sneakoscope 5.1.2 → 5.5.0

package/dist/core/release/release-gate-node.js

@@ -50,6 +50,8 @@ export function validateReleaseGateManifest(input) {
             errors.push(`gate_timeout_missing:${gate?.id || 'unknown'}`);
         if (gate?.output_contract !== undefined && gate.output_contract !== 'sks.gate-result.v1')
             errors.push(`gate_output_contract_invalid:${gate?.id || 'unknown'}`);
+        if (gate?.contract_note !== undefined && typeof gate.contract_note !== 'string')
+            errors.push(`gate_contract_note_invalid:${gate?.id || 'unknown'}`);
         if (!gate?.cache || typeof gate.cache.enabled !== 'boolean' || !Array.isArray(gate.cache.inputs))
             errors.push(`gate_cache_missing:${gate?.id || 'unknown'}`);
         if (!gate?.isolation || gate.isolation.report_dir !== 'per-gate')

package/dist/core/routes.js

@@ -155,6 +155,7 @@ export const ROUTES = [
         context7Policy: 'if_external_docs',
         reasoningPolicy: 'medium',
         stopGate: 'none',
+        coverageExemptReason: 'read-only answer route; never writes or modifies code/files',
         cliEntrypoint: 'implicit question route',
         examples: ['이 파이프라인이 왜 이렇게 동작해?', 'What does this hook do?']
     },
@@ -169,6 +170,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'medium',
         stopGate: 'honest_mode',
+        coverageExemptReason: 'setup/help/status routing only; delegates any real work to the target route it dispatches to',
         cliEntrypoint: 'sks commands',
         examples: ['$SKS show me available workflows']
     },
@@ -213,6 +215,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'single boolean project-config toggle, not a code-changing work order',
         cliEntrypoint: 'sks fast-mode on|off|status|clear [--json]',
         examples: ['$Fast-On', '$Fast-Off', '$Fast-Mode status']
     },
@@ -229,6 +232,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'single boolean project-config toggle, not a code-changing work order',
         cliEntrypoint: 'sks with-local-llm on|off|status|set-model [--json]',
         examples: ['$with-local-llm-on', '$with-local-llm-off', 'sks with-local-llm status --json']
     },
@@ -249,6 +253,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'high',
         stopGate: 'naruto-gate.json',
+        coverage_required: true,
         cliEntrypoint: 'sks team "task" [executor:5 reviewer:6 user:1] | sks team log|tail|watch|lane|status|event|message|open-zellij|attach-zellij|cleanup-zellij',
         examples: ['$Team executor:5 agree on the best plan and implement it', '$From-Chat-IMG 채팅+첨부 이미지 작업 지시서']
     },
@@ -265,6 +270,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'high',
         stopGate: 'naruto-gate.json',
+        coverage_required: true,
         cliEntrypoint: 'sks naruto run "task" [--clones N] [--backend codex-sdk|fake|ollama] [--parallel-write] | sks naruto status',
         examples: ['$Naruto run sweep the codebase for TODO comments with 50 clones', '$Work', '$Swarm "fix all lint errors"']
     },
@@ -353,6 +359,7 @@ export const ROUTES = [
         context7Policy: 'if_external_docs',
         reasoningPolicy: 'medium',
         stopGate: 'loop-graph-proof.json',
+        coverage_required: true,
         cliEntrypoint: 'sks goal create|pause|resume|clear|status',
         examples: ['$Goal persist this migration workflow with native /goal continuation']
     },
@@ -367,6 +374,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'packages already-made changes into one commit; does not itself decide what work to do',
         cliEntrypoint: 'sks commit [--message "msg"] [--json]',
         examples: ['$Commit 이번 작업 커밋해줘']
     },
@@ -381,6 +389,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'packages already-made changes into one commit and pushes; does not itself decide what work to do',
         cliEntrypoint: 'sks commit-and-push [--message "msg"] [--json]',
         examples: ['$Commit-And-Push 커밋하고 바로 푸쉬해줘']
     },
@@ -514,6 +523,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'medium',
         stopGate: 'none',
+        coverageExemptReason: 'single fixed maintenance action (refresh/pack/validate/prune), not a free-form work order',
         cliEntrypoint: 'sks wiki refresh|pack|validate|prune',
         examples: ['$Wiki refresh', '$Wiki prune and validate']
     },
@@ -528,6 +538,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'medium',
         stopGate: 'none',
+        coverageExemptReason: 'read-only help/discovery output; never writes or modifies code/files',
         cliEntrypoint: 'sks help',
         examples: ['$Help show available SKS commands']
     }

