sneakoscope 4.0.9 → 4.0.10

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.9';
+const FAST_PACKAGE_VERSION = '4.0.10';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.9';
+export const PACKAGE_VERSION = '4.0.10';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/pipeline-internals/runtime-gates.js

@@ -236,7 +236,9 @@ export async function evaluateStop(root, state, payload, opts = {}) {
     if (state?.mission_id && state?.stop_gate && !['none', 'honest_mode', 'clarification-gate'].includes(state.stop_gate)) {
         // 4.0.9: Use canonical stop-gate resolver first for NARUTO/GLM_NARUTO routes.
         const modeUpper = String(state?.mode || '').toUpperCase();
-        if (modeUpper === 'NARUTO' || state.stop_gate === 'stop-gate.json' || state.stop_gate === 'naruto-gate.json') {
+        const routeUpper = String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase();
+        const narutoFamily = modeUpper === 'NARUTO' || routeUpper === 'NARUTO' || routeUpper === 'GLM_NARUTO';
+        if (narutoFamily || state.stop_gate === 'stop-gate.json' || state.stop_gate === 'naruto-gate.json') {
             const stopCheck = await checkStopGate({
                 root,
                 route: state.route || state.mode,
@@ -244,7 +246,8 @@ export async function evaluateStop(root, state, payload, opts = {}) {
                 explicitGatePath: typeof state.stop_gate_abs_path === 'string' && state.stop_gate_abs_path ? state.stop_gate_abs_path : undefined,
             });
             if (stopCheck.action === 'allow_stop') {
-                // Gate passed via canonical resolver; fall through to remaining checks.
+                if (narutoFamily)
+                    return { continue: true, systemMessage: `SKS: canonical stop-gate passed at ${stopCheck.gate_path}` };
             }
             else if (stopCheck.action === 'hard_blocked') {
                 return { continue: true, systemMessage: `SKS: ${stopCheck.feedback}` };

package/dist/core/providers/glm/glm-request-cache.js

@@ -3,8 +3,10 @@ import { SksLruCache } from '../../perf/lru-cache.js';
 export function createGlmEncodedRequestCache(maxEntries = 128) {
     return new SksLruCache(maxEntries);
 }
-export function encodeGlmRequestWithCache(request, cache = defaultEncodedRequestCache) {
-    const key = digestRequestForCache(request);
+export function encodeGlmRequestWithCache(input, cache = defaultEncodedRequestCache) {
+    const request = 'request' in input ? input.request : input;
+    const stringify = 'request' in input && input.stringify ? input.stringify : JSON.stringify;
+    const key = 'request' in input && input.cacheKeyParts ? digestRequestCacheKeyParts(input.cacheKeyParts) : digestRequestForCache(request);
     const hit = cache.get(key);
     // Fix 18.2: On cache hit, return stored body without JSON.stringify
     if (hit) {
@@ -12,11 +14,11 @@ export function encodeGlmRequestWithCache(request, cache = defaultEncodedRequest
             return { body: hit.body, entry: hit, cacheHit: true };
         }
         // Even for non-stored bodies, skip re-stringifying by computing from request
-        const body = JSON.stringify(request);
+        const body = stringify(request);
         return { body, entry: hit, cacheHit: true };
     }
     // Cache miss: stringify once
-    const body = JSON.stringify(request);
+    const body = stringify(request);
     if (containsSecretLikeContent(body)) {
         const entry = {
             key,
@@ -40,6 +42,9 @@ export function encodeGlmRequestWithCache(request, cache = defaultEncodedRequest
     cache.set(key, entry);
     return { body, entry, cacheHit: false };
 }
+export function digestRequestCacheKeyParts(parts) {
+    return crypto.createHash('sha256').update(stableStringify(parts)).digest('hex');
+}
 export function digestRequestForCache(request) {
     const safe = {
         model: request.model,

package/dist/core/providers/glm/naruto/glm-naruto-bench.js

@@ -1,6 +1,10 @@
-import { nowIso, writeJsonAtomic } from '../../../fsx.js';
+import { nowIso } from '../../../fsx.js';
 import path from 'node:path';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
 import { GLM_52_OPENROUTER_MODEL } from '../glm-52-settings.js';
+import { resolveOpenRouterApiKey } from '../../openrouter/openrouter-secret-store.js';
+import { runGlmNarutoMission } from './glm-naruto-orchestrator.js';
 export async function runGlmNarutoBench(root, args = []) {
     const live = args.includes('--live');
     const execute = args.includes('--execute');
@@ -11,7 +15,7 @@ export async function runGlmNarutoBench(root, args = []) {
     if (!live) {
         return {
             schema: 'sks.glm-naruto-bench.v1',
-            version: '4.0.9',
+            version: '4.0.10',
             generated_at: nowIso(),
             status: 'dry_run',
             model: GLM_52_OPENROUTER_MODEL,
@@ -27,29 +31,60 @@ export async function runGlmNarutoBench(root, args = []) {
             warnings: ['dry_run_no_live_api_calls']
         };
     }
-    // Live bench would require OpenRouter key and real API calls
+    const key = await resolveOpenRouterApiKey({ env: process.env });
+    if (!key.key)
+        return blocked(root, ['live_bench_requires_openrouter_key']);
+    const fixture = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-glm-naruto-live-bench-'));
+    await fsp.mkdir(path.join(fixture, 'src'), { recursive: true });
+    await fsp.writeFile(path.join(fixture, 'src', 'bench-target.ts'), 'export const value = 1;\n', 'utf8');
+    const cases = [];
+    for (const workers of [1, 4, 8, 12]) {
+        const caseStarted = Date.now();
+        const result = await runGlmNarutoMission({
+            cwd: fixture,
+            task: 'Change src/bench-target.ts so value is 2. Return the smallest patch only.',
+            args: ['--bench', '--live', '--no-apply'],
+            missionId: `glm-naruto-live-bench-${workers}-${Date.now()}`,
+            maxWorkers: workers,
+            noApply: true
+        });
+        cases.push({
+            name: workers === 1 ? 'direct single GLM' : `GLM Naruto ${workers} workers`,
+            workers,
+            wall_clock_ms: Date.now() - caseStarted,
+            p50_ttft_ms: null,
+            p90_ttft_ms: null,
+            candidate_count: result.patch_candidates,
+            gate_pass_rate: result.patch_candidates ? result.gate_passed_candidates / result.patch_candidates : 0,
+            verifier_pass_rate: 0,
+            merge_success: result.mergeable_candidates > 0,
+            cached_tokens: 0,
+            cache_write_tokens: 0
+        });
+    }
     return {
         schema: 'sks.glm-naruto-bench.v1',
-        version: '4.0.9',
+        version: '4.0.10',
         generated_at: nowIso(),
-        status: 'blocked',
+        status: 'live',
         model: GLM_52_OPENROUTER_MODEL,
         gpt_fallback_allowed: false,
+        cases,
         summary: {
-            simulated_workers: 0,
-            simulated_waves: 0,
-            simulated_patch_candidates: 0,
-            simulated_gate_passed: 0,
-            simulated_mergeable: 0,
+            simulated_workers: Math.max(...cases.map((row) => row.workers)),
+            simulated_waves: cases.length,
+            simulated_patch_candidates: cases.reduce((sum, row) => sum + row.candidate_count, 0),
+            simulated_gate_passed: cases.reduce((sum, row) => sum + Math.round(row.candidate_count * row.gate_pass_rate), 0),
+            simulated_mergeable: cases.filter((row) => row.merge_success).length,
             wall_clock_ms: Date.now() - started
         },
-        warnings: ['live_bench_requires_openrouter_key_and_task']
+        warnings: ['live_bench_no_apply_temp_repo']
     };
 }
 function blocked(root, warnings) {
     return {
         schema: 'sks.glm-naruto-bench.v1',
-        version: '4.0.9',
+        version: '4.0.10',
         generated_at: nowIso(),
         status: 'blocked',
         model: GLM_52_OPENROUTER_MODEL,

