sneakoscope 4.2.0 → 4.4.0

package/dist/core/qa-loop.js

@@ -1,14 +1,18 @@
 import path from 'node:path';
 import { exists, nowIso, readJson, readText, writeJsonAtomic, writeTextAtomic, PACKAGE_VERSION } from './fsx.js';
-import { CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE, CODEX_WEB_VERIFICATION_POLICY, evidenceMentionsForbiddenBrowserAutomation, evidenceMentionsForbiddenWebComputerUseEvidence } from './routes.js';
+import { CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_CHROME_EXTENSION_EVIDENCE_SOURCE, CODEX_COMPUTER_USE_EVIDENCE_SOURCE, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_IN_APP_BROWSER_EVIDENCE_SOURCE, CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE, CODEX_WEB_VERIFICATION_POLICY, evidenceMentionsForbiddenBrowserAutomation, evidenceMentionsForbiddenWebComputerUseEvidence } from './routes.js';
 import { appendAgentLedgerEvent, initializeAgentCentralLedger } from './agents/agent-central-ledger.js';
 import { resolveCodexAppExecutionProfile } from './codex-app/codex-app-execution-profile.js';
 import { resolveCodexNativeInvocationPlan } from './codex-native/codex-native-invocation-router.js';
 import { imageDimensions, sha256File } from './wiki-image/image-hash.js';
+import { initializeQaRuntimeArtifacts } from './qa-loop/qa-runtime-artifacts.js';
+import { evaluateQaGateV2 } from './qa-loop/qa-gate-v2.js';
+import { DEFAULT_QA_MAX_CYCLES, QA_GATE_V2_ARTIFACT, QA_SURFACE_SELECTION_ARTIFACT } from './qa-loop/qa-types.js';
 export const QA_LOOP_ROUTE = 'QALoop';
 export const QA_LOOP_VISUAL_EVIDENCE_ARTIFACT = 'qa-loop/visual-evidence.json';
 const QA_REPORT_SUFFIX = 'qa-report.md';
-const UI_CHROME_EXTENSION_FIRST_ACK = 'use_codex_chrome_extension_first_no_computer_use_for_web_ui_or_mark_unverified';
+const UI_SURFACE_ROUTER_ACK = 'use_codex_surface_router_browser_chrome_computer_no_synthetic_evidence';
+const LEGACY_UI_CHROME_EXTENSION_FIRST_ACK = 'use_codex_chrome_extension_first_no_computer_use_for_web_ui_or_mark_unverified';
 const GPT_IMAGE_2_ANNOTATED_REVIEW_REQUIRED_ACK = 'yes_gpt_image_2_annotated_review';
 const IMAGE_FILE_RE = /\.(png|jpe?g|webp|gif)$/i;
 export const QA_NATIVE_AGENT_PERSONAS = Object.freeze([
@@ -166,7 +170,7 @@ export function inferQaLoopAnswers(prompt = '') {
         '검증하지 못한 UI/API 범위는 통과로 주장하지 않고 QA 리포트에 남긴다.'
     ];
     if (isUiScope(scope))
-        acceptance.push('UI E2E 통과 증거는 실제 Codex Chrome Extension screenshot artifact path와 sha256을 기록해야 한다.');
+        acceptance.push('UI E2E 통과 증거는 surface router가 고른 @Browser/@Chrome/@Computer 실제 action·observation ledger와 필요한 screenshot/hash를 기록해야 한다.');
     if (wantsGptImage2Review)
         acceptance.push('gpt-image-2 annotated review image가 필요한 경우 실제 Codex App $imagegen/gpt-image-2 출력 파일 path, sha256, model, provider를 기록해야 한다.');
     return {
@@ -181,17 +185,17 @@ export function inferQaLoopAnswers(prompt = '') {
         EXTERNAL_SIDE_EFFECT_POLICY: 'block_all_external_side_effects',
         ...login,
         CREDENTIAL_STORAGE_ACK: 'never_store_credentials_in_artifacts_or_wiki',
-        UI_CHROME_EXTENSION_ACK: UI_CHROME_EXTENSION_FIRST_ACK,
+        UI_CHROME_EXTENSION_ACK: UI_SURFACE_ROUTER_ACK,
         QA_VISUAL_REVIEW_IMAGEGEN_REQUIRED: wantsGptImage2Review ? GPT_IMAGE_2_ANNOTATED_REVIEW_REQUIRED_ACK : 'not_required',
         TEAM_MODE_ALLOWED: 'no_parent_only',
-        MAX_QA_CYCLES: '1',
+        MAX_QA_CYCLES: String(DEFAULT_QA_MAX_CYCLES),
         ACCEPTANCE_CRITERIA: acceptance,
         NON_GOALS: [
             '결제, 실제 이메일/SMS 발송, 관리자 권한 변경, 데이터 삭제, 프로덕션 데이터 변경은 테스트하지 않는다.'
         ],
         RISK_BOUNDARY: [
             '실제 사용자 데이터, 인증 권한, 결제, 메시지 발송, 웹훅, 외부 서비스 상태를 생성/수정/삭제하지 않는다.',
-            'Codex Chrome Extension readiness/evidence가 없으면 web/browser UI 검증 완료로 주장하지 않는다.',
+            '선택된 Codex App visual surface의 실제 action·observation evidence가 없으면 UI 검증 완료로 주장하지 않는다.',
             '로그인이 필요하지만 임시 테스트 자격증명이 없으면 인증 구간은 차단/미검증으로 기록한다.'