package/dist/core/stop-gate/stop-gate-check.js

@@ -145,6 +145,10 @@ export async function checkStopGate(input) {
         missingFields.push('regression_test_added');
     if (bugfixMission && normalizedGate.evidence.regression_test_failed_before_fix !== true)
         missingFields.push('regression_test_failed_before_fix');
+    if (normalizedGate.evidence.required_coverage_passed === false)
+        missingFields.push('coverage_required_but_not_passed');
+    if ((normalizedGate.evidence.uncovered_required_count ?? 0) > 0)
+        missingFields.push(`work_order_uncovered_count:${normalizedGate.evidence.uncovered_required_count}`);
     if (normalizedGate.status === 'passed'
         && normalizedGate.passed === true
         && normalizedGate.blockers.length === 0

package/dist/core/stop-gate/stop-gate-writer.js

@@ -140,6 +140,10 @@ function evidenceMissingBlockers(evidence) {
         blockers.push('regression_test_not_added');
     if (evidence.regression_test_failed_before_fix === false)
         blockers.push('regression_test_failed_before_fix_missing');
+    if (evidence.required_coverage_passed === false)
+        blockers.push('coverage_required_but_not_passed');
+    if ((evidence.uncovered_required_count ?? 0) > 0)
+        blockers.push(`work_order_uncovered_count:${evidence.uncovered_required_count}`);
     return blockers;
 }
 //# sourceMappingURL=stop-gate-writer.js.map

package/dist/core/trust-kernel/trust-report.js

@@ -54,7 +54,14 @@ export async function latestTrustReport(root, missionArg = 'latest') {
         return staleTrustReport(report, temporalIssues);
     }
     if (!proof) {
-        return {
+        // Persist this computed report even though it's a blocked result: `trust report`
+        // is expected to leave a durable trust-report.json behind for anyone (a human or
+        // a later `sks trust report <mission>` call) to inspect, the same way the
+        // completion-proof-present path below does via writeTrustArtifactsForProof(). An
+        // in-memory-only "blocked" result that vanishes after this call returns is
+        // surprising and was the reason `sks trust report latest --json` could exit 0
+        // with a blocked status yet leave no artifact on disk.
+        const report = {
             schema: TRUST_REPORT_SCHEMA,
             ...trustKernelMetadata(),
             ok: false,
@@ -62,6 +69,8 @@ export async function latestTrustReport(root, missionArg = 'latest') {
             status: 'blocked',
             issues: ['completion_proof_missing']
         };
+        await writeJsonAtomic(trustReportPath(root, missionId), report).catch(() => undefined);
+        return report;
     }
     const rebuilt = await writeTrustArtifactsForProof(root, proof);
     if (!rebuilt) {

package/dist/core/update/update-migration-state.js

@@ -7,6 +7,7 @@ import { enforceRetention } from '../retention.js';
 import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileSkills } from '../init/skills.js';
 import { codexHookTrustDoctor } from '../codex-hooks/codex-hook-trust-doctor.js';
+import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
 export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
 export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
 export function installationEpochPath() {
@@ -367,9 +368,28 @@ async function runConfigFastModeNormalizeStage() {
     });
     if (!hasTopLevel)
         next = insertTopLevelTomlKey(next, `default_profile = ${JSON.stringify(misplaced)}`);
-    if (next !== text)
-        await writeTextAtomic(configPath, `${next.trim()}\n`);
-    return { ok: true, status: 'ok', actions: ['normalized_fastmode_default_profile'], blockers: [], warnings: [], detail: { config_path: configPath, default_profile: misplaced } };
+    let guardResult = null;
+    if (next !== text) {
+        guardResult = await writeCodexConfigGuarded({
+            configPath,
+            before: text,
+            mutate: () => `${next.trim()}\n`,
+            cause: 'project-update-fastmode-default-profile',
+            backupTag: 'project-update-fastmode-default-profile',
+            preserveFastUiKeys: true
+        });
+        if (!guardResult.ok) {
+            return {
+                ok: false,
+                status: 'failed',
+                actions: ['normalize_fastmode_default_profile_blocked'],
+                blockers: [`codex_config_guard:${guardResult.status}`],
+                warnings: [],
+                detail: { config_path: configPath, default_profile: misplaced, guard: guardResult }
+            };
+        }
+    }
+    return { ok: true, status: 'ok', actions: ['normalized_fastmode_default_profile'], blockers: [], warnings: [], detail: { config_path: configPath, default_profile: misplaced, guard: guardResult } };
 }
 async function runHookTrustRefreshStage(root) {
     const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '5.1.2';
+export const PACKAGE_VERSION = '5.5.0';
 //# sourceMappingURL=version.js.map

