sneakoscope 4.4.0 → 4.6.0

package/dist/scripts/check-architecture.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 const root = process.cwd();
 const failures = [];
 const waivers = loadWaivers();
+const changedFiles = changedFileSet();
 runGate('pipeline-budget:check');
 runGate('pipeline-runtime:check');
 checkFacade('src/core/pipeline-runtime.ts', 300);
@@ -44,10 +44,16 @@ function checkLargeFiles() {
         if (isWaivedGenerated(relPath))
             continue;
         const max = architectureLineLimit(relPath);
-        if (lines > max)
-            failures.push(`${relPath}: handwritten file ${lines} lines > ${max} architecture gate`);
-        if (!isRouteDomainAggregator(relPath) && importsUnrelatedRouteDomains(file))
-            failures.push(`${relPath}: imports 5+ unrelated route domains`);
+        const baselineLines = changedFiles.has(relPath) ? baseLineCount(relPath) : lines;
+        if (lines >= 3000)
+            failures.push(`${relPath}: handwritten file ${lines} lines >= 3000 split-review risk`);
+        if (baselineLines === null && lines > 400)
+            failures.push(`${relPath}: new source file ${lines} lines > 400`);
+        if (changedFiles.has(relPath) && lines > max && (baselineLines === null || lines - baselineLines > 80)) {
+            failures.push(`${relPath}: changed file grew to ${lines} lines > ${max} architecture gate`);
+        }
+        if (changedFiles.has(relPath) && !isRouteDomainAggregator(relPath) && importsUnrelatedRouteDomains(file))
+            failures.push(`${relPath}: changed file imports 5+ unrelated route domains`);
     }
 }
 function architectureLineLimit(relPath) {
@@ -79,8 +85,11 @@ function importSpecs(text) {
     const specs = [];
     const re = /^\s*import\s+(?:[^'"]*?\s+from\s+)?['"]([^'"]+)['"]/gm;
     let match;
-    while ((match = re.exec(text)))
-        specs.push(match[1]);
+    while ((match = re.exec(text))) {
+        const spec = match[1];
+        if (spec)
+            specs.push(spec);
+    }
     return specs;
 }
 function walk(dir, out) {
@@ -132,4 +141,28 @@ function isWaivedGenerated(relPath) {
             && waiver.reason === 'generated'
             && waiver.expires_version);
 }
+function changedFileSet() {
+    const out = new Set();
+    for (const line of gitLines(['diff', '--name-only', 'HEAD', '--']))
+        out.add(normalize(line));
+    for (const line of gitLines(['ls-files', '--others', '--exclude-standard']))
+        out.add(normalize(line));
+    return out;
+}
+function baseLineCount(relPath) {
+    const result = spawnSync('git', ['show', `HEAD:${relPath}`], { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    if (result.status !== 0)
+        return null;
+    const text = String(result.stdout || '');
+    return text ? text.split(/\r?\n/).length : 0;
+}
+function gitLines(args) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
+    if (result.status !== 0)
+        return [];
+    return String(result.stdout || '').split(/\r?\n/).map(normalize).filter(Boolean);
+}
+function normalize(file) {
+    return String(file || '').replace(/\\/g, '/');
+}
 //# sourceMappingURL=check-architecture.js.map

