sneakoscope 4.0.15 → 4.1.0

package/README.md

@@ -35,7 +35,16 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.15** prepares the Codex `rust-v0.142.0` compatibility surface while preserving the existing GPT/Codex/MAD `sks --mad` route. The release pins `@openai/codex-sdk` to `0.142.0`, records a Codex release manifest, resolves one Codex binary identity per mission, isolates SDK child environment variables, and restores the published tarball script contract by shipping the verification scripts that package metadata exposes.
+SKS **4.1.0** turns the Codex `rust-v0.142.0` compatibility surface into the authoritative Doctor/update readiness path. Doctor now consumes structured Codex Doctor semantics, separates pre-repair observation from post-repair truth, repairs managed native assets from plain `sks doctor --fix`, and gates update completion on a current project migration receipt.
+
+What changed in 4.1.0:
+
+- **Semantic Doctor readiness.** Warning-only Codex Doctor output stays ready, blocking checks block readiness, and unknown non-zero/unparseable Doctor output fails closed.
+- **Post-repair authority.** `sks doctor --fix` records pre-repair Codex Doctor output but bases readiness on the final post-repair Doctor run.
+- **Managed native assets.** Skills, agent roles, hooks, and Context7 transport share the 4.1.0 managed manifest; stale directive markers no longer appear in generated role content.
+- **Codex 0.142 wiring.** The native feature broker exposes multi-agent mode, rollout budget strategy, indexed web search, current time, app-server overload, MCP reconnect, plugin refresh, thread search, remote native environment, and terminal subagent error handling as current capabilities.
+- **Update lifecycle receipts.** `sks update now` runs old-version Doctor preflight, installs through the guarded npm path, re-resolves the new package-local binary, runs new-version global Doctor, and writes a project migration receipt before reporting `updated`.
+- **Local evidence hygiene.** Machine-local `.sneakoscope` runtime evidence is ignored and guarded so release commits do not carry host paths, secrets, or transient proof logs.
 
 What changed in 4.0.15:
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.15"
+version = "4.1.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.15"
+version = "4.1.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.15"),
+        Some("--version") => println!("sks-rs 4.1.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.15';
+const FAST_PACKAGE_VERSION = '4.1.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/install-helpers.js

@@ -15,6 +15,7 @@ import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
+import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 const DEFAULT_CODEX_APP_PLUGINS = [
     ['browser', 'openai-bundled'],
     ['chrome', 'openai-bundled'],
@@ -80,6 +81,17 @@ export async function postinstall({ bootstrap, args = [] }) {
             console.log(`Codex App Fast mode: skipped (${fastModeRepair.reason}).`);
         else if (fastModeRepair.status === 'failed')
             console.log(`Codex App Fast mode: auto repair failed. Run \`sks setup\`. ${fastModeRepair.error || ''}`.trim());
+        const postinstallDoctor = await runPostinstallGlobalDoctorAndMarkPending().catch((err) => ({
+            ok: false,
+            doctor: null,
+            pending: null,
+            blockers: [err?.message || String(err)],
+            warnings: []
+        }));
+        if (postinstallDoctor.ok)
+            console.log('SKS update migration: global Doctor ran; project receipt will be finalized on first normal command.');
+        else
+            console.log(`SKS update migration: global Doctor did not complete; first normal command will retry. ${(postinstallDoctor.blockers || []).join(', ')}`.trim());
         // Terminating a third-party app's processes during `npm i` is unsafe by default; opt-in only.
         const appProcessRepair = process.env.SKS_POSTINSTALL_RECONCILE_APP_PROCESSES === '1'
             ? await reconcileCodexAppUpgradeProcesses()

