sneakoscope 4.2.0 → 4.3.0

package/README.md

@@ -11,6 +11,8 @@
 
 `npm i -g sneakoscope` → `sks --mad` → watch up to **100 shadow-clone workers** code in parallel,<br/>each in a live Zellij pane, every claim backed by Completion Proof.
 
+Current package release: **4.3.0**.
+
 </div>
 
 ---
@@ -35,7 +37,33 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.2.0** stabilizes MadDB SQL-plane execution so explicit `$MAD-DB` and `sks mad-db run|exec|apply-migration` invocations use a first-class, mission-bound break-glass route instead of inheriting `$MAD-SKS` state.
+SKS **4.3.0** adds the proof-backed `seo-geo-optimizer` command and route on one shared search-visibility kernel, plus Lean Engineering Policy evidence in pipeline plans, worker prompts, code-structure reports, GPT final review, and Completion Proof.
+
+- **`sks seo-geo-optimizer` / `$SEO-GEO-OPTIMIZER`.** Run read-only audit, mutation plan, explicit apply, verification, rollback, and Completion Proof for both Search Engine Optimization and Generative Engine Optimization.
+- **Mode-specific evidence.** Use `--mode seo` for package/docs/website search visibility, including metadata, canonical, robots, sitemap, locale, structured data, and internal links. Use `--mode geo` for entity facts, claim evidence, answerability, AI crawler purpose policy, and optional `llms.txt` planning. GEO means Generative Engine Optimization, not geolocation.
+- **Lean Engineering evidence.** `sks bench lean-policy --json` compares hermetic baseline-context and lean-policy-context fixtures, catching over-build candidates while preserving safety rejections without making live model accuracy claims.
+- **Safety-first mutation.** `audit` and `plan` never mutate source. `apply` requires `--apply`, uses base hashes, create-only ownership, mutation journal, rollback manifest, and post-verification.
+- **Release-gated artifacts.** SEO/GEO now have explicit runtime fixtures, schemas, feature registry mappings, release gates, route gates, and Completion Proof links.
+
+Common commands:
+
+```bash
+sks seo-geo-optimizer doctor --mode seo --json
+sks seo-geo-optimizer audit --mode seo --target package --offline --json
+sks seo-geo-optimizer plan latest --mode seo --json
+sks seo-geo-optimizer apply latest --mode seo --apply --json
+sks seo-geo-optimizer rollback latest --mode seo --apply --json
+
+sks seo-geo-optimizer doctor --mode geo --json
+sks seo-geo-optimizer audit --mode geo --target package --offline --json
+sks seo-geo-optimizer plan latest --mode geo --json
+sks seo-geo-optimizer apply latest --mode geo --include-llms-txt --apply --json
+sks bench lean-policy --json
+```
+
+Honest boundary: SEO/GEO reports separate implemented, locally verified, production verified, and measured outcome. Sitemaps, canonical tags, structured data, crawler policy, and `llms.txt` are evidence surfaces, not guarantees of indexing, ranking, traffic, rich results, or AI answer inclusion.
+
+What changed in 4.2.1:
 
 What changed in 4.2.0:
 
@@ -182,13 +210,12 @@ Change-aware release checks live behind `npm run release:check`; publish-authori
 
 - **Image generation under codex-lb.** `gpt-image-2` routes through the same Codex `/responses` backend the load balancer already proxies, so `$imagegen` works when you are authenticated only through codex-lb (no direct `OPENAI_API_KEY`). The official Codex App `$imagegen` surface stays primary; the codex-lb/OpenAI API path is the fallback. Opt out with `SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK=0`.
 
-- **xAI / Grok search.** Wire xAI Live Search into source intelligence as an MCP provider:
+- **UltraSearch source intelligence.** Run provider-independent source acquisition without requiring xAI/Grok credentials:
 
   ```bash
-  sks xai check
-  sks xai setup --scope project --command "npx" --arg "-y" --arg "<your-grok-search-mcp>"
-  export XAI_API_KEY=xai-...
-  sks xai docs
+  sks ultra-search doctor
+  sks ultra-search run "current package release notes" --mode balanced
+  sks ultra-search x "site:x.com product launch"
   ```
 
 - **CLI-only SKS update notices.** Codex App hooks no longer stop normal work to ask for an SKS update. CLI launch surfaces such as `sks --mad` print a non-blocking latest-version notice, `sks update-check` / `sks update check` show the explicit status, and `sks doctor --fix` runs the guarded global SKS update path before repair.
