sneakoscope 4.8.5 → 4.8.6

package/README.md

@@ -24,7 +24,7 @@
 | 🍥 **`$Naruto` swarm** | Up to 100 parallel clone workers behind a hardware-safe concurrency governor, lease-based parallel writes, and a scheduler that backfills idle slots while runnable work remains |
 | 🖥️ **Live Zellij cockpit** | Workers stack vertically as native Zellij stacked panes; each pane streams heartbeat, current file, tool events, and stdout tails every second |
 | 🧾 **Completion Proof** | Every serious route ends with schema-backed proof artifacts — no "trust me, it's done" |
-| 🛡️ **Safety gates** | DB/migration/destructive operations stay gated, 190+ release gate scripts, Honest Mode |
+| 🛡️ **Safety gates** | DB/migration/destructive operations stay gated, ≤200 release-preset gates, Honest Mode |
 | 🖼️ **Visual evidence** | Image Voxel TriWiki plus `$imagegen`/`gpt-image-2`-bound visual review flows |
 
 ## LLM Init Prompt for Codex Native Agent Builders
@@ -49,7 +49,7 @@ sks seo-geo-optimizer apply latest --mode seo --apply --json
 sks seo-geo-optimizer audit --mode geo --target package --offline --json
 ```
 
-> 📋 **Current release: `v4.8.5`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
+> 📋 **Current release: `v4.8.6`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
 
 ## 🍥 Parallelism, UX, And Integrations
 
@@ -763,7 +763,7 @@ npm run release:check
 npm run publish:dry
 ```
 
-`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. `npm run publish:npm` and `npm run release:publish` run `npm run publish:prep-ignore-scripts` first, then `npm publish --ignore-scripts`, so the real publish path stays strict even when lifecycle scripts are skipped. Operators who intentionally run `npm publish --ignore-scripts` directly must run `npm run publish:prep-ignore-scripts` immediately before it. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
+`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The release preset is capped at 200 user-concern gates, with terminal harness gates split into `infra-harness-gates.json` and runnable through `sks gates run harness`. Gate commands execute directly from `release-gates.v2.json`; `package.json` keeps a small user-facing script surface. Broader live gates remain explicit commands; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set.
 
 Version bumps are manual. Run `sks versioning bump` only when preparing release metadata; SKS will not create `.git/hooks/pre-commit` or auto-bump during ordinary commits.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.8.5"
+version = "4.8.6"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.8.5"
+version = "4.8.6"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.8.5"),
+        Some("--version") => println!("sks-rs 4.8.6"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.8.5';
+const FAST_PACKAGE_VERSION = '4.8.6';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -78,6 +78,7 @@ export const COMMANDS = {
     version: entry('stable', 'Show SKS version', 'dist/commands/version.js', directCommand(() => import('../commands/version.js'), 'dist/commands/version.js')),
     commands: entry('stable', 'List SKS commands', 'dist/core/commands/basic-cli.js', basicArgs('commandsCommand')),
     check: entry('stable', 'Run five-minute proof-bank affected checks', 'dist/core/commands/check-command.js', argsCommand(() => import('../core/commands/check-command.js'), 'checkCommand', 'dist/core/commands/check-command.js')),
+    gates: entry('stable', 'Run release gate DAG by gate id or preset', 'dist/core/commands/gates-command.js', argsCommand(() => import('../core/commands/gates-command.js'), 'gatesCommand', 'dist/core/commands/gates-command.js')),
     task: entry('stable', 'Run an SLA-bounded SKS task check', 'dist/core/commands/task-command.js', argsCommand(() => import('../core/commands/task-command.js'), 'taskCommand', 'dist/core/commands/task-command.js')),
     release: entry('stable', 'Run affected/full/background release gates', 'dist/core/commands/release-command.js', argsCommand(() => import('../core/commands/release-command.js'), 'releaseCommand', 'dist/core/commands/release-command.js')),
     triwiki: entry('stable', 'Inspect TriWiki index, affected graph, and proof bank', 'dist/core/commands/triwiki-command.js', argsCommand(() => import('../core/commands/triwiki-command.js'), 'triwikiCommand', 'dist/core/commands/triwiki-command.js')),

