sneakoscope 4.4.0 → 4.6.0

package/dist/core/code-structure.js

@@ -1,29 +1,43 @@
 import path from 'node:path';
 import fsp from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
 import { nowIso, writeJsonAtomic } from './fsx.js';
+import { LEAN_CHANGE_EVIDENCE_SCHEMA, leanPolicyReference, parseLeanSimplificationMarkerLine } from './lean-engineering-policy.js';
 export const CODE_STRUCTURE_THRESHOLDS = {
     warning: 1000,
     review: 2000,
     split_required_review: 3000
 };
-const DEFAULT_INCLUDE = new Set(['.js', '.js', '.ts', '.tsx', '.jsx', '.cjs']);
+const DEFAULT_INCLUDE = new Set(['.js', '.ts', '.tsx', '.jsx', '.cjs', '.mjs']);
 const SKIP_DIRS = new Set(['.git', 'node_modules', '.sneakoscope', 'dist', 'build', 'coverage']);
+const SOURCE_DIR_RE = /^(src|test|tests|schemas|scripts|crates|docs)\//;
+const SOURCE_EXT_RE = /\.(js|ts|tsx|jsx|cjs|mjs|json|md|rs|toml)$/;
+const FALLBACK_RE = /\b(fallback|legacy|shim|compat|mock|catch-all|catch all|default provider)\b/i;
+const CONFIG_FLAG_RE = /\b(process\.env|SKS_[A-Z0-9_]+|CODEX_[A-Z0-9_]+|[A-Z][A-Z0-9_]{5,})\b/;
+const ABSTRACTION_RE = /\b(interface|abstract class|class|factory|provider|adapter|registry|orchestrator|manager)\b/;
 export async function scanCodeStructure(root, opts = {}) {
-    const files = opts.files?.length ? opts.files.map((file) => path.resolve(root, file)) : await listSourceFiles(root);
-    const touched = new Set((opts.touchedFiles || []).map((file) => path.relative(root, path.resolve(root, file))));
+    const changedScope = await collectChangedScope(root, opts);
+    const files = await resolveScanFiles(root, opts, changedScope);
+    const touched = new Set((opts.touchedFiles || []).map((file) => normalizeRel(root, file)));
+    const changedSet = new Set((changedScope.source_files || []).map((file) => normalizeSlashes(file)));
     const entries = [];
+    const intentionalSimplifications = [];
     for (const file of files) {
-        const rel = path.relative(root, file);
-        const lineCount = await countLines(file).catch(() => 0);
+        const rel = normalizeRel(root, file);
+        const text = await fsp.readFile(file, 'utf8').catch(() => '');
+        const lineCount = text ? text.split(/\n/).length : 0;
         const status = structureStatus(lineCount);
-        if (status === 'ok' && !opts.includeOk)
+        const changedByDiff = changedSet.has(rel);
+        if (status === 'ok' && !opts.includeOk && !changedByDiff)
             continue;
+        const signals = analyzeTextSignals(rel, text, changedByDiff);
+        intentionalSimplifications.push(...signals.lean_markers);
         entries.push({
             path: rel,
             line_count: lineCount,
             status,
             generated_or_vendor: isGeneratedOrVendor(rel),
-            touched_by_mission: touched.size ? touched.has(rel) : false,
+            touched_by_mission: touched.size ? touched.has(rel) : changedByDiff,
             recommended_action: recommendedAction(rel, lineCount),
             exception: lineCount >= CODE_STRUCTURE_THRESHOLDS.split_required_review && !isGeneratedOrVendor(rel)
                 ? {
@@ -34,15 +48,43 @@ export async function scanCodeStructure(root, opts = {}) {
                     next_split_candidate: nextSplitCandidate(rel),
                     temporary_until: 'next substantial edit to this file'
                 }
-                : null
+                : null,
+            lean_signals: signals
         });
     }
+    const dependencyDelta = await collectDependencyDelta(root, changedScope.base);
+    const fallbackSites = await collectAddedFallbackSites(root, changedScope);
+    const runnableChecks = collectRunnableChecks(changedScope);
+    const semanticReview = buildSemanticReview({
+        entries,
+        changedScope,
+        dependencyDelta,
+        fallbackSites,
+        intentionalSimplifications,
+        runnableChecks
+    });
+    const leanChangeEvidence = buildLeanChangeEvidence({
+        changedScope,
+        dependencyDelta,
+        fallbackSites,
+        intentionalSimplifications,
+        runnableChecks,
+        semanticReview
+    });
     return {
         schema_version: 1,
