sneakoscope 4.1.1 → 4.2.0

package/dist/scripts/mad-db-operation-lifecycle-blackbox.js

@@ -6,21 +6,21 @@ import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
 import { recordMadDbToolResult } from '../core/mad-db/mad-db-result-lifecycle.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-lifecycle-blackbox-'));
-const missionId = 'M-mad-db-lifecycle-blackbox';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const success = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'lifecycle blackbox fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const success = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-success-call', sql: 'insert into audit_log(id) values (1)' });
 const successHook = madDbLifecycleHookFromDecision(success);
 assertGate(Boolean(successHook), 'success hook missing', success);
-await recordMadDbToolResult({ root, missionId, hook: successHook, ok: true, rowCount: 1 });
-const failure = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'update users set flag = true where id = 1' });
+await recordMadDbToolResult({ root, missionId: mission.id, hook: successHook, ok: true, rowCount: 1 });
+const failure = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-failure-call', sql: 'update users set flag = true where id = 1' });
 const failureHook = madDbLifecycleHookFromDecision(failure);
 assertGate(Boolean(failureHook), 'failure hook missing', failure);
-await recordMadDbToolResult({ root, missionId, hook: failureHook, ok: false, error: 'fixture failure' });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
-for (const token of ['db_operation.started', 'db_operation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
+await recordMadDbToolResult({ root, missionId: mission.id, hook: failureHook, ok: false, error: 'fixture failure' });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+for (const token of ['db_operation.started', 'db_mutation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
     assertGate(ledger.includes(token), `Mad-DB ledger missing ${token}`, { ledger });
 }
 assertGate((ledger.match(/db_operation\.succeeded/g) || []).length === 1, 'success terminal event must be recorded exactly once', { ledger });

package/dist/scripts/mad-db-operation-lifecycle-ledger-check.js

@@ -5,13 +5,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
 import { checkDbOperation } from '../core/db-safety.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-ledger-'));
-const missionId = 'M-mad-db-ledger';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
-assertGate(ledger.includes('db_operation.started') && ledger.includes('db_operation.allowed') && ledger.includes('unknown_pending_tool_result'), 'Mad-DB lifecycle ledger events missing', { ledger });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'ledger fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'ledger-call-1', sql: 'insert into audit_log(id) values (1)' });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+assertGate(ledger.includes('db_operation.reserved') && ledger.includes('db_operation.started') && ledger.includes('db_mutation.allowed') && !ledger.includes('unknown_pending_tool_result'), 'Mad-DB lifecycle ledger events missing or pending-latest fallback still present', { ledger });
 emitGate('mad-db:operation-lifecycle-ledger');
 //# sourceMappingURL=mad-db-operation-lifecycle-ledger-check.js.map

package/dist/scripts/mad-db-parallel-lifecycle-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { reserveMadDbOperation, transitionMadDbOperation } from '../core/mad-db/mad-db-operation-store.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-parallel-lifecycle-'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'parallel lifecycle fixture' });
+const cap = await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const [first, second] = await Promise.all([
+    reserveMadDbOperation({ root, missionId: mission.id, capability: cap, toolCallId: 'parallel-call-a', toolName: 'supabase.execute_sql', sql: 'insert into fixture values (1)', operationClasses: ['insert'] }),
+    reserveMadDbOperation({ root, missionId: mission.id, capability: cap, toolCallId: 'parallel-call-b', toolName: 'supabase.execute_sql', sql: 'update fixture set id = 2', operationClasses: ['all_row_update'] })
+]);
+await Promise.all([
+    transitionMadDbOperation({ root, missionId: mission.id, toolCallId: 'parallel-call-b', state: 'failed', errorCode: 'fixture_parallel_failure' }),
+    transitionMadDbOperation({ root, missionId: mission.id, toolCallId: 'parallel-call-a', state: 'succeeded', result: { ok: true } })
+]);
+const capAfter = await readMadDbCapability(root, mission.id);
+assertGate(first.operation.operation_id !== second.operation.operation_id, 'parallel calls must not collide by tool name', { first, second });
+assertGate(Boolean(capAfter) && capAfter.counters.reserved === 2 && capAfter.counters.succeeded === 1 && capAfter.counters.failed === 1, 'parallel lifecycle counters must track exact call ids', capAfter || {});
+emitGate('mad-db:parallel-lifecycle', { first: first.operation.operation_id, second: second.operation.operation_id, counters: capAfter.counters });
+//# sourceMappingURL=mad-db-parallel-lifecycle-check.js.map

