sneakoscope 4.1.1 → 4.2.1

package/dist/scripts/loop-directive-check-lib.js

@@ -41,7 +41,12 @@ export async function runLoopDirectiveCheck(id) {
         process.env.SKS_LOOP_RUNTIME_FIXTURE = '1';
     }
     const fixtureMode = process.env.SKS_LOOP_RUNTIME_FIXTURE === '1' || process.env.SKS_LOOP_GATE_FIXTURE === '1';
-    const result = await runLoopPlan({ root, plan, parallelism: 'extreme', noMutation: fixtureMode ? true : !realRuntimeMode });
+    const needsRuntime = loopDirectiveNeedsRuntime(id);
+    if (!needsRuntime)
+        await writeLightweightLoopArtifacts(root, missionId, plan);
+    const result = needsRuntime
+        ? await runLoopPlan({ root, plan, parallelism: 'extreme', noMutation: fixtureMode ? true : !realRuntimeMode })
+        : { ok: true, proofs: [], graph_proof: await readJson(loopGraphProofPath(root, missionId)) };
     const assertions = [];
     const assert = (condition, message) => assertions.push({ ok: Boolean(condition), message });
     assert(validateLoopPlan(plan).ok, 'loop plan validates');
@@ -321,6 +326,78 @@ export async function runLoopDirectiveCheck(id) {
     if (failed.length)
         process.exitCode = 1;
 }
+function loopDirectiveNeedsRuntime(id) {
+    return new Set([
+        'loop:runtime',
+        'loop:worker-runtime',
+        'loop:checker-freshness',
+        'loop:runtime-real-workers',
+        'loop:maker-checker-real',
+        'loop:gate-runner-real',
+        'loop:gate-artifacts',
+        'loop:worktree-runtime',
+        'loop:integration-merge',
+        'loop:integration-finalizer-real',
+        'loop:real-maker-checker-blackbox',
+        'naruto:loop-mesh-real-blackbox',
+        'goal:loop-runtime-real-blackbox',
+        'loop:integration-finalizer'
+    ]).has(id);
+}
+async function writeLightweightLoopArtifacts(root, missionId, plan) {
+    const node = plan.graph.nodes.find((row) => row.loop_id === 'loop-zellij') || plan.graph.nodes[0];
+    if (!node)
+        return;
+    const stateFile = loopStatePath(root, missionId, node.loop_id);
+    const proofFile = loopProofPath(root, missionId, node.loop_id);
+    const graphFile = loopGraphProofPath(root, missionId);
+    await fs.mkdir(path.dirname(stateFile), { recursive: true });
+    await fs.writeFile(stateFile, JSON.stringify({
+        schema: 'sks.loop-state.v1',
+        mission_id: missionId,
+        loop_id: node.loop_id,
+        status: 'completed',
+        current_phase: 'static-fixture',
+        updated_at: new Date().toISOString()
+    }, null, 2));
+    await fs.writeFile(proofFile, JSON.stringify({
+        schema: 'sks.loop-proof.v1',
+        mission_id: missionId,
+        loop_id: node.loop_id,
+        status: 'completed',
+        iterations: 1,
+        owner_scope: node.owner_scope,
+        maker_result: { backend: 'static-fixture', worker_count: 0, artifacts: [], patch_candidates: [], changed_files: [], blockers: [], ok: true },
+        checker_result: { backend: 'static-fixture', worker_count: 0, artifacts: [], checker_findings: [], fresh_session: true, blockers: [], ok: true },
+        gate_result: { ok: true, selected_gates: [], passed_gates: [], failed_gates: [], skipped_gates: [], blockers: [] },
+        budget: { used: { iterations: 1 } },
+        handoff: { required: false, reason: null },
+        worktree: { id: null, path: null, branch: null },
+        changed_files: [],
+        patch_bytes: 0,
+        blockers: []
+    }, null, 2));
+    await fs.mkdir(path.dirname(graphFile), { recursive: true });
+    await fs.writeFile(graphFile, JSON.stringify({
+        schema: 'sks.loop-graph-proof.v1',
+        mission_id: missionId,
+        ok: true,
+        total_loops: plan.graph.nodes.length,
+        completed_loops: plan.graph.nodes.length,
+        blocked_loops: 0,
+        failed_loops: 0,
+        handoff_loops: 0,
+        parallelism: {
+            max_active_loops: Math.min(plan.graph.nodes.length, 4),
+            max_active_workers: 0,
+            wall_ms: 1,
+            sequential_estimate_ms: Math.max(1, plan.graph.nodes.length),
+            speedup_ratio: Math.max(1, plan.graph.nodes.length)
+        },
+        gates: { selected: [], passed: [], failed: [], skipped: [] },
+        blockers: []
+    }, null, 2));
+}
 async function exists(file) {
     try {
         await fs.access(file);

