sneakoscope 4.2.0 → 4.3.0

package/dist/core/codex-control/codex-app-server-v2-client.js

@@ -8,10 +8,12 @@ export class CodexAppServerV2Client {
     cwd;
     timeoutMs;
     currentTimeProvider;
+    approvalPolicy;
     child = null;
     nextId = 1;
     pending = new Map();
     notifications = [];
+    listeners = new Set();
     stdoutBuffer = '';
     stderr = '';
     constructor(options) {
@@ -21,6 +23,7 @@ export class CodexAppServerV2Client {
         this.cwd = options.cwd || process.cwd();
         this.timeoutMs = Number(options.timeoutMs || 20_000);
         this.currentTimeProvider = options.currentTimeProvider || (() => new Date());
+        this.approvalPolicy = options.approvalPolicy || {};
     }
     async initialize() {
         this.start();
@@ -36,18 +39,58 @@ export class CodexAppServerV2Client {
                 optOutNotificationMethods: []
             }
         });
-        this.notify('notifications/initialized', {});
+        this.notify('initialized', {});
         return result;
     }
     async listThreads(params = {}) {
         return await this.request('thread/list', normalizeThreadListParams(params));
     }
+    async startThread(params = {}) {
+        return await this.request('thread/start', params);
+    }
+    async resumeThread(params = {}) {
+        return await this.request('thread/resume', params);
+    }
     async searchThreads(searchTerm, params = {}) {
         return await this.listThreads({ ...params, searchTerm });
     }
     async readThread(threadId, includeTurns = false) {
         return await this.request('thread/read', { threadId, includeTurns });
     }
+    async startTurn(params = {}) {
+        return await this.request('turn/start', params);
+    }
+    async steerTurn(params = {}) {
+        return await this.request('turn/steer', params);
+    }
+    async interruptTurn(params = {}) {
+        return await this.request('turn/interrupt', params);
+    }
+    onEvent(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    waitForNotification(methods, timeoutMs = this.timeoutMs) {
+        const expected = new Set(Array.isArray(methods) ? methods.map(String) : [String(methods)]);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                dispose();
+                reject(new Error(`Timed out waiting for app-server notification: ${Array.from(expected).join(', ')}`));
+            }, timeoutMs);
+            timer.unref?.();
+            const dispose = this.onEvent((event) => {
+                if (event && expected.has(String(event.method || ''))) {
+                    clearTimeout(timer);
+                    dispose();
+                    resolve(event);
+                }
+            });
+        });
+    }
+    async waitForTurnCompletion(threadId, turnId, timeoutMs = this.timeoutMs) {
+        const expected = turnId ? ['turn/completed', 'thread/closed', 'thread/status/changed'] : ['turn/completed', 'thread/closed'];
+        return await this.waitForNotification(expected, timeoutMs);
+    }
     start() {
         if (this.child)
             return;
@@ -107,7 +150,14 @@ export class CodexAppServerV2Client {
                 void this.respondToServerRequest(message);
             }
             else {
-                this.notifications.push({ ...message, received_at: nowIso() });
+                const event = { ...message, received_at: nowIso() };
+                this.notifications.push(event);
+                for (const listener of this.listeners) {
+                    try {
+                        listener(event);
+                    }
+                    catch { }
+                }
             }
         }
     }
@@ -119,6 +169,38 @@ export class CodexAppServerV2Client {
                 this.write({ jsonrpc: '2.0', id, result: currentTimeResponse(this.currentTimeProvider()) });
                 return;
             }
+            if (method === 'item/commandExecution/requestApproval' || method === 'commandExecution/requestApproval') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.commandExecution?.(message.params) || { decision: 'cancel' } });
+                return;
+            }
+            if (method === 'item/fileChange/requestApproval' || method === 'fileChange/requestApproval') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.fileChange?.(message.params) || { decision: 'cancel' } });
+                return;
+            }
+            if (method === 'item/permissions/requestApproval' || method === 'permissions/requestApproval') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.permissions?.(message.params) || { permissions: { network: { enabled: false }, fileSystem: { read: [], write: [], entries: [] } }, scope: 'turn', strictAutoReview: true } });
+                return;
+            }
+            if (method === 'item/tool/requestUserInput') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.toolRequestUserInput?.(message.params) || { answers: {} } });
+                return;
+            }
+            if (method === 'item/tool/call') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.dynamicToolCall?.(message.params) || { contentItems: [], success: false } });
+                return;
+            }
+            if (method === 'mcpServer/elicitation/request') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.mcpElicitation?.(message.params) || { contentItems: [], success: false } });
+                return;
+            }
+            if (method === 'attestation/generate') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.attestation?.(message.params) || { decision: 'cancel' } });
+                return;
+            }
+            if (method === 'account/chatgptAuthTokens/refresh') {
+                this.write({ jsonrpc: '2.0', id, result: this.approvalPolicy.chatgptAuthTokensRefresh?.(message.params) || { ok: false } });
+                return;
+            }
             this.write({
                 jsonrpc: '2.0',
                 id,
@@ -182,6 +264,8 @@ export async function createCodexAppServerV2Client(options = {}) {
         clientOptions.timeoutMs = options.timeoutMs;
     if (options.currentTimeProvider !== undefined)
         clientOptions.currentTimeProvider = options.currentTimeProvider;
+    if (options.approvalPolicy !== undefined)
+        clientOptions.approvalPolicy = options.approvalPolicy;
     return {
         client: new CodexAppServerV2Client(clientOptions),
         runtimeIdentity: runtime.identity