package/dist/core/providers/glm/naruto/glm-naruto-combined-patch.js

@@ -0,0 +1,49 @@
+import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
+export function combineGlmNarutoPatches(envelopes, selectedPatchIds) {
+    const selected = selectedPatchIds
+        .map((patchId) => envelopes.find((env) => env.worker_id === patchId || env.patch_sha256 === patchId))
+        .filter((env) => Boolean(env))
+        .sort((a, b) => a.worker_id.localeCompare(b.worker_id));
+    return mergeDiffSections(selected.flatMap((env) => splitDiffSections(env.patch)));
+}
+export async function checkAndApplyCombinedGlmNarutoPatch(input) {
+    const patch = combineGlmNarutoPatches(input.envelopes, input.selectedPatchIds);
+    if (!patch.trim())
+        return { ok: false, patch, applied: [], blocker: 'combined_patch_empty' };
+    const checked = await checkAndApplyGlmPatch({ cwd: input.cwd, patch, apply: input.apply });
+    if (!checked.ok)
+        return { ok: false, patch, applied: [], blocker: checked.error.code };
+    return { ok: true, patch, applied: input.selectedPatchIds };
+}
+function mergeDiffSections(sections) {
+    const byFile = new Map();
+    for (const section of sections)
+        byFile.set(section.file, [...(byFile.get(section.file) || []), section]);
+    const merged = [];
+    for (const [file] of byFile) {
+        const group = byFile.get(file);
+        const first = group[0];
+        merged.push([...first.header, ...group.flatMap((section) => section.hunks)].join('\n').trimEnd());
+    }
+    return merged.filter(Boolean).join('\n\n') + (merged.length ? '\n' : '');
+}
+function splitDiffSections(patch) {
+    const rawSections = patch
+        .split(/(?=^diff --git )/m)
+        .map((section) => section.trim())
+        .filter(Boolean);
+    return rawSections.map((section) => {
+        const lines = section.split(/\r?\n/);
+        const diff = lines[0]?.match(/^diff --git a\/(.+?) b\/(.+)$/);
+        const file = diff?.[2] || diff?.[1] || lines[0] || 'unknown';
+        const firstHunk = lines.findIndex((line) => line.startsWith('@@ '));
+        if (firstHunk < 0)
+            return { file, header: lines, hunks: [] };
+        return {
+            file,
+            header: lines.slice(0, firstHunk),
+            hunks: lines.slice(firstHunk)
+        };
+    });
+}
+//# sourceMappingURL=glm-naruto-combined-patch.js.map

package/dist/core/providers/glm/naruto/glm-naruto-conflict-graph.js

@@ -1,3 +1,4 @@
+import { envelopesHaveHunkConflict } from './glm-naruto-hunk-conflict.js';
 export function buildConflictGraph(envelopes, nodes) {
     const edges = [];
     for (let i = 0; i < nodes.length; i++) {
@@ -23,11 +24,16 @@ function detectConflict(left, right, envelopes) {
     if (leftEnv && rightEnv && leftEnv.base_digest !== rightEnv.base_digest) {
         return { left_patch_id: left.patch_id, right_patch_id: right.patch_id, reason: 'base_digest_mismatch' };
     }
+    if (left.shard_id === right.shard_id) {
+        return { left_patch_id: left.patch_id, right_patch_id: right.patch_id, reason: 'same_hunk' };
+    }
     const leftPaths = new Set(left.target_paths);
     const rightPaths = new Set(right.target_paths);
     const sharedFiles = [...leftPaths].filter((p) => rightPaths.has(p));
     if (sharedFiles.length > 0) {
-        if (left.shard_id === right.shard_id) {
+        if (leftEnv && rightEnv) {
+            if (!envelopesHaveHunkConflict(leftEnv, rightEnv))
+                return null;
             return { left_patch_id: left.patch_id, right_patch_id: right.patch_id, reason: 'same_hunk' };
         }
         return { left_patch_id: left.patch_id, right_patch_id: right.patch_id, reason: 'same_file' };

package/dist/core/providers/glm/naruto/glm-naruto-hunk-conflict.js

@@ -0,0 +1,16 @@
+import { hunksOverlap, parseUnifiedDiffHunks } from './glm-naruto-hunk-parser.js';
+export function envelopesHaveHunkConflict(left, right) {
+    const leftHunks = parseUnifiedDiffHunks(left.patch);
+    const rightHunks = parseUnifiedDiffHunks(right.patch);
+    if (leftHunks.length === 0 || rightHunks.length === 0)
+        return sharesPath(left, right);
+    return leftHunks.some((leftHunk) => rightHunks.some((rightHunk) => hunksOverlap(leftHunk, rightHunk)));
+}
+export function envelopesShareFileButNotHunk(left, right) {
+    return sharesPath(left, right) && !envelopesHaveHunkConflict(left, right);
+}
+function sharesPath(left, right) {
+    const rightPaths = new Set(right.target_paths);
+    return left.target_paths.some((file) => rightPaths.has(file));
+}
+//# sourceMappingURL=glm-naruto-hunk-conflict.js.map

package/dist/core/providers/glm/naruto/glm-naruto-hunk-parser.js

@@ -0,0 +1,36 @@
+export function parseUnifiedDiffHunks(patch) {
+    const hunks = [];
+    let currentFile = null;
+    for (const line of patch.split(/\r?\n/)) {
+        const diff = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
+        if (diff?.[2]) {
+            currentFile = diff[2];
+            continue;
+        }
+        const file = line.match(/^\+\+\+ b\/(.+)$/);
+        if (file?.[1] && file[1] !== '/dev/null')
+            currentFile = file[1];
+        const hunk = line.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$/);
+        if (hunk && currentFile) {
+            hunks.push({
+                file: currentFile,
+                old_start: Number(hunk[1]),
+                old_lines: Number(hunk[2] || 1),
+                new_start: Number(hunk[3]),
+                new_lines: Number(hunk[4] || 1),
+                header: line
+            });
+        }
+    }
+    return hunks;
+}
+export function hunksOverlap(left, right) {
+    if (left.file !== right.file)
+        return false;
+    return rangesOverlap(left.old_start, left.old_start + Math.max(1, left.old_lines) - 1, right.old_start, right.old_start + Math.max(1, right.old_lines) - 1)
+        || rangesOverlap(left.new_start, left.new_start + Math.max(1, left.new_lines) - 1, right.new_start, right.new_start + Math.max(1, right.new_lines) - 1);
+}
+function rangesOverlap(aStart, aEnd, bStart, bEnd) {
+    return aStart <= bEnd && bStart <= aEnd;
+}
+//# sourceMappingURL=glm-naruto-hunk-parser.js.map

