sneakoscope 4.8.7 → 5.1.2

package/dist/core/codex-hooks/codex-hook-managed-install.js

@@ -3,6 +3,7 @@ import { ensureDir, nowIso, readText, writeTextAtomic } from '../fsx.js';
 import { CODEX_HOOK_EVENTS } from '../codex-compat/codex-hook-events.js';
 import { buildCodexCommandHookToml, matcherApplies } from './codex-hook-config-writer.js';
 import { readCodexHookActualState } from './codex-hook-actual-discovery.js';
+import { writeTrustedHashStateForHooksFile } from './codex-hook-state-writer.js';
 const HOOK_SUBCOMMANDS = {
     SessionStart: 'session-start',
     UserPromptSubmit: 'user-prompt-submit',
@@ -39,6 +40,9 @@ export async function installManagedCodexHooks(root, opts = {}) {
         await writeTextAtomic(tomlPath, hooksToml);
         await writeTextAtomic(requirementsPath, requirementsToml);
     }
+    const trust = opts.dryRun === true
+        ? null
+        : await writeTrustedHashStateForHooksFile({ hooksFilePath: tomlPath, managed: true }, { allowSksHashFallback: true });
     const actual = opts.dryRun === true
         ? null
         : await readCodexHookActualState(root);
@@ -62,6 +66,7 @@ export async function installManagedCodexHooks(root, opts = {}) {
             dual_representation: actual.dual_representation.length,
             blockers: actual.blockers
         } : null,
+        trust,
         policy: {
             official_hash_available: false,
             trusted_hash_writer_policy: 'managed_install_required_when_official_hash_is_unavailable',

