sneakoscope 4.8.7 → 5.3.0

package/dist/scripts/doctor-imagegen-repair-check.js

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-imagegen-repair-'));
+const stateFile = path.join(root, 'imagegen-enabled');
+const reportPath = path.join(root, 'doctor-imagegen-repair.json');
+const codexBin = path.join(root, 'codex');
+await fs.writeFile(codexBin, `#!/usr/bin/env node
+const fs = require('fs');
+const stateFile = ${JSON.stringify(stateFile)};
+const args = process.argv.slice(2).join(' ');
+if (args === '--version') {
+  console.log('codex-cli 99.0.0');
+  process.exit(0);
+}
+if (args === 'features enable image_generation') {
+  fs.writeFileSync(stateFile, '1');
+  console.log('enabled image_generation');
+  process.exit(0);
+}
+if (args === 'features list --json') {
+  const enabled = fs.existsSync(stateFile);
+  console.log(JSON.stringify({ features: { image_generation: enabled } }));
+  process.exit(0);
+}
+if (args === 'features list') {
+  const enabled = fs.existsSync(stateFile) ? 'true' : 'false';
+  console.log('image_generation stable ' + enabled);
+  process.exit(0);
+}
+console.error('unexpected fake codex args: ' + args);
+process.exit(64);
+`, { mode: 0o755 });
+const report = await repairCodexImagegen({
+    root,
+    apply: true,
+    codexBin,
+    reportPath,
+    timeoutMs: 1000
+});
+const reportFile = JSON.parse(await fs.readFile(reportPath, 'utf8'));
+const ok = report.schema === 'sks.doctor-imagegen-repair.v1'
+    && report.attempted === true
+    && report.recovered === true
+    && report.after?.core_ready === true
+    && report.steps?.some((step) => step.id === 'image_generation_feature_enable' && step.ok === true)
+    && reportFile.recovered === true;
+console.log(JSON.stringify({
+    schema: 'sks.doctor-imagegen-repair-check.v1',
+    ok,
+    repair_schema: report.schema,
+    attempted: report.attempted,
+    recovered: report.recovered,
+    after_core_ready: report.after?.core_ready === true,
+    report_path: reportPath
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=doctor-imagegen-repair-check.js.map

package/dist/scripts/ensure-bin-executable.js

@@ -4,7 +4,15 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const bin = path.join(root, 'dist', 'bin', 'sks.js');
-await fsp.chmod(bin, 0o755);
-console.log(`bin executable: ${path.relative(root, bin)}`);
+const bins = [
+    path.join(root, 'dist', 'bin', 'sks.js'),
+    path.join(root, 'dist', 'bin', 'install.js')
+];
+for (const bin of bins) {
+    await fsp.chmod(bin, 0o755).catch((err) => {
+        if (err?.code !== 'ENOENT')
+            throw err;
+    });
+    console.log(`bin executable: ${path.relative(root, bin)}`);
+}
 //# sourceMappingURL=ensure-bin-executable.js.map

