sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/agent-real-codex-in-zellij-worker-pane-check.js

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
+const freshness = ensureDistFresh({ rebuild: true });
+if (!freshness.ok)
+    fail('dist_not_fresh', { freshness });
+const args = process.argv.slice(2);
+const manager = await import(pathToFileURL(path.join(root, 'dist', 'core', 'zellij', 'zellij-worker-pane-manager.js')).href);
+const slotPaneProof = await import(pathToFileURL(path.join(root, 'dist', 'core', 'agents', 'agent-slot-pane-binding-proof.js')).href);
+const swarmSource = await fs.readFile(path.join(root, 'src', 'core', 'agents', 'native-cli-session-swarm.ts'), 'utf8');
+const routerSource = await fs.readFile(path.join(root, 'src', 'core', 'agents', 'native-worker-backend-router.ts'), 'utf8');
+const controlSource = await fs.readFile(path.join(root, 'src', 'core', 'codex-control', 'codex-task-runner.ts'), 'utf8');
+const sourceOk = swarmSource.includes('native_cli_process_in_zellij_worker_pane')
+    && swarmSource.includes('openWorkerPane')
+    && swarmSource.includes('worker-process-report.json')
+    && swarmSource.includes('codex_sdk_thread_started')
+    && routerSource.includes("backend === 'codex-sdk' || backend === 'zellij'")
+    && routerSource.includes('runCodexTask')
+    && controlSource.includes('codex-sdk-events.jsonl')
+    && routerSource.includes('codex-thread-registry.json');
+const eventProof = manager.evaluateZellijWorkerPaneSpawnOrder([
+    { event_type: 'session_launch_started' },
+    { event_type: 'zellij_worker_pane_created' },
+    { event_type: 'worker_started' },
+    { event_type: 'codex_sdk_thread_started' },
+    { event_type: 'result_written' },
+    { event_type: 'pane_closed' }
+]);
+const requireReal = process.env.SKS_REQUIRE_REAL_CODEX_ZELLIJ === '1'
+    || (process.env.SKS_REQUIRE_ZELLIJ === '1' && process.env.SKS_REQUIRE_CODEX_SDK === '1')
+    || args.includes('--require-real');
+if (!requireReal) {
+    const ok = sourceOk && eventProof.ok;
+    await emit({
+        schema: 'sks.agent-real-codex-in-zellij-worker-pane-check.v1',
+        ok,
+        source_ok: sourceOk,
+        event_proof: eventProof,
+        integration_optional: true,
+        real_execution: null,
+        blockers: ok ? [] : ['agent_real_codex_in_zellij_worker_pane_source_check_failed']
+    });
+}
+else {
+    await runRealGate({ sourceOk, eventProof });
+}
+async function runRealGate({ sourceOk, eventProof }) {
+    const stamp = new Date().toISOString().replace(/[^0-9]/g, '').slice(0, 14);
+    const missionId = `M-real-codex-zellij-${stamp}`;
+    const sessionName = `sks-${missionId}`;
+    const childEnv = { ...process.env };
+    delete childEnv.SKS_CODEX_SDK_FAKE;
+    delete childEnv.SKS_CODEX_SDK_FIXTURE;
+    if (childEnv.NODE_ENV === 'test')
+        delete childEnv.NODE_ENV;
+    Object.assign(childEnv, {
+        SKS_REQUIRE_ZELLIJ: '1',
+        SKS_REQUIRE_CODEX_SDK: '1',
+        SKS_CODEX_SDK_REQUIRE_REAL: '1',
+        SKS_ZELLIJ_CLOSE_WORKER_PANE: '1',
+        SKS_ZELLIJ_WORKER_HEARTBEAT_TIMEOUT_MS: childEnv.SKS_ZELLIJ_WORKER_HEARTBEAT_TIMEOUT_MS || '30000',
+        SKS_ZELLIJ_WORKER_RESULT_TIMEOUT_MS: childEnv.SKS_ZELLIJ_WORKER_RESULT_TIMEOUT_MS || '180000',
+        SKS_REAL_SMOKE_TIMEOUT_MS: childEnv.SKS_REAL_SMOKE_TIMEOUT_MS || '300000'
+    });
+    const command = [
+        'dist/bin/sks.js',
+        'agent',
+        'run',
+        'real codex zellij worker pane read-only smoke: inspect package metadata and report no file changes',
+        '--route', '$Agent',
+        '--backend', 'zellij',
+        '--real',
+        '--readonly',
+        '--json',
+        '--agents', '1',
+        '--target-active-slots', '1',
+        '--minimum-work-items', '1',
+        '--work-items', '1',
+        '--concurrency', '1',
+        '--mission', missionId
+    ];
+    const run = spawnSync(process.execPath, command, {
+        cwd: root,
+        env: childEnv,
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024,
+        timeout: Number(childEnv.SKS_REAL_SMOKE_TIMEOUT_MS || 300000)
+    });
+    spawnSync('zellij', ['kill-session', sessionName], { cwd: root, encoding: 'utf8', timeout: 5000 });
+    const parsed = parseJson(run.stdout);
+    const ledgerRoot = parsed?.ledger_root ? path.join(root, parsed.ledger_root) : null;
+    const runtimeProof = ledgerRoot ? await inspectRealLedger(ledgerRoot) : null;
+    const blockers = [
+        ...(sourceOk ? [] : ['agent_real_codex_in_zellij_worker_pane_source_check_failed']),
+        ...(eventProof.ok ? [] : ['agent_real_codex_in_zellij_worker_pane_static_event_order_failed']),
+        ...(run.status === 0 ? [] : [`real_codex_zellij_worker_pane_command_exit_${run.status}`]),
+        ...(parsed ? [] : ['real_codex_zellij_worker_pane_json_missing']),
+        ...(runtimeProof?.blockers || [])
+    ];
+    const report = {
+        schema: 'sks.agent-real-codex-in-zellij-worker-pane-check.v1',
+        ok: blockers.length === 0,
+        integration_optional: false,
+        mission_id: parsed?.mission_id || missionId,
+        session_name: sessionName,
+        source_ok: sourceOk,
+        event_proof: eventProof,
+        command: [process.execPath, ...command],
+        exit_code: run.status,