package/dist/core/agents/agent-central-ledger.js

@@ -2,7 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { AGENT_LEDGER_EVENT_SCHEMA, AGENT_PROOF_EVIDENCE_SCHEMA } from './agent-schema.js';
-import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { appendJsonlBounded, ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { redactSecrets } from '../secret-redaction.js';
 const LEDGER_LOCKS = new Map();
 export const AGENT_ORCHESTRATOR_ONLY_FILES = Object.freeze([
@@ -111,7 +111,7 @@ export async function appendAgentLedgerEvent(root, event) {
         };
         const current_hash = hashEntry(entryWithoutHash);
         const entry = { ...entryWithoutHash, current_hash };
-        await fs.appendFile(file, JSON.stringify(entry) + '\n', 'utf8');
+        await appendJsonlBounded(file, entry, 5 * 1024 * 1024);
         return entry;
     });
 }
@@ -123,15 +123,20 @@ export async function validateAgentLedgerHashChain(root) {
     let expectedSequence = 1;
     for (const line of lines) {
         const entry = JSON.parse(line);
+        if (entry?.type === 'log.rotated') {
+            expectedSequence = 0;
+            previousHash = null;
+            continue;
+        }
         const { current_hash, ...withoutHash } = entry;
-        if (entry.sequence !== expectedSequence)
+        if (expectedSequence > 0 && entry.sequence !== expectedSequence)
             blockers.push('sequence_mismatch:' + entry.sequence + ':' + expectedSequence);
-        if ((entry.previous_hash || null) !== previousHash)
+        if (previousHash !== null && (entry.previous_hash || null) !== previousHash)
             blockers.push('previous_hash_mismatch:' + entry.sequence);
         if (hashEntry(withoutHash) !== current_hash)
             blockers.push('current_hash_mismatch:' + entry.sequence);
         previousHash = current_hash;
-        expectedSequence += 1;
+        expectedSequence = Number(entry.sequence || expectedSequence) + 1;
     }
     return { ok: blockers.length === 0, entries: lines.length, blockers };
 }

package/dist/core/agents/agent-orchestrator.js

@@ -66,6 +66,7 @@ import { applyGitWorktreeMergeQueue } from '../git/git-worktree-merge-queue.js';
 import { crossRebaseIdleWorktrees } from '../git/git-worktree-cross-rebase.js';
 import { gitOutputLine, runGitCommand } from '../git/git-worktree-runner.js';
 import { writeParallelRuntimeProof } from './parallel-runtime-proof.js';
+import { enforceRetention } from '../retention.js';
 export async function runNativeAgentOrchestrator(opts = {}) {
     const root = path.resolve(opts.root || process.cwd());
     const prompt = String(opts.prompt || 'Native agent run');
@@ -345,6 +346,15 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         zellijVisiblePaneCap: Number(opts.zellijVisiblePaneCap || visualLaneCount || targetActiveSlots),
         projectRoot: root
     });
+    const schedulerHardTimeoutMs = normalizeMissionHardTimeoutMs(opts, route);
+    let lastTimeoutReapMs = 0;
+    async function reapTimedOutAgentSessions(force = false) {
+        const now = Date.now();
+        if (!force && now - lastTimeoutReapMs < 30000)
+            return null;
+        lastTimeoutReapMs = now;
+        return killTimedOutAgentSessions(ledgerRoot, now, { hardTimeoutMs: schedulerHardTimeoutMs });
+    }
     await nativeCliSwarm.initialize();
     await setCurrent(root, { mission_id: missionId, mode: 'AGENT', phase: 'AGENT_NATIVE_KERNEL_RUNNING', route_command: routeCommand, native_agent_backend: backend });
     const scheduler = await runAgentScheduler({
@@ -361,6 +371,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         sourceIntelligenceRefs: sourceIntelligenceRef,
         goalModeRef,
         launchSession: async ({ agent, workItem }) => {