package/dist/scripts/mad-db-capability-check.js

@@ -7,9 +7,20 @@ const missionMod = await importDist('core/mission.js');
 const capMod = await importDist('core/mad-db/mad-db-capability.js');
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-cap-'));
 const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: 'fixture' });
-const cap = await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
+const cap = await capMod.createMadDbCapability(root, {
+    missionId: mission.id,
+    ack: capMod.MAD_DB_ACK,
+    cwd: root,
+    projectRef: 'fixture-project-ref',
+    runtimeSessionId: 'fixture-session',
+    profilePath: '.sneakoscope/missions/M/mad-db/runtime/codex-mad-db.config.toml',
+    profileSha256: 'fixture-profile-sha',
+    status: 'active'
+});
 assertGate(cap.schema === capMod.MAD_DB_CAPABILITY_SCHEMA, 'Mad-DB capability schema mismatch', cap);
-assertGate(cap.enabled === true && cap.one_cycle_only === true && cap.priority === 'highest', 'Mad-DB capability must be one-cycle highest priority', cap);
+assertGate(cap.legacy_compat?.one_cycle_only === true && cap.legacy_compat?.priority === 'highest', 'Mad-DB capability must retain legacy one-cycle priority metadata', cap);
+assertGate(cap.project_ref === 'fixture-project-ref' && cap.runtime_session_id === 'fixture-session' && cap.transport.profile_sha256 === 'fixture-profile-sha', 'Mad-DB capability v2 must bind project/session/profile', cap);
+assertGate(cap.scope.sql_plane === 'all_mutations' && cap.scope.control_plane === 'deny' && cap.scope.operations.includes('truncate'), 'Mad-DB capability v2 must authorize SQL-plane operation classes only', cap);
 assertGate(capMod.isMadDbCapabilityActive(cap) === true, 'Mad-DB capability must be active before consumption', cap);
 emitGate('mad-db:capability', { mission_id: mission.id, cycle_id: cap.cycle_id });
 //# sourceMappingURL=mad-db-capability-check.js.map