+        signal: run.signal,
+        timed_out: run.error?.code === 'ETIMEDOUT',
+        stdout_tail: tail(run.stdout),
+        stderr_tail: tail(run.stderr),
+        real_execution: runtimeProof,
+        blockers
+    };
+    await emit(report);
+}
+async function inspectRealLedger(ledgerRoot) {
+    const swarm = await readJson(path.join(ledgerRoot, 'agent-native-cli-session-swarm.json'), null);
+    const records = Array.isArray(swarm?.records) ? swarm.records : [];
+    const workerRecords = records.filter(isZellijCodexWorkerRecord);
+    const eventsByWorker = [];
+    for (const record of workerRecords) {
+        const workerDir = String(record.worker_artifact_dir || '');
+        const events = await readJsonl(path.join(ledgerRoot, workerDir, 'zellij-worker-pane-events.jsonl'));
+        eventsByWorker.push({ worker_dir: workerDir, event_proof: manager.evaluateZellijWorkerPaneSpawnOrder(events), events });
+    }
+    const bindingProof = await slotPaneProof.writeAgentSlotPaneBindingProof(ledgerRoot, {
+        requireZellij: true,
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-real-codex-in-zellij-worker-pane-binding-proof.json')
+    });
+    const blockers = [
+        ...(swarm?.ok === true ? [] : ['real_codex_zellij_swarm_not_ok']),
+        ...(workerRecords.length >= 1 ? [] : ['real_codex_zellij_worker_record_missing']),
+        ...(workerRecords.some((row) => row.pane_kind === 'worker_codex_sdk') ? [] : ['real_codex_zellij_worker_pane_kind_missing']),
+        ...(workerRecords.every((row) => manager.isRealZellijWorkerPaneIdSource(row.zellij_pane_id_source)) ? [] : ['real_codex_zellij_pane_id_source_not_real']),
+        ...(workerRecords.every((row) => row.zellij_pane_id) ? [] : ['real_codex_zellij_pane_id_missing']),
+        ...(workerRecords.every((row) => row.sdk_thread_id) ? [] : ['real_codex_zellij_sdk_thread_missing']),
+        ...(workerRecords.every((row) => Number(row.stream_event_count || 0) > 0) ? [] : ['real_codex_zellij_sdk_stream_events_missing']),
+        ...(workerRecords.every((row) => row.structured_output_valid === true) ? [] : ['real_codex_zellij_structured_output_missing']),
+        ...(eventsByWorker.every((row) => row.event_proof.ok === true) ? [] : ['real_codex_zellij_event_order_failed']),
+        ...(bindingProof.ok === true ? [] : ['real_codex_zellij_slot_pane_binding_failed', ...(bindingProof.blockers || [])])
+    ];
+    return {
+        ledger_root: ledgerRoot,
+        swarm_ok: swarm?.ok === true,
+        zellij_pane_worker_sessions: Number(swarm?.zellij_pane_worker_sessions || 0),
+        closed_worker_process_count: Number(swarm?.closed_worker_process_count || 0),
+        worker_record_count: records.length,
+        zellij_worker_record_count: workerRecords.length,
+        worker_records: workerRecords.map((row) => ({
+            session_id: row.session_id,
+            slot_id: row.slot_id,
+            generation_index: row.generation_index,
+            pane_kind: row.pane_kind,
+            zellij_pane_id: row.zellij_pane_id,
+            zellij_pane_id_source: row.zellij_pane_id_source,
+            sdk_thread_id: row.sdk_thread_id,
+            stream_event_count: row.stream_event_count,
+            structured_output_valid: row.structured_output_valid,
+            status: row.status,
+            blockers: row.blockers || []
+        })),
+        event_proofs: eventsByWorker.map((row) => ({ worker_dir: row.worker_dir, event_proof: row.event_proof })),
+        binding_proof: bindingProof,
+        blockers
+    };
+}
+function isZellijCodexWorkerRecord(row) {
+    return row?.scaling_primitive === 'native_cli_process_in_zellij_worker_pane'
+        || row?.pane_kind === 'worker_codex_sdk';
+}
+async function emit(report) {
+    await fs.mkdir(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+    await fs.writeFile(path.join(root, '.sneakoscope', 'reports', 'agent-real-codex-in-zellij-worker-pane.json'), `${JSON.stringify(report, null, 2)}\n`);
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok)
+        process.exitCode = 1;
+}
+function fail(blocker, detail) { emit({ schema: 'sks.agent-real-codex-in-zellij-worker-pane-check.v1', ok: false, blockers: [blocker], detail }).then(() => process.exit(1)); }
+function parseJson(stdout) {
+    const text = String(stdout || '');
+    const start = text.indexOf('{');
+    const end = text.lastIndexOf('}');
+    if (start < 0 || end <= start)
+        return null;
+    try {
+        return JSON.parse(text.slice(start, end + 1));
+    }
+    catch {
+        return null;
+    }
+}
+async function readJson(file, fallback) {
+    try {
+        return JSON.parse(await fs.readFile(file, 'utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+async function readJsonl(file) {
+    try {
+        const text = await fs.readFile(file, 'utf8');
+        return text.split(/\r?\n/).filter(Boolean).map((line) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return { parse_error: true, raw: line };
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function tail(value, limit = 4000) {
+    const text = String(value || '');
+    return text.length > limit ? text.slice(-limit) : text;
+}
+//# sourceMappingURL=agent-real-codex-in-zellij-worker-pane-check.js.map

