', violations: [] }
+        ],
+        events: [
+            { entry_id: 'entry-a', event_type: 'applied' },
+            { entry_id: 'entry-b', event_type: 'applied' }
+        ]
+    },
+    merge: { ok: true, blockers: [] },
+    applyResults: [
+        { ok: true, changed_files: ['a.txt'], rollback_digest: 'digest-a', verification: { status: 'unit-fixture' } },
+        { ok: true, changed_files: ['b.txt'], rollback_digest: 'digest-b', verification: { status: 'unit-fixture' } }
+    ],
+    verification: ['unit-fixture'],
+    transactionJournal: { ok: true, blockers: [], event_count: 10 },
+    conflictRebase: { ok: true, blockers: [] }
+});
+const pendingProof = proofMod.buildAgentPatchProof({
+    queue: { queued_count: 1, entries: [{ id: 'entry-pending', status: 'pending', violations: [] }] },
+    merge: { ok: true, blockers: [] },
+    applyResults: []
+});
+const report = { schema: 'sks.agent-patch-proof-check.v1', ok: proof.ok, proof };
+const out = path.join(root, '.sneakoscope', 'reports', 'agent-patch-proof.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(proof.ok === true, 'agent patch proof should pass clean apply results', report);
+assertGate(proof.rollback_digests.length === 2, 'agent patch proof must preserve rollback digests', report);
+assertGate(pendingProof.ok === false, 'agent patch proof must block pending queue entries', { pendingProof });
+emitGate('agent:patch-proof', { rollback_digests: proof.rollback_digests.length });
+//# sourceMappingURL=agent-patch-proof-check.js.map