package/dist/core/work-order-ledger.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from './fsx.js';
 import { ARTIFACT_FILES, validateWorkOrderLedger } from './artifact-schemas.js';
+import { promptRequirementItems } from './questions.js';
 export function createWorkOrderLedger({ missionId = 'unassigned', route = 'team', requests = [], sourcesComplete = false } = {}) {
     const items = requests.map((request, index) => ({
         id: `WO-${String(index + 1).padStart(3, '0')}`,
@@ -38,6 +39,27 @@ export async function writeWorkOrderLedger(dir, ledger) {
 export async function readWorkOrderLedger(dir) {
     return readJson(path.join(dir, ARTIFACT_FILES.work_order_ledger), null);
 }
+export function evaluateWorkOrderCoverage(ledger) {
+    if (!ledger)
+        return { ok: true, blockers: [], uncovered_count: 0 };
+    const blockers = [];
+    if (!ledger.source_inventory_complete)
+        blockers.push('work_order_inventory_truncated');
+    if (!ledger.all_customer_requests_mapped)
+        blockers.push('work_order_requests_not_mapped');
+    if (!ledger.all_work_items_verified)
+        blockers.push('work_order_items_not_verified');
+    let uncovered_count = 0;
+    for (const item of (ledger.items || [])) {
+        const isVerified = item.status === 'verified';
+        const isBlockedWithEvidence = item.status === 'blocked' && item.blocker?.blocked === true;
+        if (!isVerified && !isBlockedWithEvidence) {
+            uncovered_count += 1;
+            blockers.push(`work_order_uncovered:${item.id}:"${item.source?.verbatim?.slice(0, 40) || ''}"`);
+        }
+    }
+    return { ok: blockers.length === 0, blockers, uncovered_count };
+}
 export function updateWorkOrderItem(ledger, id, patch = {}) {
     return {
         ...ledger,
@@ -51,4 +73,42 @@ export function updateWorkOrderItem(ledger, id, patch = {}) {
         })
     };
 }
+/**
+ * Parses a free-form work-order prompt into WO-001..N ledger items (via
+ * promptRequirementItems) and persists the ledger at mission creation time,
+ * so every item is registered verbatim before any execution starts.
+ */
+export async function createAndWriteWorkOrderLedgerForPrompt(dir, { missionId, route, prompt } = {}) {
+    const { items, truncated } = promptRequirementItems(String(prompt || ''));
+    const requests = items.map((item) => ({
+        type: 'chat_text',
+        verbatim: item.text,
+        location: `prompt:${item.id}`
+    }));
+    const ledger = createWorkOrderLedger({ missionId, route, requests, sourcesComplete: !truncated });
+    await writeWorkOrderLedger(dir, ledger);
+    return ledger;
+}
+/**
+ * Closes out every item in a mission's ledger to a terminal state once the
+ * route's own gate has decided ok/not-ok, so evaluateStop's coverage gate
+ * (which blocks stop while any item sits in 'pending') can never wait
+ * forever: an item is either verified (route succeeded) or honestly
+ * blocked (route failed, real blockers recorded), never left hanging.
+ * This is coarser than true per-item tracking, but it closes the loop.
+ */
+export async function closeWorkOrderLedgerForRouteResult(dir, { ok, blockers = [] }) {
+    const ledger = await readWorkOrderLedger(dir);
+    if (!ledger || !Array.isArray(ledger.items) || ledger.items.length === 0)
+        return null;
+    let next = ledger;
+    for (const item of ledger.items) {
+        const patch = ok
+            ? { status: 'verified', implementation_tasks: item.implementation_tasks?.length ? item.implementation_tasks : ['route_completion'] }
+            : { status: 'blocked', blocker: { blocked: true, reason: blockers.join(', ') || 'route_completion_blocked', needed_to_unblock: 'resolve the route blockers and re-run' } };
+        next = updateWorkOrderItem(next, item.id, patch);
+    }
+    await writeWorkOrderLedger(dir, next);
+    return next;
+}
 //# sourceMappingURL=work-order-ledger.js.map

