sneakoscope 4.2.0 → 4.3.0

package/dist/scripts/check-pipeline-budget.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 const root = process.cwd();
@@ -8,6 +7,19 @@ const facade = path.join(root, 'src', 'core', 'pipeline.ts');
 const facadeLines = lineCount(facade);
 if (facadeLines > 200)
     failures.push(`src/core/pipeline.ts: line count ${facadeLines} > 200`);
+const facadeText = fs.readFileSync(facade, 'utf8');
+for (const exportName of [
+    'buildPipelinePlan',
+    'writePipelinePlan',
+    'validatePipelinePlan',
+    'promptPipelineContext',
+    'prepareRoute',
+    'activeRouteContext',
+    'evaluateStop'
+]) {
+    if (!facadeText.includes(exportName))
+        failures.push(`src/core/pipeline.ts: missing exported pipeline API ${exportName}`);
+}
 const runtimeFacade = path.join(root, 'src', 'core', 'pipeline-runtime.ts');
 if (fs.existsSync(runtimeFacade)) {
     const runtimeLines = lineCount(runtimeFacade);
@@ -19,7 +31,10 @@ if (fs.existsSync(runtimeFacade)) {
     }
 }
 const moduleDir = path.join(root, 'src', 'core', 'pipeline');
-for (const file of fs.readdirSync(moduleDir).filter((name) => name.endsWith('.ts'))) {
+const moduleFiles = fs.readdirSync(moduleDir).filter((name) => name.endsWith('.ts'));
+if (moduleFiles.length < 8)
+    failures.push(`src/core/pipeline: split module count ${moduleFiles.length} < 8`);
+for (const file of moduleFiles) {
     const absolute = path.join(moduleDir, file);
     const lines = lineCount(absolute);
     if (lines > 1000)
@@ -28,34 +43,6 @@ for (const file of fs.readdirSync(moduleDir).filter((name) => name.endsWith('.ts
     if (imports.length > 35)
         failures.push(`src/core/pipeline/${file}: import count ${imports.length} > 35`);
 }
-const required = [
-    'plan-schema.ts',
-    'stage-policy.ts',
-    'agent-stage-policy.ts',
-    'route-prep.ts',
-    'route-prep-team.ts',
-    'route-prep-research.ts',
-    'route-prep-qa.ts',
-    'route-prep-ppt.ts',
-    'route-prep-image-ux.ts',
-    'route-prep-db.ts',
-    'route-prep-gx.ts',
-    'stop-gate.ts',
-    'stop-gate-context7.ts',
-    'stop-gate-subagents.ts',
-    'stop-gate-proof.ts',
-    'active-context.ts',
-    'prompt-context.ts',
-    'prompt-context-dfix.ts',
-    'prompt-context-answer.ts',
-    'prompt-context-computer-use.ts',
-    'pipeline-plan-writer.ts',
-    'validation.ts'
-];
-for (const file of required) {
-    if (!fs.existsSync(path.join(moduleDir, file)))
-        failures.push(`src/core/pipeline/${file}: missing`);
-}
 if (failures.length) {
     console.error('Pipeline budget check failed:');
     for (const failure of failures)