package/dist/cli/router.js

@@ -1,5 +1,6 @@
 import { COMMAND_ALIASES, COMMANDS, } from './command-registry.js';
 import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
+import { ensureCurrentMigrationBeforeCommand } from '../core/update/update-migration-state.js';
 export function isCommandName(value) {
     return Object.prototype.hasOwnProperty.call(COMMANDS, value);
 }
@@ -48,6 +49,13 @@ export async function dispatch(args) {
         return result;
     }
     const entry = COMMANDS[command];
+    const migrationGate = await ensureCurrentMigrationBeforeCommand({ command, args: rest });
+    if (!migrationGate.ok) {
+        console.error(`SKS update migration blocked: ${migrationGate.blockers.join(', ')}`);
+        console.error('Run: sks doctor --fix --yes');
+        process.exitCode = 1;
+        return migrationGate;
+    }
     const mod = await entry.lazy();
     if (typeof mod.run !== 'function')
         throw new Error(`Command ${command} must export run(command, args)`);

package/dist/commands/doctor.js

@@ -49,10 +49,12 @@ async function runDoctor(args = [], root, doctorFix) {
     let setupRepair = null;
     const sksUpdate = doctorFix
         ? {
-            schema: 'sks.update-now.v1',
+            schema: 'sks.update-now.v2',
             ok: true,
             status: 'skipped',
-            reason: 'manual_update_commands_only'
+            reason: 'manual_update_commands_only',
+            stages: [],
+            migration_current: true
         }
         : null;
     let migrationPreFix = null;
@@ -145,9 +147,9 @@ async function runDoctor(args = [], root, doctorFix) {
         ? await writeFixMigrationJournal(root, migrationPreFix, configRepair, setupRepair).catch(() => null)
         : null;
     let codexConfig = configRepair?.after || await inspectCodexConfigReadability(root, configProbeOpts);
-    const codexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
-    const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, codexDoctor);
-    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, codexDoctor);
+    const preRepairCodexDoctor = await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--require-actual-codex') });
+    const codexDoctorDiff = compareCodexDoctorBridge(codexDoctorBefore, preRepairCodexDoctor);
+    codexStartupRepair = mergeObservedCodexStartupWarnings(codexStartupRepair, preRepairCodexDoctor);
     const codex = codexBin
         ? { bin: codexBin, version: 'fixture-or-explicit', available: true }
         : await getCodexInfo().catch(() => ({ bin: null, version: null, available: false }));
@@ -308,7 +310,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'setup',
                         ok: setupRepair !== null,
                         repaired: setupRepair !== null,
-                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : []
+                        blockers: setupRepair === null ? ['setup_repair_not_recorded'] : [],
+                        rollback_evidence: setupRepair?.config_backup_path || 'setup_force_regeneration_idempotent_manifest'
                     })
                 },
                 {
@@ -318,7 +321,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         ok: codexStartupRepair?.ok !== false,
                         repaired: doctorFix,
                         blockers: codexStartupRepair?.blockers || [],
-                        warnings: codexStartupRepair?.warnings || []
+                        warnings: codexStartupRepair?.warnings || [],
+                        rollback_evidence: codexStartupRepair?.report_path || 'codex_startup_repair_report'
                     })
                 },
                 {
@@ -327,7 +331,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'startup_config_repair',
                         ok: startupConfigRepair?.ok === true,
                         repaired: startupConfigRepair?.apply === true,
-                        blockers: startupConfigRepair?.blockers || []
+                        blockers: startupConfigRepair?.blockers || [],
+                        rollback_evidence: startupConfigRepair?.backup_path || 'startup_config_repair_idempotent_report'
                     })
                 },
                 {
@@ -337,7 +342,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         ok: context7Repair?.ok !== false,