package/dist/scripts/harness-benchmark-check.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { ensureDir, nowIso, runProcess, writeJsonAtomic } from '../core/fsx.js';
+import { reviewCommand } from '../core/commands/review-command.js';
+import { collectUiState } from '../core/commands/ui-command.js';
+import { simulateNarutoActivePool } from '../core/naruto/naruto-active-pool.js';
+import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
+import { buildNarutoWorkGraph } from '../core/naruto/naruto-work-graph.js';
+const reportPath = path.join(root, '.sneakoscope', 'reports', 'harness-benchmark.json');
+const metrics = [];
+metrics.push(await measure('install_entrypoint_readiness', 300000, async () => {
+    await assertFile('dist/bin/install.js');
+    await assertFile('plugins/sks/.codex-plugin/plugin.json');
+    return { mode: 'hermetic_readiness', command: 'npx sneakoscope install --yes' };
+}));
+metrics.push(await measure('stop_hook_light_budget', 25, async () => {
+    const started = performance.now();
+    await assertFile('dist/scripts/hook-latency-budget-check.js');
+    return { mode: 'script_presence_budget_proxy', measured_ms: performance.now() - started };
+}));
+metrics.push(await measure('swarm_14_worker_fixture', 20000, async () => {
+    const graph = buildNarutoWorkGraph({
+        requestedClones: 14,
+        totalWorkItems: 14,
+        honorExplicitTotalWorkItems: true,
+        readonly: true,
+        writeCapable: false,
+        maxActiveWorkers: 14
+    });
+    const governor = decideNarutoConcurrency({
+        requestedClones: 14,
+        totalWorkItems: 14,
+        pendingWorkQueueSize: 14,
+        backend: 'fake',
+        hardware: { remoteApiRateLimitBudget: 14, fileDescriptorLimit: 4096, freeMemoryBytes: 8 * 1024 * 1024 * 1024, totalMemoryBytes: 16 * 1024 * 1024 * 1024 }
+    });
+    const report = simulateNarutoActivePool({ graph, governor: { ...governor, safe_active_workers: 14 } });
+    return {
+        command: 'simulateNarutoActivePool --fake --clones 14',
+        ok: report.ok === true && report.completed_count >= 14 && report.max_observed_active_workers >= 7,
+        completed_count: report.completed_count,
+        max_observed_active_workers: report.max_observed_active_workers,
+        blockers: report.blockers
+    };
+}));
+metrics.push(await measure('review_10_file_diff', 120000, async () => {
+    const fixture = await makeReviewFixture();
+    const previousExitCode = process.exitCode;
+    const review = await reviewCommand(['--root', fixture]);
+    process.exitCode = previousExitCode;
+    return {
+        files: review?.files || 0,
+        machine_evidence: (review?.findings || []).filter((finding) => finding.evidence === 'machine').length,
+        verdict: review?.verdict || 'unknown'
+    };
+}));
+metrics.push(await measure('dashboard_first_state', 2000, async () => {
+    const state = await collectUiState(root, 'latest');
+    return { ok: state.ok === true, mission_id: state.mission_id || null, gates: Array.isArray(state.gates) ? state.gates.length : 0 };
+}));
+const report = {
+    schema: 'sks.harness-benchmark.v1',
+    generated_at: nowIso(),
+    ok: metrics.every((metric) => metric.ok),
+    metrics,
+    report_path: path.relative(root, reportPath)
+};
+await writeJsonAtomic(reportPath, report);
+assertGate(report.ok, 'harness benchmark check failed', report);
+emitGate('harness:benchmark', report);
+async function measure(id, budgetMs, fn) {
+    const started = performance.now();
+    try {
+        const detail = await fn();
+        const elapsed_ms = Math.round((performance.now() - started) * 100) / 100;
+        return { id, ok: elapsed_ms <= budgetMs && detail.ok !== false, budget_ms: budgetMs, elapsed_ms, detail };
+    }
+    catch (err) {
+        const elapsed_ms = Math.round((performance.now() - started) * 100) / 100;
+        return { id, ok: false, budget_ms: budgetMs, elapsed_ms, error: err?.message || String(err) };
+    }
+}
+async function assertFile(rel) {
+    await fs.access(path.join(root, rel));
+}
+async function makeReviewFixture() {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-review-bench-'));
+    await runProcess('git', ['init'], { cwd: dir, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
+    for (let i = 0; i < 10; i += 1) {
+        await ensureDir(path.join(dir, 'src'));
+        await fs.writeFile(path.join(dir, 'src', `file-${i}.txt`), `baseline ${i}\n`, 'utf8');
+    }
+    await runProcess('git', ['add', '.'], { cwd: dir, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
+    for (let i = 0; i < 10; i += 1) {
+        const content = i === 0 ? '<<<<<<< HEAD\nleft\n=======\nright\n>>>>>>> branch\n' : `changed ${i}\n`;
+        await fs.writeFile(path.join(dir, 'src', `file-${i}.txt`), content, 'utf8');
+    }
+    return dir;
+}
+//# sourceMappingURL=harness-benchmark-check.js.map