package/dist/scripts/agent-real-codex-parallel-workers-10-check.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runRealCodexParallelGate } from './lib/real-codex-parallel-gate.js';
+await runRealCodexParallelGate({ workers: 10, gate: 'agent:real-codex-parallel-workers-10' });
+//# sourceMappingURL=agent-real-codex-parallel-workers-10-check.js.map

package/dist/scripts/agent-real-codex-parallel-workers-20-check.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runRealCodexParallelGate } from './lib/real-codex-parallel-gate.js';
+await runRealCodexParallelGate({ workers: 20, gate: 'agent:real-codex-parallel-workers-20' });
+//# sourceMappingURL=agent-real-codex-parallel-workers-20-check.js.map

package/dist/scripts/agent-real-codex-parallel-workers-5-check.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runRealCodexParallelGate } from './lib/real-codex-parallel-gate.js';
+await runRealCodexParallelGate({ workers: 5, gate: 'agent:real-codex-parallel-workers-5' });
+//# sourceMappingURL=agent-real-codex-parallel-workers-5-check.js.map

package/dist/scripts/agent-real-codex-parallel-workers-check.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runRealCodexParallelGate } from './lib/real-codex-parallel-gate.js';
+await runRealCodexParallelGate({ workers: 5, gate: 'agent:real-codex-parallel-workers' });
+//# sourceMappingURL=agent-real-codex-parallel-workers-check.js.map