         ],
         MID_RUN_UNKNOWN_POLICY: ['preserve_existing_behavior', 'defer_optional_scope', 'block_only_if_no_safe_path']
@@ -245,7 +249,7 @@ export function qaLoopQuestionSlots() {
         { id: 'TEMP_TEST_CREDENTIALS_READY', question: 'If login is required, are test-only credentials ready to provide ephemerally during the run?', required: true, type: 'enum', options: ['not_required', 'yes_temp_only', 'no_block_authenticated_tests'] },
         { id: 'TEST_CREDENTIALS_RUNTIME_SOURCE', question: 'If login is required, how will test-only credentials be provided without saving the values?', required: true, type: 'enum', options: ['not_required', 'ephemeral_chat_only', 'environment_variables', 'secret_manager'] },
         { id: 'CREDENTIAL_STORAGE_ACK', question: 'Acknowledge credential handling policy.', required: true, type: 'enum', options: ['never_store_credentials_in_artifacts_or_wiki'] },
-        { id: 'UI_CHROME_EXTENSION_ACK', question: 'Acknowledge UI E2E evidence policy: Codex Chrome Extension first for web/browser/webapp verification; no Computer Use or unofficial browser automation substitute.', required: true, type: 'enum', options: [UI_CHROME_EXTENSION_FIRST_ACK] },
+        { id: 'UI_CHROME_EXTENSION_ACK', question: 'Acknowledge UI E2E evidence policy: QA-LOOP routes local/public web to @Browser, signed-in web to @Chrome, native/cross-app GUI to @Computer, and never treats synthetic artifacts as real proof.', required: true, type: 'enum', options: [UI_SURFACE_ROUTER_ACK, LEGACY_UI_CHROME_EXTENSION_FIRST_ACK] },
         { id: 'TEAM_MODE_ALLOWED', question: 'May QA-LOOP use Team/subagents where useful?', required: true, type: 'enum', options: ['yes_parallel_where_safe', 'no_parent_only'] },
         { id: 'MAX_QA_CYCLES', question: 'How many no-question QA cycles are allowed before pausing?', required: true, type: 'string' },
         { id: 'ACCEPTANCE_CRITERIA', question: 'List the QA completion criteria.', required: true, type: 'array_or_string' },
@@ -269,8 +273,8 @@ export function validateQaLoopAnswers(schema, answers = {}) {
         errors.push({ slot: 'QA_MUTATION_POLICY', error: 'production_deployed_qa_is_read_only_smoke_only' });
     if (answers.DESTRUCTIVE_DEPLOYED_TESTS_ALLOWED !== 'never')
         errors.push({ slot: 'DESTRUCTIVE_DEPLOYED_TESTS_ALLOWED', error: 'destructive_deployed_tests_never_allowed' });
-    if (isUiScope(answers.QA_SCOPE) && answers.UI_CHROME_EXTENSION_ACK !== UI_CHROME_EXTENSION_FIRST_ACK)
-        errors.push({ slot: 'UI_CHROME_EXTENSION_ACK', error: 'ui_e2e_requires_codex_chrome_extension_first_ack' });
+    if (isUiScope(answers.QA_SCOPE) && ![UI_SURFACE_ROUTER_ACK, LEGACY_UI_CHROME_EXTENSION_FIRST_ACK].includes(answers.UI_CHROME_EXTENSION_ACK))
+        errors.push({ slot: 'UI_CHROME_EXTENSION_ACK', error: 'ui_e2e_requires_codex_surface_router_ack' });
     if (answers.LOGIN_REQUIRED === 'yes' && !['yes_temp_only', 'no_block_authenticated_tests'].includes(answers.TEMP_TEST_CREDENTIALS_READY))
         errors.push({ slot: 'TEMP_TEST_CREDENTIALS_READY', error: 'authenticated_tests_require_ephemeral_test_credentials_or_must_be_blocked' });
     if (answers.LOGIN_REQUIRED === 'yes' && answers.TEMP_TEST_CREDENTIALS_READY === 'yes_temp_only' && answers.TEST_CREDENTIALS_RUNTIME_SOURCE === 'not_required')
@@ -322,6 +326,7 @@ export function defaultQaGate(contract = {}, opts = {}) {
     const gptImage2ReviewRequired = qaGptImage2AnnotatedReviewRequired(contract, contract.prompt);
     const reportFile = opts.reportFile || qaReportFilename();
     const corrective = a.QA_CORRECTIVE_POLICY !== 'report_only_no_code_changes';
+    const selectedSurface = opts.qaRuntime?.surface?.selected_surface || null;
     return {
         passed: false,
         clarification_contract_sealed: Boolean(contract.sealed_hash),
@@ -333,6 +338,15 @@ export function defaultQaGate(contract = {}, opts = {}) {
         deployed_destructive_tests_blocked: a.TARGET_ENVIRONMENT === 'local_dev_server' || a.DESTRUCTIVE_DEPLOYED_TESTS_ALLOWED === 'never',
         credentials_not_persisted: false,
         ui_e2e_required: uiRequired,
+        qa_contract_v2_required: opts.qaRuntime ? true : false,
+        qa_surface_selection_artifact: opts.qaRuntime ? QA_SURFACE_SELECTION_ARTIFACT : null,
+        qa_gate_v2_artifact: opts.qaRuntime ? QA_GATE_V2_ARTIFACT : null,
+        qa_surface_selected: selectedSurface,
+        ui_selected_surface: selectedSurface,
+        ui_live_surface_preflight_passed: !uiRequired,
+        ui_real_action_count: 0,
+        ui_observation_count: 0,
+        same_flow_replay_complete: false,
         chrome_extension_preflight_passed: !uiRequired,
         ui_chrome_extension_evidence: !uiRequired,
         ui_computer_use_evidence: false,
@@ -385,6 +399,13 @@ export async function writeQaLoopArtifacts(dir, mission, contract) {
     const root = missionRootFromDir(dir);
     const executionProfile = root ? await resolveCodexAppExecutionProfile({ root }).catch(() => null) : null;
     const codexNativeInvocation = root ? await resolveQaCodexNativeInvocation(root, mission.id).catch(() => null) : null;
+    const qaRuntime = await initializeQaRuntimeArtifacts(dir, {
+        ...contract,
+        prompt: mission.prompt || contract.prompt,
+        mission_id: mission.id || contract.mission_id
+    }, {
+        missionId: mission.id || contract.mission_id || null
+    }).catch(() => null);
     if (executionProfile)
         await writeJsonAtomic(path.join(dir, 'qa-loop', 'execution-profile.json'), executionProfile).catch(() => undefined);
     if (codexNativeInvocation)
@@ -397,11 +418,20 @@ export async function writeQaLoopArtifacts(dir, mission, contract) {
         codex_app_execution_profile: executionProfile ? compactExecutionProfile(executionProfile) : null,
         codex_native_invocation: codexNativeInvocation,
         target: { scope: a.QA_SCOPE, environment: a.TARGET_ENVIRONMENT, base_url: a.TARGET_BASE_URL, api_base_url: a.API_BASE_URL },