package/dist/core/codex-hooks/codex-hook-state-writer.js

@@ -2,35 +2,94 @@ import path from 'node:path';
 import { readJson, readText, writeTextAtomic } from '../fsx.js';
 import { CODEX_HOOK_EVENTS } from '../codex-compat/codex-hook-events.js';
 import { codexCommandHookCurrentHash, codexHookStateKey } from './codex-hook-hash.js';
-export async function writeTrustedHashStateForHooksFile(root, hooksPath = path.join(root, '.codex', 'hooks.json'), statePath = path.join(root, '.codex', 'config.toml'), opts = {}) {
-    if (opts.allowSksHashFallback !== true) {
+import { entriesFromInlineHooksToml } from './codex-hook-actual-discovery.js';
+export async function writeTrustedHashStateForHooksFile(input, hooksPathOrOpts, statePath, opts = {}) {
+    const resolved = resolveWriterInput(input, hooksPathOrOpts, statePath, opts);
+    const isSksManagedHook = resolved.managed === true || resolved.hooksPath.includes('sks-managed-hooks');
+    if (resolved.opts.allowSksHashFallback !== true && !isSksManagedHook) {
         return {
             schema: 'sks.codex-hook-state-writer.v2',
             ok: false,
-            hooks_path: hooksPath,
-            state_path: statePath,
+            hooks_path: resolved.hooksPath,
+            state_path: resolved.statePath,
             updated: 0,
             blocks: [],
             blocked: true,
             blocker: 'official_codex_hook_hash_unavailable',
             policy: 'use_sks_hooks_install_managed_instead_of_writing_sks_only_trusted_hashes',
             repair_action: 'sks hooks install --managed --json',
-            reason: opts.reason || 'SKS refuses to write trusted_hash values from its own canonicalJson hash unless official Codex hash parity is proven.'
+            reason: resolved.opts.reason || 'SKS refuses to write trusted_hash values from its own canonicalJson hash unless official Codex hash parity is proven.'
         };
     }
-    const hooksFile = await readJson(hooksPath, {});
-    const blocks = trustedHashBlocksForHooksFile(hooksPath, hooksFile);
-    const next = upsertTrustBlocks(await readText(statePath, ''), blocks);
-    await writeTextAtomic(statePath, next);
+    const blocks = await trustedHashBlocksForHooksPath(resolved.hooksPath, isSksManagedHook);
+    const next = upsertTrustBlocks(await readText(resolved.statePath, ''), blocks);
+    await writeTextAtomic(resolved.statePath, next);
     return {
         schema: 'sks.codex-hook-state-writer.v1',
         ok: true,
-        hooks_path: hooksPath,
-        state_path: statePath,
+        hooks_path: resolved.hooksPath,
+        state_path: resolved.statePath,
         updated: blocks.length,
         blocks
     };
 }
+function resolveWriterInput(input, hooksPathOrOpts, statePath, opts) {
+    if (typeof input === 'string') {
+        const root = path.resolve(input);
+        const resolvedOpts = typeof hooksPathOrOpts === 'object' && hooksPathOrOpts !== null
+            ? hooksPathOrOpts
+            : opts;
+        const hooksPath = typeof hooksPathOrOpts === 'string'
+            ? hooksPathOrOpts
+            : path.join(root, '.codex', 'hooks.json');
+        return {
+            root,
+            hooksPath: path.resolve(hooksPath),
+            statePath: path.resolve(statePath || path.join(root, '.codex', 'config.toml')),
+            managed: resolvedOpts.managed === true,
+            opts: resolvedOpts
+        };
+    }
+    const hooksPath = path.resolve(input.hooksFilePath || input.hooksPath || path.join(input.root || process.cwd(), '.codex', 'hooks.json'));
+    const root = path.resolve(input.root || rootFromHooksPath(hooksPath));
+    const resolvedOpts = typeof hooksPathOrOpts === 'object' && hooksPathOrOpts !== null
+        ? hooksPathOrOpts
+        : opts;
+    return {
+        root,
+        hooksPath,
+        statePath: path.resolve(input.statePath || statePathForHooksPath(root, hooksPath)),
+        managed: input.managed === true || resolvedOpts.managed === true,
+        opts: resolvedOpts
+    };
+}
+function rootFromHooksPath(hooksPath) {
+    const dir = path.dirname(hooksPath);
+    if (path.basename(dir) === '.codex')
+        return path.dirname(dir);
+    if (path.basename(dir) === 'managed-hooks')
+        return path.dirname(path.dirname(dir));
+    return process.cwd();
+}
+function statePathForHooksPath(root, hooksPath) {
+    const dir = path.dirname(hooksPath);
+    if (path.basename(dir) === '.codex' || path.basename(dir) === 'managed-hooks') {
+        return path.join(path.basename(dir) === '.codex' ? dir : path.dirname(dir), 'config.toml');
+    }
+    return path.join(root, '.codex', 'config.toml');
+}
+async function trustedHashBlocksForHooksPath(hooksPath, managed) {
+    if (/\.toml$/i.test(hooksPath)) {
+        const parsed = entriesFromInlineHooksToml(hooksPath, 'project', await readText(hooksPath, ''), {}, managed, managed ? 'managed_dir_toml' : 'config_toml');
+        return parsed.entries.map((entry) => ({
+            key: entry.key,
+            trusted_hash: entry.current_hash,
+            block: `[hooks.state."${tomlQuotedKey(entry.key)}"]\ntrusted_hash = "${entry.current_hash}"`
+        }));
+    }
+    const hooksFile = await readJson(hooksPath, {});
+    return trustedHashBlocksForHooksFile(hooksPath, hooksFile);
+}
 export function trustedHashBlocksForHooksFile(hooksPath, hooksFile) {
     const blocks = [];
     const hooksRoot = hooksFile?.hooks && typeof hooksFile.hooks === 'object' && !Array.isArray(hooksFile.hooks) ? hooksFile.hooks : {};

package/dist/core/codex-hooks/codex-hook-trust-doctor.js

@@ -8,7 +8,7 @@ export async function codexHookTrustDoctor(root, opts = {}) {
     const fix = opts.fix === true;
     const trustOpts = opts.managed === undefined ? {} : { managed: opts.managed };
     const before = await readCodexHookTrustEntries(root, trustOpts);
-    const fixed = fix ? await writeTrustedHashStateForHooksFile(root, undefined, undefined, { allowSksHashFallback: false }).catch((err) => ({
+    const fixed = fix ? await writeTrustedHashStateForHooksFile({ root, managed: opts.managed === true }, { allowSksHashFallback: opts.managed === true }).catch((err) => ({
         ok: false,
         error: err instanceof Error ? err.message : String(err)
     })) : null;
@@ -74,7 +74,7 @@ async function codexHookActualTrustDoctor(root, opts = {}) {
         policy: {
             official_hash_available: false,
             trusted_hash_writer_policy: 'managed_install_required_when_official_hash_is_unavailable',
-            sks_hash_fallback_allowed: false
+            sks_hash_fallback_allowed: opts.managed === true
         }
     };
 }

