sneakoscope 4.2.0 → 4.3.0

package/dist/core/lean-engineering-policy.js

@@ -0,0 +1,159 @@
+import { createHash } from 'node:crypto';
+export const LEAN_ENGINEERING_POLICY_ID = 'sks.lean-engineering-policy.v1';
+export const LEAN_DECISION_SCHEMA = 'sks.lean-decision.v1';
+export const LEAN_CHANGE_EVIDENCE_SCHEMA = 'sks.lean-change-evidence.v1';
+export const LEAN_SOLUTION_RUNGS = Object.freeze([
+    'skip',
+    'reuse-existing',
+    'stdlib',
+    'native-platform',
+    'installed-dependency',
+    'single-expression',
+    'minimal-custom'
+]);
+const LEAN_ENGINEERING_POLICY_CANONICAL = [
+    'Understand the real flow before changing code.',
+    'Stop at the highest sufficient rung: skip, reuse existing code, stdlib, native platform, installed dependency, safe single expression, minimal custom code.',
+    'Do not add unrequested routes, commands, daemons, dependencies, abstractions, config flags, shims, or hidden fallbacks.',
+    'Fix shared root causes instead of duplicating caller-specific symptom guards.',
+    'Capability and compatibility fallbacks require one authority, proof, bounded scope, and honest verification level.',
+    'Never remove trust-boundary validation, data-loss protection, security, permissions, rollback, accessibility, or explicit user requirements to shrink a diff.',
+    'Non-trivial logic needs one smallest runnable check.'
+].join('\n');
+export const LEAN_ENGINEERING_POLICY_HASH = createHash('sha256')
+    .update(LEAN_ENGINEERING_POLICY_CANONICAL)
+    .digest('hex')
+    .slice(0, 16);
+export function leanPolicyReference() {
+    return {
+        policy_id: LEAN_ENGINEERING_POLICY_ID,
+        policy_hash: LEAN_ENGINEERING_POLICY_HASH
+    };
+}
+export function leanEngineeringCompactText() {
+    return [
+        `Lean Engineering Policy (${LEAN_ENGINEERING_POLICY_ID}/${LEAN_ENGINEERING_POLICY_HASH}):`,
+        'Read the touched flow first, then stop at the highest sufficient rung: skip, reuse existing, stdlib, native platform, installed dependency, safe single expression, minimal custom.',
+        'No unrequested route/command/daemon/dependency/abstraction/config flag/shim/hidden fallback; required capability/compatibility fallback needs one authority, proof, and bounded scope.',
+        'Fix root cause once, preserve trust-boundary validation/security/rollback/accessibility/user requirements, and leave one runnable check for non-trivial logic.'
+    ].join('\n');
+}
+export function leanEngineeringLongText() {
+    return [
+        leanEngineeringCompactText(),
+        'Forbidden fallback: silent mock/fixture success, provider contract switching without authority, catch-all empty success, unused future shims, duplicate legacy/new SSOTs, or production proof from test fakes.',
+        'Allowed fallback: same contract or explicit narrower contract, capability detection, one selection authority, recorded provider/proof level, honest downgrade when used, and a bounded chain.',
+        'Compatibility bridge: one canonical implementation; legacy entry only converts arguments, emits deprecation context, and has a sunset trigger.',
+        'Intentional simplification marker: `sks-lean: ceiling=<known limit>; revisit_when=<measurable trigger>; upgrade=<specific path>`.'
+    ].join('\n');
+}
+export function normalizeLeanDecision(input = {}, defaults = {}) {
+    const value = record(input);
+    const defaultFallback = defaults.fallback_plan || { kind: 'none', authority: null, justification: null };
+    return {
+        schema: LEAN_DECISION_SCHEMA,
+        policy_id: LEAN_ENGINEERING_POLICY_ID,
+        policy_hash: LEAN_ENGINEERING_POLICY_HASH,
+        selected_rung: normalizeRung(value.selected_rung, defaults.selected_rung || 'minimal-custom'),
+        task_requires_change: booleanValue(value.task_requires_change, defaults.task_requires_change ?? true),
+        root_cause_target: nullableString(value.root_cause_target, defaults.root_cause_target ?? null),
+        reused_paths: stringArray(value.reused_paths, defaults.reused_paths),
+        stdlib_or_native_choice: nullableString(value.stdlib_or_native_choice, defaults.stdlib_or_native_choice ?? null),
+        new_dependency_requested: booleanValue(value.new_dependency_requested, defaults.new_dependency_requested ?? false),
+        new_dependency_justification: nullableString(value.new_dependency_justification, defaults.new_dependency_justification ?? null),
