sneakoscope 4.1.1 → 4.2.0

package/README.md

@@ -35,15 +35,18 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.1.1** tightens the 4.1 readiness path for publishing and first-command migration. Doctor now keeps optional native surfaces route-gated, writes v2 project migration receipts tied to an installation epoch, and keeps the migration profile fast enough for update gates.
+SKS **4.2.0** stabilizes MadDB SQL-plane execution so explicit `$MAD-DB` and `sks mad-db run|exec|apply-migration` invocations use a first-class, mission-bound break-glass route instead of inheriting `$MAD-SKS` state.
 
-What changed in 4.1.1:
+What changed in 4.2.0:
+
+- **First-class MadDB route.** `$MAD-DB` no longer aliases `$MAD-SKS`; it creates one authoritative mission, capability, runtime profile, inventory check, execution, read-back, and closeout cycle.
+- **Capability v2 binding.** MadDB capabilities bind project root, project ref hash, mission/cycle/session identity, runtime profile hash, TTL, operator intent, and SQL-plane operation classes.
+- **Ephemeral Supabase write profile.** Persistent Supabase MCP config stays read-only; write-capable MCP settings exist only inside the active MadDB mission and are removed in `finally`.
+- **Exact lifecycle correlation.** Hook/result handling is keyed by canonical `tool_call_id`, uses idempotent operation state, and avoids unsafe tool-name result matching under parallel calls.
+- **Policy/docs/test SSOT.** MadDB route metadata, generated skill guidance, DB safety wording, Doctor guidance, release gates, docs, scanner coverage, and local regression tests share the typed MadDB policy surface.
+- **Release metadata truth.** Package, CLI version constants, Rust crate metadata, README, changelog, and release checks all point at 4.2.0.
 
-- **Core vs route readiness.** Computer Use and Chrome/web review are manual-required route gates, not core blockers for ordinary Doctor/update readiness.
-- **Migration receipt v2.** First-command migration writes project receipts with installation epoch, project hash, required blockers, and optional warnings so stale locks or optional capabilities do not block normal commands.
-- **Fast migration Doctor.** `sks doctor --fix --profile migration --machine-only` skips optional Codex App, Zellij, provider, native, and deep diagnostic work while preserving core readiness checks.
-- **MAD bootstrap latency.** MAD defers update prompts, provider setup, UI snapshots, pane proof, and native swarm proof until the route actually needs them.
-- **Release metadata truth.** Package, CLI version constants, Rust crate metadata, README, changelog, and release checks all point at 4.1.1.
+What changed in 4.1.1:
 
 What changed in 4.1.0:
 
@@ -504,7 +507,7 @@ sks --mad
 sks --mad --allow-package-install --allow-service-control --allow-network --yes
 ```
 
-This syncs existing codex-lb provider auth, creates/uses the `sks-mad-high` xhigh maintenance profile, opens the MAD-SKS permission gate for that Zellij run, starts a same-mission read-only native agent swarm, and launches a Codex CLI layout whose right-side lanes read that MAD ledger. Bare `sks --mad` grants target-project file and shell scope only; add explicit `--allow-*` flags for packages, services, network, Computer Use, browser use, generated assets, file permissions, DB writes, or other high-risk scopes. MAD-SKS is not a DB-only unlock: it is explicit user authorization to widen approved target-project scopes. Catastrophic database wipe/all-row/project-management safeguards remain active, and the pipeline contract still forbids unrequested fallback implementation code.
+This syncs existing codex-lb provider auth, creates/uses the `sks-mad-high` xhigh maintenance profile, opens the MAD-SKS permission gate for that Zellij run, starts a same-mission read-only native agent swarm, and launches a Codex CLI layout whose right-side lanes read that MAD ledger. Bare `sks --mad` grants target-project file and shell scope only; add explicit `--allow-*` flags for packages, services, network, Computer Use, browser use, generated assets, file permissions, DB writes, or other high-risk scopes. MAD-SKS is not a DB-only unlock and does not create a MadDB capability. Catastrophic database wipe/all-row/project-management safeguards remain active outside the first-class MadDB route, and the pipeline contract still forbids unrequested fallback implementation code.
 
 Before launching, SKS checks npm for a newer `sneakoscope` and prints a non-blocking update notice when one is available; use `sks update now` or `sks doctor --fix` when you want SKS to update itself. Use `--yes` to approve missing dependency installs automatically. Tune MAD swarm startup with `--mad-agents <n>`, `--mad-swarm-work-items <n>`, and `--mad-swarm-backend <backend>`; `--no-mad-swarm` keeps only the cockpit UI if you need a temporary fallback.
