sneakoscope 4.8.7 → 5.3.0

package/dist/scripts/release-dag-full-coverage-check.js

@@ -2,8 +2,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const releaseManifest = readGateManifest(path.join(root, 'release-gates.v2.json'), 'sks.release-gates.v2');
-const harnessManifest = readGateManifest(path.join(root, 'infra-harness-gates.json'), 'sks.infra-harness-gates.v1');
+const packageJson = readPackageJson(path.join(root, 'package.json'));
+const releaseManifest = readReleaseGateManifest(path.join(root, 'release-gates.v2.json'), 'sks.release-gates.v2');
+const harnessManifest = readReleaseGateManifest(path.join(root, 'infra-harness-gates.json'), 'sks.infra-harness-gates.v1');
 const releasePreset = releaseManifest.gates.filter((gate) => gate.preset.includes('release'));
 const harnessPreset = harnessManifest.gates.filter((gate) => gate.preset.includes('harness'));
 const releaseIds = new Set(releasePreset.map((gate) => gate.id));
@@ -58,11 +59,19 @@ const report = {
     release_zellij: releaseZellij,
     harness_non_zellij: harnessNonZellij,
     npm_run_commands: npmRunCommands,
-    schema_complete: schemaComplete
+    schema_complete: schemaComplete,
+    package_script_count: Object.keys(packageJson.scripts || {}).length
 };
 assertGate(report.ok, 'release/harness gate manifests must satisfy consolidated v2 coverage policy', report);
 emitGate('release:dag-full-coverage', report);
-function readGateManifest(file, expectedSchema) {
+function readPackageJson(file) {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    assertGate(isRecord(parsed), 'package.json must be an object', { file });
+    const record = parsed;
+    const scripts = isRecord(record.scripts) ? Object.fromEntries(Object.entries(record.scripts).filter((entry) => typeof entry[1] === 'string')) : {};
+    return { scripts };
+}
+function readReleaseGateManifest(file, expectedSchema) {
     const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
     assertGate(isRecord(parsed), 'gate manifest must be an object', { file });
     assertGate(parsed.schema === expectedSchema, 'gate manifest schema mismatch', { file, schema: parsed.schema, expected_schema: expectedSchema });

package/dist/scripts/release-gate-dag-runner.js

@@ -43,6 +43,20 @@ console.log(`SKS Release DAG
   critical_path: ${(result.critical_path_ms / 1000).toFixed(1)}s
   certificate: ${result.completion_certificate.confidence} sla=${(result.completion_certificate.sla_ms / 1000).toFixed(0)}s met=${result.completion_certificate.sla_met}
   report: ${result.report_dir}`);
+const gateResult = {
+    schema: 'sks.gate-result.v1',
+    ok: result.ok === true,
+    blockers: result.ok ? [] : result.failures.map((failure) => `release_gate_failed:${failure.id}`),
+    summary: {
+        total_gates: result.total_gates,
+        selected_gates: result.selected_gates,
+        cached: result.cached,
+        completed: result.completed,
+        failed: result.failed,
+        report_dir: result.report_dir
+    }
+};
+console.log(JSON.stringify(gateResult));
 if (!result.ok) {
     for (const failure of result.failures) {
         console.error(`[fail] ${failure.id} exit=${failure.exit_code}\n${failure.stderr_tail}`);

package/dist/scripts/release-gate-existence-audit.js

@@ -43,7 +43,8 @@ const releaseCheckTarget = releaseCheck.includes('release:check:affected')
     : releaseCheck;
 assertGate(releaseCheckTarget.includes('release-gate-dag-runner') && /--preset\s+(?:release|affected)/.test(releaseCheckTarget), 'release:check must use the v2 DAG release/affected preset', { release_check: scripts['release:check'], resolved_release_check: releaseCheckTarget });
 assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { gate_count: releaseGates.length });
-assertGate(Object.keys(scripts).length <= 100, 'package script budget exceeded', { script_count: Object.keys(scripts).length });
+const PACKAGE_SCRIPT_BUDGET = 150;
+assertGate(Object.keys(scripts).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(scripts).length, limit: PACKAGE_SCRIPT_BUDGET });
 for (const id of requiredRelease)
     assertGate(releaseIds.has(id), `critical release gate missing from release v2 manifest: ${id}`, { id });
 for (const id of requiredHarness)