package/dist/scripts/check-command-module-budget.js

@@ -1,19 +1,30 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
+import { spawnSync } from 'node:child_process';
 const root = process.cwd();
 const dir = path.join(root, 'src', 'core', 'commands');
 const failures = [];
+const changedFiles = changedFileSet();
 for (const file of fs.readdirSync(dir).filter((name) => name.endsWith('-command.ts'))) {
     const absolute = path.join(dir, file);
+    const relPath = rel(absolute);
     const text = fs.readFileSync(absolute, 'utf8');
     const lines = text.split(/\r?\n/).length;
     const imports = [...text.matchAll(/^\s*import\s+/gm)].length;
-    if (lines > 1200)
-        failures.push(`${file}: line count ${lines} > 1200`);
-    if (imports > 35)
-        failures.push(`${file}: import count ${imports} > 35`);
+    const changed = changedFiles.has(relPath);
+    const baselineLines = baseLineCount(relPath);
+    if (lines > 1800)
+        failures.push(`${file}: line count ${lines} > 1800 hard ceiling`);
+    if (baselineLines === null && lines > 400)
+        failures.push(`${file}: new command module ${lines} lines > 400`);
+    if (changed && lines > 1200 && (baselineLines === null || lines - baselineLines > 50)) {
+        failures.push(`${file}: changed command module grew to ${lines} lines > 1200`);
+    }
+    if (imports > 60)
+        failures.push(`${file}: import count ${imports} > 60 hard ceiling`);
+    if (changed && imports > 35)
+        failures.push(`${file}: changed command module import count ${imports} > 35`);
 }
 if (failures.length) {
     console.error('Command module budget check failed:');
@@ -22,4 +33,31 @@ if (failures.length) {
     process.exit(1);
 }
 console.log('Command module budget check passed');
+function changedFileSet() {
+    const out = new Set();
+    for (const line of gitLines(['diff', '--name-only', 'HEAD', '--']))
+        out.add(normalize(line));
+    for (const line of gitLines(['ls-files', '--others', '--exclude-standard']))
+        out.add(normalize(line));
+    return out;
+}
+function baseLineCount(relPath) {
+    const result = spawnSync('git', ['show', `HEAD:${relPath}`], { cwd: root, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
+    if (result.status !== 0)
+        return null;
+    const text = String(result.stdout || '');
+    return text ? text.split(/\r?\n/).length : 0;
+}
+function gitLines(args) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
+    if (result.status !== 0)
+        return [];
+    return String(result.stdout || '').split(/\r?\n/).map(normalize).filter(Boolean);
+}
+function rel(file) {
+    return normalize(path.relative(root, file));
+}
+function normalize(file) {
+    return String(file || '').replace(/\\/g, '/');
+}
 //# sourceMappingURL=check-command-module-budget.js.map

package/dist/scripts/check-pipeline-budget.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 const root = process.cwd();
@@ -8,6 +7,19 @@ const facade = path.join(root, 'src', 'core', 'pipeline.ts');
 const facadeLines = lineCount(facade);
 if (facadeLines > 200)
     failures.push(`src/core/pipeline.ts: line count ${facadeLines} > 200`);
+const facadeText = fs.readFileSync(facade, 'utf8');
+for (const exportName of [
+    'buildPipelinePlan',
+    'writePipelinePlan',
+    'validatePipelinePlan',
+    'promptPipelineContext',
+    'prepareRoute',
+    'activeRouteContext',
+    'evaluateStop'
+]) {
+    if (!facadeText.includes(exportName))
+        failures.push(`src/core/pipeline.ts: missing exported pipeline API ${exportName}`);
+}
 const runtimeFacade = path.join(root, 'src', 'core', 'pipeline-runtime.ts');
 if (fs.existsSync(runtimeFacade)) {
     const runtimeLines = lineCount(runtimeFacade);
@@ -19,7 +31,10 @@ if (fs.existsSync(runtimeFacade)) {
     }
 }
 const moduleDir = path.join(root, 'src', 'core', 'pipeline');
-for (const file of fs.readdirSync(moduleDir).filter((name) => name.endsWith('.ts'))) {
+const moduleFiles = fs.readdirSync(moduleDir).filter((name) => name.endsWith('.ts'));
+if (moduleFiles.length < 8)
+    failures.push(`src/core/pipeline: split module count ${moduleFiles.length} < 8`);
+for (const file of moduleFiles) {
     const absolute = path.join(moduleDir, file);
     const lines = lineCount(absolute);
     if (lines > 1000)
@@ -28,34 +43,6 @@ for (const file of fs.readdirSync(moduleDir).filter((name) => name.endsWith('.ts
     if (imports.length > 35)
         failures.push(`src/core/pipeline/${file}: import count ${imports.length} > 35`);
 }
-const required = [
-    'plan-schema.ts',
-    'stage-policy.ts',
-    'agent-stage-policy.ts',
-    'route-prep.ts',
-    'route-prep-team.ts',
-    'route-prep-research.ts',
-    'route-prep-qa.ts',
-    'route-prep-ppt.ts',
-    'route-prep-image-ux.ts',
-    'route-prep-db.ts',
-    'route-prep-gx.ts',
-    'stop-gate.ts',
-    'stop-gate-context7.ts',
-    'stop-gate-subagents.ts',
-    'stop-gate-proof.ts',
-    'active-context.ts',
-    'prompt-context.ts',
-    'prompt-context-dfix.ts',
-    'prompt-context-answer.ts',
-    'prompt-context-computer-use.ts',
-    'pipeline-plan-writer.ts',
-    'validation.ts'
-];
-for (const file of required) {
-    if (!fs.existsSync(path.join(moduleDir, file)))
-        failures.push(`src/core/pipeline/${file}: missing`);
-}
 if (failures.length) {
     console.error('Pipeline budget check failed:');
     for (const failure of failures)