package/dist/core/codex-lb/codex-lb-env.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import os from 'node:os';
-import { exists, readText, runProcess, which } from '../fsx.js';
+import { exists, readJson, readText, runProcess, which } from '../fsx.js';
 export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home || os.homedir()), '.codex', 'sks-codex-lb.env');
 }
@@ -10,6 +10,25 @@ export function legacyCodexLbEnvPath(home = process.env.HOME || os.homedir()) {
 export function codexLbMetadataPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home || os.homedir()), '.codex', 'sks-codex-lb.json');
 }
+export function codexLbHealthPath(home = process.env.HOME || os.homedir()) {
+    return path.join(String(home || os.homedir()), '.codex', 'sks-codex-lb-health.json');
+}
+export async function readLbHealth(home = process.env.HOME || os.homedir()) {
+    const file = codexLbHealthPath(home);
+    const raw = await readJson(file, null);
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const degraded = Array.isArray(raw.degraded_models)
+        ? raw.degraded_models.map((model) => String(model)).filter(Boolean)
+        : [];
+    return {
+        ok: raw.ok !== false,
+        degraded_models: degraded,
+        quota_low: raw.quota_low === true,
+        source: file,
+        updated_at: typeof raw.updated_at === 'string' ? raw.updated_at : null
+    };
+}
 export function normalizeCodexLbBaseUrl(input = '') {
     let host = String(input || '').trim();
     if (!host)

package/dist/core/commands/basic-cli.js

@@ -1,9 +1,12 @@
 import path from 'node:path';
+import os from 'node:os';
+import fsp from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import { COMMANDS, LEGACY_COMMAND_ALIASES } from '../../cli/command-registry.js';
 import { flag } from '../../cli/args.js';
 import { printJson, sksTextLogo } from '../../cli/output.js';
-import { PACKAGE_VERSION, ensureDir, exists, nowIso, projectRoot, readJson, sksRoot, tmpdir, writeJsonAtomic } from '../fsx.js';
+import { ui as cliUi } from '../../cli/cli-theme.js';
+import { PACKAGE_VERSION, ensureDir, exists, nowIso, projectRoot, readJson, sksRoot, writeJsonAtomic } from '../fsx.js';
 import { COMMAND_CATALOG, DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, USAGE_TOPICS, routePrompt, routeReasoning, reasoningInstruction } from '../routes.js';
 import { initProject, normalizeInstallScope, sksCommandPrefix } from '../init.js';
 import { buildFeatureRegistry, validateFeatureRegistry } from '../feature-registry.js';
@@ -111,6 +114,8 @@ export async function updateCheckCommand(args = []) {
     const result = await runSksUpdateCheck();
     if (flag(args, '--json'))
         return printJson(result);
+    cliUi.banner('update');
+    result.update_available ? cliUi.warn('update available') : cliUi.ok('already current or no update required');
     console.log(`${sksTextLogo()}\n\n${formatSksUpdateCheckText(result)}`);
 }
 export async function updateCommand(sub = 'now', args = []) {
@@ -132,11 +137,15 @@ export async function updateCommand(sub = 'now', args = []) {
         version: valueAfter(effectiveArgs, '--version') || valueAfter(effectiveArgs, '-v'),
         dryRun: flag(effectiveArgs, '--dry-run'),
         projectRoot: root,
+        json: flag(effectiveArgs, '--json'),
+        quiet: flag(effectiveArgs, '--quiet'),
         timeoutMs: 10 * 60 * 1000,
         maxOutputBytes: 128 * 1024
     }));
     if (flag(effectiveArgs, '--json'))
         return printJson(result);
+    cliUi.banner('update');
+    result.ok ? cliUi.ok(result.status) : result.status === 'updated_with_issues' ? cliUi.warn(result.status) : cliUi.fail(result.status || 'failed');
     console.log(`${sksTextLogo()}\n`);
     console.log(`SKS update ${result.status}`);
     if (result.command)
@@ -153,6 +162,16 @@ export async function updateCommand(sub = 'now', args = []) {
         console.log(`SKS menu bar: ${result.sks_menubar.status}${result.sks_menubar.app_path ? ` (${result.sks_menubar.app_path})` : ''}`);
     for (const stage of result.stages || [])
         console.log(`Stage ${stage.id}: ${stage.ok ? 'ok' : 'failed'} ${stage.status}`);
+    if (result.verification?.length) {
+        console.log('Self verification:');
+        cliUi.table([
+            ['check', 'status', 'detail'],
+            ...result.verification.map((item) => [item.id, item.ok ? 'ok' : 'failed', item.detail || ''])
+        ]);
+        const remediation = [...new Set(result.verification.filter((item) => !item.ok).map((item) => item.remediation).filter((value) => Boolean(value)))];
+        for (const action of remediation)
+            console.log(`Remediation: ${action}`);
+    }
     if (result.error)
         console.log(`Error: ${result.error}`);
     if (!result.ok)
@@ -264,7 +283,7 @@ export async function postinstallCommand(args = []) {
 export async function selftestCommand(args = []) {
     process.env.CI = 'true';
     const root = await projectRoot();
-    const tmp = tmpdir();
+    const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-selftest-'));
     await ensureDir(tmp);
     const registry = await buildFeatureRegistry({ root });
     const coverage = validateFeatureRegistry(registry);