package/dist/scripts/mad-db-command-check.js

@@ -3,11 +3,13 @@ import { DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, routeByDollarCommand } from '.
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 assertGate(readText('src/cli/command-registry.ts').includes("'mad-db'"), 'mad-db command must be registered');
 assertGate(readText('src/commands/mad-db.ts').includes('madDbCommand'), 'mad-db command wrapper missing');
-assertGate(readText('src/core/commands/mad-db-command.ts').includes('I AUTHORIZE ONE-CYCLE DB BREAK-GLASS'), 'mad-db command must require exact ack phrase');
+assertGate(readText('src/core/commands/mad-db-command.ts').includes('deprecated_enable_no_capability'), 'legacy mad-db enable must be deprecated and must not create capabilities');
 assertGate(DOLLAR_COMMANDS.some((entry) => entry.command === '$MAD-DB'), '$MAD-DB dollar command must be visible in sks dollar-commands');
-assertGate(DOLLAR_COMMAND_ALIASES.some((entry) => entry.canonical === '$MAD-SKS' && entry.app_skill === '$mad-db'), '$mad-db app skill alias must be visible in sks dollar-commands');
-assertGate(routeByDollarCommand('MAD-DB')?.command === '$MAD-SKS', '$MAD-DB must resolve to the MAD-SKS permission route');
-assertGate(routeByDollarCommand('mad-db')?.command === '$MAD-SKS', '$mad-db must resolve to the MAD-SKS permission route');
-assertGate(readText('src/core/init.ts').includes("'mad-db':") && readText('src/core/init.ts').includes('sks mad-db enable'), 'mad-db generated picker skill template missing');
+assertGate(DOLLAR_COMMAND_ALIASES.some((entry) => entry.canonical === '$MAD-DB' && entry.app_skill === '$mad-db'), '$mad-db app skill alias must point at first-class $MAD-DB');
+assertGate(routeByDollarCommand('MAD-DB')?.command === '$MAD-DB', '$MAD-DB must resolve to the first-class MadDB route');
+assertGate(routeByDollarCommand('mad-db')?.command === '$MAD-DB', '$mad-db must resolve to the first-class MadDB route');
+const initText = readText('src/core/init.ts');
+assertGate(initText.includes("'mad-db':") && initText.includes('madDbSkillText()') && initText.includes('dbSafetyGuardSkillText()'), 'mad-db generated picker skill template must come from typed SSOT');
+assertGate(readText('src/core/commands/mad-db-command.ts').includes('run|exec|apply-migration'), 'mad-db command must expose execution subcommands');
 emitGate('mad-db:command', { command: 'sks mad-db', dollar_command: '$MAD-DB', app_skill_alias: '$mad-db' });
 //# sourceMappingURL=mad-db-command-check.js.map

package/dist/scripts/mad-db-hook-idempotency-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { checkDbOperation } from '../core/db-safety.js';
+import { createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-idempotency-'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'idempotency fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const payload = { tool_name: 'supabase.execute_sql', tool_call_id: 'canonical-call-id-1', sql: 'delete from public.fixture;' };
+const first = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const second = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const cap = await readMadDbCapability(root, mission.id);
+assertGate(first.allowed === true && second.allowed === true, 'same canonical call should be allowed while active', { first, second });
+assertGate(first.mad_db.operation_id === second.mad_db.operation_id, 'same canonical tool_call_id must map to the same operation', { first, second });
+assertGate(second.mad_db.idempotent_reservation_reused === true, 'second reservation must be marked reused', second);
+assertGate(Boolean(cap) && cap.counters.attempts === 1 && cap.counters.reserved === 1, 'PreToolUse/PermissionRequest duplicate handling must not double-count one call', cap || {});
+emitGate('mad-db:hook-idempotency', { operation_id: first.mad_db.operation_id, counters: cap.counters });
+//# sourceMappingURL=mad-db-hook-idempotency-check.js.map

package/dist/scripts/mad-db-ledger-check.js

@@ -2,6 +2,7 @@
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const ledger = readText('src/core/mad-db/mad-db-ledger.ts');
 const cap = readText('src/core/mad-db/mad-db-capability.ts');
-assertGate(ledger.includes('mad-db-ledger.jsonl') && cap.includes('capability.consumed'), 'Mad-DB ledger must record lifecycle and consumption events');
+assertGate(ledger.includes('mad-db-ledger.jsonl') && cap.includes('mad-db-capability.closed.json'), 'Mad-DB ledger must record lifecycle and closed capability events');
+assertGate(!ledger.includes('unknown_pending_tool_result'), 'Mad-DB ledger must not use old pending-latest fallback wording');
 emitGate('mad-db:ledger', { file: 'mad-db-ledger.jsonl' });
 //# sourceMappingURL=mad-db-ledger-check.js.map