package/dist/core/providers/glm/naruto/glm-naruto-orchestrator.js

@@ -2,7 +2,6 @@ import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../../../fsx.js';
 import { GLM_52_OPENROUTER_MODEL } from '../glm-52-settings.js';
 import { resolveOpenRouterApiKey } from '../../openrouter/openrouter-secret-store.js';
-import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
 import { decomposeTask, validateWorkGraph } from './glm-naruto-decomposer.js';
 import { planShardCandidates, computeInitialLaneMix } from './glm-naruto-shard-planner.js';
 import { runPatchWorkerPool } from './glm-naruto-worker-pool.js';
@@ -16,6 +15,8 @@ import { createProviderHealthTracker } from '../../openrouter/openrouter-provide
 import { createMissionTrace, recordWorkerTrace, writeMissionArtifacts, buildMissionSummary } from './glm-naruto-trace.js';
 import { runGlmJudge } from './glm-naruto-judge.js';
 import { writeFinalStopGate } from '../../../stop-gate/stop-gate-writer.js';
+import { checkAndApplyCombinedGlmNarutoPatch } from './glm-naruto-combined-patch.js';
+import { auditGlmNarutoArtifactsForSecrets } from './glm-naruto-secret-audit.js';
 import { GLM_NARUTO_LIMITS } from './glm-naruto-types.js';
 export async function runGlmNarutoMission(input) {
     const missionId = input.missionId || `glm-naruto-${nowIso().replace(/[:.]/g, '-')}`;
@@ -156,16 +157,14 @@ export async function runGlmNarutoMission(input) {
     let appliedPatches = 0;
     let applyResult = null;
     if (!input.noApply && mergePlan.selected_patches.length > 0) {
-        for (const patchId of mergePlan.selected_patches) {
-            const envelope = envelopes.find((e) => e.worker_id === patchId);
-            if (!envelope)
-                continue;
-            const applied = await checkAndApplyGlmPatch({ cwd, patch: envelope.patch, apply: true });
-            if (applied.ok) {
-                appliedPatches++;
-            }
-        }
-        applyResult = { ok: appliedPatches > 0, applied: mergePlan.selected_patches };
+        const combinedApply = await checkAndApplyCombinedGlmNarutoPatch({
+            cwd,
+            envelopes,
+            selectedPatchIds: mergePlan.selected_patches,
+            apply: true
+        });
+        appliedPatches = combinedApply.ok ? combinedApply.applied.length : 0;
+        applyResult = { ok: combinedApply.ok, applied: combinedApply.applied, ...(combinedApply.blocker ? { blocker: combinedApply.blocker } : {}) };
     }
     const terminalState = appliedPatches > 0 ? 'completed' : passedEnvelopes.length > 0 ? 'partial_candidates' : 'blocked';
     const terminationReason = appliedPatches > 0 ? 'completed_merge_applied' : passedEnvelopes.length > 0 ? 'partial_no_apply' : 'no_gate_passed_candidates';
@@ -216,13 +215,21 @@ export async function runGlmNarutoMission(input) {
         missionResult: result,
         envelopes
     });
+    const secretAudit = await auditGlmNarutoArtifactsForSecrets(path.join(cwd, '.sneakoscope', 'glm-naruto', missionId)).catch((err) => ({
+        schema: 'sks.glm-naruto-secret-audit.v1',
+        ok: false,
+        root: path.join(cwd, '.sneakoscope', 'glm-naruto', missionId),
+        scanned_files: 0,
+        findings: [`audit_failed:${err instanceof Error ? err.message : String(err)}`]
+    }));
+    await writeJsonAtomic(path.join(artifactDir, 'secret-audit.json'), secretAudit).catch(() => undefined);
     // 4.0.9: Write canonical stop-gate artifacts for hook resolution.
     await writeFinalStopGate({
         root: cwd,
         missionId,
         route: 'GLM_NARUTO',
         routeCommand: '$Naruto',
-        status: result.ok ? 'passed' : (terminalState === 'blocked' ? 'blocked' : 'failed'),
+        status: result.ok && secretAudit.ok ? 'passed' : (terminalState === 'blocked' || !secretAudit.ok ? 'blocked' : 'failed'),
         terminal: terminalState === 'completed' || terminalState === 'blocked',
         terminalState,
         evidence: {
@@ -232,8 +239,12 @@ export async function runGlmNarutoMission(input) {
             per_worker_artifacts: true,
             verifier_wave_run: true,
             model_guard_enforced: true,
+            proof_required: false,
+            proof_passed: true,
+            reflection_required: false,
+            reflection_passed: 'not_required',
         },
-        blockers: result.blockers || [],
+        blockers: secretAudit.ok ? (result.blockers || []) : ['glm_naruto_secret_leak_detected'],
         nativeGateFile: 'termination.json',
     }).catch(() => null);
     return { ...result, artifact_dir: artifactDir };