package/dist/scripts/check-publish-tag.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,21 +9,49 @@ const isPrerelease = version.includes('-');
 const publishLifecycle = process.env.npm_lifecycle_event === 'prepublishOnly';
 const npmTag = process.env.npm_config_tag || process.env.NPM_CONFIG_TAG || '';
 const publishConfigTag = pkg.publishConfig?.tag || '';
+const npmrcTag = readRootNpmrcTag();
 const configuredTag = publishLifecycle && (!npmTag || npmTag === 'latest')
-    ? (publishConfigTag || npmTag || 'latest')
-    : (npmTag || publishConfigTag || 'latest');
-const expectedTag = isPrerelease ? 'rc' : 'latest';
+    ? (npmrcTag || publishConfigTag || npmTag || 'latest')
+    : (npmTag || npmrcTag || publishConfigTag || 'latest');
+const isBackfill = !isPrerelease && /^backfill(?:[-_][a-z0-9.-]+)?$/i.test(configuredTag);
+const expectedTag = isPrerelease ? 'rc' : isBackfill ? configuredTag : 'latest';
+if (publishConfigTag && npmrcTag && publishConfigTag !== npmrcTag) {
+    console.error('package.json publishConfig.tag and root .npmrc tag disagree.');
+    console.error(`publishConfig.tag: ${publishConfigTag}`);
+    console.error(`.npmrc tag: ${npmrcTag}`);
+    process.exit(2);
+}
+if (publishConfigTag && /^backfill(?:[-_][a-z0-9.-]+)?$/i.test(publishConfigTag) && !npmrcTag && !npmTag) {
+    console.error('Backfill releases must set root .npmrc tag so `npm publish --ignore-scripts` does not use latest.');
+    console.error(`Expected .npmrc: tag=${publishConfigTag}`);
+    process.exit(2);
+}
 if (configuredTag !== expectedTag) {
     if (isPrerelease) {
         console.error(`Prerelease ${pkg.name}@${version} must be published with the rc dist-tag.`);
         console.error('Set package.json publishConfig.tag to rc or pass `--tag rc` to npm publish.');
     }
     else {
-        console.error(`Stable release ${pkg.name}@${version} must be published with the latest dist-tag.`);
-        console.error('Remove prerelease tag config and use plain `npm publish`.');
+        console.error(`Stable release ${pkg.name}@${version} must be published with the latest dist-tag unless it is an explicit backfill.`);
+        console.error('Use latest for forward releases, or a backfill-* publishConfig.tag for intentional unpublished lower-version backfills.');
     }
     console.error(`Current npm tag config: ${configuredTag || 'missing'}`);
     process.exit(2);
 }
 console.log(`Publish tag check passed: ${pkg.name}@${version} -> ${configuredTag}`);
+function readRootNpmrcTag() {
+    const npmrcPath = path.join(root, '.npmrc');
+    if (!fs.existsSync(npmrcPath))
+        return '';
+    const text = fs.readFileSync(npmrcPath, 'utf8');
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';'))
+            continue;
+        const match = trimmed.match(/^tag\s*=\s*(.+)$/);
+        if (match)
+            return String(match[1] || '').trim();
+    }
+    return '';
+}
 //# sourceMappingURL=check-publish-tag.js.map