-        safety: { mutation_policy: a.QA_MUTATION_POLICY, deployed_destructive_tests_allowed: 'never', credentials: 'temp_only_never_saved', ui_evidence: 'codex_chrome_extension_first_required_for_web_ui_e2e', visual_review: 'gpt_image_2_annotated_review_required_when_contract_requests_it' },
+        qa_runtime_v2: qaRuntime ? {
+            contract_artifact: 'qa-loop/qa-contract-v2.json',
+            surface_selection_artifact: QA_SURFACE_SELECTION_ARTIFACT,
+            selected_surface: qaRuntime.surface.selected_surface,
+            journey_graph_artifact: 'qa-loop/qa-journey-graph.json',
+            gate_artifact: QA_GATE_V2_ARTIFACT
+        } : null,
+        safety: { mutation_policy: a.QA_MUTATION_POLICY, deployed_destructive_tests_allowed: 'never', credentials: 'temp_only_never_saved', ui_evidence: 'codex_surface_router_live_action_required_for_ui_e2e', visual_review: 'gpt_image_2_annotated_review_required_when_contract_requests_it' },
         checklist
     });
     await writeJsonAtomic(path.join(dir, QA_LOOP_VISUAL_EVIDENCE_ARTIFACT), buildQaLoopVisualEvidenceArtifact(mission, contract));
-    await writeJsonAtomic(path.join(dir, 'qa-gate.json'), defaultQaGate(contract, { reportFile, executionProfile, codexNativeInvocation }));
+    await writeJsonAtomic(path.join(dir, 'qa-gate.json'), defaultQaGate(contract, { reportFile, executionProfile, codexNativeInvocation, qaRuntime }));
+    if (qaRuntime)
+        await evaluateQaGateV2(dir).catch(() => undefined);
     await writeTextAtomic(path.join(dir, reportFile), qaReportTemplate(mission, contract, checklist));
     return { checklist_count: checklist.length, report_file: reportFile };
 }
@@ -441,8 +471,18 @@ export async function ensureQaLoopVisualEvidenceContract(dir, mission = {}, cont
 }
 export async function evaluateQaGate(dir) {
     const gate = await readJson(path.join(dir, 'qa-gate.json'), {});
+    const surfaceSelection = await readJson(path.join(dir, QA_SURFACE_SELECTION_ARTIFACT), null);
+    const selectedSurface = gate.ui_selected_surface || gate.qa_surface_selected || surfaceSelection?.selected_surface || null;
+    const expectedEvidenceSource = evidenceSourceForSurface(selectedSurface);
+    const gateV2 = gate.qa_contract_v2_required === true ? await evaluateQaGateV2(dir).catch((err) => ({
+        passed: false,
+        blockers: [`qa_gate_v2_evaluation_failed:${err?.message || String(err)}`],
+        unverified: []
+    })) : null;
     const reportFile = qaReportFileFromGate(gate);
     const reasons = [];
+    if (gateV2 && gateV2.passed !== true)
+        reasons.push(...(gateV2.blockers || []));
     for (const key of ['clarification_contract_sealed', 'qa_report_written', 'qa_ledger_complete', 'checklist_completed', 'safety_reviewed', 'deployed_destructive_tests_blocked', 'credentials_not_persisted', 'honest_mode_complete']) {
         if (gate[key] !== true)
             reasons.push(`${key}_missing`);
@@ -460,17 +500,22 @@ export async function evaluateQaGate(dir) {
     if (gate.unsafe_external_side_effects === true)
         reasons.push('unsafe_external_side_effects');
     if (gate.ui_e2e_required === true) {
-        if (gate.chrome_extension_preflight_passed !== true)
-            reasons.push('chrome_extension_preflight_missing');
-        if (gate.ui_chrome_extension_evidence !== true)
-            reasons.push('ui_chrome_extension_evidence_missing');
-        if (gate.ui_computer_use_evidence === true)
+        if (!selectedSurface || selectedSurface === 'codex_chrome_extension') {
+            if (gate.chrome_extension_preflight_passed !== true)
+                reasons.push('chrome_extension_preflight_missing');
+            if (gate.ui_chrome_extension_evidence !== true)
+                reasons.push('ui_chrome_extension_evidence_missing');
+        }
+        else if (gate.ui_live_surface_preflight_passed !== true) {
+            reasons.push('ui_live_surface_preflight_missing');
+        }
+        if (gate.ui_computer_use_evidence === true && selectedSurface !== 'codex_computer_use')
             reasons.push('ui_computer_use_evidence_forbidden_for_web');
-        if (gate.ui_evidence_source !== CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE)
-            reasons.push('ui_evidence_source_not_codex_chrome_extension');
+        if (expectedEvidenceSource && gate.ui_evidence_source !== expectedEvidenceSource)
+            reasons.push(`ui_evidence_source_not_${expectedEvidenceSource}`);
         if (evidenceMentionsForbiddenBrowserAutomation({ evidence: gate.evidence, notes: gate.notes, ui_evidence_source: gate.ui_evidence_source }))
             reasons.push('forbidden_browser_automation_evidence');
-        if (evidenceMentionsForbiddenWebComputerUseEvidence({ evidence: gate.evidence, ui_evidence_source: gate.ui_evidence_source }))
+        if (selectedSurface !== 'codex_computer_use' && evidenceMentionsForbiddenWebComputerUseEvidence({ evidence: gate.evidence, ui_evidence_source: gate.ui_evidence_source }))
             reasons.push('computer_use_web_evidence_forbidden');
         reasons.push(...await missingQaLoopVisualEvidence(dir, gate));
     }
@@ -502,7 +547,7 @@ export async function evaluateQaGate(dir) {
         reasons.push('qa_ledger_missing');
     const uniqueReasons = [...new Set(reasons)];
     const passed = gate.passed === true && uniqueReasons.length === 0;
-    const result = { checked_at: nowIso(), passed, reasons: uniqueReasons, gate };
+    const result = { checked_at: nowIso(), passed, reasons: uniqueReasons, gate, gate_v2: gateV2 };
     await writeJsonAtomic(path.join(dir, 'qa-gate.evaluated.json'), result);
     return result;
 }
@@ -592,9 +637,9 @@ CONTRACT:
 ${JSON.stringify(contract, null, 2)}
 ${imageContractText}${appHandoffText}${executionProfileText}
 VISUAL EVIDENCE CONTRACT:
-- For web UI QA, do not set chrome_extension_preflight_passed/ui_chrome_extension_evidence to true unless the Codex Chrome Extension path is ready and ${QA_LOOP_VISUAL_EVIDENCE_ARTIFACT} records a real saved Chrome Extension screenshot artifact with path, sha256, and dimensions.