@@ -274,7 +301,7 @@ The cleanup contract is policy-backed in `.sneakoscope/policy.json`, but the def
 - Codex App Hooks/PAT: [docs/hooks-pat.md](docs/hooks-pat.md)
 - codex-lb: [docs/codex-lb.md](docs/codex-lb.md)
 - Source Intelligence Layer: [docs/source-intelligence-layer.md](docs/source-intelligence-layer.md)
-- X AI / Context7 / Codex Web policy: [docs/xai-context7-codex-web-policy.md](docs/xai-context7-codex-web-policy.md)
+- UltraSearch / Context7 / Codex Web policy: [docs/ultra-search-source-intelligence-policy.md](docs/ultra-search-source-intelligence-policy.md)
 - Main no-Scout / worker Scout policy: [docs/main-no-scout-worker-scout-policy.md](docs/main-no-scout-worker-scout-policy.md)
 - Real Codex dynamic smoke: [docs/real-codex-dynamic-smoke.md](docs/real-codex-dynamic-smoke.md)
 - Appshots pipeline: [docs/appshots-pipeline.md](docs/appshots-pipeline.md)
@@ -866,7 +893,7 @@ npm run release:check
 npm run publish:dry
 ```
 
-`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
+`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. `npm run publish:npm` and `npm run release:publish` run the same prepublish gate and then `npm publish --ignore-scripts`, so the real publish path stays strict even when lifecycle scripts are skipped. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
 
 Version bumps are manual. Run `sks versioning bump` only when preparing release metadata; SKS will not create `.git/hooks/pre-commit` or auto-bump during ordinary commits.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.2.0"
+version = "4.3.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.2.0"
+version = "4.3.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.2.0"),
+        Some("--version") => println!("sks-rs 4.3.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.2.0';
+const FAST_PACKAGE_VERSION = '4.3.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -132,7 +132,8 @@ export const COMMANDS = {
     'image-ux-review': entry('labs', 'Inspect image UX artifacts', 'dist/core/commands/image-ux-review-command.js', commandArgsCommand(() => import('../core/commands/image-ux-review-command.js'), 'imageUxReviewCommand', 'dist/core/commands/image-ux-review-command.js')),
     'computer-use': entry('beta', 'Record native Mac/non-web Computer Use visual evidence', 'dist/core/commands/computer-use-command.js', commandArgsCommand(() => import('../core/commands/computer-use-command.js'), 'computerUseCommand', 'dist/core/commands/computer-use-command.js')),
     context7: entry('beta', 'Context7 checks and docs', 'dist/cli/context7-command.js', subcommand(() => import('./context7-command.js'), 'context7Command', 'dist/cli/context7-command.js', 'check')),
-    xai: entry('beta', 'Set up and check xAI/Grok search MCP integration', 'dist/cli/xai-command.js', subcommand(() => import('./xai-command.js'), 'xaiCommand', 'dist/cli/xai-command.js', 'check')),
+    'ultra-search': entry('beta', 'Run provider-independent UltraSearch source intelligence', 'dist/cli/ultra-search-command.js', subcommand(() => import('./ultra-search-command.js'), 'ultraSearchCommand', 'dist/cli/ultra-search-command.js', 'doctor')),
+    xai: entry('beta', 'Deprecated compatibility notice for removed xAI/Grok setup', 'dist/cli/xai-command.js', subcommand(() => import('./xai-command.js'), 'xaiCommand', 'dist/cli/xai-command.js', 'check')),
     recallpulse: entry('labs', 'RecallPulse evidence route', 'dist/commands/recallpulse.js', directCommand(() => import('../commands/recallpulse.js'), 'dist/commands/recallpulse.js')),
     pipeline: entry('beta', 'Inspect pipeline missions', 'dist/commands/pipeline.js', directCommand(() => import('../commands/pipeline.js'), 'dist/commands/pipeline.js')),
     guard: entry('beta', 'Check harness guard', 'dist/commands/guard.js', directCommand(() => import('../commands/guard.js'), 'dist/commands/guard.js')),
@@ -142,6 +143,7 @@ export const COMMANDS = {
     aliases: entry('stable', 'Show command aliases', 'dist/core/commands/basic-cli.js', basicNoArgs('aliasesCommand')),
     selftest: entry('stable', 'Run local mock selftest', 'dist/core/commands/basic-cli.js', basicArgs('selftestCommand')),
     goal: entry('beta', 'Manage Goal bridge workflow', 'dist/core/commands/goal-command.js', subcommand(() => import('../core/commands/goal-command.js'), 'goalCommand', 'dist/core/commands/goal-command.js')),
+    'seo-geo-optimizer': entry('beta', 'Run unified SEO/GEO optimizer audit/plan/apply/verify on the search-visibility kernel', 'dist/core/commands/seo-command.js', argsCommand(() => import('../core/commands/seo-command.js'), 'seoGeoOptimizerCommand', 'dist/core/commands/seo-command.js')),
     hook: entry('beta', 'Codex hook entrypoint', 'dist/commands/hook.js', directCommand(() => import('../commands/hook.js'), 'dist/commands/hook.js')),