package/dist/core/codex-control/codex-fake-sdk-adapter.js

@@ -27,22 +27,44 @@ export async function runFakeCodexSdkTask(input) {
 }
 function fakeStructuredOutput(input) {
     if (input.outputSchemaId === GPT_FINAL_ARBITER_RESULT_SCHEMA_ID) {
-        const unsafe = /\b(truncate|delete all|drop table|credential)\b/i.test(input.prompt || '');
+        const prompt = String(input.prompt || '');
+        const leanEnabled = /\b(Lean review|Lean Engineering Policy|sks\.lean-engineering-policy)\b/i.test(prompt);
+        const unsafe = /\b(truncate|delete all|drop table|credential|delete validation|validation removed|path traversal|sql injection|secret leak)\b/i.test(prompt);
+        const overbuild = leanEnabled ? classifyLeanOverbuild(prompt) : null;
+        const status = unsafe ? 'rejected' : overbuild ? 'needs_more_work' : 'approved';
+        const leanStatus = unsafe ? 'rejected' : overbuild ? 'needs_more_work' : 'pass';
+        const blockers = unsafe ? ['unsafe_candidate_patch'] : overbuild?.blockers || [];
+        const findings = unsafe
+            ? [{ id: 'unsafe-candidate', severity: 'high', summary: 'unsafe candidate rejected' }]
+            : overbuild ? overbuild.findings : [];
         return {
             schema: GPT_FINAL_ARBITER_RESULT_SCHEMA_ID,
-            status: unsafe ? 'rejected' : 'approved',
+            status,
             summary: unsafe
                 ? 'Fake Codex SDK GPT final arbiter rejected an unsafe candidate for hermetic verification.'
-                : 'Fake Codex SDK GPT final arbiter approved the candidate for hermetic verification.',
-            gpt_review_findings: unsafe ? [{ id: 'unsafe-candidate', severity: 'high', summary: 'unsafe candidate rejected' }] : [],
-            accepted_patch_envelopes: unsafe ? [] : [],
+                : overbuild
+                    ? 'Fake Codex SDK GPT final arbiter requested a leaner candidate for hermetic verification.'
+                    : 'Fake Codex SDK GPT final arbiter approved the candidate for hermetic verification.',
+            gpt_review_findings: findings,
+            accepted_patch_envelopes: status === 'approved' ? [] : [],
             modified_patch_envelopes: [],
-            rejected_patch_envelopes: unsafe ? [{ id: 'unsafe-candidate', summary: 'unsafe candidate', patch_envelope_json: '{}' }] : [],
-            required_followup_work: unsafe ? [{ id: 'unsafe_candidate_patch', severity: 'high', summary: 'unsafe_candidate_patch' }] : [],
+            rejected_patch_envelopes: status === 'rejected' ? [{ id: blockers[0] || 'rejected-candidate', summary: blockers[0] || 'rejected candidate', patch_envelope_json: '{}' }] : [],
+            required_followup_work: blockers.map((blocker) => ({ id: blocker, severity: unsafe ? 'high' : 'medium', summary: blocker })),
             verification_plan: ['schema validation', 'local collaboration final gate'],
             rollback_notes: [],
-            blockers: unsafe ? ['unsafe_candidate_patch'] : [],
-            confidence: unsafe ? 'medium' : 'high'
