sneakoscope 4.8.6 → 5.1.2

package/dist/core/proof/auto-finalize.js

@@ -4,6 +4,7 @@ import { finalizeRouteWithProof } from './route-finalizer.js';
 import { routeRequiresAgentIntake } from '../agents/agent-plan.js';
 import { readAgentGateStatus } from '../agents/agent-gate.js';
 import { DEFAULT_AGENT_COUNT } from '../agents/agent-schema.js';
+import { evaluateGate } from '../stop-gate/gate-evaluator.js';
 const AGENT_ARTIFACTS = [
     'agents/agent-proof-evidence.json',
     'agents/agent-sessions.json',
@@ -18,10 +19,13 @@ export async function maybeFinalizeRoute(root, { missionId, route, gateFile = nu
         return { ok: false, skipped: true, reason: 'mission_id_or_route_missing' };
     }
     const missionDir = path.join(root, '.sneakoscope', 'missions', missionId);
-    const gateObject = gate || (gateFile && await exists(path.join(missionDir, gateFile))
+    const diskGateObject = gateFile && await exists(path.join(missionDir, gateFile))
         ? await readJson(path.join(missionDir, gateFile), null)
-        : null);
-    const passed = gateObject?.passed === true || gateObject?.ok === true || gateObject?.status === 'pass';
+        : null;
+    const gateObject = diskGateObject || gate || null;
+    const gateVerdict = gateFile ? await evaluateGate(root, missionId, gateFile) : null;
+    const callerGateMismatch = Boolean(gate && diskGateObject && stableJson(gate) !== stableJson(diskGateObject));
+    const passed = gateVerdict ? gateVerdict.pass && !callerGateMismatch : gateObject?.passed === true || gateObject?.ok === true || gateObject?.status === 'pass';
     const mission = await readJson(path.join(missionDir, 'mission.json'), {});
     const prompt = mission.prompt || '';
     const agentRequired = agents !== false && routeRequiresAgentIntake(route, { task: prompt, noAgents: agents === false });
@@ -30,8 +34,18 @@ export async function maybeFinalizeRoute(root, { missionId, route, gateFile = nu
     const agentGate = agentRequired ? await readAgentGateStatus(root, missionId) : null;
     const agentArtifacts = agentGate ? await existingAgentArtifacts(root, missionId) : [];
     const agentBlockers = agentRequired && agentGate?.ok !== true ? ['agent_gate_not_passed'] : [];
-    const effectiveAgentBlockers = mock ? [] : agentBlockers;
-    const finalStatus = statusHint || (blockers.length || effectiveAgentBlockers.length ? 'blocked' : (passed ? (mock ? 'verified_partial' : 'verified') : (mock ? 'verified_partial' : 'blocked')));
+    const gateBlockers = gateVerdict && !gateVerdict.pass
+        ? [`route_gate_${gateVerdict.verdict}`, ...gateVerdict.reasons.map((item) => `route_gate_${item}`)]
+        : [];
+    if (callerGateMismatch)
+        gateBlockers.push('route_gate_caller_disk_mismatch');
+    const computedStatus = computeAutoFinalizeStatus({
+        mock,
+        passed,
+        blockers: [...blockers, ...agentBlockers, ...gateBlockers]
+    });
+    const statusResolution = applyStatusHint(computedStatus, statusHint);
+    const finalStatus = statusResolution.status;
     const proof = await finalizeRouteWithProof(root, {
         missionId,
         route,
@@ -48,14 +62,18 @@ export async function maybeFinalizeRoute(root, { missionId, route, gateFile = nu
             ...(agentGate?.proof?.fake_backend_disclaimer ? [agentGate.proof.fake_backend_disclaimer] : []),
             ...(mock && agentBlockers.length ? [`Mock agent intake does not satisfy full production gate: ${agentBlockers.join(', ')}`] : []),
             ...(mock ? ['Route was finalized from an explicit mock/fixture command path.'] : []),