+        new_abstraction_requested: booleanValue(value.new_abstraction_requested, defaults.new_abstraction_requested ?? false),
+        new_abstraction_justification: nullableString(value.new_abstraction_justification, defaults.new_abstraction_justification ?? null),
+        fallback_plan: normalizeFallbackPlan(value.fallback_plan, defaultFallback),
+        expected_changed_paths: stringArray(value.expected_changed_paths, defaults.expected_changed_paths),
+        verification_minimum: stringArray(value.verification_minimum, defaults.verification_minimum)
+    };
+}
+export function validateLeanDecision(input) {
+    const value = record(input);
+    const issues = [];
+    if (value.schema !== LEAN_DECISION_SCHEMA)
+        issues.push('schema');
+    if (value.policy_id !== LEAN_ENGINEERING_POLICY_ID)
+        issues.push('policy_id');
+    if (value.policy_hash !== LEAN_ENGINEERING_POLICY_HASH)
+        issues.push('policy_hash');
+    if (!isLeanSolutionRung(value.selected_rung))
+        issues.push('selected_rung');
+    if (typeof value.task_requires_change !== 'boolean')
+        issues.push('task_requires_change');
+    if (!Array.isArray(value.reused_paths))
+        issues.push('reused_paths');
+    if (!Array.isArray(value.expected_changed_paths))
+        issues.push('expected_changed_paths');
+    if (!Array.isArray(value.verification_minimum))
+        issues.push('verification_minimum');
+    const fallback = record(value.fallback_plan);
+    if (!isFallbackKind(fallback.kind))
+        issues.push('fallback_plan.kind');
+    if (fallback.kind !== 'none' && (!fallback.authority || !fallback.justification))
+        issues.push('fallback_plan.evidence');
+    if (value.new_dependency_requested === true && !value.new_dependency_justification)
+        issues.push('new_dependency_justification');
+    if (value.new_abstraction_requested === true && !value.new_abstraction_justification)
+        issues.push('new_abstraction_justification');
+    if (value.selected_rung === 'skip' && value.task_requires_change === true)
+        issues.push('skip_requires_no_change');
+    if (value.task_requires_change === true && !value.verification_minimum?.length)
+        issues.push('verification_minimum_required');
+    return { ok: issues.length === 0, issues };
+}
+export function parseLeanSimplificationMarkerLine(text, file = '', line = 0) {
+    const match = /^\s*(?:(?:\/\/|#)\s*)sks-lean:\s*(.+)$/i.exec(text);
+    if (!match)
+        return null;
+    const fields = Object.fromEntries((match[1] || '').split(';').map((part) => {
+        const [key, ...rest] = part.split('=');
+        return [String(key || '').trim(), rest.join('=').trim()];
+    }));
+    const ceiling = fields.ceiling || null;
+    const revisit = fields.revisit_when || null;
+    const upgrade = fields.upgrade || null;
+    return {
+        file,
+        line,
+        ceiling,
+        revisit_when: revisit,
+        upgrade,
+        status: !revisit ? 'missing-trigger' : !upgrade ? 'missing-upgrade' : 'complete'
+    };
+}
+function normalizeFallbackPlan(input, defaults) {
+    const value = record(input);
+    const kind = isFallbackKind(value.kind) ? value.kind : defaults.kind;
+    return {
+        kind,
+        authority: nullableString(value.authority, defaults.authority),
+        justification: nullableString(value.justification, defaults.justification)
+    };
+}
+function normalizeRung(value, fallback) {
+    return isLeanSolutionRung(value) ? value : fallback;
+}
+function isLeanSolutionRung(value) {
+    return typeof value === 'string' && LEAN_SOLUTION_RUNGS.includes(value);
+}
+function isFallbackKind(value) {
+    return value === 'none' || value === 'capability' || value === 'compatibility' || value === 'fail-closed';
+}
+function stringArray(value, fallback = []) {
+    const source = Array.isArray(value) ? value : Array.isArray(fallback) ? fallback : [];
+    return source.map((item) => String(item || '').trim()).filter(Boolean);
+}
+function nullableString(value, fallback = null) {
+    const text = String(value ?? '').trim();
+    if (text)
+        return text;
+    return fallback;
+}
+function booleanValue(value, fallback) {
+    return typeof value === 'boolean' ? value : fallback;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+//# sourceMappingURL=lean-engineering-policy.js.map