+            blockers,
+            lean_review: {
+                status: leanStatus,
+                selected_rung: unsafe ? 'unknown' : overbuild?.selected_rung || 'minimal-custom',
+                unnecessary_files: [],
+                unnecessary_dependencies: overbuild?.unnecessary_dependencies || [],
+                unnecessary_abstractions: overbuild?.unnecessary_abstractions || [],
+                fallback_findings: unsafe ? ['unsafe_candidate_patch'] : overbuild?.fallback_findings || [],
+                root_cause_review: overbuild?.root_cause_review || [],
+                verification_minimum_present: !unsafe && !/\b(missing runnable check|no runnable check)\b/i.test(prompt),
+                net_lines: null
+            },
+            confidence: unsafe || overbuild ? 'medium' : 'high'
         };
     }
     return {
@@ -56,4 +78,40 @@ function fakeStructuredOutput(input) {
         blockers: []
     };
 }
+function classifyLeanOverbuild(prompt) {
+    if (/\b(existing helper reimplementation|same helper reimplementation|reimplement existing helper)\b/i.test(prompt)) {
+        return leanFinding('reuse_existing_helper', 'reuse-existing', 'Candidate reimplements an existing helper instead of reusing the repository authority.', {
+            root_cause_review: ['reuse existing helper or fix the common helper once']
+        });
+    }
+    if (/\b(new dependency|dependency bloat|native platform instead of dependency)\b/i.test(prompt)) {
+        return leanFinding('unnecessary_dependency', 'stdlib', 'Candidate adds a dependency where stdlib or platform support is sufficient.', {
+            unnecessary_dependencies: ['unjustified dependency']
+        });
+    }
+    if (/\b(one implementation factory|single implementation factory|one implementation interface)\b/i.test(prompt)) {
+        return leanFinding('single_impl_abstraction', 'minimal-custom', 'Candidate adds an abstraction without a second implementation or real variation axis.', {
+            unnecessary_abstractions: ['single implementation factory/interface']
+        });
+    }
+    if (/\b(hidden mock fallback|silent mock fallback|fixture fallback)\b/i.test(prompt)) {
+        return leanFinding('hidden_fallback', 'minimal-custom', 'Candidate hides a production failure behind a mock or fixture fallback.', {
+            fallback_findings: ['hidden mock fallback']
+        });
+    }
+    if (/\b(caller duplicate guard|duplicate caller guard|symptom patch)\b/i.test(prompt)) {
+        return leanFinding('root_cause_missing', 'minimal-custom', 'Candidate patches a caller symptom instead of the shared root cause.', {
+            root_cause_review: ['move duplicated guard to the shared root-cause helper']
+        });
+    }
+    return null;
+}
+function leanFinding(id, selectedRung, summary, extra = {}) {
+    return {
+        selected_rung: selectedRung,
+        blockers: [id],
+        findings: [{ id, severity: 'medium', summary }],
+        ...extra
+    };
+}
 //# sourceMappingURL=codex-fake-sdk-adapter.js.map