         mission_id: opts.missionId || null,
         scanned_at: nowIso(),
         thresholds: CODE_STRUCTURE_THRESHOLDS,
         files: entries.sort((a, b) => b.line_count - a.line_count),
+        changed_scope: changedScope,
+        dependencies_added: dependencyDelta.added,
+        dependencies_removed: dependencyDelta.removed,
+        fallback_sites_added: fallbackSites,
+        intentional_simplifications: intentionalSimplifications,
+        runnable_checks: runnableChecks,
+        semantic_review: semanticReview,
+        lean_change_evidence: leanChangeEvidence,
         actions_taken: opts.actions_taken || [],
         remaining_risks: entries.filter((entry) => entry.exception).map((entry) => `${entry.path}: ${entry.status}`)
     };
@@ -52,6 +94,103 @@ export async function writeCodeStructureReport(root, dir, opts = {}) {
     await writeJsonAtomic(path.join(dir, 'code-structure-report.json'), report);
     return report;
 }
+export function leanChangeEvidenceFromReport(report) {
+    if (report?.lean_change_evidence)
+        return report.lean_change_evidence;
+    return buildLeanChangeEvidence({
+        changedScope: report?.changed_scope || emptyChangedScope('unknown', 'HEAD'),
+        dependencyDelta: {
+            added: report?.dependencies_added || [],
+            removed: report?.dependencies_removed || []
+        },
+        fallbackSites: report?.fallback_sites_added || [],
+        intentionalSimplifications: report?.intentional_simplifications || [],
+        runnableChecks: report?.runnable_checks || [],
+        semanticReview: report?.semantic_review || { status: 'needs-review', findings: [] }
+    });
+}
+async function resolveScanFiles(root, opts, changedScope) {
+    if (opts.files?.length)
+        return opts.files.map((file) => path.resolve(root, file));
+    const changedSourceFiles = (changedScope.source_files || [])
+        .filter((file) => DEFAULT_INCLUDE.has(path.extname(file)))
+        .map((file) => path.resolve(root, file));
+    if ((opts.changed || opts.changedSince || opts.changedFiles?.length) && changedSourceFiles.length)
+        return changedSourceFiles;
+    return listSourceFiles(root);
+}
+async function collectChangedScope(root, opts) {
+    if (opts.changedFiles?.length) {
+        const changedFiles = Array.from(new Set(opts.changedFiles.map((file) => normalizeRel(root, file))));
+        return {
+            ...emptyChangedScope('explicit', opts.changedSince || 'HEAD'),
+            changed_files: changedFiles,
+            source_files: changedFiles.filter(isSourceLike),
+            entries: changedFiles.map((file) => ({ path: file, status: 'M', lines_added: 0, lines_deleted: 0 }))
+        };
+    }
+    const shouldCollect = opts.changed || opts.changedSince;
+    if (!shouldCollect)
+        return emptyChangedScope('full', opts.changedSince || 'HEAD');
+    const base = String(opts.changedSince || (typeof opts.changed === 'string' ? opts.changed : 'HEAD'));
+    const numstat = gitLines(root, ['diff', '--numstat', base, '--']);
+    const nameStatus = gitLines(root, ['diff', '--name-status', base, '--']);
+    const untracked = gitLines(root, ['ls-files', '--others', '--exclude-standard']);
+    const entriesByPath = new Map();
+    for (const line of numstat) {
+        const parts = line.split(/\t/);
+        if (parts.length < 3)
+            continue;
+        const linesAdded = parseNumstat(parts[0] || '0');
+        const linesDeleted = parseNumstat(parts[1] || '0');
+        const rel = normalizeSlashes(parts.slice(2).join('\t'));
+        entriesByPath.set(rel, {
+            path: rel,
+            status: 'M',
+            lines_added: linesAdded,
+            lines_deleted: linesDeleted
+        });
+    }
+    for (const line of nameStatus) {
+        const parts = line.split(/\t/).filter(Boolean);
+        if (parts.length < 2)
+            continue;
+        const status = parts[0];
+        const rel = normalizeSlashes(parts[parts.length - 1] || '');
+        if (!rel)
+            continue;
+        const existing = entriesByPath.get(rel) || { path: rel, lines_added: 0, lines_deleted: 0 };
+        entriesByPath.set(rel, { ...existing, status });