package/dist/scripts/mad-db-policy-v2-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { MAD_DB_POLICY, isMadDbControlPlaneDeniedTool, isMadDbSqlPlaneToolName, madDbOperationClassesFromClassification } from '../core/mad-db/mad-db-policy.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+for (const operation of ['drop', 'all_row_delete', 'truncate', 'migration_apply', 'direct_execute_sql']) {
+    assertGate(MAD_DB_POLICY.sql_plane_allowed.includes(operation), `policy missing ${operation}`, MAD_DB_POLICY);
+}
+assertGate(isMadDbSqlPlaneToolName('mcp__supabase_mad_db__execute_sql') === true, 'execute_sql variants must be SQL-plane tools');
+assertGate(isMadDbSqlPlaneToolName('supabase.apply_migration') === true, 'apply_migration variants must be SQL-plane tools');
+assertGate(isMadDbControlPlaneDeniedTool('supabase.delete_project') === true, 'project control-plane delete must remain denied');
+assertGate(isMadDbControlPlaneDeniedTool('supabase.billing_update') === true, 'billing control-plane updates must remain denied');
+const classes = madDbOperationClassesFromClassification({
+    toolName: 'supabase.execute_sql',
+    level: 'destructive',
+    sql: { reasons: ['truncate', 'delete_without_where', 'alter_table_drop'], statements: ['truncate public.fixture;', 'delete from public.fixture;', 'alter table public.fixture drop column old_col;'] }
+});
+for (const operation of ['direct_execute_sql', 'truncate', 'all_row_delete', 'drop']) {
+    assertGate(classes.includes(operation), `classification must map ${operation}`, { classes });
+}
+emitGate('mad-db:policy-v2', { classes });
+//# sourceMappingURL=mad-db-policy-v2-check.js.map

package/dist/scripts/mad-db-priority-resolver-check.js

@@ -11,10 +11,10 @@ const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: '
 const state = { mission_id: mission.id };
 const denied = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', sql: 'drop table users;' });
 assertGate(denied.allowed === false, 'without Mad-DB capability destructive DB must be blocked', denied);
-await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
-const allowed = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', sql: 'drop table users;' });
+await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const allowed = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', tool_call_id: 'priority-drop-table', sql: 'drop table users;' });
 assertGate(allowed.allowed === true && allowed.mad_db?.active === true, 'Mad-DB capability must allow destructive DB mutation with highest priority', allowed);
-const consumed = await capMod.readMadDbCapability(root, mission.id);
-assertGate(consumed.consumed === false && consumed.operation_count === 1, 'Mad-DB capability must remain active during bounded one-cycle after first operation', consumed);
-emitGate('mad-db:priority-resolver', { cycle_id: consumed.cycle_id });
+const after = await capMod.readMadDbCapability(root, mission.id);
+assertGate(after.status === 'active' && after.counters.reserved === 1, 'Mad-DB capability must remain active and reserve exactly one operation', after);
+emitGate('mad-db:priority-resolver', { cycle_id: after.cycle_id, reserved: after.counters.reserved });
 //# sourceMappingURL=mad-db-priority-resolver-check.js.map