package/dist/core/codex-control/codex-reliability-shield.js

@@ -37,6 +37,7 @@ export async function runWithCodexReliabilityShield(input, runAttempt) {
             break;
     }
     const blockers = attempts.flatMap((attempt) => attempt.blockers);
+    const modelCapacityRetryCount = attempts.filter((attempt) => attempt.model_capacity_error && attempt.retryable).length;
     const report = {
         schema: CODEX_RELIABILITY_SHIELD_SCHEMA,
         generated_at: nowIso(),
@@ -52,6 +53,8 @@ export async function runWithCodexReliabilityShield(input, runAttempt) {
         heartbeat_count: attempts.reduce((sum, attempt) => sum + attempt.heartbeat_count, 0),
         repaired_tool_result_count: attempts.reduce((sum, attempt) => sum + attempt.repaired_tool_result_count, 0),
         no_duplicate_streamed_output: attempts.slice(0, -1).every((attempt) => attempt.meaningful_event_count === 0),
+        model_capacity_retry_count: modelCapacityRetryCount,
+        selected_model_capacity_fallback: selectedAttempt > 1 && modelCapacityRetryCount > 0,
         blockers
     };
     return {
@@ -61,24 +64,27 @@ export async function runWithCodexReliabilityShield(input, runAttempt) {
 }
 export function evaluateCodexReliabilityAttempt(result, events, policy, attempt) {
     const meaningful = events.filter(isMeaningfulEvent);
-    const fatal = hasFatalError(result, events);
+    const modelCapacity = isCodexModelCapacityError(result, events);
+    const fatal = !modelCapacity && hasFatalError(result, events);
     const idle = hasIdleTimeout(events, policy.idleTimeoutMs);
     const empty = events.length === 0 || (!String(result.finalResponse || '').trim() && meaningful.length === 0);
     const partial = meaningful.length > 0 && !result.structuredOutput;
     const blockers = [];
     let retryable = false;
     let retryReason = null;
-    if (idle && partial)
+    if (modelCapacity)
+        blockers.push('codex_model_capacity_unavailable');
+    if (!modelCapacity && idle && partial)
         blockers.push('codex_reliability_idle_after_partial_output');
-    if (partial && !idle)
+    if (!modelCapacity && partial && !idle)
         blockers.push('codex_reliability_partial_output_without_structured_result');
     if (fatal)
         blockers.push('codex_reliability_fatal_error_no_retry');
-    if (!fatal && idle && meaningful.length === 0) {
+    if (!modelCapacity && !fatal && idle && meaningful.length === 0) {
         retryable = true;
         retryReason = 'stream_idle_before_meaningful_event';
     }
-    else if (!fatal && empty) {
+    else if (!modelCapacity && !fatal && empty) {
         retryable = true;
         retryReason = 'empty_sdk_result_before_meaningful_event';
     }
@@ -92,11 +98,26 @@ export function evaluateCodexReliabilityAttempt(result, events, policy, attempt)
         retry_reason: retryReason,
         idle_timeout: idle,
         fatal_error: fatal,
+        model_capacity_error: modelCapacity,
+        capacity_fallback_hint: null,
         repaired_tool_result_count: 0,
         heartbeat_count: 0,
         blockers
     };
 }
+export function isCodexModelCapacityError(result, events) {
+    const text = [
+        String(result.finalResponse || ''),
+        ...(Array.isArray(result.blockers) ? result.blockers : []),
+        ...events.map((event) => [
+            event?.error?.message,
+            event?.message,
+            event?.item?.text,
+            event?.raw?.failed_event?.error?.message
+        ].filter(Boolean).join('\n'))
+    ].join('\n');
+    return /selected model is at capacity|model(?:\s+[\w.-]+)?\s+is\s+at\s+capacity|try a different model|capacity(?:\s+is)?\s+exhausted|temporarily at capacity/i.test(text);
+}
 export function repairToolCallSequence(events) {
     const repaired = [...events];
     const openToolCalls = new Set();