package/dist/scripts/check-publish-tag.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,21 +9,49 @@ const isPrerelease = version.includes('-');
 const publishLifecycle = process.env.npm_lifecycle_event === 'prepublishOnly';
 const npmTag = process.env.npm_config_tag || process.env.NPM_CONFIG_TAG || '';
 const publishConfigTag = pkg.publishConfig?.tag || '';
+const npmrcTag = readRootNpmrcTag();
 const configuredTag = publishLifecycle && (!npmTag || npmTag === 'latest')
-    ? (publishConfigTag || npmTag || 'latest')
-    : (npmTag || publishConfigTag || 'latest');
-const expectedTag = isPrerelease ? 'rc' : 'latest';
+    ? (npmrcTag || publishConfigTag || npmTag || 'latest')
+    : (npmTag || npmrcTag || publishConfigTag || 'latest');
+const isBackfill = !isPrerelease && /^backfill(?:[-_][a-z0-9.-]+)?$/i.test(configuredTag);
+const expectedTag = isPrerelease ? 'rc' : isBackfill ? configuredTag : 'latest';
+if (publishConfigTag && npmrcTag && publishConfigTag !== npmrcTag) {
+    console.error('package.json publishConfig.tag and root .npmrc tag disagree.');
+    console.error(`publishConfig.tag: ${publishConfigTag}`);
+    console.error(`.npmrc tag: ${npmrcTag}`);
+    process.exit(2);
+}
+if (publishConfigTag && /^backfill(?:[-_][a-z0-9.-]+)?$/i.test(publishConfigTag) && !npmrcTag && !npmTag) {
+    console.error('Backfill releases must set root .npmrc tag so `npm publish --ignore-scripts` does not use latest.');
+    console.error(`Expected .npmrc: tag=${publishConfigTag}`);
+    process.exit(2);
+}
 if (configuredTag !== expectedTag) {
     if (isPrerelease) {
         console.error(`Prerelease ${pkg.name}@${version} must be published with the rc dist-tag.`);
         console.error('Set package.json publishConfig.tag to rc or pass `--tag rc` to npm publish.');
     }
     else {
-        console.error(`Stable release ${pkg.name}@${version} must be published with the latest dist-tag.`);
-        console.error('Remove prerelease tag config and use plain `npm publish`.');
+        console.error(`Stable release ${pkg.name}@${version} must be published with the latest dist-tag unless it is an explicit backfill.`);
+        console.error('Use latest for forward releases, or a backfill-* publishConfig.tag for intentional unpublished lower-version backfills.');
     }
     console.error(`Current npm tag config: ${configuredTag || 'missing'}`);
     process.exit(2);
 }
 console.log(`Publish tag check passed: ${pkg.name}@${version} -> ${configuredTag}`);
+function readRootNpmrcTag() {
+    const npmrcPath = path.join(root, '.npmrc');
+    if (!fs.existsSync(npmrcPath))
+        return '';
+    const text = fs.readFileSync(npmrcPath, 'utf8');
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';'))
+            continue;
+        const match = trimmed.match(/^tag\s*=\s*(.+)$/);
+        if (match)
+            return String(match[1] || '').trim();
+    }
+    return '';
+}
 //# sourceMappingURL=check-publish-tag.js.map