package/dist/scripts/agent-role-config-repair-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/agents/agent-role-config.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-repair-'));
+fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });
+const plan = await mod.repairAgentRoleConfigs({ root, apply: false, codexHome: path.join(root, 'codex-home') });
+const repair = await mod.repairAgentRoleConfigs({ root, apply: true, codexHome: path.join(root, 'codex-home'), reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json') });
+const analysisScout = path.join(root, '.codex', 'agents', 'analysis-scout.toml');
+const staleRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-role-stale-'));
+fs.mkdirSync(path.join(staleRoot, '.codex', 'agents'), { recursive: true });
+fs.writeFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'model = "gpt-5-codex"\nsandbox_mode = "read-only"\n');
+const stalePlan = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: false, codexHome: path.join(staleRoot, 'codex-home') });
+const staleRepair = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: true, codexHome: path.join(staleRoot, 'codex-home') });
+const repairedText = fs.readFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
+const report = {
+    schema: 'sks.agent-role-config-repair-check.v1',
+    plan_ok: plan.ok === true && plan.missing.includes('analysis-scout.toml'),
+    repair_ok: repair.ok === true,
+    analysis_scout_created: fs.existsSync(analysisScout),
+    created_matches_model: fs.readFileSync(analysisScout, 'utf8').includes('model = "gpt-5.5"'),
+    stale_detected: stalePlan.stale.includes('analysis-scout.toml'),
+    stale_repaired: staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && repairedText.includes('name = "analysis_scout"') && repairedText.includes('model = "gpt-5.5"'),
+    warnings_suppressed: repair.warnings_suppressed === true,
+    artifact_written: fs.existsSync(path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json'))
+};
+const ok = report.plan_ok && report.repair_ok && report.analysis_scout_created && report.created_matches_model && report.stale_detected && report.stale_repaired && report.warnings_suppressed && report.artifact_written;
+assertGate(ok, 'doctor --fix must repair missing SKS-owned agent role configs', report);
+emitGate('agent:role-config-repair', report);
+//# sourceMappingURL=agent-role-config-repair-check.js.map

package/dist/scripts/agent-rollback-command-check.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { writeReport } from './agent-patch-swarm-gate-lib.js';
+const project = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-rollback-command-'));
+const file = path.join(project, 'a.txt');
+fs.writeFileSync(file, 'after\n');
+const mission = 'M-rollback-command';
+const missionRoot = path.join(project, '.sneakoscope', 'missions', mission);
+const agentRoot = path.join(missionRoot, 'agents');
+fs.mkdirSync(agentRoot, { recursive: true });
+fs.writeFileSync(path.join(missionRoot, 'mission.json'), `${JSON.stringify({
+    id: mission,
+    mode: 'agent',
+    prompt: 'Rollback command fixture',
+    created_at: new Date().toISOString(),
+    phase: 'AGENT_PATCH_ROLLBACK_FIXTURE',
+    questions_allowed: false,
+    implementation_allowed: true
+}, null, 2)}\n`);
+fs.writeFileSync(path.join(missionRoot, 'events.jsonl'), `${JSON.stringify({ ts: new Date().toISOString(), type: 'mission.created', mission, mode: 'agent' })}\n`);
+fs.writeFileSync(path.join(agentRoot, 'agent-patch-apply-results.json'), `${JSON.stringify({
+    schema: 'sks.agent-patch-apply-results.v1',
+    results: [{
+            entry_id: 'entry-a',
+            agent_id: 'agent-a',
+            lease_id: 'lease-a',
+            ok: true,
+            changed_files: ['a.txt'],
+            rollback_digest: 'digest-a',
+            rollback: [{ path: 'a.txt', existed: true, sha256_after: sha256Text('after\n'), sha256_before: sha256Text('before\n'), content_before: 'before\n' }]
+        }]
+}, null, 2)}\n`);
+fs.writeFileSync(path.join(agentRoot, 'agent-patch-queue.json'), `${JSON.stringify({
+    schema: 'sks.agent-patch-queue.v1',
+    entries: [{ id: 'entry-a', agent_id: 'agent-a', write_paths: ['a.txt'], status: 'verified', violations: [] }],
+    events: [],
+    ownership_ledger: []
+}, null, 2)}\n`);
+const currentPath = path.join(project, '.sneakoscope', 'current.json');
+fs.mkdirSync(path.dirname(currentPath), { recursive: true });
+fs.writeFileSync(currentPath, `${JSON.stringify({ mission_id: mission }, null, 2)}\n`);
+const statePath = path.join(project, '.sneakoscope', 'state', 'current.json');
+fs.mkdirSync(path.dirname(statePath), { recursive: true });
+fs.writeFileSync(statePath, `${JSON.stringify({ mission_id: mission, mode: 'AGENT', phase: 'AGENT_PATCH_ROLLBACK_FIXTURE' }, null, 2)}\n`);
+const env = { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1' };
+const dry = spawnSync(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), 'agent', 'rollback-patches', 'latest', '--patch-entry-id', 'entry-a', '--dry-run', '--json'], { cwd: project, encoding: 'utf8', env });
+const apply = spawnSync(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), 'agent', 'rollback-patches', mission, '--patch-entry-id', 'entry-a', '--apply', '--json'], { cwd: project, encoding: 'utf8', env });
+const dryJson = parseProcessJson('dry-run', dry);
+const applyJson = parseProcessJson('apply', apply);
+const queue = JSON.parse(fs.readFileSync(path.join(agentRoot, 'agent-patch-queue.json'), 'utf8'));
+const report = { schema: 'sks.agent-rollback-command-check.v1', ok: dry.status === 0 && apply.status === 0 && applyJson.data?.ok === true, dryJson, applyJson, queue, restored: fs.readFileSync(file, 'utf8') };
+writeReport('agent-rollback-command', report);
+assertGate(dryJson.data?.dry_run === true, 'rollback command must support dry-run', report);
+assertGate(applyJson.data?.apply === true, 'rollback command must support apply', report);
+assertGate(applyJson.data?.restored_files?.includes('a.txt'), 'rollback command summary must show restored files', report);
+assertGate(queue.entries?.[0]?.status === 'rolled_back', 'rollback apply must update patch queue status', report);
+assertGate(report.restored === 'before\n', 'rollback apply must restore file content', report);
+emitGate('agent:rollback-command', { restored_files: applyJson.data.restored_files.length });
+function sha256Text(text) {
+    return crypto.createHash('sha256').update(text).digest('hex');
+}
+function parseProcessJson(label, result) {
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch (error) {
+        const report = {
+            schema: 'sks.agent-rollback-command-check.v1',
+            ok: false,
+            label,
+            status: result.status,
+            stdout: result.stdout,
+            stderr: result.stderr,
+            parse_error: error instanceof Error ? error.message : String(error)
+        };
+        writeReport('agent-rollback-command', report);
+        assertGate(false, `rollback command ${label} must emit JSON`, report);
+    }
+}
+//# sourceMappingURL=agent-rollback-command-check.js.map