+    }
+    for (const rel of untracked.map(normalizeSlashes).filter(Boolean)) {
+        if (entriesByPath.has(rel))
+            continue;
+        const text = await fsp.readFile(path.join(root, rel), 'utf8').catch(() => '');
+        entriesByPath.set(rel, {
+            path: rel,
+            status: 'A',
+            lines_added: text ? text.split(/\n/).length : 0,
+            lines_deleted: 0
+        });
+    }
+    const entries = [...entriesByPath.values()].filter((entry) => entry.path);
+    const changedFiles = entries.map((entry) => entry.path);
+    const sourceFiles = changedFiles.filter(isSourceLike);
+    const linesAdded = entries.reduce((sum, entry) => sum + Number(entry.lines_added || 0), 0);
+    const linesDeleted = entries.reduce((sum, entry) => sum + Number(entry.lines_deleted || 0), 0);
+    return {
+        mode: 'git-diff',
+        base,
+        changed_files: changedFiles,
+        files_added: entries.filter((entry) => String(entry.status || '').startsWith('A')).length,
+        files_deleted: entries.filter((entry) => String(entry.status || '').startsWith('D')).length,
+        lines_added: linesAdded,
+        lines_deleted: linesDeleted,
+        net_lines: linesAdded - linesDeleted,
+        source_files: sourceFiles,
+        entries
+    };
+}
 async function listSourceFiles(root, dir = root, out = []) {
     const entries = await fsp.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
@@ -70,6 +209,203 @@ async function listSourceFiles(root, dir = root, out = []) {
     }
     return out;
 }
+async function collectDependencyDelta(root, base = 'HEAD') {
+    const current = await readPackageDependencyNames(path.join(root, 'package.json'));
+    const previousText = gitText(root, ['show', `${base}:package.json`]);
+    const previous = parsePackageDependencyNames(previousText || '{}');
+    return {
+        added: [...current].filter((name) => !previous.has(name)).sort(),
+        removed: [...previous].filter((name) => !current.has(name)).sort()
+    };
+}
+async function readPackageDependencyNames(file) {
+    const text = await fsp.readFile(file, 'utf8').catch(() => '{}');
+    return parsePackageDependencyNames(text);
+}
+function parsePackageDependencyNames(text) {
+    const value = safeJson(text);
+    const names = new Set();
+    for (const section of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+        const deps = value?.[section] && typeof value[section] === 'object' ? value[section] : {};
+        for (const name of Object.keys(deps))
+            names.add(`${section}:${name}`);
+    }
+    return names;
+}
+async function collectAddedFallbackSites(root, changedScope) {
+    if (!changedScope?.source_files?.length || changedScope.mode !== 'git-diff')
+        return [];
+    const diff = gitText(root, ['diff', '--unified=0', changedScope.base || 'HEAD', '--', ...changedScope.source_files]);
+    const sites = [];
+    let currentFile = '';
+    let currentLine = 0;
+    for (const line of diff.split(/\r?\n/)) {
+        if (line.startsWith('+++ b/')) {
+            currentFile = normalizeSlashes(line.slice('+++ b/'.length));
+            continue;
+        }
+        const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+        if (hunk) {
+            currentLine = Number(hunk[1]) || 0;
+            continue;
+        }
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            if (FALLBACK_RE.test(line))
+                sites.push({ file: currentFile, line: currentLine, text: line.slice(1).trim().slice(0, 160) });
+            currentLine += 1;
+            continue;
+        }
+        if (!line.startsWith('-'))
+            currentLine += 1;
+    }
+    return sites;
+}
+function analyzeTextSignals(rel, text, changedByDiff) {
+    const lines = text.split(/\r?\n/);
+    const imports = lines.filter((line) => /^\s*import\s/.test(line));
+    const externalImports = imports
+        .map((line) => /from\s+['"]([^'"]+)['"]|import\s+['"]([^'"]+)['"]/.exec(line)?.[1] || /from\s+['"]([^'"]+)['"]|import\s+['"]([^'"]+)['"]/.exec(line)?.[2] || '')
+        .filter((specifier) => specifier && !specifier.startsWith('.') && !specifier.startsWith('node:'));