+            ...(gateVerdict?.verdict === 'mock_only' ? ['Route gate is mock fixture evidence and cannot satisfy a real completion gate.'] : []),
+            ...(statusResolution.rejected ? [`statusHint rejected: requested ${statusResolution.rejected.requested}, computed ${statusResolution.rejected.computed}.`] : []),
             ...(!passed && !mock ? ['Route gate did not pass' + (reason ? ': ' + reason : '') + '.'] : [])
         ],
         blockers: [
             ...blockers,
-            ...effectiveAgentBlockers,
-            ...(!passed && !mock ? ['route_gate_not_passed'] : [])
+            ...agentBlockers,
+            ...gateBlockers,
+            ...(!passed && !mock && !gateBlockers.length ? ['route_gate_not_passed'] : [])
         ],
         statusHint: finalStatus,
+        statusHintRejected: statusResolution.rejected,
         mock,
         fixClaim,
         requireRelation,
@@ -65,7 +83,7 @@ export async function maybeFinalizeRoute(root, { missionId, route, gateFile = nu
         failureAnalysis,
         lightweightEvidence
     });
-    return { ...proof, auto_finalized: true, gate_passed: passed, status_hint: finalStatus };
+    return { ...proof, auto_finalized: true, gate_passed: passed, gate_verdict: gateVerdict, status_hint: finalStatus, status_hint_rejected: statusResolution.rejected };
 }
 async function existingAgentArtifacts(root, missionId) {
     const dir = path.join(root, '.sneakoscope', 'missions', missionId);
@@ -94,8 +112,9 @@ async function ensureMockAgentEvidence(root, missionId, route, prompt) {
     if (!(await exists(path.join(dir, 'agent-proof-evidence.json')))) {
         await writeJsonAtomic(path.join(dir, 'agent-proof-evidence.json'), {
             schema: 'sks.agent-proof-evidence.v1',
-            ok: true,
-            status: 'passed',
+            ok: false,
+            status: 'mock_fixture',
+            execution_class: 'mock_fixture',
             mission_id: missionId,
             route,
             backend: 'fake',
@@ -109,8 +128,48 @@ async function ensureMockAgentEvidence(root, missionId, route, prompt) {
             consensus_ok: true,
             janitor_report: 'agents/agent-janitor-report.json',
             janitor_ok: true,
-            blockers: []
+            blockers: ['mock_fixture_cannot_satisfy_real_agent_gate']
         });
     }
 }
+const STATUS_RANK = {
+    blocked: 0,
+    failed: 0,
+    not_verified: 0,
+    mock_only: 1,
+    verified_partial: 2,
+    verified: 3
+};
+function computeAutoFinalizeStatus({ mock, passed, blockers }) {
+    if (mock)
+        return 'mock_only';
+    if (blockers.length > 0)
+        return 'blocked';
+    return passed ? 'verified' : 'blocked';
+}
+function applyStatusHint(computed, requested) {
+    if (!requested)
+        return { status: computed, rejected: null };
+    const requestedRank = STATUS_RANK[requested];
+    const computedRank = STATUS_RANK[computed];
+    if (requestedRank === undefined || computedRank === undefined) {
+        return { status: computed, rejected: { requested, computed, reason: 'unknown_status_hint' } };
+    }
+    if (computed === 'mock_only' && requested !== 'mock_only') {
+        return { status: computed, rejected: { requested, computed, reason: 'mock_fixture_status_cap' } };
+    }
+    if (requestedRank > computedRank) {
+        return { status: computed, rejected: { requested, computed, reason: 'status_hint_upgrade_rejected' } };
+    }
+    return { status: requested, rejected: null };
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
 //# sourceMappingURL=auto-finalize.js.map