package/dist/core/codex-control/codex-task-runner.js

@@ -118,6 +118,8 @@ export async function runCodexTask(input) {
         patchEnvelopePath,
         blockers: finalBlockers,
         reliabilityShield: adapterResult?.reliabilityShield || null,
+        capacityFallback: adapterResult?.reliabilityShield?.selected_model_capacity_fallback === true,
+        modelCapacityRetryCount: Number(adapterResult?.reliabilityShield?.model_capacity_retry_count || 0),
         ultraRouterDecision: routerDecision,
         outputSchemaId: task.outputSchemaId,
         finalResponse: adapterResult?.finalResponse || '',
@@ -146,7 +148,11 @@ export async function runCodexTask(input) {
         result,
         capability: capability,
         sandbox,
-        envProof: runtime.env.proof,
+        envProof: {
+            ...runtime.env.proof,
+            capacity_fallback_selected: result.capacityFallback === true,
+            model_capacity_retry_count: result.modelCapacityRetryCount
+        },
         config: runtime.config,
         reliabilityShield: adapterResult?.reliabilityShield || null,
         routerDecision: routerDecision,

package/dist/core/codex-control/gpt-final-arbiter.js

@@ -5,6 +5,7 @@ import { evaluateLocalCollaborationFinalGate, resolveLocalCollaborationPolicy }
 import { runCodexTask } from './codex-control-plane.js';
 import { GPT_FINAL_ARBITER_INPUT_SCHEMA, GPT_FINAL_ARBITER_RESULT_SCHEMA_ID, gptFinalArbiterResultSchema, normalizeGptFinalArbiterResult } from './gpt-final-review-schema.js';
 import { compressGptFinalContext } from './gpt-final-context-compressor.js';
+import { leanEngineeringCompactText } from '../lean-engineering-policy.js';
 export const GPT_FINAL_ARBITER_RUN_SCHEMA = 'sks.gpt-final-arbiter-run.v1';
 export async function runGptFinalArbiter(input, opts = {}) {
     const started = Date.now();
@@ -145,7 +146,9 @@ function buildArbiterPrompt(input, compressed) {
     return [
         'You are the GPT Final Arbiter for an SKS local collaboration run.',
         'Local model outputs are drafts only. Review the proof pack, candidate diff, patch envelopes, verification results, side effects, mutation ledger, and rollback plan.',
-        'Approve or modify only when the candidate is safe and supported. Reject unsafe local patches. Return only the requested structured JSON schema.',
+        leanEngineeringCompactText(),
+        'Lean review: check for reused helpers before reimplementation, unjustified dependencies, one-implementation factories/interfaces, hidden mock or provider fallbacks, duplicated caller guards instead of root-cause fixes, forwarding-only files, missing runnable checks for non-trivial logic, and safety/validation removal disguised as simplification.',
+        'Approve or modify only when the candidate is safe, supported, and no more complex than the request requires. Reject unsafe local patches. Return only the requested structured JSON schema.',
         JSON.stringify({
             route: input.route,
             mission_id: input.mission_id,