package/dist/core/commands/check-command.js

@@ -4,6 +4,7 @@ import { spawnSync } from 'node:child_process';
 import { flag } from '../../cli/args.js';
 import { printJson } from '../../cli/output.js';
 import { projectRoot } from '../fsx.js';
+import { evaluateGateProcessOutput } from './gate-result-contract.js';
 const CHECK_SCHEMA = 'sks.check.v1';
 export async function checkCommand(args = []) {
     const root = await projectRoot();
@@ -31,10 +32,41 @@ export async function checkCommand(args = []) {
             shell: false,
             env: { ...process.env, CI: process.env.CI || 'true' }
         });
-        const ok = result.status === 0;
-        if (step.name === 'proof-bank-summary')
-            proofBankSummary = parseJsonObject(String(result.stdout || ''));
-        steps.push({ name: step.name, ok, status: result.status, stderr_tail: tail(String(result.stderr || '')) });
+        const stdout = String(result.stdout || '');
+        let ok = result.status === 0;
+        let reason;
+        let contract;
+        let gateResult = null;
+        if (step.name === 'proof-bank-summary') {
+            proofBankSummary = parseJsonObject(stdout);
+            if (!proofBankSummary) {
+                ok = false;
+                reason = 'invalid_json_output';
+            }
+        }
+        if (step.output_contract === 'sks.gate-result.v1') {
+            const gateEval = evaluateGateProcessOutput({ status: result.status, stdout, requiresContract: true });
+            ok = gateEval.ok;
+            reason = gateEval.reason;
+            contract = gateEval.contract;
+            gateResult = gateEval.gate_result;
+        }
+        else if (step.name.startsWith('release:')) {
+            const gateEval = evaluateGateProcessOutput({ status: result.status, stdout });
+            ok = gateEval.ok;
+            reason = gateEval.reason;
+            contract = gateEval.contract;
+            gateResult = gateEval.gate_result;
+        }
+        steps.push({
+            name: step.name,
+            ok,
+            status: result.status,
+            stderr_tail: tail(String(result.stderr || '')),
+            ...(reason ? { reason } : {}),
+            ...(contract ? { contract } : {}),
+            ...(gateResult ? { gate_result: gateResult } : {})
+        });
         if (!json) {
             if (result.stdout)
                 process.stdout.write(result.stdout);
@@ -69,7 +101,7 @@ function buildCheckPlan(input) {
     }
     else {
         steps.push({ name: buildScript, command: 'npm', args: ['run', buildScript, '--silent'] });
-        steps.push({ name: `release:${tier}`, command: process.execPath, args: dagArgs(tier, input.changedSince, input.sla) });
+        steps.push({ name: `release:${tier}`, command: process.execPath, args: dagArgs(tier, input.changedSince, input.sla), output_contract: 'sks.gate-result.v1' });
     }
     return {
         tier,