package/dist/core/zellij/zellij-slot-telemetry.js

@@ -272,7 +272,7 @@ function normalizeStatus(value) {
     const text = String(value || '').toLowerCase();
     if (text === 'closed' || text === 'done' || text === 'passed')
         return 'completed';
-    if (text === 'blocked' || text === 'error')
+    if (text === 'blocked' || text === 'error' || text === 'timed_out')
         return 'failed';
     if (text === 'coding')
         return 'running';

package/dist/scripts/doctor-context7-mcp-repair-blackbox.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+const root = await makeTempRoot('sks-context7-blackbox-');
+const configPath = path.join(root, '.codex', 'config.toml');
+await writeText(configPath, '[mcp_servers.context7]\ncommand = "npx"\n');
+const repaired = await repairContext7Mcp({ root, apply: true });
+const text = await fs.readFile(configPath, 'utf8');
+assertGate(repaired.ok === true && text.includes('https://mcp.context7.com/mcp'), 'Context7 blackbox must write remote URL', { repaired, text });
+await writeText(configPath, '[mcp_servers.context7]\ndisabled = true\ncommand = "npx"\n');
+const disabled = await repairContext7Mcp({ root, apply: true });
+assertGate(disabled.after_transport === 'disabled' && disabled.repaired === false && disabled.disabled_preserved === true, 'Context7 blackbox must preserve explicitly disabled server', disabled);
+emitGate('doctor:context7-mcp-repair-blackbox');
+//# sourceMappingURL=doctor-context7-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
+import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
+const root = await makeTempRoot('sks-doctor-production-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const startup = await repairCodexStartupConfig({ root, apply: true });
+const context7 = await repairContext7Mcp({ root, apply: true });
+const supabase = await repairSupabaseMcp({ root, apply: true });
+const tx = await runDoctorFixTransaction({ root, phases: [
+        { id: 'preflight', run: async () => ({ id: 'preflight', ok: true }) },
+        { id: 'codex_startup_config_repair', run: async () => ({ id: 'codex_startup_config_repair', ok: startup.ok, repaired: true, blockers: startup.blockers, rollback_evidence: 'fixture_config_backup' }) },
+        { id: 'context7_mcp_repair', run: async () => ({ id: 'context7_mcp_repair', ok: context7.ok, repaired: context7.repaired, blockers: context7.blockers, rollback_evidence: 'fixture_context7_backup' }) },
+        { id: 'supabase_mcp_repair', required_for_ready: false, run: async () => ({ id: 'supabase_mcp_repair', ok: supabase.ok, manual_required: supabase.manual_required, required_for_ready: false, blockers: supabase.blockers, warnings: supabase.warnings, rollback_evidence: 'optional_supabase_fixture' }) },
+        { id: 'postcheck', run: async () => ({ id: 'postcheck', ok: true }) }
+    ] });
+const postcheck = doctorRepairPostcheck(tx);
+assertGate(tx.schema === 'sks.doctor-fix-transaction.v2' && tx.raw_secret_values_recorded === false, 'doctor transaction must write production schema without raw secrets', tx);
+assertGate(tx.phases.every((phase) => typeof phase.duration_ms === 'number' && phase.started_at && phase.completed_at), 'doctor transaction phases must include runtime evidence', tx);
+assertGate(postcheck.ok === true, 'doctor repair postcheck must pass when only manual-required optional phases remain', postcheck);
+emitGate('doctor:fix-production-blackbox', { phases: tx.phases.length });
+//# sourceMappingURL=doctor-fix-production-blackbox.js.map

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+const root = await makeTempRoot('sks-startup-config-blackbox-');
+await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const report = await repairCodexStartupConfig({ root, apply: true });
+const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);
+assertGate(!text.includes('message_role_prefix') && /config_file = "\//.test(text), 'startup config blackbox must rewrite to absolute config paths and remove unsupported fields', { text });
+emitGate('doctor:startup-config-repair-blackbox');
+//# sourceMappingURL=doctor-startup-config-repair-blackbox.js.map

package/dist/scripts/doctor-supabase-mcp-repair-blackbox.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
+const root = await makeTempRoot('sks-supabase-mcp-blackbox-');
+delete process.env.SUPABASE_ACCESS_TOKEN;
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nSUPABASE_ACCESS_TOKEN = "env:SUPABASE_ACCESS_TOKEN"\n');
+const unsafe = await repairSupabaseMcp({ root, apply: true });
+assertGate(unsafe.ok === true && unsafe.manual_required === true && unsafe.read_only_migrated === true && unsafe.ready_blocking === false, 'Supabase unsafe write access must be migrated to read-only without passing silently as write-ready', unsafe);
+await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase_sauron]\ndisabled = true\n');
+const optional = await repairSupabaseMcp({ root, apply: true });
+assertGate(optional.ok === true && optional.disabled === true && optional.disabled_preserved === true, 'optional disabled Supabase config must be preserved', optional);
+emitGate('doctor:supabase-mcp-repair-blackbox');
+//# sourceMappingURL=doctor-supabase-mcp-repair-blackbox.js.map