 
@@ -717,7 +720,7 @@ Use these inside Codex App or another agent prompt. They are prompt commands, no
 
 Common prompts: `$Team`, `$From-Chat-IMG`, `$with-local-llm-on`, `$with-local-llm-off`, `$DFix`, `$Answer`, `$SKS`, `$QA-LOOP`, `$PPT`, `$Computer-Use`/`$CU`, `$Goal`, `$Research`, `$AutoResearch`, `$DB`, `$MAD-SKS`, `$MAD-DB`, `$GX`, `$Wiki`, and `$Help`.
 
-`$MAD-DB` is the prompt-visible Mad-DB alias for one-cycle DB break-glass work. It maps to the same guarded MAD-SKS permission route, while the terminal lifecycle remains `sks mad-db status|enable|revoke`; it is not a permanent DB unlock and catastrophic DB safeguards remain active.
+`$MAD-DB` is the first-class MadDB SQL-plane execution route. `sks mad-db run|exec|apply-migration` creates the bound mission/capability/runtime profile, verifies Supabase `execute_sql` and `apply_migration`, executes the requested SQL-plane mutation, reads back postconditions, and then closes the write profile while proving normal read-only restoration. Supabase project/account/billing/credential control-plane actions remain denied. See `docs/mad-db.md`.
 
 ## 🔁 Common Workflows
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.1.1"
+version = "4.2.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.1.1"
+version = "4.2.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.1.1"),
+        Some("--version") => println!("sks-rs 4.2.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.1.1';
+const FAST_PACKAGE_VERSION = '4.2.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -112,7 +112,7 @@ export const COMMANDS = {
     zellij: entry('beta', 'Inspect Zellij runtime status and explain repair (no auto-install)', 'dist/commands/zellij.js', directCommand(() => import('../commands/zellij.js'), 'dist/commands/zellij.js')),
     'mad-sks': entry('beta', 'MAD-SKS scoped permission modifier', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')),
     glm: entry('beta', 'Run GLM 5.2 MAD mode through OpenRouter', 'dist/core/commands/glm-command.js', argsCommand(() => import('../core/commands/glm-command.js'), 'glmCommand', 'dist/core/commands/glm-command.js')),
-    'mad-db': entry('beta', 'Create or inspect one-cycle Mad-DB break-glass capability tokens', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')),
+    'mad-db': entry('beta', 'Run first-class MadDB SQL-plane execution cycles with mission-local Supabase write transport', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
     'dollar-commands': entry('stable', 'List Codex App dollar commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),
     'fast-mode': entry('stable', 'Toggle SKS Fast mode default for dollar-command routes', 'dist/core/commands/fast-mode-command.js', argsCommand(() => import('../core/commands/fast-mode-command.js'), 'fastModeCommand', 'dist/core/commands/fast-mode-command.js')),

package/dist/core/auto-review.js

@@ -314,7 +314,7 @@ function removeLegacyProfileConfig(text, profile) {
 function upsertAutoReviewPolicy(text) {
     const policy = [
         '[auto_review]',
-        'policy = "In MAD launches, allow live-server work, normal DB writes, Supabase MCP DB writes, direct execute SQL, schema cleanup, and migration application for the active invocation. Deny only catastrophic database wipes, all-row value deletion/update, dangerous project or branch management, credential exfiltration, persistent security weakening, broad unrelated file deletion, and unrequested fallback implementation code."'
+        'policy = "In MAD-SKS launches, allow only scoped non-MadDB high-risk work approved for the active invocation and keep catastrophic DB wipe/all-row safeguards active. In first-class MAD-DB cycles, the explicit $MAD-DB or sks mad-db run|exec|apply-migration invocation is the SQL-plane approval boundary: execute requested execute_sql/apply_migration mutations with mission-local write transport, read-back proof, and final read-only restoration. Supabase project/account/billing/credential control-plane actions remain denied."'