package/dist/scripts/release-gate-planner.js

@@ -9,6 +9,7 @@ import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { validateReleaseGateManifest } = await importDist('core/release/release-gate-node.js');
 const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
 const scripts = pkg.scripts || {};
+const PACKAGE_SCRIPT_BUDGET = 150;
 const release = readManifest('release-gates.v2.json');
 const harness = readManifest('infra-harness-gates.json');
 assertGate(!fs.existsSync(path.join(root, 'release-gates.json')), 'release-gates.json v1 must not be present');
@@ -27,7 +28,7 @@ const releasePresetLeaks = release.gates.filter((gate) => !Array.isArray(gate.pr
 const harnessPresetLeaks = harness.gates.filter((gate) => !Array.isArray(gate.preset) || !gate.preset.includes('harness') || gate.preset.includes('release')).map((gate) => gate.id);
 const npmRunGates = release.gates.concat(harness.gates).filter((gate) => /\bnpm\s+run\b/.test(String(gate.command))).map((gate) => gate.id);
 assertGate(release.gates.length <= 200, 'release preset gate budget exceeded', { release_gates: release.gates.length, limit: 200 });
-assertGate(Object.keys(scripts).length <= 100, 'package.json script budget exceeded', { scripts: Object.keys(scripts).length, limit: 100 });
+assertGate(Object.keys(scripts).length <= PACKAGE_SCRIPT_BUDGET, 'package.json script budget exceeded', { scripts: Object.keys(scripts).length, limit: PACKAGE_SCRIPT_BUDGET });
 assertGate(duplicateAcrossManifests.length === 0, 'gate appears in both release and harness manifests', { duplicateAcrossManifests });
 assertGate(releaseZellij.length === 0, 'zellij gates must live in infra-harness-gates.json, not release-gates.v2.json', { releaseZellij });
 assertGate(harnessNonZellij.length === 0, 'infra harness manifest must contain only zellij gates', { harnessNonZellij });

package/dist/scripts/release-gate-script-parity-check.js

@@ -4,10 +4,6 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { assertGate, emitGate, readJson, root } from './sks-1-18-gate-lib.js';
 import { writeJsonAtomic } from '../core/fsx.js';
-import { REQUIRED_3112_REAL_CHECK_IDS, REQUIRED_3112_RELEASE_IDS } from './release-3112-required-gates.js';
-import { REQUIRED_3113_REAL_CHECK_IDS, REQUIRED_3113_RELEASE_IDS } from './release-3113-required-gates.js';
-import { REQUIRED_4000_REAL_CHECK_IDS, REQUIRED_4000_RELEASE_IDS } from './release-4000-required-gates.js';
-import { REQUIRED_4002_REAL_CHECK_IDS, REQUIRED_4002_RELEASE_IDS } from './release-4002-required-gates.js';
 export const REQUIRED_3110_RELEASE_IDS = [
     'core-skill:manifest',
     'core-skill:immutable-sync',
@@ -38,7 +34,7 @@ export const REQUIRED_3110_RELEASE_IDS = [
     'config:managed-merge-callsite-coverage',
     'release:gate-script-parity',
     'release:wiring-3110-blackbox',
-    'sks:3110-all-feature-regression'
+    'sks:3112-all-feature-regression'
 ];
 if (isMain()) {
     main().catch((err) => {
@@ -63,36 +59,52 @@ export function buildReleaseGateScriptParityReport() {
     const gates = Array.isArray(manifest.gates) ? manifest.gates : [];
     const gateById = new Map(gates.map((gate) => [gate.id, gate]));
     const releaseGateIds = gates.filter((gate) => gate.preset?.includes('release')).map((gate) => gate.id);
-    const requiredReleaseIds = [...new Set([...REQUIRED_3110_RELEASE_IDS, ...REQUIRED_3112_RELEASE_IDS, ...REQUIRED_3113_RELEASE_IDS, ...REQUIRED_4000_RELEASE_IDS, ...REQUIRED_4002_RELEASE_IDS, 'codex:0140-real-probes'])];
-    const requiredRealCheckIds = [...new Set([...REQUIRED_3112_REAL_CHECK_IDS, ...REQUIRED_3113_REAL_CHECK_IDS, ...REQUIRED_4000_REAL_CHECK_IDS, ...REQUIRED_4002_REAL_CHECK_IDS])];
+    const requiredReleaseIds = releaseGateIds;
+    const requiredRealCheckIds = gates.filter((gate) => gate.preset?.includes('real-check')).map((gate) => gate.id);
     const requiredAllIds = [...new Set([...requiredReleaseIds, ...requiredRealCheckIds])];
-    const missingScripts = [...new Set([
-            ...releaseGateIds.filter((id) => !scripts[id]),
-            ...requiredAllIds.filter((id) => !scripts[id])
-        ])].sort();
+    const requiredEntryScripts = [
+        'build',
+        'build:incremental',
+        'typecheck',
+        'release:check',
+        'release:metadata',
+        'release:check:affected',
+        'release:check:fast',
+        'release:check:confidence',
+        'release:check:full',
+        'prepublishOnly',
+        'publish:prep-ignore-scripts',
+        'publish:ignore-scripts',
+        'gates:run',
+        'policy:gate-audit'
+    ];
+    const missingEntryScripts = requiredEntryScripts.filter((id) => !scripts[id]).sort();
     const missingGates = requiredAllIds.filter((id) => !gateById.has(id)).sort();
     const missingReleasePreset = requiredReleaseIds.filter((id) => !gateById.get(id)?.preset?.includes('release')).sort();
     const missingRealCheckPreset = requiredRealCheckIds.filter((id) => !gateById.get(id)?.preset?.includes('real-check')).sort();
     const wrongCommands = requiredAllIds
-        .map((id) => ({ id, expected: `npm run ${id} --silent`, actual: gateById.get(id)?.command || '' }))
-        .filter((row) => row.actual !== row.expected);
+        .map((id) => {
+        const actual = gateById.get(id)?.command || '';
+        return { id, actual, reason: directManifestCommandIssue(actual) };
+    })
+        .filter((row) => row.reason);
     const missingSourceTargets = requiredAllIds
-        .map((id) => ({ id, source: sourceTargetForScript(scripts[id]) }))
+        .map((id) => ({ id, source: sourceTargetForScript(gateById.get(id)?.command) }))
         .filter((row) => row.source && !fs.existsSync(path.join(root, row.source)))
         .map((row) => row.source)
         .sort();
     const missingDistTargets = requiredAllIds
-        .map((id) => ({ id, dist: distTargetForScript(scripts[id]) }))
+        .map((id) => ({ id, dist: distTargetForScript(gateById.get(id)?.command) }))
         .filter((row) => row.dist && fs.existsSync(path.join(root, 'dist')) && !fs.existsSync(path.join(root, row.dist)))
         .map((row) => row.dist)
         .sort();
     return {
         schema: 'sks.release-gate-script-parity.v1',
-        ok: missingScripts.length === 0 && missingGates.length === 0 && missingReleasePreset.length === 0 && missingRealCheckPreset.length === 0 && wrongCommands.length === 0 && missingSourceTargets.length === 0 && missingDistTargets.length === 0,
+        ok: missingEntryScripts.length === 0 && missingGates.length === 0 && missingReleasePreset.length === 0 && missingRealCheckPreset.length === 0 && wrongCommands.length === 0 && missingSourceTargets.length === 0 && missingDistTargets.length === 0,
         release_gate_count: releaseGateIds.length,
         package_script_count: Object.keys(scripts).length,
         checked_required_ids: requiredAllIds.length,
-        missing_scripts: missingScripts,
+        missing_entry_scripts: missingEntryScripts,
         missing_gates: missingGates,
         missing_release_preset: missingReleasePreset,
         missing_real_check_preset: missingRealCheckPreset,
@@ -101,6 +113,22 @@ export function buildReleaseGateScriptParityReport() {
         missing_dist_targets: missingDistTargets
     };
 }
+function directManifestCommandIssue(command) {
+    const text = String(command || '');
+    if (!text)
+        return 'missing_command';
+    if (/\bnpm\s+run\b/.test(text))
+        return 'gate_command_must_not_require_package_script_alias';
+    const segments = text.split(/\s+(?:&&|\|\|)\s+/).map((part) => part.trim()).filter(Boolean);
+    const invalid = segments.find((part) => !(/^node\s+\.\/dist\/scripts\/[^\s]+\.js\b/.test(part)
+        || /^node\s+\.\/dist\/bin\/sks\.js\b/.test(part)
+        || /^node\s+--test\b/.test(part)
+        || /^tsc\s+-p\s+tsconfig\.json\s+--noEmit$/.test(part)));
+    if (invalid) {
+        return 'gate_command_must_execute_dist_script_or_typecheck_directly';
+    }
+    return '';
+}
 function distTargetForScript(script) {
     const match = String(script || '').match(/node\s+\.\/dist\/scripts\/([^\s]+\.js)/);
     return match ? `dist/scripts/${match[1]}` : null;