package/dist/scripts/gate-policy-audit-check.js

@@ -26,9 +26,9 @@ const directCodexConfigWrites = scanDirectCodexConfigWrites();
 const commandGateContract = scanCommandGateContract();
 const directMkdtempCalls = scanDirectMkdtempCalls();
 const rustTempdirCalls = scanRustTempdirCalls();
-if (releaseGates.length > 200)
+if (releaseGates.length > 220)
     blockers.push(`release_preset_gate_budget_exceeded:${releaseGates.length}`);
-if (gates.length > 200)
+if (gates.length > 220)
     blockers.push(`release_manifest_gate_budget_exceeded:${gates.length}`);
 if (Object.keys(pkg.scripts || {}).length > 100)
     blockers.push(`package_script_budget_exceeded:${Object.keys(pkg.scripts || {}).length}`);

package/dist/scripts/naruto-real-active-pool-runtime-check.js

@@ -49,7 +49,32 @@ const artifactEvidence = report.worker_lifecycle.every((row) => row.worker_artif
     && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-heartbeat.jsonl'))
     && fs.existsSync(path.join(row.worker_artifact_dir, 'worker-result.json'))
     && fs.existsSync(path.join(row.worker_artifact_dir, 'codex-control', 'codex-control-proof.json')));
+const timeoutReport = await runNarutoRealActivePool({
+    graph: buildNarutoWorkGraph({ requestedClones: 1, totalWorkItems: 1, writeCapable: false, maxActiveWorkers: 1 }),
+    governor: { ...target, safe_active_workers: 1, safe_zellij_visible_panes: 0 },
+    hardTimeoutMs: 1,
+    spawnWorker: async (item, placement) => ({
+        id: item.id,
+        item,
+        placement,
+        started_at: Date.now() - 1000,
+        pid: null,
+        worker_artifact_dir: path.join(tempRoot, 'timeout-worker'),
+        heartbeat_path: path.join(tempRoot, 'timeout-worker', 'worker-heartbeat.jsonl'),
+        exit: new Promise(() => undefined)
+    }),
+    collectWorker: async () => {
+        throw new Error('timed out worker should be force-collected before collectWorker');
+    },
+    enqueueVerification: async () => undefined,
+    updateDashboard: async () => undefined
+});
+const timeoutEvidence = timeoutReport.completed_count === 1
+    && timeoutReport.failed_count === 1
+    && timeoutReport.blockers.includes('naruto_worker_hard_timeout')
+    && timeoutReport.worker_lifecycle.some((row) => row.ok === false && row.completed_at !== null);
 const ok = report.ok && spawned === graph.total_work_items && collected === graph.total_work_items && report.max_observed_active_workers >= target.safe_active_workers && report.active_pool_utilization >= 0.8 && processEvidence && artifactEvidence;
 assertGate(ok, 'Naruto real active pool runtime must include actual child process, heartbeat, and result evidence', { report, spawned, collected, processEvidence, artifactEvidence, tempRoot });
-emitGate('naruto:real-active-pool-runtime', report);
+assertGate(timeoutEvidence, 'Naruto real active pool must force-collect hung workers as timed-out results', { timeoutReport });
+emitGate('naruto:real-active-pool-runtime', { ...report, timeout_force_collect_checked: true });
 //# sourceMappingURL=naruto-real-active-pool-runtime-check.js.map