     profile: entry('labs', 'Inspect/set profile', 'dist/commands/profile.js', directCommand(() => import('../commands/profile.js'), 'dist/commands/profile.js')),
     hproof: entry('beta', 'Evaluate H-Proof gate', 'dist/commands/hproof.js', directCommand(() => import('../commands/hproof.js'), 'dist/commands/hproof.js')),

package/dist/cli/ultra-search-command.js

@@ -0,0 +1,163 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runUltraSearch } from '../core/ultra-search/index.js';
+export async function ultraSearchCommand(sub = 'help', args = []) {
+    const action = sub || 'help';
+    if (action === 'run')
+        return runCommand(args);
+    if (action === 'x')
+        return runCommand(['--mode', 'x_search', ...args]);
+    if (action === 'fetch')
+        return runCommand(['--mode', 'url_acquisition', ...args]);
+    if (action === 'doctor')
+        return doctorCommand(args);
+    if (action === 'status' || action === 'inspect' || action === 'sources' || action === 'claims')
+        return inspectCommand(action, args);
+    if (action === 'cache')
+        return cacheCommand(args);
+    if (action === 'bench')
+        return benchCommand(args);
+    if (action === 'migrate-xai')
+        return migrateXaiCommand(args);
+    return helpCommand();
+}
+async function runCommand(args) {
+    const json = args.includes('--json');
+    const mode = readOption(args, '--mode');
+    const query = positional(args).join(' ').trim();
+    if (!query)
+        throw new Error('Usage: sks ultra-search run "<query>" [--mode fast|balanced|deep|exhaustive|x_search|url_acquisition] [--json]');
+    const missionDir = await mkMissionDir();
+    const result = await runUltraSearch({
+        missionDir,
+        query,
+        ...(mode ? { mode } : {})
+    });
+    if (json)
+        console.log(JSON.stringify(result, null, 2));
+    else {
+        console.log(`UltraSearch ${result.ok ? 'completed' : 'partial/blocked'}: ${result.mode}`);
+        console.log(`Mission: ${missionDir}`);
+        console.log(`Sources: ${result.sources.length}, verified: ${result.proof.verified_source_count}`);
+        if (result.blockers.length)
+            console.log(`Blockers: ${result.blockers.join(', ')}`);
+    }
+    return result;
+}
+async function doctorCommand(args) {
+    const json = args.includes('--json');
+    const report = {
+        schema: 'sks.ultra-search-doctor.v1',
+        ok: true,
+        core_ready: true,
+        xai_required: false,
+        optional: {
+            context7: 'external_runtime_optional_by_intent',
+            codex_web: process.env.SKS_CODEX_WEB_SEARCH_AVAILABLE === '1' || process.env.CODEX_WEB_SEARCH_AVAILABLE === '1' ? 'available' : 'not_bound',
+            authenticated_chrome: 'operator_consented_optional',
+            official_x_api: 'credentials_optional_not_required'
+        },
+        blockers: [],
+        warnings: []
+    };
+    if (json)
+        console.log(JSON.stringify(report, null, 2));
+    else
+        console.log('UltraSearch doctor: core ready; xAI/Grok is not required.');
+    return report;
+}
+async function inspectCommand(action, args) {
+    const json = args.includes('--json');
+    const mission = positional(args)[0] || 'latest';
+    const target = mission === 'latest' ? await latestMissionDir() : mission;
+    const file = path.join(target, 'ultra-search', action === 'sources' ? 'source-ledger.json' : action === 'claims' ? 'claim-ledger.json' : 'ultra-search-result.json');
+    const text = await fs.readFile(file, 'utf8');
+    if (json)
+        console.log(text.trim());
+    else
+        console.log(text);
+    return JSON.parse(text);
+}
+async function cacheCommand(args) {
+    const sub = positional(args)[0] || 'status';
+    const report = { schema: 'sks.ultra-search-cache.v1', ok: true, action: sub, local_only: true };
+    console.log(JSON.stringify(report, null, 2));
+    return report;
+}
+async function benchCommand(args) {
+    const report = {
+        schema: 'sks.ultra-search-bench.v1',
+        ok: false,
+        suite: readOption(args, '--suite') || 'all',
+        status: 'real_benchmark_not_run',
+        blockers: ['real_web_or_x_parity_corpus_required']
+    };
+    console.log(JSON.stringify(report, null, 2));
+    return report;
+}
+async function migrateXaiCommand(args) {
+    const apply = args.includes('--apply');
+    const report = {
+        schema: apply ? 'sks.ultra-search-xai-migration-result.v1' : 'sks.ultra-search-xai-migration-plan.v1',
+        ok: true,
+        applied: false,
+        managed_candidates: [],
+        unowned_preserved: true,
+        note: 'No automatic MCP config deletion is performed without an owned managed marker and explicit --apply.'