-- If decision-contract.json answers set QA_VISUAL_REVIEW_IMAGEGEN_REQUIRED=${GPT_IMAGE_2_ANNOTATED_REVIEW_REQUIRED_ACK}, use Codex App $imagegen/gpt-image-2 (${CODEX_APP_IMAGE_GENERATION_DOC_URL}) to produce a real generated annotated review image from the Chrome Extension screenshot. Record its path, sha256, model=gpt-image-2, provider=Codex App $imagegen, and source_screenshot_artifact in ${QA_LOOP_VISUAL_EVIDENCE_ARTIFACT} and qa-gate.json.
-- Do not substitute prose-only critique, Playwright/Selenium/Puppeteer/Browser Use screenshots, Computer Use browser screenshots, placeholder images, fake fixtures, or direct API fallback as full web UI visual evidence.
+- For UI QA, do not mark live UI evidence true unless qa-loop/qa-surface-selection.json selected the correct @Browser/@Chrome/@Computer surface and action/observation ledgers record real user-like actions.
+- If decision-contract.json answers set QA_VISUAL_REVIEW_IMAGEGEN_REQUIRED=${GPT_IMAGE_2_ANNOTATED_REVIEW_REQUIRED_ACK}, use Codex App $imagegen/gpt-image-2 (${CODEX_APP_IMAGE_GENERATION_DOC_URL}) to produce a real generated annotated review image from the selected-surface source screenshot. Record its path, sha256, model=gpt-image-2, provider=Codex App $imagegen, and source_screenshot_artifact in ${QA_LOOP_VISUAL_EVIDENCE_ARTIFACT} and qa-gate.json.
+- Do not substitute prose-only critique, Playwright/Selenium/Puppeteer screenshots, static screenshots, plugin cache, placeholder images, fake fixtures, or direct API fallback as full UI visual evidence.
 Previous tail:
 ${String(previous || '').slice(-2500)}
 `;
@@ -623,7 +668,7 @@ function qaChecklist(a) {
         ['preflight.roles', 'Map roles, permissions, protected areas.']
     ];
     if (qaUiRequired(a))
-        cases.push(['ui.chrome_extension_first', CODEX_WEB_VERIFICATION_POLICY], ['ui.navigation', 'Check primary navigation, deep links, back/forward, refresh, and protected routes.'], ['ui.auth', 'Check login, logout, session expiry, unauthorized access, and role-specific visibility.'], ['ui.forms', 'Check required fields, validation, disabled states, success, and failure.'], ['ui.states', 'Check loading, empty, error, retry, offline/timeout, and slow network states.'], ['ui.crud', 'Check allowed create/change flows and block forbidden destructive flows by environment.'], ['ui.responsive', 'Check desktop, tablet, mobile, overflow, long text, and keyboard focus order.'], ['ui.a11y', 'Check labels, focus traps, modals, contrast-sensitive controls, and screen-reader names.'], ['ui.visual', 'Capture evidence for meaningful UI regressions without storing secrets.']);
+        cases.push(['ui.surface_router', CODEX_WEB_VERIFICATION_POLICY], ['ui.navigation', 'Check primary navigation, deep links, back/forward, refresh, and protected routes.'], ['ui.auth', 'Check login, logout, session expiry, unauthorized access, and role-specific visibility.'], ['ui.forms', 'Check required fields, validation, disabled states, success, and failure.'], ['ui.states', 'Check loading, empty, error, retry, offline/timeout, and slow network states.'], ['ui.crud', 'Check allowed create/change flows and block forbidden destructive flows by environment.'], ['ui.responsive', 'Check desktop, tablet, mobile, overflow, long text, and keyboard focus order.'], ['ui.a11y', 'Check labels, focus traps, modals, contrast-sensitive controls, and screen-reader names.'], ['ui.visual', 'Capture evidence for meaningful UI regressions without storing secrets.']);
     if (qaApiRequired(a))
         cases.push(['api.health', 'Check health/version/readiness endpoints when available.'], ['api.auth', 'Check anonymous, authenticated, expired, and wrong-role access.'], ['api.contract', 'Check status codes, response shape, headers, content type, and error format.'], ['api.validation', 'Check missing, malformed, boundary, duplicate, and over-limit payloads.'], ['api.listing', 'Check pagination, sorting, filters, search, and empty results.'], ['api.mutation', 'Check allowed seeded create/change and forbid deployed destructive flows.'], ['api.idempotency', 'Check retry/idempotency behavior for safe operations.'], ['api.concurrency', 'Check stale change, conflict, and double-submit behavior.'], ['api.failure', 'Check timeout, upstream error, rate-limit, and rollback-visible failure paths.'], ['api.security', 'Check CORS, auth headers, PII redaction, and permission boundaries.']);
     cases.push(['report.evidence', 'Record pass/fail/blocked/skipped with evidence.'], ['report.corrective_loop', 'Record fixes, rechecks, unresolved findings, deferred blockers.'], ['report.honest', 'Run Honest Mode.']);
@@ -675,6 +720,8 @@ async function missingQaLoopVisualEvidence(dir, gate = {}) {
     const visual = await readJson(path.join(dir, QA_LOOP_VISUAL_EVIDENCE_ARTIFACT), null);
     const reasons = [];
     const uiRequired = gate.ui_e2e_required === true;
+    const selectedSurface = gate.ui_selected_surface || gate.qa_surface_selected || (gate.ui_chrome_extension_evidence === true ? 'codex_chrome_extension' : null);
+    const expectedSource = evidenceSourceForSurface(selectedSurface) || CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE;
     if (uiRequired) {
         const screenshot = visual?.chrome_extension_screenshot || {};
         if (gate.ui_chrome_extension_screenshot_captured !== true && !positiveVisualStatus(screenshot.status, ['captured', 'attached', 'verified']))
