sneakoscope 4.0.14 → 4.1.0

package/README.md

@@ -35,7 +35,25 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.14** seals GLM Naruto real parallelism while preserving the existing GPT/Codex/MAD `sks --mad` route. GLM mode stays locked to OpenRouter `z-ai/glm-5.2`; non-GLM MAD does not require OpenRouter, does not select GLM, and does not enter the GLM Naruto scheduler.
+SKS **4.1.0** turns the Codex `rust-v0.142.0` compatibility surface into the authoritative Doctor/update readiness path. Doctor now consumes structured Codex Doctor semantics, separates pre-repair observation from post-repair truth, repairs managed native assets from plain `sks doctor --fix`, and gates update completion on a current project migration receipt.
+
+What changed in 4.1.0:
+
+- **Semantic Doctor readiness.** Warning-only Codex Doctor output stays ready, blocking checks block readiness, and unknown non-zero/unparseable Doctor output fails closed.
+- **Post-repair authority.** `sks doctor --fix` records pre-repair Codex Doctor output but bases readiness on the final post-repair Doctor run.
+- **Managed native assets.** Skills, agent roles, hooks, and Context7 transport share the 4.1.0 managed manifest; stale directive markers no longer appear in generated role content.
+- **Codex 0.142 wiring.** The native feature broker exposes multi-agent mode, rollout budget strategy, indexed web search, current time, app-server overload, MCP reconnect, plugin refresh, thread search, remote native environment, and terminal subagent error handling as current capabilities.
+- **Update lifecycle receipts.** `sks update now` runs old-version Doctor preflight, installs through the guarded npm path, re-resolves the new package-local binary, runs new-version global Doctor, and writes a project migration receipt before reporting `updated`.
+- **Local evidence hygiene.** Machine-local `.sneakoscope` runtime evidence is ignored and guarded so release commits do not carry host paths, secrets, or transient proof logs.
+
+What changed in 4.0.15:
+
+- **Codex 0.142 release manifest.** `rust-v0.142.0`, `codex-cli 0.142.0`, SDK `0.142.0`, generated app-server schema hash, required probes, and supported platforms are captured as a single manifest.
+- **Runtime identity proof.** Codex compatibility now resolves the project/env/PATH binary through one resolver and records realpath, version, SHA-256, package root, platform, and arch.
+- **Safer SDK execution policy.** SDK tasks no longer inherit `process.env` wholesale and no longer hard-code `approvalPolicy: never`, `skipGitRepoCheck: true`, or network access from sandbox mode.
+- **0.142 app-server evidence.** Generated app-server TypeScript and JSON Schema snapshots are stored under versioned paths; app-server-v2 wraps `thread/list`, `thread/read`, list search, and `currentTime/read` handling, while capability gates reject `assumed_by_version` evidence.
+- **Transactional thread registry guard.** Codex thread registration now uses an atomic lock and append-only journal, with a 100-write gate covering concurrent updates and corruption preservation.
+- **Package contract repair.** The npm tarball includes `dist/scripts` verification targets so public package scripts do not point at files excluded from the package.
 
 What changed in 4.0.14:
 

package/config/codex-releases/rust-v0.142.0.json

@@ -0,0 +1,39 @@
+{
+  "schema": "sks.codex-release-manifest.v1",
+  "targetTag": "rust-v0.142.0",
+  "requiredCliVersion": "0.142.0",
+  "sdkVersion": "0.142.0",
+  "minimumSupportedVersion": "0.142.0",
+  "protocolMode": "app-server-v2",
+  "generatedSchemaSha256": "fc3c48943de51865e81c8320876fd5310e9d96bd066fc63b74616d26c0e6dd12",
+  "upstreamCommit": "rust-v0.142.0",
+  "featurePolicies": {
+    "multiAgentMode": "probe",
+    "indexedWebSearch": "probe",
+    "currentTimeRead": "wrap",
+    "threadListSearchRead": "probe",
+    "pluginCatalogRefresh": "probe",
+    "terminalSubagentErrorPropagation": "probe",
+    "execMcpTransientRecovery": "probe",
+    "remoteNativeEnvironment": "probe",
+    "rolloutTokenBudget": "probe"
+  },
+  "requiredRealProbes": [
+    "runtime_identity",
+    "protocol_schema_generation",
+    "multi_agent_mode_schema",
+    "indexed_web_search_schema",
+    "current_time_read_schema",
+    "thread_list_search_schema",
+    "terminal_error_schema",
+    "rollout_budget_schema"
+  ],
+  "supportedPlatforms": [
+    "darwin-arm64",
+    "darwin-x64",
+    "linux-arm64",
+    "linux-x64",
+    "win32-arm64",
+    "win32-x64"
+  ]
+}