     ].join('\n');
     const existing = readTableString(text, 'auto_review', 'policy');
     if (existing && /unrequested fallback implementation code/i.test(existing))

package/dist/core/commands/mad-db-command.js

@@ -1,98 +1,178 @@
-import { initProject } from '../init.js';
-import { createMission, findLatestMission, setCurrent } from '../mission.js';
-import { exists, sksRoot } from '../fsx.js';
 import path from 'node:path';
-import { createMadDbCapability, isMadDbCapabilityActive, MAD_DB_ACK, readMadDbCapability, resolveMadDbMissionId, revokeMadDbCapability } from '../mad-db/mad-db-capability.js';
+import { initProject } from '../init.js';
+import { findLatestMission, setCurrent } from '../mission.js';
+import { exists, readText, sksRoot } from '../fsx.js';
+import { closeMadDbCycle, isMadDbCapabilityActive, MAD_DB_ACK, readMadDbCapability, resolveMadDbMissionId, revokeMadDbCapability } from '../mad-db/mad-db-capability.js';
+import { closeMadDbRuntimeProfile, verifyReadOnlyRestored } from '../mad-db/mad-db-runtime-profile.js';
+import { runMadDbCycle } from '../mad-db/mad-db-coordinator.js';
+import { resolveMadDbTarget } from '../mad-db/mad-db-target.js';
+import { quarantineStaleMadDbRuntimeProfiles } from '../mad-db/mad-db-recovery.js';
+import { sha256 } from '../fsx.js';
 export async function madDbCommand(args = []) {
     const action = String(args[0] && !String(args[0]).startsWith('--') ? args[0] : 'status');
     const rest = action === args[0] ? args.slice(1) : args;
     const root = await sksRoot();
     if (!(await exists(path.join(root, '.sneakoscope'))))
         await initProject(root, {});
+    if (action === 'run')
+        return runMadDb(root, rest);
+    if (action === 'exec')
+        return execMadDb(root, rest);
+    if (action === 'apply-migration')
+        return applyMigrationMadDb(root, rest);
+    if (action === 'doctor')
+        return doctorMadDb(root, rest);
+    if (action === 'close')
+        return closeMadDb(root, rest);
     if (action === 'enable')
         return enableMadDb(root, rest);
     if (action === 'revoke')
         return revokeMadDb(root, rest);
     if (action === 'status')
         return statusMadDb(root, rest);
-    console.error('Usage: sks mad-db enable --ack "I AUTHORIZE ONE-CYCLE DB BREAK-GLASS" [--mission latest|new|M-...] | status | revoke');
+    console.error('Usage: sks mad-db run "<task-or-sql>" | exec --sql "<SQL>" | apply-migration --name <name> --file <sql-file> | doctor|status|close|revoke [--json]');
     process.exitCode = 1;
 }
+async function runMadDb(root, args) {
+    const task = positionalText(args) || readOption(args, '--task', '');
+    const sql = readOption(args, '--sql', '');
+    const result = await runMadDbCycle({
+        root,
+        action: 'run',
+        task,
+        sql: sql || null,
+        verifySql: readOption(args, '--verify-sql', '') || null,
+        args
+    });
+    return printResult(result, args);
+}
+async function execMadDb(root, args) {
+    const sql = readOption(args, '--sql', '') || positionalText(args);
+    const result = await runMadDbCycle({
+        root,
+        action: 'exec',
+        task: sql || 'sks mad-db exec',
+        sql: sql || null,
+        verifySql: readOption(args, '--verify-sql', '') || null,
+        args
+    });
+    return printResult(result, args);
+}
+async function applyMigrationMadDb(root, args) {
+    const file = readOption(args, '--file', '');
+    const sql = readOption(args, '--sql', '') || (file ? await readText(path.resolve(file), '') : '');
+    const result = await runMadDbCycle({
+        root,
+        action: 'apply-migration',
+        task: `apply migration ${readOption(args, '--name', 'mad_db_migration')}`,
+        sql: sql || null,
+        migrationName: readOption(args, '--name', `mad_db_${Date.now()}`),
+        migrationFile: file || null,
+        verifySql: readOption(args, '--verify-sql', '') || null,
+        args
+    });
+    return printResult(result, args);
+}
+async function doctorMadDb(root, args) {
+    const target = await resolveMadDbTarget(root, { args });
+    const recovery = await quarantineStaleMadDbRuntimeProfiles(root);
+    const restoration = await verifyReadOnlyRestored(root, null);
+    const result = {
+        schema: 'sks.mad-db-doctor.v1',
+        ok: target.blockers.length === 0 && restoration.persistent_supabase_read_only,
+        target: { ...target, project_ref: target.project_ref ? `<hash:${target.project_ref_hash}>` : null },
+        stale_recovery: recovery,