package/dist/scripts/mad-db-lifecycle-hook-decision-check.js

@@ -5,13 +5,14 @@ import os from 'node:os';
 import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
+import { createMission } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-hook-decision-'));
-const missionId = 'M-mad-db-hook-decision';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const decision = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'hook fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const decision = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'hook-decision-call-1', sql: 'insert into audit_log(id) values (1)' });
 const hook = madDbLifecycleHookFromDecision(decision);
 assertGate(decision.allowed === true && decision.mad_db?.lifecycle_result_pending === true, 'Mad-DB decision must mark pending lifecycle result', decision);
-assertGate(Boolean(hook?.mission_id === missionId && hook?.operation_id && hook?.cycle_id && hook?.tool_name), 'Mad-DB decision must expose ledger result hook', { decision, hook });
+assertGate(Boolean(hook?.mission_id === mission.id && hook?.operation_id && hook?.tool_call_id === 'hook-decision-call-1' && hook?.cycle_id && hook?.tool_name), 'Mad-DB decision must expose canonical tool_call_id ledger result hook', { decision, hook });
 emitGate('mad-db:lifecycle-hook-decision', { operation_id: hook.operation_id, cycle_id: hook.cycle_id });
 //# sourceMappingURL=mad-db-lifecycle-hook-decision-check.js.map

package/dist/scripts/mad-db-mad-command-check.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { madHighCommand } from '../core/commands/mad-sks-command.js';
+import { madHighCommand, resolveMadLaunchMadDbGrant } from '../core/commands/mad-sks-command.js';
 import { checkDbOperation } from '../core/db-safety.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const original = {
@@ -53,27 +53,29 @@ try {
     assertGate(launch?.ok === true && launch.status === 'headless-fallback', 'sks --mad fixture launch must complete headless', launch);
     const state = await readJson(path.join(tmp, '.sneakoscope', 'state', 'current.json'));
     assert.equal(state.mad_sks_active, true);
-    assert.equal(state.mad_db_active, true);
-    assert.equal(state.mad_db_grant_source, 'sks_mad_default');
-    assert.equal(state.mad_db_priority_override_active, true);
+    assert.notEqual(state.mad_db_active, true);
+    assert.notEqual(state.mad_db_grant_source, 'sks_mad_default');
+    assert.notEqual(state.mad_db_priority_override_active, true);
     const missionDir = path.join(tmp, '.sneakoscope', 'missions', state.mission_id);
-    const grants = await readJson(path.join(missionDir, 'mad-sks-launch-grants.json'));
-    const capability = await readJson(path.join(missionDir, 'mad-db-capability.json'));
-    assert.equal(grants.mad_sks_active, true);
-    assert.equal(grants.mad_db_active, true);
-    assert.equal(grants.mad_db_default_grant, true);
-    assert.equal(capability.enabled, true);
-    assert.equal(capability.one_cycle_only, true);
-    assert.equal(capability.consumed, false);
+    await assertMissing(path.join(missionDir, 'mad-db-capability.json'), 'bare sks --mad must not create a MadDB capability');
+    await assertMissing(path.join(missionDir, 'mad-sks-launch-grants.json'), 'bare sks --mad must not create MadDB grant artifacts');
     const decision = await checkDbOperation(tmp, state, {
         tool_name: 'supabase.execute_sql',
-        sql: "insert into sks_mad_db_probe(message) values ('default grant proof');"
+        tool_call_id: 'mad-sks-default-does-not-open-maddb',
+        sql: 'truncate sks_mad_db_probe;'
     });
-    assertGate(decision.allowed === true && decision.mad_db?.active === true, 'sks --mad default MAD-DB grant must satisfy DB mutation policy locally', decision);
+    assertGate(decision.allowed === false && decision.mad_db?.active !== true, 'sks --mad default must not satisfy MadDB mutation policy locally', decision);
+    const defaultGrant = resolveMadLaunchMadDbGrant([]);
+    const explicitGrant = resolveMadLaunchMadDbGrant(['--mad-db']);
+    assert.equal(defaultGrant.enabled, false);
+    assert.equal(defaultGrant.requested, false);
+    assert.equal(explicitGrant.enabled, false);
+    assert.equal(explicitGrant.requested, true);
+    assert.equal(explicitGrant.source, 'mad_db_first_class_route_required');
     emitGate('mad-db:mad-command', {
         mission_id: state.mission_id,
-        grant_source: state.mad_db_grant_source,
-        cycle_id: capability.cycle_id
+        default_mad_db_active: state.mad_db_active === true,
+        explicit_flag_source: explicitGrant.source
     });
 }
 finally {
@@ -91,6 +93,17 @@ finally {
 async function readJson(file) {
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
+async function assertMissing(file, message) {
+    try {
+        await fs.access(file);
+        assertGate(false, message, { file });
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT')
+            return;
+        throw err;
+    }
+}
 function restoreEnv(key, value) {
     if (value == null)
         delete process.env[key];