package/dist/scripts/agent-route-truth-backfill-check.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { runActualAgentBackfillBlackbox } from './agent-route-blackbox-lib.js';
+runActualAgentBackfillBlackbox('agent:route-truth-backfill');
+//# sourceMappingURL=agent-route-truth-backfill-check.js.map

package/dist/scripts/agent-scheduler-proof-check.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { runDynamicPoolFixture } from './agent-dynamic-pool-fixture.js';
+const fixture = await runDynamicPoolFixture({ target: 5, total: 8 });
+const state = fixture.result.state;
+for (const key of ['target_active_slots', 'max_observed_active_slots', 'pending_queue_drained', 'backfill_count', 'expected_backfill_count', 'slot_count', 'generation_count']) {
+    assertGate(Object.prototype.hasOwnProperty.call(state, key) || key === 'slot_count' || key === 'generation_count', `scheduler state/proof missing ${key}`, state);
+}
+assertGate(state.pending_count === 0 && state.active_slot_count === 0, 'scheduler proof must finish with empty queue and zero active sessions', state);
+assertGate(state.backfill_count >= state.expected_backfill_count, 'scheduler proof must not underfill expected backfills', state);
+emitGate('agent:scheduler-proof', { pending_count: state.pending_count, active_slot_count: state.active_slot_count, backfill_count: state.backfill_count });
+//# sourceMappingURL=agent-scheduler-proof-check.js.map

package/dist/scripts/agent-scheduler-proof-hardening-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+import { runDynamicPoolFixture } from './agent-dynamic-pool-fixture.js';
+const proofSource = readText('src/core/agents/agent-proof-evidence.ts');
+for (const token of [
+    'agent_work_queue_missing',
+    'agent_scheduler_events_missing',
+    'agent_worker_slots_missing',
+    'agent_session_generations_missing',
+    'scheduler_active_slots_not_zero_at_finalization',
+    'scheduler_backfill_count_below_expected',
+    'scheduler_max_observed_active_slots_mismatch',
+    'terminal_close_report_count_below_generation_count'
+]) {
+    assertGate(proofSource.includes(token), `scheduler proof hardening missing ${token}`);
+}
+const fixture = await runDynamicPoolFixture({ target: 5, total: 8 });
+assertGate(fixture.result.state.pending_queue_drained === true, 'positive scheduler fixture must drain', fixture.result.state);
+assertGate(fixture.result.state.backfill_count >= fixture.result.state.expected_backfill_count, 'positive scheduler fixture must satisfy backfill invariant', fixture.result.state);
+emitGate('agent:scheduler-proof-hardening', { checked_blockers: 8, backfill_count: fixture.result.state.backfill_count });
+//# sourceMappingURL=agent-scheduler-proof-hardening-check.js.map