package/dist/scripts/check-route-modularity.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 const root = process.cwd();
@@ -7,37 +6,23 @@ const failures = [];
 const routeCli = path.join(root, 'src', 'core', 'commands', 'route-cli.mjs');
 if (fs.existsSync(routeCli))
     failures.push('src/core/commands/route-cli.mjs must not exist in runtime source');
-for (const file of listFiles(path.join(root, 'src', 'commands'), '.mjs')) {
-    const text = fs.readFileSync(file, 'utf8');
-    if (text.includes('route-cli.mjs'))
-        failures.push(`${rel(file)} imports route-cli.mjs`);
+const legacyCommandsDir = path.join(root, 'src', 'commands');
+if (fs.existsSync(legacyCommandsDir)) {
+    for (const file of listFiles(legacyCommandsDir, '.mjs')) {
+        const text = fs.readFileSync(file, 'utf8');
+        if (text.includes('route-cli.mjs'))
+            failures.push(`${rel(file)} imports route-cli.mjs`);
+    }
 }
-const requiredModules = [
-    'team-command.mjs',
-    'qa-loop-command.mjs',
-    'research-command.mjs',
-    'autoresearch-command.mjs',
-    'ppt-command.mjs',
-    'image-ux-review-command.mjs',
-    'computer-use-command.mjs',
-    'db-command.mjs',
-    'wiki-command.mjs',
-    'gx-command.mjs',
-    'goal-command.mjs',
-    'pipeline-command.mjs',
-    'recallpulse-command.mjs',
-    'hproof-command.mjs',
-    'validate-artifacts-command.mjs'
-];
-for (const name of requiredModules) {
-    if (!commandModuleExists(name))
-        failures.push(`missing ${name}`);
+for (const relModule of registeredCommandModules()) {
+    if (!fs.existsSync(path.join(root, relModule)))
+        failures.push(`registered command module missing: ${relModule}`);
 }
 const disallowedImports = {
-    'qa-loop-command.mjs': ['research-command', 'ppt-command', 'team-command', 'gx-command'],
-    'research-command.mjs': ['qa-loop-command', 'ppt-command', 'team-command', 'gx-command'],
-    'db-command.mjs': ['image-ux-review-command', 'ppt-command', 'computer-use-command'],
-    'wiki-command.mjs': ['team-command', 'research-command', 'qa-loop-command', 'ppt-command']
+    'qa-loop-command.ts': ['research-command', 'ppt-command', 'team-command', 'gx-command'],
+    'research-command.ts': ['qa-loop-command', 'ppt-command', 'team-command', 'gx-command'],
+    'db-command.ts': ['image-ux-review-command', 'ppt-command', 'computer-use-command'],
+    'wiki-command.ts': ['team-command', 'research-command', 'qa-loop-command', 'ppt-command']
 };
 for (const [name, needles] of Object.entries(disallowedImports)) {
     const file = commandModulePath(name);
@@ -56,6 +41,16 @@ if (failures.length) {
     process.exit(1);
 }
 console.log('Route modularity check passed');
+function registeredCommandModules() {
+    const registry = fs.readFileSync(path.join(root, 'src', 'cli', 'command-registry.ts'), 'utf8');
+    const out = new Set();
+    for (const match of registry.matchAll(/['"]dist\/core\/commands\/([^'"]+)\.js['"]/g)) {
+        const stem = match[1];
+        if (stem)
+            out.add(`src/core/commands/${stem}.ts`);
+    }
+    return [...out].sort();
+}
 function listFiles(dir, ext) {
     const out = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -72,11 +67,8 @@ function rel(file) {
 }
 function commandModulePath(name) {
     const base = path.join(root, 'src', 'core', 'commands');
-    const mjs = path.join(base, name);
+    const mjs = path.join(base, name.replace(/\.ts$/, '.mjs'));
     const ts = path.join(base, name.replace(/\.mjs$/, '.ts'));
     return fs.existsSync(mjs) ? mjs : ts;
 }
-function commandModuleExists(name) {
-    return fs.existsSync(commandModulePath(name));
-}
 //# sourceMappingURL=check-route-modularity.js.map