package/dist/scripts/mad-db-mcp-result-lifecycle-check.js

@@ -6,25 +6,26 @@ import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { evaluateHookPayload } from '../core/hooks-runtime.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-mcp-result-'));
-const missionId = 'M-mad-db-mcp-result';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const successPayload = { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' };
-const successDecision = await checkDbOperation(root, { mission_id: missionId }, successPayload);
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'mcp result fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const successPayload = { tool_name: 'supabase.execute_sql', tool_call_id: 'mcp-success-call', sql: 'insert into audit_log(id) values (1)' };
+const successDecision = await checkDbOperation(root, { mission_id: mission.id }, successPayload);
 const successHook = madDbLifecycleHookFromDecision(successDecision);
 assertGate(Boolean(successHook), 'Mad-DB lifecycle hook missing before post-tool success result', successDecision);
-await evaluateHookPayload('post-tool', { tool_name: successPayload.tool_name, success: true, row_count: 1 }, { root, state: { mission_id: missionId } });
-const failurePayload = { tool_name: 'supabase.execute_sql', sql: 'update audit_log set id = 2 where id = 1' };
-const failureDecision = await checkDbOperation(root, { mission_id: missionId }, failurePayload);
+await evaluateHookPayload('post-tool', { tool_name: successPayload.tool_name, tool_call_id: successHook.tool_call_id, success: true, row_count: 1 }, { root, state: { mission_id: mission.id } });
+const failurePayload = { tool_name: 'supabase.execute_sql', tool_call_id: 'mcp-failure-call', sql: 'update audit_log set id = 2 where id = 1' };
+const failureDecision = await checkDbOperation(root, { mission_id: mission.id }, failurePayload);
 const failureHook = madDbLifecycleHookFromDecision(failureDecision);
 assertGate(Boolean(failureHook), 'Mad-DB lifecycle hook missing before post-tool MCP isError result', failureDecision);
 await evaluateHookPayload('post-tool', {
     tool_name: failurePayload.tool_name,
+    tool_call_id: failureHook.tool_call_id,
     result: { isError: true, content: [{ type: 'text', text: 'fixture MCP error' }] }
-}, { root, state: { mission_id: missionId } });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
+}, { root, state: { mission_id: mission.id } });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
 assertGate(ledger.includes('db_operation.succeeded') && ledger.includes('db_operation.failed') && ledger.includes('fixture MCP error'), 'PostToolUse must append succeeded and MCP isError failed lifecycle events', { ledger });
 emitGate('mad-db:mcp-result-lifecycle', { success_operation_id: successHook.operation_id, failure_operation_id: failureHook.operation_id, status: 'succeeded_and_failed_checked' });
 //# sourceMappingURL=mad-db-mcp-result-lifecycle-check.js.map