package/dist/core/pipeline-internals/runtime-core.js

@@ -26,7 +26,8 @@ import { prepareMadDbMission } from '../mad-db/mad-db-coordinator.js';
 import { AGENT_INTAKE_STAGE_ID, AGENT_COUNT } from '../agents/agent-schema.js';
 import { normalizeAgentPolicy, routeRequiresAgentIntake, agentPipelineStage } from '../agents/agent-plan.js';
 import { readAgentGateStatus } from '../agents/agent-gate.js';
-import { CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_COMPUTER_USE_EVIDENCE_SOURCE, CODEX_COMPUTER_USE_ONLY_POLICY, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_POLICY, FROM_CHAT_IMG_CHECKLIST_ARTIFACT, FROM_CHAT_IMG_COVERAGE_ARTIFACT, FROM_CHAT_IMG_QA_LOOP_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS, SOLUTION_SCOUT_STAGE_ID, chatCaptureIntakeText, context7RequirementText, dollarCommand, evidenceMentionsForbiddenBrowserAutomation, getdesignReferencePolicyText, hasFromChatImgSignal, hasMadSksSignal, imageUxReviewPipelinePolicyText, looksLikeProblemSolvingRequest, noUnrequestedFallbackCodePolicyText, outcomeRubricPolicyText, pptPipelineAllowlistPolicyText, reflectionRequiredForRoute, reasoningInstruction, routeNeedsContext7, routePrompt, routeReasoning, routeRequiresSubagents, solutionScoutPolicyText, speedLanePolicyText, stripDollarCommand, stripMadSksSignal, stripVisibleDecisionAnswerBlocks, subagentExecutionPolicyText, stackCurrentDocsPolicyText, triwikiContextTracking, triwikiContextTrackingText, triwikiStagePolicyText } from '../routes.js';
+import { CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_COMPUTER_USE_EVIDENCE_SOURCE, CODEX_COMPUTER_USE_ONLY_POLICY, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_POLICY, FROM_CHAT_IMG_CHECKLIST_ARTIFACT, FROM_CHAT_IMG_COVERAGE_ARTIFACT, FROM_CHAT_IMG_QA_LOOP_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS, SOLUTION_SCOUT_STAGE_ID, chatCaptureIntakeText, context7RequirementText, dollarCommand, evidenceMentionsForbiddenBrowserAutomation, getdesignReferencePolicyText, hasFromChatImgSignal, hasMadSksSignal, imageUxReviewPipelinePolicyText, leanEngineeringCompactText, looksLikeProblemSolvingRequest, pptPipelineAllowlistPolicyText, reflectionRequiredForRoute, reasoningInstruction, routeNeedsContext7, routePrompt, routeReasoning, routeRequiresSubagents, solutionScoutPolicyText, stripDollarCommand, stripMadSksSignal, stripVisibleDecisionAnswerBlocks, subagentExecutionPolicyText, stackCurrentDocsPolicyText, triwikiContextTracking, triwikiContextTrackingText, triwikiStagePolicyText } from '../routes.js';
+import { normalizeLeanDecision, validateLeanDecision } from '../lean-engineering-policy.js';
 import { TEAM_DECOMPOSITION_ARTIFACT, TEAM_GRAPH_ARTIFACT, TEAM_INBOX_DIR, TEAM_RUNTIME_TASKS_ARTIFACT, teamRuntimePlanMetadata, teamRuntimeRequiredArtifacts, validateTeamRuntimeArtifacts, writeTeamRuntimeArtifacts } from '../team-dag.js';
 import { formatAgentReasoning, formatRoleCounts, initTeamLive, parseTeamSpecText, teamReasoningPolicy } from '../team-live.js';
 import { evaluateTeamReviewPolicyGate, MIN_TEAM_REVIEWER_LANES, MIN_TEAM_REVIEW_POLICY_TEXT, teamReviewPolicy } from '../team-review-policy.js';
@@ -93,6 +94,13 @@ export function buildPipelinePlan(input = {}) {
     const skipped = stages.filter((stage) => stage.status === 'skipped').map((stage) => stage.id);
     const kept = stages.filter((stage) => stage.status !== 'skipped' && stage.status !== 'not_applicable').map((stage) => stage.id);
     const routeEconomy = routeEconomyPlan(proof);
+    const leanDecision = normalizeLeanDecision(input.leanDecision, {
+        selected_rung: ['Answer', 'Help', 'Wiki'].includes(route?.id) ? 'skip' : 'minimal-custom',
+        task_requires_change: !['Answer', 'Help', 'Wiki'].includes(route?.id),