package/dist/scripts/check-route-modularity.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 const root = process.cwd();
@@ -7,37 +6,23 @@ const failures = [];
 const routeCli = path.join(root, 'src', 'core', 'commands', 'route-cli.mjs');
 if (fs.existsSync(routeCli))
     failures.push('src/core/commands/route-cli.mjs must not exist in runtime source');
-for (const file of listFiles(path.join(root, 'src', 'commands'), '.mjs')) {
-    const text = fs.readFileSync(file, 'utf8');
-    if (text.includes('route-cli.mjs'))
-        failures.push(`${rel(file)} imports route-cli.mjs`);
+const legacyCommandsDir = path.join(root, 'src', 'commands');
+if (fs.existsSync(legacyCommandsDir)) {
+    for (const file of listFiles(legacyCommandsDir, '.mjs')) {
+        const text = fs.readFileSync(file, 'utf8');
+        if (text.includes('route-cli.mjs'))
+            failures.push(`${rel(file)} imports route-cli.mjs`);
+    }
 }
-const requiredModules = [
-    'team-command.mjs',
-    'qa-loop-command.mjs',
-    'research-command.mjs',
-    'autoresearch-command.mjs',
-    'ppt-command.mjs',
-    'image-ux-review-command.mjs',
-    'computer-use-command.mjs',
-    'db-command.mjs',
-    'wiki-command.mjs',
-    'gx-command.mjs',
-    'goal-command.mjs',
-    'pipeline-command.mjs',
-    'recallpulse-command.mjs',
-    'hproof-command.mjs',
-    'validate-artifacts-command.mjs'
-];
-for (const name of requiredModules) {
-    if (!commandModuleExists(name))
-        failures.push(`missing ${name}`);
+for (const relModule of registeredCommandModules()) {
+    if (!fs.existsSync(path.join(root, relModule)))
+        failures.push(`registered command module missing: ${relModule}`);
 }
 const disallowedImports = {
-    'qa-loop-command.mjs': ['research-command', 'ppt-command', 'team-command', 'gx-command'],
-    'research-command.mjs': ['qa-loop-command', 'ppt-command', 'team-command', 'gx-command'],
-    'db-command.mjs': ['image-ux-review-command', 'ppt-command', 'computer-use-command'],
-    'wiki-command.mjs': ['team-command', 'research-command', 'qa-loop-command', 'ppt-command']
+    'qa-loop-command.ts': ['research-command', 'ppt-command', 'team-command', 'gx-command'],
+    'research-command.ts': ['qa-loop-command', 'ppt-command', 'team-command', 'gx-command'],
+    'db-command.ts': ['image-ux-review-command', 'ppt-command', 'computer-use-command'],
+    'wiki-command.ts': ['team-command', 'research-command', 'qa-loop-command', 'ppt-command']
 };
 for (const [name, needles] of Object.entries(disallowedImports)) {
     const file = commandModulePath(name);
@@ -56,6 +41,16 @@ if (failures.length) {
     process.exit(1);
 }
 console.log('Route modularity check passed');
+function registeredCommandModules() {
+    const registry = fs.readFileSync(path.join(root, 'src', 'cli', 'command-registry.ts'), 'utf8');
+    const out = new Set();
+    for (const match of registry.matchAll(/['"]dist\/core\/commands\/([^'"]+)\.js['"]/g)) {
+        const stem = match[1];
+        if (stem)
+            out.add(`src/core/commands/${stem}.ts`);
+    }
+    return [...out].sort();
+}
 function listFiles(dir, ext) {
     const out = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -72,11 +67,8 @@ function rel(file) {
 }
 function commandModulePath(name) {
     const base = path.join(root, 'src', 'core', 'commands');
-    const mjs = path.join(base, name);
+    const mjs = path.join(base, name.replace(/\.ts$/, '.mjs'));
     const ts = path.join(base, name.replace(/\.mjs$/, '.ts'));
     return fs.existsSync(mjs) ? mjs : ts;
 }
-function commandModuleExists(name) {
-    return fs.existsSync(commandModulePath(name));
-}
 //# sourceMappingURL=check-route-modularity.js.map

package/dist/scripts/check-runtime-schemas.js

@@ -80,6 +80,28 @@ for (const file of [
         issues.push(`codex_schema_invalid_json:${file}:${err.message}`);
     }
 }
+const searchVisibilitySchemaDir = path.join(root, 'schemas', 'search-visibility');
+for (const file of [
+    'site-inventory.schema.json',
+    'finding-ledger.schema.json',
+    'gate.schema.json',
+    'mutation-plan.schema.json',
+    'verification-report.schema.json'
+]) {
+    const full = path.join(searchVisibilitySchemaDir, file);
+    if (!fs.existsSync(full)) {
+        issues.push(`search_visibility_schema_missing:${file}`);
+        continue;
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(full, 'utf8'));
+        if (parsed.type !== 'object' || !parsed.$id)
+            issues.push(`search_visibility_schema_shape:${file}`);
+    }
+    catch (err) {
+        issues.push(`search_visibility_schema_invalid_json:${file}:${err.message}`);
+    }
+}
 const result = { schema: 'sks.runtime-schema-check.v1', ok: issues.length === 0, validators_ok: validatorsOk, issues };
 console.log(JSON.stringify(result, null, 2));
 if (!result.ok)

package/dist/scripts/codex-control-all-pipelines-check.js

@@ -10,6 +10,7 @@ const required = [
     'codex-control:thread-registry',
     'codex-control:side-effect-scope',
     'codex-control:empty-result-retry',
+    'codex-control:model-capacity-fallback',
     'codex-control:stream-idle-watchdog',
     'codex-control:tool-call-sequence-repair',
     'codex-control:keepalive-no-cot-leak'