package/dist/core/commands/computer-use-command.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
-import { nowIso, projectRoot, writeJsonAtomic } from '../fsx.js';
+import fsp from 'node:fs/promises';
+import { nowIso, projectRoot, readJson, writeJsonAtomic } from '../fsx.js';
 import { createMission, findLatestMission } from '../mission.js';
 import { flag, readOption } from '../../cli/args.js';
 import { printJson } from '../../cli/output.js';
@@ -130,17 +131,23 @@ export async function computerUseCommand(command, args = []) {
         return;
     }
     const route = command === 'cu' ? '$CU' : '$Computer-Use';
+    const gate = await evaluateComputerUseGate(root, missionId);
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'missions', missionId, 'computer-use-gate.json'), gate);
     const proof = await maybeFinalizeRoute(root, {
         missionId,
         route,
+        gateFile: 'computer-use-gate.json',
+        gate,
         mock: flag(args, '--mock'),
         visual: true,
         requireRelation: flag(args, '--fix-claim') || flag(args, '--require-relation'),
         artifacts: ['computer-use-evidence-ledger.json', 'screen-capture-ledger.json', 'image-voxel-ledger.json', 'visual-anchors.json'],
         claims: [{ id: 'computer-use-evidence', status: flag(args, '--mock') ? 'verified_partial' : 'supported' }],
-        command: { cmd: `sks ${command} ${args.join(' ')}`.trim(), status: 0 }
+        blockers: gate.blockers || [],
+        statusHint: gate.passed ? undefined : 'blocked',
+        command: { cmd: `sks ${command} ${args.join(' ')}`.trim(), status: gate.passed ? 0 : 1 }
     });
-    const result = { schema: 'sks.computer-use-evidence.v1', ok: proof.ok, mission_id: missionId, route, proof: proof.validation };
+    const result = { schema: 'sks.computer-use-evidence.v1', ok: proof.ok && gate.passed === true, mission_id: missionId, route, gate, proof: proof.validation };
     if (flag(args, '--json'))
         return printJson(result);
     console.log(`Computer Use evidence: ${proof.ok ? 'ok' : 'blocked'} ${missionId}`);
@@ -170,7 +177,18 @@ async function importFixture(root, command, args) {
     };
     await writeJsonAtomic(path.join(dir, 'computer-use-evidence-ledger.json'), evidence);
     await writeJsonAtomic(path.join(dir, 'screen-capture-ledger.json'), captures);
-    const gate = { schema_version: 1, passed: true, ok: true, computer_use_evidence: true, screen_capture_evidence: true, mock: true };
+    const gate = {
+        schema: 'sks.computer-use-gate.v1',
+        schema_version: 1,
+        passed: false,
+        ok: false,
+        status: 'blocked',
+        execution_class: 'mock_fixture',
+        computer_use_evidence: false,
+        screen_capture_evidence: false,
+        mock: true,
+        blockers: ['computer_use_fixture_mode_cannot_claim_real']
+    };
     await writeJsonAtomic(path.join(dir, 'computer-use-gate.json'), gate);
     const proof = await maybeFinalizeRoute(root, {
         missionId: id,
@@ -182,11 +200,48 @@ async function importFixture(root, command, args) {
         requireRelation: flag(args, '--fix-claim') || flag(args, '--require-relation'),
         artifacts: ['computer-use-evidence-ledger.json', 'screen-capture-ledger.json', 'image-voxel-ledger.json', 'visual-anchors.json', 'completion-proof.json'],
         claims: [{ id: 'computer-use-import-fixture', status: 'verified_partial' }],
-        command: { cmd: `sks ${command} import-fixture --mock`, status: 0 }
+        statusHint: 'blocked',
+        blockers: gate.blockers,
+        command: { cmd: `sks ${command} import-fixture --mock`, status: 1 }
     });
-    const result = { schema: 'sks.computer-use-import-fixture.v1', ok: proof.ok, mission_id: id, route, proof: proof.validation };
+    const result = { schema: 'sks.computer-use-import-fixture.v1', ok: false, mission_id: id, route, gate, proof: proof.validation };
+    process.exitCode = 1;
     if (flag(args, '--json'))
         return printJson(result);
-    console.log(`Computer Use fixture imported: ${proof.ok ? 'ok' : 'blocked'} ${id}`);
+    console.log(`Computer Use fixture imported: blocked ${id}`);
+}
+async function evaluateComputerUseGate(root, missionId) {
+    const dir = path.join(root, '.sneakoscope', 'missions', missionId);
+    const evidence = await readJson(path.join(dir, 'computer-use-evidence-ledger.json'), null);
+    const captures = await readJson(path.join(dir, 'screen-capture-ledger.json'), null);
+    const blockers = new Set();
+    const actions = Array.isArray(evidence?.actions) ? evidence.actions : [];
+    const captureRows = Array.isArray(captures?.captures) ? captures.captures : [];
+    if (!actions.length)
+        blockers.add('computer_use_actions_missing');
+    if (actions.some((action) => action?.status === 'mocked' || action?.mock === true) || evidence?.mock === true)
+        blockers.add('computer_use_mock_actions_not_evidence');
+    if (!captureRows.length)
+        blockers.add('screen_capture_evidence_missing');
+    for (const capture of captureRows) {
+        const rel = String(capture?.path || '');
+        const abs = path.isAbsolute(rel) ? rel : path.join(root, rel);
+        const stat = await fsp.stat(abs).catch(() => null);
+        if (!stat || stat.size < 256)
+            blockers.add(`screen_capture_file_missing_or_too_small:${capture?.id || rel || 'unknown'}`);
+        if (capture?.status === 'mocked' || capture?.mock === true || captures?.mock === true)
+            blockers.add('screen_capture_mock_not_evidence');
+    }
+    const passed = blockers.size === 0;
+    return {
+        schema: 'sks.computer-use-gate.v1',
+        schema_version: 1,
+        passed,
+        ok: passed,
+        status: passed ? 'pass' : 'blocked',
+        computer_use_evidence: actions.length > 0 && ![...blockers].includes('computer_use_mock_actions_not_evidence'),
+        screen_capture_evidence: captureRows.length > 0 && ![...blockers].some((blocker) => blocker.startsWith('screen_capture_')),
+        blockers: [...blockers]
+    };
 }
 //# sourceMappingURL=computer-use-command.js.map