+        root_cause_target: route?.id ? `${route.id} route selected implementation surface` : null,
+        expected_changed_paths: input.expectedChangedPaths || input.touchedFiles || [],
+        verification_minimum: verification.slice(0, 3).map((item) => String(item || '').trim()).filter(Boolean)
+    });
     return {
         schema_version: PIPELINE_PLAN_SCHEMA_VERSION,
         generated_at: nowIso(),
@@ -135,6 +143,7 @@ export function buildPipelinePlan(input = {}) {
         verification,
         invariants: ['no_unrequested_fallback_code', 'ssot_guard', 'listed_verification', 'triwiki_validate_before_final', 'honest_mode'],
         proof_field: proof,
+        lean_decision: leanDecision,
         ssot_guard: buildSsotGuard({ route: route?.id || 'SKS', mode: route?.mode || 'SKS', task }),
         route_economy: routeEconomy,
         agent_intake: agentPolicy,
@@ -193,6 +202,9 @@ export function validatePipelinePlan(plan = {}) {
     const routeEconomyLatticeIssues = validateRouteEconomyDecisionLattice(plan.route_economy, plan.proof_field);
     if (routeEconomyLatticeIssues.length)
         issues.push(...routeEconomyLatticeIssues.map((issue) => `route_economy.decision_lattice:${issue}`));
+    const leanDecision = validateLeanDecision(plan.lean_decision);
+    if (!leanDecision.ok)
+        issues.push(...leanDecision.issues.map((issue) => `lean_decision:${issue}`));
     if (plan.no_unrequested_fallback_code !== true || !plan.invariants?.includes('no_unrequested_fallback_code'))
         issues.push('fallback_guard');
     if (!plan.ssot_guard?.required || !plan.invariants?.includes('ssot_guard'))
@@ -427,10 +439,8 @@ export function promptPipelineContext(prompt, route = null) {
         'Stance: infer the user intent aggressively from rough wording, local context, TriWiki, and conservative defaults; do not surface prequestion sheets before work.',
         subagentExecutionPolicyText(route, cleanPrompt),
         solutionScoutPolicyText(cleanPrompt),
-        noUnrequestedFallbackCodePolicyText(),
+        leanEngineeringCompactText(),
         ssotGuardPolicyText(),
-        outcomeRubricPolicyText(),
-        speedLanePolicyText(),
         skillDreamPolicyText(),
         route?.id === 'PPT'
             ? `${pptPipelineAllowlistPolicyText()} ${getdesignReferencePolicyText()}`
@@ -456,7 +466,7 @@ export function promptPipelineContext(prompt, route = null) {
     if (route?.id === 'ImageUXReview')
         lines.push(`Image UX Review route: ${imageUxReviewPipelinePolicyText()} Use ${IMAGE_UX_REVIEW_POLICY_ARTIFACT}, ${IMAGE_UX_REVIEW_SCREEN_INVENTORY_ARTIFACT}, ${IMAGE_UX_REVIEW_GENERATED_REVIEW_LEDGER_ARTIFACT}, ${IMAGE_UX_REVIEW_ISSUE_LEDGER_ARTIFACT}, ${IMAGE_UX_REVIEW_ITERATION_REPORT_ARTIFACT}, and ${IMAGE_UX_REVIEW_GATE_ARTIFACT} as the route evidence set. The route may suggest safe fixes only when the user requested fixing; otherwise report findings and blockers.`);
     if (route?.id === 'AutoResearch')
-        lines.push('AutoResearch route: load autoresearch-loop plus seo-geo-optimizer when SEO/GEO, discoverability, README, npm, GitHub stars, ranking, or AI-search visibility is relevant.');
+        lines.push('AutoResearch route: load autoresearch-loop for experiments and benchmarking. SEO/GEO, discoverability, README, npm, GitHub search visibility, and AI-search visibility should use the first-class $SEO-GEO-OPTIMIZER parent route unless the selected route explicitly needs a child experiment.');
     if (route?.id === 'DB')
         lines.push('DB route: scan/check database risk first; destructive DB operations remain forbidden.');
     if (route?.id === 'MadDB')