+        read_only_restoration: restoration,
+        execute_sql_apply_migration_inventory_checked: false,
+        note: 'doctor does not open write transport; run/exec/apply-migration verifies tool inventory inside a bound cycle'
+    };
+    return printJsonOrText(result, args, result.ok ? 'MadDB doctor passed local checks.' : `MadDB doctor found blockers: ${[...target.blockers, ...restoration.blockers].join(', ')}`);
+}
 async function enableMadDb(root, args) {
     const json = hasFlag(args, '--json');
     const ack = readOption(args, '--ack', '');
     if (ack !== MAD_DB_ACK) {
-        const result = { schema: 'sks.mad-db-command.v1', ok: false, action: 'enable', reason: 'ack_phrase_required', required_ack: MAD_DB_ACK };
+        const result = { schema: 'sks.mad-db-command.v2', ok: false, action: 'enable', reason: 'deprecated_enable_no_capability', required_ack: MAD_DB_ACK, token_only: true };
         if (json)
             return console.log(JSON.stringify(result, null, 2));
-        console.error(`Mad-DB enable blocked. Required --ack ${JSON.stringify(MAD_DB_ACK)}`);
+        console.error(`MadDB enable is deprecated and does not create a capability. Use sks mad-db run|exec|apply-migration for an executable cycle. Legacy ack was ${JSON.stringify(MAD_DB_ACK)}.`);
         process.exitCode = 2;
         return result;
     }
-    const requestedMission = readOption(args, '--mission', 'latest');
-    let missionId = requestedMission === 'new' ? null : await resolveMadDbMissionId(root, {}, requestedMission);
-    if (!missionId) {
-        const created = await createMission(root, { mode: 'mad-db', prompt: 'sks mad-db enable one-cycle DB break-glass' });
-        missionId = created.id;
-    }
-    const capability = await createMadDbCapability(root, {
-        missionId,
-        ack,
-        cwd: process.cwd(),
-        ttlMs: Number(readOption(args, '--ttl-ms', String(2 * 60 * 60 * 1000)))
-    });
-    await setCurrent(root, {
-        mission_id: missionId,
-        route: 'MadDB',
-        route_command: '$MAD-DB',
-        mode: 'MADDB',
-        phase: 'MADDB_ONE_CYCLE_CAPABILITY_ACTIVE',
-        mad_db_active: true,
-        mad_db_cycle_id: capability.cycle_id,
-        mad_db_capability_file: 'mad-db-capability.json',
-        mad_db_ack_phrase: 'accepted',
-        stop_gate: 'mad-db-capability.json'
-    });
-    const result = { schema: 'sks.mad-db-command.v1', ok: true, action: 'enable', mission_id: missionId, capability };
+    const result = {
+        schema: 'sks.mad-db-command.v2',
+        ok: false,
+        action: 'enable',
+        reason: 'deprecated_enable_no_capability',
+        token_only: true,
+        executable_commands: ['sks mad-db run', 'sks mad-db exec', 'sks mad-db apply-migration']
+    };
     if (json)
         return console.log(JSON.stringify(result, null, 2));
-    console.log(`Mad-DB one-cycle capability active for ${missionId}; expires ${capability.expires_at}.`);
+    console.error('MadDB enable no longer creates a capability. Use sks mad-db run|exec|apply-migration to create the bound mission/profile/capability and execute SQL.');
+    process.exitCode = 2;
     return result;
 }
 async function statusMadDb(root, args) {
-    const json = hasFlag(args, '--json');
     const missionId = await resolveMadDbMissionId(root, {}, readOption(args, '--mission', 'latest'));
     const capability = missionId ? await readMadDbCapability(root, missionId) : null;
     const result = {
-        schema: 'sks.mad-db-command.v1',
+        schema: 'sks.mad-db-status.v2',
         ok: true,
         action: 'status',
         mission_id: missionId,
         active: isMadDbCapabilityActive(capability),
-        capability
+        capability: capability ? redactCapability(capability) : null
     };
-    if (json)
-        return console.log(JSON.stringify(result, null, 2));
-    if (!missionId || !capability)
-        console.log('Mad-DB: no capability found.');
-    else
-        console.log(`Mad-DB: ${result.active ? 'active' : 'inactive'} for ${missionId}; consumed=${capability.consumed}; expires=${capability.expires_at}.`);
-    return result;
+    return printJsonOrText(result, args, !missionId || !capability ? 'MadDB: no capability found.' : `MadDB: ${result.active ? 'active' : 'inactive'} for ${missionId}; status=${capability.status}; expires=${capability.expires_at}.`);
+}
+async function closeMadDb(root, args) {
+    const missionId = await resolveMadDbMissionId(root, {}, readOption(args, '--mission', 'latest')) || await findLatestMission(root);