+    };
+    console.log(JSON.stringify(report, null, 2));
+    return report;
+}
+function helpCommand() {
+    console.log([
+        'Usage:',
+        '  sks ultra-search doctor [--json]',
+        '  sks ultra-search run "<query>" [--mode fast|balanced|deep|exhaustive]',
+        '  sks ultra-search x "<query>"',
+        '  sks ultra-search fetch "<url>"',
+        '  sks ultra-search status|inspect|sources|claims <mission|latest>',
+        '  sks ultra-search cache status|prune|clear',
+        '  sks ultra-search bench [--suite all|x|web|docs|blocked]',
+        '  sks ultra-search migrate-xai [--apply]'
+    ].join('\n'));
+    return { ok: true, status: 'help' };
+}
+function readOption(args, flag) {
+    const index = args.indexOf(flag);
+    const value = index >= 0 ? args[index + 1] : undefined;
+    return value || null;
+}
+function positional(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const value = args[i];
+        if (!value)
+            continue;
+        if (value.startsWith('--')) {
+            if (value !== '--json')
+                i++;
+            continue;
+        }
+        out.push(value);
+    }
+    return out;
+}
+async function mkMissionDir() {
+    const dir = path.join(process.cwd(), '.sneakoscope', 'missions', `ultra-${Date.now().toString(36)}`);
+    await fs.mkdir(dir, { recursive: true });
+    return dir;
+}
+async function latestMissionDir() {
+    const root = path.join(process.cwd(), '.sneakoscope', 'missions');
+    const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
+    const dirs = entries.filter((entry) => entry.isDirectory()).map((entry) => path.join(root, entry.name)).sort();
+    const latest = dirs.reverse().find(asyncDirLikelyUltra);
+    if (!latest)
+        return path.join(os.tmpdir(), 'sks-ultra-search-missing');
+    return latest;
+}
+function asyncDirLikelyUltra(dir) {
+    return Boolean(dir);
+}
+//# sourceMappingURL=ultra-search-command.js.map

package/dist/cli/xai-command.js

@@ -1,175 +1,35 @@
-import path from 'node:path';
-import { ensureDir, projectRoot, readText, runProcess, sksRoot, writeTextAtomic } from '../core/fsx.js';
-import { getCodexInfo } from '../core/codex-adapter.js';
-import { detectXaiMcp } from '../core/mcp/xai-mcp-detector.js';
-// `sks xai` — wire up xAI/Grok web search (Live Search) as a Codex MCP server so
-// SKS source-intelligence can fan out to Grok alongside Context7 and Codex web
-// search. SKS detects xAI via an MCP server whose name matches xai/grok/x-ai and
-// that exposes a search/web/query tool (see core/mcp/xai-mcp-detector.ts), so
-// `setup` registers that MCP server and points the operator at XAI_API_KEY.
-//
-// xAI reference (https://api.x.ai/v1): OpenAI-compatible Responses API with the
-// `web_search` / `x_search` tools, model family `grok-4.x`, auth via XAI_API_KEY.