package/dist/scripts/codex-control-model-capacity-fallback-check.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, readText } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/codex-control/codex-reliability-shield.js');
+let attempts = 0;
+const seenAttempts = [];
+const result = await mod.runWithCodexReliabilityShield(baseTask(), async (attempt) => {
+    attempts += 1;
+    seenAttempts.push(attempt);
+    return {
+        ok: false,
+        sdkThreadId: '',
+        sdkRunId: null,
+        events: [{ type: 'turn.failed', message: 'Selected model is at capacity. Please try a different model.' }],
+        finalResponse: '',
+        structuredOutput: null,
+        blockers: ['Selected model is at capacity. Please try a different model.']
+    };
+});
+assertGate(attempts === 1, 'model capacity must not retry with downgraded pressure', { attempts, seenAttempts, result });
+assertGate(result.reliabilityShield.ok === false, 'terminal model capacity must remain visible as a blocker', result.reliabilityShield);
+assertGate(result.reliabilityShield.retry_count === 0, 'capacity retry count must stay zero', result.reliabilityShield);
+assertGate(result.reliabilityShield.model_capacity_retry_count === 0, 'model capacity retry must not be counted', result.reliabilityShield);
+assertGate(result.reliabilityShield.selected_model_capacity_fallback === false, 'capacity fallback flag must not be selected', result.reliabilityShield);
+assertGate(result.reliabilityShield.attempts[0].retryable === false, 'capacity attempt must be terminal', result.reliabilityShield.attempts[0]);
+assertGate(result.reliabilityShield.attempts[0].retry_reason === null, 'capacity retry reason must stay null', result.reliabilityShield.attempts[0]);
+assertGate(result.reliabilityShield.attempts[0].blockers.includes('codex_model_capacity_unavailable'), 'capacity blocker must be explicit', result.reliabilityShield.attempts[0]);
+assertGate(mod.isCodexModelCapacityError({ blockers: ['Selected model is at capacity. Please try a different model.'] }, []) === true, 'capacity classifier must recognize common Codex error text');
+const runnerSource = readText('src/core/codex-control/codex-task-runner.ts');
+assertGate(!runnerSource.includes("capacity_fallback_service_tier: 'standard'"), 'capacity fallback must not force standard service tier');
+assertGate(!runnerSource.includes("capacity_fallback_reasoning_effort: 'low'"), 'capacity fallback must not force low reasoning');
+assertGate(!runnerSource.includes('SKS_CODEX_CAPACITY_FALLBACK_MODEL'), 'capacity fallback model override must be removed');
+emitGate('codex-control:model-capacity-fallback', {
+    attempts,
+    retry_count: result.reliabilityShield.retry_count,
+    model_capacity_retry_count: result.reliabilityShield.model_capacity_retry_count
+});
+function baseTask() {
+    return {
+        route: '$Agent',
+        tier: 'worker',
+        missionId: 'M-model-capacity-fallback',
+        cwd: process.cwd(),
+        prompt: 'model capacity fallback fixture',
+        outputSchemaId: 'sks.agent-worker-result.v1',
+        outputSchema: {},
+        sandboxPolicy: 'read-only',
+        requestedScopeContract: { read_only: true },
+        reliabilityPolicy: { maxEmptyResultRetries: 1, idleTimeoutMs: 5000, timeoutClass: 'short' },
+        mutationLedgerRoot: process.cwd()
+    };
+}
+//# sourceMappingURL=codex-control-model-capacity-fallback-check.js.map

package/dist/scripts/config-managed-merge-callsite-coverage-check.js

@@ -114,11 +114,17 @@ const ALLOWLIST = [
         reason: 'migration journal writes hashes and rollback metadata, not raw secret config values',
         expires: '3.2.0'
     },
+    {
+        file: 'src/core/mad-db/mad-db-runtime-profile.ts',
+        pattern: /codex-mad-db\.config\.toml|writeTextAtomic/,
+        reason: 'MAD-DB runtime profile writes only a mission-local temporary Codex profile and verifies read-only restoration on close',
+        expires: '4.3.0'
+    },
     {
         file: 'src/core/providers/glm/naruto/glm-naruto-trace.ts',
         pattern: /mission-result\.json|sanitizeArtifact/,
         reason: 'GLM Naruto trace writer persists sanitized mission-result proof artifacts, not raw env secret files',
-        expires: '4.2.0'
+        expires: '4.3.0'
     }
 ];
 const sources = listSourceFiles().map((file) => ({