+    const capability = missionId ? await readMadDbCapability(root, missionId) : null;
+    const restoration = missionId ? await closeMadDbRuntimeProfile({ root, missionId, reason: 'operator_close' }) : null;
+    const closed = missionId && capability ? await closeMadDbCycle(root, missionId, capability.cycle_id, 'operator_close') : null;
+    if (missionId)
+        await setCurrent(root, { mad_db_active: false, phase: 'MADDB_CLOSED' });
+    const result = { schema: 'sks.mad-db-close.v2', ok: Boolean(closed), action: 'close', mission_id: missionId, capability: closed ? redactCapability(closed) : null, read_only_restoration: restoration };
+    return printJsonOrText(result, args, closed ? `MadDB cycle closed for ${missionId}.` : 'MadDB: no capability to close.');
 }
 async function revokeMadDb(root, args) {
-    const json = hasFlag(args, '--json');
     const missionId = await resolveMadDbMissionId(root, {}, readOption(args, '--mission', 'latest')) || await findLatestMission(root);
     const revoked = missionId ? await revokeMadDbCapability(root, missionId, readOption(args, '--reason', 'operator_revoked')) : null;
+    const restoration = missionId ? await closeMadDbRuntimeProfile({ root, missionId, reason: 'operator_revoke' }) : null;
     await setCurrent(root, { mad_db_active: false, phase: 'MADDB_REVOKED' });
-    const result = { schema: 'sks.mad-db-command.v1', ok: Boolean(revoked), action: 'revoke', mission_id: missionId, capability: revoked };
-    if (json)
-        return console.log(JSON.stringify(result, null, 2));
-    if (!revoked)
-        console.log('Mad-DB: no capability to revoke.');
+    const result = { schema: 'sks.mad-db-command.v2', ok: Boolean(revoked), action: 'revoke', mission_id: missionId, capability: revoked ? redactCapability(revoked) : null, read_only_restoration: restoration };
+    return printJsonOrText(result, args, revoked ? `MadDB capability revoked for ${missionId}.` : 'MadDB: no capability to revoke.');
+}
+function printResult(result, args) {
+    if (hasFlag(args, '--json')) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else if (result.ok) {
+        console.log(`MadDB complete: mission=${result.mission_id} cycle=${result.cycle_id} execution=${result.execution?.ok ? 'succeeded' : 'unknown'} verification=${result.read_back?.ok === true ? 'passed' : 'not-requested'} read-only-restored=${result.read_only_restoration?.ok === true}`);
+    }
+    else {
+        console.error(`MadDB failed: mission=${result.mission_id} blockers=${(result.blockers || []).join(', ') || 'unknown'} read-only-restored=${result.read_only_restoration?.ok === true}`);
+        process.exitCode = 1;
+    }
+    return result;
+}
+function printJsonOrText(result, args, text) {
+    if (hasFlag(args, '--json'))
+        console.log(JSON.stringify(result, null, 2));
     else
-        console.log(`Mad-DB capability revoked for ${missionId}.`);
+        console.log(text);
+    if (result.ok === false)
+        process.exitCode = process.exitCode || 1;
     return result;
 }
+function redactCapability(capability) {
+    return {
+        ...capability,
+        project_ref: capability.project_ref ? `<hash:${sha256(capability.project_ref).slice(0, 16)}>` : null,
+        transport: capability.transport ? { ...capability.transport, server_url_redacted: capability.transport.server_url_redacted || '<redacted>' } : null
+    };
+}
 function hasFlag(args, flag) {
     return args.includes(flag);
 }
@@ -100,7 +180,22 @@ function readOption(args, name, fallback) {
     const index = args.indexOf(name);
     if (index >= 0 && args[index + 1] && !String(args[index + 1]).startsWith('--'))
         return String(args[index + 1]);
-    const prefixed = args.find((arg) => String(arg).startsWith(name + '='));
+    const prefixed = args.find((arg) => String(arg).startsWith(`${name}=`));
     return prefixed ? prefixed.slice(name.length + 1) : fallback;
 }
+function positionalText(args) {
+    const out = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (!arg)
+            continue;
+        if (arg.startsWith('--')) {
+            if (!arg.includes('=') && args[index + 1] && !String(args[index + 1]).startsWith('--'))
+                index += 1;
+            continue;
+        }
+        out.push(arg);
+    }
+    return out.join(' ').trim();
+}
 //# sourceMappingURL=mad-db-command.js.map

package/dist/core/commands/mad-sks-command.js

@@ -19,7 +19,6 @@ import { repairCodexConfigEperm } from '../codex/codex-config-eperm-repair.js';