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.14"
+version = "4.1.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.14"
+version = "4.1.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.14"),
+        Some("--version") => println!("sks-rs 4.1.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.14';
+const FAST_PACKAGE_VERSION = '4.1.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/install-helpers.js

@@ -15,6 +15,7 @@ import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
+import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 const DEFAULT_CODEX_APP_PLUGINS = [
     ['browser', 'openai-bundled'],
     ['chrome', 'openai-bundled'],
@@ -80,6 +81,17 @@ export async function postinstall({ bootstrap, args = [] }) {
             console.log(`Codex App Fast mode: skipped (${fastModeRepair.reason}).`);
         else if (fastModeRepair.status === 'failed')
             console.log(`Codex App Fast mode: auto repair failed. Run \`sks setup\`. ${fastModeRepair.error || ''}`.trim());
+        const postinstallDoctor = await runPostinstallGlobalDoctorAndMarkPending().catch((err) => ({
+            ok: false,
+            doctor: null,
+            pending: null,
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }));
+        if (postinstallDoctor.ok)
+            console.log('SKS update migration: global Doctor ran; project receipt will be finalized on first normal command.');
+        else
+            console.log(`SKS update migration: global Doctor did not complete; first normal command will retry. ${(postinstallDoctor.blockers || []).join(', ')}`.trim());
         // Terminating a third-party app's processes during `npm i` is unsafe by default; opt-in only.
         const appProcessRepair = process.env.SKS_POSTINSTALL_RECONCILE_APP_PROCESSES === '1'
             ? await reconcileCodexAppUpgradeProcesses()

package/dist/cli/router.js

@@ -1,5 +1,6 @@
 import { COMMAND_ALIASES, COMMANDS, } from './command-registry.js';
 import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
+import { ensureCurrentMigrationBeforeCommand } from '../core/update/update-migration-state.js';
 export function isCommandName(value) {
     return Object.prototype.hasOwnProperty.call(COMMANDS, value);
 }
@@ -48,6 +49,13 @@ export async function dispatch(args) {
         return result;
     }
     const entry = COMMANDS[command];
+    const migrationGate = await ensureCurrentMigrationBeforeCommand({ command, args: rest });
+    if (!migrationGate.ok) {
+        console.error(`SKS update migration blocked: ${migrationGate.blockers.join(', ')}`);
+        console.error('Run: sks doctor --fix --yes');
+        process.exitCode = 1;
+        return migrationGate;
+    }
     const mod = await entry.lazy();
     if (typeof mod.run !== 'function')
         throw new Error(`Command ${command} must export run(command, args)`);

package/dist/commands/codex.js

@@ -4,6 +4,7 @@ import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compa
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
 import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
+import { detectCodex0142Capability } from '../core/codex-control/codex-0142-capability.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -38,6 +39,19 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
+    if (action === '0.142' || action === '0142' || action === 'rust-v0.142.0') {
+        const result = await detectCodex0142Capability({ requireReal: flag(args, '--require-real') });
+        if (flag(args, '--json'))
+            return printJson(result);
+        console.log(`Codex 0.142 compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
+        for (const blocker of result.blockers || [])
+            console.log(`- blocker: ${blocker}`);
+        for (const warning of result.warnings || [])
+            console.log(`- warning: ${warning}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === 'doctor') {
         const result = await codexDoctorReport();
         if (flag(args, '--json'))
@@ -56,7 +70,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema|0.141 [--json]');
+    console.error('Usage: sks codex compatibility|version|doctor|schema|0.142|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map