                         repaired: doctorFix,
                         blockers: context7Repair?.blockers || [],
-                        warnings: context7Repair?.warnings || []
+                        warnings: context7Repair?.warnings || [],
+                        rollback_evidence: context7Repair?.report_path || 'context7_repair_report'
                     })
                 },
                 {
@@ -348,7 +354,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         repaired: context7McpRepair?.repaired === true,
                         manual_required: context7McpRepair?.manual_required === true,
                         blockers: context7McpRepair?.blockers || [],
-                        warnings: context7McpRepair?.warnings || []
+                        warnings: context7McpRepair?.warnings || [],
+                        rollback_evidence: context7McpRepair?.backup_path || 'context7_mcp_repair_idempotent_report'
                     })
                 },
                 {
@@ -361,7 +368,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         manual_required: supabaseMcpRepair?.manual_required === true,
                         required_for_ready: false,
                         blockers: supabaseMcpRepair?.blockers || [],
-                        warnings: supabaseMcpRepair?.warnings || []
+                        warnings: supabaseMcpRepair?.warnings || [],
+                        rollback_evidence: 'optional_supabase_no_ready_mutation_required'
                     })
                 },
                 {
@@ -370,7 +378,8 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'command_alias_cleanup',
                         ok: commandAliasCleanup?.ok !== false,
                         repaired: Array.isArray(commandAliasCleanup?.actions) && commandAliasCleanup.actions.length > 0,
-                        blockers: commandAliasCleanup?.blockers || []
+                        blockers: commandAliasCleanup?.blockers || [],
+                        rollback_evidence: commandAliasCleanup?.report_path || 'command_alias_cleanup_report'
                     })
                 },
                 {
@@ -379,14 +388,17 @@ async function runDoctor(args = [], root, doctorFix) {
                         id: 'native_capability_repair',
                         ok: doctorNativeCapabilityRepair?.ok !== false,
                         repaired: doctorFix,
-                        blockers: doctorNativeCapabilityRepair?.blockers || []
+                        blockers: doctorNativeCapabilityRepair?.blockers || [],
+                        rollback_evidence: doctorNativeCapabilityRepair?.secret_preservation_guard || 'native_capability_repair_report'
                     })
                 }
             ]
         }).catch((err) => ({
-            schema: 'sks.doctor-fix-transaction.v1',
+            schema: 'sks.doctor-fix-transaction.v2',
+            generated_at: new Date().toISOString(),
             ok: false,
             postcheck_ok: false,
+            dirty_plan: doctorDirtyPlan,
             phases: [
                 {
                     id: 'doctor_fix_transaction',
@@ -395,9 +407,11 @@ async function runDoctor(args = [], root, doctorFix) {
                     manual_required: false,
                     blockers: [err?.message || String(err)],
                     warnings: [],
-                    artifact_path: null
+                    artifact_path: null,
+                    rollback_evidence: null
                 }
             ],
+            mutations_without_rollback: 0,
             rollback_performed: false,
             raw_secret_values_recorded: false
         }))
@@ -432,7 +446,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const mcpPluginInventory = pluginInventory?.report
         ? await writeMcpPluginInventoryArtifacts(root, { inventory: pluginInventory.report }).catch((err) => ({ error: err?.message || String(err), candidates: null }))
         : null;
-    const repairCodexNative = doctorFix && flag(args, '--repair-codex-native');
+    const repairCodexNative = doctorFix;
     const codexNativeRepair = repairCodexNative
         ? await repairCodexNativeManagedAssets({
             root,
@@ -485,13 +499,41 @@ async function runDoctor(args = [], root, doctorFix) {