+    const leanMarkers = lines
+        .map((line, index) => parseLeanSimplificationMarkerLine(line, rel, index + 1))
+        .filter((marker) => Boolean(marker));
+    const effectiveLines = lines.map((line) => line.trim()).filter(Boolean);
+    const forwardingOnly = effectiveLines.length > 0
+        && effectiveLines.length <= 10
+        && effectiveLines.every((line) => line.startsWith('import ') || line.startsWith('export ') || line.startsWith('//') || line.startsWith('/*') || line.startsWith('*'));
+    return {
+        import_count: imports.length,
+        external_dependency_imports: Array.from(new Set(externalImports)).sort(),
+        ts_nocheck: /^\s*\/\/\s*@ts-nocheck\b/m.test(text),
+        changed_by_diff: changedByDiff,
+        forwarding_only: forwardingOnly,
+        fallback_markers: countMatches(text, FALLBACK_RE),
+        config_flag_markers: countMatches(text, CONFIG_FLAG_RE),
+        abstraction_markers: countMatches(text, ABSTRACTION_RE),
+        lean_markers: leanMarkers
+    };
+}
+function collectRunnableChecks(changedScope) {
+    return (changedScope.source_files || [])
+        .filter((file) => /\b(test|tests|fixture|fixtures|spec|check|__tests__)\b/i.test(file))
+        .sort();
+}
+function buildSemanticReview(input) {
+    const findings = [];
+    for (const dep of input.dependencyDelta.added || []) {
+        findings.push({
+            tag: 'reuse',
+            severity: 'blocker',
+            summary: `new dependency requires explicit lean justification: ${dep}`
+        });
+    }
+    if ((input.fallbackSites || []).length) {
+        findings.push({
+            tag: 'fallback',
+            severity: 'review',
+            summary: `${input.fallbackSites.length} added fallback/compat/mock marker(s) need authority and proof`
+        });
+    }
+    const changedEntries = (input.entries || input.changedScope?.entries || []);
+    if (input.changedScope?.net_lines > 300) {
+        findings.push({
+            tag: 'shrink',
+            severity: 'review',
+            summary: `changed diff is +${input.changedScope.net_lines} net lines; confirm this is the smallest sufficient change`
+        });
+    }
+    if ((input.changedScope?.source_files || []).length && !(input.runnableChecks || []).length) {
+        findings.push({
+            tag: 'verify',
+            severity: 'review',
+            summary: 'changed source files were detected without a changed runnable check file'
+        });
+    }
+    for (const entry of input.entries || []) {
+        if (!entry.lean_signals?.changed_by_diff)
+            continue;
+        if (entry.lean_signals.ts_nocheck) {
+            findings.push({
+                tag: 'verify',
+                severity: isLeanOwnedTypeSafetyPath(entry.path) ? 'blocker' : 'review',
+                file: entry.path,
+                summary: isLeanOwnedTypeSafetyPath(entry.path)
+                    ? 'changed Lean/architecture-owned file contains @ts-nocheck'
+                    : 'changed auxiliary fixture/gate file contains @ts-nocheck; keep typed migration scoped'
+            });
+        }
+        if (entry.lean_signals.forwarding_only) {
+            findings.push({
+                tag: 'reuse',
+                severity: 'review',
+                file: entry.path,
+                summary: 'changed file is forwarding-only; confirm it replaces an older path instead of duplicating an SSOT'
+            });
+        }
+        if (entry.lean_signals.config_flag_markers > 6 || entry.lean_signals.abstraction_markers > 12) {
+            findings.push({
+                tag: 'yagni',
+                severity: 'review',
+                file: entry.path,
+                summary: 'changed file has dense config/abstraction markers; review for unrequested knobs or layers'
+            });
+        }
+    }
+    for (const marker of input.intentionalSimplifications || []) {
+        if (marker.status === 'complete')
+            continue;
+        findings.push({
+            tag: 'shrink',
+            severity: 'review',
+            file: marker.file,
+            line: marker.line,
+            summary: `lean simplification marker is incomplete: ${marker.status}`