package/dist/commands/doctor.js

@@ -49,10 +49,12 @@ async function runDoctor(args = [], root, doctorFix) {
     let setupRepair = null;
     const sksUpdate = doctorFix
         ? {
-            schema: 'sks.update-now.v1',
+            schema: 'sks.update-now.v2',
             ok: true,
             status: 'skipped',
-            reason: 'manual_update_commands_only'
+            reason: 'manual_update_commands_only',
+            stages: [],
+            migration_current: true
         }
         : null;
     let migrationPreFix = null;
@@ -145,9 +147,9 @@ async function runDoctor(args = [], root, doctorFix) {
         ? await writeFixMigrationJournal(root, migrationPreFix, configRepair, setupRepair).catch(() => null)
         : null;
     let codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
-    const codexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
-    const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, codexDoctor);
-    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, codexDoctor);
+    const preRepairCodexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
+    const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, preRepairCodexDoctor);
+    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, preRepairCodexDoctor);
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -308,7 +310,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'setup',
                         ok: setupRepair !== null,
                         repaired: setupRepair !== null,
-                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : [],
+                        rollback_evidence: setupRepair?.config_backup_path || 'setup_force_regeneration_idempotent_manifest'
                     })
                 },
                 {
@@ -318,7 +321,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         ok: codexStartupRepair?.ok !== false,
                         repaired: doctorFix,
                         blockers: codexStartupRepair?.blockers || [],
-                        warnings: codexStartupRepair?.warnings || []
+                        warnings: codexStartupRepair?.warnings || [],
+                        rollback_evidence: codexStartupRepair?.report_path || 'codex_startup_repair_report'
                     })
                 },
                 {
@@ -327,7 +331,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'startup_config_repair',
                         ok: startupConfigRepair?.ok === true,
                         repaired: startupConfigRepair?.apply === true,
-                        blockers: startupConfigRepair?.blockers || []
+                        blockers: startupConfigRepair?.blockers || [],
+                        rollback_evidence: startupConfigRepair?.backup_path || 'startup_config_repair_idempotent_report'
                     })
                 },
                 {
@@ -337,7 +342,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         ok: context7Repair?.ok !== false,
                         repaired: doctorFix,
                         blockers: context7Repair?.blockers || [],
-                        warnings: context7Repair?.warnings || []
+                        warnings: context7Repair?.warnings || [],
+                        rollback_evidence: context7Repair?.report_path || 'context7_repair_report'
                     })
                 },
                 {
@@ -348,7 +354,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         repaired: context7McpRepair?.repaired === true,
                         manual_required: context7McpRepair?.manual_required === true,
                         blockers: context7McpRepair?.blockers || [],
-                        warnings: context7McpRepair?.warnings || []
+                        warnings: context7McpRepair?.warnings || [],
+                        rollback_evidence: context7McpRepair?.backup_path || 'context7_mcp_repair_idempotent_report'
                     })
                 },
                 {
@@ -361,7 +368,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         manual_required: supabaseMcpRepair?.manual_required === true,
                         required_for_ready: false,
                         blockers: supabaseMcpRepair?.blockers || [],
-                        warnings: supabaseMcpRepair?.warnings || []
+                        warnings: supabaseMcpRepair?.warnings || [],
+                        rollback_evidence: 'optional_supabase_no_ready_mutation_required'
                     })
                 },
                 {
@@ -370,7 +378,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'command_alias_cleanup',
                         ok: commandAliasCleanup?.ok !== false,
                         repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
-                        blockers: commandAliasCleanup?.blockers || []
+                        blockers: commandAliasCleanup?.blockers || [],
+                        rollback_evidence: commandAliasCleanup?.report_path || 'command_alias_cleanup_report'
                     })
                 },
                 {
@@ -379,14 +388,17 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'native_capability_repair',