package/dist/scripts/legacy-update-e2e-check.js

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { PACKAGE_VERSION, packageRoot, readJson, writeReceiptRotated } from '../core/fsx.js';
+import { runSksUpdateNow } from '../core/update-check.js';
+import { ensureCurrentMigrationBeforeCommand, projectUpdateMigrationReceiptPath, runPackageLocalDoctor } from '../core/update/update-migration-state.js';
+const REQUIRED_LEGACY_STAGES = [
+    'legacy-team-artifacts',
+    'session-state-split',
+    'skills-reconcile',
+    'menubar-retarget',
+    'config-fastmode-normalize',
+    'hook-trust-refresh',
+    'receipt-rotation'
+];
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-legacy-update-e2e-'));
+const savedHome = process.env.HOME;
+const savedGlobalRoot = process.env.SKS_GLOBAL_ROOT;
+const savedCwd = process.cwd();
+try {
+    const home = path.join(tempRoot, 'home');
+    const project = path.join(tempRoot, 'project');
+    await seedLegacyFixture(home, project);
+    process.env.HOME = home;
+    process.env.SKS_GLOBAL_ROOT = path.join(home, '.sneakoscope-global');
+    process.chdir(project);
+    const output = await captureConsole(async () => runSksUpdateNow({
+        version: PACKAGE_VERSION,
+        projectRoot: project,
+        currentVersion: '4.8.4',
+        json: false,
+        quiet: false,
+        timeoutMs: 60_000,
+        env: {
+            ...process.env,
+            HOME: home,
+            SKS_GLOBAL_ROOT: path.join(home, '.sneakoscope-global'),
+            SKS_INSTALLED_SKS_VERSION: '4.8.4',
+            SKS_NPM_VIEW_SNEAKOSCOPE_VERSION: PACKAGE_VERSION,
+            SKS_UPDATE_FAKE_INSTALL: '1',
+            SKS_TEST_DOCTOR_OK: '1',
+            SKS_TEST_OLD_DOCTOR_FAIL: '1',
+            SKS_UPDATE_SKIP_SKS_MENUBAR: '1',
+            SKS_REQUIRE_ZELLIJ: '0',
+            SKS_POSTINSTALL_GLOBAL_DOCTOR: '0',
+            SKS_MIGRATION_DOCTOR_TIMEOUT_MS: '5000'
+        }
+    }));
+    const result = output.value;
+    assertGate(result.status === 'updated', 'fake legacy update must finish updated', { status: result.status, error: result.error, stages: result.stages });
+    assertGate(result.verification.length === 4 && result.verification.every((row) => row.ok), 'all final self-verification checks must pass', { verification: result.verification });
+    assertGate(result.stages.some((stage) => stage.id === 'old_version_doctor_preflight' && stage.status === 'failed_continuing'), 'old-version doctor failure must continue', { stages: result.stages });
+    assertGate(result.stages.some((stage) => stage.id === 'npm_global_install' && stage.status === 'fake_installed'), 'fake install stage missing', { stages: result.stages });
+    assertGate(/[▸>].*npm_global_install|npm_global_install/.test(output.text) && /final_self_verification/.test(output.text), 'progress output must include stage start/end lines', { output: output.text.slice(-2000) });
+    const receipt = await readJson(projectUpdateMigrationReceiptPath(project), null);
+    const stageIds = new Set((receipt?.legacy_migration_stages || []).map((stage) => stage.id));
+    for (const id of REQUIRED_LEGACY_STAGES)
+        assertGate(stageIds.has(id), `legacy stage missing from receipt: ${id}`, { receipt });
+    const badStages = (receipt?.legacy_migration_stages || []).filter((stage) => stage.ok !== true);
+    assertGate(badStages.length === 0, 'legacy migration stages must all be ok', { badStages, receipt });
+    const retryProject = path.join(tempRoot, 'retry-project');
+    await fsp.mkdir(path.join(retryProject, '.sneakoscope'), { recursive: true });
+    const retry = await ensureCurrentMigrationBeforeCommand({
+        command: 'legacy-e2e',
+        cwd: retryProject,
+        env: {
+            ...process.env,
+            HOME: home,
+            SKS_GLOBAL_ROOT: path.join(home, '.sneakoscope-global'),
+            SKS_TEST_DOCTOR_TIMEOUT_ONCE: '1',
+            SKS_MIGRATION_DOCTOR_TIMEOUT_MS: '1'
+        }
+    });
+    assertGate(retry.ok === true && retry.status === 'repaired', 'timeout doctor must retry once and repair', retry);
+    assertGate(retry.warnings.some((warning) => warning.startsWith('doctor_migration_timeout_retry')), 'timeout retry warning missing', retry);
+    const failProject = path.join(tempRoot, 'fail-project');
+    await fsp.mkdir(path.join(failProject, '.sneakoscope'), { recursive: true });
+    const failed = await ensureCurrentMigrationBeforeCommand({
+        command: 'legacy-e2e',
+        cwd: failProject,
+        env: {
+            ...process.env,
+            HOME: home,
+            SKS_GLOBAL_ROOT: path.join(home, '.sneakoscope-global'),
+            SKS_TEST_DOCTOR_FAIL: '1',
+            SKS_MIGRATION_DOCTOR_TIMEOUT_MS: '1'
+        }
+    });
+    assertGate(failed.ok === false && failed.blockers.includes('doctor_migration_failed'), 'non-timeout doctor failure must not be reported as timeout', failed);
+    assertGate(!failed.warnings.some((warning) => warning.startsWith('doctor_migration_timeout_retry')), 'non-timeout failure must not retry', failed);
+    const currentDryRunProject = path.join(tempRoot, 'current-dry-run-project');
+    await fsp.mkdir(path.join(currentDryRunProject, '.sneakoscope'), { recursive: true });
+    const currentDryRun = await captureConsole(async () => runSksUpdateNow({
+        projectRoot: currentDryRunProject,
+        currentVersion: PACKAGE_VERSION,
+        dryRun: true,
+        json: false,
+        quiet: false,
+        timeoutMs: 5000,
+        env: {
+            ...process.env,
+            HOME: home,
+            SKS_GLOBAL_ROOT: path.join(home, '.sneakoscope-global'),
+            SKS_INSTALLED_SKS_VERSION: PACKAGE_VERSION,
+            SKS_NPM_VIEW_SNEAKOSCOPE_VERSION: PACKAGE_VERSION,
+            SKS_UPDATE_SKIP_SKS_MENUBAR: '1'