package/dist/core/proof/auto-finalize.js

@@ -13,7 +13,7 @@ const AGENT_ARTIFACTS = [
     'agents/agent-task-board.json',
     'agents/agent-concurrency-policy.json'
 ];
-export async function maybeFinalizeRoute(root, { missionId, route, gateFile = null, gate = null, artifacts = [], claims = [], visualEvidence = null, visual = false, fixClaim = false, requireRelation = false, mock = false, statusHint = null, reason = null, command = null, dbEvidence = null, testEvidence = null, blockers = [], unverified = [], agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null } = {}) {
+export async function maybeFinalizeRoute(root, { missionId, route, gateFile = null, gate = null, artifacts = [], claims = [], visualEvidence = null, visual = false, fixClaim = false, requireRelation = false, mock = false, statusHint = null, reason = null, command = null, dbEvidence = null, testEvidence = null, blockers = [], unverified = [], agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null, lightweightEvidence = false } = {}) {
     if (!missionId || !route) {
         return { ok: false, skipped: true, reason: 'mission_id_or_route_missing' };
     }
@@ -62,7 +62,8 @@ export async function maybeFinalizeRoute(root, { missionId, route, gateFile = nu
         visualClaim: visual,
         agents,
         allowActiveWrongnessPartial,
-        failureAnalysis
+        failureAnalysis,
+        lightweightEvidence
     });
     return { ...proof, auto_finalized: true, gate_passed: passed, status_hint: finalStatus };
 }

package/dist/core/proof/proof-schema.js

@@ -33,7 +33,8 @@ export function emptyCompletionProof(overrides = {}) {
             triwiki: null,
             wrongness: null,
             source_intelligence: null,
-            goal_mode: null
+            goal_mode: null,
+            lean_engineering: null
         },
         claims: [],
         unverified: [],

package/dist/core/proof/proof-writer.js

@@ -74,6 +74,7 @@ export function renderProofMarkdown(proof = {}, validation = validateCompletionP
         `- Agents: ${proof.evidence?.agents?.agent_count ?? 0} (${proof.evidence?.agents?.status || 'not_recorded'})`,
         `- TriWiki: ${proof.evidence?.triwiki?.status || 'not_recorded'}`,
         `- Wrongness: ${proof.evidence?.wrongness?.active_count ?? 0} active (${proof.evidence?.wrongness?.high_severity_active ?? 0} high)`,
+        `- Lean engineering: ${proof.evidence?.lean_engineering?.semantic_review?.status || proof.evidence?.lean_engineering?.status || 'not_recorded'}`,
         `- Evidence router: ${proof.evidence?.evidence_router?.records ?? 0} record(s)`,
         `- Trust report: ${proof.evidence?.trust_report || 'not_recorded'}`,
         ''