                         ok: doctorNativeCapabilityRepair?.ok !== false,
                         repaired: doctorFix,
-                        blockers: doctorNativeCapabilityRepair?.blockers || []
+                        blockers: doctorNativeCapabilityRepair?.blockers || [],
+                        rollback_evidence: doctorNativeCapabilityRepair?.secret_preservation_guard || 'native_capability_repair_report'
                     })
                 }
             ]
         }).catch((err) => ({
-            schema: 'sks.doctor-fix-transaction.v1',
+            schema: 'sks.doctor-fix-transaction.v2',
+            generated_at: new Date().toISOString(),
             ok: false,
             postcheck_ok: false,
+            dirty_plan: doctorDirtyPlan,
             phases: [
                 {
                     id: 'doctor_fix_transaction',
@@ -395,9 +407,11 @@ async function runDoctor(args = [], root, doctorFix) {
                     manual_required: false,
                     blockers: [err?.message || String(err)],
                     warnings: [],
-                    artifact_path: null
+                    artifact_path: null,
+                    rollback_evidence: null
                 }
             ],
+            mutations_without_rollback: 0,
             rollback_performed: false,
             raw_secret_values_recorded: false
         }))
@@ -432,7 +446,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const mcpPluginInventory = pluginInventory?.report
         ? await writeMcpPluginInventoryArtifacts(root, { inventory: pluginInventory.report }).catch((err) => ({ error: err?.message || String(err), candidates: null }))
         : null;
-    const repairCodexNative = doctorFix && flag(args, '--repair-codex-native');
+    const repairCodexNative = doctorFix;
     const codexNativeRepair = repairCodexNative
         ? await repairCodexNativeManagedAssets({
             root,
@@ -485,13 +499,41 @@ async function runDoctor(args = [], root, doctorFix) {
         if (reinspected)
             codexConfig = reinspected;
     }
+    const postRepairCodexDoctor = doctorFix
+        ? await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--fix') || flag(args, '--require-actual-codex') }).catch((err) => ({
+            schema: 'sks.codex-doctor-bridge.v2',
+            generated_at: new Date().toISOString(),
+            available: false,
+            exit_code: null,
+            process_exit_code: null,
+            disposition: 'block',
+            semantic_ok: false,
+            source_format: 'text-fallback',
+            blocking_checks: [],
+            warning_checks: [],
+            informational_checks: [],
+            environment_diagnostics_ok: false,
+            git_diagnostics_ok: false,
+            terminal_diagnostics_ok: false,
+            app_server_diagnostics_ok: false,
+            thread_inventory_ok: false,
+            stdout_tail: '',
+            stderr_tail: '',
+            blockers: [`post_repair_codex_doctor_exception:${err?.message || String(err)}`],
+            warnings: []
+        }))
+        : preRepairCodexDoctor;
+    const authoritativeCodexDoctor = postRepairCodexDoctor;
+    const codexDoctorAuthoritativeDiff = compareCodexDoctorBridge(codexDoctorBefore, authoritativeCodexDoctor);
     const pkgBytes = await dirSize(root).catch(() => 0);
     const ready = await writeDoctorReadinessMatrix(root, {
         codex,
         codex_config: codexConfig,
         codex_app: codexApp,
         codex_lb: codexLb,
-        codex_doctor: codexDoctor,
+        codex_doctor: authoritativeCodexDoctor,
+        pre_repair_codex_doctor: preRepairCodexDoctor,
+        post_repair_codex_doctor: postRepairCodexDoctor,
         require_codex_doctor: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         zellij,
         context7_repair: context7Repair,
@@ -502,6 +544,7 @@ async function runDoctor(args = [], root, doctorFix) {
         doctor_fix_transaction: doctorFixTransaction,
         doctor_dirty_plan: doctorDirtyPlan,
         doctor_fix_postcheck: doctorFixPostcheck,
+        doctor_native_capability: doctorNativeCapabilityRepair,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -522,7 +565,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const zellijReadiness = buildZellijReadiness(root, zellij, ready);
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
-        schema: 'sks.doctor-status.v1',
+        schema: 'sks.doctor-status.v2',
         ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false && (!doctorFixPostcheck || doctorFixPostcheck.ok !== false),
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
@@ -533,8 +576,11 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_app_ui: codexAppUi,
         provider_context: providerContext,
         codex_lb: codexLb,
-        codex_doctor: codexDoctor,
-        codex_doctor_diff: codexDoctorDiff,
+        codex_doctor: authoritativeCodexDoctor,
+        pre_repair_codex_doctor: preRepairCodexDoctor,
+        post_repair_codex_doctor: postRepairCodexDoctor,
+        codex_doctor_diff: codexDoctorAuthoritativeDiff,
+        observational_codex_doctor_diff: codexDoctorDiff,