package/dist/scripts/release-metadata-1-19-check.js

@@ -372,7 +372,8 @@ assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate man
 assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
 assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { release_gates: releaseGates.length });
 assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
-assertGate(Object.keys(pkg.scripts || {}).length <= 100, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length });
+const PACKAGE_SCRIPT_BUDGET = 100;
+assertGate(Object.keys(pkg.scripts || {}).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: PACKAGE_SCRIPT_BUDGET });
 for (const script of requiredPackageScripts)
     assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);
 for (const id of requiredReleaseGates)

package/dist/scripts/seo-geo-feature-fixture-quality-check.js

@@ -9,7 +9,7 @@ for (const id of ['cli-seo-geo-optimizer', 'route-seo-geo-optimizer']) {
     assertGate(feature, `feature missing: ${id}`);
     assertGate(feature.fixture?.status === 'pass', `feature fixture must pass: ${id}`, feature);
     assertGate(feature.fixture?.quality !== 'static_contract', `SEO/GEO feature must not rely on static contract: ${id}`, feature.fixture);
-    assertGate(['runtime_verified', 'runtime_mock_verified'].includes(feature.fixture?.quality), `SEO/GEO fixture quality must be runtime-backed: ${id}`, feature.fixture);
+    assertGate(feature.fixture?.quality === 'runtime_verified', `SEO/GEO fixture quality must be runtime-backed by execution: ${id}`, feature.fixture);
 }
 const selftest = registryMod.buildAllFeaturesSelftest(registry, {});
 const runtimeCheck = selftest.checks.find((check) => check.id === 'runtime_routes_not_static_contract');