package/dist/core/proof/proof-schema.js

@@ -3,6 +3,7 @@ export const COMPLETION_PROOF_SCHEMA = 'sks.completion-proof.v1';
 export const COMPLETION_PROOF_STATUSES = Object.freeze([
     'verified',
     'verified_partial',
+    'mock_only',
     'blocked',
     'not_verified',
     'failed'
@@ -12,6 +13,7 @@ export function emptyCompletionProof(overrides = {}) {
         schema: COMPLETION_PROOF_SCHEMA,
         version: PACKAGE_VERSION,
         generated_at: nowIso(),
+        execution_class: null,
         mission_id: null,
         route: null,
         status: 'not_verified',

package/dist/core/proof/route-adapter.js

@@ -5,7 +5,7 @@ import { normalizeProofRoute, routeRequiresImageVoxelAnchors } from './route-pro
 import { linkProofClaimsToEvidence, proofEvidenceSummary } from '../evidence/evidence-proof-linker.js';
 import { writeTrustArtifactsForProof } from '../trust-kernel/trust-report.js';
 import { enforceRetention } from '../retention.js';
-export async function writeRouteCompletionProof(root, { missionId = null, route = null, status = 'verified_partial', gate = null, summary = {}, artifacts = [], evidence = {}, claims = [], unverified = [], blockers = [], failureAnalysis = null, nextHumanActions = [], lightweightEvidence = false } = {}) {
+export async function writeRouteCompletionProof(root, { missionId = null, route = null, status = 'verified_partial', gate = null, summary = {}, artifacts = [], evidence = {}, claims = [], unverified = [], blockers = [], failureAnalysis = null, nextHumanActions = [], lightweightEvidence = false, executionClass = null, statusHintRejected = null } = {}) {
     const collected = lightweightEvidence ? { files: [] } : await collectProofEvidence(root);
     const normalizedRoute = normalizeProofRoute(route);
     const mergedEvidence = {
@@ -21,6 +21,7 @@ export async function writeRouteCompletionProof(root, { missionId = null, route
         unverified
     });
     const written = await writeCompletionProof(root, {
+        execution_class: executionClass,
         mission_id: missionId,
         route: normalizedRoute,
         status: normalizedStatus,
@@ -36,6 +37,7 @@ export async function writeRouteCompletionProof(root, { missionId = null, route
         claims,
         unverified,
         blockers,
+        ...(statusHintRejected ? { status_hint_rejected: statusHintRejected } : {}),
         failure_analysis: normalizeFailureAnalysis(failureAnalysis || evidence.failure_analysis || evidence.root_cause_analysis),
         next_human_actions: nextHumanActions
     }, {
@@ -88,6 +90,8 @@ function normalizeFailureAnalysis(value) {
     };
 }
 function normalizeRouteProofStatus(status, { route, evidence, blockers, unverified }) {
+    if (status === 'mock_only')
+        return 'mock_only';
     if (blockers?.length)
         return status === 'failed' ? 'failed' : 'blocked';
     if (status === 'verified' && unverified?.length)

package/dist/core/proof/route-finalizer.js

@@ -7,7 +7,7 @@ import { wrongnessProofEvidence } from '../triwiki-wrongness/wrongness-proof-lin
 import { computerUseStatusReport } from '../computer-use-status.js';
 import { readComputerUseLiveEvidence } from '../computer-use-live-evidence.js';
 import { leanChangeEvidenceFromReport, scanCodeStructure } from '../code-structure.js';
-export async function finalizeRouteWithProof(root, { missionId, route, gateFile = null, gate = null, artifacts = [], visualEvidence = null, dbEvidence = null, madSksEvidence = null, testEvidence = null, commandEvidence = null, claims = [], unverified = [], blockers = [], statusHint = 'verified_partial', strict = false, mock = false, fixClaim = false, requireRelation = false, visualClaim = undefined, agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null, lightweightEvidence = false } = {}) {
+export async function finalizeRouteWithProof(root, { missionId, route, gateFile = null, gate = null, artifacts = [], visualEvidence = null, dbEvidence = null, madSksEvidence = null, testEvidence = null, commandEvidence = null, claims = [], unverified = [], blockers = [], statusHint = 'verified_partial', strict = false, mock = false, fixClaim = false, requireRelation = false, visualClaim = undefined, agents = undefined, allowActiveWrongnessPartial = false, failureAnalysis = null, lightweightEvidence = false, statusHintRejected = null } = {}) {
     const policy = routeFinalizerPolicy(route, { strict, fixClaim, requireRelation, visualClaim });
     const localBlockers = [...blockers];
     const providedVisualEvidence = visualEvidence;
@@ -68,10 +68,11 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         || !computerUseLive?.evidence
         || computerUseLive.evidence.mode !== 'live_capture_success'
         || computerUseLive.evidence.image_voxel?.linked !== true));
-    const status = localBlockers.length
-        ? (strict ? 'blocked' : statusHint === 'verified' ? 'verified_partial' : statusHint)
-        : visualComputerUseDowngrade ? 'verified_partial'
-            : statusHint;
+    const status = mock ? 'mock_only'
+        : localBlockers.length
+            ? (strict ? 'blocked' : statusHint === 'verified' ? 'verified_partial' : statusHint)
+            : visualComputerUseDowngrade ? 'verified_partial'
+                : statusHint;
     const finalUnverified = [
         ...unverified,
         ...(imageEvidence?.mock ? ['Image voxel evidence is mock fixture evidence and does not claim a real visual run.'] : []),
@@ -138,6 +139,8 @@ export async function finalizeRouteWithProof(root, { missionId, route, gateFile
         blockers: localBlockers,
         failureAnalysis: resolvedFailureAnalysis,
         lightweightEvidence,
+        executionClass: mock ? 'mock_fixture' : 'real',
+        statusHintRejected,
         summary: {
             files_changed: collected.files?.length || 0,
             commands_run: evidence.commands?.length || 0,

