sneakoscope 4.8.7 → 5.3.0

package/dist/core/db-safety.js

@@ -609,8 +609,8 @@ export function dbBlockReason(decision) {
     return [
         'Sneakoscope Codex Database Safety Gate blocked this operation.',
         `Reasons: ${(decision.reasons || []).join(', ') || 'unknown'}.`,
-        'Default DB mode is read-only. Destructive SQL-plane operations require an explicit active MadDB v2 capability opened by $MAD-DB or sks mad-db run|exec|apply-migration.',
-        'Use read-only/project-scoped Supabase MCP URLs outside MadDB. Supabase project/account/billing/credential control-plane operations remain denied even in MadDB.'
+        'Default DB mode is read-only. Destructive SQL-plane operations require an explicit active MAD-SKS sql-plane capability opened by $MAD-SKS/sks mad-sks sql|apply-migration or the deprecated $MAD-DB/sks mad-db redirect.',
+        'Use read-only/project-scoped Supabase MCP URLs outside MAD-SKS sql-plane. Supabase project/account/billing/credential control-plane operations remain denied even there.'
     ].join(' ');
 }
 export async function scanDbSafety(root, opts = {}) {

package/dist/core/doctor/doctor-dirty-planner.js

@@ -1,8 +1,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js';
 import { PACKAGE_VERSION, packageRoot, sha256 } from '../fsx.js';
 import { hashJson } from '../triwiki/triwiki-cache-key.js';
+import { SKS_MENUBAR_LABEL, sksMenuBarPaths } from '../codex-app/sks-menubar.js';
 export const DOCTOR_DIRTY_PLAN_SCHEMA = 'sks.doctor-dirty-plan.v2';
 export function planDoctorDirtyRepair(root, phaseIds) {
     const phases = phaseIds.map((id) => {
@@ -10,25 +12,30 @@ export function planDoctorDirtyRepair(root, phaseIds) {
         const inputHash = phaseInputHash(root, id);
         const postcheckRequired = phaseRequiresPostcheck(id);
         const markerState = readMarker(marker);
+        const runtimeProbeFailed = runtimeProbeFailures(root, id);
         if (!markerState)
-            return { id, status: 'dirty', reason: 'no_clean_marker', input_hash: inputHash, last_clean_proof_id: null, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'no_clean_marker', input_hash: inputHash, last_clean_proof_id: null, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         if (markerState.input_hash !== inputHash) {
-            return { id, status: 'dirty', reason: 'input_hash_changed', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'input_hash_changed', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         }
         if (markerState.proof_id && !proofExists(root, markerState.proof_id)) {
-            return { id, status: 'dirty', reason: 'clean_proof_missing', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'clean_proof_missing', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         }
         if (!markerState.repair_applied) {
-            return { id, status: 'dirty', reason: 'repair_not_applied', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false };
+            return { id, status: 'dirty', reason: 'repair_not_applied', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
+        }
+        if (runtimeProbeFailed.length) {
+            return { id, status: 'dirty', reason: `runtime_probe_failed:${runtimeProbeFailed.join(',')}`, input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired, postcheck_pending: false, runtime_probe_failed: runtimeProbeFailed };
         }
         return {
             id,
-            status: 'clean',
+            status: markerState.postcheck_pending ? 'dirty' : 'clean',
             reason: postcheckRequired && markerState.postcheck_pending ? 'matching_repair_marker_postcheck_pending' : 'matching_clean_proof',
             input_hash: inputHash,
             last_clean_proof_id: markerState.proof_id,
             postcheck_required: postcheckRequired,
-            postcheck_pending: postcheckRequired && markerState.postcheck_pending
+            postcheck_pending: postcheckRequired && markerState.postcheck_pending,
+            runtime_probe_failed: []
         };
     });
     const plan = {
@@ -37,6 +44,7 @@ export function planDoctorDirtyRepair(root, phaseIds) {
         phases,
         dirty_count: phases.filter((phase) => phase.status === 'dirty').length,
         clean_count: phases.filter((phase) => phase.status === 'clean').length,
+        runtime_probe_failed: phases.flatMap((phase) => phase.runtime_probe_failed.map((failure) => `${phase.id}:${failure}`)),
         semantic_dirty_plan_path: dirtyPlanPath(root)
     };
     writeDirtyPlan(root, plan);
@@ -236,7 +244,43 @@ function proofExists(root, proofId) {
     }
 }
 function phaseRequiresPostcheck(id) {
-    return /zellij|context7|startup|supabase|native|secret/i.test(id);
+    return /zellij|context7|startup|supabase|native|secret|menubar/i.test(id);