+            await reapTimedOutAgentSessions();
             const slice = workItem.slice || { id: workItem.id, description: workItem.description || prompt };
             const workerWorktree = await prepareWorkerGitWorktree({
                 root,
@@ -401,6 +412,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
             const result = opts.nativeCliSwarm === false
                 ? await runAgentByBackend(backend, runtimeAgent, runtimeSlice, backendOpts)
                 : await nativeCliSwarm.launchWorker({ agent: runtimeAgent, slice: runtimeSlice, opts: backendOpts });
+            await reapTimedOutAgentSessions();
             if (route === '$Naruto')
                 attachNarutoRuntimeProof(result, runtimeAgent, runtimeSlice);
             if (workerWorktree)
@@ -452,6 +464,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
             return result;
         },
         onSchedulerEvent: async ({ event, slots, state }) => {
+            await reapTimedOutAgentSessions();
             const paneBySlot = await readZellijPaneIdsBySlot(ledgerRoot);
             const enrichedSlots = slots.map((slot) => ({ ...slot, pane_id: paneBySlot.get(slot.slot_id) || null, launch_status: paneBySlot.has(slot.slot_id) ? 'launched' : slot.status }));
             await writeZellijRightLaneCockpit(ledgerRoot, { missionId, sessionName: `sks-${missionId}`, slots: enrichedSlots });
@@ -472,6 +485,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
             }
         }
     });
+    await reapTimedOutAgentSessions(true);
     await nativeCliSwarm.finalize();
     const parallelRuntimeProof = await writeParallelRuntimeProof(ledgerRoot, missionId, {
         requestedWorkers: Number(opts.agents || roster.agent_count || targetActiveSlots),
@@ -544,7 +558,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
     const stale = await detectStaleAgentSessions(ledgerRoot);
     if (!stale.ok)
         await appendAgentLedgerEvent(ledgerRoot, { agent_id: 'orchestrator', session_id: 'orchestrator', event_type: 'stale_sessions_detected', payload: stale });
-    const timeoutKill = await killTimedOutAgentSessions(ledgerRoot);
+    const timeoutKill = await killTimedOutAgentSessions(ledgerRoot, Date.now(), { hardTimeoutMs: schedulerHardTimeoutMs });
     const recursion = await writeAgentRecursionGuardReport(ledgerRoot, results);
     const consensus = await writeAgentConsensus(ledgerRoot, results);
     const outputValidation = await writeAgentOutputValidationReport(ledgerRoot, results);
@@ -612,6 +626,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         finalGptPatchStage
     });
     await writeAgentCodexCockpitArtifacts(dir, { missionId, projectHash: namespace.root_hash });
+    await enforceRetention(root, { afterRoute: true, completedMissionId: missionId, rotateLargeJsonl: true, lightweight: true }).catch(() => null);
     await setCurrent(root, { mission_id: missionId, mode: 'AGENT', phase: proof.ok ? 'AGENT_NATIVE_KERNEL_DONE' : 'AGENT_NATIVE_KERNEL_BLOCKED', native_agent_backend: backend, updated_at: nowIso() });
     return {
         schema: 'sks.agent-run.v1',
@@ -659,6 +674,12 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         proof
     };
 }
+function normalizeMissionHardTimeoutMs(opts = {}, route = '') {
+    const raw = Number(opts.hardTimeoutMs || opts.agentHardTimeoutMs || process.env.SKS_AGENT_HARD_TIMEOUT_MS || 0);
+    if (Number.isFinite(raw) && raw > 0)
+        return Math.max(1000, Math.min(Math.floor(raw), 24 * 60 * 60 * 1000));
+    return String(route || '').replace(/^\$/, '').toUpperCase() === 'NARUTO' ? 10 * 60 * 1000 : 30 * 60 * 1000;
+}
 function withFinalGptPatchEnvelopes(results, patchEnvelopes = []) {
     const byAgent = new Map();
     for (const envelope of patchEnvelopes) {