         zellij,
         zellij_repair: zellijRepair,
         context7_repair: context7Repair,
@@ -609,7 +655,7 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  manual: ${action}`);
     for (const warning of codexStartupRepair.warnings || [])
         console.log(`  warning: ${warning}`);
-    console.log(`  codex doctor:    ${codexDoctor.available ? (codexDoctor.exit_code === 0 ? 'ok' : 'warning') : 'unavailable'}`);
+    console.log(`  codex doctor:    ${authoritativeCodexDoctor.available ? (authoritativeCodexDoctor.disposition || (authoritativeCodexDoctor.exit_code === 0 ? 'pass' : 'warn')) : 'unavailable'}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
     console.log('SKS Runtime Readiness:');
@@ -686,7 +732,14 @@ async function runDoctor(args = [], root, doctorFix) {
         }
     }
     const codex0138 = codex0138Capability.report || {};
-    console.log('Codex 0.138 features:');
+    console.log('Codex current compatibility:');
+    console.log(`  target: rust-v0.142.0`);
+    console.log(`  runtime: ${codex.version || 'unknown'}`);
+    console.log(`  multi-agent mode: ${codexNativeFeatureMatrix.features?.multi_agent_mode?.ok ? 'verified' : 'unverified'}`);
+    console.log(`  rollout budget: ${codexNativeFeatureMatrix.features?.rollout_budget?.ok ? 'verified' : 'unverified'}`);
+    console.log(`  indexed search: ${codexNativeFeatureMatrix.features?.indexed_web_search?.ok ? 'verified' : 'unverified'}`);
+    console.log(`  current time: ${codexNativeFeatureMatrix.features?.current_time_read?.ok ? 'verified' : 'unverified'}`);
+    console.log('Historical compatibility: Codex 0.138 features');
     console.log(`  /app handoff: ${codex0138.supports_app_handoff ? 'ok' : 'unavailable'}`);
     console.log(`  plugin JSON: ${codex0138.supports_plugin_json ? 'ok' : 'unavailable'}`);
     console.log(`  image path exposure: ${codex0138.supports_image_path_exposure ? 'ok' : 'unavailable'}`);
@@ -716,6 +769,7 @@ async function runDoctor(args = [], root, doctorFix) {
     console.log('Ready:');
     console.log(`  cli_ready: ${ready.cli_ready ? 'yes' : 'no'}`);
     console.log(`  mad_ready: ${ready.mad_ready ? 'yes' : 'no'}`);
+    console.log(`  managed_state_current: ${ready.managed_state_current ? 'yes' : 'no'}`);
     console.log(`  ready:     ${ready.ready ? 'yes' : 'no'}`);
     if (!ready.ready) {
         console.log('Primary blocker:');
@@ -747,6 +801,9 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
     const defaults = matrix?.invocation_defaults || {};
     const hookPolicy = defaults.hook_evidence_policy || 'unknown-do-not-count';
     const agentStrategy = defaults.loop_worker_role_strategy || 'message-role';
+    const multiAgentMode = defaults.multi_agent_mode || 'none';
+    const rolloutBudget = defaults.rollout_budget_strategy || 'sks-local-only';
+    const researchSource = defaults.research_source_strategy || 'local-files';
     const zellijStatus = zellijReadiness?.status === 'ok'
         ? 'ok'
         : zellijReadiness?.cli_ready ? 'headless_available' : 'repair_required';
@@ -759,7 +816,7 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         repairActions.push('Homebrew + Zellij: sks doctor --fix --install-homebrew --yes');
     }
     if (codexNative !== 'ok')
-        repairActions.push('Codex Native managed assets: sks doctor --fix --repair-codex-native --yes');
+        repairActions.push('Codex Native managed assets: sks doctor --fix --yes');
     if (matrix?.features?.project_memory?.ok !== true)
         repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
     return {
@@ -768,14 +825,21 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         codex_native: codexNative,
         loop_mesh: agentStrategy === 'agent_type' ? 'ok' : 'fallback',
         qa_visual: defaults.qa_visual_review_strategy || 'blocked',
-        research_sources: defaults.research_source_strategy || 'local-files',
+        research_sources: researchSource,
         image_followup: defaults.image_followup_strategy || 'blocked',
         hook_evidence_policy: hookPolicy,
         agent_role_strategy: agentStrategy,
+        multi_agent_mode: multiAgentMode,
+        rollout_budget_strategy: rolloutBudget,
+        current_time_source: defaults.current_time_source || 'external-clock',
+        overload_retry_policy: defaults.overload_retry_policy || 'generic',
         notes: [
             ...(zellijStatus === 'headless_available' ? ['MAD can run with --headless; live panes require repair'] : []),
             ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
-            ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : [])
+            ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : []),
+            ...(multiAgentMode === 'proactive' ? ['Codex 0.142 multi-agent proactive mode available for Naruto-style routes'] : []),
+            ...(rolloutBudget === 'codex-0142-shared' ? ['Codex 0.142 rollout budget can be recorded in route proof'] : []),
+            ...(researchSource === 'indexed-web-search' ? ['Codex 0.142 indexed web search selected for source-intelligence routes'] : [])
         ],
         repair_actions: [...new Set(repairActions)]
     };