+}
+function runtimeProbeFailures(root, id) {
+    if (!id.includes('menubar') || process.platform !== 'darwin')
+        return [];
+    const failures = [];
+    const paths = sksMenuBarPaths(process.env.HOME, root);
+    if (!fs.existsSync(paths.executable_path))
+        failures.push('menubar_app_missing');
+    if (!fs.existsSync(paths.action_script_path))
+        failures.push('action_script_missing');
+    else {
+        try {
+            fs.accessSync(paths.action_script_path, fs.constants.X_OK);
+        }
+        catch {
+            failures.push('action_script_not_executable');
+        }
+    }
+    const launchctl = process.env.SKS_MENUBAR_LAUNCHCTL || '/bin/launchctl';
+    if (!fs.existsSync(launchctl)) {
+        failures.push('launchctl_missing');
+        return failures;
+    }
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const service = `${uid === null ? 'gui' : `gui/${uid}`}/${SKS_MENUBAR_LABEL}`;
+    const result = spawnSync(launchctl, ['print', service], {
+        encoding: 'utf8',
+        timeout: 500,
+        maxBuffer: 32 * 1024
+    });
+    const text = `${result.stdout || ''}\n${result.stderr || ''}`;
+    if (result.error)
+        failures.push(`launchctl_probe_error:${result.error.message}`);
+    else if (result.status !== 0 || !(/\bstate = running\b|\bpid = \d+\b/.test(text)))
+        failures.push('launchd_not_running');
+    return failures;
 }
 function writeDirtyPlan(root, plan) {
     const file = dirtyPlanPath(root);

package/dist/core/doctor/doctor-transaction.js

@@ -1,14 +1,18 @@
 import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { isDoctorPhaseClean, markDoctorPhaseClean } from './doctor-dirty-planner.js';
+import { ui as cliUi } from '../../cli/cli-theme.js';
 export async function runDoctorFixTransaction(input) {
     const startedAt = nowIso();
     const phases = [];
     const proofIdsUsed = [];
     let rollbackPerformed = false;
+    const liveOutput = input.json !== true && input.machineOnly !== true;
     for (const definition of input.phases) {
         const phaseStarted = nowIso();
         const startedMs = Date.now();
+        if (liveOutput)
+            cliUi.step(`▸ ${definition.id} ...`);
         let phase = {
             id: definition.id,
             ok: false,
@@ -32,6 +36,8 @@ export async function runDoctorFixTransaction(input) {
                 completed_at: nowIso(),
                 duration_ms: Math.max(0, Date.now() - startedMs)
             });
+            if (liveOutput)
+                cliUi.step(`✔ ${definition.id} (${Math.round((Date.now() - startedMs) / 1000)}s)`);
             continue;
         }
         try {
@@ -71,6 +77,8 @@ export async function runDoctorFixTransaction(input) {
             proofIdsUsed.push(proofId);
         }
         phases.push(phase);
+        if (liveOutput)
+            cliUi.step(`${phase.ok ? '✔' : '✖'} ${definition.id} (${Math.round((phase.duration_ms || 0) / 1000)}s)`);
     }
     const writeInput = {
         root: input.root,

package/dist/core/doctor/doctor-zellij-repair.js

@@ -10,6 +10,7 @@ export async function runDoctorZellijRepair(input) {
         autoApprove: args.includes('--yes') || args.includes('-y'),
         installHomebrew: args.includes('--install-homebrew') || process.env.SKS_ALLOW_HOMEBREW_INSTALL === '1',
         dryRun: args.includes('--dry-run'),
+        quiet: args.includes('--json') || args.includes('--machine-only'),
         interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY && process.env.SKS_NO_QUESTION !== '1'),
         allowHeadlessFallback: false,
         env: process.env

package/dist/core/doctor/imagegen-repair.js

@@ -0,0 +1,161 @@
+import path from 'node:path';
+import { CODEX_APP_IMAGE_GENERATION_DOC_URL } from '../routes.js';
+import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
+import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
+export const DOCTOR_IMAGEGEN_REPAIR_SCHEMA = 'sks.doctor-imagegen-repair.v1';
+export async function repairCodexImagegen(input) {
+    const root = path.resolve(input.root || process.cwd());
+    const apply = input.apply === true;
+    const steps = [];
+    const before = await detectImagegenCapability({
+        codexBin: input.codexBin || undefined,
+        timeoutMs: input.timeoutMs || 5000
+    }).catch((err) => ({ ok: false, core_ready: false, blockers: [messageOf(err)], codex_app: { available: false, blocker: messageOf(err) } }));
+    let codexBin = input.codexBin || await which('codex').catch(() => null);
+    let versionStep;
+    if (codexBin) {
+        const version = await runProcess(codexBin, ['--version'], { timeoutMs: input.timeoutMs || 5000, maxOutputBytes: 16 * 1024 })
+            .catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+        versionStep = {