package/dist/scripts/core-skill-immutable-sync-check.js

@@ -3,11 +3,12 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
 import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 const root = await makeTempRoot('sks-core-immutable-');
 const skillsRoot = path.join(root, '.agents', 'skills');
+const expectedSkillCount = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.length;
 const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-assertGate(first.installed.length === 8, 'first immutable sync must install missing managed core skills', first);
+assertGate(first.installed.length === expectedSkillCount, 'first immutable sync must install missing managed core skills', first);
 const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
 assertGate(second.installed.length === 0 && second.restored.length === 0, 'second immutable sync must be idempotent', second);
 await writeText(path.join(skillsRoot, 'loop', 'SKILL.md'), `${renderCoreSkillTemplate('loop')}\ncorruption\n`);

package/dist/scripts/core-skill-integrity-blackbox.js

@@ -3,10 +3,11 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
 import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 import { initProject } from '../core/init.js';
 const root = await makeTempRoot('sks-core-blackbox-');
 const skillsRoot = path.join(root, '.agents', 'skills');
+const expectedSkillCount = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.length;
 const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
 const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
 await writeText(path.join(skillsRoot, 'research', 'SKILL.md'), `${renderCoreSkillTemplate('research')}\nmutated\n`);
@@ -21,7 +22,7 @@ const setupIntegrity = await syncCoreSkillsIntegrity({ root: setupRoot, apply: f
 await writeText(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md'), `${renderCoreSkillTemplate('loop')}\nmutated by setup blackbox\n`);
 const setupRestore = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
 const restoredSetupText = await fs.readFile(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md'), 'utf8');
-assertGate(first.installed.length === 8, 'blackbox A: first sync installs missing core skills', first);
+assertGate(first.installed.length === expectedSkillCount, 'blackbox A: first sync installs missing core skills', first);
 assertGate(second.installed.length === 0 && second.restored.length === 0, 'blackbox B: second sync changes nothing', second);
 assertGate(third.restored.length === 1 && restoredText === renderCoreSkillTemplate('research'), 'blackbox C: managed drift restored exactly', third);
 assertGate(user.skipped_user_authored.length === 1, 'blackbox D: user skill is not overwritten', user);

package/dist/scripts/core-skill-manifest-check.js

@@ -1,10 +1,15 @@
 #!/usr/bin/env node
 import { assertGate, emitGate } from './sks-3-1-8-check-lib.js';
-import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, coreSkillDefinitions, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 import { sha256 } from '../core/fsx.js';
 const manifest = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z');
+const definitions = coreSkillDefinitions();
 assertGate(manifest.schema === 'sks.core-skill-manifest.v1', 'manifest schema mismatch', manifest);
-assertGate(manifest.skills.length === 8, 'manifest must list eight immutable core skills', manifest.skills.map((skill) => skill.canonical_name));
+assertGate(manifest.skills.length === definitions.length, 'manifest must list every immutable core skill definition', {
+    manifest: manifest.skills.map((skill) => skill.canonical_name),
+    definitions: definitions.map((skill) => skill.canonical_name)
+});
+assertGate(new Set(manifest.skills.map((skill) => skill.canonical_name)).size === manifest.skills.length, 'manifest core skill names must be unique', manifest.skills.map((skill) => skill.canonical_name));
 assertGate(CORE_SKILL_TEMPLATE_VERSION === 'sks-core-skill-template.v1', 'core skill template version must be content-schema based, not package-version based', { CORE_SKILL_TEMPLATE_VERSION });
 for (const skill of manifest.skills) {
     const content = renderCoreSkillTemplate(skill.canonical_name);