+        });
+    }
+    const status = findings.some((finding) => finding.severity === 'blocker')
+        ? 'blocked'
+        : findings.some((finding) => finding.severity === 'review')
+            ? 'needs-review'
+            : 'pass';
+    return { status, findings };
+}
+function isLeanOwnedTypeSafetyPath(file) {
+    return [
+        'src/core/code-structure.ts',
+        'src/core/commands/code-structure-command.ts',
+        'src/core/lean-engineering-policy.ts',
+        'src/core/codex-control/gpt-final-arbiter.ts',
+        'src/core/codex-control/gpt-final-review-schema.ts',
+        'src/core/codex-control/codex-fake-sdk-adapter.ts',
+        'src/core/agents/native-worker-backend-router.ts',
+        'src/scripts/check-architecture.ts',
+        'src/scripts/check-command-module-budget.ts',
+        'src/scripts/check-pipeline-budget.ts',
+        'src/scripts/check-route-modularity.ts',
+        'src/scripts/check-publish-tag.ts',
+        'src/scripts/gpt-final-arbiter-check.ts',
+        'src/scripts/release-registry-check.ts'
+    ].includes(file);
+}
+function buildLeanChangeEvidence(input) {
+    const changedScope = input.changedScope || emptyChangedScope('unknown', 'HEAD');
+    return {
+        schema: LEAN_CHANGE_EVIDENCE_SCHEMA,
+        ...leanPolicyReference(),
+        changed_files: changedScope.changed_files || [],
+        files_added: changedScope.files_added || 0,
+        files_deleted: changedScope.files_deleted || 0,
+        lines_added: changedScope.lines_added || 0,
+        lines_deleted: changedScope.lines_deleted || 0,
+        net_lines: changedScope.net_lines || 0,
+        dependencies_added: input.dependencyDelta?.added || [],
+        dependencies_removed: input.dependencyDelta?.removed || [],
+        fallback_sites_added: input.fallbackSites || [],
+        intentional_simplifications: input.intentionalSimplifications || [],
+        runnable_checks: input.runnableChecks || [],
+        semantic_review: input.semanticReview || { status: 'needs-review', findings: [] }
+    };
+}
 async function countLines(file) {
     const text = await fsp.readFile(file, 'utf8');
     return text ? text.split(/\n/).length : 0;
@@ -89,17 +425,69 @@ function isGeneratedOrVendor(rel) {
 function recommendedAction(rel, lines) {
     if (lines < CODE_STRUCTURE_THRESHOLDS.warning)
         return 'none';
-    if (/src\/cli\/main\.js$/.test(rel))
+    if (/src\/cli\/main\.(js|ts)$/.test(rel))
         return 'extract CLI subcommand handlers into focused modules before adding substantial command logic';
     if (/routes|pipeline|init/.test(rel))
         return 'extract policy tables or route-specific execution into focused modules';
     return 'identify a cohesive module boundary and extract before adding unrelated logic';
 }
 function nextSplitCandidate(rel) {
-    if (/src\/cli\/main\.js$/.test(rel))
+    if (/src\/cli\/main\.(js|ts)$/.test(rel))
         return 'goal/wiki/team/eval/db command handlers';
-    if (/src\/core\/pipeline\.js$/.test(rel))
+    if (/src\/core\/pipeline\.(js|ts)$/.test(rel))
         return 'route prepare handlers and stop-gate evaluators';
     return 'largest cohesive command or policy section';
 }
+function countMatches(text, pattern) {
+    const flags = pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`;
+    return [...text.matchAll(new RegExp(pattern.source, flags))].length;
+}
+function isSourceLike(file) {
+    const rel = normalizeSlashes(file);
+    return SOURCE_DIR_RE.test(rel) && SOURCE_EXT_RE.test(rel) && !isGeneratedOrVendor(rel);
+}
+function parseNumstat(value) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+function gitLines(root, args) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
+    if (result.status !== 0)
+        return [];
+    return String(result.stdout || '').split(/\r?\n/).filter(Boolean);
+}
+function gitText(root, args) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    if (result.status !== 0)
+        return '';
+    return String(result.stdout || '');
+}
+function emptyChangedScope(mode, base) {
+    return {
+        mode,
+        base,
+        changed_files: [],
+        files_added: 0,
+        files_deleted: 0,