package/dist/core/proof/selftest-proof-fixtures.js

@@ -26,20 +26,33 @@ export async function writeSelftestRouteProof(root, { missionId, route = '$Team'
     return writeRouteCompletionProof(root, {
         missionId,
         route,
-        status: 'verified_partial',
-        gate: { passed: true, source: gateSource || defaults.gateSource },
+        status: 'mock_only',
+        executionClass: 'mock_fixture',
+        gate: {
+            passed: false,
+            ok: false,
+            execution_class: 'mock_fixture',
+            source: gateSource || defaults.gateSource,
+            blockers: ['selftest_fixture_cannot_claim_real_route_completion']
+        },
         summary: { selftest: true, tests_passed: 1, manual_review_required: true },
         artifacts: artifacts || defaults.artifacts,
         evidence: {
-            route_gate: { passed: true },
-            commands: [{ cmd: 'sks selftest --mock', status: 'verified_partial' }]
+            route_gate: {
+                passed: false,
+                ok: false,
+                execution_class: 'mock_fixture',
+                blockers: ['selftest_fixture_cannot_claim_real_route_completion']
+            },
+            commands: [{ cmd: 'sks selftest --mock', status: 'mock_only' }]
         },
         claims: [{
                 id: `selftest-${kind.replaceAll('_', '-')}-proof`,
                 text: CLAIM_TEXT[kind] || CLAIM_TEXT.team_gate,
                 status: 'verified_partial'
             }],
-        unverified: unverified || defaults.unverified
+        unverified: unverified || defaults.unverified,
+        blockers: ['selftest_fixture_cannot_claim_real_route_completion']
     });
 }
 //# sourceMappingURL=selftest-proof-fixtures.js.map

package/dist/core/proof/validation.js

@@ -10,6 +10,8 @@ export function validateCompletionProof(proof = {}) {
         issues.push('schema');
     if (!COMPLETION_PROOF_STATUSES.includes(String(record.status)))
         issues.push('status');
+    if (!['real', 'mock_fixture'].includes(String(record.execution_class)))
+        issues.push('execution_class');
     if (!record.summary || typeof record.summary !== 'object')
         issues.push('summary');
     if (!record.evidence || typeof record.evidence !== 'object')