+            id: 'codex_cli_version',
+            ok: version.code === 0,
+            attempted: true,
+            command: `${codexBin} --version`,
+            exit_code: version.code,
+            stdout_tail: tail(version.stdout),
+            stderr_tail: tail(version.stderr),
+            blocker: version.code === 0 ? null : 'codex_cli_version_failed'
+        };
+    }
+    else {
+        versionStep = {
+            id: 'codex_cli_version',
+            ok: false,
+            attempted: false,
+            command: 'codex --version',
+            blocker: 'codex_binary_missing'
+        };
+    }
+    steps.push(versionStep);
+    if (!codexBin && apply && (input.autoInstallCodex === true || process.env.SKS_IMAGEGEN_AUTO_INSTALL_CODEX === '1')) {
+        const npmBin = await which('npm').catch(() => null);
+        if (npmBin) {
+            const install = await runProcess(npmBin, ['i', '-g', '@openai/codex@latest'], {
+                timeoutMs: 180000,
+                maxOutputBytes: 128 * 1024
+            }).catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+            steps.push({
+                id: 'codex_cli_install',
+                ok: install.code === 0,
+                attempted: true,
+                command: `${npmBin} i -g @openai/codex@latest`,
+                exit_code: install.code,
+                stdout_tail: tail(install.stdout),
+                stderr_tail: tail(install.stderr),
+                blocker: install.code === 0 ? null : 'codex_cli_install_failed'
+            });
+            codexBin = await which('codex').catch(() => null);
+        }
+        else {
+            steps.push({
+                id: 'codex_cli_install',
+                ok: false,
+                attempted: false,
+                command: 'npm i -g @openai/codex@latest',
+                blocker: 'npm_missing'
+            });
+        }
+    }
+    else if (!codexBin) {
+        steps.push({
+            id: 'codex_cli_install',
+            ok: false,
+            attempted: false,
+            command: 'npm i -g @openai/codex@latest',
+            blocker: apply ? 'auto_install_requires_SKS_IMAGEGEN_AUTO_INSTALL_CODEX_1' : 'doctor_fix_not_requested'
+        });
+    }
+    if (codexBin && before?.core_ready !== true && apply) {
+        const enable = await runProcess(codexBin, ['features', 'enable', 'image_generation'], {
+            timeoutMs: input.timeoutMs || 10000,
+            maxOutputBytes: 32 * 1024
+        }).catch((err) => ({ code: 1, stdout: '', stderr: messageOf(err) }));
+        steps.push({
+            id: 'image_generation_feature_enable',
+            ok: enable.code === 0,
+            attempted: true,
+            command: `${codexBin} features enable image_generation`,
+            exit_code: enable.code,
+            stdout_tail: tail(enable.stdout),
+            stderr_tail: tail(enable.stderr),
+            blocker: enable.code === 0 ? null : 'codex_feature_enable_unsupported_or_failed'
+        });
+    }
+    else {
+        steps.push({
+            id: 'image_generation_feature_enable',
+            ok: before?.core_ready === true,
+            attempted: false,
+            command: codexBin ? `${codexBin} features enable image_generation` : 'codex features enable image_generation',
+            blocker: before?.core_ready === true ? null : apply ? 'codex_cli_missing' : 'doctor_fix_not_requested'
+        });
+    }
+    const after = await detectImagegenCapability({
+        codexBin: codexBin || undefined,
+        timeoutMs: input.timeoutMs || 5000
+    }).catch((err) => ({ ok: false, core_ready: false, blockers: [messageOf(err)], codex_app: { available: false, blocker: messageOf(err) } }));
+    steps.push({
+        id: 'imagegen_capability_redetect',
+        ok: after?.core_ready === true,
+        attempted: true,
+        command: 'codex features list --json',
+        blocker: after?.core_ready === true ? null : 'codex_app_builtin_imagegen_capability_missing'
+    });
+    const recovered = after?.core_ready === true;
+    const blockers = recovered ? [] : [
+        ...new Set([
+            ...(after?.core_blockers || []),
+            ...(after?.blockers || []),
+            'codex_imagegen_unavailable'
+        ].map(String))
+    ];
+    let report = {
+        schema: DOCTOR_IMAGEGEN_REPAIR_SCHEMA,
+        generated_at: nowIso(),
+        ok: recovered,
+        attempted: before?.core_ready !== true,
+        apply,
+        recovered,
+        before,
+        after,
+        steps,
+        blockers,
+        manual_actions: recovered ? [] : [
+            `Install/update Codex CLI if missing: npm i -g @openai/codex@latest`,
+            `Open Codex App settings and enable image_generation / $imagegen.`,