 import { runCodexLaunchPreflight } from '../preflight/parallel-preflight-engine.js';
 import { diffCodexAppUiSnapshots, writeCodexAppUiSnapshot } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { checkSksUpdateNotice } from '../update/update-notice.js';
-import { createMadDbCapability, MAD_DB_ACK } from '../mad-db/mad-db-capability.js';
 import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-capability.js';
 import { writeCodex0139CapabilityArtifacts } from '../codex-control/codex-0139-capability.js';
 import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
@@ -203,38 +202,22 @@ export async function madHighCommand(args = [], deps = {}) {
         process.exitCode = 1;
         return glmRuntime;
     }
-    const madDbCapability = madDbGrant.enabled
-        ? await createMadDbCapability(madLaunch.root, { missionId: madLaunch.mission_id, ack: madDbGrant.ack, cwd: process.cwd() })
-        : null;
-    if (madDbCapability) {
+    if (madDbGrant.requested) {
         const grantReport = {
-            schema: 'sks.mad-sks-launch-grants.v1',
+            schema: 'sks.mad-sks-launch-grants.v2',
             generated_at: nowIso(),
             mission_id: madLaunch.mission_id,
             mad_sks_active: true,
-            mad_db_active: true,
-            mad_db_default_grant: madDbGrant.source === 'sks_mad_default',
+            mad_db_active: false,
+            mad_db_default_grant: false,
             mad_db_grant_source: madDbGrant.source,
-            mad_db_one_cycle_only: true,
-            mad_db_capability_file: 'mad-db-capability.json',
-            mad_db_cycle_id: madDbCapability.cycle_id,
-            mad_db_expires_at: madDbCapability.expires_at,
+            mad_db_requires_first_class_route: true,
+            mad_db_cli: 'sks mad-db run|exec|apply-migration',
+            mad_db_capability_file: null,
             standalone_mad_db_enable_still_requires_ack: true
         };
         await writeJsonAtomic(path.join(madLaunch.dir, 'mad-sks-launch-grants.json'), grantReport);
-        await setCurrent(madLaunch.root, {
-            mission_id: madLaunch.mission_id,
-            mad_db_active: true,
-            mad_db_cycle_id: madDbCapability.cycle_id,
-            mad_db_capability_file: 'mad-db-capability.json',
-            mad_db_break_glass: true,
-            mad_db_default_grant: madDbGrant.source === 'sks_mad_default',
-            mad_db_grant_source: madDbGrant.source,
-            mad_db_one_cycle_only: true,
-            mad_db_priority_override_active: true,
-            mad_sks_launch_grants_file: 'mad-sks-launch-grants.json'
-        });
-        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_db.capability_created', grant_source: madDbGrant.source, cycle_id: madDbCapability.cycle_id, expires_at: madDbCapability.expires_at });
+        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_db.first_class_route_required', grant_source: madDbGrant.source, cli: grantReport.mad_db_cli });
     }
     const updateNotice = {
         schema: 'sks.update-notice.v1',
@@ -256,11 +239,11 @@ export async function madHighCommand(args = [], deps = {}) {
     console.log(`SKS MAD ready: ${glmRuntime?.profile?.profile_name || madHighProfileName()} | gate ${madLaunch.mission_id}`);
     if (glmRuntime?.profile)
         console.log(`GLM MAD launch active: ${glmRuntime.profile.model} via OpenRouter; GPT fallback blocked.`);
-    if (madDbCapability)
-        console.log(`MAD-DB one-cycle capability active (${madDbGrant.source}); expires ${madDbCapability.expires_at}.`);
+    if (madDbGrant.requested)
+        console.log('MAD-DB flag observed; use the first-class route: sks mad-db run|exec|apply-migration.');
     if (updateNotice.update_available === true)
         console.log(`SKS update notice: ${updateNotice.latest_version} available (non-blocking).`);
-    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. MAD-DB one-cycle DB break-glass is already active for this launch; protected-core, audit, and one-cycle bounds remain.');
+    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. MAD-DB SQL-plane execution is not active in MAD-SKS; use the first-class MadDB route for DROP/TRUNCATE/all-row SQL-plane work.');
     const launchLb = lb.status === 'present' ? { ...lb, status: 'configured' } : lb;
     const madSksEnv = {
         SKS_PROTECTED_CORE_POLICY: madLaunch.gate.protected_core_policy,
@@ -411,10 +394,11 @@ function buildGlmMadLaunchOpts(cleanArgs = [], opts = {}) {
 }
 export function resolveMadLaunchMadDbGrant(args = []) {