         if (reinspected)
             codexConfig = reinspected;
     }
+    const postRepairCodexDoctor = doctorFix
+        ? await runCodexDoctorBridge({ codexBin: codexBin || null, cwd: root, required: flag(args, '--fix') || flag(args, '--require-actual-codex') }).catch((err) => ({
+            schema: 'sks.codex-doctor-bridge.v2',
+            generated_at: new Date().toISOString(),
+            available: false,
+            exit_code: null,
+            process_exit_code: null,
+            disposition: 'block',
+            semantic_ok: false,
+            source_format: 'text-fallback',
+            blocking_checks: [],
+            warning_checks: [],
+            informational_checks: [],
+            environment_diagnostics_ok: false,
+            git_diagnostics_ok: false,
+            terminal_diagnostics_ok: false,
+            app_server_diagnostics_ok: false,
+            thread_inventory_ok: false,
+            stdout_tail: '',
+            stderr_tail: '',
+            blockers: [`post_repair_codex_doctor_exception:${err?.message || String(err)}`],
+            warnings: []
+        }))
+        : preRepairCodexDoctor;
+    const authoritativeCodexDoctor = postRepairCodexDoctor;
+    const codexDoctorAuthoritativeDiff = compareCodexDoctorBridge(codexDoctorBefore, authoritativeCodexDoctor);
     const pkgBytes = await dirSize(root).catch(() => 0);
     const ready = await writeDoctorReadinessMatrix(root, {
         codex,
         codex_config: codexConfig,
         codex_app: codexApp,
         codex_lb: codexLb,
-        codex_doctor: codexDoctor,
+        codex_doctor: authoritativeCodexDoctor,
+        pre_repair_codex_doctor: preRepairCodexDoctor,
+        post_repair_codex_doctor: postRepairCodexDoctor,
         require_codex_doctor: flag(args, '--fix') || flag(args, '--require-actual-codex'),
         zellij,
         context7_repair: context7Repair,
@@ -502,6 +544,7 @@ async function runDoctor(args = [], root, doctorFix) {
         doctor_fix_transaction: doctorFixTransaction,
         doctor_dirty_plan: doctorDirtyPlan,
         doctor_fix_postcheck: doctorFixPostcheck,
+        doctor_native_capability: doctorNativeCapabilityRepair,
         local_model: localModel,
         agent_role_config: agentRoleConfigRepair,
         repair: configRepair,
@@ -522,7 +565,7 @@ async function runDoctor(args = [], root, doctorFix) {
     const zellijReadiness = buildZellijReadiness(root, zellij, ready);
     const runtimeReadiness = buildRuntimeReadiness(zellijReadiness, codexNativeFeatureMatrix);
     const result = {
-        schema: 'sks.doctor-status.v1',
+        schema: 'sks.doctor-status.v2',
         ok: ready.ready && (!sksUpdate || sksUpdate.ok !== false) && commandAliasCleanup.ok !== false && codexStartupRepair.ok !== false && (!doctorFixPostcheck || doctorFixPostcheck.ok !== false),
         root,
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
@@ -533,8 +576,11 @@ async function runDoctor(args = [], root, doctorFix) {
         codex_app_ui: codexAppUi,
         provider_context: providerContext,
         codex_lb: codexLb,
-        codex_doctor: codexDoctor,
-        codex_doctor_diff: codexDoctorDiff,
+        codex_doctor: authoritativeCodexDoctor,
+        pre_repair_codex_doctor: preRepairCodexDoctor,
+        post_repair_codex_doctor: postRepairCodexDoctor,
+        codex_doctor_diff: codexDoctorAuthoritativeDiff,
+        observational_codex_doctor_diff: codexDoctorDiff,
         zellij,
         zellij_repair: zellijRepair,
         context7_repair: context7Repair,
@@ -609,7 +655,7 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  manual: ${action}`);
     for (const warning of codexStartupRepair.warnings || [])
         console.log(`  warning: ${warning}`);
-    console.log(`  codex doctor:    ${codexDoctor.available ? (codexDoctor.exit_code === 0 ? 'ok' : 'warning') : 'unavailable'}`);
+    console.log(`  codex doctor:    ${authoritativeCodexDoctor.available ? (authoritativeCodexDoctor.disposition || (authoritativeCodexDoctor.exit_code === 0 ? 'pass' : 'warn')) : 'unavailable'}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
     console.log('SKS Runtime Readiness:');
@@ -686,7 +732,14 @@ async function runDoctor(args = [], root, doctorFix) {
         }
     }
     const codex0138 = codex0138Capability.report || {};