package/dist/core/proof/route-adapter.js

@@ -5,8 +5,8 @@ import { normalizeProofRoute, routeRequiresImageVoxelAnchors } from './route-pro
 import { linkProofClaimsToEvidence, proofEvidenceSummary } from '../evidence/evidence-proof-linker.js';
 import { writeTrustArtifactsForProof } from '../trust-kernel/trust-report.js';
 import { enforceRetention } from '../retention.js';
-export async function writeRouteCompletionProof(root, { missionId = null, route = null, status = 'verified_partial', gate = null, summary = {}, artifacts = [], evidence = {}, claims = [], unverified = [], blockers = [], failureAnalysis = null, nextHumanActions = [] } = {}) {
-    const collected = await collectProofEvidence(root);
+export async function writeRouteCompletionProof(root, { missionId = null, route = null, status = 'verified_partial', gate = null, summary = {}, artifacts = [], evidence = {}, claims = [], unverified = [], blockers = [], failureAnalysis = null, nextHumanActions = [], lightweightEvidence = false } = {}) {
+    const collected = lightweightEvidence ? { files: [] } : await collectProofEvidence(root);
     const normalizedRoute = normalizeProofRoute(route);
     const mergedEvidence = {
         ...collected,
@@ -45,6 +45,8 @@ export async function writeRouteCompletionProof(root, { missionId = null, route
             status: normalizedStatus
         }
     });
+    if (lightweightEvidence)
+        return { ...written, trust: null, retention: null };
     if (!missionId)
         return written;
     const firstTrust = await writeTrustArtifactsForProof(root, written.proof);

package/dist/core/proof/route-finalizer.js

@@ -6,7 +6,8 @@ import { readAgentProofEvidence } from '../agents/agent-proof-evidence.js';
 import { wrongnessProofEvidence } from '../triwiki-wrongness/wrongness-proof-linker.js';
 import { computerUseStatusReport } from '../computer-use-status.js';
 import { readComputerUseLiveEvidence } from '../computer-use-live-evidence.js';
-export async function finalizeRouteWithProof(root, { missionId, route, gateFile = null, gate = null, artifacts = [], visualEvidence = null, dbEvidence = null, madSksEvidence = null, testEvidence = null, commandEvidence = null, claims = [], unverified = [], blockers = [], statusHint = 'verified_partial', strict = false, mock = false, fixClaim = false, requireRelation = false, visualClaim = undefined, agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null } = {}) {
+import { leanChangeEvidenceFromReport, scanCodeStructure } from '../code-structure.js';
+export async function finalizeRouteWithProof(root, { missionId, route, gateFile = null, gate = null, artifacts = [], visualEvidence = null, dbEvidence = null, madSksEvidence = null, testEvidence = null, commandEvidence = null, claims = [], unverified = [], blockers = [], statusHint = 'verified_partial', strict = false, mock = false, fixClaim = false, requireRelation = false, visualClaim = undefined, agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null, lightweightEvidence = false } = {}) {
     const policy = routeFinalizerPolicy(route, { strict, fixClaim, requireRelation, visualClaim });
     const localBlockers = [...blockers];
     const providedVisualEvidence = visualEvidence;
@@ -23,9 +24,14 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