package/dist/core/providers/glm/naruto/glm-naruto-patch-candidate-gate.js

@@ -0,0 +1,42 @@
+import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
+import { parseGlmNarutoPatchCandidate } from './glm-naruto-patch-candidate-parser.js';
+const PROTECTED_PATH = /(^|\/)(\.github|dist|node_modules)(\/|$)/;
+const SECRET_PATTERN = /\b(?:Bearer\s+[A-Za-z0-9._~+/-]+|sk-(?:or-)?[A-Za-z0-9_-]{12,}|OPENROUTER_API_KEY|SKS_OPENROUTER_API_KEY)\b/;
+export async function evaluateGlmNarutoPatchCandidateGate(input) {
+    const checks = [];
+    const parsed = parseGlmNarutoPatchCandidate(input.envelope.patch);
+    checks.push(check('candidate_parse', parsed.ok, parsed.blockers.join(',') || undefined));
+    checks.push(check('patch_section', Boolean(parsed.patch), parsed.patch ? undefined : 'missing_patch_section'));
+    checks.push(check('unified_diff', /^diff --git /m.test(parsed.patch), parsed.patch ? undefined : 'no_diff_git'));
+    const blockedPath = parsed.touched_paths.find((file) => PROTECTED_PATH.test(file));
+    checks.push(check('protected_path_guard', !blockedPath, blockedPath));
+    const secretLeak = SECRET_PATTERN.test(parsed.patch);
+    checks.push(check('secret_leakage_guard', !secretLeak, secretLeak ? 'secret_like_content' : undefined));
+    if (parsed.ok && !blockedPath && !secretLeak) {
+        const applyCheck = await checkAndApplyGlmPatch({
+            cwd: input.cwd,
+            patch: parsed.patch,
+            apply: input.apply === true
+        });
+        checks.push(check('git_apply_check', applyCheck.ok, applyCheck.ok ? undefined : applyCheck.error.code));
+    }
+    else {
+        checks.push({ id: 'git_apply_check', ok: false, reason: 'skipped_due_to_prior_blocker', ms: 0 });
+    }
+    const blockers = checks.filter((row) => !row.ok).map((row) => row.reason || row.id);
+    return {
+        schema: 'sks.glm-naruto-patch-candidate-gate.v1',
+        ok: blockers.length === 0,
+        worker_id: input.envelope.worker_id,
+        shard_id: input.envelope.shard_id,
+        patch_id: input.envelope.patch_sha256,
+        extracted_patch: parsed.patch,
+        touched_paths: parsed.touched_paths,
+        checks,
+        blockers
+    };
+}
+function check(id, ok, reason) {
+    return { id, ok, ...(reason ? { reason } : {}), ms: 0 };
+}
+//# sourceMappingURL=glm-naruto-patch-candidate-gate.js.map

package/dist/core/providers/glm/naruto/glm-naruto-patch-candidate-parser.js

@@ -0,0 +1,62 @@
+import { parseUnifiedDiffPatch } from '../glm-patch-parser.js';
+const CANDIDATE_OPEN = '<sks_patch_candidate>';
+const CANDIDATE_CLOSE = '</sks_patch_candidate>';
+const LEGACY_PATCH_OPEN = '<sks_patch>';
+export function parseGlmNarutoPatchCandidate(text) {
+    const blockers = [];
+    if (text.includes(LEGACY_PATCH_OPEN) && !text.includes(CANDIDATE_OPEN)) {
+        return failed(text, ['legacy_sks_patch_envelope_rejected']);
+    }
+    const body = unwrapCandidateBody(text);
+    if (!body.ok)
+        return failed(text, body.blockers);
+    const extracted = extractPatchSection(body.body);
+    if (!extracted.ok)
+        return failed(body.body, extracted.blockers);
+    const parsed = parseUnifiedDiffPatch(extracted.patch);
+    if (parsed.empty)
+        blockers.push('patch_missing_unified_diff');
+    return {
+        ok: blockers.length === 0,
+        body: body.body,
+        patch: extracted.patch,
+        touched_paths: parsed.touchedPaths,
+        blockers
+    };
+}
+function unwrapCandidateBody(text) {
+    const start = text.indexOf(CANDIDATE_OPEN);
+    const end = text.indexOf(CANDIDATE_CLOSE);
+    if (start >= 0 || end >= 0) {
+        if (start < 0 || end <= start)
+            return { ok: false, blockers: ['malformed_patch_candidate_envelope'] };
+        return { ok: true, body: text.slice(start + CANDIDATE_OPEN.length, end).trim() };
+    }
+    if (/^\s*patch\s*:/im.test(text))
+        return { ok: true, body: text.trim() };
+    return { ok: false, blockers: ['missing_patch_candidate_envelope'] };
+}
+function extractPatchSection(body) {
+    const lines = body.split(/\r?\n/);
+    const patchLine = lines.findIndex((line) => /^\s*patch\s*:/i.test(line));
+    if (patchLine < 0)
+        return { ok: false, blockers: ['missing_patch_section'] };
+    const firstLine = lines[patchLine] || '';
+    const inline = firstLine.replace(/^\s*patch\s*:\s*/i, '');
+    const tail = inline.trim() ? [inline, ...lines.slice(patchLine + 1)] : lines.slice(patchLine + 1);
+    const raw = tail.join('\n').replace(/^\s*```(?:diff|patch)?\s*/i, '').replace(/\s*```\s*$/i, '').trim();
+    const diffIndex = raw.search(/^diff --git /m);
+    if (diffIndex < 0)
+        return { ok: false, blockers: ['patch_missing_diff_git'] };
+    return { ok: true, patch: raw.slice(diffIndex).trimEnd() + '\n' };
+}
+function failed(body, blockers) {
+    return {
+        ok: false,
+        body,
+        patch: '',
+        touched_paths: [],
+        blockers
+    };
+}
+//# sourceMappingURL=glm-naruto-patch-candidate-parser.js.map

package/dist/core/providers/glm/naruto/glm-naruto-secret-audit.js

@@ -0,0 +1,39 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+const SECRET_PATTERN = /\b(?:Bearer\s+[A-Za-z0-9._~+/-]+|sk-(?:or-)?[A-Za-z0-9_-]{12,}|OPENROUTER_API_KEY|SKS_OPENROUTER_API_KEY)\b/;
+export async function auditGlmNarutoArtifactsForSecrets(root) {
+    const findings = [];
+    let scanned = 0;
+    await scan(root, async (file) => {
+        if (!/\.(json|jsonl|md|txt)$/i.test(file))
+            return;
+        scanned++;
+        const content = await fsp.readFile(file, 'utf8').catch(() => '');
+        if (SECRET_PATTERN.test(content))
+            findings.push(path.relative(root, file));
+    });
+    return {
+        schema: 'sks.glm-naruto-secret-audit.v1',
+        ok: findings.length === 0,
+        root,
+        scanned_files: scanned,
+        findings
+    };
+}
+async function scan(dir, visit) {
+    let entries;
+    try {
+        entries = await fsp.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const p = path.join(dir, String(entry.name));
+        if (entry.isDirectory())
+            await scan(p, visit);
+        else if (entry.isFile())
+            await visit(p);
+    }
+}
+//# sourceMappingURL=glm-naruto-secret-audit.js.map

package/dist/core/providers/glm/naruto/glm-naruto-verifier-output.js

@@ -0,0 +1,26 @@
+export function parseGlmNarutoVerifierOutput(content) {
+    try {
+        const parsed = JSON.parse(stripJsonFences(content));
+        const issues = [];
+        if (parsed.schema !== 'sks.glm-naruto-verifier-output.v1')
+            issues.push('schema');
+        if (typeof parsed.ok !== 'boolean')
+            issues.push('ok');
+        if (!Array.isArray(parsed.issues) || parsed.issues.some((issue) => typeof issue !== 'string'))
+            issues.push('issues');
+        if (typeof parsed.risk_score !== 'number' || parsed.risk_score < 0 || parsed.risk_score > 1)
+            issues.push('risk_score');
+        if (typeof parsed.confidence !== 'number' || parsed.confidence < 0 || parsed.confidence > 1)
+            issues.push('confidence');
+        if (issues.length)
+            return { ok: false, issues: issues.map((issue) => `invalid_${issue}`) };
+        return { ok: true, output: parsed, issues: [] };
+    }
+    catch {
+        return { ok: false, issues: ['malformed_json'] };
+    }
+}
+function stripJsonFences(content) {
+    return content.trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```\s*$/i, '').trim();
+}
+//# sourceMappingURL=glm-naruto-verifier-output.js.map