package/dist/core/commands/db-command.js

@@ -6,6 +6,7 @@ import { maybeFinalizeRoute } from '../proof/auto-finalize.js';
 import { recordDbSafetyMismatchWrongness } from '../triwiki-wrongness/wrongness-ledger.js';
 import { flag, readOption } from './command-utils.js';
 import { writeRouteCollaborationArtifacts } from '../agents/route-collaboration-ledger.js';
+import { context7EvidenceStatus } from './route-success-helpers.js';
 export async function dbCommand(sub, args = []) {
     const root = await sksRoot();
     if (sub === 'policy') {
@@ -79,7 +80,9 @@ async function recordDbExpectation(root, input = {}) {
 async function finalizeDbCheck(root, { action, args, result, exitCode }) {
     const prompt = `sks db ${action} ${args.join(' ')}`.trim();
     const { id, dir } = await createMission(root, { mode: 'db', prompt });
-    const blocked = exitCode !== 0 || result.action === 'block' || result.level === 'destructive';
+    const context7 = await context7EvidenceStatus(root, id);
+    const destructiveOperationZero = result.level !== 'destructive';
+    const blocked = exitCode !== 0 || result.action === 'block' || result.level === 'destructive' || !context7.ok;
     const report = {
         schema: 'sks.db-operation-report.v1',
         mission_id: id,
@@ -91,11 +94,34 @@ async function finalizeDbCheck(root, { action, args, result, exitCode }) {
             ok: !blocked,
             level: result.level || result.risk || result.status || null,
             action: result.action || action,
-            destructive_blocked: blocked && /drop|delete|truncate|reset|destructive/i.test(JSON.stringify(result))
-        }
+            destructive_operation_zero: destructiveOperationZero,
+            destructive_blocked: !destructiveOperationZero || (blocked && /drop|delete|truncate|reset|destructive/i.test(JSON.stringify(result))),
+            context7_policy: context7.policy,
+            context7_evidence: context7.evidence
+        },
+        blockers: [
+            ...(!destructiveOperationZero ? ['destructive_operation_found'] : []),
+            ...(context7.ok ? [] : [context7.blocker])
+        ]
     };
     await writeJsonAtomic(path.join(dir, 'db-operation-report.json'), report);
-    const gate = { schema_version: 1, passed: !blocked, ok: !blocked, status: blocked ? 'blocked' : 'pass', db_operation_report: 'db-operation-report.json' };
+    const gateBlockers = [
+        ...(blocked && destructiveOperationZero ? ['db_operation_blocked'] : []),
+        ...(!destructiveOperationZero ? ['destructive_operation_found'] : []),
+        ...(context7.ok ? [] : [context7.blocker])
+    ];
+    const gate = {
+        schema: 'sks.db-gate.v1',
+        schema_version: 1,
+        passed: !blocked,
+        ok: !blocked,
+        status: blocked ? 'blocked' : 'pass',
+        db_operation_report: 'db-operation-report.json',
+        destructive_operation_zero: destructiveOperationZero,
+        context7_policy: context7.policy,
+        context7_evidence: context7.evidence,
+        blockers: [...new Set(gateBlockers)]
+    };
     await writeJsonAtomic(path.join(dir, 'db-gate.json'), gate);
     const native = await writeRouteCollaborationArtifacts(root, {
         missionId: id,
@@ -112,7 +138,7 @@ async function finalizeDbCheck(root, { action, args, result, exitCode }) {
         artifacts: ['db-operation-report.json', 'completion-proof.json', ...Object.values(native.artifacts || {})],
         dbEvidence: report.db_safety,
         statusHint: blocked ? 'blocked' : 'verified_partial',
-        blockers: blocked ? ['db_operation_blocked'] : [],
+        blockers: gate.blockers,
         command: { cmd: prompt, status: exitCode }
     });
     return { ...completion, native_agent_collaboration: native };