@@ -690,8 +737,8 @@ async function missingQaLoopVisualEvidence(dir, gate = {}) {
         else
             reasons.push(...await imageEvidenceFileReasons(dir, screenshotPath, screenshotSha, 'ui_chrome_extension_screenshot', screenshotDims));
         const screenshotSource = firstNonEmpty(gate.ui_chrome_extension_screenshot_source, screenshot.evidence_source, gate.ui_evidence_source);
-        if (screenshotSource !== CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE)
-            reasons.push('ui_chrome_extension_screenshot_source_not_codex_chrome_extension');
+        if (screenshotSource !== expectedSource)
+            reasons.push(`ui_chrome_extension_screenshot_source_not_${expectedSource}`);
     }
     const review = visual?.gpt_image_2_annotated_review || {};
     const gptImage2ReviewRequired = gate.gpt_image_2_annotated_review_required === true || review.required === true;
@@ -786,4 +833,14 @@ function positiveCount(value) {
     const n = Number(value || 0);
     return Number.isFinite(n) && n > 0;
 }
+function evidenceSourceForSurface(surface) {
+    const value = String(surface || '').trim();
+    if (value === 'codex_in_app_browser')
+        return CODEX_IN_APP_BROWSER_EVIDENCE_SOURCE;
+    if (value === 'codex_chrome_extension')
+        return CODEX_CHROME_EXTENSION_EVIDENCE_SOURCE;
+    if (value === 'codex_computer_use')
+        return CODEX_COMPUTER_USE_EVIDENCE_SOURCE;
+    return null;
+}
 //# sourceMappingURL=qa-loop.js.map

package/dist/core/release/gate-manifest.js

@@ -6,6 +6,7 @@ export const FORBIDDEN_RECURSIVE_GATES = new Set([
     'release:check:dynamic:execute',
     'release:real-check',
     'release:publish',
+    'publish:ignore-scripts',
     'publish:npm',
     'publish:dry',
     'prepublishOnly'

package/dist/core/release/sla-scheduler.js

@@ -2,7 +2,7 @@ import { computeTriWikiAffectedGraph } from '../triwiki/triwiki-affected-graph.j
 import { buildTriWikiSlaCertificate } from '../triwiki/triwiki-sla-certificate.js';
 import { planExtremeParallelSchedule } from './extreme-parallel-scheduler.js';
 export const SLA_SCHEDULER_SCHEMA = 'sks.sla-scheduler.v1';
-export function planFiveMinuteSla(root, graph = computeTriWikiAffectedGraph({ root, tier: 'affected' }), slaMs = 300_000) {
+export function planFiveMinuteSla(root, graph = computeTriWikiAffectedGraph({ root, tier: 'affected', includeProofLookup: false }), slaMs = 300_000) {
     const schedule = planExtremeParallelSchedule(root, graph);
     const certificate = buildTriWikiSlaCertificate({
         graph,

package/dist/core/release-parallel-full-coverage.js

@@ -17,7 +17,7 @@ export const RELEASE_1_17_GATE_SNAPSHOT = Object.freeze([
     'release:readiness'
 ]);
 export const RELEASE_1_18_REQUIRED_GATES = Object.freeze([
-    'xai-mcp:capability',
+    'ultra-search:provider-interface',
     'source-intelligence:policy',
     'source-intelligence:all-modes',
     'codex-web:adapter',

package/dist/core/routes.js

@@ -30,17 +30,32 @@ export const FROM_CHAT_IMG_CHECKLIST_ARTIFACT = 'from-chat-img-checklist.md';
 export const FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT = 'from-chat-img-temp-triwiki.json';
 export const FROM_CHAT_IMG_QA_LOOP_ARTIFACT = 'from-chat-img-qa-loop.json';
 export const FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS = 5;
-export const USAGE_TOPICS = 'install|setup|bootstrap|root|deps|zellij|tmux|auto-review|team|qa-loop|ppt|image-ux-review|computer-use|goal|fast-mode|research|db|git|codex|codex-app|codex-native|hooks|features|all-features|dfix|commit|commit-and-push|design|imagegen|dollar|context7|xai|pipeline|reasoning|guard|conflicts|versioning|eval|harness|hproof|gx|wiki|wrongness|code-structure|proof-field|skill-dream|rust';
+export const USAGE_TOPICS = 'install|setup|bootstrap|root|deps|zellij|tmux|auto-review|team|qa-loop|ppt|image-ux-review|computer-use|goal|fast-mode|research|db|git|codex|codex-app|codex-native|hooks|features|all-features|dfix|commit|commit-and-push|design|imagegen|dollar|context7|ultra-search|xai|pipeline|reasoning|guard|conflicts|versioning|eval|harness|hproof|gx|wiki|wrongness|code-structure|proof-field|skill-dream|rust';
 export const CODEX_COMPUTER_USE_EVIDENCE_SOURCE = 'codex_computer_use';
-export const CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE = 'codex_chrome_extension';
+export const CODEX_IN_APP_BROWSER_EVIDENCE_SOURCE = 'codex_in_app_browser';
+export const CODEX_CHROME_EXTENSION_EVIDENCE_SOURCE = 'codex_chrome_extension';
+export const CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE = CODEX_IN_APP_BROWSER_EVIDENCE_SOURCE;
 export const CODEX_IMAGEGEN_EVIDENCE_SOURCE = 'codex_app_imagegen_gpt_image_2';
+export const CODEX_IN_APP_BROWSER_DOC_URL = 'https://developers.openai.com/codex/app/browser';
 export const CODEX_CHROME_EXTENSION_DOC_URL = 'https://developers.openai.com/codex/app/chrome-extension';
+export const CODEX_COMPUTER_USE_DOC_URL = 'https://developers.openai.com/codex/app/computer-use';
+export const CODEX_RECORD_REPLAY_DOC_URL = 'https://developers.openai.com/codex/record-and-replay';
+export const CODEX_APP_SERVER_DOC_URL = 'https://developers.openai.com/codex/app-server';
 export const CODEX_APP_IMAGE_GENERATION_DOC_URL = 'https://developers.openai.com/codex/app/features#image-generation';
 export const OPENAI_IMAGE_GENERATION_DOC_URL = 'https://developers.openai.com/api/docs/guides/image-generation';