package/dist/core/providers/glm/naruto/glm-naruto-worker-artifacts.js

@@ -0,0 +1,42 @@
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../../../fsx.js';
+export async function writeGlmNarutoWorkerArtifacts(input) {
+    const dir = path.join(input.root, '.sneakoscope', 'glm-naruto', input.missionId, 'workers', input.workerId);
+    await ensureDir(dir);
+    if (input.requestSummary) {
+        await writeJsonAtomic(path.join(dir, 'request-summary.json'), sanitizeArtifact({
+            schema: 'sks.glm-naruto-worker-request-summary.v1',
+            worker_id: input.workerId,
+            shard_id: input.shardId,
+            created_at: nowIso(),
+            ...input.requestSummary
+        }));
+    }
+    if (input.streamTrace)
+        await writeJsonAtomic(path.join(dir, 'stream-trace.json'), sanitizeArtifact(input.streamTrace));
+    if (input.patchEnvelope)
+        await writeJsonAtomic(path.join(dir, 'patch-envelope.json'), sanitizeArtifact(input.patchEnvelope));
+    if (input.gateResult)
+        await writeJsonAtomic(path.join(dir, 'gate-result.json'), sanitizeArtifact(input.gateResult));
+    if (input.termination) {
+        await writeJsonAtomic(path.join(dir, 'termination.json'), sanitizeArtifact({
+            schema: 'sks.glm-naruto-worker-termination.v1',
+            worker_id: input.workerId,
+            shard_id: input.shardId,
+            created_at: nowIso(),
+            ...input.termination
+        }));
+    }
+    return dir;
+}
+function sanitizeArtifact(value) {
+    return JSON.parse(JSON.stringify(value, (_key, raw) => {
+        if (typeof raw !== 'string')
+            return raw;
+        return raw
+            .replace(/Bearer\s+[A-Za-z0-9._~+/-]+/g, 'Bearer [REDACTED]')
+            .replace(/sk-or-[A-Za-z0-9_-]+/g, 'sk-or-[REDACTED]')
+            .replace(/sk-[A-Za-z0-9_-]{12,}/g, 'sk-[REDACTED]');
+    }));
+}
+//# sourceMappingURL=glm-naruto-worker-artifacts.js.map

package/dist/core/providers/glm/naruto/glm-naruto-worker-pool.js

@@ -1,8 +1,9 @@
 import { runPatchWorker } from './glm-naruto-worker-runtime.js';
-import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
-import { evaluateGlmSpeedGate } from '../glm-speed-gate.js';
 import { decideConcurrency } from './glm-naruto-concurrency-governor.js';
 import { planFileLeases } from './glm-naruto-file-lease.js';
+import { evaluateGlmNarutoPatchCandidateGate } from './glm-naruto-patch-candidate-gate.js';
+import { createPatchEnvelope } from './glm-naruto-patch-envelope.js';
+import { writeGlmNarutoWorkerArtifacts } from './glm-naruto-worker-artifacts.js';
 export async function runPatchWorkerPool(input) {
     const envelopes = [];
     const traces = [];
@@ -34,6 +35,7 @@ export async function runPatchWorkerPool(input) {
                 apiKey: input.apiKey,
                 missionId: input.missionId,
                 workerId,
+                root: input.cwd,
                 shard: shardWithStrategy,
                 contextSummary: input.contextSummary,
                 timeoutMs: input.workerTimeoutMs
@@ -43,25 +45,42 @@ export async function runPatchWorkerPool(input) {
     const results = await Promise.allSettled(workerTasks);
     for (const result of results) {
         if (result.status === 'fulfilled' && result.value.ok && result.value.envelope) {
-            const gate = evaluateGlmSpeedGate(result.value.envelope.patch);
+            const gate = await evaluateGlmNarutoPatchCandidateGate({
+                cwd: input.cwd,
+                envelope: result.value.envelope,
+                apply: false
+            });
             let envelope = result.value.envelope;
             if (gate.ok) {
-                const applyCheck = await checkAndApplyGlmPatch({
-                    cwd: input.cwd,
-                    patch: envelope.patch,
-                    apply: false
+                envelope = createPatchEnvelope({
+                    missionId: envelope.mission_id,
+                    workerId: envelope.worker_id,
+                    shardId: envelope.shard_id,
+                    baseDigest: envelope.base_digest,
+                    patch: gate.extracted_patch,
+                    strategy: envelope.strategy,
+                    reasoningEffort: envelope.reasoning_effort,
+                    status: 'gate_passed',
+                    warnings: envelope.warnings
                 });
-                envelope = applyCheck.ok
-                    ? { ...envelope, status: 'gate_passed' }
-                    : { ...envelope, status: 'gate_failed', blockers: [applyCheck.error.code] };
             }
             else {
                 envelope = {
                     ...envelope,
                     status: 'gate_failed',
-                    blockers: gate.checks.filter((c) => !c.ok).map((c) => c.reason || c.id)
+                    blockers: gate.blockers
                 };
             }
+            await writeGlmNarutoWorkerArtifacts({
+                root: input.cwd,
+                missionId: input.missionId,
+                workerId: envelope.worker_id,
+                shardId: envelope.shard_id,
+                patchEnvelope: envelope,
+                gateResult: gate,
+                streamTrace: result.value.trace,
+                termination: { status: envelope.status, ok: gate.ok, blockers: envelope.blockers }
+            }).catch(() => undefined);
             envelopes.push(envelope);
             traces.push(result.value.trace);
         }