package/dist/scripts/mad-db-one-cycle-bounded-check.js

@@ -3,25 +3,22 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { closeMadDbCycle, createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { closeMadDbCycle, createMadDbCapability, isMadDbCapabilityActive, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
 import { checkDbOperation } from '../core/db-safety.js';
+import { createMission } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-bounded-'));
-const missionId = 'M-mad-db-bounded';
-process.env.SKS_MAD_DB_MAX_OPERATIONS = '2';
-const cap = await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-assertGate(cap.max_operations >= 2 && cap.operation_count === 0, 'capability must start as bounded one-cycle', cap);
-const payload = { tool_name: 'supabase.execute_sql', sql: 'update users set flag = true where id = 1' };
-const first = await checkDbOperation(root, { mission_id: missionId }, payload);
-const afterFirst = await readMadDbCapability(root, missionId);
-assertGate(first.allowed === true && afterFirst.operation_count === 1 && afterFirst.consumed === false, 'capability must remain active after operation 1 when max_operations > 1', { first, afterFirst });
-const second = await checkDbOperation(root, { mission_id: missionId }, payload);
-const afterSecond = await readMadDbCapability(root, missionId);
-assertGate(second.allowed === true && afterSecond.operation_count === 2 && afterSecond.consumed === true, 'capability must be consumed when operation_count reaches max_operations', { second, afterSecond });
-const closeMissionId = 'M-mad-db-close-cycle';
-process.env.SKS_MAD_DB_MAX_OPERATIONS = '20';
-const closeCap = await createMadDbCapability(root, { missionId: closeMissionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const closed = await closeMadDbCycle(root, closeMissionId, closeCap.cycle_id);
-assertGate(closed?.consumed === true && closed?.consumed_by === 'mad-db-cycle-close', 'explicit cycle close must consume active capability', closed);
-emitGate('mad-db:one-cycle-bounded', { cycle_id: cap.cycle_id, operation_count: afterSecond.operation_count, max_operations: afterSecond.max_operations, close_cycle: closed?.consumed === true });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'bounded fixture' });
+const cap = await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+assertGate(isMadDbCapabilityActive(cap) === true && Date.parse(cap.expires_at) > Date.now(), 'capability must start active with bounded TTL', cap);
+const payload = { tool_name: 'supabase.execute_sql', tool_call_id: 'bounded-call-1', sql: 'update users set flag = true where id = 1' };
+const first = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const afterFirst = await readMadDbCapability(root, mission.id);
+assertGate(first.allowed === true && afterFirst.counters.reserved === 1 && afterFirst.status === 'active', 'capability must reserve one operation and remain active before final close', { first, afterFirst });
+const second = await checkDbOperation(root, { mission_id: mission.id }, payload);
+const afterSecond = await readMadDbCapability(root, mission.id);
+assertGate(second.allowed === true && second.mad_db?.idempotent_reservation_reused === true && afterSecond.counters.reserved === 1, 'same canonical tool_call_id must be idempotent and not double-counted', { second, afterSecond });
+const closed = await closeMadDbCycle(root, mission.id, cap.cycle_id);
+assertGate(closed?.status === 'closed' && isMadDbCapabilityActive(closed) === false, 'explicit cycle close must deactivate active capability', closed);
+emitGate('mad-db:one-cycle-bounded', { cycle_id: cap.cycle_id, reserved: afterSecond.counters.reserved, close_cycle: closed?.status === 'closed' });
 //# sourceMappingURL=mad-db-one-cycle-bounded-check.js.map

package/dist/scripts/mad-db-one-cycle-consumption-check.js

@@ -7,10 +7,10 @@ const missionMod = await importDist('core/mission.js');
 const capMod = await importDist('core/mad-db/mad-db-capability.js');
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-consume-'));
 const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: 'fixture' });
-const cap = await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
+const cap = await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
 await capMod.consumeMadDbCapability(root, mission.id, { consumedBy: 'fixture' });
 const consumed = await capMod.readMadDbCapability(root, mission.id);
-assertGate(capMod.isMadDbCapabilityActive(consumed) === false && consumed.consumed === true, 'Mad-DB capability must be inactive after consumption', consumed);
-assertGate(fs.existsSync(path.join(root, '.sneakoscope', 'missions', mission.id, 'mad-db-capability.consumed.json')), 'consumed proof artifact missing');
+assertGate(capMod.isMadDbCapabilityActive(consumed) === false && consumed.status === 'closed' && Boolean(consumed.closed_at), 'Mad-DB capability must be inactive after close/consumption compatibility call', consumed);
+assertGate(fs.existsSync(path.join(root, '.sneakoscope', 'missions', mission.id, 'mad-db-capability.closed.json')), 'closed proof artifact missing');
 emitGate('mad-db:one-cycle-consumption', { cycle_id: cap.cycle_id });
 //# sourceMappingURL=mad-db-one-cycle-consumption-check.js.map