 export const OPENAI_CHATGPT_IMAGES_2_DOC_URL = 'https://openai.com/index/introducing-chatgpt-images-2-0/';
 export const OPENAI_GPT_IMAGE_2_MODEL_DOC_URL = 'https://developers.openai.com/api/docs/models/gpt-image-2';
-export const CODEX_WEB_VERIFICATION_POLICY = `Web, browser, localhost, website, webapp, and web-based app verification must use the official Codex Chrome Extension path first (${CODEX_CHROME_EXTENSION_DOC_URL}). Before web UX review, QA-LOOP, browser smoke, authenticated browser checks, or web visual verification proceeds, SKS must verify that the Chrome Extension path is installed/enabled through Codex App plugin readiness; if it is missing, rapidly halt the pipeline, tell the user to install/setup the extension, and resume only after the user explicitly says installation is complete. Do not use Codex Computer Use as browser/web-app verification evidence. Do not substitute Playwright, Selenium, Puppeteer, Browser Use, Chrome MCP, generic browser automation, screenshots fabricated from code, or prose-only checks for the Chrome Extension gate.`;
-export const CODEX_COMPUTER_USE_ONLY_POLICY = `Codex Computer Use is reserved for native macOS, desktop-app, OS-settings, and non-web visual tasks such as setting up a Mac app or inspecting a non-browser surface. It must not be used for browser, localhost, website, webapp, or web-based app verification; those routes follow the Chrome Extension policy instead. If live native Computer Use tools are unavailable for a non-web target, mark the native visual evidence unverified instead of fabricating screenshots or substituting browser automation. Codex App readiness/config verification is not target evidence: use Codex-provided control surfaces such as \`codex features list\`, \`codex mcp list\`, \`sks codex-app check\`, remote-control status, and plugin/tool exposure. In Codex App prompts, invoke @Computer or @AppName only for live native Mac/non-web target apps or screens.`;
+export const QA_INTERACTION_SURFACES = Object.freeze([
+    'codex_in_app_browser',
+    'codex_chrome_extension',
+    'codex_computer_use',
+    'codex_app_plugin',
+    'structured_mcp',
+    'shell_or_api_diagnostic'
+]);
+export const CODEX_QA_SURFACE_ROUTING_POLICY = `Codex QA surface routing follows the official Codex App split: use @Browser / in-app Browser (${CODEX_IN_APP_BROWSER_DOC_URL}) first for localhost, local development servers, file-backed previews, and public pages that do not require sign-in; use @Chrome / Codex Chrome Extension (${CODEX_CHROME_EXTENSION_DOC_URL}) for signed-in websites, cookies, browser profiles, extensions, existing tabs, or internal tools; use @Computer or @AppName (${CODEX_COMPUTER_USE_DOC_URL}) for native macOS/Windows apps, OS settings, cross-app workflows, and GUI-only bugs. Prefer structured Plugins/MCPs for repeatable data operations, then verify rendered user-visible results with Browser, Chrome, or Computer Use. Playwright, Selenium, Puppeteer, Chrome MCP, static screenshots, plugin cache, and final-agent prose are not Codex App live action proof. App Server evidence (${CODEX_APP_SERVER_DOC_URL}) must correlate thread, turn, item/tool events, approvals, diffs, actions, observations, findings, fixes, and same-flow replay before a real QA pass is claimed.`;
+export const CODEX_WEB_VERIFICATION_POLICY = CODEX_QA_SURFACE_ROUTING_POLICY;
+export const CODEX_COMPUTER_USE_ONLY_POLICY = `Codex Computer Use is a live GUI surface for supported macOS and Windows environments, invoked with @Computer or @AppName for native apps, OS settings, browser contexts that truly require GUI-level operation, and cross-app workflows. Do not replace @Browser localhost/public-page checks or @Chrome signed-in checks with Computer Use unless the surface router records a specific GUI-only/cross-app reason. If live Computer Use tools, permissions, or app access are unavailable, mark the affected native/GUI evidence blocked or unverified instead of fabricating screenshots or actions. Codex App readiness/config checks are capability evidence only, not target interaction proof.`;
 export const IMAGEGEN_SOCIAL_SOURCE_POLICY = 'Use public X/social/community reports only as prompt-quality and workflow-sentiment hints after official OpenAI/Codex docs. Social posts are not capability specs, evidence of tool availability, or proof that a generated asset was created.';
 export const CODEX_IMAGEGEN_REQUIRED_POLICY = 'Pipeline image generation, raster asset creation/editing, and generated image-review evidence must use real Codex App imagegen/$imagegen with gpt-image-2 when that evidence is required for full verification. For newest-model image requests, prompt explicitly for "ChatGPT Images 2.0 / GPT Image 2.0 with gpt-image-2" instead of relying on generic image-generation wording. Do not substitute placeholder SVG/HTML/CSS, prose-only critique, stock-like stand-ins, manually fabricated files, or missing-output ledgers for requested/generated raster assets or required generated review images. If imagegen/gpt-image-2 is unavailable or generated annotated images cannot be created/linked, record the blocker and cap any closeout at verified_partial/reference-only instead of claiming generated-image evidence or full route verification; that partial closeout requires source screenshots plus hashes, docs evidence, source Image Voxel anchors, and Honest Mode evidence. In Codex App prompts, invoke $imagegen when live image generation is needed; SKS hooks and skills can require the policy but cannot attach missing host image-generation tools to an already-started turn. Official OpenAI/Codex docs are authoritative for capabilities, surfaces, limits, and evidence rules; X/social/community reports may inform prompt style only.';