package/dist/scripts/check-runtime-schemas.js

@@ -80,6 +80,28 @@ for (const file of [
         issues.push(`codex_schema_invalid_json:${file}:${err.message}`);
     }
 }
+const searchVisibilitySchemaDir = path.join(root, 'schemas', 'search-visibility');
+for (const file of [
+    'site-inventory.schema.json',
+    'finding-ledger.schema.json',
+    'gate.schema.json',
+    'mutation-plan.schema.json',
+    'verification-report.schema.json'
+]) {
+    const full = path.join(searchVisibilitySchemaDir, file);
+    if (!fs.existsSync(full)) {
+        issues.push(`search_visibility_schema_missing:${file}`);
+        continue;
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(full, 'utf8'));
+        if (parsed.type !== 'object' || !parsed.$id)
+            issues.push(`search_visibility_schema_shape:${file}`);
+    }
+    catch (err) {
+        issues.push(`search_visibility_schema_invalid_json:${file}:${err.message}`);
+    }
+}
 const result = { schema: 'sks.runtime-schema-check.v1', ok: issues.length === 0, validators_ok: validatorsOk, issues };
 console.log(JSON.stringify(result, null, 2));
 if (!result.ok)

package/dist/scripts/config-managed-merge-callsite-coverage-check.js

@@ -118,13 +118,13 @@ const ALLOWLIST = [
         file: 'src/core/mad-db/mad-db-runtime-profile.ts',
         pattern: /codex-mad-db\.config\.toml|writeTextAtomic/,
         reason: 'MAD-DB runtime profile writes only a mission-local temporary Codex profile and verifies read-only restoration on close',
-        expires: '4.3.0'
+        expires: '4.6.0'
     },
     {
         file: 'src/core/providers/glm/naruto/glm-naruto-trace.ts',
         pattern: /mission-result\.json|sanitizeArtifact/,
         reason: 'GLM Naruto trace writer persists sanitized mission-result proof artifacts, not raw env secret files',
-        expires: '4.3.0'
+        expires: '4.6.0'
     }
 ];
 const sources = listSourceFiles().map((file) => ({

package/dist/scripts/core-skill-immutable-sync-check.js

@@ -3,11 +3,12 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
 import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 const root = await makeTempRoot('sks-core-immutable-');
 const skillsRoot = path.join(root, '.agents', 'skills');
+const expectedSkillCount = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.length;
 const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
-assertGate(first.installed.length === 8, 'first immutable sync must install missing managed core skills', first);
+assertGate(first.installed.length === expectedSkillCount, 'first immutable sync must install missing managed core skills', first);
 const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
 assertGate(second.installed.length === 0 && second.restored.length === 0, 'second immutable sync must be idempotent', second);
 await writeText(path.join(skillsRoot, 'loop', 'SKILL.md'), `${renderCoreSkillTemplate('loop')}\ncorruption\n`);

package/dist/scripts/core-skill-integrity-blackbox.js

@@ -3,10 +3,11 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { assertGate, emitGate, makeTempRoot, writeText, writeUserSkill } from './sks-3-1-8-check-lib.js';
 import { syncCoreSkillsIntegrity } from '../core/codex-native/core-skill-integrity.js';
-import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 import { initProject } from '../core/init.js';
 const root = await makeTempRoot('sks-core-blackbox-');
 const skillsRoot = path.join(root, '.agents', 'skills');
+const expectedSkillCount = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z').skills.length;
 const first = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
 const second = await syncCoreSkillsIntegrity({ root, apply: true, skillsRoot });
 await writeText(path.join(skillsRoot, 'research', 'SKILL.md'), `${renderCoreSkillTemplate('research')}\nmutated\n`);
@@ -21,7 +22,7 @@ const setupIntegrity = await syncCoreSkillsIntegrity({ root: setupRoot, apply: f
 await writeText(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md'), `${renderCoreSkillTemplate('loop')}\nmutated by setup blackbox\n`);
 const setupRestore = await initProject(setupRoot, { force: true, installScope: 'project', localOnly: true, globalCommand: 'sks' });
 const restoredSetupText = await fs.readFile(path.join(setupRoot, '.agents', 'skills', 'loop', 'SKILL.md'), 'utf8');
-assertGate(first.installed.length === 8, 'blackbox A: first sync installs missing core skills', first);
+assertGate(first.installed.length === expectedSkillCount, 'blackbox A: first sync installs missing core skills', first);
 assertGate(second.installed.length === 0 && second.restored.length === 0, 'blackbox B: second sync changes nothing', second);
 assertGate(third.restored.length === 1 && restoredText === renderCoreSkillTemplate('research'), 'blackbox C: managed drift restored exactly', third);
 assertGate(user.skipped_user_authored.length === 1, 'blackbox D: user skill is not overwritten', user);