package/dist/scripts/geo-claim-evidence-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('geo-claims', {
+    title: 'Fixture That Guarantees AI Citation',
+    description: 'Fixture that guarantees AI citation and traffic lift.',
+});
+fs.appendFileSync(path.join(fixture, 'README.md'), '\nThis fixture guarantees AI citation and traffic lift.\n');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json'], { allowFailure: true }).json;
+const claims = assertMissionArtifact(audit.mission_id, 'claim-evidence-ledger.json', fixture);
+const findings = assertMissionArtifact(audit.mission_id, 'geo-findings.json', fixture);
+assertGate(claims.claims.some((claim) => claim.safe_to_publish === false && /citation|traffic/i.test(claim.claim)), 'unsupported GEO claim must be unsafe to publish', claims);
+assertGate(findings.findings.some((finding) => finding.category === 'claim-evidence' && finding.severity === 'critical'), 'unsafe claim must become critical claim-evidence finding', findings);
+assertGate(audit.ok === false || findings.findings.some((finding) => finding.blocking), 'critical unsafe claims must block the gate', { audit, findings });
+emitGate('geo:claim-evidence', { mission_id: audit.mission_id, claims: claims.claims.length });
+//# sourceMappingURL=geo-claim-evidence-check.js.map

package/dist/scripts/geo-cli-blackbox-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runSks, runSksJson } from './search-visibility-gate-lib.js';
+const commands = runSksJson(['commands', '--json']).json;
+assertGate(commands.commands.some((row) => row.name === 'seo-geo-optimizer' && /unified SEO\/GEO optimizer/i.test(row.description)), 'commands --json must expose seo-geo-optimizer');
+assertGate(!commands.commands.some((row) => row.name === 'seo' || row.name === 'geo'), 'commands --json must not expose split seo/geo command surfaces');
+const optimizerUsage = runSks(['usage', 'seo-geo-optimizer']);
+assertGate(/sks seo-geo-optimizer \[seo\|geo\] doctor\|audit\|plan\|apply\|verify\|status\|rollback\|fixture/.test(optimizerUsage.stdout), 'usage seo-geo-optimizer must expose unified lifecycle');
+const doctor = runSksJson(['seo-geo-optimizer', 'doctor', '--mode', 'geo', '--json']).json;
+assertGate(doctor.route === '$SEO-GEO-OPTIMIZER' && doctor.schema === 'sks.search-visibility.doctor-command.v1', 'optimizer geo doctor must preserve unified route identity', doctor);
+const invalid = runSks(['seo-geo-optimizer', 'nonsense-subcommand', '--mode', 'geo'], { allowFailure: true });
+assertGate(invalid.status === 2 && /Usage: sks seo-geo-optimizer/.test(invalid.stderr), 'invalid optimizer subcommand must exit 2 with usage', {
+    status: invalid.status,
+    stdout: invalid.stdout,
+    stderr: invalid.stderr,
+});
+emitGate('geo:cli-blackbox', { adapter: doctor.adapter, confidence: doctor.confidence });
+//# sourceMappingURL=geo-cli-blackbox-check.js.map

package/dist/scripts/geo-crawler-policy-check.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('geo-crawlers');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json']).json;
+const policy = assertMissionArtifact(audit.mission_id, 'ai-crawler-policy.json', fixture);
+const purposes = new Set(policy.entries.map((entry) => entry.purpose));
+const agents = new Set(policy.entries.map((entry) => entry.userAgent));
+assertGate(policy.policy.single_allow_ai_toggle === false && policy.policy.purpose_split_required === true, 'AI crawler policy must split purposes instead of one allow_ai toggle', policy);
+for (const purpose of ['search', 'training', 'user_retrieval'])
+    assertGate(purposes.has(purpose), `crawler purpose missing: ${purpose}`, policy);
+for (const agent of ['OAI-SearchBot', 'GPTBot', 'ChatGPT-User', 'Claude-SearchBot', 'ClaudeBot', 'Claude-User'])
+    assertGate(agents.has(agent), `crawler user agent missing: ${agent}`, policy);
+assertGate(policy.entries.every((entry) => entry.officialSource && entry.observedAt && entry.expiresAt), 'crawler registry entries must carry dated official sources', policy);
+emitGate('geo:crawler-purpose-policy', { mission_id: audit.mission_id, entries: policy.entries.length });
+//# sourceMappingURL=geo-crawler-policy-check.js.map