package/dist/core/agents/agent-runner-codex-exec.js

@@ -7,6 +7,7 @@ import { buildCodexExecArgs } from '../codex/codex-cli-syntax-builder.js';
 export function buildCodexExecAgentArgs(agent, prompt, opts = {}) {
     const resultFile = opts.resultFile || defaultCodexResultFile(agent, opts);
     const sandbox = opts.workspaceWrite ? 'workspace-write' : 'read-only';
+    const noMcp = workerNoMcpDefault(agent, opts, sandbox);
     const args = buildCodexExecArgs({
         json: true,
         outputSchema: opts.schemaFile || path.join(packageRoot(), 'schemas/codex/agent-result.schema.json'),
@@ -15,6 +16,7 @@ export function buildCodexExecAgentArgs(agent, prompt, opts = {}) {
         skipGitRepoCheck: opts.skipGitRepoCheck !== false,
         profile: opts.profile ? String(opts.profile) : null,
         ignoreUserConfig: !opts.profile,
+        noMcp,
         ignoreRules: true,
         sandbox,
         serviceTier: opts.serviceTier || (opts.fastMode === false ? 'standard' : 'fast'),
@@ -49,6 +51,7 @@ export async function runCodexExecAgent(agent, slice, opts = {}) {
             fast_mode: fastPolicy.fast_mode,
             service_tier_passed_to_codex: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
             service_tier_cli_override_present: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
+            no_mcp: command.args.includes('--no-mcp'),
             output_schema_used: command.args.includes('--output-schema'),
             output_last_message_path: command.resultFile,
             agent_worker_env_injected: false,
@@ -78,6 +81,7 @@ export async function runCodexExecAgent(agent, slice, opts = {}) {
         fast_mode: fastPolicy.fast_mode,
         service_tier_passed_to_codex: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
         service_tier_cli_override_present: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
+        no_mcp: command.args.includes('--no-mcp'),
         output_schema_used: command.args.includes('--output-schema'),
         output_last_message_path: command.resultFile,
         agent_worker_env_injected: Object.keys(workerEnv).length > 0,
@@ -119,6 +123,26 @@ export async function runCodexExecAgent(agent, slice, opts = {}) {
     }
     return validateAgentWorkerResult({ mission_id: opts.missionId || opts.mission_id || '', agent_id: agent.id, session_id: agent.session_id, persona_id: agent.persona_id || agent.id, task_slice_id: slice?.id || '', status: result.code === 0 ? 'done' : 'failed', backend: 'codex-exec', summary: result.stdout.slice(-1000) || result.stderr.slice(-1000), artifacts: [command.resultFile, report], blockers: result.code === 0 ? ['codex_exec_output_last_message_missing_or_invalid'] : ['codex_exec_exit_' + result.code], confidence: 'verified_partial', unverified: result.code === 0 ? ['codex-exec stdout fallback; resultFile JSON missing or invalid'] : [], writes: [], source_intelligence_refs: agent.source_intelligence_refs || null, goal_mode_ref: agent.goal_mode_ref || null, verification: { status: result.code === 0 ? 'partial' : 'failed', checks: ['codex-exec-exit-code', 'codex-exec-process-report', 'codex-exec-output-last-message'] } });
 }
+function workerNoMcpDefault(agent, opts = {}, sandbox = 'read-only') {
+    if (opts.noMcp !== undefined)
+        return opts.noMcp !== false;
+    if (sandbox === 'read-only')
+        return true;
+    const roleText = [
+        agent?.role,
+        agent?.persona_id,
+        agent?.required_role,
+        agent?.kind,
+        opts.role,
+        opts.kind
+    ].map((value) => String(value || '')).join(' ');
+    if (/\b(?:verify|verifier|verification|review|reviewer|qa|audit|read[-_ ]?only)\b/i.test(roleText))
+        return true;
+    const safeList = Array.isArray(opts.workerSafeMcpServers)
+        ? opts.workerSafeMcpServers
+        : String(process.env.SKS_WORKER_SAFE_MCP_SERVERS || '').split(',').map((item) => item.trim()).filter(Boolean);
+    return !(opts.allowWorkerMcp === true && safeList.length > 0);
+}
 async function writeCodexProcessReport(root, agent, report) {
     const rel = path.join(agent.session_artifact_dir || path.join('sessions', agent.id), 'agent-process-report.json');
     await writeJsonAtomic(path.join(root, rel), { schema: 'sks.agent-process-report.v1', backend: 'codex-exec', agent_id: agent.id, session_id: agent.session_id, service_tier: report.service_tier || agent.service_tier || 'fast', fast_mode: report.fast_mode !== false, ...report });

package/dist/core/agents/fast-mode-policy.js

@@ -122,13 +122,12 @@ export function applyFastModeToRoster(roster, policy) {
     };
 }
 export async function writeFastModePropagationProof(root, input = { policy: resolveFastModePolicy() }) {
-    const workerFastReports = await collectNamedJson(root, 'worker-fast-mode.json');
     const workerProcessReports = await collectNamedJson(root, 'worker-process-report.json');
     const agentProcessReports = await collectNamedJson(root, 'agent-process-report.json');
     const zellijReports = await collectNamedJson(root, 'agent-zellij-report.json');
     const madReports = await collectNamedJson(root, 'mad-sks-worker-report.json');
     const defaultFastExpected = input.policy.fast_mode === true;
-    const childReports = [...workerFastReports, ...workerProcessReports, ...agentProcessReports, ...zellijReports, ...madReports];
+    const childReports = [...workerProcessReports, ...agentProcessReports, ...zellijReports, ...madReports];
     const missingFast = defaultFastExpected
         ? childReports.filter((row) => row.json?.fast_mode !== true && row.json?.fast_mode !== 'true')
         : [];
@@ -137,7 +136,7 @@ export async function writeFastModePropagationProof(root, input = { policy: reso
         return value && value !== input.policy.service_tier;
     });
     const missingCliOverride = [];
-    const workerMissing = defaultFastExpected && workerFastReports.length === 0 && workerProcessReports.length === 0
+    const workerMissing = defaultFastExpected && workerProcessReports.length === 0
         ? ['fast_mode_worker_reports_missing']
         : [];
     const report = {
@@ -149,7 +148,7 @@ export async function writeFastModePropagationProof(root, input = { policy: reso
         default_fast_mode: input.policy.default_fast_mode,
         service_tier: input.policy.service_tier,
         fast_mode: input.policy.fast_mode,
-        worker_fast_report_count: workerFastReports.length,
+        worker_fast_report_count: 0,
         worker_process_report_count: workerProcessReports.length,
         codex_sdk_process_report_count: agentProcessReports.filter((row) => row.json?.backend === 'codex-sdk').length,
         process_report_count: agentProcessReports.filter((row) => row.json?.backend === 'process').length,