     const list = (args || []).map((arg) => String(arg));
+    const requested = list.includes('--mad-db');
     return {
-        enabled: true,
-        source: list.includes('--mad-db') ? 'sks_mad_explicit_redundant_flag' : 'sks_mad_default',
-        ack: MAD_DB_ACK,
+        enabled: false,
+        requested,
+        source: requested ? 'mad_db_first_class_route_required' : 'not_requested',
         one_cycle_only: true
     };
 }

package/dist/core/db-safety.js

@@ -3,9 +3,10 @@ import { exists, readJson, writeJsonAtomic, readText, nowIso, appendJsonlBounded
 import { missionDir, setCurrent } from './mission.js';
 import { evaluateMadSksPermissionGate, isMadSksRouteState } from './permission-gates.js';
 import { resolveMadDbMutationPolicy } from './mad-db/mad-db-policy-resolver.js';
-import { recordMadDbOperation } from './mad-db/mad-db-capability.js';
-import { appendMadDbLedgerEvent, appendMadDbOperationLifecycle } from './mad-db/mad-db-ledger.js';
-import { lifecycleHookFromUnknown, recordPendingMadDbLifecycleHook } from './mad-db/mad-db-result-lifecycle.js';
+import { appendMadDbLedgerEvent } from './mad-db/mad-db-ledger.js';
+import { lifecycleHookFromUnknown } from './mad-db/mad-db-result-lifecycle.js';
+import { extractCanonicalToolCallId, reserveMadDbOperation, transitionMadDbOperation } from './mad-db/mad-db-operation-store.js';
+import { madDbOperationClassesFromClassification } from './mad-db/mad-db-policy.js';
 export const DEFAULT_DB_SAFETY_POLICY = Object.freeze({
     schema_version: 1,
     mode: 'read_only_default',
@@ -511,19 +512,29 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
     const madDb = await resolveMadDbMutationPolicy(root, state, classification);
     if (madDb.allowed === true && state?.mission_id) {
         const madDbDecision = madDb;
-        const operationId = `mad-db-op-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-        const sqlHash = classification.sql?.statements?.length ? sha256(String(classification.sql.statements.join('\n'))) : null;
-        await appendMadDbOperationLifecycle(root, state.mission_id, {
-            type: 'db_operation.started',
-            operationId,
-            cycleId: madDbDecision.cycle_id,
-            toolName: classification.toolName || null,
-            sqlHash,
-            destructive: classification.level === 'destructive'
+        const sqlText = classification.sql?.statements?.length ? String(classification.sql.statements.join('\n')) : null;
+        const sqlHash = sqlText ? sha256(sqlText) : null;
+        const toolCallId = extractCanonicalToolCallId(payload) || `payload-${sha256(JSON.stringify({ tool: classification.toolName || '', sqlHash, level: classification.level })).slice(0, 16)}`;
+        const operationClasses = madDbDecision.operation_classes?.length ? madDbDecision.operation_classes : madDbOperationClassesFromClassification(classification);
+        const reservation = await reserveMadDbOperation({
+            root,
+            missionId: String(state.mission_id),
+            capability: madDbDecision.capability,
+            toolCallId,
+            toolName: classification.toolName || 'unknown_database_tool',
+            sql: sqlText,
+            operationClasses
+        });
+        await transitionMadDbOperation({
+            root,
+            missionId: String(state.mission_id),
+            toolCallId,
+            state: 'started'
         });
         const lifecycleHook = {
             mission_id: String(state.mission_id),
-            operation_id: operationId,
+            operation_id: reservation.operation.operation_id,
+            tool_call_id: toolCallId,
             cycle_id: madDbDecision.cycle_id || null,
             tool_name: classification.toolName || null,
             sql_hash: sqlHash,
@@ -538,35 +549,22 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
             mad_db: {
                 active: true,
                 priority: 'highest',
+                capability_schema: 'sks.mad-db-capability.v2',
                 one_cycle_only: true,
                 cycle_id: madDbDecision.cycle_id,
                 capability_file: 'mad-db-capability.json',
-                consumed: false,
-                operation_id: operationId,
+                status: reservation.capability.status,
+                operation_id: reservation.operation.operation_id,
+                tool_call_id: toolCallId,
+                tool_call_id_missing: extractCanonicalToolCallId(payload) === null,
                 lifecycle_result_pending: true,