package/dist/scripts/mad-db-operation-lifecycle-blackbox.js

@@ -6,21 +6,21 @@ import path from 'node:path';
 import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
 import { recordMadDbToolResult } from '../core/mad-db/mad-db-result-lifecycle.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-lifecycle-blackbox-'));
-const missionId = 'M-mad-db-lifecycle-blackbox';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-const success = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'lifecycle blackbox fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const success = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-success-call', sql: 'insert into audit_log(id) values (1)' });
 const successHook = madDbLifecycleHookFromDecision(success);
 assertGate(Boolean(successHook), 'success hook missing', success);
-await recordMadDbToolResult({ root, missionId, hook: successHook, ok: true, rowCount: 1 });
-const failure = await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'update users set flag = true where id = 1' });
+await recordMadDbToolResult({ root, missionId: mission.id, hook: successHook, ok: true, rowCount: 1 });
+const failure = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'blackbox-failure-call', sql: 'update users set flag = true where id = 1' });
 const failureHook = madDbLifecycleHookFromDecision(failure);
 assertGate(Boolean(failureHook), 'failure hook missing', failure);
-await recordMadDbToolResult({ root, missionId, hook: failureHook, ok: false, error: 'fixture failure' });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
-for (const token of ['db_operation.started', 'db_operation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
+await recordMadDbToolResult({ root, missionId: mission.id, hook: failureHook, ok: false, error: 'fixture failure' });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+for (const token of ['db_operation.started', 'db_mutation.allowed', 'db_operation.succeeded', 'db_operation.failed']) {
     assertGate(ledger.includes(token), `Mad-DB ledger missing ${token}`, { ledger });
 }
 assertGate((ledger.match(/db_operation\.succeeded/g) || []).length === 1, 'success terminal event must be recorded exactly once', { ledger });

package/dist/scripts/mad-db-operation-lifecycle-ledger-check.js

@@ -5,13 +5,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
 import { checkDbOperation } from '../core/db-safety.js';
-import { missionDir } from '../core/mission.js';
+import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-ledger-'));
-const missionId = 'M-mad-db-ledger';
-await createMadDbCapability(root, { missionId, ack: MAD_DB_ACK, ttlMs: 60000 });
-await checkDbOperation(root, { mission_id: missionId }, { tool_name: 'supabase.execute_sql', sql: 'insert into audit_log(id) values (1)' });
-const ledger = await fs.readFile(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), 'utf8');
-assertGate(ledger.includes('db_operation.started') && ledger.includes('db_operation.allowed') && ledger.includes('unknown_pending_tool_result'), 'Mad-DB lifecycle ledger events missing', { ledger });
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'ledger fixture' });
+await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'ledger-call-1', sql: 'insert into audit_log(id) values (1)' });
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+assertGate(ledger.includes('db_operation.reserved') && ledger.includes('db_operation.started') && ledger.includes('db_mutation.allowed') && !ledger.includes('unknown_pending_tool_result'), 'Mad-DB lifecycle ledger events missing or pending-latest fallback still present', { ledger });
 emitGate('mad-db:operation-lifecycle-ledger');
 //# sourceMappingURL=mad-db-operation-lifecycle-ledger-check.js.map

package/dist/scripts/mad-db-parallel-lifecycle-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMission } from '../core/mission.js';
+import { createMadDbCapability, MAD_DB_ACK, readMadDbCapability } from '../core/mad-db/mad-db-capability.js';
+import { reserveMadDbOperation, transitionMadDbOperation } from '../core/mad-db/mad-db-operation-store.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-parallel-lifecycle-'));
+const mission = await createMission(root, { mode: 'mad-db', prompt: 'parallel lifecycle fixture' });
+const cap = await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const [first, second] = await Promise.all([
+    reserveMadDbOperation({ root, missionId: mission.id, capability: cap, toolCallId: 'parallel-call-a', toolName: 'supabase.execute_sql', sql: 'insert into fixture values (1)', operationClasses: ['insert'] }),
+    reserveMadDbOperation({ root, missionId: mission.id, capability: cap, toolCallId: 'parallel-call-b', toolName: 'supabase.execute_sql', sql: 'update fixture set id = 2', operationClasses: ['all_row_update'] })
+]);
+await Promise.all([
+    transitionMadDbOperation({ root, missionId: mission.id, toolCallId: 'parallel-call-b', state: 'failed', errorCode: 'fixture_parallel_failure' }),
+    transitionMadDbOperation({ root, missionId: mission.id, toolCallId: 'parallel-call-a', state: 'succeeded', result: { ok: true } })
+]);
+const capAfter = await readMadDbCapability(root, mission.id);
+assertGate(first.operation.operation_id !== second.operation.operation_id, 'parallel calls must not collide by tool name', { first, second });
+assertGate(Boolean(capAfter) && capAfter.counters.reserved === 2 && capAfter.counters.succeeded === 1 && capAfter.counters.failed === 1, 'parallel lifecycle counters must track exact call ids', capAfter || {});
+emitGate('mad-db:parallel-lifecycle', { first: first.operation.operation_id, second: second.operation.operation_id, counters: capAfter.counters });
+//# sourceMappingURL=mad-db-parallel-lifecycle-check.js.map