+            `Verify with: codex features list --json`,
+            `Docs: ${CODEX_APP_IMAGE_GENERATION_DOC_URL}`
+        ],
+        docs_url: CODEX_APP_IMAGE_GENERATION_DOC_URL
+    };
+    if (input.reportPath !== null) {
+        const reportPath = input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-imagegen-repair.json');
+        try {
+            await ensureDir(path.dirname(reportPath));
+            await writeJsonAtomic(reportPath, report);
+            report = { ...report, report_path: reportPath };
+        }
+        catch (err) {
+            report = { ...report, report_write_failed: true, report_write_error: messageOf(err) };
+        }
+    }
+    return report;
+}
+function tail(value, max = 2000) {
+    const text = String(value || '');
+    return text.length > max ? text.slice(-max) : text;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=imagegen-repair.js.map

package/dist/core/feature-fixture-runner.js

@@ -181,7 +181,7 @@ function inspectExpectedArtifact(root, tempRoot, artifact, ctx = {}) {
         return { ...result, failure: 'json_parse' };
     }
     if (schema === 'sks.completion-proof.v1')
-        return { ...result, schema_ok: parsed.schema === schema, content_ok: ['verified', 'verified_partial', 'blocked'].includes(parsed.status), status: parsed.status };
+        return { ...result, schema_ok: parsed.schema === schema, content_ok: ['verified', 'verified_partial', 'mock_only', 'blocked'].includes(parsed.status), status: parsed.status };
     if (schema === 'sks.image-voxel-ledger.v1') {
         const anchorCount = Array.isArray(parsed.anchors) ? parsed.anchors.length : 0;
         const relationCount = Array.isArray(parsed.relations) ? parsed.relations.length : 0;
@@ -241,7 +241,7 @@ function renderFeatureFixtureMarkdown(report = {}) {
 }
 export function validateCompletionProofArtifact(file) {
     const proof = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return proof.schema === 'sks.completion-proof.v1' && ['verified', 'verified_partial', 'blocked'].includes(proof.status);
+    return proof.schema === 'sks.completion-proof.v1' && ['verified', 'verified_partial', 'mock_only', 'blocked'].includes(proof.status);
 }
 export function validateImageVoxelArtifact(file, { requireAnchors = true, requireRelations = false } = {}) {
     const ledger = JSON.parse(fs.readFileSync(file, 'utf8'));

package/dist/core/feature-fixtures.js

@@ -2,7 +2,7 @@ import { PACKAGE_VERSION } from './fsx.js';
 export const FEATURE_FIXTURE_SCHEMA = 'sks.feature-fixtures.v1';
 export const FEATURE_QUALITY_LEVELS = Object.freeze([
     'runtime_verified',
-    'runtime_mock_verified',
+    'wiring_only',
     'integration_optional',
     'static_contract',
     'missing'
@@ -12,21 +12,31 @@ const FIXTURES = Object.freeze({
     'cli-version': fixture('execute', 'sks --version', [], 'pass'),
     'cli-root': fixture('execute', 'sks root --json', [], 'pass'),
     'cli-doctor': fixture('real_optional', 'sks doctor --json', [], 'pass'),
+    'doctor:imagegen-repair': fixture('execute_and_validate_artifacts', 'sks doctor --json', [{ path: '.sneakoscope/reports/feature-fixtures/doctor-imagegen-repair.json', schema: 'sks.doctor-imagegen-repair.v1', optional: true }], 'pass', {
+        quality: 'runtime_verified',
+        validates_json_fields: ['imagegen_repair', 'repair.imagegen']
+    }),
     'cli-paths': fixture('execute_and_validate_artifacts', 'sks paths managed --json', ['.sneakoscope/managed-paths.json'], 'pass'),
     'cli-rollback': fixture('execute', 'sks rollback list --json', [], 'pass'),
     'cli-setup': fixture('real_optional', 'sks setup --json --local-only', [], 'pass'),
     'cli-codex': fixture('execute', 'sks codex compatibility --json', [], 'pass'),
     'cli-codex-app': fixture('real_optional', 'sks codex-app check --json', [], 'pass'),
     'cli-codex-lb': fixture('execute_and_validate_artifacts', 'sks codex-lb metrics --json', [], 'pass'),
-    'cli-hooks': fixture('mock', 'sks hooks trust-report --json', [], 'pass'),
+    'cli-hooks': fixture('execute', 'sks hooks trust-report --json', [], 'pass'),
     'cli-features': fixture('execute', 'sks features check --json', [], 'pass'),
     'cli-commands': fixture('execute', 'sks commands --json', [], 'pass'),
     'cli-check': fixture('execute', 'sks check --tier confidence --sla 5m --plan --json', [], 'pass'),
+    'cli-plan': fixture('execute', 'sks plan "fixture" --json', [], 'pass'),
+    'cli-review': fixture('execute', 'sks review --diff HEAD --json', [], 'pass'),
+    'cli-ui': fixture('static', 'sks ui [--port 4477] [--mission latest] [--once] [--json]', [], 'pass', {
+        quality: 'static_contract',
+        reason: 'UI command opens a localhost dashboard; release fixture tracks the CLI contract without launching a server.'