-const XAI_DOCS_URL = 'https://docs.x.ai/developers/tools/web-search';
-const XAI_API_BASE = 'https://api.x.ai/v1';
-const DEFAULT_SERVER_NAME = 'grok-search';
-const flag = (args, name) => args.includes(name);
 export async function xaiCommand(sub = 'check', args = []) {
+    const json = args.includes('--json');
     const action = sub || 'check';
-    if (action === 'check' || action === 'status')
-        return xaiCheck(args);
-    if (action === 'setup')
-        return xaiSetup(args);
-    if (action === 'docs' || action === 'help' || action === '--help' || action === '-h')
-        return xaiDocs(args);
-    throw new Error(`Unknown xai command: ${action}. Use: sks xai check | setup | status | docs`);
-}
-async function xaiCheck(args) {
-    const root = await projectRoot().catch(() => process.cwd());
-    const detection = await detectXaiMcp({ root });
-    if (flag(args, '--json'))
-        return console.log(JSON.stringify(detection, null, 2));
-    console.log('SKS xAI / Grok search MCP\n');
-    console.log(`Status:    ${describeStatus(detection.status)}`);
-    console.log(`Configured: ${detection.configured ? 'yes' : 'no'}`);
-    console.log(`Search-capable: ${detection.search_capable ? 'yes' : detection.configured_but_unverified ? 'configured (tools unverified at runtime)' : 'no'}`);
-    if (detection.servers.length) {
-        for (const server of detection.servers) {
-            console.log(`  • ${server.raw_name} (${server.source})${server.tools.length ? ` tools: ${server.tools.join(', ')}` : ''}`);
-        }
-    }
-    console.log(`Checked:   ${detection.config_paths_checked.join(', ') || 'none'}`);
-    if (!detection.configured) {
-        console.log('\nNot configured. Run: sks xai setup --scope project --command "<your-xai-mcp-server>"');
-        console.log('Then export your key:    export XAI_API_KEY=xai-...');
-        console.log(`Docs: ${XAI_DOCS_URL}`);
-    }
-    else if (detection.status === 'configured_but_unverified') {
-        console.log('\nServer is registered; tool capability is verified when Codex lists its tools at runtime.');
-    }
-}
-async function xaiSetup(args) {
-    const scope = readOption(args, '--scope', flag(args, '--global') ? 'global' : 'project');
-    if (!['project', 'global'].includes(scope))
-        throw new Error('Invalid xAI scope. Use --scope project or --scope global.');
-    const name = sanitizeServerName(readOption(args, '--name', DEFAULT_SERVER_NAME));
-    const url = readOption(args, '--url', null);
-    const command = readOption(args, '--command', null);
-    const commandArgs = readRepeatedOption(args, '--arg');
-    const envKey = readOption(args, '--api-key-env', 'XAI_API_KEY');
-    if (!url && !command) {
-        // Nothing to install yet: print a ready-to-paste config + the exact next steps
-        // instead of writing a broken/guessed server entry.
-        printSetupGuidance(scope, name, envKey);
-        return;
-    }
-    if (scope === 'global') {
-        const codex = await getCodexInfo();
-        if (!codex.bin)
-            throw new Error('Codex CLI missing. Install @openai/codex or set SKS_CODEX_BIN, then re-run.');
-        const cmdArgs = url
-            ? ['mcp', 'add', name, '--url', url]
-            : ['mcp', 'add', name, '--', command, ...commandArgs];
-        const result = await runProcess(codex.bin, cmdArgs, { timeoutMs: 30000, maxOutputBytes: 64 * 1024 });
-        if (flag(args, '--json'))
-            return console.log(JSON.stringify({ scope, name, command: `${codex.bin} ${cmdArgs.join(' ')}`, result }, null, 2));
-        if (result.code !== 0)
-            throw new Error(result.stderr || result.stdout || 'codex mcp add failed');
-        console.log(`xAI/Grok MCP "${name}" registered globally.`);
-        console.log(`Set your key: export ${envKey}=xai-...   (docs: ${XAI_DOCS_URL})`);
-        return;
-    }
-    const root = await projectRoot().catch(() => sksRoot());
-    const changed = await ensureProjectXaiMcpConfig(root, { name, url, command, commandArgs, envKey });
-    const detection = await detectXaiMcp({ root });