package/dist/scripts/mad-db-real-supabase-e2e.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { MAD_DB_ACK, closeMadDbCycle, createMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { MadDbMcpExecutor } from '../core/mad-db/mad-db-executor.js';
+import { createMadDbRuntimeProfile, closeMadDbRuntimeProfile } from '../core/mad-db/mad-db-runtime-profile.js';
+import { emitGate } from './sks-1-18-gate-lib.js';
+const requireReal = process.argv.includes('--require-real');
+const projectRef = process.env.SKS_MAD_DB_E2E_PROJECT_REF || process.env.SKS_MAD_DB_PROJECT_REF || '';
+const hasAuth = Boolean(process.env.SUPABASE_ACCESS_TOKEN || process.env.SKS_MAD_DB_SUPABASE_ACCESS_TOKEN);
+if (!projectRef || !hasAuth) {
+    const detail = {
+        status: 'unverified',
+        require_real: requireReal,
+        missing_project_ref: !projectRef,
+        missing_supabase_access_token: !hasAuth,
+        required_env: ['SKS_MAD_DB_E2E_PROJECT_REF', 'SUPABASE_ACCESS_TOKEN or SKS_MAD_DB_SUPABASE_ACCESS_TOKEN']
+    };
+    console.error(JSON.stringify({ schema: 'sks.mad-db-real-e2e.v1', ok: false, ...detail }, null, 2));
+    process.exit(requireReal ? 2 : 0);
+}
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-real-e2e-'));
+await fs.mkdir(path.join(root, '.codex'), { recursive: true });
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), `[mcp_servers.supabase]\nurl = "https://mcp.supabase.com/mcp?project_ref=${projectRef}&read_only=true"\n`);
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'real disposable Supabase MadDB E2E' });
+const cycleId = `real-e2e-${Date.now().toString(36)}`;
+const profile = await createMadDbRuntimeProfile({ root, missionId: mission.id, cycleId, projectRef, runtimeSessionId: 'real-e2e-session' });
+await createMadDbCapability(root, {
+    missionId: mission.id,
+    ack: MAD_DB_ACK,
+    cwd: root,
+    cycleId,
+    projectRef,
+    runtimeSessionId: 'real-e2e-session',
+    profilePath: profile.profile_path,
+    profileSha256: profile.profile_sha256,
+    serverUrlRedacted: profile.server_url_redacted,
+    status: 'active'
+});
+const executor = new MadDbMcpExecutor(profile, { timeoutMs: Number(process.env.SKS_MAD_DB_E2E_TIMEOUT_MS || 120000) });
+const suffix = Date.now().toString(36).replace(/[^a-z0-9]/g, '');
+const table = `sks_mad_db_e2e_${suffix}`;
+const migrationName = `sks_mad_db_e2e_migration_${suffix}`;
+const steps = [
+    {
+        name: 'create_table',
+        tool: 'execute_sql',
+        sql: `create table public.${table} (id integer primary key, label text not null);`,
+        verify: `select case when to_regclass('public.${table}') is not null then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'add_column',
+        tool: 'execute_sql',
+        sql: `alter table public.${table} add column note text;`,
+        verify: `select case when exists (select 1 from information_schema.columns where table_schema='public' and table_name='${table}' and column_name='note') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'insert',
+        tool: 'execute_sql',
+        sql: `insert into public.${table} (id, label, note) values (1, 'alpha', 'inserted');`,
+        verify: `select case when (select count(*) from public.${table}) = 1 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'update',
+        tool: 'execute_sql',
+        sql: `update public.${table} set label = 'beta' where id = 1;`,
+        verify: `select case when exists (select 1 from public.${table} where id=1 and label='beta') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'targeted_delete',
+        tool: 'execute_sql',
+        sql: `delete from public.${table} where id = 1;`,
+        verify: `select case when (select count(*) from public.${table}) = 0 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'all_row_delete',
+        tool: 'execute_sql',
+        sql: `insert into public.${table} (id, label) values (2, 'two'), (3, 'three'); delete from public.${table};`,
+        verify: `select case when (select count(*) from public.${table}) = 0 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'truncate',
+        tool: 'execute_sql',
+        sql: `insert into public.${table} (id, label) values (4, 'four'), (5, 'five'); truncate table public.${table};`,
+        verify: `select case when (select count(*) from public.${table}) = 0 then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'drop_column',
+        tool: 'execute_sql',
+        sql: `alter table public.${table} add column drop_me text; alter table public.${table} drop column drop_me;`,
+        verify: `select case when not exists (select 1 from information_schema.columns where table_schema='public' and table_name='${table}' and column_name='drop_me') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'migration_apply',
+        tool: 'apply_migration',
+        sql: `alter table public.${table} add column migrated_flag boolean default false;`,
+        verify: `select case when exists (select 1 from information_schema.columns where table_schema='public' and table_name='${table}' and column_name='migrated_flag') then 1 else 1/0 end as ok;`
+    },
+    {
+        name: 'drop_table',
+        tool: 'execute_sql',
+        sql: `drop table public.${table};`,
+        verify: `select case when to_regclass('public.${table}') is null then 1 else 1/0 end as ok;`
+    }
+];
+const timings = [];
+const matrix = [];
+let inventory = null;
+let restoration = null;
+let failure = null;
+try {
+    inventory = await executor.inventory();
+    if (inventory.ok !== true)
+        throw failureDetail('real Supabase MCP inventory must expose execute_sql and apply_migration', inventory);
+    for (const step of steps) {
+        const started = Date.now();
+        const result = step.tool === 'apply_migration'
+            ? await executor.applyMigration(`${migrationName}_${step.name}`, step.sql)
+            : await executor.executeSql(step.sql);
+        const verify = await executor.executeSql(step.verify);
+        const elapsed = Date.now() - started;
+        timings.push(elapsed);
+        matrix.push({ name: step.name, tool: step.tool, execute_ok: result.ok, verify_ok: verify.ok, duration_ms: elapsed, result_digest: result.result_digest, verify_digest: verify.result_digest });
+        if (result.ok !== true || verify.ok !== true)
+            throw failureDetail(`real MadDB E2E step failed: ${step.name}`, matrix[matrix.length - 1]);
+    }
+}
+catch (err) {
+    failure = err?.detail || { message: err?.message || String(err) };
+}
+finally {
+    await executor.close();
+    restoration = await closeMadDbRuntimeProfile({ root, missionId: mission.id, profile, reason: 'real_e2e_finally' });
+    await closeMadDbCycle(root, mission.id, cycleId, 'real_e2e_finally');
+}
+if (failure) {
+    console.error(JSON.stringify({
+        schema: 'sks.mad-db-real-e2e.v1',
+        ok: false,
+        status: 'failed_real_supabase',
+        project_ref_hash: profile.project_ref_hash,
+        failure,
+        destructive_operation_matrix: matrix,
+        read_only_restoration: restoration
+    }, null, 2));
+    process.exit(1);
+}
+timings.sort((a, b) => a - b);
+const percentile = (p) => timings.length ? timings[Math.min(timings.length - 1, Math.floor((timings.length - 1) * p))] : 0;
+emitGate('mad-db:real-e2e', {
+    status: 'passed_real_supabase',
+    project_ref_hash: profile.project_ref_hash,
+    table_hash: table.slice(-10),
+    inventory: { execute_sql_available: inventory?.execute_sql_available === true, apply_migration_available: inventory?.apply_migration_available === true, tool_count: inventory?.tool_names?.length || 0 },
+    destructive_operation_matrix: matrix,
+    timings_ms: { p50: percentile(0.5), p95: percentile(0.95), max: timings[timings.length - 1] || 0 },
+    read_only_restoration: restoration
+});
+function failureDetail(message, detail) {
+    const err = new Error(message);
+    err.detail = { message, detail };
+    return err;
+}
+//# sourceMappingURL=mad-db-real-supabase-e2e.js.map