-    console.log('Codex 0.138 features:');
+    console.log('Codex current compatibility:');
+    console.log(`  target: rust-v0.142.0`);
+    console.log(`  runtime: ${codex.version || 'unknown'}`);
+    console.log(`  multi-agent mode: ${codexNativeFeatureMatrix.features?.multi_agent_mode?.ok ? 'verified' : 'unverified'}`);
+    console.log(`  rollout budget: ${codexNativeFeatureMatrix.features?.rollout_budget?.ok ? 'verified' : 'unverified'}`);
+    console.log(`  indexed search: ${codexNativeFeatureMatrix.features?.indexed_web_search?.ok ? 'verified' : 'unverified'}`);
+    console.log(`  current time: ${codexNativeFeatureMatrix.features?.current_time_read?.ok ? 'verified' : 'unverified'}`);
+    console.log('Historical compatibility: Codex 0.138 features');
     console.log(`  /app handoff: ${codex0138.supports_app_handoff ? 'ok' : 'unavailable'}`);
     console.log(`  plugin JSON: ${codex0138.supports_plugin_json ? 'ok' : 'unavailable'}`);
     console.log(`  image path exposure: ${codex0138.supports_image_path_exposure ? 'ok' : 'unavailable'}`);
@@ -716,6 +769,7 @@ async function runDoctor(args = [], root, doctorFix) {
     console.log('Ready:');
     console.log(`  cli_ready: ${ready.cli_ready ? 'yes' : 'no'}`);
     console.log(`  mad_ready: ${ready.mad_ready ? 'yes' : 'no'}`);
+    console.log(`  managed_state_current: ${ready.managed_state_current ? 'yes' : 'no'}`);
     console.log(`  ready:     ${ready.ready ? 'yes' : 'no'}`);
     if (!ready.ready) {
         console.log('Primary blocker:');
@@ -747,6 +801,9 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
     const defaults = matrix?.invocation_defaults || {};
     const hookPolicy = defaults.hook_evidence_policy || 'unknown-do-not-count';
     const agentStrategy = defaults.loop_worker_role_strategy || 'message-role';
+    const multiAgentMode = defaults.multi_agent_mode || 'none';
+    const rolloutBudget = defaults.rollout_budget_strategy || 'sks-local-only';
+    const researchSource = defaults.research_source_strategy || 'local-files';
     const zellijStatus = zellijReadiness?.status === 'ok'
         ? 'ok'
         : zellijReadiness?.cli_ready ? 'headless_available' : 'repair_required';
@@ -759,7 +816,7 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         repairActions.push('Homebrew + Zellij: sks doctor --fix --install-homebrew --yes');
     }
     if (codexNative !== 'ok')
-        repairActions.push('Codex Native managed assets: sks doctor --fix --repair-codex-native --yes');
+        repairActions.push('Codex Native managed assets: sks doctor --fix --yes');
     if (matrix?.features?.project_memory?.ok !== true)
         repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
     return {
@@ -768,14 +825,21 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
         codex_native: codexNative,
         loop_mesh: agentStrategy === 'agent_type' ? 'ok' : 'fallback',
         qa_visual: defaults.qa_visual_review_strategy || 'blocked',
-        research_sources: defaults.research_source_strategy || 'local-files',
+        research_sources: researchSource,
         image_followup: defaults.image_followup_strategy || 'blocked',
         hook_evidence_policy: hookPolicy,
         agent_role_strategy: agentStrategy,
+        multi_agent_mode: multiAgentMode,
+        rollout_budget_strategy: rolloutBudget,
+        current_time_source: defaults.current_time_source || 'external-clock',
+        overload_retry_policy: defaults.overload_retry_policy || 'generic',
         notes: [
             ...(zellijStatus === 'headless_available' ? ['MAD can run with --headless; live panes require repair'] : []),
             ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
-            ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : [])
+            ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : []),
+            ...(multiAgentMode === 'proactive' ? ['Codex 0.142 multi-agent proactive mode available for Naruto-style routes'] : []),
+            ...(rolloutBudget === 'codex-0142-shared' ? ['Codex 0.142 rollout budget can be recorded in route proof'] : []),
+            ...(researchSource === 'indexed-web-search' ? ['Codex 0.142 indexed web search selected for source-intelligence routes'] : [])
         ],
         repair_actions: [...new Set(repairActions)]
     };