 export const DEFAULT_CODEX_APP_PLUGINS = Object.freeze([
@@ -56,7 +71,7 @@ export const RESERVED_CODEX_PLUGIN_SKILL_NAMES = Object.freeze([
     'browser-use',
     ...DEFAULT_CODEX_APP_PLUGINS.map(([name]) => name)
 ].sort());
-export const FORBIDDEN_BROWSER_AUTOMATION_RE = /\b(playwright|chrome\s+mcp|browser\s+use|selenium|puppeteer)\b/i;
+export const FORBIDDEN_BROWSER_AUTOMATION_RE = /\b(playwright|chrome\s+mcp|selenium|puppeteer)\b/i;
 export function evidenceMentionsForbiddenBrowserAutomation(value, seen = new Set()) {
     if (value == null)
         return false;
@@ -673,7 +688,8 @@ export const COMMAND_CATALOG = [
     { name: 'image-ux-review', usage: 'sks ux-review run --image <path> --fix --json | sks image-ux-review status <mission-id|latest> [--json]', description: 'Run or inspect $Image-UX-Review gpt-image-2/imagegen annotated UI/UX review artifacts, issue ledgers, safe fix loops, recapture, and proof gates.' },
     { name: 'computer-use', usage: 'sks computer-use import|status|smoke|require ... [--json]', description: 'Record native Mac/non-web Computer Use visual evidence while keeping web verification on the Chrome Extension path.' },
     { name: 'context7', usage: 'sks context7 check|setup|tools|resolve|docs|evidence ...', description: 'Check, configure, and call the local Context7 MCP requirement.' },
-    { name: 'xai', usage: 'sks xai check|setup|status|docs [--scope project|global] [--url <u>|--command <c>] ...', description: 'Set up and check the optional xAI/Grok Live Search MCP provider for source intelligence.' },
+    { name: 'ultra-search', usage: 'sks ultra-search doctor|run|x|fetch|status|inspect|sources|claims|cache|bench|migrate-xai', description: 'Run provider-independent UltraSearch source intelligence.' },
+    { name: 'xai', usage: 'sks xai check|status|docs', description: 'Deprecated compatibility notice; use sks ultra-search.' },
     { name: 'recallpulse', usage: 'sks recallpulse run|status|eval|governance|checklist <mission-id|latest>', description: 'Run report-only RecallPulse active recall, durable status, proof capsule, evidence envelope, and governance checks.' },
     { name: 'pipeline', usage: 'sks pipeline status|resume|plan|answer ...', description: 'Inspect the active skill-first route, materialized execution plan, ambiguity gates, and completion gates.' },
     { name: 'guard', usage: 'sks guard check [--json]', description: 'Check SKS harness self-protection lock, fingerprints, and source-repo exception state.' },

package/dist/core/source-intelligence/source-intelligence-policy.js

@@ -1,9 +1,13 @@
 import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
-export const SOURCE_INTELLIGENCE_POLICY_SCHEMA = 'sks.source-intelligence-policy.v1';
+export const SOURCE_INTELLIGENCE_POLICY_SCHEMA = 'sks.source-intelligence-policy.v2';
 export function buildSourceIntelligencePolicy(input = {}) {
     const route = input.route || 'unknown';
     const offline = input.offline === true;
+    const query = input.query || '';
+    const docsIntent = /\b(package|npm|SDK|API|MCP|framework|library|docs?|문서|React|Next\.js|Prisma|Tailwind)\b/i.test(query);
+    const xIntent = /\b(?:x\.com|twitter\.com|X\/Twitter|트위터|엑스|site:x\.com|site:twitter\.com)\b/i.test(query);
+    const urlIntent = /https?:\/\/[^\s)"']+/i.test(query);
     const context7Available = input.context7Available !== false;
     const codex = input.codexWebCapability || {
         schema: 'sks.codex-web-search-capability.v1',
@@ -11,43 +15,65 @@ export function buildSourceIntelligencePolicy(input = {}) {
         status: 'degraded_unverified',
         reason: 'capability_not_checked'
     };
-    const xai = input.xaiDetection;
-    const xaiSearchCapable = xai?.search_capable === true;
-    const xaiConfigured = xai?.configured === true;
     const blockers = [];
     const warnings = [];
     const wrongnessKinds = [];
-    if (!context7Available) {
+    if (docsIntent && !context7Available) {
         blockers.push('docs_context_missing');
         wrongnessKinds.push('context7_missing');
     }
     if (!offline && codex.status === 'unavailable') {
-        warnings.push('codex_web_search_unavailable_degraded_to_context7_only');
+        warnings.push('codex_web_search_unavailable_degraded_to_ultra_cache_or_docs');
         wrongnessKinds.push('codex_web_search_missing');
     }
-    if (xaiSearchCapable)
-        warnings.push('xai_search_evidence_required_for_verified_current_claims');
-    if (xaiConfigured && !xaiSearchCapable && xai?.configured_but_unverified)
-        warnings.push('xai_mcp_configured_but_search_capability_unverified');
-    const mode = !context7Available
+    if (input.xaiDetection)
+        warnings.push('xai_detection_input_ignored_by_source_intelligence_v2');
+    const mode = input.mode || (!context7Available && docsIntent
         ? 'blocked'
         : offline
-            ? 'offline_context7_only'
-            : xaiSearchCapable
-                ? 'context7_codex_web_xai'
-                : codex.status === 'unavailable'
-                    ? 'context7_only_degraded'
-                    : 'context7_codex_web';