package/dist/core/agents/native-cli-session-proof.js

@@ -6,7 +6,7 @@ export async function writeNativeCliSessionProof(root, input = {}) {
     const swarm = await readJson(path.join(root, 'agent-native-cli-session-swarm.json'), null);
     const scheduler = await readJson(path.join(root, 'agent-scheduler-state.json'), null);
     const workerProcessReports = await collectNamedJson(root, 'worker-process-report.json');
-    const workerCloseReports = await collectNamedJson(root, 'worker-terminal-close-report.json');
+    const workerCloseReports = workerProcessReports.filter((row) => row.json?.session_proof || row.json?.exit_code !== undefined);
     const workerHeartbeats = await collectHeartbeatCounts(root);
     const requestedAgents = Number(input.requestedAgents || swarm?.requested_agents || scheduler?.target_active_slots || 0);
     const targetActiveSlots = Number(input.targetActiveSlots || swarm?.target_active_slots || scheduler?.target_active_slots || requestedAgents);

package/dist/core/agents/native-cli-worker.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { ensureDir, nowIso, readJson, writeJsonAtomic, appendJsonl } from '../fsx.js';
+import { appendJsonlBounded, ensureDir, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { scanAgentTextForRecursion } from './agent-recursion-guard.js';
 import { validateAgentWorkerResult } from './agent-worker-pipeline.js';
 import { resolveFastModePolicy } from './fast-mode-policy.js';
@@ -53,48 +53,49 @@ export async function runNativeCliWorker(input = {}) {
         worker_env: process.env.SKS_AGENT_WORKER === '1',
         violations: recursion.violations
     };
-    await writeJsonAtomic(path.join(workerDir, 'worker-intake.json'), {
-        schema: NATIVE_CLI_WORKER_SCHEMA,
-        generated_at: nowIso(),
-        parent_mission_id: String(intake.parent_mission_id || input.parentMissionId || intake.mission_id || ''),
-        slot_id: String(agent.slot_id || input.slotId || ''),
-        generation_index: Number(agent.generation_index || input.generationIndex || 1),
-        task_id: String(slice.id || input.taskId || ''),
-        persona_id: String(agent.persona_id || input.personaId || ''),
-        lease_id: String(intake.lease_id || input.leaseId || ''),
-        agent_root: agentRoot,
-        main_repo_root: String(input.mainRepoRoot || intake.main_repo_root || worktree?.main_repo_root || agentRoot),
-        cwd: workerCwd,
-        worktree,
-        worker_artifact_dir: workerDirRel,
-        result_path: resultRel,
-        heartbeat_path: heartbeatRel,
-        patch_envelope_path: patchRel,
-        backend,
-        codex_task: {
-            backend: backend === 'zellij' ? 'codex-sdk' : backend,
-            output_schema_id: 'sks.agent-worker-result.v1',
-            sandbox_policy: Array.isArray(slice.write_paths) && slice.write_paths.length > 0 ? 'workspace-write' : 'read-only',
-            thread_policy: 'new_thread_per_generation',
+    if (process.env.SKS_DEBUG_ARTIFACTS === '1')
+        await writeJsonAtomic(path.join(workerDir, 'worker-intake.json'), {
+            schema: NATIVE_CLI_WORKER_SCHEMA,
+            generated_at: nowIso(),
+            parent_mission_id: String(intake.parent_mission_id || input.parentMissionId || intake.mission_id || ''),
+            slot_id: String(agent.slot_id || input.slotId || ''),
+            generation_index: Number(agent.generation_index || input.generationIndex || 1),
+            task_id: String(slice.id || input.taskId || ''),
+            persona_id: String(agent.persona_id || input.personaId || ''),
+            lease_id: String(intake.lease_id || input.leaseId || ''),
+            agent_root: agentRoot,
+            main_repo_root: String(input.mainRepoRoot || intake.main_repo_root || worktree?.main_repo_root || agentRoot),
+            cwd: workerCwd,
             worktree,
-            cwd: workerCwd
-        },
-        service_tier: policy.service_tier,
-        fast_mode: policy.fast_mode,
-        source_intelligence_refs: agent.source_intelligence_refs || intake.source_intelligence_refs || null,
-        goal_mode_ref: agent.goal_mode_ref || intake.goal_mode_ref || null,
-        strategy_refs: slice.strategy_refs || intake.strategy_refs || null,
-        no_recursive_orchestrator_guard: guard.ok
-    });
+            worker_artifact_dir: workerDirRel,
+            result_path: resultRel,