package/dist/core/commands/fast-mode-command.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { flag } from '../../cli/args.js';
 import { printJson } from '../../cli/output.js';
+import { ui as cliUi } from '../../cli/cli-theme.js';
 import { projectRoot, readText } from '../fsx.js';
 import { clearFastModePreference, fastModePreferencePath, readFastModePreference, resolveFastModePolicy, writeFastModePreference } from '../agents/fast-mode-policy.js';
 import { codexFastModeDesktopStatus, codexLbConfigPath, ensureGlobalCodexFastModeDuringInstall } from '../../cli/install-helpers.js';
@@ -76,6 +77,8 @@ export async function fastModeCommand(args = []) {
     };
     if (flag(args, '--json'))
         return printJson(result);
+    cliUi.banner('fast-mode');
+    cliUi.ok(`project workers ${result.fast_mode ? 'fast' : 'standard'}`);
     console.log('SKS Fast Mode');
     console.log(`Root: ${root}`);
     console.log(`Global (desktop): ${globalStatus.on ? 'on' : 'off'} (default_profile=${globalStatus.default_profile || 'none'}, top-level ${globalStatus.top_level_default_profile ? 'OK' : 'none'})`);

package/dist/core/commands/gate-result-contract.js

@@ -0,0 +1,43 @@
+export const GATE_RESULT_CONTRACT = 'sks.gate-result.v1';
+export function parseGateResultFromStdout(stdout) {
+    const lines = String(stdout || '').trim().split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    const last = lines.at(-1);
+    if (!last)
+        return null;
+    try {
+        const parsed = JSON.parse(last);
+        if (parsed?.schema === GATE_RESULT_CONTRACT && typeof parsed.ok === 'boolean' && Array.isArray(parsed.blockers)) {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function evaluateGateProcessOutput({ status, stdout, requiresContract = false }) {
+    const gateResult = parseGateResultFromStdout(stdout);
+    if (!gateResult) {
+        if (requiresContract) {
+            return {
+                ok: false,
+                contract: GATE_RESULT_CONTRACT,
+                gate_result: null,
+                reason: 'gate_output_contract_violation'
+            };
+        }
+        return {
+            ok: status === 0,
+            contract: 'legacy_exit_code_only',
+            gate_result: null,
+            ...(status === 0 ? { reason: 'legacy_exit_code_only' } : {})
+        };
+    }
+    return {
+        ok: status === 0 && gateResult.ok === true,
+        contract: GATE_RESULT_CONTRACT,
+        gate_result: gateResult,
+        ...(gateResult.ok === true ? {} : { reason: 'gate_result_not_ok' })
+    };
+}
+//# sourceMappingURL=gate-result-contract.js.map

package/dist/core/commands/gates-command.js

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { flag } from '../../cli/args.js';
 import { printJson } from '../../cli/output.js';
 import { projectRoot } from '../fsx.js';
+import { evaluateGateProcessOutput } from './gate-result-contract.js';
 export async function gatesCommand(args = []) {
     const root = await projectRoot();
     const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'run';
@@ -29,12 +30,16 @@ export async function gatesCommand(args = []) {
         maxBuffer: 1024 * 1024 * 20,
         env: { ...process.env, CI: process.env.CI || 'true' }
     });
+    const gateEval = evaluateGateProcessOutput({ status: result.status, stdout: String(result.stdout || '') });
     const report = {
         schema: 'sks.gates-command.v1',
-        ok: result.status === 0,
+        ok: gateEval.ok,
         target,
         mode: isPreset ? 'preset' : 'gate',
         status: result.status,
+        contract: gateEval.contract,
+        gate_result: gateEval.gate_result,
+        ...(gateEval.reason ? { reason: gateEval.reason } : {}),
         stdout_tail: tail(String(result.stdout || '')),
         stderr_tail: tail(String(result.stderr || ''))
     };