-    if (flag(args, '--json'))
-        return console.log(JSON.stringify({ scope, name, changed, detection }, null, 2));
-    console.log(`xAI/Grok MCP "${name}" ${changed ? 'configured' : 'already configured'} in .codex/config.toml`);
-    console.log(`Detected:  ${detection.configured ? 'yes' : 'no'} (${detection.status})`);
-    console.log(`Set your key: export ${envKey}=xai-...   (docs: ${XAI_DOCS_URL})`);
-}
-async function xaiDocs(_args) {
-    console.log('SKS xAI / Grok search integration\n');
-    console.log(`API base:   ${XAI_API_BASE}`);
-    console.log('Auth:       XAI_API_KEY (Bearer)');
-    console.log('Model:      grok-4.x (OpenAI-compatible Responses API)');
-    console.log('Tools:      web_search, x_search (agentic Live Search)');
-    console.log(`Reference:  ${XAI_DOCS_URL}\n`);
-    console.log('Wire it into SKS source-intelligence with an MCP server:');
-    console.log('  sks xai setup --scope project --command "npx" --arg "-y" --arg "<your-grok-search-mcp>"');
-    console.log('  sks xai setup --scope global  --url "https://<your-grok-mcp-endpoint>"');
-    console.log('  export XAI_API_KEY=xai-...');
-    console.log('  sks xai check');
-}
-function printSetupGuidance(scope, name, envKey) {
-    console.log('SKS xAI / Grok search setup\n');
-    console.log('Specify the MCP server to register. Examples:');
-    console.log(`  sks xai setup --scope ${scope} --command "npx" --arg "-y" --arg "<your-grok-search-mcp>"`);
-    console.log(`  sks xai setup --scope ${scope} --url "https://<your-grok-mcp-endpoint>"`);
-    console.log('\nReady-to-paste .codex/config.toml block (edit command/args for your server):\n');
-    console.log(xaiMcpToml({ name, command: 'npx', commandArgs: ['-y', '<your-grok-search-mcp>'], envKey }).trim());
-    console.log(`\nThen set your key:  export ${envKey}=xai-...`);
-    console.log(`Docs: ${XAI_DOCS_URL}`);
-}
-export function xaiMcpToml(opts) {
-    const name = sanitizeServerName(opts.name || DEFAULT_SERVER_NAME);
-    const envKey = opts.envKey || 'XAI_API_KEY';
-    const lines = [`[mcp_servers.${name}]`];
-    if (opts.url) {
-        lines.push(`url = ${JSON.stringify(opts.url)}`);
-    }
+    const result = {
+        schema: 'sks.xai-compat.v1',
+        ok: action !== 'setup',
+        status: 'deprecated',
+        action,
+        setup_performed: false,
+        xai_required: false,
+        replacement: {
+            doctor: 'sks ultra-search doctor',
+            x_search: 'sks ultra-search x "<query>"',
+            migration: 'sks ultra-search migrate-xai [--apply]'
+        },
+        blockers: action === 'setup' ? ['xai_setup_removed_use_ultra_search'] : [],
+        warnings: ['sks_xai_is_deprecated_and_does_not_configure_mcp_or_require_XAI_API_KEY']
+    };
+    if (json)
+        console.log(JSON.stringify(result, null, 2));
     else {
-        lines.push(`command = ${JSON.stringify(opts.command || 'npx')}`);
-        const argv = (opts.commandArgs && opts.commandArgs.length) ? opts.commandArgs : ['-y', '<your-grok-search-mcp>'];
-        lines.push(`args = [${argv.map((a) => JSON.stringify(a)).join(', ')}]`);
-    }
-    lines.push(`env = { ${envKey} = ${JSON.stringify(`\${${envKey}}`)} }`);
-    lines.push('');
-    return lines.join('\n');
-}
-async function ensureProjectXaiMcpConfig(root, opts) {
-    const configPath = path.join(root, '.codex', 'config.toml');
-    await ensureDir(path.dirname(configPath));
-    const current = await readText(configPath, '');
-    const block = xaiMcpToml(opts).trim();
-    const existingRe = new RegExp(`(^|\\n)\\[mcp_servers\\.${escapeRegExp(opts.name)}\\]\\n[\\s\\S]*?(?=\\n\\[[^\\]]+\\]|\\s*$)`);
-    if (existingRe.test(current)) {
-        const next = current.replace(existingRe, `$1${block}\n`);
-        if (next === current)
-            return false;
-        await writeTextAtomic(configPath, next.endsWith('\n') ? next : `${next}\n`);
-        return true;
-    }
-    const text = String(current);
-    await writeTextAtomic(configPath, `${text.trimEnd()}${text.trim() ? '\n\n' : ''}${block}\n`);
-    return true;