package/dist/scripts/agent-session-generation-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/agents/agent-session-generation.js');
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-session-generation-'));
+const refs = { artifact: 'source-intelligence-evidence.json', ok: true };
+const goal = { artifact: 'goal-mode-applied.json', ok: true };
+const gen1 = mod.createAgentSessionGeneration({ slotId: 'slot-001', generationIndex: 1, missionId: 'M-gen', rootHash: 'root', taskId: 'work-1', personaId: 'verifier', sourceIntelligenceRefs: refs, goalModeRef: goal });
+const gen2 = mod.createAgentSessionGeneration({ slotId: 'slot-001', generationIndex: 2, missionId: 'M-gen', rootHash: 'root', taskId: 'work-2', personaId: 'verifier', sourceIntelligenceRefs: refs, goalModeRef: goal });
+await mod.writeAgentSessionGeneration(root, gen1);
+await mod.closeAgentSessionGeneration(root, gen1.session_id, { status: 'closed' });
+await mod.writeAgentSessionGeneration(root, gen2);
+await mod.closeAgentSessionGeneration(root, gen2.session_id, { status: 'closed' });
+const closed = await mod.assertAgentSessionGenerationsClosed(root);
+assertGate(closed.ok === true, 'all generations must close and retain refs', closed);
+assertGate(closed.generation_count === 2, 'same slot must retain two immutable generations', closed);
+emitGate('agent:session-generation', { generation_count: closed.generation_count });
+//# sourceMappingURL=agent-session-generation-check.js.map

package/dist/scripts/agent-slot-pane-binding-proof-check.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
+const freshness = ensureDistFresh({ rebuild: true });
+if (!freshness.ok)
+    fail('dist_not_fresh', { freshness });
+const proof = await import(pathToFileURL(path.join(root, 'dist', 'core', 'agents', 'agent-slot-pane-binding-proof.js')).href);
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-slot-pane-binding-'));
+const records = [1, 2, 3].map((index) => ({
+    session_id: `slot-001-gen-${index}`,
+    slot_id: 'slot-001',
+    generation_index: index,
+    pane_kind: index === 1 ? 'slot_status_renderer' : 'worker_codex_sdk',
+    zellij_pane_id: String(100 + index),
+    zellij_pane_id_source: index % 2 ? 'zellij_worker_new_pane_stdout' : 'zellij_worker_list_panes',
+    scaling_primitive: index === 1 ? 'native_cli_process_with_zellij_slot_renderer' : 'native_cli_process_in_zellij_worker_pane',
+    sdk_thread_id: `sdk-thread-${index}`,
+    sdk_run_id: `sdk-run-${index}`,
+    stream_event_count: 4,
+    structured_output_valid: true,
+    status: 'closed'
+}));
+await fs.writeFile(path.join(tmp, 'agent-native-cli-session-swarm.json'), `${JSON.stringify({
+    schema: 'sks.agent-native-cli-session-swarm.v1',
+    ok: true,
+    closed_worker_process_count: records.length,
+    zellij_pane_worker_sessions: records.length,
+    max_observed_worker_process_count: 1,
+    target_active_slots: 1,
+    records
+}, null, 2)}\n`);
+await fs.writeFile(path.join(tmp, 'agent-zellij-pane-launch-ledger.jsonl'), records.map((record) => JSON.stringify({
+    schema: 'sks.agent-zellij-pane-launch.v1',
+    pane_kind: record.pane_kind,
+    persistent_slot_lane: false,
+    scaling_primitive: record.scaling_primitive,
+    slot_id: record.slot_id,
+    generation_index: record.generation_index,
+    pane_id: record.zellij_pane_id,
+    pane_id_source: record.zellij_pane_id_source,
+    sdk_thread_id: record.sdk_thread_id,
+    sdk_run_id: record.sdk_run_id,
+    stream_event_count: record.stream_event_count,
+    structured_output_valid: record.structured_output_valid
+})).join('\n') + '\n');
+const report = await proof.writeAgentSlotPaneBindingProof(tmp, { requireZellij: true, reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-slot-pane-binding-proof.json') });
+const badRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-slot-pane-binding-bad-'));
+await fs.writeFile(path.join(badRoot, 'agent-native-cli-session-swarm.json'), `${JSON.stringify({
+    closed_worker_process_count: 1,
+    zellij_pane_worker_sessions: 1,
+    records: [{ ...records[0], zellij_pane_id_source: 'synthetic_layout_pending_proof' }]
+})}\n`);
+await fs.writeFile(path.join(badRoot, 'agent-zellij-pane-launch-ledger.jsonl'), '');
+const bad = await proof.evaluateAgentSlotPaneBindingProof(badRoot, { requireZellij: true });
+const ok = report.ok && report.sdk_thread_count === records.length && bad.ok === false && bad.blockers.includes('slot_pane_binding_synthetic_or_missing_pane_id_source');
+emit({ schema: 'sks.agent-slot-pane-binding-proof-check.v1', ok, report, bad, blockers: ok ? [] : ['agent_slot_pane_binding_proof_check_failed'] });
+function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
+    process.exitCode = 1; }
+function fail(blocker, detail) { emit({ schema: 'sks.agent-slot-pane-binding-proof-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
+//# sourceMappingURL=agent-slot-pane-binding-proof-check.js.map