package/dist/core/provider/model-router.js

@@ -0,0 +1,53 @@
+const CHAINS = {
+    quick: [
+        { model: 'gpt-5.4-mini', reasoning: 'low', serviceTier: 'fast' },
+        { model: 'gpt-5.5', reasoning: 'low', serviceTier: 'fast' }
+    ],
+    standard: [
+        { model: 'gpt-5.5', reasoning: 'medium', serviceTier: 'fast' }
+    ],
+    agentic: [
+        { model: 'gpt-5.3-codex', reasoning: 'high', serviceTier: 'fast' },
+        { model: 'gpt-5.5', reasoning: 'high', serviceTier: 'fast' }
+    ],
+    ultrabrain: [
+        { model: 'gpt-5.5', reasoning: 'xhigh', serviceTier: 'standard' }
+    ],
+    verify: [
+        { model: 'gpt-5.4-mini', reasoning: 'medium', serviceTier: 'fast' }
+    ],
+    review: [
+        { model: 'gpt-5.5', reasoning: 'high', serviceTier: 'fast' }
+    ]
+};
+export async function routeModel(category, opts = {}) {
+    const chain = CHAINS[category] || CHAINS.standard;
+    const degraded = new Set((opts.lbHealth?.degraded_models || []).map((model) => String(model)));
+    for (const choice of chain) {
+        if (degraded.has(choice.model))
+            continue;
+        if (opts.lbHealth?.quota_low && choice.reasoning === 'xhigh')
+            return { ...choice, reasoning: 'high' };
+        return choice;
+    }
+    return chain[chain.length - 1] ?? CHAINS.standard[0];
+}
+export function categoryForWorkerRole(role) {
+    const text = String(role || '').toLowerCase();
+    if (/verif|test|qa/.test(text))
+        return 'verify';
+    if (/review|critic|judge/.test(text))
+        return 'review';
+    if (/research|explore|read|scout/.test(text))
+        return 'quick';
+    if (/plan|architect|strategy/.test(text))
+        return 'ultrabrain';
+    return 'agentic';
+}
+export function modelRouteReason(category, choice, opts = {}) {
+    if (opts.explicit)
+        return `${category}->${choice.model} (explicit env override)`;
+    const suffix = opts.quotaLow ? 'quota discipline' : opts.degraded?.length ? 'lb degraded fallback' : 'quota discipline';
+    return `${category}->${choice.model} (${suffix})`;
+}
+//# sourceMappingURL=model-router.js.map

package/dist/core/questions.js

@@ -263,7 +263,7 @@ export function inferAnswersForPrompt(prompt, explicitAnswers = {}) {
     };
     const criteria = {
         version: [version ? `version refs are ${version}` : 'version refs advance consistently', 'publish:dry gate passes', 'npm publish is not run'],
-        chat_capture: ['From-Chat-IMG activates chat-image intake only here', 'all visible chat requirements are listed before implementation', `${FROM_CHAT_IMG_COVERAGE_ARTIFACT} maps every customer request, screenshot region, and attachment to work-order item(s)`, `${FROM_CHAT_IMG_CHECKLIST_ARTIFACT} is updated as each request, image match, work item, scoped QA-LOOP, and verification step is completed`, `${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT} records temporary TriWiki-backed session context with retention metadata`, `${FROM_CHAT_IMG_QA_LOOP_ARTIFACT} proves QA-LOOP ran over the exact customer-request work-order range after implementation`, 'unresolved_items is empty before Team completion', 'scoped_qa_loop_completed is true with zero unresolved QA findings', 'Web/browser visual inspection uses Codex Chrome Extension readiness first; native Mac/non-web visual inspection uses Codex Computer Use when available', CODEX_WEB_VERIFICATION_POLICY, CODEX_COMPUTER_USE_ONLY_POLICY, 'client requests follow normal SKS gates and verification'],
+        chat_capture: ['From-Chat-IMG activates chat-image intake only here', 'all visible chat requirements are listed before implementation', `${FROM_CHAT_IMG_COVERAGE_ARTIFACT} maps every customer request, screenshot region, and attachment to work-order item(s)`, `${FROM_CHAT_IMG_CHECKLIST_ARTIFACT} is updated as each request, image match, work item, scoped QA-LOOP, and verification step is completed`, `${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT} records temporary TriWiki-backed session context with retention metadata`, `${FROM_CHAT_IMG_QA_LOOP_ARTIFACT} proves QA-LOOP ran over the exact customer-request work-order range after implementation`, 'unresolved_items is empty before Naruto completion', 'scoped_qa_loop_completed is true with zero unresolved QA findings', 'Web/browser visual inspection uses Codex Chrome Extension readiness first; native Mac/non-web visual inspection uses Codex Computer Use when available', CODEX_WEB_VERIFICATION_POLICY, CODEX_COMPUTER_USE_ONLY_POLICY, 'client requests follow normal SKS gates and verification'],
         triwiki_audit: ['TriWiki ingestion, voxel attention, and contract consumption paths are inspected against current code', 'repeat-mistake prevention gaps are fixed in the relevant code path or blocked with evidence', 'regression coverage proves fresh/high-weight mistake memory can influence future missions', 'final status separates supported behavior from anything still unverified'],
         priority: ['strong feedback raises required_weight', 'request topics are counted in wiki packs', 'future inference uses priority signals'],
         request_intake: ['request-intake.json records original prompt, interpreted intent, source-order requirements, wiki context used, and transformed prompt', 'pipeline-plan.json attaches request_intake metadata and execution_prompt from request-intake.transformed_prompt', 'decision-contract.json preserves the same request-intake artifact when a contract is sealed'],