package/dist/scripts/geo-llms-txt-optional-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('geo-llms');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json']).json;
+const plan = runSksJson(['seo-geo-optimizer', 'plan', audit.mission_id, '--mode', 'geo', '--root', fixture, '--json']).json;
+const llmsPlan = assertMissionArtifact(audit.mission_id, 'llms-txt-plan.json', fixture);
+assertGate(audit.ok === true, 'missing llms.txt must not block GEO gate', audit);
+assertGate(plan.operations === 0, 'GEO plan must not create llms.txt unless --include-llms-txt is explicit', plan);
+assertGate(llmsPlan.required_for_gate === false && llmsPlan.experimental_assistive_surface === true, 'llms.txt must be optional and experimental', llmsPlan);
+assertGate(!fs.existsSync(path.join(fixture, 'llms.txt')), 'llms.txt must not be created by default');
+const explicitPlan = runSksJson(['seo-geo-optimizer', 'plan', audit.mission_id, '--mode', 'geo', '--root', fixture, '--include-llms-txt', '--json']).json;
+assertGate(explicitPlan.operations === 1, 'explicit --include-llms-txt should plan managed llms.txt creation', explicitPlan);
+const apply = runSksJson(['seo-geo-optimizer', 'apply', audit.mission_id, '--mode', 'geo', '--root', fixture, '--include-llms-txt', '--apply', '--json']).json;
+assertGate(apply.ok === true && fs.existsSync(path.join(fixture, 'llms.txt')), 'explicit llms.txt apply must create managed file', apply);
+emitGate('geo:llms-txt-optional', { mission_id: audit.mission_id });
+//# sourceMappingURL=geo-llms-txt-optional-check.js.map

package/dist/scripts/gpt-final-arbiter-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -15,13 +14,17 @@ try {
     assertGate(approved.ok === true, 'GPT final arbiter fixture must approve safe candidate', approved);
     assertGate(approved.backend === 'codex-sdk', 'GPT final arbiter backend must be codex-sdk');
     assertGate(approved.result.status === 'approved', 'safe candidate must return approved');
+    assertGate(approved.result.lean_review?.status === 'pass', 'safe candidate must pass lean review');
+    assertGate(approved.result.lean_review?.selected_rung === 'minimal-custom', 'lean review must record selected rung');
     assertGate(approved.final_gate.ok === true, 'approved arbiter result must pass final gate');
     const artifact = await readJsonFile(path.join(tmp, 'gpt-final-arbiter.json'));
     assertGate(artifact.result.schema === 'sks.gpt-final-arbiter-result.v1', 'arbiter artifact must contain schema-valid result');
+    assertGate(artifact.result.lean_review?.verification_minimum_present === true, 'arbiter artifact must record lean verification minimum');
     const unsafeTmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-arbiter-unsafe-'));
     const rejected = await mod.runGptFinalArbiter({ ...fixtureInput('unsafe'), candidate_diff: 'unsafe delete all credential patch' }, { cwd: root, mutationLedgerRoot: unsafeTmp });
     assertGate(rejected.ok === false, 'unsafe candidate must not pass final arbiter');
     assertGate(rejected.result.status === 'rejected', 'unsafe candidate must be rejected');
+    assertGate(rejected.result.lean_review?.status === 'rejected', 'unsafe candidate must reject lean review');
     assertGate(rejected.blockers.includes('unsafe_candidate_patch'), 'unsafe rejection blocker must be preserved');
     emitGate('local-collab:gpt-final-arbiter', { approved: approved.result.status, rejected: rejected.result.status });
 }