package/dist/core/providers/glm/naruto/glm-naruto-worker-runtime.js

@@ -6,9 +6,12 @@ import { sendOpenRouterChatCompletionStream } from '../../openrouter/openrouter-
 import { assertGlm52ActualModel } from '../glm-52-response-guard.js';
 import { encodeGlmRequestWithCache } from '../glm-request-cache.js';
 import { parsePatchCandidateOutput, createPatchEnvelope, digestPatch } from './glm-naruto-patch-envelope.js';
+import { parseGlmNarutoVerifierOutput } from './glm-naruto-verifier-output.js';
+import { writeGlmNarutoWorkerArtifacts } from './glm-naruto-worker-artifacts.js';
 const STABLE_SYSTEM_PREFIX = `You are a SKS GLM Naruto patch worker. Model lock: ${GLM_52_OPENROUTER_MODEL}. No GPT/OpenAI fallback allowed. Output only <sks_patch_candidate>, <sks_need_context>, or <sks_blocked> envelopes. Use unified diff format for patches. Never write to main workspace directly. Follow proof-first mutation rules.`;
 export async function runPatchWorker(input) {
     const started = Date.now();
+    const artifactRoot = input.root ?? process.cwd();
     const sessionId = `sks-glm-naruto-${input.missionId}-${input.workerId}`;
     const reasoningEffort = input.shard.reasoning;
     const shardSuffix = JSON.stringify({
@@ -34,7 +37,38 @@ export async function runPatchWorker(input) {
         providerSort: 'throughput'
     });
     const requestWithSession = { ...request, session_id: sessionId };
-    const encoded = encodeGlmRequestWithCache(requestWithSession);
+    const stablePrefixDigest = crypto.createHash('sha256').update(STABLE_SYSTEM_PREFIX).digest('hex');
+    const shardSuffixDigest = crypto.createHash('sha256').update(shardSuffix).digest('hex');
+    const encoded = encodeGlmRequestWithCache({
+        request: requestWithSession,
+        cacheKeyParts: {
+            model: requestWithSession.model,
+            profile: 'glm-naruto-worker-speed',
+            stable_prefix_digest: stablePrefixDigest,
+            shard_suffix_digest: shardSuffixDigest,
+            tools_digest: requestWithSession.tools ? crypto.createHash('sha256').update(JSON.stringify(requestWithSession.tools)).digest('hex') : null,
+            response_format_digest: requestWithSession.response_format ? crypto.createHash('sha256').update(JSON.stringify(requestWithSession.response_format)).digest('hex') : null,
+            provider_digest: crypto.createHash('sha256').update(JSON.stringify(requestWithSession.provider ?? null)).digest('hex'),
+            session_id: sessionId
+        }
+    });
+    await writeGlmNarutoWorkerArtifacts({
+        root: artifactRoot,
+        missionId: input.missionId,
+        workerId: input.workerId,
+        shardId: input.shard.id,
+        requestSummary: {
+            model: requestWithSession.model,
+            provider: 'openrouter',
+            session_id: sessionId,
+            request_body_sha256: encoded.entry.bodySha256,
+            request_body_size: encoded.entry.byteLength,
+            request_body_stored: encoded.entry.bodyStored,
+            cache_hit: encoded.cacheHit,
+            stable_prefix_digest: stablePrefixDigest,
+            shard_suffix_digest: shardSuffixDigest
+        }
+    }).catch(() => undefined);
     const traceBase = {
         worker_id: input.workerId,
         shard_id: input.shard.id,
@@ -54,35 +88,63 @@ export async function runPatchWorker(input) {
             apiKey: input.apiKey,
             request: requestWithSession,
             timeoutMs: input.timeoutMs,
-            idleTimeoutMs: 60_000
+            idleTimeoutMs: 60_000,
+            ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {})
         });
         if (!response.ok) {
+            const trace = { ...traceBase, total_ms: Date.now() - started, status: 'failed' };
+            await writeGlmNarutoWorkerArtifacts({
+                root: artifactRoot,
+                missionId: input.missionId,
+                workerId: input.workerId,
+                shardId: input.shard.id,
+                streamTrace: trace,
+                termination: { status: 'failed', ok: false, error: response.error.code }
+            }).catch(() => undefined);
             return {
                 envelope: null,
-                trace: { ...traceBase, total_ms: Date.now() - started, status: 'failed' },
+                trace,
                 ok: false,
                 error: response.error.code
             };
         }
         const modelGuard = assertGlm52ActualModel(response.value.model);
         if (!modelGuard.ok) {
+            const trace = { ...traceBase, total_ms: Date.now() - started, status: 'blocked' };
+            await writeGlmNarutoWorkerArtifacts({
+                root: artifactRoot,
+                missionId: input.missionId,
+                workerId: input.workerId,
+                shardId: input.shard.id,
+                streamTrace: trace,
+                termination: { status: 'blocked', ok: false, error: `model_guard:${modelGuard.code}` }
+            }).catch(() => undefined);
             return {
                 envelope: null,
-                trace: { ...traceBase, total_ms: Date.now() - started, status: 'blocked' },
+                trace,
                 ok: false,
                 error: `model_guard:${modelGuard.code}`
             };
         }
         const parsed = parsePatchCandidateOutput(response.value.content);
         if (parsed.kind !== 'patch') {
+            const trace = {
+                ...traceBase,
+                ttft_ms: response.value.ttft_ms,
+                total_ms: Date.now() - started,
+                status: parsed.kind === 'blocked' ? 'blocked' : 'no_patch'
+            };
+            await writeGlmNarutoWorkerArtifacts({
+                root: artifactRoot,
+                missionId: input.missionId,
+                workerId: input.workerId,
+                shardId: input.shard.id,
+                streamTrace: trace,
+                termination: { status: trace.status, ok: false, error: parsed.kind }
+            }).catch(() => undefined);
             return {
                 envelope: null,
-                trace: {
-                    ...traceBase,
-                    ttft_ms: response.value.ttft_ms,
-                    total_ms: Date.now() - started,
-                    status: parsed.kind === 'blocked' ? 'blocked' : 'no_patch'
-                },
+                trace,
                 ok: false,
                 error: parsed.kind
             };
@@ -103,12 +165,38 @@ export async function runPatchWorker(input) {
             patch_digest: digestPatch(envelope.patch),
             status: 'completed'
         };
+        await writeGlmNarutoWorkerArtifacts({
+            root: artifactRoot,
+            missionId: input.missionId,
+            workerId: input.workerId,
+            shardId: input.shard.id,
+            streamTrace: trace,
+            patchEnvelope: envelope,
+            gateResult: {
+                schema: 'sks.glm-naruto-worker-gate-result.v1',
+                worker_id: input.workerId,
+                shard_id: input.shard.id,
+                status: 'pending_orchestrator_gate',
+                ok: false,
+                reason: 'deterministic_gate_runs_in_orchestrator_with_repo_cwd'
+            },
+            termination: { status: 'completed', ok: true }
+        }).catch(() => undefined);
         return { envelope, trace, ok: true };
     }
     catch (err) {
+        const trace = { ...traceBase, total_ms: Date.now() - started, status: 'failed' };
+        await writeGlmNarutoWorkerArtifacts({
+            root: artifactRoot,
+            missionId: input.missionId,
+            workerId: input.workerId,
+            shardId: input.shard.id,
+            streamTrace: trace,
+            termination: { status: 'failed', ok: false, error: err instanceof Error ? err.message : String(err) }
+        }).catch(() => undefined);
         return {
             envelope: null,
-            trace: { ...traceBase, total_ms: Date.now() - started, status: 'failed' },
+            trace,
             ok: false,
             error: err instanceof Error ? err.message : String(err)
         };
@@ -118,7 +206,7 @@ export async function runVerifierWorker(input) {
     const started = Date.now();
     const sessionId = `sks-glm-naruto-verify-${input.missionId}-${input.workerId}`;
     const messages = [
-        { role: 'system', content: `You are a SKS GLM Naruto verifier. Model: ${GLM_52_OPENROUTER_MODEL}. No GPT fallback. Check if the patch is correct and safe. Output JSON: {"ok":true/false,"issues":["..."]}` },
+        { role: 'system', content: `You are a SKS GLM Naruto verifier. Model: ${GLM_52_OPENROUTER_MODEL}. No GPT fallback. Return only JSON with schema "sks.glm-naruto-verifier-output.v1", ok boolean, issues string array, risk_score number 0..1, confidence number 0..1. Do not include markdown.` },
         { role: 'user', content: JSON.stringify({ patch_sha256: input.envelope.patch_sha256, target_paths: input.envelope.target_paths, patch: input.envelope.patch.slice(0, 4000) }) }
     ];
     const request = buildGlm52Request({
@@ -126,14 +214,16 @@ export async function runVerifierWorker(input) {
         messages,
         maxTokens: 2048,
         toolChoice: 'none',
-        parallelToolCalls: false
+        parallelToolCalls: false,
+        providerSort: 'throughput'
     });
     try {
         const response = await sendOpenRouterChatCompletionStream({
             apiKey: input.apiKey,
             request: { ...request, session_id: sessionId },
             timeoutMs: input.timeoutMs,
-            idleTimeoutMs: 60_000
+            idleTimeoutMs: 60_000,
+            ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {})
         });
         if (!response.ok) {
             return {
@@ -155,6 +245,68 @@ export async function runVerifierWorker(input) {
                 issues: [response.error.code]
             };
         }
+        const modelGuard = assertGlm52ActualModel(response.value.model);
+        if (!modelGuard.ok) {
+            return {
+                ok: false,
+                trace: {
+                    worker_id: input.workerId,
+                    shard_id: input.envelope.shard_id,
+                    strategy: 'minimal_patch',
+                    model: GLM_52_OPENROUTER_MODEL,
+                    provider: 'openrouter',
+                    session_id: sessionId,
+                    ttft_ms: response.value.ttft_ms,
+                    total_ms: Date.now() - started,
+                    request_cache_hit: false,
+                    output_digest: crypto.createHash('sha256').update(response.value.content).digest('hex'),
+                    patch_digest: input.envelope.patch_sha256,
+                    status: 'verification_failed'
+                },
+                issues: [`model_guard:${modelGuard.code}`]
+            };
+        }
+        const parsed = parseGlmNarutoVerifierOutput(response.value.content);
+        if (!parsed.ok || !parsed.output) {
+            return {
+                ok: false,
+                trace: {
+                    worker_id: input.workerId,
+                    shard_id: input.envelope.shard_id,
+                    strategy: 'minimal_patch',
+                    model: GLM_52_OPENROUTER_MODEL,
+                    provider: 'openrouter',
+                    session_id: sessionId,
+                    ttft_ms: response.value.ttft_ms,
+                    total_ms: Date.now() - started,
+                    request_cache_hit: false,
+                    output_digest: crypto.createHash('sha256').update(response.value.content).digest('hex'),
+                    patch_digest: input.envelope.patch_sha256,
+                    status: 'verification_failed'
+                },
+                issues: parsed.issues
+            };
+        }
+        if (!parsed.output.ok) {
+            return {
+                ok: false,
+                trace: {
+                    worker_id: input.workerId,
+                    shard_id: input.envelope.shard_id,
+                    strategy: 'minimal_patch',
+                    model: GLM_52_OPENROUTER_MODEL,
+                    provider: 'openrouter',
+                    session_id: sessionId,
+                    ttft_ms: response.value.ttft_ms,
+                    total_ms: Date.now() - started,
+                    request_cache_hit: false,
+                    output_digest: crypto.createHash('sha256').update(response.value.content).digest('hex'),
+                    patch_digest: input.envelope.patch_sha256,
+                    status: 'verification_failed'
+                },
+                issues: parsed.output.issues
+            };
+        }
         return {
             ok: true,
             trace: {
@@ -169,7 +321,7 @@ export async function runVerifierWorker(input) {
                 request_cache_hit: false,
                 output_digest: crypto.createHash('sha256').update(response.value.content).digest('hex'),
                 patch_digest: input.envelope.patch_sha256,
-                status: 'completed'
+                status: 'verification_passed'
             },
             issues: []
         };