+        }
+    }));
+    assertGate(currentDryRun.value.status === 'dry_run', 'already-current update dry-run must stay dry_run', { result: currentDryRun.value });
+    assertGate(!currentDryRun.value.stages.some((stage) => ['project_receipt', 'sks_menubar', 'global_skills_reconcile'].includes(stage.id)), 'already-current dry-run must not run mutating current-version repair stages', { stages: currentDryRun.value.stages });
+    assertGate(!fs.existsSync(projectUpdateMigrationReceiptPath(currentDryRunProject)), 'already-current dry-run must not write a project receipt', { receipt: projectUpdateMigrationReceiptPath(currentDryRunProject) });
+    const timeoutEntrypoint = path.join(tempRoot, 'timeout-doctor.js');
+    await fsp.writeFile(timeoutEntrypoint, 'setInterval(() => {}, 1000)\n');
+    const actualTimeout = await runPackageLocalDoctor({
+        root: project,
+        entrypoint: timeoutEntrypoint,
+        args: [],
+        env: {
+            ...process.env,
+            HOME: home,
+            SKS_GLOBAL_ROOT: path.join(home, '.sneakoscope-global')
+        },
+        timeoutMs: 25,
+        maxOutputBytes: 1024
+    });
+    assertGate(actualTimeout.ok === false && actualTimeout.timedOut === true && actualTimeout.timed_out === true, 'package-local doctor timeout must come from real child process timeout path', actualTimeout);
+    const rotationProject = path.join(tempRoot, 'rotation-project');
+    const rotationReceipt = projectUpdateMigrationReceiptPath(rotationProject);
+    await fsp.mkdir(path.dirname(rotationReceipt), { recursive: true });
+    const base = path.basename(rotationReceipt);
+    const dir = path.dirname(rotationReceipt);
+    for (let index = 0; index < 5; index += 1) {
+        const rotated = path.join(dir, `${base}.2026-07-03T00-00-0${index}-000Z.json`);
+        await fsp.writeFile(rotated, JSON.stringify({ index }) + '\n');
+        await fsp.utimes(rotated, new Date(2026, 6, 3, 0, 0, index), new Date(2026, 6, 3, 0, 0, index));
+    }
+    await fsp.writeFile(rotationReceipt, JSON.stringify({ current: true }) + '\n');
+    await writeReceiptRotated(rotationReceipt, { next: true }, { keep: 5 });
+    const rotatedAfterWrite = (await fsp.readdir(dir)).filter((name) => name.startsWith(`${base}.`) && name.endsWith('.json'));
+    assertGate(rotatedAfterWrite.length <= 5, 'receipt rotation must include the just-rotated current receipt in keep=5 pruning', { rotatedAfterWrite });
+    console.log(JSON.stringify({
+        schema: 'sks.legacy-update-e2e-check.v1',
+        ok: true,
+        package_version: PACKAGE_VERSION,
+        update_status: result.status,
+        verification: result.verification.map((row) => ({ id: row.id, ok: row.ok })),
+        legacy_stage_count: REQUIRED_LEGACY_STAGES.length,
+        progress_lines: output.text.split(/\r?\n/).filter(Boolean).length,
+        retry_status: retry.status,
+        failure_blockers: failed.blockers,
+        current_dry_run_status: currentDryRun.value.status,
+        actual_timeout_timed_out: actualTimeout.timedOut,
+        rotated_receipt_count: rotatedAfterWrite.length
+    }, null, 2));
+}
+finally {
+    process.chdir(savedCwd);
+    if (savedHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = savedHome;
+    if (savedGlobalRoot === undefined)
+        delete process.env.SKS_GLOBAL_ROOT;
+    else
+        process.env.SKS_GLOBAL_ROOT = savedGlobalRoot;
+    await fsp.rm(tempRoot, { recursive: true, force: true }).catch(() => undefined);
+}
+async function seedLegacyFixture(home, project) {
+    await fsp.mkdir(path.join(home, '.agents', 'skills'), { recursive: true });
+    await fsp.mkdir(path.join(home, '.codex', 'sks-menubar'), { recursive: true });
+    await fsp.mkdir(path.join(project, '.sneakoscope'), { recursive: true });
+    await fsp.mkdir(path.join(project, '.codex'), { recursive: true });
+    await fsp.writeFile(path.join(home, '.agents', 'skills', '.sks-generated.json'), JSON.stringify({
+        schema_version: 1,
+        generated_by: 'sneakoscope',
+        version: '4.8.4',
+        skills: [],
+        files: []
+    }, null, 2) + '\n');
+    await fsp.writeFile(path.join(home, '.codex', 'config.toml'), [
+        'default_profile = "legacy"',
+        '',
+        '[hooks.state."legacy"]',
+        'trusted_hash = "old-hash"',
+        ''
+    ].join('\n'));
+    await fsp.writeFile(path.join(home, '.codex', 'sks-menubar', 'sks-menubar-action.sh'), [
+        '#!/usr/bin/env sh',
+        'SKS_ENTRY="/old/sneakoscope/dist/bin/sks.js"',
+        'exec "$SKS_ENTRY" "$@"',
+        ''
+    ].join('\n'));
+    await fsp.writeFile(path.join(project, '.sneakoscope', 'current.json'), JSON.stringify({
+        mission_id: 'M-legacy',
+        phase: 'LEGACY'
+    }, null, 2) + '\n');
+    await fsp.writeFile(path.join(project, '.codex', 'config.toml'), [
+        '[user.fast_mode]',
+        'visible = true',
+        'default_profile = "sks-fast-high"',
+        ''
+    ].join('\n'));
+    const stamp = path.join(packageRoot(), 'dist', '.sks-build-stamp.json');
+    assertGate(fs.existsSync(stamp), 'dist build stamp missing; run npm run build:incremental first', { stamp });
+}
+async function captureConsole(fn) {
+    const originalLog = console.log;
+    const lines = [];
+    console.log = (...args) => {
+        lines.push(args.map((arg) => typeof arg === 'string' ? arg : JSON.stringify(arg)).join(' '));
+    };
+    try {
+        const value = await fn();
+        return { value, text: lines.join('\n') };
+    }
+    finally {
+        console.log = originalLog;
+    }
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ schema: 'sks.legacy-update-e2e-check.v1', ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+//# sourceMappingURL=legacy-update-e2e-check.js.map