+    }),
     'cli-run': fixture('execute_and_validate_artifacts', 'sks run "fixture" --mock --json', ['run-classification.json', 'completion-proof.json', 'evidence-index.json', 'route-completion-contract.json', 'trust-report.json'], 'pass'),
     'cli-status': fixture('execute', 'sks status --json', [], 'pass'),
     'cli-usage': fixture('execute', 'sks usage overview', [], 'pass'),
     'cli-quickstart': fixture('execute', 'sks quickstart', [], 'pass'),
-    'cli-update': fixture('mock', 'sks update now --dry-run --json', [], 'pass'),
+    'cli-update': fixture('execute', 'sks update now --dry-run --json', [], 'pass'),
     'cli-update-check': fixture('static', 'sks update-check --json', [], 'pass'),
     'cli-guard': fixture('execute', 'sks guard check --json', [], 'pass'),
     'cli-conflicts': fixture('execute', 'sks conflicts check --json', [], 'pass'),
@@ -35,20 +45,21 @@ const FIXTURES = Object.freeze({
     'cli-fix-path': fixture('execute', 'sks fix-path --json', [], 'pass'),
     'cli-selftest': fixture('execute', 'sks selftest --mock', [], 'pass'),
     'cli-git': fixture('execute', 'sks git policy --json', [], 'pass'),
-    'cli-goal': fixture('mock', 'sks goal status latest --json', ['goal-workflow.json'], 'pass'),
+    'cli-uninstall': fixture('execute', 'sks uninstall --dry-run --json', [], 'pass'),
+    'cli-goal': fixture('execute_and_validate_artifacts', 'sks goal status latest --json', ['goal-workflow.json'], 'pass'),
     'cli-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode seo --json', ['search-visibility/site-inventory.json', 'search-visibility/seo-findings.json', 'search-visibility/verification-report.json', 'seo-gate.json', 'completion-proof.json'], 'pass'),
-    'cli-research': fixture('mock', 'sks research status latest --json', ['research-gate.json', 'completion-proof.json'], 'pass'),
-    'cli-qa-loop': fixture('mock', 'sks qa-loop status latest --json', ['qa-loop-proof.json', 'completion-proof.json'], 'pass'),
-    'cli-ppt': fixture('mock', 'sks ppt fixture --mock --json', ['ppt-imagegen-review-gate.json', 'completion-proof.json'], 'pass'),
-    'cli-image-ux-review': fixture('mock', 'sks image-ux-review status latest --json', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
+    'cli-research': fixture('execute_and_validate_artifacts', 'sks research status latest --json', ['research-gate.json', 'completion-proof.json'], 'pass'),
+    'cli-qa-loop': fixture('execute_and_validate_artifacts', 'sks qa-loop status latest --json', ['qa-loop-proof.json', 'completion-proof.json'], 'pass'),
+    'cli-ppt': fixture('execute_and_validate_artifacts', 'sks ppt fixture --mock --json', ['ppt-imagegen-review-gate.json', 'completion-proof.json'], 'pass'),
+    'cli-image-ux-review': fixture('execute_and_validate_artifacts', 'sks image-ux-review status latest --json', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
     'cli-computer-use': fixture('real_optional', 'sks computer-use status --json', [], 'pass'),
-    'cli-pipeline': fixture('mock', 'sks pipeline status latest --json', ['pipeline-plan.json'], 'pass'),
-    'cli-validate-artifacts': fixture('mock', 'sks validate-artifacts latest --json', ['validation-report.json'], 'pass'),
-    'cli-hproof': fixture('mock', 'sks hproof check latest', ['completion-proof.json'], 'pass'),
+    'cli-pipeline': fixture('execute_and_validate_artifacts', 'sks pipeline status latest --json', ['pipeline-plan.json'], 'pass'),
+    'cli-validate-artifacts': fixture('execute_and_validate_artifacts', 'sks validate-artifacts latest --json', ['validation-report.json'], 'pass'),
+    'cli-hproof': fixture('execute_and_validate_artifacts', 'sks hproof check latest', ['completion-proof.json'], 'pass'),
     'cli-proof-field': fixture('execute', 'sks proof-field scan --json --intent fixture', [], 'pass'),
-    'cli-recallpulse': fixture('mock', 'sks recallpulse status latest --json', ['recallpulse-report.json'], 'pass'),
+    'cli-recallpulse': fixture('execute_and_validate_artifacts', 'sks recallpulse status latest --json', ['recallpulse-report.json'], 'pass'),