package/dist/scripts/mad-db-route-identity-check.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { routeByDollarCommand } from '../core/routes.js';
+import { closeMadDbCycle, isMadDbCapabilityActive } from '../core/mad-db/mad-db-capability.js';
+import { closeMadDbRuntimeProfile } from '../core/mad-db/mad-db-runtime-profile.js';
+import { madDbRouteIdentityProof, prepareMadDbMission } from '../core/mad-db/mad-db-coordinator.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-route-identity-'));
+const prepared = await prepareMadDbMission({
+    root,
+    task: '$MAD-DB truncate public.fixture',
+    args: ['--project-ref', 'fixture-project-ref', '--target', 'preview'],
+    verifyTools: false,
+    runtimeSessionId: 'route-identity-session'
+});
+const proof = await madDbRouteIdentityProof(root, prepared.mission_id);
+assertGate(routeByDollarCommand('MAD-DB')?.id === 'MadDB', '$MAD-DB must resolve to first-class MadDB route', routeByDollarCommand('MAD-DB'));
+assertGate(routeByDollarCommand('MAD-SKS')?.id === 'MadSKS', '$MAD-SKS must remain the scoped permission route', routeByDollarCommand('MAD-SKS'));
+assertGate(prepared.ok === true && prepared.capability.mission_id === prepared.mission_id, 'MadDB prepare must create one authoritative mission/capability', prepared);
+assertGate(prepared.capability.runtime_session_id === 'route-identity-session' && prepared.capability.transport.profile_sha256 === prepared.runtime_profile.profile_sha256, 'capability must bind the runtime profile hash/session', prepared.capability);
+assertGate(isMadDbCapabilityActive(prepared.capability) === true, 'prepared capability must be active/transport-ready', prepared.capability);
+assertGate(proof.ok === true && proof.same_mission === true && proof.route_command === '$MAD-DB', 'route identity proof mismatch', proof);
+await closeMadDbRuntimeProfile({ root, missionId: prepared.mission_id, reason: 'route_identity_check' });
+await closeMadDbCycle(root, prepared.mission_id, prepared.cycle_id, 'route_identity_check');
+emitGate('mad-db:route-identity', { mission_id: prepared.mission_id, cycle_id: prepared.cycle_id, profile_sha256: prepared.runtime_profile.profile_sha256 });
+//# sourceMappingURL=mad-db-route-identity-check.js.map