package/dist/core/providers/openrouter/openrouter-stream.js

@@ -2,6 +2,15 @@ import { redactOpenRouterString } from '../../security/redact-secrets.js';
 import { OPENROUTER_CHAT_COMPLETIONS_URL } from './openrouter-types.js';
 import { normalizeOpenRouterError } from './openrouter-error.js';
 import { encodeGlmRequestWithCache } from '../glm/glm-request-cache.js';
+export class GlmStreamIdleTimeout extends Error {
+    code;
+    constructor(afterTtft) {
+        const code = afterTtft ? 'glm_stream_idle_timeout_after_ttft' : 'glm_stream_idle_timeout';
+        super(code);
+        this.name = 'GlmStreamIdleTimeout';
+        this.code = code;
+    }
+}
 export async function sendOpenRouterChatCompletionStream(input) {
     const started = Date.now();
     const controller = input.timeoutMs ? new AbortController() : null;
@@ -37,12 +46,13 @@ export async function sendOpenRouterChatCompletionStream(input) {
     catch (err) {
         if (timeout)
             clearTimeout(timeout);
-        if (err instanceof Error && (err.name === 'AbortError' || err.message === 'glm_stream_idle_timeout' || err.message === 'glm_stream_idle_timeout_after_ttft')) {
-            const isIdle = err.message.startsWith('glm_stream_idle');
+        if (err instanceof Error && (err.name === 'AbortError' || err instanceof GlmStreamIdleTimeout || err.message === 'glm_stream_idle_timeout' || err.message === 'glm_stream_idle_timeout_after_ttft')) {
+            const code = err instanceof GlmStreamIdleTimeout ? err.code : err.message;
+            const isIdle = code.startsWith('glm_stream_idle');
             return {
                 ok: false,
                 error: {
-                    code: isIdle ? err.message : 'glm_request_timeout',
+                    code: isIdle ? code : 'glm_request_timeout',
                     message: isIdle ? `OpenRouter stream idle timeout after ${input.idleTimeoutMs || 0}ms.` : `OpenRouter stream aborted after ${input.timeoutMs || 'external'}ms.`,
                     severity: 'failed'
                 }
@@ -71,18 +81,23 @@ async function readRealStream(body, startedAtMs, idleTimeoutMs) {
     let lastChunkMs = startedAtMs;
     try {
         while (true) {
-            // 4.0.9: Idle timeout between chunks — abort if stream stalls.
             const readPromise = reader.read();
             let idleTimer = null;
-            if (idleTimeoutMs && idleTimeoutMs > 0) {
-                idleTimer = setTimeout(() => {
-                    const code = ttft === null ? 'glm_stream_idle_timeout' : 'glm_stream_idle_timeout_after_ttft';
-                    reader.cancel(code).catch(() => undefined);
-                }, idleTimeoutMs);
-            }
             let result;
             try {
-                result = await readPromise;
+                result = idleTimeoutMs && idleTimeoutMs > 0
+                    ? await Promise.race([
+                        readPromise,
+                        new Promise((_, reject) => {
+                            idleTimer = setTimeout(() => reject(new GlmStreamIdleTimeout(ttft !== null)), idleTimeoutMs);
+                        })
+                    ])
+                    : await readPromise;
+            }
+            catch (err) {
+                if (err instanceof GlmStreamIdleTimeout)
+                    await reader.cancel(err.code).catch(() => undefined);
+                throw err;
             }
             finally {
                 if (idleTimer)