     'cli-agent': fixture('execute_and_validate_artifacts', 'sks agent run fixture --mock --json', ['agents/agent-central-ledger.json', 'agents/agent-task-board.json', 'agents/agent-leases.json', 'agents/agent-no-overlap-proof.json', 'agents/agent-session-cleanup.json', 'agents/agent-proof-evidence.json', 'agents/agent-effort-policy.json'], 'pass'),
-    'cli-gx': fixture('mock', 'sks gx validate fixture', ['gx-validation.json'], 'pass'),
+    'cli-gx': fixture('execute_and_validate_artifacts', 'sks gx validate fixture', ['gx-validation.json'], 'pass'),
     'cli-perf': fixture('execute', 'sks perf cold-start --json --iterations 1', [], 'pass'),
     'cli-bench': fixture('execute_and_validate_artifacts', 'sks bench core --tier npx-one-shot --json --iterations 1', ['.sneakoscope/reports/performance/core-bench.json'], 'pass'),
     'cli-code-structure': fixture('execute', 'sks code-structure scan --json', [], 'pass'),
@@ -63,16 +74,16 @@ const FIXTURES = Object.freeze({
     'cli-dfix': fixture('execute_and_validate_artifacts', 'sks dfix fixture --json', ['completion-proof.json', 'dfix-gate.json', 'dfix-verification.json'], 'pass'),
     'cli-wiki': fixture('execute_and_validate_artifacts', 'sks wiki image-ingest test/fixtures/images/one-by-one.png --json', [{ path: '.sneakoscope/wiki/image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1', require_anchors: false }], 'pass'),
     'cli-db': fixture('execute', 'sks db policy', [], 'pass'),
-    'cli-wizard': fixture('mock', 'sks wizard', [], 'pass'),
-    'cli-bootstrap': fixture('mock', 'sks bootstrap --dry-run', [], 'pass'),
-    'cli-deps': fixture('mock', 'sks deps check --json', [], 'pass'),
-    'cli-auth': fixture('mock', 'sks auth status --json', [], 'pass'),
-    'cli-codex-native': fixture('mock', 'sks codex-native status --json', [], 'pass'),
+    'cli-wizard': fixture('execute', 'sks wizard', [], 'pass'),
+    'cli-bootstrap': fixture('execute', 'sks bootstrap --dry-run', [], 'pass'),
+    'cli-deps': fixture('execute', 'sks deps check --json', [], 'pass'),
+    'cli-auth': fixture('execute', 'sks auth status --json', [], 'pass'),
+    'cli-codex-native': fixture('execute', 'sks codex-native status --json', [], 'pass'),
     'cli-zellij': fixture('mock', 'npm run zellij:capability --silent', [], 'pass'),
     'cli-tmux': fixture('mock', 'removed runtime migration notice: sks tmux --json', [], 'pass'),
-    'cli-mad': fixture('mock', 'sks mad --help', [], 'pass'),
+    'cli-mad': fixture('execute', 'sks mad --help', [], 'pass'),
     'cli-mad-sks': fixture('static', 'sks mad-sks status --json', [], 'pass'),
-    'cli-auto-review': fixture('mock', 'sks auto-review status --json', [], 'pass'),
+    'cli-auto-review': fixture('execute', 'sks auto-review status --json', [], 'pass'),
     'cli-commit': fixture('mock', 'sks commit --dry-run', [], 'pass'),
     'cli-commit-and-push': fixture('mock', 'sks commit-and-push --dry-run', [], 'pass'),
     'cli-context7': fixture('real_optional', 'sks context7 check --json', [], 'pass'),
@@ -80,29 +91,39 @@ const FIXTURES = Object.freeze({
     'cli-ultra-search': fixture('execute', 'sks ultra-search doctor --json', [], 'pass'),
     'cli-xai': fixture('real_optional', 'sks xai check --json', [], 'pass'),
     'cli-task': fixture('execute', 'sks task instant --plan --json', [], 'pass'),
-    'cli-release': fixture('mock', 'sks release affected --json', [], 'pass'),
+    'cli-release': fixture('execute', 'sks release affected --json', [], 'pass'),
     'cli-triwiki': fixture('execute', 'sks triwiki index --json', [], 'pass'),
     'cli-daemon': fixture('execute', 'sks daemon status --json', [], 'pass'),
-    'cli-all-features': fixture('mock', 'sks all-features complete --json', [`.sneakoscope/reports/all-feature-completion-${PACKAGE_VERSION}.json`], 'pass'),
-    'cli-init': fixture('mock', 'sks init --local-only --dry-run', [], 'pass'),
-    'cli-eval': fixture('mock', 'sks eval run --mock --json', [], 'pass'),