             localBlockers.push(...(imageEvidence.issues?.length ? imageEvidence.issues : ['image_voxel_anchors_missing']));
         }
     }
-    const collected = await collectProofEvidence(root);
+    const collected = lightweightEvidence ? { files: [] } : await collectProofEvidence(root);
+    const leanEngineeringEvidence = await collectLeanEngineeringEvidence(root, lightweightEvidence).catch((err) => ({
+        schema: 'sks.lean-change-evidence.v1',
+        status: 'not_collected',
+        reason: err?.message || String(err || 'unknown_error')
+    }));
     const agentEvidence = agents === false ? null : await readAgentProofEvidence(root, missionId).catch(() => null);
-    const wrongnessEvidence = await wrongnessProofEvidence(root, missionId, { route: policy.route }).catch(() => null);
+    const wrongnessEvidence = lightweightEvidence ? null : await wrongnessProofEvidence(root, missionId, { route: policy.route }).catch(() => null);
     const requiresNativeComputerUseLiveEvidence = ['$Computer-Use', '$CU'].includes(String(policy.route || ''));
     const computerUse = requiresNativeComputerUseLiveEvidence
         ? await computerUseStatusReport().catch((err) => ({ schema: 'sks.computer-use-status.v1', status: 'unknown', ok: false, guidance: [err.message], evidence: { status: 'unknown' } }))
@@ -117,6 +123,7 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
                 evidence: computerUse.evidence || null,
                 live_evidence: computerUseLive?.evidence || null
             } } : {}),
+        lean_engineering: leanEngineeringEvidence,
         route_gate: gate || (gateFile ? { source: gateFile } : null)
     };
     return writeRouteCompletionProof(root, {
@@ -130,6 +137,7 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         unverified: finalUnverified,
         blockers: localBlockers,
         failureAnalysis: resolvedFailureAnalysis,
+        lightweightEvidence,
         summary: {
             files_changed: collected.files?.length || 0,
             commands_run: evidence.commands?.length || 0,
@@ -139,6 +147,30 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         }
     });
 }
+async function collectLeanEngineeringEvidence(root, lightweightEvidence) {
+    if (lightweightEvidence) {
+        return leanChangeEvidenceFromReport({
+            changed_scope: {
+                mode: 'lightweight',
+                base: 'HEAD',
+                changed_files: [],
+                files_added: 0,
+                files_deleted: 0,
+                lines_added: 0,
+                lines_deleted: 0,
+                net_lines: 0,
+                source_files: [],
+                entries: []
+            },
+            semantic_review: {
+                status: 'needs-review',
+                findings: [{ tag: 'verify', severity: 'review', summary: 'lightweight proof skipped changed-scope code-structure scan' }]
+            }
+        });
+    }
+    const report = await scanCodeStructure(root, { changed: true });
+    return leanChangeEvidenceFromReport(report);
+}
 function inferRouteFailureAnalysis({ missionId, route, status, blockers, unverified, wrongnessEvidence, imageEvidence, agentEvidence, computerUse, computerUseLive, visualComputerUseDowngrade } = {}) {
     if (status === 'verified' && !blockers?.length && !unverified?.length)
         return null;