package/dist/core/codex-control/gpt-final-review-schema.js

@@ -1,3 +1,4 @@
+import { LEAN_SOLUTION_RUNGS } from '../lean-engineering-policy.js';
 export const GPT_FINAL_ARBITER_RESULT_SCHEMA_ID = 'sks.gpt-final-arbiter-result.v1';
 export const GPT_FINAL_ARBITER_INPUT_SCHEMA = 'sks.gpt-final-arbiter-input.v1';
 const reviewItemSchema = {
@@ -20,6 +21,32 @@ const patchDecisionSchema = {
     },
     additionalProperties: false
 };
+const leanReviewSchema = {
+    type: 'object',
+    required: [
+        'status',
+        'selected_rung',
+        'unnecessary_files',
+        'unnecessary_dependencies',
+        'unnecessary_abstractions',
+        'fallback_findings',
+        'root_cause_review',
+        'verification_minimum_present',
+        'net_lines'
+    ],
+    properties: {
+        status: { enum: ['pass', 'modified', 'rejected', 'needs_more_work'] },
+        selected_rung: { enum: [...LEAN_SOLUTION_RUNGS, 'unknown'] },
+        unnecessary_files: { type: 'array', items: { type: 'string' } },
+        unnecessary_dependencies: { type: 'array', items: { type: 'string' } },
+        unnecessary_abstractions: { type: 'array', items: { type: 'string' } },
+        fallback_findings: { type: 'array', items: { type: 'string' } },
+        root_cause_review: { type: 'array', items: { type: 'string' } },
+        verification_minimum_present: { type: 'boolean' },
+        net_lines: { type: ['number', 'null'] }
+    },
+    additionalProperties: false
+};
 export const gptFinalArbiterResultSchema = {
     type: 'object',
     required: [
@@ -34,6 +61,7 @@ export const gptFinalArbiterResultSchema = {
         'verification_plan',
         'rollback_notes',
         'blockers',
+        'lean_review',
         'confidence'
     ],
     properties: {
@@ -48,6 +76,7 @@ export const gptFinalArbiterResultSchema = {
         verification_plan: { type: 'array', items: { type: 'string' } },
         rollback_notes: { type: 'array', items: { type: 'string' } },
         blockers: { type: 'array', items: { type: 'string' } },
+        lean_review: leanReviewSchema,
         confidence: { enum: ['low', 'medium', 'high'] }
     },
     additionalProperties: false
@@ -66,6 +95,7 @@ export function normalizeGptFinalArbiterResult(value) {
         verification_plan: stringArray(value?.verification_plan),
         rollback_notes: stringArray(value?.rollback_notes),
         blockers: stringArray(value?.blockers),
+        lean_review: normalizeLeanReview(value?.lean_review, status),
         confidence: normalizeConfidence(value?.confidence)
     };
 }
@@ -107,6 +137,34 @@ function patchDecisionItems(value) {
 function stringArray(value) {
     return Array.isArray(value) ? value.map((entry) => String(entry || '').trim()).filter(Boolean) : [];
 }
+function normalizeLeanReview(value, arbiterStatus) {
+    const raw = typeof value === 'object' && value !== null ? value : {};
+    return {
+        status: normalizeLeanReviewStatus(raw.status, arbiterStatus),
+        selected_rung: normalizeLeanRung(raw.selected_rung),
+        unnecessary_files: stringArray(raw.unnecessary_files),
+        unnecessary_dependencies: stringArray(raw.unnecessary_dependencies),
+        unnecessary_abstractions: stringArray(raw.unnecessary_abstractions),
+        fallback_findings: stringArray(raw.fallback_findings),
+        root_cause_review: stringArray(raw.root_cause_review),
+        verification_minimum_present: typeof raw.verification_minimum_present === 'boolean' ? raw.verification_minimum_present : arbiterStatus === 'approved' || arbiterStatus === 'modified',
+        net_lines: Number.isFinite(Number(raw.net_lines)) ? Number(raw.net_lines) : null
+    };
+}
+function normalizeLeanReviewStatus(value, arbiterStatus) {
+    if (value === 'pass' || value === 'modified' || value === 'rejected' || value === 'needs_more_work')
+        return value;
+    if (arbiterStatus === 'approved')
+        return 'pass';
+    if (arbiterStatus === 'modified')
+        return 'modified';
+    if (arbiterStatus === 'rejected')
+        return 'rejected';
+    return 'needs_more_work';
+}
+function normalizeLeanRung(value) {
+    return typeof value === 'string' && [...LEAN_SOLUTION_RUNGS, 'unknown'].includes(value) ? value : 'unknown';
+}
 function normalizeSeverity(value) {
     return value === 'low' || value === 'medium' || value === 'high' ? value : 'medium';
 }

package/dist/core/codex-control/model-call-concurrency.js

@@ -56,7 +56,7 @@ export function defaultModelCallBudget(provider) {
     const text = String(provider || '');
     if (text === 'local-llm' || text === 'ollama')
         return envInt('SKS_LOCAL_LLM_MAX_PARALLEL_REQUESTS', 4);
-    return envInt('SKS_REMOTE_API_PARALLEL_BUDGET', 12);
+    return envInt('SKS_REMOTE_API_PARALLEL_BUDGET', 3);
 }
 class ModelCallSemaphoreImpl {
     provider;