-}
-function describeStatus(status) {
-    switch (status) {
-        case 'search_capable': return 'search-capable (ready)';
-        case 'configured_but_unverified': return 'configured (verify tools at runtime)';
-        case 'configured_no_search': return 'configured but no search tool detected';
-        case 'missing': return 'not configured';
-        default: return status;
-    }
-}
-function sanitizeServerName(value) {
-    const cleaned = String(value || DEFAULT_SERVER_NAME).trim().replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
-    return cleaned || DEFAULT_SERVER_NAME;
-}
-function readOption(args, name, fallback) {
-    const i = args.indexOf(name);
-    return i >= 0 && args[i + 1] && !String(args[i + 1]).startsWith('--') ? args[i + 1] : fallback;
-}
-function readRepeatedOption(args, name) {
-    const out = [];
-    for (let i = 0; i < args.length; i += 1) {
-        if (args[i] === name && args[i + 1])
-            out.push(String(args[i + 1]));
+        console.log('`sks xai` is deprecated. UltraSearch no longer requires xAI/Grok or XAI_API_KEY.');
+        console.log('Use: sks ultra-search doctor');
+        console.log('Use: sks ultra-search x "<query>"');
+        if (action === 'setup') {
+            console.log('No MCP setup was performed.');
+            process.exitCode = 1;
+        }
     }
-    return out;
+    return result;
 }
-function escapeRegExp(value) {
-    return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+export function xaiMcpToml() {
+    return '';
 }
 //# sourceMappingURL=xai-command.js.map

package/dist/core/agents/agent-codex-cockpit.js

@@ -72,7 +72,7 @@ export async function buildAgentCodexCockpitState(missionDir, opts = {}) {
         janitor_ok: janitor?.ok ?? null,
         proof_status: proof?.status || (proof?.ok ? 'passed' : proof ? 'blocked' : null),
         source_intelligence_status: sourceIntelligence?.ok === true ? sourceIntelligence.mode || 'ok' : sourceIntelligence ? 'blocked' : null,
-        xai_status: sourceIntelligence?.xai_search?.status || sourceIntelligence?.policy?.xai_mcp?.status || null,
+        ultra_search_status: sourceIntelligence?.ultra_search?.proof?.ok === true ? 'verified' : sourceIntelligence?.ultra_search ? 'partial' : null,
         codex_web_search_status: sourceIntelligence?.codex_web_search?.status || sourceIntelligence?.policy?.codex_web_search?.status || null,
         goal_mode_status: goalMode?.mode || null,
         terminal_session_status: terminalClosed ? 'closed' : proof ? 'blocked_or_unverified' : null,
@@ -115,7 +115,7 @@ export function renderAgentCodexDashboard(state) {
         `- Concurrency: ${state.concurrency ?? 'unknown'}`,
         `- Proof: ${state.proof_status || 'unknown'}`,
         `- Source intelligence: ${state.source_intelligence_status || 'unknown'}`,
-        `- X AI: ${state.xai_status || 'unknown'}`,
+        `- UltraSearch: ${state.ultra_search_status || 'unknown'}`,
         `- Codex Web Search: ${state.codex_web_search_status || 'unknown'}`,
         `- Goal mode: ${state.goal_mode_status || 'unknown'}`,
         `- Terminal sessions: ${state.terminal_session_status || 'unknown'}`,
@@ -195,7 +195,7 @@ function summarizeLiveState(state) {
         session_generation_count: state.session_generations.length,
         proof_status: state.proof_status,
         source_intelligence_status: state.source_intelligence_status,
-        xai_status: state.xai_status,
+        ultra_search_status: state.ultra_search_status,
         codex_web_search_status: state.codex_web_search_status,
         goal_mode_status: state.goal_mode_status,
         terminal_session_status: state.terminal_session_status,

package/dist/core/agents/agent-runner-ollama.js

@@ -4,6 +4,7 @@ import { loadTriWikiRuntimeContext, triWikiContextBlock, triWikiProofRecord } fr
 import { validateAgentWorkerResult } from './agent-worker-pipeline.js';
 import { normalizeAgentPatchEnvelope } from './agent-patch-schema.js';
 import { resolveOllamaWorkerConfig } from './ollama-worker-config.js';
+import { leanEngineeringCompactText } from '../lean-engineering-policy.js';