package/dist/scripts/sks-1-11-gate-lib.js

@@ -23,15 +23,17 @@ export function runSksJson(args) {
         timeout: Number(process.env.SKS_GATE_TIMEOUT_MS || 120_000),
         env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' }
     });
-    if (result.status !== 0) {
-        assertGate(false, 'sks command failed', { args, status: result.status, stdout: result.stdout, stderr: result.stderr });
-    }
+    let parsed = null;
     try {
-        return JSON.parse(result.stdout);
+        parsed = JSON.parse(result.stdout);
     }
     catch (err) {
         assertGate(false, 'sks command did not emit parseable JSON', { args, stdout: result.stdout, error: err.message });
     }
+    if (result.status !== 0 && !parsed?.mission_id) {
+        assertGate(false, 'sks command failed', { args, status: result.status, stdout: result.stdout, stderr: result.stderr });
+    }
+    return { ...parsed, _process_status: result.status, _stderr_tail: String(result.stderr || '').slice(-600) };
 }
 export function runPptReview(action = 'review') {
     const json = runSksJson(['ppt', 'fixture', '--mock', '--json']);
@@ -46,7 +48,7 @@ export function runPptReview(action = 'review') {
         },
         slideIssues: review.slide_issue_ledger || {}
     };
-    assertGate(json.ok === true, 'ppt imagegen review fixture blocked', json);
+    assertGate(Boolean(json.mission_id), 'ppt imagegen review fixture did not create a mission', json);
     assertGate(json.proof_evidence?.generated_slide_callout_images_count > 0, 'ppt callout image evidence missing', json.proof_evidence);
     assertGate(json.proof_evidence?.slide_issue_extraction_status === 'valid', 'ppt issue extraction missing', json.proof_evidence);
     return json;
@@ -60,7 +62,7 @@ export function runDfixFixture() {
 }
 export function runUxFixture() {
     const json = runSksJson(['image-ux-review', 'fixture', '--mock', '--json']);
-    assertGate(json.ok === true, 'image UX review fixture blocked', json);
+    assertGate(Boolean(json.mission_id), 'image UX review fixture did not create a mission', json);
     return json;
 }
 export function missionFile(missionId, file) {