package/dist/core/agents/agent-role-config.js

@@ -1,26 +1,19 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
-import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
+import { MANAGED_AGENT_ROLES, managedAgentRoleByFile, managedAgentRoleByName, managedAgentRoleContent, managedAgentRoleOwnsText } from '../managed-assets/managed-assets-manifest.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
-export const SKS_OWNED_AGENT_CONFIGS = new Map([
-    ['analysis-scout.toml', roleConfig('analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only')],
-    ['native-agent-intake.toml', roleConfig('native_agent', 'Read-only Team native agent for repository/docs/tests/API/risk slices.', 'read-only')],
-    ['team-consensus.toml', roleConfig('team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only')],
-    ['implementation-worker.toml', roleConfig('implementation_worker', 'Implementation specialist for bounded SKS Team write sets.', 'workspace-write')],
-    ['db-safety-reviewer.toml', roleConfig('db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only')],
-    ['qa-reviewer.toml', roleConfig('qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only')]
-]);
+export const SKS_OWNED_AGENT_CONFIGS = new Map(MANAGED_AGENT_ROLES.map((role) => [
+    role.filename,
+    { name: role.codex_name, sandbox: role.sandbox, content: managedAgentRoleContent(role), id: role.id }
+]));
 export function managedAgentRoleConfigForFile(file) {
-    return SKS_OWNED_AGENT_CONFIGS.get(path.basename(file))?.content || null;
+    const role = managedAgentRoleByFile(file);
+    return role ? managedAgentRoleContent(role) : null;
 }
 export function managedAgentRoleConfigForRole(role) {
-    const normalized = String(role || '').trim().replace(/-/g, '_');
-    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
-        if (config.name === normalized || path.basename(file, '.toml').replace(/-/g, '_') === normalized)
-            return { file, content: config.content };
-    }
-    return null;
+    const match = managedAgentRoleByName(role);
+    return match ? { file: match.filename, content: managedAgentRoleContent(match) } : null;
 }
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
@@ -31,12 +24,14 @@ export async function repairAgentRoleConfigs(input) {
     const created = [];
     const repaired = [];
     const existing = [];
-    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
+    for (const role of MANAGED_AGENT_ROLES) {
+        const file = role.filename;
+        const content = managedAgentRoleContent(role);
         const found = candidates.find((dir) => fs.existsSync(path.join(dir, file)));
         if (found) {
             const foundPath = path.join(found, file);
             const text = fs.readFileSync(foundPath, 'utf8');
-            if (isValidRoleConfig(text, config)) {
+            if (isValidRoleConfig(text, role)) {
                 existing.push(path.relative(root, foundPath) || foundPath);
                 continue;
             }
@@ -44,7 +39,7 @@ export async function repairAgentRoleConfigs(input) {
             if (input.apply) {
                 const target = foundPath.startsWith(path.join(root, '.codex', 'agents')) ? foundPath : path.join(root, '.codex', 'agents', file);
                 await ensureDir(path.dirname(target));
-                await writeTextAtomic(target, config.content);
+                await writeTextAtomic(target, content);
                 repaired.push(path.relative(root, target));
             }
             continue;
@@ -53,7 +48,7 @@ export async function repairAgentRoleConfigs(input) {
         if (input.apply) {
             const target = path.join(root, '.codex', 'agents', file);
             await ensureDir(path.dirname(target));
-            await writeTextAtomic(target, config.content);
+            await writeTextAtomic(target, content);
             created.push(path.relative(root, target));
         }
     }
@@ -69,6 +64,7 @@ export async function repairAgentRoleConfigs(input) {
         existing,
         created,
         repaired,
+        manifest_role_ids: MANAGED_AGENT_ROLES.map((role) => role.id),
         warnings_suppressed: true,
         blockers: input.apply && requiredFixes !== appliedFixes ? ['agent_role_config_repair_incomplete'] : []
     };
@@ -76,28 +72,9 @@ export async function repairAgentRoleConfigs(input) {
         await writeJsonAtomic(input.reportPath, report);
     return report;
 }
-function roleConfig(name, description, sandbox) {
-    const content = [
-        `name = "${name}"`,
-        `description = "${description}"`,
-        `model = "${REQUIRED_CODEX_MODEL}"`,
-        'model_reasoning_effort = "medium"',
-        `sandbox_mode = "${sandbox}"`,
-        'approval_policy = "never"',
-        'developer_instructions = """',
-        `You are the SKS ${name} role.`,
-        sandbox === 'read-only' ? 'Do not edit files.' : 'Only edit the bounded files assigned by the parent orchestrator.',
-        'Return concise source-backed findings and LIVE_EVENT lines when applicable.',
-        '"""',
-        ''
-    ].join('\n');
-    return { name, sandbox, content };
-}
-function isValidRoleConfig(text, config) {
-    return text.includes(`name = "${config.name}"`)
+function isValidRoleConfig(text, role) {
+    return managedAgentRoleOwnsText(text, role)
         && text.includes('description = "')
-        && text.includes(`model = "${REQUIRED_CODEX_MODEL}"`)
-        && text.includes(`sandbox_mode = "${config.sandbox}"`)
         && text.includes('developer_instructions = """');
 }
 //# sourceMappingURL=agent-role-config.js.map