package/dist/scripts/mad-db-command-check.js

@@ -3,13 +3,16 @@ import { DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, routeByDollarCommand } from '.
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 assertGate(readText('src/cli/command-registry.ts').includes("'mad-db'"), 'mad-db command must be registered');
 assertGate(readText('src/commands/mad-db.ts').includes('madDbCommand'), 'mad-db command wrapper missing');
-assertGate(readText('src/core/commands/mad-db-command.ts').includes('deprecated_enable_no_capability'), 'legacy mad-db enable must be deprecated and must not create capabilities');
-assertGate(DOLLAR_COMMANDS.some((entry) => entry.command === '$MAD-DB'), '$MAD-DB dollar command must be visible in sks dollar-commands');
-assertGate(DOLLAR_COMMAND_ALIASES.some((entry) => entry.canonical === '$MAD-DB' && entry.app_skill === '$mad-db'), '$mad-db app skill alias must point at first-class $MAD-DB');
-assertGate(routeByDollarCommand('MAD-DB')?.command === '$MAD-DB', '$MAD-DB must resolve to the first-class MadDB route');
-assertGate(routeByDollarCommand('mad-db')?.command === '$MAD-DB', '$mad-db must resolve to the first-class MadDB route');
+const madDbCommandSource = readText('src/core/commands/mad-db-command.ts');
+assertGate(madDbCommandSource.includes('mad-db is deprecated') && madDbCommandSource.includes('deprecated_alias'), 'mad-db command must warn and annotate deprecated_alias');
+assertGate(!DOLLAR_COMMANDS.some((entry) => entry.command === '$MAD-DB'), '$MAD-DB deprecated alias must be hidden from new dollar-command listings');
+assertGate(DOLLAR_COMMAND_ALIASES.some((entry) => entry.canonical === '$MAD-DB' && entry.app_skill === '$mad-db'), '$mad-db app skill alias must remain for deprecated $MAD-DB');
+assertGate(routeByDollarCommand('MAD-DB')?.command === '$MAD-DB' && routeByDollarCommand('MAD-DB')?.deprecated === true, '$MAD-DB must resolve to the deprecated alias route');
+assertGate(routeByDollarCommand('mad-db')?.command === '$MAD-DB' && routeByDollarCommand('mad-db')?.aliasTo === '$MAD-SKS', '$mad-db must resolve to deprecated alias redirecting to $MAD-SKS');
 const initText = readText('src/core/init.ts');
-assertGate(initText.includes("'mad-db':") && initText.includes('madDbSkillText()') && initText.includes('dbSafetyGuardSkillText()'), 'mad-db generated picker skill template must come from typed SSOT');
-assertGate(readText('src/core/commands/mad-db-command.ts').includes('run|exec|apply-migration'), 'mad-db command must expose execution subcommands');
-emitGate('mad-db:command', { command: 'sks mad-db', dollar_command: '$MAD-DB', app_skill_alias: '$mad-db' });
+const skillInitText = readText('src/core/init/skills.ts');
+const typedSkillSource = `${initText}\n${skillInitText}`;
+assertGate(typedSkillSource.includes("'mad-db':") && typedSkillSource.includes('merged into mad-sks') && typedSkillSource.includes('madDbSkillText()') && typedSkillSource.includes('dbSafetyGuardSkillText()'), 'mad-db generated skill must be deprecated and SQL-plane policy must be merged into mad-sks');
+assertGate(madDbCommandSource.includes('run') && madDbCommandSource.includes('exec') && madDbCommandSource.includes('apply-migration') && madDbCommandSource.includes('sql'), 'mad-db command must translate legacy execution subcommands');
+emitGate('mad-db:command', { command: 'sks mad-db', dollar_command: '$MAD-DB', app_skill_alias: '$mad-db', alias_to: '$MAD-SKS' });
 //# sourceMappingURL=mad-db-command-check.js.map