package/dist/scripts/agent-slot-telemetry-wiring-check.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const swarm = readText('src/core/agents/native-cli-session-swarm.ts');
+const worker = readText('src/core/agents/native-cli-worker.ts');
+for (const token of ['slot_reserved', 'worker_spawned', 'heartbeat', 'task_progress', 'artifact_written', 'worker_completed', 'worker_failed']) {
+    assertGate(swarm.includes(token) || worker.includes(token), `missing telemetry lifecycle event ${token}`);
+}
+assertGate(swarm.includes('appendZellijSlotTelemetry') && worker.includes('appendZellijSlotTelemetry'), 'swarm and worker must append slot telemetry');
+assertGate(worker.includes('startWorkerProgressTelemetry'), 'native worker must pump progress telemetry while backend work is active');
+emitGate('agent:slot-telemetry-wiring', { lifecycle_events: 7, progress_pump: true });
+//# sourceMappingURL=agent-slot-telemetry-wiring-check.js.map

package/dist/scripts/agent-source-intelligence-propagation-check.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { runDynamicPoolFixture } from './agent-dynamic-pool-fixture.js';
+const fixture = await runDynamicPoolFixture({ target: 5, total: 8 });
+const allResultsHaveRefs = fixture.result.results.every((result) => result.source_intelligence_refs?.artifact === 'source-intelligence-evidence.json');
+assertGate(allResultsHaveRefs, 'all dynamic generations must propagate source intelligence refs', fixture.result.results);
+emitGate('agent:source-intelligence-propagation', { result_count: fixture.result.results.length });
+//# sourceMappingURL=agent-source-intelligence-propagation-check.js.map

package/dist/scripts/agent-strategy-to-lease-wiring-check.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { makeTempPatchProject, writeReport } from './agent-patch-swarm-gate-lib.js';
+const strategy = await importDist('core/strategy/strategy-compiler.js');
+const rosterMod = await importDist('core/agents/agent-roster.js');
+const partitionMod = await importDist('core/agents/agent-work-partition.js');
+const tmp = makeTempPatchProject('sks-strategy-lease-');
+const files = Array.from({ length: 10 }, (_, index) => `file-${index + 1}.txt`);
+const prompt = files.map((file) => `\`${file}\``).join(' ');
+const compiled = strategy.compileStrategy({ prompt, route: '$Agent', agentCount: 5 });
+const roster = rosterMod.buildAgentRoster({ agents: 5, concurrency: 5, prompt });
+const partition = await partitionMod.buildAgentWorkPartition(tmp, roster, prompt, {
+    route: '$Agent',
+    targetActiveSlots: 5,
+    desiredWorkItemCount: 10,
+    minimumWorkItems: 10,
+    strategyOwnershipPlan: compiled.file_ownership_plan,
+    microWins: compiled.gate.micro_wins
+});
+const writeLeases = partition.leases.filter((lease) => lease.kind === 'write');
+const report = { schema: 'sks.agent-strategy-to-lease-wiring-check.v1', ok: partition.ok, tmp, compiled, writeLeases };
+writeReport('agent-strategy-to-lease-wiring', report);
+assertGate(compiled.file_ownership_plan.no_overlap === true, 'strategy file ownership plan must have no overlaps', report);
+assertGate(writeLeases.length >= 10, 'strategy write targets must become write leases', report);
+assertGate(writeLeases.every((lease) => lease.strategy_task_id && lease.micro_win_id && lease.owner_persona), 'leases must carry strategy task, micro-win, and persona metadata', report);
+assertGate(writeLeases.every((lease) => lease.verification_node_id && lease.rollback_node_id), 'leases must carry verification and rollback node ids', report);
+assertGate(fs.existsSync(path.join(tmp, 'file-1.txt')), 'fixture sanity check failed', report);
+emitGate('agent:strategy-to-lease-wiring', { write_lease_count: writeLeases.length });
+//# sourceMappingURL=agent-strategy-to-lease-wiring-check.js.map