package/dist/core/codex-adapter.js

@@ -1,19 +1,14 @@
 import path from 'node:path';
-import { exists, packageRoot, runProcess, which } from './fsx.js';
+import { runProcess } from './fsx.js';
 import { forceGpt55CodexArgs } from './codex-model-guard.js';
 import { managedProxyEnvForChild } from './codex/managed-proxy-env.js';
+import { resolveCodexRuntime } from './codex-runtime/resolve-codex-runtime.js';
 export async function findCodexBinary() {
-    const env = process.env.SKS_CODEX_BIN || process.env.DCODEX_CODEX_BIN || process.env.CODEX_BIN;
-    if (env && await exists(env))
-        return env;
-    const global = await which('codex');
-    if (global)
-        return global;
-    const root = packageRoot();
-    const local = path.join(root, 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex');
-    if (await exists(local))
-        return local;
-    return null;
+    const resolved = await resolveCodexRuntime({
+        explicitPath: process.env.DCODEX_CODEX_BIN || null,
+        requestedBy: 'codex-adapter'
+    });
+    return resolved.identity?.realpath || null;
 }
 export async function codexVersion(bin) {
     if (!bin)

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -86,12 +86,12 @@ export async function syncCodexAgentRoles(input) {
 function roleToml(role, payload) {
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.11 directive role: ${role}"`,
+        `description = "SKS managed 4.1.0 directive role: ${role}"`,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
         'developer_instructions = """',
-        `You are ${role}. SKS managed 3.1.7 directive role with bounded ownership.`,
+        `You are ${role}. SKS managed 4.1.0 directive role with bounded ownership.`,
         'Bounded ownership: use only the assigned owner files/directories and treat memory as guidance, not permission.',
         role.includes('implementer') ? 'Maker/checker separation: implementer may patch only owner scope and cannot self-approve.' : 'Maker/checker separation: checker is read-only and must reject missing gates or missing proof artifacts.',
         role.includes('implementer') ? 'Allowed sandbox: workspace-write only within assigned owner scope.' : 'Allowed sandbox: read-only; checker roles cannot mutate.',
@@ -107,7 +107,7 @@ function roleToml(role, payload) {
     ].join('\n');
 }
 function isSksManagedDirectiveRole(text) {
-    return /SKS managed 3\.1\.(?:4|5|6|7|11) (?:directive|bounded) role/.test(text)
+    return /SKS managed (?:3\.1\.(?:4|5|6|7|11)|4\.1\.0) (?:directive|bounded) role/.test(text)
         || /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text);
 }
 function blockersOf(value) {