package/dist/core/stop-gate/stop-gate-check.js

@@ -86,6 +86,7 @@ export async function checkStopGate(input) {
             missing_fields: [],
             blockers: [],
         };
+        await writeDiagnostics(root, missionId, diagnostics);
         return {
             schema: 'sks.stop-gate-check.v1',
             ok: true,
@@ -115,6 +116,7 @@ export async function checkStopGate(input) {
             missing_fields: [],
             blockers: [],
         };
+        await writeDiagnostics(root, missionId, diagnostics);
         return {
             schema: 'sks.stop-gate-check.v1',
             ok: false,
@@ -129,9 +131,19 @@ export async function checkStopGate(input) {
     const missingFields = [];
     if (normalizedGate.passed !== true)
         missingFields.push('passed');
-    if (!normalizedGate.terminal)
+    if (normalizedGate.terminal !== true)
         missingFields.push('terminal');
-    if (normalizedGate.passed === true && missingFields.length === 0) {
+    if (normalizedGate.status !== 'passed')
+        missingFields.push('status');
+    if (normalizedGate.blockers.length > 0)
+        missingFields.push('blockers');
+    if (normalizedGate.missing_fields.length > 0)
+        missingFields.push(...normalizedGate.missing_fields.map((field) => `missing_fields:${field}`));
+    if (normalizedGate.passed === true
+        && normalizedGate.terminal === true
+        && normalizedGate.status === 'passed'
+        && normalizedGate.blockers.length === 0
+        && normalizedGate.missing_fields.length === 0) {
         const action = 'allow_stop';
         const diagnostics = {
             schema: 'sks.stop-gate-diagnostics.v1',

package/dist/core/stop-gate/stop-gate-writer.js

@@ -5,7 +5,11 @@ import { setCurrent } from '../mission.js';
 export async function writeFinalStopGate(input) {
     const dir = missionDir(input.root, input.missionId);
     await ensureDir(dir);
-    const passed = input.status === 'passed';
+    const evidenceBlockers = input.status === 'passed' ? evidenceMissingBlockers(input.evidence) : [];
+    const status = evidenceBlockers.length ? 'blocked' : input.status;
+    const blockers = [...(input.blockers ?? []), ...evidenceBlockers];
+    const missingFields = [...(input.missingFields ?? []), ...evidenceBlockers.map((blocker) => `evidence:${blocker}`)];
+    const passed = status === 'passed';
     const nativeGateFile = input.nativeGateFile ?? 'naruto-gate.json';
     const nativeGatePath = path.join(dir, nativeGateFile);
     const canonicalGatePath = path.join(dir, 'stop-gate.json');
@@ -18,17 +22,55 @@ export async function writeFinalStopGate(input) {
         mission_id: input.missionId,
         gate_file: nativeGateFile,
         gate_abs_path: canonicalGatePath,
-        status: input.status,
+        status,
         passed,
-        terminal: input.terminal,
-        terminal_state: input.terminalState,
+        terminal: evidenceBlockers.length ? false : input.terminal,
+        terminal_state: evidenceBlockers.length ? 'blocked' : input.terminalState,
         evidence: input.evidence,
-        blockers: input.blockers ?? [],
-        missing_fields: input.missingFields ?? [],
+        blockers,
+        missing_fields: missingFields,
         created_at: nowIso(),
     };
-    // 1. Write route-native gate file (backwards compat)
-    await writeJsonAtomic(nativeGatePath, { ...gate, schema: 'sks.naruto-gate' });
+    // 1. Write route-native gate file (backwards compat), preserving detailed native fields by default.
+    const preserveNativeGate = input.preserveNativeGate !== false;
+    if (preserveNativeGate && await exists(nativeGatePath)) {
+        const existing = await readJson(nativeGatePath, {});
+        await writeJsonAtomic(nativeGatePath, {
+            ...existing,
+            ...(input.nativeGatePatch ?? {}),
+            route: input.route,
+            route_command: input.routeCommand,
+            mission_id: input.missionId,
+            status,
+            passed,
+            terminal: gate.terminal,
+            terminal_state: gate.terminal_state,
+            evidence: {
+                ...(existing.evidence || {}),
+                ...input.evidence
+            },
+            blockers,
+            missing_fields: missingFields,
+            updated_at: nowIso()
+        });
+    }
+    else {
+        await writeJsonAtomic(nativeGatePath, {
+            schema: nativeGateFile === 'termination.json' ? 'sks.glm-naruto-termination.v1' : 'sks.naruto-gate.v1',
+            route: input.route,
+            route_command: input.routeCommand,
+            mission_id: input.missionId,
+            status,
+            passed,
+            terminal: gate.terminal,
+            terminal_state: gate.terminal_state,
+            evidence: input.evidence,
+            blockers,
+            missing_fields: missingFields,
+            updated_at: nowIso(),
+            ...(input.nativeGatePatch ?? {})
+        });
+    }
     // 2. Write canonical stop-gate.json
     await writeJsonAtomic(canonicalGatePath, gate);
     // 3. Write stop-gate.latest.json
@@ -41,11 +83,11 @@ export async function writeFinalStopGate(input) {
         mode: input.route === 'GLM_NARUTO' ? 'NARUTO' : (input.route === 'Naruto' ? 'NARUTO' : input.route),
         stop_gate: 'stop-gate.json',
         stop_gate_abs_path: canonicalGatePath,
-        stop_gate_status: input.status,
+        stop_gate_status: status,
         stop_gate_passed: passed,
         route_evidence_passed: input.evidence.route_evidence_passed ?? passed,
-        terminal: input.terminal,
-        terminal_state: input.terminalState,
+        terminal: gate.terminal,
+        terminal_state: gate.terminal_state,
     });
     // 5. Re-read and verify
     const verifyResult = {
@@ -73,4 +115,12 @@ export async function writeFinalStopGate(input) {
     await writeJsonAtomic(verifyPath, verifyResult);
     return gate;
 }
+function evidenceMissingBlockers(evidence) {
+    const blockers = [];
+    if (evidence.proof_required === true && evidence.proof_passed !== true)
+        blockers.push('proof_not_passed');
+    if (evidence.reflection_required === true && evidence.reflection_passed !== true && evidence.reflection_passed !== 'not_required')
+        blockers.push('reflection_not_passed');
+    return blockers;
+}
 //# sourceMappingURL=stop-gate-writer.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.0.9",
+  "version": "4.0.10",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",