package/dist/core/recallpulse.js

@@ -598,7 +598,7 @@ async function buildL2(root, dir) {
     const pipelinePlan = await readJson(path.join(dir, 'pipeline-plan.json'), null);
     const contract = await readJson(path.join(dir, 'decision-contract.json'), null);
     const statusLedger = await readJson(path.join(dir, MISSION_STATUS_LEDGER_ARTIFACT), null);
-    const gateFiles = ['team-gate.json', 'research-gate.evaluated.json', 'research-gate.json', 'db-review.json', 'qa-gate.json', 'ppt-gate.json', 'image-ux-review-gate.json', 'gx-gate.json', 'hard-blocker.json'];
+    const gateFiles = ['naruto-gate.json', 'research-gate.evaluated.json', 'research-gate.json', 'db-review.json', 'qa-gate.json', 'ppt-gate.json', 'image-ux-review-gate.json', 'gx-gate.json', 'hard-blocker.json', 'team-gate.json']; // team-gate is legacy read-only recall for old missions.
     const gates = [];
     for (const file of gateFiles) {
         const gate = await readJson(path.join(dir, file), null);

package/dist/core/release/gate-manifest.js

@@ -32,7 +32,7 @@ export const ALWAYS_ON_GATES = new Set([
     'postinstall:safe-side-effects',
     'publish:packlist-performance',
     'legacy:upgrade-zero-break',
-    'release:version-truth',
+    'release:proof-truth',
     'release:dynamic-performance',
     'release:provenance',
     'changelog:check'
@@ -46,7 +46,7 @@ export const REQUIRED_FOR_PUBLISH = new Set([
     'safety:side-effect-zero',
     'safety:mutation-callsite-coverage:repo-wide',
     'side-effect:runtime-report',
-    'release:version-truth',
+    'release:proof-truth',
     'release:provenance',
     'release:codex-current',
     'codex:0142:manifest',

package/dist/core/release/release-gate-affected-selector.js

@@ -1,15 +1,8 @@
 import { spawnSync } from 'node:child_process';
 const ALWAYS_KEEP = new Set([
-    'release:version-truth',
+    'release:proof-truth',
     'release:dag-full-coverage',
-    'release:codex-current',
-    'codex:0142:manifest',
-    'codex:0142:binary-identity',
-    'codex:0142:policy',
-    'codex:0142:app-server-v2',
-    'codex:0142:thread-store',
-    'codex:0142:capability',
-    'runtime:ts-source-of-truth',
+    'release:runtime-truth-matrix',
     'typecheck',
     'schema:check'
 ]);
@@ -79,7 +72,7 @@ function gateSelectionReason(gate, changedFiles, preset) {
     if (matchingReleaseScript)
         return 'release_script_changed';
     if (changedFiles.some((file) => file.startsWith('src/scripts/prepublish-') || file.startsWith('src/scripts/publish-'))) {
-        if (releaseGate && gate.id === 'release:version-truth')
+        if (releaseGate && gate.id === 'release:proof-truth')
             return 'publish_or_prepublish_script_changed';
     }
     if (changedFiles.some((file) => file.startsWith('src/scripts/scheduler-') || file.startsWith('src/core/scheduler/'))) {

package/dist/core/release/release-gate-batch-runner.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import path from 'node:path';
-import { createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
+import { cleanupReleaseGateHermeticEnv, createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { writeReleaseGateJson } from './release-gate-report.js';
 import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
@@ -69,7 +69,9 @@ function runOne(root, runId, reportRoot, gate) {
                 if (timeoutCleanup)
                     await timeoutCleanup;
                 const exitCode = timedOut ? 124 : code;
-                resolve({ id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: Date.now() - started, report_dir: hermetic.report_dir });
+                const result = { id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: Date.now() - started, report_dir: hermetic.report_dir };
+                cleanupReleaseGateHermeticEnv(hermetic);
+                resolve(result);
             })();
         });
     });