package/dist/core/commands/gc-command.js

@@ -1,7 +1,27 @@
-import { dirSize, formatBytes, packageRoot, sksRoot } from '../fsx.js';
+import { dirSize, formatBytes, packageRoot, projectRoot, sksRoot } from '../fsx.js';
 import { enforceRetention, storageReport } from '../retention.js';
 import { flag } from './command-utils.js';
-export async function memoryCommand(_sub, args = []) {
+import { projectTriwikiToAgentsMd } from '../triwiki/agents-md-projector.js';
+import { compileMistakeRules } from '../verification/mistake-rule-compiler.js';
+export async function memoryCommand(sub, args = []) {
+    const action = String(sub || '').toLowerCase();
+    if (['build', 'project', 'agents', 'agents-md'].includes(action)) {
+        const root = await projectRoot();
+        const [result, rules] = await Promise.all([
+            projectTriwikiToAgentsMd(root, { maxLocalFiles: Number(readOption(args, '--max-local-files', 8)) }),
+            compileMistakeRules(root).catch((err) => ({ compiled: [], skipped: [`compile_failed:${err instanceof Error ? err.message : String(err)}`] }))
+        ]);
+        const output = { ...result, mistake_rules: rules };
+        if (flag(args, '--json'))
+            return console.log(JSON.stringify(output, null, 2));
+        console.log(`SKS memory build: ${result.ok ? 'ok' : result.reason}`);
+        for (const file of result.written)
+            console.log(`- ${file}`);
+        console.log(`- mistake rules compiled: ${rules.compiled.length}, skipped: ${rules.skipped.length}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return output;
+    }
     return gcCommand(args || []);
 }
 export async function gcCommand(args = []) {
@@ -16,6 +36,13 @@ export async function gcCommand(args = []) {
     for (const a of res.actions.slice(0, 20))
         console.log(`- ${a.action} ${a.path || a.mission || ''} ${a.bytes ? formatBytes(a.bytes) : ''}`);
 }
+function readOption(args = [], name, fallback = null) {
+    const index = args.indexOf(name);
+    if (index >= 0 && args[index + 1] && !String(args[index + 1]).startsWith('--'))
+        return args[index + 1];
+    const prefixed = args.find((arg) => String(arg).startsWith(`${name}=`));
+    return prefixed ? String(prefixed).slice(name.length + 1) : fallback;
+}
 export async function statsCommand(args = []) {
     const root = await sksRoot();
     const report = await storageReport(root);

package/dist/core/commands/goal-command.js

@@ -6,6 +6,7 @@ import { GOAL_BRIDGE_ARTIFACT, GOAL_WORKFLOW_ARTIFACT, updateGoalWorkflow, write
 import { flag, promptOf, resolveMissionId } from './command-utils.js';
 import { compileGoalToLoopPlan } from '../loops/goal-to-loop-compat.js';
 import { runLoopPlan } from '../loops/loop-runtime.js';
+import { evaluateLocalGate } from './route-success-helpers.js';
 export async function goalCommand(sub, args = []) {
     const known = new Set(['create', 'pause', 'resume', 'clear', 'status', 'help', '--help', '-h']);
     const action = known.has(sub) ? sub : 'create';
@@ -39,10 +40,16 @@ async function goalCreate(args) {
     const workflow = await writeGoalWorkflow(dir, mission, { action: 'create', prompt });
     const plan = await compileGoalToLoopPlan({ root, missionId: id, goalText: prompt, legacyGoalOptions: { native_goal: workflow.native_goal } });
     const result = await runLoopPlan({ root, plan, parallelism: 'balanced' });
-    await setCurrent(root, { mission_id: id, mode: 'GOAL', route: 'Goal', route_command: '$Goal', phase: result.ok ? 'GOAL_LOOP_COMPLETED' : 'GOAL_LOOP_BLOCKED', questions_allowed: true, implementation_allowed: true, native_goal: workflow.native_goal, stop_gate: 'loop-graph-proof.json' }, { replace: true });
+    const gate = await evaluateLocalGate({ root, missionId: id, gateFile: 'loop-graph-proof.json' });
+    const ok = result.ok === true && gate.ok === true;
+    await setCurrent(root, { mission_id: id, mode: 'GOAL', route: 'Goal', route_command: '$Goal', phase: ok ? 'GOAL_LOOP_COMPLETED' : 'GOAL_LOOP_BLOCKED', questions_allowed: true, implementation_allowed: true, native_goal: workflow.native_goal, stop_gate: 'loop-graph-proof.json', stop_gate_blockers: gate.blockers }, { replace: true });
+    if (!ok)
+        process.exitCode = 1;
     if (flag(args, '--json'))
-        return console.log(JSON.stringify({ schema: 'sks.goal-create.v1', ok: result.ok, mission_id: id, workflow, loop_plan: plan, loop_result: result }, null, 2));
+        return console.log(JSON.stringify({ schema: 'sks.goal-create.v1', ok, mission_id: id, workflow, loop_plan: plan, loop_result: result, gate }, null, 2));
     console.log(`Goal compiled to Loop Graph: ${id}`);
+    if (!ok)
+        console.log(`Gate blocked: ${gate.blockers.join(', ') || 'loop_result_not_ok'}`);
     console.log('Use `sks loop status latest` to inspect.');
     console.log(`Artifact: ${path.relative(root, path.join(dir, GOAL_WORKFLOW_ARTIFACT))}`);
     console.log(`Bridge: ${path.relative(root, path.join(dir, GOAL_BRIDGE_ARTIFACT))}`);