-    'cli-harness': fixture('mock', 'sks harness fixture --mock --json', [], 'pass'),
-    'cli-naruto': fixture('mock', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['completion-proof.json', 'naruto-gate.json'], 'pass'),
-    'cli-team': fixture('mock', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json'], 'pass'),
-    'cli-reasoning': fixture('mock', 'sks reasoning status --json', [], 'pass'),
-    'cli-profile': fixture('mock', 'sks profile status --json', [], 'pass'),
-    'skill-db-safety-guard': fixture('mock', 'sks db check --sql "SELECT 1" --json', ['db-operation-report.json', 'completion-proof.json'], 'pass'),
-    'skill-honest-mode': fixture('mock', 'sks proof smoke --json', ['completion-proof.json', 'trust-report.json'], 'pass'),
-    'skill-imagegen': fixture('mock', 'sks image-ux-review fixture --mock --json', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
-    'skill-gx-visual-validate': fixture('mock', 'sks gx validate fixture --mock --json', ['gx-validation.json'], 'pass'),
+    'cli-all-features': fixture('execute_and_validate_artifacts', 'sks all-features complete --json', [`.sneakoscope/reports/all-feature-completion-${PACKAGE_VERSION}.json`], 'pass'),
+    'cli-init': fixture('execute', 'sks init --local-only --dry-run', [], 'pass'),
+    'cli-eval': fixture('execute', 'sks eval run --mock --json', [], 'pass'),
+    'cli-harness': fixture('execute', 'sks harness fixture --mock --json', [], 'pass'),
+    'cli-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['completion-proof.json', 'naruto-gate.json'], 'pass'),
+    'cli-team': fixture('execute_and_validate_artifacts', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json'], 'pass'),
+    'cli-reasoning': fixture('execute', 'sks reasoning status --json', [], 'pass'),
+    'cli-profile': fixture('execute', 'sks profile status --json', [], 'pass'),
+    'skill-db-safety-guard': fixture('execute_and_validate_artifacts', 'sks db check --sql "SELECT 1" --json', ['db-operation-report.json', 'completion-proof.json'], 'pass'),
+    'skill-honest-mode': fixture('execute_and_validate_artifacts', 'sks proof smoke --json', ['completion-proof.json', 'trust-report.json'], 'pass'),
+    'skill-imagegen': fixture('execute_and_validate_artifacts', 'sks image-ux-review fixture --mock --json', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
+    'ux-review:run-wires-imagegen': fixture('execute_and_validate_artifacts', 'npm run ux-review:run-wires-imagegen --silent', [{ path: 'image-ux-review-gate.json', schema: 'sks.image-ux-review-gate.v2', optional: true }], 'pass', {
+        validates_source_contracts: ['requireCodexImagegen', 'generateGptImage2CalloutReview', 'evidence_class', 'output_sha256']
+    }),
+    'ppt:real-imagegen-wiring': fixture('execute_and_validate_artifacts', 'npm run ppt:real-imagegen-wiring --silent', [{ path: 'ppt-imagegen-review-gate.json', schema: 'sks.ppt-imagegen-review-gate.v1', optional: true }], 'pass', {
+        validates_source_contracts: ['generateGptImage2CalloutReview', 'buildSlideImagegenEvidence', 'imagegen_evidence']
+    }),
+    'skill-gx-visual-validate': fixture('execute_and_validate_artifacts', 'sks gx validate fixture --mock --json', ['gx-validation.json'], 'pass'),
     'skill-context7-docs': fixture('real_optional', 'sks context7 check --json', [], 'pass'),
-    'skill-seo-geo-optimizer': fixture('mock', 'sks seo-geo-optimizer fixture --mode geo --json', ['search-visibility/site-inventory.json', 'search-visibility/geo-findings.json', 'geo-gate.json', 'completion-proof.json'], 'pass'),
+    'skill-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode geo --json', ['search-visibility/site-inventory.json', 'search-visibility/geo-findings.json', 'geo-gate.json', 'completion-proof.json'], 'pass'),
     'cli-proof': fixture('execute_and_validate_artifacts', 'sks proof smoke --json', ['.sneakoscope/proof/latest.json'], 'pass'),
     'cli-trust': fixture('execute_and_validate_artifacts', 'sks trust report latest --json', ['trust-report.json'], 'pass'),