package/dist/scripts/mad-db-route-identity-check.js

@@ -10,18 +10,20 @@ import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-route-identity-'));
 const prepared = await prepareMadDbMission({
     root,
-    task: '$MAD-DB truncate public.fixture',
+    task: '$MAD-SKS truncate public.fixture',
     args: ['--project-ref', 'fixture-project-ref', '--target', 'preview'],
     verifyTools: false,
-    runtimeSessionId: 'route-identity-session'
+    runtimeSessionId: 'route-identity-session',
+    route: 'MadSKS',
+    routeCommand: '$MAD-SKS'
 });
 const proof = await madDbRouteIdentityProof(root, prepared.mission_id);
-assertGate(routeByDollarCommand('MAD-DB')?.id === 'MadDB', '$MAD-DB must resolve to first-class MadDB route', routeByDollarCommand('MAD-DB'));
-assertGate(routeByDollarCommand('MAD-SKS')?.id === 'MadSKS', '$MAD-SKS must remain the scoped permission route', routeByDollarCommand('MAD-SKS'));
-assertGate(prepared.ok === true && prepared.capability.mission_id === prepared.mission_id, 'MadDB prepare must create one authoritative mission/capability', prepared);
+assertGate(routeByDollarCommand('MAD-DB')?.id === 'MadDB' && routeByDollarCommand('MAD-DB')?.deprecated === true && routeByDollarCommand('MAD-DB')?.aliasTo === '$MAD-SKS', '$MAD-DB must remain a deprecated alias to $MAD-SKS', routeByDollarCommand('MAD-DB'));
+assertGate(routeByDollarCommand('MAD-SKS')?.id === 'MadSKS', '$MAD-SKS must be the merged scoped permission + SQL-plane route', routeByDollarCommand('MAD-SKS'));
+assertGate(prepared.ok === true && prepared.capability.mission_id === prepared.mission_id, 'MAD-SKS sql-plane prepare must create one authoritative mission/capability', prepared);
 assertGate(prepared.capability.runtime_session_id === 'route-identity-session' && prepared.capability.transport.profile_sha256 === prepared.runtime_profile.profile_sha256, 'capability must bind the runtime profile hash/session', prepared.capability);
 assertGate(isMadDbCapabilityActive(prepared.capability) === true, 'prepared capability must be active/transport-ready', prepared.capability);
-assertGate(proof.ok === true && proof.same_mission === true && proof.route_command === '$MAD-DB', 'route identity proof mismatch', proof);
+assertGate(proof.ok === true && proof.same_mission === true && proof.route_command === '$MAD-SKS' && proof.deprecated_route_accepted === true, 'route identity proof mismatch', proof);
 await closeMadDbRuntimeProfile({ root, missionId: prepared.mission_id, reason: 'route_identity_check' });
 await closeMadDbCycle(root, prepared.mission_id, prepared.cycle_id, 'route_identity_check');
 emitGate('mad-db:route-identity', { mission_id: prepared.mission_id, cycle_id: prepared.cycle_id, profile_sha256: prepared.runtime_profile.profile_sha256 });