package/dist/scripts/loop-directive-check-lib.js

@@ -41,7 +41,12 @@ export async function runLoopDirectiveCheck(id) {
         process.env.SKS_LOOP_RUNTIME_FIXTURE = '1';
     }
     const fixtureMode = process.env.SKS_LOOP_RUNTIME_FIXTURE === '1' || process.env.SKS_LOOP_GATE_FIXTURE === '1';
-    const result = await runLoopPlan({ root, plan, parallelism: 'extreme', noMutation: fixtureMode ? true : !realRuntimeMode });
+    const needsRuntime = loopDirectiveNeedsRuntime(id);
+    if (!needsRuntime)
+        await writeLightweightLoopArtifacts(root, missionId, plan);
+    const result = needsRuntime
+        ? await runLoopPlan({ root, plan, parallelism: 'extreme', noMutation: fixtureMode ? true : !realRuntimeMode })
+        : { ok: true, proofs: [], graph_proof: await readJson(loopGraphProofPath(root, missionId)) };
     const assertions = [];
     const assert = (condition, message) => assertions.push({ ok: Boolean(condition), message });
     assert(validateLoopPlan(plan).ok, 'loop plan validates');
@@ -321,6 +326,78 @@ export async function runLoopDirectiveCheck(id) {
     if (failed.length)
         process.exitCode = 1;
 }
+function loopDirectiveNeedsRuntime(id) {
+    return new Set([
+        'loop:runtime',
+        'loop:worker-runtime',
+        'loop:checker-freshness',
+        'loop:runtime-real-workers',
+        'loop:maker-checker-real',
+        'loop:gate-runner-real',
+        'loop:gate-artifacts',
+        'loop:worktree-runtime',
+        'loop:integration-merge',
+        'loop:integration-finalizer-real',
+        'loop:real-maker-checker-blackbox',
+        'naruto:loop-mesh-real-blackbox',
+        'goal:loop-runtime-real-blackbox',
+        'loop:integration-finalizer'
+    ]).has(id);
+}
+async function writeLightweightLoopArtifacts(root, missionId, plan) {
+    const node = plan.graph.nodes.find((row) => row.loop_id === 'loop-zellij') || plan.graph.nodes[0];
+    if (!node)
+        return;
+    const stateFile = loopStatePath(root, missionId, node.loop_id);
+    const proofFile = loopProofPath(root, missionId, node.loop_id);
+    const graphFile = loopGraphProofPath(root, missionId);
+    await fs.mkdir(path.dirname(stateFile), { recursive: true });
+    await fs.writeFile(stateFile, JSON.stringify({
+        schema: 'sks.loop-state.v1',
+        mission_id: missionId,
+        loop_id: node.loop_id,
+        status: 'completed',
+        current_phase: 'static-fixture',
+        updated_at: new Date().toISOString()
+    }, null, 2));
+    await fs.writeFile(proofFile, JSON.stringify({
+        schema: 'sks.loop-proof.v1',
+        mission_id: missionId,
+        loop_id: node.loop_id,
+        status: 'completed',
+        iterations: 1,
+        owner_scope: node.owner_scope,
+        maker_result: { backend: 'static-fixture', worker_count: 0, artifacts: [], patch_candidates: [], changed_files: [], blockers: [], ok: true },
+        checker_result: { backend: 'static-fixture', worker_count: 0, artifacts: [], checker_findings: [], fresh_session: true, blockers: [], ok: true },
+        gate_result: { ok: true, selected_gates: [], passed_gates: [], failed_gates: [], skipped_gates: [], blockers: [] },
+        budget: { used: { iterations: 1 } },
+        handoff: { required: false, reason: null },
+        worktree: { id: null, path: null, branch: null },
+        changed_files: [],
+        patch_bytes: 0,
+        blockers: []
+    }, null, 2));
+    await fs.mkdir(path.dirname(graphFile), { recursive: true });
+    await fs.writeFile(graphFile, JSON.stringify({
+        schema: 'sks.loop-graph-proof.v1',
+        mission_id: missionId,
+        ok: true,
+        total_loops: plan.graph.nodes.length,
+        completed_loops: plan.graph.nodes.length,
+        blocked_loops: 0,
+        failed_loops: 0,
+        handoff_loops: 0,
+        parallelism: {
+            max_active_loops: Math.min(plan.graph.nodes.length, 4),
+            max_active_workers: 0,
+            wall_ms: 1,
+            sequential_estimate_ms: Math.max(1, plan.graph.nodes.length),
+            speedup_ratio: Math.max(1, plan.graph.nodes.length)
+        },
+        gates: { selected: [], passed: [], failed: [], skipped: [] },
+        blockers: []
+    }, null, 2));
+}
 async function exists(file) {
     try {
         await fs.access(file);