package/dist/scripts/mad-db-runtime-profile-lifecycle-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { createMadDbRuntimeProfile, closeMadDbRuntimeProfile, verifyReadOnlyRestored } from '../core/mad-db/mad-db-runtime-profile.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-runtime-profile-'));
+await fs.mkdir(path.join(root, '.codex'), { recursive: true });
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), [
+    '[mcp_servers.supabase]',
+    'url = "https://mcp.supabase.com/mcp?project_ref=fixture-project-ref&read_only=true"',
+    ''
+].join('\n'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'runtime profile fixture' });
+const profile = await createMadDbRuntimeProfile({ root, missionId: mission.id, cycleId: 'runtime-profile-cycle', projectRef: 'fixture-project-ref', runtimeSessionId: 'runtime-profile-session' });
+const profileText = await fs.readFile(path.join(root, profile.profile_path), 'utf8');
+const beforeClose = await verifyReadOnlyRestored(root, profile.normal_config_hash_before, path.join(root, profile.profile_path));
+const proof = await closeMadDbRuntimeProfile({ root, missionId: mission.id, profile, reason: 'runtime_profile_lifecycle_check' });
+assertGate(profileText.includes('features=database') && !profileText.includes('read_only=true'), 'runtime profile must be write-capable and database-scoped', { profileText });
+assertGate(beforeClose.ok === false && beforeClose.blockers.includes('runtime_write_profile_still_exists'), 'open runtime profile must be detected before close', beforeClose);
+assertGate(proof.ok === true && proof.persistent_supabase_read_only === true && proof.runtime_profile_exists === false, 'close must remove profile and prove persistent read-only restoration', proof);
+emitGate('mad-db:runtime-profile', { profile_sha256: profile.profile_sha256, restoration_ok: proof.ok });
+//# sourceMappingURL=mad-db-runtime-profile-lifecycle-check.js.map

package/dist/scripts/mad-db-safety-conflict-matrix-check.js

@@ -12,11 +12,11 @@ const madSksState = { mission_id: mission.id, mode: 'MADSKS', mad_sks_active: tr
 fs.writeFileSync(path.join(mission.dir, 'mad-sks-gate.json'), JSON.stringify({ passed: false, permissions_deactivated: false }, null, 2));
 const catastrophic = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', sql: 'truncate users;' });
 assertGate(catastrophic.allowed === false && catastrophic.reasons.includes('mad_sks_catastrophic_db_operation_blocked'), 'MAD-SKS catastrophic guard must remain without Mad-DB', catastrophic);
-await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
-const breakGlass = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', sql: 'truncate users;' });
+await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const breakGlass = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', tool_call_id: 'matrix-truncate-active', sql: 'truncate users;' });
 assertGate(breakGlass.allowed === true && breakGlass.mad_db?.active === true, 'Mad-DB must override DB mutation guard only while active', breakGlass);
 await capMod.consumeMadDbCapability(root, mission.id, { consumedBy: 'fixture-cycle-close' });
-const afterConsume = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', sql: 'truncate users;' });
+const afterConsume = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', tool_call_id: 'matrix-truncate-closed', sql: 'truncate users;' });
 assertGate(afterConsume.allowed === false, 'after bounded cycle close, MAD-SKS catastrophic guard must block again', afterConsume);
 emitGate('mad-db:safety-conflict-matrix', { states: ['mad-sks-blocks', 'mad-db-allows-cycle', 'mad-sks-blocks-after-cycle-close'] });
 //# sourceMappingURL=mad-db-safety-conflict-matrix-check.js.map

package/dist/scripts/mad-db-skill-policy-snapshot-check.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { MAD_DB_POLICY, dbSafetyGuardSkillText, madDbSkillText } from '../core/mad-db/mad-db-policy.js';
+import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+const madDbSkill = madDbSkillText();
+const dbSafetySkill = dbSafetyGuardSkillText();
+const initText = readText('src/core/init.ts');
+for (const token of ['table/schema DROP', 'all-row mutations', 'TRUNCATE', 'execute_sql', 'apply_migration']) {
+    assertGate(madDbSkill.includes(token), `MadDB skill SSOT missing ${token}`, { madDbSkill });
+}
+assertGate(dbSafetySkill.includes('Active MadDB is the explicit exception'), 'db safety skill must name active MadDB exception', { dbSafetySkill });
+assertGate(!madDbSkill.includes('Keep catastrophic safeguards active: whole database/schema/table removal'), 'MadDB skill must not carry old destructive-operation denial text', { madDbSkill });
+assertGate(initText.includes('madDbSkillText()') && initText.includes('dbSafetyGuardSkillText()'), 'init must generate skills from typed MadDB policy SSOT', {});
+assertGate(MAD_DB_POLICY.active_mode.sql_plane === 'allow_all_mutations' && MAD_DB_POLICY.normal_supabase_mcp.read_only_required === true, 'typed policy must encode active SQL-plane and normal read-only modes', MAD_DB_POLICY);
+emitGate('mad-db:skill-policy', { schema: MAD_DB_POLICY.schema, operation_classes: MAD_DB_POLICY.sql_plane_allowed.length });
+//# sourceMappingURL=mad-db-skill-policy-snapshot-check.js.map