package/dist/scripts/mad-db-safety-conflict-matrix-check.js

@@ -5,18 +5,41 @@ import path from 'node:path';
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const missionMod = await importDist('core/mission.js');
 const capMod = await importDist('core/mad-db/mad-db-capability.js');
+const runtimeMod = await importDist('core/mad-db/mad-db-runtime-profile.js');
+const coordinatorMod = await importDist('core/mad-db/mad-db-coordinator.js');
 const db = await importDist('core/db-safety.js');
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-db-matrix-'));
 const mission = await missionMod.createMission(root, { mode: 'mad-sks', prompt: 'fixture' });
 const madSksState = { mission_id: mission.id, mode: 'MADSKS', mad_sks_active: true, mad_sks_gate_file: 'mad-sks-gate.json' };
 fs.writeFileSync(path.join(mission.dir, 'mad-sks-gate.json'), JSON.stringify({ passed: false, permissions_deactivated: false }, null, 2));
 const catastrophic = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', sql: 'truncate users;' });
-assertGate(catastrophic.allowed === false && catastrophic.reasons.includes('mad_sks_catastrophic_db_operation_blocked'), 'MAD-SKS catastrophic guard must remain without Mad-DB', catastrophic);
-await capMod.createMadDbCapability(root, { missionId: mission.id, ack: capMod.MAD_DB_ACK, cwd: root, projectRef: 'fixture-project-ref', status: 'active' });
-const breakGlass = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', tool_call_id: 'matrix-truncate-active', sql: 'truncate users;' });
-assertGate(breakGlass.allowed === true && breakGlass.mad_db?.active === true, 'Mad-DB must override DB mutation guard only while active', breakGlass);
-await capMod.consumeMadDbCapability(root, mission.id, { consumedBy: 'fixture-cycle-close' });
-const afterConsume = await db.checkDbOperation(root, madSksState, { tool_name: 'supabase.execute_sql', tool_call_id: 'matrix-truncate-closed', sql: 'truncate users;' });
-assertGate(afterConsume.allowed === false, 'after bounded cycle close, MAD-SKS catastrophic guard must block again', afterConsume);
-emitGate('mad-db:safety-conflict-matrix', { states: ['mad-sks-blocks', 'mad-db-allows-cycle', 'mad-sks-blocks-after-cycle-close'] });
+assertGate(catastrophic.allowed === false && catastrophic.reasons.includes('mad_sks_catastrophic_db_operation_blocked'), 'MAD-SKS catastrophic guard must remain without active sql-plane capability', catastrophic);
+const prepared = await coordinatorMod.prepareMadDbMission({
+    root,
+    task: '$MAD-SKS truncate users',
+    args: ['--project-ref', 'fixture-project-ref', '--target', 'preview'],
+    verifyTools: false,
+    route: 'MadSKS',
+    routeCommand: '$MAD-SKS'
+});
+const activeState = {
+    mission_id: prepared.mission_id,
+    mode: 'MADSKS',
+    route: 'MadSKS',
+    route_command: '$MAD-SKS',
+    mad_sks_active: true,
+    mad_db_active: true,
+    mad_db_capability_mission_id: prepared.mission_id,
+    mad_db_cycle_id: prepared.cycle_id,
+    mad_db_runtime_session_id: prepared.capability.runtime_session_id,
+    mad_db_profile_sha256: prepared.runtime_profile.profile_sha256,
+    mad_sks_gate_file: 'mad-sks-gate.json'
+};
+const sqlPlane = await db.checkDbOperation(root, activeState, { tool_name: 'supabase.execute_sql', tool_call_id: 'matrix-truncate-active', sql: 'truncate users;' });
+assertGate(sqlPlane.allowed === true && sqlPlane.mad_db?.active === true && sqlPlane.mad_db?.state_source !== 'legacy_mad_db_route', 'MAD-SKS sql-plane capability must authorize the bounded SQL-plane cycle', sqlPlane);
+await runtimeMod.closeMadDbRuntimeProfile({ root, missionId: prepared.mission_id, reason: 'matrix-cycle-close' });
+await capMod.closeMadDbCycle(root, prepared.mission_id, prepared.cycle_id, 'matrix-cycle-close');
+const afterClose = await db.checkDbOperation(root, { ...activeState, mad_db_active: false, mad_sks_active: false }, { tool_name: 'supabase.execute_sql', tool_call_id: 'matrix-truncate-closed', sql: 'truncate users;' });
+assertGate(afterClose.allowed === false, 'after bounded sql-plane close, MAD-SKS catastrophic guard must block again', afterClose);
+emitGate('mad-db:safety-conflict-matrix', { states: ['mad-sks-blocks-without-sql-plane', 'mad-sks-sql-plane-allows-cycle', 'mad-sks-blocks-after-cycle-close'] });
 //# sourceMappingURL=mad-db-safety-conflict-matrix-check.js.map

package/dist/scripts/mad-db-skill-policy-snapshot-check.js

@@ -3,16 +3,15 @@ import { MAD_DB_POLICY, dbSafetyGuardSkillText, madDbSkillText } from '../core/m
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const madDbSkill = madDbSkillText();
 const dbSafetySkill = dbSafetyGuardSkillText();
-const initText = readText('src/core/init.ts');
+const initText = `${readText('src/core/init.ts')}\n${readText('src/core/init/skills.ts')}`;
 for (const token of ['table/schema DROP', 'all-row mutations', 'TRUNCATE', 'execute_sql', 'apply_migration']) {
     assertGate(madDbSkill.includes(token), `MadDB skill SSOT missing ${token}`, { madDbSkill });
 }
-assertGate(dbSafetySkill.includes('Active MadDB is the explicit exception'), 'db safety skill must name active MadDB exception', { dbSafetySkill });
+assertGate(dbSafetySkill.includes('Active MAD-SKS sql-plane is the explicit exception'), 'db safety skill must name active MAD-SKS sql-plane exception', { dbSafetySkill });
 assertGate(!madDbSkill.includes('Keep catastrophic safeguards active: whole database/schema/table removal'), 'MadDB skill must not carry old destructive-operation denial text', { madDbSkill });
-assertGate(!madDbSkill.includes('persistent security weakening'), 'MadDB skill must not carry prompt-only SQL-plane denial text', { madDbSkill });
-assertGate(madDbSkill.includes('Do not add prompt-only SQL deny lists inside active MadDB'), 'MadDB skill must prevent SQL-plane prompt veto lists', { madDbSkill });
+assertGate(madDbSkill.includes('Do not add prompt-only SQL deny lists inside active sql-plane'), 'MadDB skill must prevent SQL-plane prompt veto lists', { madDbSkill });
 assertGate(!dbSafetySkill.includes('do not run DROP'), 'db safety skill must not conflict with active MadDB SQL-plane allowance', { dbSafetySkill });
-assertGate(dbSafetySkill.includes('Default read-only restrictions do not apply to SQL-plane work while the active MadDB capability v2 is bound'), 'db safety skill must explicitly remove default restrictions during active MadDB', { dbSafetySkill });
+assertGate(dbSafetySkill.includes('Default read-only restrictions do not apply to SQL-plane work while the active MAD-SKS sql-plane capability v2 is bound'), 'db safety skill must explicitly remove default restrictions during active MAD-SKS sql-plane', { dbSafetySkill });
 assertGate(initText.includes('madDbSkillText()') && initText.includes('dbSafetyGuardSkillText()'), 'init must generate skills from typed MadDB policy SSOT', {});
 assertGate(MAD_DB_POLICY.active_mode.sql_plane === 'allow_all_mutations' && MAD_DB_POLICY.normal_supabase_mcp.read_only_required === true, 'typed policy must encode active SQL-plane and normal read-only modes', MAD_DB_POLICY);
 emitGate('mad-db:skill-policy', { schema: MAD_DB_POLICY.schema, operation_classes: MAD_DB_POLICY.sql_plane_allowed.length });