package/dist/scripts/sks-menubar-install-check.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { PACKAGE_VERSION } from '../core/fsx.js';
+import { PACKAGE_VERSION, runProcess, which } from '../core/fsx.js';
 import { installSksMenuBar } from '../core/codex-app/sks-menubar.js';
 const temp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-check-'));
 const envHomeTemp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-env-home-check-'));
@@ -44,22 +44,30 @@ const actionScript = result.action_script_path ? await fs.readFile(result.action
 const launchAgentSource = result.launch_agent_path ? await fs.readFile(result.launch_agent_path, 'utf8').catch(() => '') : '';
 const infoPlistPath = result.app_path ? path.join(result.app_path, 'Contents', 'Info.plist') : null;
 const infoPlist = infoPlistPath ? await fs.readFile(infoPlistPath, 'utf8').catch(() => '') : '';
+const swiftParse = await swiftParseSmoke(generatedSourcePath);
 const commandRegistry = await fs.readFile(path.join(process.cwd(), 'src', 'cli', 'command-registry.ts'), 'utf8');
 const installHelpers = await fs.readFile(path.join(process.cwd(), 'src', 'cli', 'install-helpers.ts'), 'utf8');
+const cltMissing = process.platform === 'darwin' && result.blockers.includes('xcode_clt_missing');
 const hasVisibleStatusSource = generatedSource.includes('NSStatusItem.variableLength')
     && generatedSource.includes('configureStatusButton(button, title: state.title)')
     && generatedSource.includes('SKS ⚠')
     && generatedSource.includes('SKS ↑')
+    && generatedSource.includes('SKS ⋯')
     && generatedSource.includes('Timer.scheduledTimer(withTimeInterval: 30.0');
 const hasBackgroundReadonlyActions = generatedSource.includes('runSksBackground(["codex-lb", "fast-check"]')
     && generatedSource.includes('runSksBackground(["update", "check"]')
     && generatedSource.includes('display notification')
-    && !generatedSource.includes('@objc func fastCheck() {\n        runSksInTerminal');
-const hasTerminalFailureAlert = generatedSource.includes('output.contains("-1743")')
-    && generatedSource.includes('Privacy & Security > Automation');
-const hasTerminalExit = generatedSource.includes('; exit');
+    && !generatedSource.includes('runSksInTerminal')
+    && !generatedSource.includes('runInTerminal');
+const hasNativeModalSource = generatedSource.includes('func promptText(title: String, message: String')
+    && generatedSource.includes('NSSecureTextField')
+    && generatedSource.includes('stdinText: key + "\\n"');
+const hasActionLogSource = generatedSource.includes('lastActionLogPath')
+    && generatedSource.includes('.posixPermissions: 0o600')
+    && generatedSource.includes('redactSecrets');
 const hasAutosaveNameSource = generatedSource.includes('statusItem.autosaveName = "com.sneakoscope.sks-menubar"');
-const hasExplicitVisibleSource = generatedSource.includes('statusItem.isVisible = true');
+const hasCodexLifecycleSource = generatedSource.includes('Codex app not detected — sync disabled')
+    || (generatedSource.includes('NSWorkspace.didLaunchApplicationNotification') && generatedSource.includes('NSWorkspace.didTerminateApplicationNotification'));
 const hasNoUnconditionalKeepAlive = !launchAgentSource.includes('<key>KeepAlive</key>');
 const hasNoLaunchAgentSecrets = !launchAgentSource.includes('EnvironmentVariables')
     && !launchAgentSource.includes('CODEX_LB_API_KEY')
@@ -69,11 +77,13 @@ const hasInteractiveProcessType = launchAgentSource.includes('<key>ProcessType</
 const hasPackagePlistVersion = infoPlist.includes(`<string>${PACKAGE_VERSION}</string>`)
     && infoPlist.includes('<key>CFBundleShortVersionString</key>')
     && infoPlist.includes('<key>CFBundleVersion</key>');
-const hasActionFallbacks = actionScript.includes('.nvm/versions/node/*/bin/node(Nn[-1])')
+const hasActionFallbacks = actionScript.includes('command -v sks')
+    && actionScript.includes('npm root -g')
+    && actionScript.includes('.nvm/versions/node/*/lib/node_modules/sneakoscope/dist/bin/sks.js')
     && actionScript.includes('/bin/zsh -lc')
-    && actionScript.includes('command -v sks');
-const hasEntryWarning = result.warnings.includes('sks_entry_project_local_ignored_global_package_used')
-    || result.warnings.includes('sks_entry_resolved_under_project_root');
+    && actionScript.includes('exit 127')
+    && actionScript.includes('display notification');
+const hasEntryWarning = result.warnings.includes('sks_entry_project_local');
 const hasBuildStamp = buildStampExists
     && result.build_stamp?.package_version === PACKAGE_VERSION
     && result.build_stamp?.codesign_identifier === 'com.sneakoscope.sks-menubar';
@@ -94,7 +104,8 @@ const expectedMenuItems = [
     'Set OpenRouter Key and GLM Profiles',