     'cli-wrongness': fixture('execute_and_validate_artifacts', 'sks wrongness add --kind missing_evidence --claim "fixture wrongness" --json', ['.sneakoscope/wiki/wrongness-ledger.json'], 'pass'),
     'route-team': fixture('execute_and_validate_artifacts', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json'], 'pass'),
     'route-team-alias': fixture('execute_and_validate_artifacts', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json'], 'pass'),
     'route-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --clones 4 --backend fake --work-items 4 --json', ['agents/agent-proof-evidence.json', 'agents/agent-scheduler-state.json'], 'pass'),
+    'route-work': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['completion-proof.json', 'naruto-gate.json'], 'pass'),
+    'route-swarm': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['completion-proof.json', 'naruto-gate.json'], 'pass'),
+    'route-plan': fixture('execute', 'sks plan "fixture" --json', [], 'pass'),
+    'route-review': fixture('execute', 'sks review --diff HEAD --json', [], 'pass'),
     'route-shadowclone': fixture('mock', '$ShadowClone alias of $Naruto shadow-clone swarm route', [], 'pass'),
     'route-kagebunshin': fixture('mock', '$Kagebunshin alias of $Naruto shadow-clone swarm route', [], 'pass'),
     'route-qa-loop': fixture('execute_and_validate_artifacts', 'sks qa-loop run latest --mock --json', ['completion-proof.json', 'qa-gate.json'], 'pass'),
@@ -120,11 +141,11 @@ const FIXTURES = Object.freeze({
     'route-ultrasearch': fixture('execute', 'sks run "$UltraSearch source intelligence fixture" --execute --json', [], 'pass'),
     'route-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode geo --json', ['search-visibility/site-inventory.json', 'search-visibility/geo-findings.json', 'search-visibility/verification-report.json', 'geo-gate.json', 'completion-proof.json'], 'pass'),
     'route-autoresearch': fixture('mock', '$AutoResearch fixture route', ['research-gate.json', 'completion-proof.json'], 'pass'),
-    'route-mad-sks': fixture('mock', '$MAD-SKS permission gate route', ['mad-sks-gate.json', 'completion-proof.json'], 'pass'),
+    'route-mad-sks': fixture('mock', '$MAD-SKS permission gate + sql_plane route', [{ path: 'mad-sks-gate.json', schema: 'sks.mad-sks-gate.v1' }, 'completion-proof.json'], 'pass'),
     'route-from-chat-img': fixture('mock', '$From-Chat-IMG visual work order route', ['from-chat-img-work-order.md', 'image-voxel-ledger.json', 'completion-proof.json'], 'pass'),
     'route-ux-review': fixture('mock', '$UX-Review image UX alias route', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
     'route-db': fixture('execute_and_validate_artifacts', 'sks db check --sql "SELECT 1" --json', ['completion-proof.json', 'db-operation-report.json'], 'pass'),
-    'route-mad-db': fixture('mock', '$MAD-DB one-cycle DB break-glass route contract', ['mad-db-capability.json', 'mad-db-ledger.jsonl', 'completion-proof.json'], 'pass'),
+    'route-mad-db': fixture('mock', '$MAD-DB deprecated alias to $MAD-SKS sql-plane contract', ['mad-sks-gate.json', 'completion-proof.json'], 'pass'),
     'route-wiki': fixture('execute_and_validate_artifacts', 'sks wiki image-ingest test/fixtures/images/one-by-one.png --json', [{ path: 'completion-proof.json', schema: 'sks.completion-proof.v1' }, { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }], 'pass'),
     'route-gx': fixture('execute_and_validate_artifacts', 'sks gx validate fixture --mock --json', ['completion-proof.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'gx-validation.json'], 'pass'),
     'route-sks': fixture('mock', '$SKS control-surface route', ['completion-proof.json'], 'pass'),
@@ -249,7 +270,7 @@ function qualityForKind(kind) {
     if (kind === 'execute' || kind === 'execute_and_validate_artifacts')
         return 'runtime_verified';
     if (kind === 'mock')
-        return 'runtime_mock_verified';
+        return 'wiring_only';
     if (kind === 'real_optional')
         return 'integration_optional';
     if (kind === 'not_available')