+            ? 'offline_cache'
+            : urlIntent
+                ? 'url_acquisition'
+                : xIntent
+                    ? 'x_search'
+                    : /deep|exhaustive|가능한 전부|누락 없이|완벽하게 조사/i.test(query)
+                        ? 'ultra_deep'
+                        : 'ultra_balanced');
+    const selected = new Set();
+    if (docsIntent && context7Available)
+        selected.add('context7');
+    if (!offline && codex.status !== 'unavailable')
+        selected.add('codex_web');
+    if (xIntent || mode === 'x_search')
+        selected.add('x_public');
+    if (offline)
+        selected.add('offline_cache');
     return {
         schema: SOURCE_INTELLIGENCE_POLICY_SCHEMA,
         generated_at: nowIso(),
         ok: blockers.length === 0,
         route,
         mode,
+        requirements: {
+            official_sources: docsIntent,
+            full_content: mode !== 'ultra_fast',
+            counter_search: mode === 'ultra_deep' || mode === 'ultra_exhaustive',
+            claim_ledger: true,
+            social_recency: xIntent || mode === 'x_search',
+            code_execution_verification: /\b(code|implementation|test|runtime|구현)\b/i.test(query)
+        },
+        capabilities: {
+            docs: context7Available ? ['context7', 'official_web'] : ['official_web'],
+            web_search: !offline ? ['codex_web'] : [],
+            repo_search: ['github'],
+            social: xIntent || mode === 'x_search' ? ['x_public', 'authenticated_chrome_optional', 'official_x_api_optional'] : [],
+            browser: ['codex_browser_optional', 'codex_chrome_optional']
+        },
+        selected_providers: [...selected],
         context7: {
-            required: true,
+            required: docsIntent,
             available: context7Available,
-            status: context7Available ? (offline ? 'offline_only' : 'available') : 'missing'
+            status: docsIntent ? (context7Available ? (offline ? 'offline_only' : 'available') : 'missing') : 'not_required'
         },
         codex_web_search: {
             required: !offline,
@@ -55,13 +81,6 @@ export function buildSourceIntelligencePolicy(input = {}) {
             status: codex.status,
             reason: codex.reason
         },
-        xai_mcp: {
-            required: xaiSearchCapable,
-            configured: xaiConfigured,
-            search_capable: xaiSearchCapable,
-            configured_but_unverified: xai?.configured_but_unverified === true,
-            status: xai?.status || 'not_checked'
-        },
         wrongness_kinds: wrongnessKinds,
         blockers,
         warnings

package/dist/core/source-intelligence/source-intelligence-proof.js

@@ -1,25 +1,21 @@
-export const SOURCE_INTELLIGENCE_PROOF_SCHEMA = 'sks.source-intelligence-proof.v1';
+export const SOURCE_INTELLIGENCE_PROOF_SCHEMA = 'sks.source-intelligence-proof.v2';
 export function buildSourceIntelligenceProof(policy, evidence) {
     const blockers = [...policy.blockers];
     const wrongnessKinds = [...policy.wrongness_kinds];
-    const context7Ok = evidence.context7?.ok === true;
-    const codexWebOk = policy.codex_web_search.required ? evidence.codex_web_search?.ok === true : true;
-    const xaiOk = policy.xai_mcp.required ? evidence.xai_search?.ok === true : true;
-    const xaiMissingIsBlocker = policy.xai_mcp.required && !xaiOk;
+    const context7Ok = policy.context7.required ? evidence.context7?.ok === true : true;
+    const ultraOk = evidence.ultra_search?.proof.provider_independent === true && evidence.ultra_search?.proof.xai_runtime_dependency === false;
     const appshotsRequired = evidence.appshots?.capability.visual_required === true;
     const appshotsOk = appshotsRequired ? evidence.appshots?.ok === true : true;
     if (policy.context7.required && !context7Ok) {
         blockers.push('context7_missing');
         wrongnessKinds.push('context7_missing');
     }
-    if (policy.codex_web_search.required && !codexWebOk && policy.mode !== 'context7_only_degraded') {
-        blockers.push('codex_web_search_missing');
-        wrongnessKinds.push('codex_web_search_missing');
-    }
-    if (policy.xai_mcp.required && !xaiOk) {
-        blockers.push('xai_available_not_used');
-        wrongnessKinds.push('xai_available_not_used');
+    if (!ultraOk) {
+        blockers.push('ultra_search_provider_independent_proof_missing');
+        wrongnessKinds.push('ultra_search_provider_independent_proof_missing');
     }
+    if (evidence.ultra_search?.proof.blockers.length)
+        blockers.push(...evidence.ultra_search.proof.blockers);
     if (appshotsRequired && !appshotsOk) {
         blockers.push('appshots_operator_action_missing');
         wrongnessKinds.push('appshots_operator_action_missing');
@@ -32,10 +28,8 @@ export function buildSourceIntelligenceProof(policy, evidence) {
             context7_required: policy.context7.required,
             context7_ok: context7Ok,
             codex_web_required: policy.codex_web_search.required,
-            codex_web_ok: codexWebOk,
-            xai_required: policy.xai_mcp.required,
-            xai_ok: xaiOk,
-            xai_missing_is_blocker: xaiMissingIsBlocker,
+            ultra_search_ok: ultraOk,
+            provider_independent: evidence.ultra_search?.proof.provider_independent === true,
             appshots_required: appshotsRequired,
             appshots_ok: appshotsOk
         },