package/dist/core/agents/agent-role-config.js

@@ -1,26 +1,19 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
-import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
+import { MANAGED_AGENT_ROLES, managedAgentRoleByFile, managedAgentRoleByName, managedAgentRoleContent, managedAgentRoleOwnsText } from '../managed-assets/managed-assets-manifest.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
-export const SKS_OWNED_AGENT_CONFIGS = new Map([
-    ['analysis-scout.toml', roleConfig('analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only')],
-    ['native-agent-intake.toml', roleConfig('native_agent', 'Read-only Team native agent for repository/docs/tests/API/risk slices.', 'read-only')],
-    ['team-consensus.toml', roleConfig('team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only')],
-    ['implementation-worker.toml', roleConfig('implementation_worker', 'Implementation specialist for bounded SKS Team write sets.', 'workspace-write')],
-    ['db-safety-reviewer.toml', roleConfig('db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only')],
-    ['qa-reviewer.toml', roleConfig('qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only')]
-]);
+export const SKS_OWNED_AGENT_CONFIGS = new Map(MANAGED_AGENT_ROLES.map((role) => [
+    role.filename,
+    { name: role.codex_name, sandbox: role.sandbox, content: managedAgentRoleContent(role), id: role.id }
+]));
 export function managedAgentRoleConfigForFile(file) {
-    return SKS_OWNED_AGENT_CONFIGS.get(path.basename(file))?.content || null;
+    const role = managedAgentRoleByFile(file);
+    return role ? managedAgentRoleContent(role) : null;
 }
 export function managedAgentRoleConfigForRole(role) {
-    const normalized = String(role || '').trim().replace(/-/g, '_');
-    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
-        if (config.name === normalized || path.basename(file, '.toml').replace(/-/g, '_') === normalized)
-            return { file, content: config.content };
-    }
-    return null;
+    const match = managedAgentRoleByName(role);
+    return match ? { file: match.filename, content: managedAgentRoleContent(match) } : null;
 }
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
@@ -31,12 +24,14 @@ export async function repairAgentRoleConfigs(input) {
     const created = [];
     const repaired = [];
     const existing = [];
-    for (const [file, config] of SKS_OWNED_AGENT_CONFIGS) {
+    for (const role of MANAGED_AGENT_ROLES) {
+        const file = role.filename;
+        const content = managedAgentRoleContent(role);
         const found = candidates.find((dir) => fs.existsSync(path.join(dir, file)));
         if (found) {
             const foundPath = path.join(found, file);
             const text = fs.readFileSync(foundPath, 'utf8');
-            if (isValidRoleConfig(text, config)) {
+            if (isValidRoleConfig(text, role)) {
                 existing.push(path.relative(root, foundPath) || foundPath);
                 continue;
             }
@@ -44,7 +39,7 @@ export async function repairAgentRoleConfigs(input) {
             if (input.apply) {
                 const target = foundPath.startsWith(path.join(root, '.codex', 'agents')) ? foundPath : path.join(root, '.codex', 'agents', file);
                 await ensureDir(path.dirname(target));
-                await writeTextAtomic(target, config.content);
+                await writeTextAtomic(target, content);
                 repaired.push(path.relative(root, target));
             }
             continue;
@@ -53,7 +48,7 @@ export async function repairAgentRoleConfigs(input) {
         if (input.apply) {
             const target = path.join(root, '.codex', 'agents', file);
             await ensureDir(path.dirname(target));
-            await writeTextAtomic(target, config.content);
+            await writeTextAtomic(target, content);
             created.push(path.relative(root, target));
         }
     }
@@ -69,6 +64,7 @@ export async function repairAgentRoleConfigs(input) {
         existing,
         created,
         repaired,
+        manifest_role_ids: MANAGED_AGENT_ROLES.map((role) => role.id),
         warnings_suppressed: true,
         blockers: input.apply && requiredFixes !== appliedFixes ? ['agent_role_config_repair_incomplete'] : []
     };
@@ -76,28 +72,9 @@ export async function repairAgentRoleConfigs(input) {
         await writeJsonAtomic(input.reportPath, report);
     return report;
 }
-function roleConfig(name, description, sandbox) {
-    const content = [
-        `name = "${name}"`,
-        `description = "${description}"`,
-        `model = "${REQUIRED_CODEX_MODEL}"`,
-        'model_reasoning_effort = "medium"',
-        `sandbox_mode = "${sandbox}"`,
-        'approval_policy = "never"',
-        'developer_instructions = """',
-        `You are the SKS ${name} role.`,
-        sandbox === 'read-only' ? 'Do not edit files.' : 'Only edit the bounded files assigned by the parent orchestrator.',
-        'Return concise source-backed findings and LIVE_EVENT lines when applicable.',
-        '"""',
-        ''
-    ].join('\n');
-    return { name, sandbox, content };
-}
-function isValidRoleConfig(text, config) {
-    return text.includes(`name = "${config.name}"`)
+function isValidRoleConfig(text, role) {
+    return managedAgentRoleOwnsText(text, role)
         && text.includes('description = "')
-        && text.includes(`model = "${REQUIRED_CODEX_MODEL}"`)
-        && text.includes(`sandbox_mode = "${config.sandbox}"`)
         && text.includes('developer_instructions = """');
 }
 //# sourceMappingURL=agent-role-config.js.map