package/dist/core/codex-native/core-skill-manifest.js

@@ -1,4 +1,5 @@
 import { PACKAGE_VERSION, nowIso, sha256 } from '../fsx.js';
+import { leanPolicyReference } from '../lean-engineering-policy.js';
 import { canonicalSkillName } from './skill-name-canonicalizer.js';
 export const CORE_SKILL_TEMPLATE_VERSION = 'sks-core-skill-template.v1';
 export const CORE_SKILL_MANAGED_BEGIN = '<!-- BEGIN SKS IMMUTABLE CORE SKILL -->';
@@ -83,6 +84,26 @@ const CORE_SKILL_DEFINITIONS = [
         when: 'Use when deeper local context or directory-specific recall is required.',
         evidence: '.sneakoscope/context/AGENTS.generated.md and managed memory artifacts.',
         fallback: 'Preserve user content and skip directories that cannot be safely updated.'
+    },
+    {
+        id: 'sks-core-search-visibility-core',
+        canonical_name: 'search-visibility-core',
+        display_name: 'search-visibility-core',
+        route: '$SEO-GEO-OPTIMIZER',
+        purpose: 'provide the shared search-visibility kernel for SEO and GEO audit, plan, explicit apply, verify, rollback, and Completion Proof without ranking, traffic, or citation guarantees.',
+        when: 'Use when $SEO-GEO-OPTIMIZER or sks seo-geo-optimizer needs typed mode-specific evidence, gates, artifacts, or safe mutation planning.',
+        evidence: 'search-visibility artifacts, seo-gate.json or geo-gate.json, mutation-plan.json, rollback-manifest.json, verification-report.json, and completion-proof.json.',
+        fallback: 'Keep unsupported frameworks plan-only, record unverified production/browser/Search Console/AI citation outcomes, and never invent guarantee evidence.'
+    },
+    {
+        id: 'sks-core-seo-geo-optimizer',
+        canonical_name: 'seo-geo-optimizer',
+        display_name: 'seo-geo-optimizer',
+        route: '$SEO-GEO-OPTIMIZER',
+        purpose: 'run the unified SEO/GEO optimizer route for Search Engine Optimization and Generative Engine Optimization, not geolocation or GeoIP, with no ranking, traffic, indexing, rich-result, answer inclusion, or AI citation guarantee.',
+        when: 'Use the CLI entrypoint: sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo for SEO and GEO visibility work.',
+        evidence: 'site inventory, route graph, seo-findings.json or geo-findings.json, claim-evidence-ledger.json, ai-crawler-policy.json, llms-txt-plan.json, verification report, route gate, and Completion Proof.',
+        fallback: 'Do not auto-allow training crawlers or fabricate AI answer visibility; mark missing live outcomes unverified and keep recovery on the unified optimizer route.'
     }
 ];
 export function coreSkillDefinitions() {
@@ -97,6 +118,7 @@ export function renderCoreSkillTemplate(name) {
     const skill = CORE_SKILL_DEFINITIONS.find((entry) => entry.canonical_name === canonical);
     if (!skill)
         throw new Error(`Unknown SKS core skill: ${name}`);
+    const lean = leanPolicyReference();
     return [
         '---',
         `name: ${skill.display_name}`,
@@ -117,6 +139,7 @@ export function renderCoreSkillTemplate(name) {
         `Command: ${skill.route}`,
         `Purpose: ${skill.purpose}`,
         `Use when: ${skill.when}`,
+        `Lean policy: ${lean.policy_id}/${lean.policy_hash}`,
         `Proof paths: ${skill.evidence}`,
         'Safety rules: preserve user-authored skills, keep route state bounded, and stop on hard blockers instead of fabricating fallback behavior.',
         `Failure recovery: ${skill.fallback}`,