package/dist/scripts/release-dag-full-coverage-check.js

@@ -113,6 +113,12 @@ const requiredReleasePresetIds = [
     'team:legacy-create-removed',
     'mad-db:one-cycle-bounded',
     'mad-db:operation-lifecycle-ledger',
+    'mad-db:route-identity',
+    'mad-db:hook-idempotency',
+    'mad-db:parallel-lifecycle',
+    'mad-db:runtime-profile',
+    'mad-db:skill-policy',
+    'mad-db:policy-v2',
     'parallel:strict-pid-proof',
     'parallel:missing-pid-rejection',
     'scheduler:utilization-integral',

package/dist/scripts/release-triwiki-first-runner-blackbox.js

@@ -27,7 +27,11 @@ const result = await dag.runReleaseGateDag({ root: tmp, preset: 'confidence', ch
 assertGate(result.triwiki_selection_used === true, 'TriWiki selection must be marked used', result);
 assertGate(result.selected_gate_ids.includes('triwiki:proof-card'), 'TriWiki graph must select the TriWiki gate', result.selected_gate_ids);
 assertGate(!result.selected_gate_ids.includes('scheduler:resource-budget'), 'unaffected scheduler gate must be skipped by TriWiki selection', result);
-emitGate('release:triwiki-first-runner-blackbox', { selected: result.selected_gate_ids, skipped: result.triwiki_skipped_gates });
+const rootSurfaceResult = await dag.runReleaseGateDag({ root: tmp, preset: 'affected', changedFiles: ['package.json'], noCache: true });
+assertGate(rootSurfaceResult.triwiki_selection_used === false, 'root release surface changes should use focused affected selector instead of expensive TriWiki graph', rootSurfaceResult);
+assertGate(rootSurfaceResult.selected_gate_ids.includes('release:version-truth'), 'root release surface should keep release safety gate', rootSurfaceResult.selected_gate_ids);
+assertGate(!rootSurfaceResult.selected_gate_ids.includes('scheduler:resource-budget'), 'root release surface affected selector should not full-sweep unrelated scheduler gate', rootSurfaceResult.selected_gate_ids);
+emitGate('release:triwiki-first-runner-blackbox', { selected: result.selected_gate_ids, skipped: result.triwiki_skipped_gates, root_surface_selected: rootSurfaceResult.selected_gate_ids });
 function gate(id, inputs) {
     return {
         id,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -174,7 +174,7 @@
     "fast:codex-service-tier-proof": "node ./dist/scripts/fast-codex-service-tier-proof-check.js",
     "codex:project-config-policy-splitter": "node ./dist/scripts/codex-project-config-policy-splitter-check.js",
     "test:no-orphan-dist-imports": "node ./dist/scripts/test-no-orphan-dist-imports-check.js",
-    "packcheck": "find bin test -name '*.mjs' -print0 | xargs -0 -n1 node --check && npm run runtime:no-src-mjs",
+    "packcheck": "for d in bin test; do [ -d \"$d\" ] && find \"$d\" -name '*.mjs' -print0; done | xargs -0 -n1 node --check && npm run runtime:no-src-mjs",
     "changelog:check": "node ./dist/scripts/changelog-check.js",
     "cli-entrypoint:check": "node ./dist/scripts/check-cli-entrypoint.js",
     "legacy-free:check": "node ./dist/scripts/check-legacy-free.js",
@@ -362,7 +362,7 @@
     "release:publish": "npm run publish:npm",
     "publish:dry": "npm run release:metadata && npm run release:version-truth && npm run publish:packlist-performance && npm run release:check:full && node ./dist/scripts/check-publish-tag.js && node ./dist/scripts/release-check-stamp.js verify && npm run release:provenance -- --publish && npm run release:dist-freshness && node ./dist/scripts/release-registry-check.js --require-unpublished && npm --cache /tmp/sks-npm-cache publish --dry-run --ignore-scripts --registry https://registry.npmjs.org/ --access public",
     "publish:npm": "npm --cache /tmp/sks-npm-cache publish --registry https://registry.npmjs.org/ --access public",
-    "publish:fast": "npm run build && npm --cache /tmp/sks-npm-cache publish --ignore-scripts --registry https://registry.npmjs.org/ --access public",
+    "publish:fast": "node -e \"console.error('publish:fast is quarantined; use publish:dry and publish:npm with the release gates.'); process.exit(1)\"",
     "prepack": "npm run build",
     "prepublishOnly": "npm run release:metadata && npm run release:version-truth && npm run release:dist-freshness && npm run publish:packlist-performance && node ./dist/scripts/prepublish-release-check-or-fast.js && node ./dist/scripts/check-publish-tag.js && node ./dist/scripts/release-check-stamp.js verify && npm run release:provenance -- --publish && node ./dist/scripts/release-registry-check.js --require-unpublished --require-publish-auth",
     "dist:check": "node ./dist/scripts/check-dist-runtime.js",
@@ -719,6 +719,12 @@
     "team:legacy-create-removed": "node ./dist/scripts/team-legacy-create-removed-check.js",
     "mad-db:one-cycle-bounded": "node ./dist/scripts/mad-db-one-cycle-bounded-check.js",
     "mad-db:operation-lifecycle-ledger": "node ./dist/scripts/mad-db-operation-lifecycle-ledger-check.js",
+    "mad-db:route-identity": "node ./dist/scripts/mad-db-route-identity-check.js",
+    "mad-db:hook-idempotency": "node ./dist/scripts/mad-db-hook-idempotency-check.js",
+    "mad-db:parallel-lifecycle": "node ./dist/scripts/mad-db-parallel-lifecycle-check.js",
+    "mad-db:runtime-profile": "node ./dist/scripts/mad-db-runtime-profile-lifecycle-check.js",
+    "mad-db:skill-policy": "node ./dist/scripts/mad-db-skill-policy-snapshot-check.js",
+    "mad-db:policy-v2": "node ./dist/scripts/mad-db-policy-v2-check.js",
     "release:speed-summary": "node ./dist/scripts/release-speed-summary-check.js",
     "release:speed-summary:check": "node ./dist/scripts/release-speed-summary-check.js",
     "naruto:ssot-routing": "node ./dist/scripts/naruto-ssot-routing-check.js",
@@ -752,6 +758,10 @@
     "mad-db:lifecycle-hook-decision": "node ./dist/scripts/mad-db-lifecycle-hook-decision-check.js",
     "mad-db:mcp-result-lifecycle": "node ./dist/scripts/mad-db-mcp-result-lifecycle-check.js",
     "mad-db:operation-lifecycle-blackbox": "node ./dist/scripts/mad-db-operation-lifecycle-blackbox.js",
+    "mad-db:unit": "npm run mad-db:capability && npm run mad-db:command && npm run mad-db:mad-command && npm run mad-db:priority-resolver && npm run mad-db:ledger && npm run mad-db:one-cycle-consumption && npm run mad-db:safety-conflict-matrix && npm run mad-db:one-cycle-bounded && npm run mad-db:operation-lifecycle-ledger && npm run mad-db:route-identity && npm run mad-db:hook-idempotency && npm run mad-db:parallel-lifecycle && npm run mad-db:runtime-profile && npm run mad-db:skill-policy && npm run mad-db:policy-v2 && npm run mad-db:lifecycle-hook-decision && npm run mad-db:mcp-result-lifecycle && npm run mad-db:operation-lifecycle-blackbox",
+    "mad-db:real-e2e": "node ./dist/scripts/mad-db-real-supabase-e2e.js --require-real",
+    "mad-db:all": "npm run build && npm run mad-db:unit",
+    "mad-db:release": "npm run mad-db:all && npm run mad-db:real-e2e",
     "runtime:proof-summary": "node ./dist/scripts/runtime-proof-summary-check.js",
     "runtime:proof-summary-cli": "node ./dist/scripts/runtime-proof-summary-cli-check.js",
     "codex-app:launcher": "node ./dist/scripts/codex-app-launcher-check.js",

package/schemas/mad-db/mad-db-capability.schema.json

@@ -1,31 +1,104 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "sks.mad-db-capability.v1",
+  "$id": "sks.mad-db-capability.v2",
   "type": "object",
-  "required": ["schema", "mission_id", "cycle_id", "enabled", "created_at", "expires_at", "one_cycle_only", "priority", "scope", "operator_ack", "consumed"],
+  "required": [
+    "schema",
+    "revision",
+    "mission_id",
+    "cycle_id",
+    "project_root_hash",
+    "project_ref",
+    "target_environment",
+    "allowed_schemas",
+    "runtime_session_id",
+    "operator_intent_hash",
+    "operator_ack_hash",
+    "scope",
+    "transport",
+    "issued_at",
+    "expires_at",
+    "closed_at",
+    "status",
+    "counters"
+  ],
   "properties": {
-    "schema": { "const": "sks.mad-db-capability.v1" },
+    "schema": { "const": "sks.mad-db-capability.v2" },
+    "revision": { "type": "integer", "minimum": 1 },
     "mission_id": { "type": "string", "pattern": "^M-" },
-    "cycle_id": { "type": "string" },
-    "enabled": { "type": "boolean" },
-    "created_at": { "type": "string" },
-    "expires_at": { "type": "string" },
-    "one_cycle_only": { "const": true },
-    "priority": { "const": "highest" },
-    "scope": { "const": "all_database_mutations" },
-    "operator_ack": {
+    "cycle_id": { "type": "string", "pattern": "^mad-db-" },
+    "project_root_hash": { "type": "string", "minLength": 8 },
+    "project_ref": { "type": "string", "minLength": 1 },
+    "target_environment": { "enum": ["local", "branch", "preview", "production"] },
+    "allowed_schemas": { "type": "array", "items": { "type": "string" } },
+    "codex_thread_id": { "type": ["string", "null"] },
+    "runtime_session_id": { "type": "string", "minLength": 1 },
+    "operator_intent_hash": { "type": "string", "minLength": 8 },
+    "operator_ack_hash": { "type": "string", "minLength": 8 },
+    "scope": {
+      "type": "object",
+      "required": ["sql_plane", "control_plane", "operations"],
+      "properties": {
+        "sql_plane": { "const": "all_mutations" },
+        "control_plane": { "const": "deny" },
+        "operations": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "create",
+              "alter",
+              "drop",
+              "drop_database_sql",
+              "insert",
+              "update",
+              "delete",
+              "all_row_update",
+              "all_row_delete",
+              "truncate",
+              "migration_apply",
+              "direct_execute_sql",
+              "rls_policy_change",
+              "function_or_trigger_change",
+              "index_change",
+              "unknown_sql_mutation"
+            ]
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "transport": {
       "type": "object",
-      "required": ["phrase", "accepted_at", "cwd"],
+      "required": ["profile_path", "profile_sha256", "server_url_redacted", "features", "write_capable"],
       "properties": {
-        "phrase": { "const": "I AUTHORIZE ONE-CYCLE DB BREAK-GLASS" },
-        "accepted_at": { "type": "string" },
-        "cwd": { "type": "string" }
+        "profile_path": { "type": "string", "minLength": 1 },
+        "profile_sha256": { "type": "string", "minLength": 8 },
+        "server_url_redacted": { "type": "string", "minLength": 1 },
+        "features": {
+          "type": "array",
+          "prefixItems": [{ "const": "database" }],
+          "minItems": 1,
+          "maxItems": 1
+        },
+        "write_capable": { "const": true }
       },
-      "additionalProperties": true
+      "additionalProperties": false
     },
-    "consumed": { "type": "boolean" },
-    "consumed_at": { "type": ["string", "null"] },
-    "consumed_by": { "type": ["string", "null"] }
+    "issued_at": { "type": "string" },
+    "expires_at": { "type": "string" },
+    "closed_at": { "type": ["string", "null"] },
+    "status": { "enum": ["issued", "transport_ready", "active", "closing", "closed", "revoked", "expired", "quarantined"] },
+    "counters": {
+      "type": "object",
+      "required": ["attempts", "reserved", "succeeded", "failed"],
+      "properties": {
+        "attempts": { "type": "integer", "minimum": 0 },
+        "reserved": { "type": "integer", "minimum": 0 },
+        "succeeded": { "type": "integer", "minimum": 0 },
+        "failed": { "type": "integer", "minimum": 0 }
+      },
+      "additionalProperties": false
+    }
   },
   "additionalProperties": true
 }