+            heartbeat_path: heartbeatRel,
+            patch_envelope_path: patchRel,
+            backend,
+            codex_task: {
+                backend: backend === 'zellij' ? 'codex-sdk' : backend,
+                output_schema_id: 'sks.agent-worker-result.v1',
+                sandbox_policy: Array.isArray(slice.write_paths) && slice.write_paths.length > 0 ? 'workspace-write' : 'read-only',
+                thread_policy: 'new_thread_per_generation',
+                worktree,
+                cwd: workerCwd
+            },
+            service_tier: policy.service_tier,
+            fast_mode: policy.fast_mode,
+            source_intelligence_refs: agent.source_intelligence_refs || intake.source_intelligence_refs || null,
+            goal_mode_ref: agent.goal_mode_ref || intake.goal_mode_ref || null,
+            strategy_refs: slice.strategy_refs || intake.strategy_refs || null,
+            no_recursive_orchestrator_guard: guard.ok
+        });
     await workerTelemetry(agentRoot, intake, agent, slice, {
         eventType: 'task_started',
         status: 'running',
         backend,
         serviceTier: policy.service_tier,
-        artifacts: [path.join(workerDirRel, 'worker-intake.json'), heartbeatRel],
+        artifacts: [heartbeatRel],
         logTail: String(slice.description || slice.title || slice.id || 'worker task started')
     });
-    await appendJsonl(path.resolve(agentRoot, heartbeatRel), {
+    await appendJsonlBounded(path.resolve(agentRoot, heartbeatRel), {
         schema: 'sks.native-cli-worker-heartbeat.v1',
         ts: nowIso(),
         event: 'started',
@@ -104,7 +105,7 @@ export async function runNativeCliWorker(input = {}) {
         generation_index: agent.generation_index || null,
         fast_mode: policy.fast_mode,
         service_tier: policy.service_tier
-    });
+    }, 2 * 1024 * 1024);
     await workerTelemetry(agentRoot, intake, agent, slice, {
         eventType: 'heartbeat',
         status: 'running',
@@ -113,18 +114,6 @@ export async function runNativeCliWorker(input = {}) {
         artifacts: [heartbeatRel],
         logTail: 'worker heartbeat started'
     });
-    await writeJsonAtomic(path.join(workerDir, 'worker-fast-mode.json'), {
-        schema: 'sks.native-cli-worker-fast-mode.v1',
-        generated_at: nowIso(),
-        ok: true,
-        fast_mode: policy.fast_mode,
-        service_tier: policy.service_tier,
-        env: {
-            SKS_FAST_MODE: process.env.SKS_FAST_MODE || null,
-            SKS_SERVICE_TIER: process.env.SKS_SERVICE_TIER || null
-        }
-    });
-    await writeJsonAtomic(path.join(workerDir, 'worker-recursion-guard.json'), guard);
     let noPatchReason = null;
     const progressTelemetry = startWorkerProgressTelemetry({
         agentRoot,
@@ -184,13 +173,12 @@ export async function runNativeCliWorker(input = {}) {
             backend,
             blockers: Array.isArray(slice.write_paths) && slice.write_paths.length && backend !== 'fake' ? ['write_capable_no_patch_envelope'] : []
         };
-        await writeJsonAtomic(path.join(workerDir, 'worker-no-patch-reason.json'), noPatchReason);
         await workerTelemetry(agentRoot, intake, agent, slice, {
             eventType: 'artifact_written',
             status: 'running',
             backend,
             serviceTier: policy.service_tier,
-            artifacts: [path.join(workerDirRel, 'worker-no-patch-reason.json')],
+            artifacts: [resultRel],
             blockers: noPatchReason.blockers || [],
             logTail: noPatchReason.reason
         });
@@ -203,6 +191,9 @@ export async function runNativeCliWorker(input = {}) {
         generated_at: nowIso(),
         ok: guard.ok,
         backend,
+        fast_mode: policy.fast_mode,
+        service_tier: policy.service_tier,
+        codex_desktop_service_tier: policy.codex_desktop_service_tier,
         cwd: workerCwd,
         worktree,
         agent_id: agent.id,
@@ -213,8 +204,6 @@ export async function runNativeCliWorker(input = {}) {
         ppid: process.ppid,
         process_id: process.pid,
         command_line: redactCommandLine(process.argv),
-        fast_mode: policy.fast_mode,
-        service_tier: policy.service_tier,
         sdk_thread_id: routed.report?.sdk_thread_id || null,
         sdk_run_id: routed.report?.sdk_run_id || null,