package/dist/scripts/mad-db-policy-v2-check.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { MAD_DB_POLICY, isMadDbControlPlaneDeniedTool, isMadDbSqlPlaneToolName, madDbOperationClassesFromClassification } from '../core/mad-db/mad-db-policy.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+for (const operation of ['drop', 'all_row_delete', 'truncate', 'migration_apply', 'direct_execute_sql']) {
+    assertGate(MAD_DB_POLICY.sql_plane_allowed.includes(operation), `policy missing ${operation}`, MAD_DB_POLICY);
+}
+assertGate(isMadDbSqlPlaneToolName('mcp__supabase_mad_db__execute_sql') === true, 'execute_sql variants must be SQL-plane tools');
+assertGate(isMadDbSqlPlaneToolName('supabase.apply_migration') === true, 'apply_migration variants must be SQL-plane tools');
+assertGate(isMadDbControlPlaneDeniedTool('supabase.delete_project') === true, 'project control-plane delete must remain denied');
+assertGate(isMadDbControlPlaneDeniedTool('supabase.billing_update') === true, 'billing control-plane updates must remain denied');
+const classes = madDbOperationClassesFromClassification({
+    toolName: 'supabase.execute_sql',
+    level: 'destructive',
+    sql: { reasons: ['truncate', 'delete_without_where', 'alter_table_drop'], statements: ['truncate public.fixture;', 'delete from public.fixture;', 'alter table public.fixture drop column old_col;'] }
+});
+for (const operation of ['direct_execute_sql', 'truncate', 'all_row_delete', 'drop']) {
+    assertGate(classes.includes(operation), `classification must map ${operation}`, { classes });
+}
+emitGate('mad-db:policy-v2', { classes });
+//# sourceMappingURL=mad-db-policy-v2-check.js.map

package/dist/scripts/mad-db-priority-resolver-check.js

@@ -11,10 +11,10 @@ const mission = await missionMod.createMission(root, { mode: 'mad-db', prompt: '
 const state = { mission_id: mission.id };
 const denied = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', sql: 'drop table users;' });
 assertGate(denied.allowed === false, 'without Mad-DB capability destructive DB must be blocked', denied);
-await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root });
-const allowed = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', sql: 'drop table users;' });
+await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
+const allowed = await db.checkDbOperation(root, state, { tool_name: 'supabase.execute_sql', tool_call_id: 'priority-drop-table', sql: 'drop table users;' });
 assertGate(allowed.allowed === true && allowed.mad_db?.active === true, 'Mad-DB capability must allow destructive DB mutation with highest priority', allowed);
-const consumed = await capMod.readMadDbCapability(root, mission.id);
-assertGate(consumed.consumed === false && consumed.operation_count === 1, 'Mad-DB capability must remain active during bounded one-cycle after first operation', consumed);
-emitGate('mad-db:priority-resolver', { cycle_id: consumed.cycle_id });
+const after = await capMod.readMadDbCapability(root, mission.id);
+assertGate(after.status === 'active' && after.counters.reserved === 1, 'Mad-DB capability must remain active and reserve exactly one operation', after);
+emitGate('mad-db:priority-resolver', { cycle_id: after.cycle_id, reserved: after.counters.reserved });
 //# sourceMappingURL=mad-db-priority-resolver-check.js.map