package/dist/core/commands/bench-command.js

@@ -1,4 +1,4 @@
-import { TRUST_VALIDATE_BENCH_COMMAND, benchRoot, runCoreBench } from '../bench.js';
+import { TRUST_VALIDATE_BENCH_COMMAND, benchRoot, runCoreBench, runLeanPolicyBench } from '../bench.js';
 import { runProcess } from '../fsx.js';
 import { flag, readFlagValue } from './command-utils.js';
 export async function benchCommand(args = []) {
@@ -18,9 +18,18 @@ export async function benchCommand(args = []) {
     }
     if (action === 'route-fixtures')
         return commandBench('sks.route-fixture-bench.v1', ['all-features', 'selftest', '--mock', '--execute-fixtures', '--strict-artifacts', '--json'], args);
+    if (action === 'lean-policy') {
+        const report = await runLeanPolicyBench(root);
+        if (!report.ok)
+            process.exitCode = 1;
+        if (flag(args, '--json'))
+            return console.log(JSON.stringify(report, null, 2));
+        console.log(`lean-policy: ${report.ok ? 'pass' : 'blocked'}`);
+        return report;
+    }
     if (action === 'blackbox')
         return commandBench('sks.blackbox-bench.v1', ['blackbox-matrix-placeholder'], args);
-    console.error('Usage: sks bench core|route-fixtures|blackbox|trust-kernel [--json] [--iterations N]');
+    console.error('Usage: sks bench core|route-fixtures|lean-policy|blackbox|trust-kernel [--json] [--iterations N]');
     process.exitCode = 2;
 }
 async function commandBench(schema, commandArgs, args = []) {

package/dist/core/commands/code-structure-command.js

@@ -4,18 +4,50 @@ import { flag } from './command-utils.js';
 export async function codeStructureCommand(sub, args = []) {
     const action = sub || 'scan';
     if (action !== 'scan') {
-        console.error('Usage: sks code-structure scan [--json]');
+        console.error('Usage: sks code-structure scan [--json] [--all] [--changed [ref|file[,file]]] [--changed-since <ref>]');
         process.exitCode = 1;
         return;
     }
     const root = await sksRoot();
-    const report = await scanCodeStructure(root, { includeOk: flag(args, '--all') });
+    const changedArg = valueAfter(args, '--changed');
+    const changedSince = valueAfter(args, '--changed-since');
+    const changedArgLooksLikeFiles = Boolean(changedArg && (changedArg.includes(',')
+        || changedArg.includes('/')
+        || changedArg.includes('\\')
+        || /\.(js|ts|tsx|jsx|mjs|cjs|json|md|rs|toml)$/i.test(changedArg)));
+    const changedFiles = changedArg && changedArgLooksLikeFiles
+        ? changedArg.split(',').map((file) => file.trim()).filter(Boolean)
+        : [];
+    const report = await scanCodeStructure(root, {
+        includeOk: flag(args, '--all'),
+        changed: flag(args, '--changed') ? (changedFiles.length ? true : changedArg || true) : false,
+        changedSince,
+        changedFiles
+    });
     if (flag(args, '--json'))
         return console.log(JSON.stringify(report, null, 2));
     console.log('SKS Code Structure');
+    if (report.changed_scope?.mode !== 'full') {
+        console.log(`Changed scope: ${report.changed_scope.changed_files.length} files, ${report.changed_scope.net_lines} net lines`);
+        console.log(`Lean semantic review: ${report.semantic_review?.status || 'unknown'}`);
+    }
     for (const file of report.files.slice(0, 20))
         console.log(`${file.status} ${file.line_count} ${file.path}`);
     if (report.remaining_risks.length)
         console.log(`Risks: ${report.remaining_risks.join(', ')}`);
+    if (report.semantic_review?.findings?.length) {
+        for (const finding of report.semantic_review.findings.slice(0, 8)) {
+            console.log(`Lean ${finding.severity}: ${finding.file ? `${finding.file}: ` : ''}${finding.summary}`);
+        }
+    }
+}
+function valueAfter(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1)
+        return null;
+    const value = args[index + 1];
+    if (!value || String(value).startsWith('--'))
+        return null;
+    return String(value);
 }
 //# sourceMappingURL=code-structure-command.js.map