 export const OLLAMA_WORKER_POLICY_SCHEMA = 'sks.ollama-worker-policy.v1';
 export const OLLAMA_WORKER_REQUEST_SCHEMA = 'sks.ollama-worker-request.v1';
 export const OLLAMA_WORKER_RESPONSE_SCHEMA = 'sks.ollama-worker-response.v1';
@@ -185,6 +186,7 @@ function buildOllamaGenerateRequest(agent, slice, opts, config, requestId, triwi
     const prompt = [
         'You are an SKS local Ollama worker. You are not an architect, planner, reviewer, verifier, safety judge, or strategist.',
         'Only perform the narrow worker task below. If the task asks for strategy, planning, design, review, verification, risk judgment, or orchestration, return JSON with status "blocked" and blockers.',
+        leanEngineeringCompactText(),
         'Before writing or collecting, consult the TriWiki context below first. Treat use_first as high-trust project memory and hydrate_first as source/evidence that the parent must verify before risky or user-visible work.',
         'If TriWiki is missing, stale, or lacks current stack syntax/version guidance, do not invent from model memory. Return blocked and tell the parent SKS route to update .sneakoscope/memory/q2_facts/stack-current-docs.md with Context7 or official vendor docs, then run `sks wiki refresh` and `sks wiki validate .sneakoscope/wiki/context-pack.json` before retrying.',
         'Return JSON only. Do not wrap it in markdown.',

package/dist/core/agents/agent-wrongness.js

@@ -11,7 +11,7 @@ const WRONGNESS_MAP = [
     ['missing_follow_up_schema', /follow_up_work_item|follow_up_work_items|schema_invalid:.*follow_up/],
     ['session_generation_missing', /session_generation_open|terminal_close_report_missing|source_intelligence_missing_for_generation|goal_mode_missing_for_generation/],
     ['schema_invalid_output', /^schema_invalid:/],
-    ['xai_available_not_used', /xai_available_not_used/],
+    ['ultra_search_provider_independent_proof_missing', /ultra_search_provider_independent_proof_missing/],
     ['codex_web_search_missing', /codex_web_search_missing/],
     ['context7_missing', /context7_missing|docs_context_missing/],
     ['stale_heartbeat', /stale_heartbeat/],

package/dist/core/agents/native-worker-backend-router.js

@@ -9,6 +9,7 @@ import { validateAgentWorkerResult } from './agent-worker-pipeline.js';
 import { normalizeAgentPatchEnvelope } from './agent-patch-schema.js';
 import { runCodexTask } from '../codex-control/codex-control-plane.js';
 import { CODEX_AGENT_WORKER_RESULT_SCHEMA_ID, codexAgentWorkerResultSchema } from '../codex-control/schemas/agent-worker-result.schema.js';
+import { leanEngineeringCompactText, leanPolicyReference } from '../lean-engineering-policy.js';
 export const NATIVE_WORKER_BACKEND_ROUTER_SCHEMA = 'sks.native-worker-backend-router.v1';
 export async function runNativeWorkerBackendRouter(input) {
     const root = path.resolve(input.agentRoot);
@@ -216,6 +217,7 @@ export async function runNativeWorkerBackendRouter(input) {
         model_authored_patch_envelopes: patchEnvelopes.some((envelope) => envelope.source === 'model_authored'),
         fixture_patch_envelopes: patchEnvelopes.some((envelope) => envelope.source === 'fixture'),
         proof_level: proofLevel,
+        lean_engineering_policy: leanPolicyReference(),
         fast_mode: input.fastModePolicy.fast_mode,
         service_tier: input.fastModePolicy.service_tier,
         sdk_thread_id: childReports.find((report) => report?.sdk_thread_id)?.sdk_thread_id || null,
@@ -284,6 +286,7 @@ function buildWorkerPrompt(slice) {
         write.length
             ? `Write-capable slice. Return JSON matching ${CODEX_AGENT_WORKER_RESULT_SCHEMA_ID}; include patch_envelopes for write_paths=${JSON.stringify(write)}.`
             : `Read-only slice. Return JSON matching ${CODEX_AGENT_WORKER_RESULT_SCHEMA_ID}; do not report pre-existing repository dirtiness as changed_files.`,
+        leanEngineeringCompactText(),
         'Required JSON fields: status, summary, findings, changed_files, patch_envelopes, verification, rollback_notes, blockers.'
     ].join('\n');
 }