package/dist/scripts/agent-strategy-to-patch-strict-check.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { writeReport } from './agent-patch-swarm-gate-lib.js';
+const proofMod = await importDist('core/agents/agent-patch-proof.js');
+const cleanProof = proofMod.buildAgentPatchProof({
+    queue: {
+        queued_count: 0,
+        entries: [{
+                id: 'entry-strict',
+                status: 'verified',
+                violations: [],
+                lease_id: 'lease-strict',
+                envelope: {
+                    task_slice_id: 'slice-strict',
+                    lease_id: 'lease-strict',
+                    lease_proof: {
+                        lease_id: 'lease-strict',
+                        owner_agent: 'agent-strict',
+                        strategy_task_id: 'task-strict',
+                        micro_win_id: 'win-strict',
+                        verification_node_id: 'verify-strict',
+                        rollback_node_id: 'rollback-strict'
+                    }
+                }
+            }],
+        events: [{ entry_id: 'entry-strict', event_type: 'verified' }],
+        ownership_ledger: [{ entry_id: 'entry-strict', lease_id: 'lease-strict', write_paths: ['strict.txt'] }]
+    },
+    merge: { ok: true, blockers: [] },
+    applyResults: [{ entry_id: 'entry-strict', ok: true, changed_files: ['strict.txt'], rollback_digest: 'digest-strict', verification: { status: 'verified' } }],
+    transactionJournal: { ok: true, blockers: [], event_count: 8 },
+    conflictRebase: { ok: true, blockers: [] }
+});
+const missingProof = proofMod.buildAgentPatchProof({
+    queue: {
+        queued_count: 0,
+        entries: [{ id: 'entry-missing', status: 'verified', violations: [], envelope: { lease_proof: {} } }]
+    },
+    merge: { ok: true, blockers: [] },
+    applyResults: [{ entry_id: 'entry-missing', ok: true, changed_files: ['missing.txt'], rollback_digest: 'digest', verification: { status: 'verified' } }],
+    transactionJournal: { ok: true, blockers: [], event_count: 8 },
+    conflictRebase: { ok: true, blockers: [] }
+});
+const report = { schema: 'sks.agent-strategy-to-patch-strict-check.v1', ok: cleanProof.ok && missingProof.ok === false, cleanProof, missingProof };
+writeReport('agent-strategy-to-patch-strict', report);
+assertGate(cleanProof.strategy_to_patch_ok === true, 'strict strategy-to-patch clean fixture must pass', report);
+assertGate(cleanProof.verification_node_coverage['entry-strict'] === 'verify-strict', 'verification node coverage must be recorded', report);
+assertGate(cleanProof.rollback_node_coverage['entry-strict'] === 'rollback-strict', 'rollback node coverage must be recorded', report);
+assertGate(missingProof.blockers.some((row) => row.includes('strategy_reference_missing')), 'missing strategy reference must block proof', report);
+assertGate(missingProof.blockers.some((row) => row.includes('verification_node_missing')), 'missing verification node must block proof', report);
+assertGate(missingProof.blockers.some((row) => row.includes('rollback_node_missing')), 'missing rollback node must block proof', report);
+emitGate('agent:strategy-to-patch-strict', { clean: cleanProof.ok, missing_blockers: missingProof.blockers.length });
+//# sourceMappingURL=agent-strategy-to-patch-strict-check.js.map

package/dist/scripts/agent-task-graph-expansion-check.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/agents/agent-task-graph.js');
+for (const [target, total] of [[5, 8], [5, 25], [20, 40]]) {
+    const graph = mod.buildAgentTaskGraph({ routeType: '$Team', prompt: `fixture ${target}/${total}`, targetActiveSlots: target, desiredWorkItems: total, minimumWorkItems: total });
+    assertGate(graph.schema === 'sks.agent-task-graph.v1', 'task graph schema mismatch', graph);
+    assertGate(graph.target_active_slots === target, 'target active slots mismatch', graph.route_work_count_summary);
+    assertGate(graph.total_work_items === total, 'total work items mismatch', graph.route_work_count_summary);
+    assertGate(graph.total_work_items > graph.target_active_slots || total === target, 'work items must be independent from active slots', graph.route_work_count_summary);
+    assertGate(graph.work_items.every((item) => item.work_item_id && item.required_persona_category && Array.isArray(item.dependencies) && Array.isArray(item.lease_requirements)), 'work item shape incomplete', graph.work_items[0]);
+}
+emitGate('agent:task-graph-expansion', { fixtures: ['5/8', '5/25', '20/40'] });
+//# sourceMappingURL=agent-task-graph-expansion-check.js.map