     'Fast Check',
     'SKS Version Check',
-    'Update SKS Now'
+    'Update SKS Now',
+    'View Last Log'
 ];
 const missingExpectedItems = expectedMenuItems.filter((item) => !result.menu_items.includes(item));
 const hasExpectedItems = missingExpectedItems.length === 0;
@@ -110,8 +121,9 @@ const launchSkippedForTempInstall = result.launch?.requested === false
     && envHomeResult.warnings.includes('launch_skipped_temp_install');
 const preferredPositionSkippedForTempInstall = !result.actions.includes('seeded SKS menu bar preferred position')
     && !envHomeResult.actions.includes('seeded SKS menu bar preferred position');
-const ok = process.platform === 'darwin'
-    ? result.ok === true
+const darwinOk = cltMissing
+    ? swiftParse.status === 'skipped' && swiftParse.reason === 'xcode_clt_missing'
+    : result.ok === true
         && result.status === 'installed_launch_skipped'
         && secondResult.ok === true
         && envHomeResult.ok === true
@@ -122,10 +134,10 @@ const ok = process.platform === 'darwin'
         && hasExpectedItems
         && hasVisibleStatusSource
         && hasBackgroundReadonlyActions
-        && hasTerminalFailureAlert
-        && hasTerminalExit
+        && hasNativeModalSource
+        && hasActionLogSource
         && hasAutosaveNameSource
-        && hasExplicitVisibleSource
+        && hasCodexLifecycleSource
         && hasNoUnconditionalKeepAlive
         && hasNoLaunchAgentSecrets
         && hasInteractiveProcessType
@@ -133,6 +145,7 @@ const ok = process.platform === 'darwin'
         && hasActionFallbacks
         && hasEntryWarning
         && hasBuildStamp
+        && swiftParse.ok === true
         && isIdempotent
         && hasCommandRegistry
         && noLaunchctlSecretSetenv
@@ -140,7 +153,9 @@ const ok = process.platform === 'darwin'
         && launchSkippedForTempHome
         && launchSkippedForEnvHome
         && launchSkippedForTempInstall
-        && preferredPositionSkippedForTempInstall
+        && preferredPositionSkippedForTempInstall;
+const ok = process.platform === 'darwin'
+    ? darwinOk
     : result.ok === true && result.status === 'unsupported_platform';
 const report = {
     schema: 'sks.sks-menubar-install-check.v1',
@@ -157,10 +172,10 @@ const report = {
     generated_source_path: generatedSourcePath,
     has_visible_status_source: hasVisibleStatusSource,
     has_background_readonly_actions: hasBackgroundReadonlyActions,
-    has_terminal_failure_alert: hasTerminalFailureAlert,
-    has_terminal_exit: hasTerminalExit,
+    has_native_modal_source: hasNativeModalSource,
+    has_action_log_source: hasActionLogSource,
     has_autosave_name_source: hasAutosaveNameSource,
-    has_explicit_visible_source: hasExplicitVisibleSource,
+    has_codex_lifecycle_source: hasCodexLifecycleSource,
     has_no_unconditional_keepalive: hasNoUnconditionalKeepAlive,
     has_no_launch_agent_secrets: hasNoLaunchAgentSecrets,
     has_interactive_process_type: hasInteractiveProcessType,
@@ -168,6 +183,7 @@ const report = {
     has_action_fallbacks: hasActionFallbacks,
     has_entry_warning: hasEntryWarning,
     has_build_stamp: hasBuildStamp,
+    swift_parse: swiftParse,
     is_idempotent: isIdempotent,
     has_command_registry: hasCommandRegistry,
     no_launchctl_secret_setenv: noLaunchctlSecretSetenv,
@@ -193,4 +209,25 @@ async function exists(file) {
         return false;
     }
 }
+async function swiftParseSmoke(sourcePath) {
+    if (process.platform !== 'darwin')
+        return { ok: true, status: 'skipped', reason: 'not_macos' };
+    const xcodeSelect = await which('xcode-select').catch(() => null) || '/usr/bin/xcode-select';
+    const clt = await runProcess(xcodeSelect, ['-p'], { timeoutMs: 5_000, maxOutputBytes: 8 * 1024 })
+        .catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    if (clt.code !== 0)
+        return { ok: true, status: 'skipped', reason: 'xcode_clt_missing', code: clt.code, error: String(clt.stderr || clt.stdout || '').trim() };
+    if (!sourcePath)
+        return { ok: false, status: 'failed', reason: 'source_missing' };
+    const swiftc = await which('swiftc').catch(() => null) || '/usr/bin/swiftc';
+    const parsed = await runProcess(swiftc, ['-parse', sourcePath], { timeoutMs: 30_000, maxOutputBytes: 32 * 1024 })
+        .catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    return {
+        ok: parsed.code === 0,
+        status: parsed.code === 0 ? 'parsed' : 'failed',
+        reason: parsed.code === 0 ? null : 'swift_parse_failed',
+        code: parsed.code,
+        error: parsed.code === 0 ? null : String(parsed.stderr || parsed.stdout || '').trim()
+    };
+}
 //# sourceMappingURL=sks-menubar-install-check.js.map