         stream_event_count: Number(routed.report?.stream_event_count || 0),
@@ -224,21 +213,32 @@ export async function runNativeCliWorker(input = {}) {
         backend_child_execution: routed.report.child_process_ids.length > 0 || Boolean(routed.report?.sdk_thread_id) || backend === 'fake' || backend === 'ollama',
         recursion_guard_env: process.env.SKS_DISABLE_ROUTE_RECURSION === '1',
         worker_env: process.env.SKS_AGENT_WORKER === '1',
+        fast_mode_report: {
+            ok: true,
+            fast_mode: policy.fast_mode,
+            service_tier: policy.service_tier,
+            env: {
+                SKS_FAST_MODE: process.env.SKS_FAST_MODE || null,
+                SKS_SERVICE_TIER: process.env.SKS_SERVICE_TIER || null
+            }
+        },
+        recursion_guard: guard,
+        session_proof: {
+            ok: guard.ok,
+            session_id: agent.session_id,
+            slot_id: agent.slot_id || null,
+            generation_index: agent.generation_index || null,
+            artifact_dir: workerDirRel,
+            patch_envelope: patchEnvelopes.length ? patchRel : null
+        },
         exit_code: guard.ok ? 0 : 1
     };
     await writeJsonAtomic(path.join(workerDir, 'worker-process-report.json'), report);
     const artifacts = [
-        path.join(workerDirRel, 'worker-intake.json'),
-        heartbeatRel,
-        path.join(workerDirRel, 'worker-process-report.json'),
-        routed.reportRel,
-        ...routed.result.artifacts.filter((artifact) => artifact.includes('codex-worker-') || artifact.includes('agent-process-report') || artifact.includes('agent-zellij-report')),
         resultRel,
-        patchEnvelopes.length ? patchRel : path.join(workerDirRel, 'worker-no-patch-reason.json'),
-        path.join(workerDirRel, 'worker-terminal-close-report.json'),
-        path.join(workerDirRel, 'worker-fast-mode.json'),
-        path.join(workerDirRel, 'worker-recursion-guard.json'),
-        path.join(workerDirRel, 'worker-session-proof.json')
+        path.join(workerDirRel, 'worker-process-report.json'),
+        heartbeatRel,
+        ...(patchEnvelopes.length ? [patchRel] : [])
     ];
     const result = validateAgentWorkerResult({
         ...routed.result,
@@ -268,7 +268,7 @@ export async function runNativeCliWorker(input = {}) {
         zellij_child_report: routed.result.zellij_child_report,
         model_authored_patch_envelopes: patchEnvelopes.some((envelope) => envelope.source === 'model_authored'),
         fixture_patch_envelopes: patchEnvelopes.some((envelope) => envelope.source === 'fixture'),
-        ...(!patchEnvelopes.length ? { no_patch_reason: noPatchReason || await readJson(path.join(workerDir, 'worker-no-patch-reason.json'), null) } : {}),
+        ...(!patchEnvelopes.length ? { no_patch_reason: noPatchReason } : {}),
         source_intelligence_refs: agent.source_intelligence_refs || intake.source_intelligence_refs || null,
         goal_mode_ref: agent.goal_mode_ref || intake.goal_mode_ref || null,
         verification: { status: guard.ok && routed.result.status === 'done' ? 'passed' : 'failed', checks: [...(routed.result.verification?.checks || []), 'native-cli-worker-process', 'worker-artifact-contract', 'fast-mode-policy', 'native-worker-backend-router'] },
@@ -284,40 +284,14 @@ export async function runNativeCliWorker(input = {}) {
         blockers: result.blockers || [],
         logTail: result.summary || ''
     });
-    await writeJsonAtomic(path.join(workerDir, 'worker-session-proof.json'), {
-        schema: 'sks.native-cli-worker-session-proof.v1',
-        generated_at: nowIso(),
-        ok: result.status === 'done',
-        session_id: result.session_id,
-        slot_id: agent.slot_id || null,
-        generation_index: agent.generation_index || null,
-        process_id: process.pid,
-        main_repo_root: String(input.mainRepoRoot || intake.main_repo_root || worktree?.main_repo_root || agentRoot),
-        cwd: workerCwd,
-        worktree,
-        artifact_dir: workerDirRel,
-        patch_envelope: patchEnvelopes.length ? patchRel : null,
-        no_patch_reason: patchEnvelopes.length ? null : path.join(workerDirRel, 'worker-no-patch-reason.json'),
-        backend_router_report: routed.reportRel,
-        backend_child_process_ids: routed.report.child_process_ids,
-        sdk_thread_id: routed.report?.sdk_thread_id || null,