package/dist/scripts/core-skill-manifest-check.js

@@ -1,10 +1,15 @@
 #!/usr/bin/env node
 import { assertGate, emitGate } from './sks-3-1-8-check-lib.js';
-import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
+import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, coreSkillDefinitions, renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 import { sha256 } from '../core/fsx.js';
 const manifest = buildSksCoreSkillManifest('1970-01-01T00:00:00.000Z');
+const definitions = coreSkillDefinitions();
 assertGate(manifest.schema === 'sks.core-skill-manifest.v1', 'manifest schema mismatch', manifest);
-assertGate(manifest.skills.length === 8, 'manifest must list eight immutable core skills', manifest.skills.map((skill) => skill.canonical_name));
+assertGate(manifest.skills.length === definitions.length, 'manifest must list every immutable core skill definition', {
+    manifest: manifest.skills.map((skill) => skill.canonical_name),
+    definitions: definitions.map((skill) => skill.canonical_name)
+});
+assertGate(new Set(manifest.skills.map((skill) => skill.canonical_name)).size === manifest.skills.length, 'manifest core skill names must be unique', manifest.skills.map((skill) => skill.canonical_name));
 assertGate(CORE_SKILL_TEMPLATE_VERSION === 'sks-core-skill-template.v1', 'core skill template version must be content-schema based, not package-version based', { CORE_SKILL_TEMPLATE_VERSION });
 for (const skill of manifest.skills) {
     const content = renderCoreSkillTemplate(skill.canonical_name);

package/dist/scripts/geo-claim-evidence-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('geo-claims', {
+    title: 'Fixture That Guarantees AI Citation',
+    description: 'Fixture that guarantees AI citation and traffic lift.',
+});
+fs.appendFileSync(path.join(fixture, 'README.md'), '\nThis fixture guarantees AI citation and traffic lift.\n');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json'], { allowFailure: true }).json;
+const claims = assertMissionArtifact(audit.mission_id, 'claim-evidence-ledger.json', fixture);
+const findings = assertMissionArtifact(audit.mission_id, 'geo-findings.json', fixture);
+assertGate(claims.claims.some((claim) => claim.safe_to_publish === false && /citation|traffic/i.test(claim.claim)), 'unsupported GEO claim must be unsafe to publish', claims);
+assertGate(findings.findings.some((finding) => finding.category === 'claim-evidence' && finding.severity === 'critical'), 'unsafe claim must become critical claim-evidence finding', findings);
+assertGate(audit.ok === false || findings.findings.some((finding) => finding.blocking), 'critical unsafe claims must block the gate', { audit, findings });
+emitGate('geo:claim-evidence', { mission_id: audit.mission_id, claims: claims.claims.length });
+//# sourceMappingURL=geo-claim-evidence-check.js.map

package/dist/scripts/geo-cli-blackbox-check.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runSks, runSksJson } from './search-visibility-gate-lib.js';
+const commands = runSksJson(['commands', '--json']).json;
+assertGate(commands.commands.some((row) => row.name === 'seo-geo-optimizer' && /unified SEO\/GEO optimizer/i.test(row.description)), 'commands --json must expose seo-geo-optimizer');
+assertGate(!commands.commands.some((row) => row.name === 'seo' || row.name === 'geo'), 'commands --json must not expose split seo/geo command surfaces');
+const optimizerUsage = runSks(['usage', 'seo-geo-optimizer']);
+assertGate(/sks seo-geo-optimizer \[seo\|geo\] doctor\|audit\|plan\|apply\|verify\|status\|rollback\|fixture/.test(optimizerUsage.stdout), 'usage seo-geo-optimizer must expose unified lifecycle');
+const doctor = runSksJson(['seo-geo-optimizer', 'doctor', '--mode', 'geo', '--json']).json;
+assertGate(doctor.route === '$SEO-GEO-OPTIMIZER' && doctor.schema === 'sks.search-visibility.doctor-command.v1', 'optimizer geo doctor must preserve unified route identity', doctor);
+const invalid = runSks(['seo-geo-optimizer', 'nonsense-subcommand', '--mode', 'geo'], { allowFailure: true });
+assertGate(invalid.status === 2 && /Usage: sks seo-geo-optimizer/.test(invalid.stderr), 'invalid optimizer subcommand must exit 2 with usage', {
+    status: invalid.status,
+    stdout: invalid.stdout,
+    stderr: invalid.stderr,
+});
+emitGate('geo:cli-blackbox', { adapter: doctor.adapter, confidence: doctor.confidence });
+//# sourceMappingURL=geo-cli-blackbox-check.js.map