package/dist/scripts/ux-review-real-loop-fixture-check.js

@@ -1,24 +1,29 @@
 #!/usr/bin/env node
 // @ts-nocheck
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
-const root = process.cwd();
-const result = spawnSync(process.execPath, [path.join(root, 'dist/bin/sks.js'), 'image-ux-review', 'fixture', '--mock', '--json'], {
+const repoRoot = process.cwd();
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-ux-review-real-loop-fixture-'));
+const result = spawnSync(process.execPath, [path.join(repoRoot, 'dist/bin/sks.js'), 'image-ux-review', 'fixture', '--mock', '--json'], {
     cwd: root,
     encoding: 'utf8',
-    env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' },
+    env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', SKS_UPDATE_MIGRATION_GATE_DISABLED: '1', CI: 'true' },
     timeout: Number(process.env.SKS_UX_REVIEW_REAL_LOOP_FIXTURE_TIMEOUT_MS || 180_000)
 });
-assert.equal(result.status, 0, JSON.stringify({
+assert.ok([0, 1].includes(result.status), JSON.stringify({
     stderr: result.stderr,
     stdout: result.stdout,
     signal: result.signal,
     error: result.error?.message || null
 }, null, 2));
 const json = JSON.parse(result.stdout);
+assert.equal(json.ok, false);
 assert.equal(json.artifacts.gate.mock_fixture_cannot_claim_real, true);
 assert.equal(json.artifacts.generated_review_ledger.real_generated_count, 0);
 assert.equal(json.artifacts.generated_review_ledger.generated_count, 1);
+assert.equal(json.proof.status, 'mock_only');
 console.log(JSON.stringify({ schema: 'sks.ux-review-real-loop-fixture.v1', ok: true, mission_id: json.mission_id }, null, 2));
 //# sourceMappingURL=ux-review-real-loop-fixture-check.js.map

package/dist/scripts/ux-review-run-wires-imagegen-check.js

@@ -3,7 +3,11 @@
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('ux-review:run-wires-imagegen', 'src/core/commands/image-ux-review-command.ts', [
     'const shouldGenerateCallouts = flag(args, \'--generate-callouts\') || flag(args, \'--fix\')',
+    'requireCodexImagegen',
     'generateGptImage2CalloutReview',
+    'evidence_class',
+    'output_sha256',
+    'imagegen_response_non_codex_api_fallback_not_full_evidence',
     'extractRealCallouts',
     'buildImageUxCalloutExtractionReport'
 ]);

package/dist/scripts/zellij-slot-telemetry-runtime-check.js

@@ -19,5 +19,6 @@ for (const event of requiredEvents) {
 assertGate(swarm.includes('appendZellijSlotTelemetry'), 'session swarm must append Zellij slot telemetry');
 assertGate(worker.includes('appendZellijSlotTelemetry'), 'native worker must append Zellij slot telemetry');
 assertGate(worker.includes('startWorkerProgressTelemetry'), 'native worker must emit progress telemetry during backend runtime');
+assertGate(!/progress:\s*\{\s*done:\s*tick,\s*total:\s*0/.test(worker), 'heartbeat ticks must not be reported as progress done/total counters');
 emitGate('zellij:slot-telemetry-runtime', { lifecycle_events: requiredEvents.length, progress_pump: true });
 //# sourceMappingURL=zellij-slot-telemetry-runtime-check.js.map