-        sdk_run_id: routed.report?.sdk_run_id || null,
-        stream_event_count: Number(routed.report?.stream_event_count || 0),
-        structured_output_valid: routed.report?.structured_output_valid === true,
-        model_authored_patch_envelopes: patchEnvelopes.some((envelope) => envelope.source === 'model_authored'),
-        fixture_patch_envelopes: patchEnvelopes.some((envelope) => envelope.source === 'fixture'),
-        fast_mode: policy.fast_mode,
-        service_tier: policy.service_tier,
-        blockers: result.blockers
-    });
-    await appendJsonl(path.resolve(agentRoot, heartbeatRel), {
+    await appendJsonlBounded(path.resolve(agentRoot, heartbeatRel), {
         schema: 'sks.native-cli-worker-heartbeat.v1',
         ts: nowIso(),
         event: 'finished',
         pid: process.pid,
         session_id: agent.session_id,
         status: result.status
-    });
+    }, 2 * 1024 * 1024);
     await workerTelemetry(agentRoot, intake, agent, slice, {
         eventType: 'heartbeat',
         status: result.status === 'done' ? 'completed' : 'failed',
@@ -327,32 +301,18 @@ export async function runNativeCliWorker(input = {}) {
         blockers: result.blockers || [],
         logTail: 'worker heartbeat finished'
     });
-    await writeJsonAtomic(path.join(workerDir, 'worker-terminal-close-report.json'), {
-        schema: 'sks.native-cli-worker-terminal-close-report.v1',
-        generated_at: nowIso(),
-        ok: result.status === 'done',
-        session_id: result.session_id,
-        slot_id: agent.slot_id || null,
-        generation_index: agent.generation_index || null,
-        process_id: process.pid,
-        exit_code: result.status === 'done' ? 0 : 1,
-        fast_mode: policy.fast_mode,
-        service_tier: policy.service_tier,
-        blockers: result.blockers
-    });
     return result;
 }
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function startWorkerProgressTelemetry(input) {
-    const parsed = Number(process.env.SKS_ZELLIJ_WORKER_PROGRESS_MS || 2000);
-    const intervalMs = Math.max(500, Number.isFinite(parsed) ? Math.floor(parsed) : 2000);
+    const parsed = Number(process.env.SKS_ZELLIJ_WORKER_PROGRESS_MS || 10000);
+    const intervalMs = Math.max(1000, Number.isFinite(parsed) ? Math.floor(parsed) : 10000);
     let tick = 0;
     const timer = setInterval(() => {
         tick += 1;
-        const progress = { done: tick, total: 0, label: 'backend running' };
-        appendJsonl(path.resolve(input.agentRoot, input.heartbeatRel), {
+        appendJsonlBounded(path.resolve(input.agentRoot, input.heartbeatRel), {
             schema: 'sks.native-cli-worker-heartbeat.v1',
             ts: nowIso(),
             event: 'progress',
@@ -360,15 +320,14 @@ function startWorkerProgressTelemetry(input) {
             session_id: input.agent.session_id,
             slot_id: input.agent.slot_id || null,
             generation_index: input.agent.generation_index || null,
-            progress
-        }).catch(() => undefined);
+            progress: null
+        }, 2 * 1024 * 1024).catch(() => undefined);
         workerTelemetry(input.agentRoot, input.intake, input.agent, input.slice, {
-            eventType: 'task_progress',
+            eventType: 'heartbeat',
             status: 'running',
             backend: input.backend,
             serviceTier: input.serviceTier,
             artifacts: [input.heartbeatRel],
-            progress,
             logTail: `backend running ${tick}`
         }).catch(() => undefined);
     }, intervalMs);
@@ -435,7 +394,8 @@ async function workerTelemetry(agentRoot, intake, agent, slice, input) {
         service_tier: input.serviceTier,
         worktree_id: agent.worktree?.id || slice.worktree?.id || intake.worktree?.id || null,
         worktree_path: agent.worktree?.path || slice.worktree?.path || intake.worktree?.path || null,
-        task_title: String(slice.description || slice.title || slice.id || 'worker task'),
+        task_id: String(slice.id || 'worker-task'),
+        ...(input.eventType === 'task_started' ? { task_title: String(slice.description || slice.title || slice.id || 'worker task') } : {}),
         current_file: firstString([slice.write_paths?.[0], slice.readonly_paths?.[0], slice.input_files?.[0]]) || null,
         ...(input.progress ? { progress: input.progress } : {}),
         artifact_paths: input.artifacts || [],