+        lines_added: 0,
+        lines_deleted: 0,
+        net_lines: 0,
+        source_files: [],
+        entries: []
+    };
+}
+function normalizeRel(root, file) {
+    return normalizeSlashes(path.relative(root, path.resolve(root, file)));
+}
+function normalizeSlashes(file) {
+    return String(file || '').replace(/\\/g, '/');
+}
 //# sourceMappingURL=code-structure.js.map

package/dist/core/codex-control/codex-fake-sdk-adapter.js

@@ -27,22 +27,44 @@ export async function runFakeCodexSdkTask(input) {
 }
 function fakeStructuredOutput(input) {
     if (input.outputSchemaId === GPT_FINAL_ARBITER_RESULT_SCHEMA_ID) {
-        const unsafe = /\b(truncate|delete all|drop table|credential)\b/i.test(input.prompt || '');
+        const prompt = String(input.prompt || '');
+        const leanEnabled = /\b(Lean review|Lean Engineering Policy|sks\.lean-engineering-policy)\b/i.test(prompt);
+        const unsafe = /\b(truncate|delete all|drop table|credential|delete validation|validation removed|path traversal|sql injection|secret leak)\b/i.test(prompt);
+        const overbuild = leanEnabled ? classifyLeanOverbuild(prompt) : null;
+        const status = unsafe ? 'rejected' : overbuild ? 'needs_more_work' : 'approved';
+        const leanStatus = unsafe ? 'rejected' : overbuild ? 'needs_more_work' : 'pass';
+        const blockers = unsafe ? ['unsafe_candidate_patch'] : overbuild?.blockers || [];
+        const findings = unsafe
+            ? [{ id: 'unsafe-candidate', severity: 'high', summary: 'unsafe candidate rejected' }]
+            : overbuild ? overbuild.findings : [];
         return {
             schema: GPT_FINAL_ARBITER_RESULT_SCHEMA_ID,
-            status: unsafe ? 'rejected' : 'approved',
+            status,
             summary: unsafe
                 ? 'Fake Codex SDK GPT final arbiter rejected an unsafe candidate for hermetic verification.'
-                : 'Fake Codex SDK GPT final arbiter approved the candidate for hermetic verification.',
-            gpt_review_findings: unsafe ? [{ id: 'unsafe-candidate', severity: 'high', summary: 'unsafe candidate rejected' }] : [],
-            accepted_patch_envelopes: unsafe ? [] : [],
+                : overbuild
+                    ? 'Fake Codex SDK GPT final arbiter requested a leaner candidate for hermetic verification.'
+                    : 'Fake Codex SDK GPT final arbiter approved the candidate for hermetic verification.',
+            gpt_review_findings: findings,
+            accepted_patch_envelopes: status === 'approved' ? [] : [],
             modified_patch_envelopes: [],
-            rejected_patch_envelopes: unsafe ? [{ id: 'unsafe-candidate', summary: 'unsafe candidate', patch_envelope_json: '{}' }] : [],
-            required_followup_work: unsafe ? [{ id: 'unsafe_candidate_patch', severity: 'high', summary: 'unsafe_candidate_patch' }] : [],
+            rejected_patch_envelopes: status === 'rejected' ? [{ id: blockers[0] || 'rejected-candidate', summary: blockers[0] || 'rejected candidate', patch_envelope_json: '{}' }] : [],
+            required_followup_work: blockers.map((blocker) => ({ id: blocker, severity: unsafe ? 'high' : 'medium', summary: blocker })),
             verification_plan: ['schema validation', 'local collaboration final gate'],
             rollback_notes: [],
-            blockers: unsafe ? ['unsafe_candidate_patch'] : [],
-            confidence: unsafe ? 'medium' : 'high'
+            blockers,
+            lean_review: {
+                status: leanStatus,
+                selected_rung: unsafe ? 'unknown' : overbuild?.selected_rung || 'minimal-custom',
+                unnecessary_files: [],
+                unnecessary_dependencies: overbuild?.unnecessary_dependencies || [],
+                unnecessary_abstractions: overbuild?.unnecessary_abstractions || [],
+                fallback_findings: unsafe ? ['unsafe_candidate_patch'] : overbuild?.fallback_findings || [],
+                root_cause_review: overbuild?.root_cause_review || [],
+                verification_minimum_present: !unsafe && !/\b(missing runnable check|no runnable check)\b/i.test(prompt),
+                net_lines: null
+            },