package/dist/scripts/geo-crawler-policy-check.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('geo-crawlers');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json']).json;
+const policy = assertMissionArtifact(audit.mission_id, 'ai-crawler-policy.json', fixture);
+const purposes = new Set(policy.entries.map((entry) => entry.purpose));
+const agents = new Set(policy.entries.map((entry) => entry.userAgent));
+assertGate(policy.policy.single_allow_ai_toggle === false && policy.policy.purpose_split_required === true, 'AI crawler policy must split purposes instead of one allow_ai toggle', policy);
+for (const purpose of ['search', 'training', 'user_retrieval'])
+    assertGate(purposes.has(purpose), `crawler purpose missing: ${purpose}`, policy);
+for (const agent of ['OAI-SearchBot', 'GPTBot', 'ChatGPT-User', 'Claude-SearchBot', 'ClaudeBot', 'Claude-User'])
+    assertGate(agents.has(agent), `crawler user agent missing: ${agent}`, policy);
+assertGate(policy.entries.every((entry) => entry.officialSource && entry.observedAt && entry.expiresAt), 'crawler registry entries must carry dated official sources', policy);
+emitGate('geo:crawler-purpose-policy', { mission_id: audit.mission_id, entries: policy.entries.length });
+//# sourceMappingURL=geo-crawler-policy-check.js.map

package/dist/scripts/geo-llms-txt-optional-check.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, assertMissionArtifact, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('geo-llms');
+const audit = runSksJson(['seo-geo-optimizer', 'audit', '--mode', 'geo', '--root', fixture, '--target', 'package', '--offline', '--json']).json;
+const plan = runSksJson(['seo-geo-optimizer', 'plan', audit.mission_id, '--mode', 'geo', '--root', fixture, '--json']).json;
+const llmsPlan = assertMissionArtifact(audit.mission_id, 'llms-txt-plan.json', fixture);
+assertGate(audit.ok === true, 'missing llms.txt must not block GEO gate', audit);
+assertGate(plan.operations === 0, 'GEO plan must not create llms.txt unless --include-llms-txt is explicit', plan);
+assertGate(llmsPlan.required_for_gate === false && llmsPlan.experimental_assistive_surface === true, 'llms.txt must be optional and experimental', llmsPlan);
+assertGate(!fs.existsSync(path.join(fixture, 'llms.txt')), 'llms.txt must not be created by default');
+const explicitPlan = runSksJson(['seo-geo-optimizer', 'plan', audit.mission_id, '--mode', 'geo', '--root', fixture, '--include-llms-txt', '--json']).json;
+assertGate(explicitPlan.operations === 1, 'explicit --include-llms-txt should plan managed llms.txt creation', explicitPlan);
+const apply = runSksJson(['seo-geo-optimizer', 'apply', audit.mission_id, '--mode', 'geo', '--root', fixture, '--include-llms-txt', '--apply', '--json']).json;
+assertGate(apply.ok === true && fs.existsSync(path.join(fixture, 'llms.txt')), 'explicit llms.txt apply must create managed file', apply);
+emitGate('geo:llms-txt-optional', { mission_id: audit.mission_id });
+//# sourceMappingURL=geo-llms-txt-optional-check.js.map