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -86,12 +86,12 @@ export async function syncCodexAgentRoles(input) {
 function roleToml(role, payload) {
     return [
         `name = "${role}"`,
-        `description = "SKS managed 3.1.11 directive role: ${role}"`,
+        `description = "SKS managed 4.1.0 directive role: ${role}"`,
         'model_reasoning_effort = "medium"',
         role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
         'approval_policy = "never"',
         'developer_instructions = """',
-        `You are ${role}. SKS managed 3.1.7 directive role with bounded ownership.`,
+        `You are ${role}. SKS managed 4.1.0 directive role with bounded ownership.`,
         'Bounded ownership: use only the assigned owner files/directories and treat memory as guidance, not permission.',
         role.includes('implementer') ? 'Maker/checker separation: implementer may patch only owner scope and cannot self-approve.' : 'Maker/checker separation: checker is read-only and must reject missing gates or missing proof artifacts.',
         role.includes('implementer') ? 'Allowed sandbox: workspace-write only within assigned owner scope.' : 'Allowed sandbox: read-only; checker roles cannot mutate.',
@@ -107,7 +107,7 @@ function roleToml(role, payload) {
     ].join('\n');
 }
 function isSksManagedDirectiveRole(text) {
-    return /SKS managed 3\.1\.(?:4|5|6|7|11) (?:directive|bounded) role/.test(text)
+    return /SKS managed (?:3\.1\.(?:4|5|6|7|11)|4\.1\.0) (?:directive|bounded) role/.test(text)
         || /\bmessage_role_prefix\s*=/.test(text) && /SKS managed 3\.1\./.test(text);
 }
 function blockersOf(value) {

package/dist/core/codex-control/codex-app-server-v2-client.js

@@ -28,7 +28,7 @@ export class CodexAppServerV2Client {
             clientInfo: {
                 name: 'sneakoscope-codex-app-server-v2',
                 title: 'Sneakoscope Codex app-server v2',
-                version: '4.0.15'
+                version: '4.1.0'
             },
             capabilities: {
                 experimentalApi: true,