+            confidence: unsafe || overbuild ? 'medium' : 'high'
         };
     }
     return {
@@ -56,4 +78,40 @@ function fakeStructuredOutput(input) {
         blockers: []
     };
 }
+function classifyLeanOverbuild(prompt) {
+    if (/\b(existing helper reimplementation|same helper reimplementation|reimplement existing helper)\b/i.test(prompt)) {
+        return leanFinding('reuse_existing_helper', 'reuse-existing', 'Candidate reimplements an existing helper instead of reusing the repository authority.', {
+            root_cause_review: ['reuse existing helper or fix the common helper once']
+        });
+    }
+    if (/\b(new dependency|dependency bloat|native platform instead of dependency)\b/i.test(prompt)) {
+        return leanFinding('unnecessary_dependency', 'stdlib', 'Candidate adds a dependency where stdlib or platform support is sufficient.', {
+            unnecessary_dependencies: ['unjustified dependency']
+        });
+    }
+    if (/\b(one implementation factory|single implementation factory|one implementation interface)\b/i.test(prompt)) {
+        return leanFinding('single_impl_abstraction', 'minimal-custom', 'Candidate adds an abstraction without a second implementation or real variation axis.', {
+            unnecessary_abstractions: ['single implementation factory/interface']
+        });
+    }
+    if (/\b(hidden mock fallback|silent mock fallback|fixture fallback)\b/i.test(prompt)) {
+        return leanFinding('hidden_fallback', 'minimal-custom', 'Candidate hides a production failure behind a mock or fixture fallback.', {
+            fallback_findings: ['hidden mock fallback']
+        });
+    }
+    if (/\b(caller duplicate guard|duplicate caller guard|symptom patch)\b/i.test(prompt)) {
+        return leanFinding('root_cause_missing', 'minimal-custom', 'Candidate patches a caller symptom instead of the shared root cause.', {
+            root_cause_review: ['move duplicated guard to the shared root-cause helper']
+        });
+    }
+    return null;
+}
+function leanFinding(id, selectedRung, summary, extra = {}) {
+    return {
+        selected_rung: selectedRung,
+        blockers: [id],
+        findings: [{ id, severity: 'medium', summary }],
+        ...extra
+    };
+}
 //# sourceMappingURL=codex-fake-sdk-adapter.js.map

package/dist/core/codex-control/gpt-final-arbiter.js

@@ -5,6 +5,7 @@ import { evaluateLocalCollaborationFinalGate, resolveLocalCollaborationPolicy }
 import { runCodexTask } from './codex-control-plane.js';
 import { GPT_FINAL_ARBITER_INPUT_SCHEMA, GPT_FINAL_ARBITER_RESULT_SCHEMA_ID, gptFinalArbiterResultSchema, normalizeGptFinalArbiterResult } from './gpt-final-review-schema.js';
 import { compressGptFinalContext } from './gpt-final-context-compressor.js';
+import { leanEngineeringCompactText } from '../lean-engineering-policy.js';
 export const GPT_FINAL_ARBITER_RUN_SCHEMA = 'sks.gpt-final-arbiter-run.v1';
 export async function runGptFinalArbiter(input, opts = {}) {
     const started = Date.now();
@@ -145,7 +146,9 @@ function buildArbiterPrompt(input, compressed) {
     return [
         'You are the GPT Final Arbiter for an SKS local collaboration run.',
         'Local model outputs are drafts only. Review the proof pack, candidate diff, patch envelopes, verification results, side effects, mutation ledger, and rollback plan.',
-        'Approve or modify only when the candidate is safe and supported. Reject unsafe local patches. Return only the requested structured JSON schema.',
+        leanEngineeringCompactText(),
+        'Lean review: check for reused helpers before reimplementation, unjustified dependencies, one-implementation factories/interfaces, hidden mock or provider fallbacks, duplicated caller guards instead of root-cause fixes, forwarding-only files, missing runnable checks for non-trivial logic, and safety/validation removal disguised as simplification.',
+        'Approve or modify only when the candidate is safe, supported, and no more complex than the request requires. Reject unsafe local patches. Return only the requested structured JSON schema.',
         JSON.stringify({
             route: input.route,
             mission_id: input.mission_id,