package/dist/scripts/naruto-real-active-pool-runtime-check.js

@@ -49,7 +49,32 @@ const artifactEvidence = report.worker_lifecycle.every((row) => row.worker_artif
     && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-heartbeat.jsonl'))
     && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json'))
     && fs.existsSync(path.join(row.worker_artifact_dir, 'codex-control', 'codex-control-proof.json')));
+const timeoutReport = await runNarutoRealActivePool({
+    graph: buildNarutoWorkGraph({ requestedClones: 1, totalWorkItems: 1, writeCapable: false, maxActiveWorkers: 1 }),
+    governor: { ...target, safe_active_workers: 1, safe_zellij_visible_panes: 0 },
+    hardTimeoutMs: 1,
+    spawnWorker: async (item, placement) => ({
+        id: item.id,
+        item,
+        placement,
+        started_at: Date.now() - 1000,
+        pid: null,
+        worker_artifact_dir: path.join(tempRoot, 'timeout-worker'),
+        heartbeat_path: path.join(tempRoot, 'timeout-worker', 'worker-heartbeat.jsonl'),
+        exit: new Promise(() => undefined)
+    }),
+    collectWorker: async () => {
+        throw new Error('timed out worker should be force-collected before collectWorker');
+    },
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const timeoutEvidence = timeoutReport.completed_count === 1
+    && timeoutReport.failed_count === 1
+    && timeoutReport.blockers.includes('naruto_worker_hard_timeout')
+    && timeoutReport.worker_lifecycle.some((row) => row.ok === false && row.completed_at !== null);
 const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && report.active_pool_utilization >= 0.8 && processEvidence && artifactEvidence;
 assertGate(ok, 'Naruto real active pool runtime must include actual child process, heartbeat, and result evidence', { report, spawned, collected, processEvidence, artifactEvidence, tempRoot });
-emitGate('naruto:real-active-pool-runtime', report);
+assertGate(timeoutEvidence, 'Naruto real active pool must force-collect hung workers as timed-out results', { timeoutReport });
+emitGate('naruto:real-active-pool-runtime', { ...report, timeout_force_collect_checked: true });
 //# sourceMappingURL=naruto-real-active-pool-runtime-check.js.map

package/dist/scripts/ppt-real-imagegen-wiring-check.js

@@ -5,12 +5,16 @@ requireContains('ppt:real-imagegen-wiring', 'src/core/ppt-review/slide-imagegen-
     'generateGptImage2CalloutReview',
     'PPT_SLIDE_IMAGEGEN_REQUEST_ARTIFACT',
     'PPT_SLIDE_IMAGEGEN_RESPONSE_ARTIFACT',
+    'buildSlideImagegenEvidence',
+    'evidence_class',
+    'output_sha256',
     'extraction_pending_count',
     'callout_extraction_status'
 ]);
 requireContains('ppt:real-imagegen-wiring', 'src/core/ppt-review/index.ts', [
     'buildSlideImagegenRequestArtifact',
-    'buildSlideImagegenResponseArtifact'
+    'buildSlideImagegenResponseArtifact',
+    'imagegen_evidence'
 ]);
 emitGate('ppt:real-imagegen-wiring', { adapter: 'shared UX generateGptImage2CalloutReview' });
 //# sourceMappingURL=ppt-real-imagegen-wiring-check.js.map

package/dist/scripts/proof-root-cause-policy-check.js

@@ -11,6 +11,7 @@ const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-root-cause-policy-'));
 await writeRouteCompletionProof(root, {
     missionId: 'M-root-cause-missing',
     route: '$Wiki',
+    executionClass: 'real',
     status: 'verified_partial',
     unverified: ['fallback path was used without RCA']
 });
@@ -23,6 +24,7 @@ assert.ok(missingGate.issues.includes('root_cause_analysis_missing'));
 const fixed = await writeRouteCompletionProof(root, {
     missionId: 'M-root-cause-complete',
     route: '$Wiki',
+    executionClass: 'real',
     status: 'verified_partial',
     unverified: ['fallback path was used, root cause corrected below'],
     failureAnalysis: {