package/dist/core/release/release-gate-cache-v2.js

@@ -19,7 +19,7 @@ export function releaseGateProofBankFile(root) {
 // sources, which are inputs of ~280 gates (via `package.json` and `src/**`).
 // Before this normalization every publish re-ran the entire DAG from zero
 // (test:blackbox alone is ~11 minutes) even when no behavior changed.
-// Version-CORRECTNESS gates (release:version-truth, release:metadata, ...)
+// Version/proof-correctness gates (release:proof-truth, release:metadata, ...)
 // are declared with `cache.enabled: false`, so they always re-run and still
 // catch version drift. Set SKS_RELEASE_CACHE_VERSION_SENSITIVE=1 to restore
 // the old fully version-sensitive hashing.
@@ -31,6 +31,7 @@ const VERSION_NEUTRAL_CACHE_FILES = new Set([
     'src/bin/sks.ts',
     'dist/build-manifest.json'
 ]);
+const INPUT_DIGEST_MEMO = new Map();
 export function releaseGateCacheKey(root, gate) {
     const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
     const releaseVersion = String(pkg.version || '');
@@ -52,23 +53,35 @@ export function releaseGateCacheKey(root, gate) {
         hashFileIfPresent(hash, path.join(root, 'dist', 'build-manifest.json'));
     }
     for (const input of gate.cache.inputs) {
-        const expanded = expandGlob(root, input);
         hash.update(`input:${input}`);
-        if (!expanded.length) {
-            hash.update(`missing_or_empty:${input}`);
-            continue;
-        }
-        for (const file of expanded) {
-            const rel = path.relative(root, file);
-            hash.update(rel);
-            if (!versionSensitive && VERSION_NEUTRAL_CACHE_FILES.has(rel))
-                hashVersionNeutralFile(hash, rel, file, releaseVersion);
-            else
-                hashFileIfPresent(hash, file);
-        }
+        hash.update(releaseGateInputDigest(root, input, { versionSensitive, releaseVersion }));
     }
     return hash.digest('hex');
 }
+function releaseGateInputDigest(root, input, opts) {
+    const memoKey = `${path.resolve(root)}\0${input}\0${opts.versionSensitive ? 'sensitive' : 'neutral'}\0${opts.releaseVersion}`;
+    if (process.env.SKS_RELEASE_GATE_CACHE_MEMOIZE === '1') {
+        const cached = INPUT_DIGEST_MEMO.get(memoKey);
+        if (cached)
+            return cached;
+    }
+    const hash = crypto.createHash('sha256');
+    const expanded = expandGlob(root, input);
+    if (!expanded.length)
+        hash.update(`missing_or_empty:${input}`);
+    for (const file of expanded) {
+        const rel = path.relative(root, file);
+        hash.update(rel);
+        if (!opts.versionSensitive && VERSION_NEUTRAL_CACHE_FILES.has(rel))
+            hashVersionNeutralFile(hash, rel, file, opts.releaseVersion);
+        else
+            hashFileIfPresent(hash, file);
+    }
+    const digest = hash.digest('hex');
+    if (process.env.SKS_RELEASE_GATE_CACHE_MEMOIZE === '1')
+        INPUT_DIGEST_MEMO.set(memoKey, digest);
+    return digest;
+}
 function hashVersionNeutralFile(hash, rel, file, releaseVersion) {
     if (!fs.existsSync(file) || !fs.statSync(file).isFile())
         return;