package/dist/scripts/gpt-final-arbiter-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -15,13 +14,17 @@ try {
     assertGate(approved.ok === true, 'GPT final arbiter fixture must approve safe candidate', approved);
     assertGate(approved.backend === 'codex-sdk', 'GPT final arbiter backend must be codex-sdk');
     assertGate(approved.result.status === 'approved', 'safe candidate must return approved');
+    assertGate(approved.result.lean_review?.status === 'pass', 'safe candidate must pass lean review');
+    assertGate(approved.result.lean_review?.selected_rung === 'minimal-custom', 'lean review must record selected rung');
     assertGate(approved.final_gate.ok === true, 'approved arbiter result must pass final gate');
     const artifact = await readJsonFile(path.join(tmp, 'gpt-final-arbiter.json'));
     assertGate(artifact.result.schema === 'sks.gpt-final-arbiter-result.v1', 'arbiter artifact must contain schema-valid result');
+    assertGate(artifact.result.lean_review?.verification_minimum_present === true, 'arbiter artifact must record lean verification minimum');
     const unsafeTmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-gpt-final-arbiter-unsafe-'));
     const rejected = await mod.runGptFinalArbiter({ ...fixtureInput('unsafe'), candidate_diff: 'unsafe delete all credential patch' }, { cwd: root, mutationLedgerRoot: unsafeTmp });
     assertGate(rejected.ok === false, 'unsafe candidate must not pass final arbiter');
     assertGate(rejected.result.status === 'rejected', 'unsafe candidate must be rejected');
+    assertGate(rejected.result.lean_review?.status === 'rejected', 'unsafe candidate must reject lean review');
     assertGate(rejected.blockers.includes('unsafe_candidate_patch'), 'unsafe rejection blocker must be preserved');
     emitGate('local-collab:gpt-final-arbiter', { approved: approved.result.status, rejected: rejected.result.status });
 }

package/dist/scripts/release-parallel-check.js

@@ -38,6 +38,21 @@ const tasks = [
     task('source-intelligence:policy', 'npm run source-intelligence:policy --silent', { dependencies: ['build'] }),
     task('source-intelligence:all-modes', 'npm run source-intelligence:all-modes --silent', { dependencies: ['build', 'source-intelligence:policy', 'ultra-search:provider-interface', 'codex-web:adapter'] }),
     task('codex-web:adapter', 'npm run codex-web:adapter --silent', { dependencies: ['build'] }),
+    task('seo:cli-blackbox', 'npm run seo:cli-blackbox --silent', { dependencies: ['build'] }),
+    task('seo:audit-fixture', 'npm run seo:audit-fixture --silent', { dependencies: ['build'] }),
+    task('seo:no-mutation-by-default', 'npm run seo:no-mutation-by-default --silent', { dependencies: ['build'] }),
+    task('seo:mutation-rollback', 'npm run seo:mutation-rollback --silent', { dependencies: ['build'] }),
+    task('seo:canonical-sitemap-locale', 'npm run seo:canonical-sitemap-locale --silent', { dependencies: ['build'] }),
+    task('seo:structured-data-visible-content', 'npm run seo:structured-data-visible-content --silent', { dependencies: ['build'] }),
+    task('geo:cli-blackbox', 'npm run geo:cli-blackbox --silent', { dependencies: ['build'] }),
+    task('geo:claim-evidence', 'npm run geo:claim-evidence --silent', { dependencies: ['build'] }),
+    task('geo:crawler-purpose-policy', 'npm run geo:crawler-purpose-policy --silent', { dependencies: ['build'] }),
+    task('geo:llms-txt-optional', 'npm run geo:llms-txt-optional --silent', { dependencies: ['build'] }),
+    task('seo-geo:route-identity', 'npm run seo-geo:route-identity --silent', { dependencies: ['build'] }),
+    task('seo-geo:geo-disambiguation', 'npm run seo-geo:geo-disambiguation --silent', { dependencies: ['build'] }),
+    task('seo-geo:skill-rich-content', 'npm run seo-geo:skill-rich-content --silent', { dependencies: ['build'] }),
+    task('seo-geo:no-unsupported-ranking-claims', 'npm run seo-geo:no-unsupported-ranking-claims --silent', { dependencies: ['build'] }),
+    task('seo-geo:feature-fixture-quality', 'npm run seo-geo:feature-fixture-quality --silent', { dependencies: ['build'] }),
     task('doctor:codex-doctor-parity', 'npm run doctor:codex-doctor-parity --silent', { dependencies: ['build'] }),
     task('codex:permission-profiles', 'npm run codex:permission-profiles --silent', { dependencies: ['build'] }),
     task('codex:legacy-profile-consumers-removed', 'npm run codex:legacy-profile-consumers-removed --silent', { dependencies: ['build'] }),