                 ledger_result_hook: lifecycleHook,
-                operation_count: Number(madDbDecision.operation_count || 0) + 1,
-                max_operations: madDbDecision.max_operations || 20
+                operation_classes: operationClasses,
+                counters: reservation.capability.counters,
+                idempotent_reservation_reused: reservation.reused
             }
         };
-        await appendMadDbLedgerEvent(root, state.mission_id, { type: 'db_mutation.allowed', cycle_id: madDbDecision.cycle_id, mode: madDbDecision.mode, classification, operation_id: operationId });
-        await appendMadDbOperationLifecycle(root, state.mission_id, {
-            type: 'db_operation.allowed',
-            operationId,
-            cycleId: madDbDecision.cycle_id,
-            toolName: classification.toolName || null,
-            sqlHash,
-            destructive: classification.level === 'destructive',
-            resultStatus: 'unknown_pending_tool_result'
-        });
-        const updatedCapability = await recordMadDbOperation(root, state.mission_id, {
-            operationId,
-            ...(classification.toolName ? { toolName: classification.toolName } : {}),
-            ...(sqlHash ? { sqlHash } : {})
-        });
-        decision.mad_db.consumed = updatedCapability?.consumed === true;
-        decision.mad_db.operation_count = updatedCapability?.operation_count ?? decision.mad_db.operation_count;
-        await recordPendingMadDbLifecycleHook(root, state.mission_id, lifecycleHook);
+        await appendMadDbLedgerEvent(root, state.mission_id, { type: 'db_mutation.allowed', cycle_id: madDbDecision.cycle_id, mode: madDbDecision.mode, classification, operation_id: reservation.operation.operation_id, tool_call_id: toolCallId });
         await appendJsonlBounded(path.join(missionDir(root, state.mission_id), 'db-safety.jsonl'), { ts: nowIso(), decision });
         return decision;
     }
@@ -605,8 +603,8 @@ export function dbBlockReason(decision) {
     return [
         'Sneakoscope Codex Database Safety Gate blocked this operation.',
         `Reasons: ${(decision.reasons || []).join(', ') || 'unknown'}.`,
-        'Destructive database operations are never allowed. Production writes are forbidden. Supabase/Postgres MCP write tools must not be used for live destructive changes.',
-        'Use read-only/project-scoped Supabase MCP URLs, create migration files, and apply them only to local or preview/branch environments when explicitly allowed by the sealed contract.'
+        'Default DB mode is read-only. Destructive SQL-plane operations require an explicit active MadDB v2 capability opened by $MAD-DB or sks mad-db run|exec|apply-migration.',
+        'Use read-only/project-scoped Supabase MCP URLs outside MadDB. Supabase project/account/billing/credential control-plane operations remain denied even in MadDB.'
     ].join(' ');
 }
 export async function scanDbSafety(root, opts = {}) {

package/dist/core/doctor/supabase-mcp-repair.js

@@ -40,8 +40,8 @@ export async function repairSupabaseMcp(input) {
         manual_required: manualRequired,
         next_action: manualRequired
             ? tokenEnvPresent
-                ? 'Set Supabase MCP to read-only or explicitly approve write-scoped MCP use.'
-                : 'Set SUPABASE_ACCESS_TOKEN only if Supabase write MCP features are required; otherwise keep Supabase MCP disabled/read-only.'
+                ? 'Set persistent Supabase MCP to read-only. Write-scoped Supabase MCP is allowed only through a mission-local MadDB runtime profile.'
+                : 'Set SUPABASE_ACCESS_TOKEN only when an explicit MadDB run needs Supabase MCP auth; otherwise keep persistent Supabase MCP disabled/read-only.'
             : null,
         blockers: readyBlocking ? ['supabase_mcp_write_access_not_safe_by_default'] : [],
         warnings: [

package/dist/core/feature-registry.js

@@ -871,7 +871,7 @@ function routeKnownGaps(command) {
     if (command === '$MAD-SKS')
         return ['permission closed by owning gate'];
     if (command === '$MAD-DB')
-        return ['one-cycle capability must be explicitly enabled, consumed, or revoked'];
+        return ['active cycle must execute requested SQL-plane work, read back postconditions, and close the mission-local write profile'];
     return [];
 }
 function checkRow(id, ok, blockers = []) {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.1.1';
+export const PACKAGE_VERSION = '4.2.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {