sneakoscope 4.1.1 → 4.2.1

package/dist/core/commands/mad-sks-command.js

@@ -19,7 +19,6 @@ import { repairCodexConfigEperm } from '../codex/codex-config-eperm-repair.js';
 import { runCodexLaunchPreflight } from '../preflight/parallel-preflight-engine.js';
 import { diffCodexAppUiSnapshots, writeCodexAppUiSnapshot } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { checkSksUpdateNotice } from '../update/update-notice.js';
-import { createMadDbCapability, MAD_DB_ACK } from '../mad-db/mad-db-capability.js';
 import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-capability.js';
 import { writeCodex0139CapabilityArtifacts } from '../codex-control/codex-0139-capability.js';
 import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
@@ -203,38 +202,22 @@ export async function madHighCommand(args = [], deps = {}) {
         process.exitCode = 1;
         return glmRuntime;
     }
-    const madDbCapability = madDbGrant.enabled
-        ? await createMadDbCapability(madLaunch.root, { missionId: madLaunch.mission_id, ack: madDbGrant.ack, cwd: process.cwd() })
-        : null;
-    if (madDbCapability) {
+    if (madDbGrant.requested) {
         const grantReport = {
-            schema: 'sks.mad-sks-launch-grants.v1',
+            schema: 'sks.mad-sks-launch-grants.v2',
             generated_at: nowIso(),
             mission_id: madLaunch.mission_id,
             mad_sks_active: true,
-            mad_db_active: true,
-            mad_db_default_grant: madDbGrant.source === 'sks_mad_default',
+            mad_db_active: false,
+            mad_db_default_grant: false,
             mad_db_grant_source: madDbGrant.source,
-            mad_db_one_cycle_only: true,
-            mad_db_capability_file: 'mad-db-capability.json',
-            mad_db_cycle_id: madDbCapability.cycle_id,
-            mad_db_expires_at: madDbCapability.expires_at,
+            mad_db_requires_first_class_route: true,
+            mad_db_cli: 'sks mad-db run|exec|apply-migration',
+            mad_db_capability_file: null,
             standalone_mad_db_enable_still_requires_ack: true
         };
         await writeJsonAtomic(path.join(madLaunch.dir, 'mad-sks-launch-grants.json'), grantReport);
-        await setCurrent(madLaunch.root, {
-            mission_id: madLaunch.mission_id,
-            mad_db_active: true,
-            mad_db_cycle_id: madDbCapability.cycle_id,
-            mad_db_capability_file: 'mad-db-capability.json',
-            mad_db_break_glass: true,
-            mad_db_default_grant: madDbGrant.source === 'sks_mad_default',
-            mad_db_grant_source: madDbGrant.source,
-            mad_db_one_cycle_only: true,
-            mad_db_priority_override_active: true,
-            mad_sks_launch_grants_file: 'mad-sks-launch-grants.json'
-        });
-        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_db.capability_created', grant_source: madDbGrant.source, cycle_id: madDbCapability.cycle_id, expires_at: madDbCapability.expires_at });
+        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_db.first_class_route_required', grant_source: madDbGrant.source, cli: grantReport.mad_db_cli });
     }
     const updateNotice = {
         schema: 'sks.update-notice.v1',
@@ -256,11 +239,11 @@ export async function madHighCommand(args = [], deps = {}) {
     console.log(`SKS MAD ready: ${glmRuntime?.profile?.profile_name || madHighProfileName()} | gate ${madLaunch.mission_id}`);
     if (glmRuntime?.profile)
         console.log(`GLM MAD launch active: ${glmRuntime.profile.model} via OpenRouter; GPT fallback blocked.`);
-    if (madDbCapability)
-        console.log(`MAD-DB one-cycle capability active (${madDbGrant.source}); expires ${madDbCapability.expires_at}.`);
+    if (madDbGrant.requested)
+        console.log('MAD-DB flag observed; use the first-class route: sks mad-db run|exec|apply-migration.');
     if (updateNotice.update_available === true)
         console.log(`SKS update notice: ${updateNotice.latest_version} available (non-blocking).`);
-    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. MAD-DB one-cycle DB break-glass is already active for this launch; protected-core, audit, and one-cycle bounds remain.');
+    console.log('Scoped high-power maintenance authority active; add explicit --allow-* flags for packages, services, network, browser/Computer Use, generated assets, file permissions, or system/admin scopes. MAD-DB SQL-plane execution is not active in MAD-SKS; use the first-class MadDB route for DROP/TRUNCATE/all-row SQL-plane work.');
     const launchLb = lb.status === 'present' ? { ...lb, status: 'configured' } : lb;
     const madSksEnv = {
         SKS_PROTECTED_CORE_POLICY: madLaunch.gate.protected_core_policy,
@@ -411,10 +394,11 @@ function buildGlmMadLaunchOpts(cleanArgs = [], opts = {}) {
 }
 export function resolveMadLaunchMadDbGrant(args = []) {
     const list = (args || []).map((arg) => String(arg));
+    const requested = list.includes('--mad-db');
     return {
-        enabled: true,
-        source: list.includes('--mad-db') ? 'sks_mad_explicit_redundant_flag' : 'sks_mad_default',
-        ack: MAD_DB_ACK,
+        enabled: false,
+        requested,
+        source: requested ? 'mad_db_first_class_route_required' : 'not_requested',
         one_cycle_only: true
     };
 }

package/dist/core/commands/qa-loop-command.js

@@ -17,6 +17,8 @@ import { runCodexAppHandoff, qaLoopShouldRequestAppHandoff } from '../codex-app/
 import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-capability.js';
 import { writeCodexAccountUsageArtifacts } from '../usage/codex-account-usage.js';
 import { buildQaLoopBudgetPolicy, selectQaLoopEscalatedEffort } from '../qa-loop/qa-loop-budget-policy.js';
+import { initializeQaRuntimeArtifacts } from '../qa-loop/qa-runtime-artifacts.js';
+import { DEFAULT_QA_MAX_CYCLES, QA_SURFACE_SELECTION_ARTIFACT } from '../qa-loop/qa-types.js';
 import { writeCodexModelEffortCapabilityArtifact } from '../codex-control/codex-model-capabilities.js';
 import { discoverImageArtifactsInDir, writeImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
 import { pluginAppTemplatePolicy } from '../codex-plugins/codex-plugin-json.js';
@@ -41,7 +43,7 @@ export async function qaLoopCommand(sub, args = []) {
 Usage:
   sks qa-loop prepare "target"
   sks qa-loop answer <mission-id|latest> <answers.json>
-  sks qa-loop run <mission-id|latest> [--mock] [--max-cycles N] [--app-handoff] [--app-handoff-required] [--app-handoff-launch] [--app-handoff-artifact-only]
+  sks qa-loop run <mission-id|latest> [--mock] [--max-cycles N] [--surface auto|codex_in_app_browser|codex_chrome_extension|codex_computer_use] [--report-only] [--app-handoff] [--app-handoff-required] [--app-handoff-launch] [--app-handoff-artifact-only]
   sks qa-loop app-confirm <mission-id|latest> --verdict pass|fail --notes "..."
   sks qa-loop status <mission-id|latest> [--desktop]
 `);
@@ -126,6 +128,17 @@ async function qaLoopRun(args) {
         await writeQaLoopArtifacts(dir, mission, contract);
     else
         await ensureQaLoopVisualEvidenceContract(dir, mission, contract);
+    const requestedSurface = readFlagValue(args, '--surface', 'auto');
+    const reportOnly = flag(args, '--report-only');
+    await initializeQaRuntimeArtifacts(dir, {
+        ...contract,
+        prompt: mission.prompt || contract.prompt,
+        mission_id: id
+    }, {
+        missionId: id,
+        requestedSurface,
+        reportOnly
+    }).catch(() => null);
     const safetyScan = await scanDbSafety(root);
     if (!safetyScan.ok) {
         console.error('QA-LOOP cannot run: SKS safety scan found unsafe project data-tool configuration.');
@@ -133,7 +146,7 @@ async function qaLoopRun(args) {
         process.exitCode = 2;
         return;
     }
-    const fallbackCycles = Number.parseInt(contract.answers?.MAX_QA_CYCLES, 10) || 8;
+    const fallbackCycles = Number.parseInt(contract.answers?.MAX_QA_CYCLES, 10) || DEFAULT_QA_MAX_CYCLES;
     const maxCycles = readMaxCycles(args, fallbackCycles);
     const requestedAgents = readBoundedIntegerFlag(args, '--agents', 3, 1, 20);
     const targetActiveSlots = readBoundedIntegerFlag(args, '--target-active-slots', requestedAgents, 1, 20);
@@ -141,15 +154,18 @@ async function qaLoopRun(args) {
     const minimumWorkItems = readBoundedIntegerFlag(args, '--minimum-work-items', targetActiveSlots, 1, 200);
     const maxQueueExpansion = readBoundedIntegerFlag(args, '--max-queue-expansion', 10, 0, 200);
     const profile = readFlagValue(args, '--profile', 'sks-logic-high') || 'sks-logic-high';
-    const writeMode = readFlagValue(args, '--write-mode', flag(args, '--parallel-write') ? 'parallel' : 'off');
-    const applyPatches = flag(args, '--apply-patches');
+    const mock = flag(args, '--mock');
+    const sourceFixesEnabled = !reportOnly;
+    const writeMode = readFlagValue(args, '--write-mode', sourceFixesEnabled && !mock ? (flag(args, '--parallel-write') ? 'parallel' : 'proof-safe') : 'off');
+    const applyPatches = sourceFixesEnabled && !mock && !flag(args, '--no-fix');
     const dryRunPatches = flag(args, '--dry-run-patches') || flag(args, '--dryrun-patches');
     const maxWriteAgents = readBoundedIntegerFlag(args, '--max-write-agents', Math.min(requestedAgents, 5), 1, 20);
-    const mock = flag(args, '--mock');
     const qaGate = await readJson(path.join(dir, 'qa-gate.json'), {});
     const reportFile = qaGate.qa_report_file;
     const executionProfile = await readJson(path.join(dir, 'qa-loop', 'execution-profile.json'), null);
     const uiRequired = qaUiRequired(contract.answers || {});
+    const surfaceSelection = await readJson(path.join(dir, QA_SURFACE_SELECTION_ARTIFACT), null);
+    const selectedSurface = surfaceSelection?.selected_surface || null;
     const gptImage2ReviewRequired = qaGptImage2AnnotatedReviewRequired(contract, mission.prompt);
     const capabilityArtifact = await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch((err) => ({ error: err?.message || String(err), report: null }));
     const usageArtifact = await writeCodexAccountUsageArtifacts(root, { missionId: id }).catch((err) => ({ error: err?.message || String(err), snapshot: null }));
@@ -246,7 +262,7 @@ async function qaLoopRun(args) {
             return;
         }
     }
-    if (uiRequired && !mock) {
+    if (uiRequired && !mock && selectedSurface === 'codex_chrome_extension') {
         const chrome = await codexChromeExtensionStatus();
         if (!chrome.ok) {
             const blockedGate = {
@@ -277,7 +293,7 @@ async function qaLoopRun(args) {
             await setCurrent(root, { mission_id: id, mode: 'QALOOP', phase: 'QALOOP_BLOCKED_CHROME_EXTENSION_SETUP_REQUIRED', questions_allowed: true });
             if (flag(args, '--json'))
                 return console.log(JSON.stringify({ schema: 'sks.qa-loop-run.v1', ok: false, status: 'blocked', blocker: 'codex_chrome_extension_setup_required', mission_id: id, chrome_extension: chrome, gate: blockedGate }, null, 2));
-            console.error('QA-LOOP blocked: install/enable the Codex Chrome Extension first, then tell SKS installation is complete before resuming.');
+            console.error('QA-LOOP blocked: this journey was routed to @Chrome, but the Codex Chrome Extension is not connected. Install/enable it, then resume.');
             console.error(chrome.docs_url);
             process.exitCode = 2;
             return;

package/dist/core/db-safety.js

@@ -3,9 +3,10 @@ import { exists, readJson, writeJsonAtomic, readText, nowIso, appendJsonlBounded
 import { missionDir, setCurrent } from './mission.js';
 import { evaluateMadSksPermissionGate, isMadSksRouteState } from './permission-gates.js';
 import { resolveMadDbMutationPolicy } from './mad-db/mad-db-policy-resolver.js';
-import { recordMadDbOperation } from './mad-db/mad-db-capability.js';
-import { appendMadDbLedgerEvent, appendMadDbOperationLifecycle } from './mad-db/mad-db-ledger.js';
-import { lifecycleHookFromUnknown, recordPendingMadDbLifecycleHook } from './mad-db/mad-db-result-lifecycle.js';
+import { appendMadDbLedgerEvent } from './mad-db/mad-db-ledger.js';
+import { lifecycleHookFromUnknown } from './mad-db/mad-db-result-lifecycle.js';
+import { extractCanonicalToolCallId, reserveMadDbOperation, transitionMadDbOperation } from './mad-db/mad-db-operation-store.js';
+import { madDbOperationClassesFromClassification } from './mad-db/mad-db-policy.js';
 export const DEFAULT_DB_SAFETY_POLICY = Object.freeze({
     schema_version: 1,
     mode: 'read_only_default',
@@ -511,19 +512,29 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
     const madDb = await resolveMadDbMutationPolicy(root, state, classification);
     if (madDb.allowed === true && state?.mission_id) {
         const madDbDecision = madDb;
-        const operationId = `mad-db-op-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-        const sqlHash = classification.sql?.statements?.length ? sha256(String(classification.sql.statements.join('\n'))) : null;
-        await appendMadDbOperationLifecycle(root, state.mission_id, {
-            type: 'db_operation.started',
-            operationId,
-            cycleId: madDbDecision.cycle_id,
-            toolName: classification.toolName || null,
-            sqlHash,
-            destructive: classification.level === 'destructive'
+        const sqlText = classification.sql?.statements?.length ? String(classification.sql.statements.join('\n')) : null;
+        const sqlHash = sqlText ? sha256(sqlText) : null;
+        const toolCallId = extractCanonicalToolCallId(payload) || `payload-${sha256(JSON.stringify({ tool: classification.toolName || '', sqlHash, level: classification.level })).slice(0, 16)}`;
+        const operationClasses = madDbDecision.operation_classes?.length ? madDbDecision.operation_classes : madDbOperationClassesFromClassification(classification);
+        const reservation = await reserveMadDbOperation({
+            root,
+            missionId: String(state.mission_id),
+            capability: madDbDecision.capability,
+            toolCallId,
+            toolName: classification.toolName || 'unknown_database_tool',
+            sql: sqlText,
+            operationClasses
+        });
+        await transitionMadDbOperation({
+            root,
+            missionId: String(state.mission_id),
+            toolCallId,
+            state: 'started'
         });
         const lifecycleHook = {
             mission_id: String(state.mission_id),
-            operation_id: operationId,
+            operation_id: reservation.operation.operation_id,
+            tool_call_id: toolCallId,
             cycle_id: madDbDecision.cycle_id || null,
             tool_name: classification.toolName || null,
             sql_hash: sqlHash,
@@ -538,35 +549,22 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
             mad_db: {
                 active: true,
                 priority: 'highest',
+                capability_schema: 'sks.mad-db-capability.v2',
                 one_cycle_only: true,
                 cycle_id: madDbDecision.cycle_id,
                 capability_file: 'mad-db-capability.json',
-                consumed: false,
-                operation_id: operationId,
+                status: reservation.capability.status,
+                operation_id: reservation.operation.operation_id,
+                tool_call_id: toolCallId,
+                tool_call_id_missing: extractCanonicalToolCallId(payload) === null,
                 lifecycle_result_pending: true,
                 ledger_result_hook: lifecycleHook,
-                operation_count: Number(madDbDecision.operation_count || 0) + 1,
-                max_operations: madDbDecision.max_operations || 20
+                operation_classes: operationClasses,
+                counters: reservation.capability.counters,
+                idempotent_reservation_reused: reservation.reused
             }
         };
-        await appendMadDbLedgerEvent(root, state.mission_id, { type: 'db_mutation.allowed', cycle_id: madDbDecision.cycle_id, mode: madDbDecision.mode, classification, operation_id: operationId });
-        await appendMadDbOperationLifecycle(root, state.mission_id, {
-            type: 'db_operation.allowed',
-            operationId,
-            cycleId: madDbDecision.cycle_id,
-            toolName: classification.toolName || null,
-            sqlHash,
-            destructive: classification.level === 'destructive',
-            resultStatus: 'unknown_pending_tool_result'
-        });
-        const updatedCapability = await recordMadDbOperation(root, state.mission_id, {
-            operationId,
-            ...(classification.toolName ? { toolName: classification.toolName } : {}),
-            ...(sqlHash ? { sqlHash } : {})
-        });
-        decision.mad_db.consumed = updatedCapability?.consumed === true;
-        decision.mad_db.operation_count = updatedCapability?.operation_count ?? decision.mad_db.operation_count;
-        await recordPendingMadDbLifecycleHook(root, state.mission_id, lifecycleHook);
+        await appendMadDbLedgerEvent(root, state.mission_id, { type: 'db_mutation.allowed', cycle_id: madDbDecision.cycle_id, mode: madDbDecision.mode, classification, operation_id: reservation.operation.operation_id, tool_call_id: toolCallId });
         await appendJsonlBounded(path.join(missionDir(root, state.mission_id), 'db-safety.jsonl'), { ts: nowIso(), decision });
         return decision;
     }
@@ -605,8 +603,8 @@ export function dbBlockReason(decision) {
     return [
         'Sneakoscope Codex Database Safety Gate blocked this operation.',
         `Reasons: ${(decision.reasons || []).join(', ') || 'unknown'}.`,
-        'Destructive database operations are never allowed. Production writes are forbidden. Supabase/Postgres MCP write tools must not be used for live destructive changes.',
-        'Use read-only/project-scoped Supabase MCP URLs, create migration files, and apply them only to local or preview/branch environments when explicitly allowed by the sealed contract.'
+        'Default DB mode is read-only. Destructive SQL-plane operations require an explicit active MadDB v2 capability opened by $MAD-DB or sks mad-db run|exec|apply-migration.',
+        'Use read-only/project-scoped Supabase MCP URLs outside MadDB. Supabase project/account/billing/credential control-plane operations remain denied even in MadDB.'
     ].join(' ');
 }
 export async function scanDbSafety(root, opts = {}) {

package/dist/core/doctor/supabase-mcp-repair.js

@@ -40,8 +40,8 @@ export async function repairSupabaseMcp(input) {
         manual_required: manualRequired,
         next_action: manualRequired
             ? tokenEnvPresent
-                ? 'Set Supabase MCP to read-only or explicitly approve write-scoped MCP use.'
-                : 'Set SUPABASE_ACCESS_TOKEN only if Supabase write MCP features are required; otherwise keep Supabase MCP disabled/read-only.'
+                ? 'Set persistent Supabase MCP to read-only. Write-scoped Supabase MCP is allowed only through a mission-local MadDB runtime profile.'
+                : 'Set SUPABASE_ACCESS_TOKEN only when an explicit MadDB run needs Supabase MCP auth; otherwise keep persistent Supabase MCP disabled/read-only.'
             : null,
         blockers: readyBlocking ? ['supabase_mcp_write_access_not_safe_by_default'] : [],
         warnings: [

package/dist/core/feature-registry.js

@@ -871,7 +871,7 @@ function routeKnownGaps(command) {
     if (command === '$MAD-SKS')
         return ['permission closed by owning gate'];
     if (command === '$MAD-DB')
-        return ['one-cycle capability must be explicitly enabled, consumed, or revoked'];
+        return ['active cycle must execute requested SQL-plane work, read back postconditions, and close the mission-local write profile'];
     return [];
 }
 function checkRow(id, ok, blockers = []) {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.1.1';
+export const PACKAGE_VERSION = '4.2.1';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/hooks-runtime.js

@@ -590,7 +590,7 @@ function clarificationAnswerToolAllowed(payload = {}) {
         return true;
     if (/\bpipeline\s+answer\b/i.test(command))
         return true;
-    return !/\b(npm|git|selftest|packcheck|release:check|publish:dry|publish:npm|doctor|team|qa-loop|wiki|db|test)\b/i.test(command);
+    return !/\b(npm|git|selftest|packcheck|release:check|publish:dry|publish:ignore-scripts|publish:npm|doctor|team|qa-loop|wiki|db|test)\b/i.test(command);
 }
 function payloadMentionsAnswersJson(payload = {}) {
     try {

package/dist/core/init.js

@@ -13,6 +13,7 @@ import { CODEX_HOOK_EVENT_STATE_KEYS } from './codex-compat/codex-hook-events.js
 import { codexCommandHookCurrentHash } from './codex-hooks/codex-hook-hash.js';
 import { buildSksCoreSkillManifest, isCoreSkillName } from './codex-native/core-skill-manifest.js';
 import { syncCoreSkillsIntegrity } from './codex-native/core-skill-integrity.js';
+import { dbSafetyGuardSkillText, madDbSkillText } from './mad-db/mad-db-policy.js';
 const REFLECTION_MEMORY_PATH = '.sneakoscope/memory/q2_facts/post-route-reflection.md';
 const SKS_GENERATED_GIT_PATTERNS = [
     '.sneakoscope/missions/',
@@ -351,7 +352,7 @@ export async function initProject(root, opts = {}) {
                 state: 'git-common-dir/sks-version-state.json'
             }
         },
-        database_safety: 'default_safe; $MAD-SKS scoped permission profile is centralized in src/core/permission-gates.ts (emitted as dist/core/permission-gates.js) and keeps catastrophic safeguards active',
+        database_safety: 'default_safe; $MAD-SKS scoped permission profile keeps catastrophic safeguards active; first-class $MAD-DB is the explicit SQL-plane execution exception with mission-local write transport and read-back proof',
         gx_renderer: 'deterministic_svg_html'
     };
     await writeJsonAtomic(manifestPath, manifest);
@@ -826,7 +827,7 @@ export async function initProject(root, opts = {}) {
             // them relocated into the home config by the splitter, re-triggering the warning.
             {
                 table: 'auto_review',
-                text: '[auto_review]\npolicy = "In MAD launches, allow live-server work, normal DB writes, Supabase MCP DB writes, direct execute SQL, schema cleanup, and migration application for the active invocation. Deny only catastrophic database wipes, all-row value deletion/update, dangerous project or branch management, credential exfiltration, persistent security weakening, broad unrelated file deletion, and unrequested fallback implementation code."'
+                text: '[auto_review]\npolicy = "In MAD-SKS launches, allow only the scoped non-MadDB high-risk surfaces approved for the active invocation and keep catastrophic DB wipe/all-row safeguards active. In first-class MAD-DB cycles, the explicit $MAD-DB or sks mad-db run|exec|apply-migration invocation is the SQL-plane approval boundary: execute requested execute_sql/apply_migration mutations with mission-local write transport, read-back proof, and final read-only restoration. Supabase project/account/billing/credential control-plane actions remain denied."'
             }
         ];
     }
@@ -1058,7 +1059,7 @@ export async function installSkills(root) {
         'research': `---\nname: research\ndescription: Dollar-command route for $Research or $research frontier discovery workflows.\n---\n\nUse when the user invokes $Research/$research or asks for research, hypotheses, new mechanisms, falsification, or testable predictions. Prefer sks research prepare and sks research run. Research is not an implementation route: do not edit repository source, docs, package metadata, generated skills, or harness files; write only route-local mission artifacts under .sneakoscope/missions/<mission-id>/. Run the genius-lens agent council with named persona-inspired cognitive roles: Einstein Agent, Feynman Agent, Turing Agent, von Neumann Agent, and Skeptic Agent. These are lenses only; do not impersonate the historical people. Every Research agent ledger row must include display_name, persona, persona_boundary, effort=xhigh, reasoning_effort=xhigh, service_tier when available, one literal "Eureka!" idea, falsifiers, cheap_probes, and challenge_or_response before synthesis. This is not a fixed three-cycle route: repeat source gathering, Eureka ideas, evidence-bound debate, falsification, and synthesis pressure until every agent records final agreement, or until the explicit max-cycle safety cap pauses with an unpassed gate. Create research-source-skill.md as a route-local Skill Creator artifact, then maximize layered public web/source search across latest papers, official/government or leading-institution data, standards/primary docs, current news, public discourse, developer/practitioner sources, traditional background sources, and counterevidence before synthesis. Record research-source-skill.md, source-ledger.json, agent-ledger.json, debate-ledger.json, novelty-ledger.json, falsification-ledger.json, research-report.md, research-paper.md, genius-opinion-summary.md, and research-gate.json. debate-ledger.json must include consensus_iterations, unanimous_consensus, and per-agent agreements; research-gate.json cannot pass until unanimous_consensus=true with every agent agreement recorded. Context7 is optional and only needed when the research topic depends on external package/API/framework docs; do not use it as the default research evidence layer. Normal Research may take one or two hours when needed; favor real source collection, cross-layer comparison, falsification, and a concise paper manuscript over speed. Do not use --mock except for selftests or dry harness checks; if live source execution is unavailable, record a blocker and keep the gate unpassed. Do not use for ordinary code edits.\n`,
         'autoresearch': `---\nname: autoresearch\ndescription: Dollar-command route for $AutoResearch or $autoresearch iterative experiment loops.\n---\n\nUse for $AutoResearch, iterative improvement, SEO/GEO, ranking, workflow, benchmark, or experiments. Define program, hypothesis, experiment, metric, keep/discard, falsification, next step, and Honest Mode. Load seo-geo-optimizer for README/npm/GitHub/schema/AI-search work.\n`,
         'db': `---\nname: db\ndescription: Dollar-command route for $DB or $db database and Supabase safety checks.\n---\n\nUse when the user invokes $DB/$db or the task touches SQL, Supabase, Postgres, migrations, Prisma, Drizzle, Knex, MCP database tools, or production data. Run or follow sks db policy, sks db scan, sks db classify, and sks db check. Destructive database operations remain forbidden.\n`,
-        'mad-db': `---\nname: mad-db\ndescription: One-cycle Mad-DB break-glass route alias for $MAD-DB and $mad-db database safety work.\n---\n\nUse only when the user explicitly invokes $MAD-DB/$mad-db or asks for Mad-DB visibility. Treat it as a DB safety route with one-cycle break-glass controls, not as a general permanent DB unlock. Prefer \`sks mad-db status --json\` for inspection, \`sks mad-db enable --ack "I AUTHORIZE ONE-CYCLE DB BREAK-GLASS" [--mission latest|new|M-...] --json\` only after explicit user authorization, and \`sks mad-db revoke --mission <id|latest> --json\` to close the cycle. Keep catastrophic safeguards active: whole database/schema/table removal, truncate, all-row delete/update, reset, dangerous project/branch management, credential exfiltration, persistent security weakening, and unrequested fallback implementation remain blocked. Pair with db-safety-guard, Context7 evidence when external DB/API docs are involved, route-local reflection, and Honest Mode.\n`,
+        'mad-db': `${madDbSkillText()}\n`,
         'mad-sks': `---\nname: mad-sks\ndescription: Explicit high-risk authorization modifier for $MAD-SKS scoped permission widening across approved target-project surfaces.\n---\n\nUse only when the user explicitly invokes $MAD-SKS or top-level sks --mad. It can be combined with another route, such as $MAD-SKS $Team or $DB ... $MAD-SKS; in that case the other command remains the primary workflow and MAD-SKS is only the temporary permission grant. The widened permission applies only while the active mission gate is open, must be deactivated when the task ends, and can open approved scopes such as target-project file writes, shell commands, package installs, local service control, network operations, browser/Computer Use workflows, generated assets, file permissions, migrations, Supabase MCP database writes, column/schema cleanup, direct execute SQL, and normal targeted DB writes. Keep catastrophic safeguards active: whole database/schema/table removal, truncate, all-row delete/update, reset, dangerous project/branch management, credential exfiltration, persistent security weakening, destructive delete without explicit confirmation, and unrequested fallback implementation remain blocked. Do not carry MAD-SKS permission into later prompts or routes. The permission profile source is centralized in src/core/permission-gates.ts and emitted as dist/core/permission-gates.js so skill/hook/MCP-style gates share one decision function.\n`,
         'gx': `---\nname: gx\ndescription: Dollar-command route for $GX or $gx deterministic GX visual context cartridges.\n---\n\nUse when the user invokes $GX/$gx or asks for architecture/context visualization through SKS. Prefer sks gx init, render, validate, drift, and snapshot. vgraph.json remains the source of truth.\n`,
         'help': `---\nname: help\ndescription: Dollar-command route for $Help or $help explaining installed SKS commands and workflows.\n---\n\nUse when the user invokes $Help/$help or asks what commands exist. Prefer concise output from sks commands, sks usage <topic>, sks quickstart, sks aliases, and sks codex-app.\n`,
@@ -1073,7 +1074,7 @@ export async function installSkills(root) {
         'autoresearch-loop': `---\nname: autoresearch-loop\ndescription: Iterative AutoResearch-style loop for open-ended improvement, discovery, prompt, ranking, SEO/GEO, and workflow-quality tasks.\n---\n\nUse for research, ranking, prompt/workflow improvement, benchmark gains, or repeated refinement. Loop: program, hypothesis, smallest falsifying experiment, metric, keep/discard, falsify, next step. Keep a ledger and do not claim improvement without evidence.\n`,
         'hproof-claim-ledger': `---\nname: hproof-claim-ledger\ndescription: Extract atomic claims and classify support status.\n---\n\nEvery factual statement must become an atomic claim. Unsupported critical claims cannot be used for implementation or final answer. Database claims require DB safety evidence.\n`,
         'hproof-evidence-bind': `---\nname: hproof-evidence-bind\ndescription: Bind claims to code, tests, decision contract, vgraph, beta, wiki, or GX render evidence.\n---\n\nEvidence priority: current code/tests, decision-contract.json, vgraph.json, beta.json, GX snapshot/render metadata, LLM Wiki coordinate index, user prompt. Database claims must respect .sneakoscope/db-safety.json. Wiki claims should carry id, hash, source path, and RGBA/trig coordinate anchors so they can be hydrated instead of treated as unsupported summaries.\n`,
-        'db-safety-guard': `---\nname: db-safety-guard\ndescription: Enforce Sneakoscope Codex database safety before using SQL, Supabase MCP, Postgres, Prisma, Drizzle, Knex, or migration commands.\n---\n\nRules:\n- Never run DROP, TRUNCATE, mass DELETE/UPDATE, db reset, db push, project deletion, branch reset/merge/delete, or RLS-disabling operations.\n- Supabase MCP must be read-only and project-scoped by default.\n- Live writes through execute_sql are blocked; use migration files and only local/preview branches if explicitly allowed.\n- Production writes are forbidden.\n- If unsure, read-only only.\n`,
+        'db-safety-guard': `${dbSafetyGuardSkillText()}\n`,
         'gx-visual-generate': `---\nname: gx-visual-generate\ndescription: Render a deterministic SVG/HTML visual sheet from vgraph.json and beta.json.\n---\n\nUse sks gx render. vgraph.json is source of truth; renders embed source hash and RGBA wiki anchors.\n`,
         'gx-visual-read': `---\nname: gx-visual-read\ndescription: Read a Sneakoscope Codex deterministic visual sheet and produce context notes.\n---\n\nExtract nodes, edges, invariants, tests, risks, uncertainties, and RGBA anchors from source/render/snapshot. Do not infer hidden nodes.\n`,
         'gx-visual-validate': `---\nname: gx-visual-validate\ndescription: Validate render metadata against vgraph.json and beta.json.\n---\n\nRun sks gx validate and drift; fail stale or incomplete hashes, nodes, edges, invariants, or anchors.\n`,