package/dist/core/release/release-gate-dag.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
+import { cleanupReleaseGateHermeticEnv, cleanupReleaseGateRunTemp, createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { appendReleaseGateJsonl, writeReleaseGateJson } from './release-gate-report.js';
 import { findReadyReleaseGateNodes, findReleaseGatesBlockedByFailedDeps, pickReadyLaunchableReleaseGates } from './release-gate-scheduler.js';
 import { readReleaseGateCacheRecord, releaseGateProofBankFile, writeReleaseGateCacheHit } from './release-gate-cache-v2.js';
@@ -14,6 +14,7 @@ import { computeResourceClassBudget } from './resource-class-budget.js';
 import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
 import { rmrf } from '../fsx.js';
+import { sweepSksTempDirs } from '../retention.js';
 export function loadReleaseGateManifest(root, file = 'release-gates.v2.json') {
     const manifestPath = path.join(root, file);
     const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
@@ -58,6 +59,7 @@ export async function runReleaseGateDag(input) {
         : new Set();
     const runId = `rg-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
     const retentionBefore = await pruneOldReleaseGateRunDirs(root);
+    await sweepSksTempDirs(root, { maxAgeHours: 24 }).catch(() => null);
     const reportDir = path.join(root, '.sneakoscope', 'reports', 'release-gates', runId);
     fs.mkdirSync(reportDir, { recursive: true });
     const timeline = path.join(reportDir, 'timeline.jsonl');
@@ -167,6 +169,7 @@ export async function runReleaseGateDag(input) {
             sumGateMs += report.critical_path_ms || 0;
         }
         const packed = writeSummarySnapshot(true);
+        cleanupReleaseGateRunTemp(runId);
         return {
             ...packed,
             ok: packed.ok && packRun.ok,
@@ -258,6 +261,7 @@ export async function runReleaseGateDag(input) {
     const finalResult = { ...result, retention: mergeReleaseGateRetention(retentionBefore, retentionAfter) };
     appendReleaseGateJsonl(timeline, { event: 'retention', phase: 'after_run', ...retentionAfter, at: new Date().toISOString() });
     writeReleaseGateJson(path.join(reportDir, 'summary.json'), finalResult);
+    cleanupReleaseGateRunTemp(runId);
     return finalResult;
 }
 export function selectReleaseGatePreset(manifest, preset) {
@@ -348,6 +352,7 @@ function runGate(root, runId, reportRoot, gate) {
                 const exitCode = timedOut ? 124 : code;
                 const result = { id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
                 writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), { schema: 'sks.release-gate-result.v1', ...result, stdout_log: stdoutFile, stderr_log: stderrFile });
+                cleanupReleaseGateHermeticEnv(hermetic);
                 resolve(result);
             })();
         });

package/dist/core/release/release-gate-hermetic-env.js

@@ -32,4 +32,14 @@ export function createReleaseGateHermeticEnv(input) {
         }
     };
 }
+export function cleanupReleaseGateHermeticEnv(env) {
+    if (process.env.SKS_KEEP_GATE_ENV === '1')
+        return;
+    fs.rmSync(env.tmp_dir, { recursive: true, force: true });
+}
+export function cleanupReleaseGateRunTemp(runId) {
+    if (process.env.SKS_KEEP_GATE_ENV === '1')
+        return;
+    fs.rmSync(path.join(os.tmpdir(), 'sks-gate', runId), { recursive: true, force: true });
+}
 //# sourceMappingURL=release-gate-hermetic-env.js.map

package/dist/core/release/release-gate-node.js

@@ -16,6 +16,7 @@ export const RELEASE_GATE_RESOURCE_CLASSES = [
     'global-config',
     'publish',
     'fs-read',
+    'fs-write',
     'timing-sensitive'
 ];
 export function validateReleaseGateManifest(input) {
@@ -47,6 +48,8 @@ export function validateReleaseGateManifest(input) {
             errors.push(`gate_side_effect_invalid:${gate?.id || 'unknown'}`);
         if (!Number.isFinite(Number(gate?.timeout_ms)) || Number(gate.timeout_ms) <= 0)
             errors.push(`gate_timeout_missing:${gate?.id || 'unknown'}`);
+        if (gate?.output_contract !== undefined && gate.output_contract !== 'sks.gate-result.v1')
+            errors.push(`gate_output_contract_invalid:${gate?.id || 'unknown'}`);
         if (!gate?.cache || typeof gate.cache.enabled !== 'boolean' || !Array.isArray(gate.cache.inputs))
             errors.push(`gate_cache_missing:${gate?.id || 'unknown'}`);
         if (!gate?.isolation || gate.isolation.report_dir !== 'per-gate')

package/dist/core/release/release-gate-resource-governor.js

@@ -19,6 +19,7 @@ export function defaultReleaseGateBudget() {
         'global-config': 1,
         publish: 1,
         'fs-read': Math.min(96, cores * 10),
+        'fs-write': Math.min(12, Math.max(1, cores)),
         'timing-sensitive': 1
     };
     for (const key of Object.keys(base)) {