package/docs/demo.tape

@@ -0,0 +1,28 @@
+Output docs/assets/sks-v5-demo.gif
+Set Shell "zsh"
+Set FontSize 16
+Set Width 1280
+Set Height 720
+Set TypingSpeed 20ms
+
+Type "npx sneakoscope install --yes"
+Sleep 500ms
+Enter
+Sleep 1s
+Ctrl+C
+
+Type "sks plan \"ship a proof-first review flow\""
+Enter
+Sleep 1s
+
+Type "sks review --staged"
+Enter
+Sleep 1s
+
+Type "sks ui --once"
+Enter
+Sleep 1s
+
+Type "sks naruto run \"demo no-op swarm\" --backend fake --clones 4 --work-items 4 --no-open-zellij --json"
+Enter
+Sleep 2s

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.8.7",
+  "version": "5.3.0",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -14,7 +14,8 @@
   },
   "bin": {
     "sks": "dist/bin/sks.js",
-    "sneakoscope": "dist/bin/sks.js"
+    "sneakoscope": "dist/bin/sks.js",
+    "sneakoscope-install": "dist/bin/install.js"
   },
   "publishConfig": {
     "access": "public",
@@ -32,8 +33,17 @@
     "!dist/**/*.tsbuildinfo",
     "!dist/**/__tests__",
     "!dist/**/*.test.js",
+    "!dist/scripts/*blackbox*.js",
+    "dist/scripts/doctor-context7-mcp-repair-blackbox.js",
+    "dist/scripts/doctor-fix-production-blackbox.js",
+    "dist/scripts/doctor-startup-config-repair-blackbox.js",
+    "dist/scripts/doctor-supabase-mcp-repair-blackbox.js",
+    "dist/scripts/project-skill-dedupe-blackbox.js",
+    "dist/scripts/supabase-secret-preservation-blackbox.js",
+    "dist/scripts/update-preserves-supabase-keys-blackbox.js",
     "!dist/vendor/openai-codex/rust-v0.131.0",
     "config/codex-releases/rust-v0.142.0.json",
+    "config/bench-baseline.json",
     "schemas",
     "!schemas/codex/app-server-0.142/**",
     "schemas/codex/app-server-0.142/codex_app_server_protocol.v2.schemas.json",
@@ -41,6 +51,8 @@
     "crates/sks-core/Cargo.lock",
     "crates/sks-core/Cargo.toml",
     "crates/sks-core/src",
+    "docs/demo.tape",
+    "docs/assets/sneakoscope-architecture-pipeline.jpg",
     "README.md",
     "LICENSE"
   ],
@@ -60,17 +72,31 @@
     "runtime:dist-parity": "node ./dist/scripts/runtime-dist-parity-check.js",
     "release:check": "npm run release:check:affected --silent",
     "release:metadata": "node ./dist/scripts/release-metadata-check.js",
+    "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",
     "release:check:parallel": "npm run build --silent && node ./dist/scripts/release-parallel-check.js && node ./dist/scripts/release-check-stamp.js write",
     "release:check:legacy": "npm run release:check:parallel --silent",
+    "release:dag-full-coverage": "node ./dist/scripts/release-dag-full-coverage-check.js",
     "core-skill:route-runtime-integration": "node ./dist/scripts/core-skill-route-runtime-integration-check.js",
+    "core-skill:no-drift": "node ./dist/scripts/core-skill-no-drift-check.js",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "schema:check": "node ./dist/scripts/check-runtime-schemas.js",
     "repo-audit": "node ./dist/scripts/repo-audit.js",
+    "native-capability:postcheck": "node ./dist/scripts/native-capability-postcheck-check.js",
+    "secret:preservation-guard": "node ./dist/scripts/secret-preservation-guard-check.js",
+    "secret:supabase-preservation-blackbox": "node ./dist/scripts/supabase-secret-preservation-blackbox.js",
+    "update:preserves-supabase-keys": "node ./dist/scripts/update-preserves-supabase-keys-blackbox.js",
+    "skill:dedupe-blackbox": "node ./dist/scripts/project-skill-dedupe-blackbox.js",
     "postinstall": "node ./dist/bin/sks.js postinstall",
     "selftest": "node ./dist/bin/sks.js selftest --mock",
     "doctor": "node ./dist/bin/sks.js doctor",
+    "doctor:fix-production-blackbox": "node ./dist/scripts/doctor-fix-production-blackbox.js",
+    "doctor:startup-config-repair-blackbox": "node ./dist/scripts/doctor-startup-config-repair-blackbox.js",
+    "doctor:context7-mcp-repair-blackbox": "node ./dist/scripts/doctor-context7-mcp-repair-blackbox.js",
+    "doctor:supabase-mcp-repair-blackbox": "node ./dist/scripts/doctor-supabase-mcp-repair-blackbox.js",
     "codex:config-load-probe": "node ./dist/scripts/codex-config-load-probe.js --json",
     "codex:actual-config-load-probe": "node ./dist/scripts/codex-config-load-probe.js --actual-codex --json",
+    "codex:0140-capability": "node ./dist/scripts/codex-0140-capability-check.js",
+    "codex:0140-feature-probes": "node ./dist/scripts/codex-0140-feature-probes-check.js",
     "runtime:ts-rust-boundary": "node ./dist/scripts/runtime-ts-rust-boundary-check.js",
     "release:check:dynamic": "node ./dist/scripts/release-check-dynamic.js",
     "release:check:dynamic:execute": "node ./dist/scripts/release-check-dynamic-execute.js",
@@ -96,34 +122,15 @@
     "feature:check": "node ./dist/bin/sks.js features check --json",
     "feature-quality:check": "node ./dist/scripts/check-feature-quality.js --release",
     "all-features:selftest": "node ./dist/bin/sks.js all-features selftest --mock --json",
-    "trust:check": "node ./dist/bin/sks.js trust validate latest --json || node ./dist/scripts/trust-fixture-check.js",
-    "wrongness:check": "node ./dist/bin/sks.js wrongness validate project --json && node ./dist/scripts/wrongness-fixture-check.js",
-    "git-hygiene:check": "node ./dist/bin/sks.js git doctor --json",
-    "shared-memory:check": "node ./dist/bin/sks.js wiki validate-shared --json || node ./dist/scripts/shared-memory-fixture-check.js",
-    "evidence:check": "node ./dist/scripts/evidence-fixture-check.js",
-    "codex-app:handoff": "node ./dist/scripts/codex-app-handoff-check.js",
-    "qa-loop:app-handoff": "node ./dist/scripts/qa-loop-app-handoff-check.js",
-    "qa-loop:app-handoff-capability": "node ./dist/scripts/qa-loop-app-handoff-capability-check.js",
-    "qa-loop:app-handoff-cli": "node ./dist/scripts/qa-loop-app-handoff-cli-check.js",
-    "qa-loop:image-path-exposure": "node ./dist/scripts/qa-loop-image-path-exposure-check.js",
-    "qa-loop:effort-escalation": "node ./dist/scripts/qa-loop-effort-escalation-check.js",
-    "qa-loop:budget-policy": "node ./dist/scripts/qa-loop-budget-policy-check.js",
     "naruto:real-active-pool-runtime": "node ./dist/scripts/naruto-real-active-pool-runtime-check.js",
+    "bench": "node ./dist/scripts/coding-bench-check.js",
+    "release:check:bench": "npm run build:incremental --silent && npm run bench --silent",
     "release:check:affected": "npm run build:incremental --silent && node ./dist/scripts/release-gate-dag-runner.js --preset affected --changed-since auto --sla 5m && node ./dist/scripts/release-check-stamp.js write",
     "release:check:fast": "npm run build:incremental --silent && node ./dist/scripts/release-gate-dag-runner.js --preset fast --changed-since auto --sla 5m && node ./dist/scripts/release-check-stamp.js write",
     "release:check:confidence": "npm run build:incremental --silent && node ./dist/scripts/release-gate-dag-runner.js --preset confidence --changed-since auto --sla 5m && node ./dist/scripts/release-check-stamp.js write",
-    "release:check:full": "npm run build:clean --silent && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-check-stamp.js write",
+    "release:check:full": "npm run build:clean --silent && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-gate-dag-runner.js --preset bench --full && node ./dist/scripts/release-check-stamp.js write",
     "publish:prep-ignore-scripts": "npm run prepublishOnly",
     "publish:ignore-scripts": "npm run publish:prep-ignore-scripts && npm publish --ignore-scripts",
-    "naruto:ssot-gate-aliases": "node ./dist/scripts/naruto-ssot-gate-aliases-check.js",
-    "codex-app:handoff-launch": "node ./dist/scripts/codex-app-handoff-launch-check.js",
-    "qa-loop:app-handoff-launch": "node ./dist/scripts/qa-loop-app-handoff-launch-check.js",
-    "qa-loop:app-handoff-confirmation": "node ./dist/scripts/qa-loop-app-handoff-confirmation-check.js",
-    "qa-loop:app-handoff-status-lifecycle": "node ./dist/scripts/qa-loop-app-handoff-status-lifecycle-check.js",
-    "qa-loop:app-handoff-gate-lifecycle": "node ./dist/scripts/qa-loop-app-handoff-gate-lifecycle-check.js",
-    "qa-loop:image-path-prompt-injection": "node ./dist/scripts/qa-loop-image-path-prompt-injection-check.js",
-    "loop:integration-finalizer": "node ./dist/scripts/loop-integration-finalizer-check.js",
-    "qa-loop:execution-profile-routing": "node ./dist/scripts/qa-loop-execution-profile-routing-check.js",
     "gates:run": "node ./dist/scripts/release-gate-dag-runner.js",
     "policy:gate-audit": "node ./dist/scripts/gate-policy-audit-check.js"
   },