package/dist/core/qa-loop/qa-app-server-driver.js

@@ -0,0 +1,134 @@
+import path from 'node:path';
+import { appendJsonlBounded, nowIso, writeJsonAtomic } from '../fsx.js';
+import { QA_ACTION_LEDGER_ARTIFACT, QA_LIVE_SESSION_ARTIFACT, QA_RUNTIME_EVENT_LEDGER_ARTIFACT } from './qa-types.js';
+export async function runQaAppServerDriver(input) {
+    const events = [];
+    const dispose = input.client.onEvent?.((event) => {
+        events.push(event);
+    });
+    const startedAt = nowIso();
+    const blockers = [];
+    let threadId = null;
+    let turnId = null;
+    try {
+        await input.client.initialize?.();
+        const thread = await input.client.startThread({
+            cwd: input.cwd,
+            ...input.threadStartParams
+        });
+        threadId = extractThreadId(thread);
+        if (!threadId)
+            blockers.push('app_server_thread_id_missing');
+        if (threadId) {
+            const turn = await input.client.startTurn({
+                threadId,
+                cwd: input.cwd,
+                input: [{ type: 'text', text: input.prompt }],
+                ...input.turnStartParams
+            });
+            turnId = extractTurnId(turn);
+            if (!turnId)
+                blockers.push('app_server_turn_id_missing');
+            if (input.client.waitForTurnCompletion) {
+                const completed = await input.client.waitForTurnCompletion(threadId, turnId, input.timeoutMs);
+                events.push({ method: 'turn/completed', params: completed, received_at: nowIso() });
+            }
+        }
+    }
+    catch (err) {
+        blockers.push(`app_server_driver_failed:${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        dispose?.();
+    }
+    await writeAppServerEventLedgers(input.missionDir, input.missionId, input.surfaceSelection.selected_surface, threadId, turnId, events);
+    const session = {
+        schema: 'sks.qa-loop-live-session.v2',
+        started_at: startedAt,
+        completed_at: nowIso(),
+        mission_id: input.missionId,
+        status: blockers.length ? 'blocked' : 'completed',
+        selected_surface: input.surfaceSelection.selected_surface,
+        thread_id: threadId,
+        turn_id: turnId,
+        event_count: events.length,
+        item_event_count: events.filter(isItemEvent).length,
+        action_event_count: events.filter(isActionLikeEvent).length,
+        observation_event_count: events.filter(isObservationLikeEvent).length,
+        blockers,
+        unverified: events.some(isActionLikeEvent) ? [] : ['app_server_action_event_unverified'],
+        artifacts: {
+            runtime_events: QA_RUNTIME_EVENT_LEDGER_ARTIFACT,
+            action_ledger: QA_ACTION_LEDGER_ARTIFACT
+        }
+    };
+    await writeJsonAtomic(path.join(input.missionDir, QA_LIVE_SESSION_ARTIFACT), session);
+    return session;
+}
+async function writeAppServerEventLedgers(missionDir, missionId, surface, threadId, turnId, events) {
+    for (const event of events) {
+        const method = String(event.method || event.type || event.params?.method || 'app_server_event');
+        await appendJsonlBounded(path.join(missionDir, QA_RUNTIME_EVENT_LEDGER_ARTIFACT), {
+            schema: 'sks.qa-loop-app-server-event.v2',
+            ts: nowIso(),
+            mission_id: missionId,
+            thread_id: event.params?.threadId || event.threadId || threadId,
+            turn_id: event.params?.turnId || event.params?.turn?.id || event.turnId || turnId,
+            item_id: event.params?.itemId || event.params?.item?.id || event.itemId || null,
+            surface,
+            kind: method,
+            status: 'observed',
+            data: redactEvent(event)
+        });
+        if (isActionLikeEvent(event)) {
+            await appendJsonlBounded(path.join(missionDir, QA_ACTION_LEDGER_ARTIFACT), {
+                schema: 'sks.qa-loop-action.v2',
+                ts: nowIso(),
+                mission_id: missionId,
+                thread_id: event.params?.threadId || event.threadId || threadId,
+                turn_id: event.params?.turnId || event.params?.turn?.id || event.turnId || turnId,
+                item_id: event.params?.itemId || event.params?.item?.id || event.itemId || null,
+                surface,
+                kind: method,
+                status: 'observed',
+                real: true,
+                data: redactEvent(event)
+            });
+        }
+    }
+}
+function extractThreadId(value) {
+    const obj = value;
+    return stringOrNull(obj?.thread?.id || obj?.threadId || obj?.id);
+}
+function extractTurnId(value) {
+    const obj = value;
+    return stringOrNull(obj?.turn?.id || obj?.turnId || obj?.id);
+}
+function stringOrNull(value) {
+    const text = String(value || '').trim();
+    return text || null;
+}
+function isItemEvent(event) {
+    return /^item\//.test(String(event.method || event.type || ''));
+}
+function isActionLikeEvent(event) {
+    const method = String(event.method || event.type || '');
+    return /^item\/.*(?:tool|action|commandExecution|computer|browser|chrome)/i.test(method)
+        || /(?:tool|action|click|type|scroll|navigate|screenshot|observation)/i.test(JSON.stringify(event.params || event));
+}
+function isObservationLikeEvent(event) {
+    const method = String(event.method || event.type || '');
+    return /observation|completed|screenshot|browser|chrome|computer/i.test(method)
+        || /observation|screenshot|visual|page|window/i.test(JSON.stringify(event.params || event));
+}
+function redactEvent(event) {
+    return JSON.parse(JSON.stringify(event, (key, value) => {
+        if (/(password|passwd|token|secret|cookie|authorization|credential)/i.test(String(key)))
+            return '[REDACTED]';
+        if (typeof value === 'string' && /(Bearer\s+[A-Za-z0-9._-]+|sk-[A-Za-z0-9_-]+)/.test(value))
+            return '[REDACTED]';
+        return value;
+    }));
+}
+//# sourceMappingURL=qa-app-server-driver.js.map