package/dist/scripts/packlist-performance-check.js

@@ -7,7 +7,13 @@ import { spawnSync } from 'node:child_process';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
 const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 1024);
-const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2300 * 1024);
+// Raised from 2300 KiB after the 5.4.0 dollar-command hardening pass added
+// src/core/feature-fixture-executor.ts and expanded several command modules
+// (route-success-helpers.ts, seo-command.ts, ppt-command.ts, qa-loop-command.ts,
+// research-command.ts, image-ux-review-command.ts, mad-sks-command.ts,
+// sks-menubar.ts) with genuine new production logic, pushing the packed size
+// to ~2306 KiB. Kept modest headroom rather than a large jump.
+const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2340 * 1024);
 function runNpmPack() {
     const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
     const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { assertGate, emitGate, makeTempRoot, writeManagedCoreSkill, writeUserSkill } from './sks-3-1-8-check-lib.js';
+import { dedupeProjectSkills } from '../core/codex-native/project-skill-dedupe.js';
+import { syncCodexSksSkills, withSkillSyncLock } from '../core/codex-app/codex-skill-sync.js';
+import { buildSkillRegistryLedger } from '../core/codex-native/skill-registry-ledger.js';
+const root = await makeTempRoot('sks-skill-dedupe-blackbox-');
+process.env.CODEX_HOME = path.join(root, 'codex-home');
+await writeManagedCoreSkill(root, '.agents/skills', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const scenarioA = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop', 'loop');
+await writeManagedCoreSkill(root, '.codex/skills', 'loop');
+const scenarioB = await dedupeProjectSkills({ root, fix: true, yes: true });
+await writeUserSkill(root, '.agents/skills', 'user-loop-a', 'Loop');
+await writeUserSkill(root, '.codex/skills', 'user-loop-b', 'loop');
+const scenarioC = await dedupeProjectSkills({ root, fix: true, yes: false });
+const scenarioD = await dedupeProjectSkills({ root, fix: true, yes: true, quarantineUserDuplicates: true });
+const staleRoot = await makeTempRoot('sks-skill-stale-lock-');
+const lockPath = path.join(staleRoot, '.sneakoscope', 'locks', 'skill-sync.lock');
+await fs.mkdir(lockPath, { recursive: true });
+await fs.writeFile(path.join(lockPath, 'owner.json'), JSON.stringify({ schema: 'sks.skill-sync-lock.v1', pid: 999999, acquired_at: '1970-01-01T00:00:00.000Z', stale_after_ms: 1 }), 'utf8');
+await withSkillSyncLock(staleRoot, async () => undefined);
+const concurrentRoot = await makeTempRoot('sks-skill-concurrent-');
+process.env.CODEX_HOME = path.join(concurrentRoot, 'codex-home');
+const skillsRoot = path.join(process.env.CODEX_HOME, 'skills');
+await Promise.all(Array.from({ length: 20 }, () => syncCodexSksSkills({ root: concurrentRoot, apply: true, skillsRoot })));
+const concurrentLedger = await buildSkillRegistryLedger({ root: concurrentRoot });
+assertGate(scenarioA.actions.some((action) => action.action === 'quarantined'), 'scenario A must quarantine SKS-managed duplicate', scenarioA);
+assertGate(scenarioB.actions.some((action) => action.reason.includes('user-authored skill preserved')), 'scenario B must preserve user-authored skill', scenarioB);
+assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate_requires_confirmation')), 'scenario C must not auto-delete user-authored duplicates', scenarioC);
+assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
+assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
+emitGate('skill:dedupe-blackbox');
+//# sourceMappingURL=project-skill-dedupe-blackbox.js.map

package/dist/scripts/release-dag-full-coverage-check.js

@@ -42,7 +42,7 @@ const schemaComplete = [...releaseManifest.gates, ...harnessManifest.gates].ever
 const report = {
     schema: 'sks.release-dag-full-coverage-check.v2',
     ok: schemaComplete
-        && releasePreset.length <= 200
+        && releasePreset.length <= 220
         && missingRequiredReleasePreset.length === 0
         && missingRequiredHarnessPreset.length === 0
         && duplicateAcrossManifests.length === 0

package/dist/scripts/release-gate-existence-audit.js

@@ -42,7 +42,7 @@ const releaseCheckTarget = releaseCheck.includes('release:check:affected')
     ? String(scripts['release:check:affected'] || '')
     : releaseCheck;
 assertGate(releaseCheckTarget.includes('release-gate-dag-runner') && /--preset\s+(?:release|affected)/.test(releaseCheckTarget), 'release:check must use the v2 DAG release/affected preset', { release_check: scripts['release:check'], resolved_release_check: releaseCheckTarget });
-assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { gate_count: releaseGates.length });
+assertGate(releaseGates.length > 0 && releaseGates.length <= 220, 'release v2 manifest must include 1..220 release gates', { gate_count: releaseGates.length });
 const PACKAGE_SCRIPT_BUDGET = 150;
 assertGate(Object.keys(scripts).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(scripts).length, limit: PACKAGE_SCRIPT_BUDGET });
 for (const id of requiredRelease)

package/dist/scripts/release-gate-planner.js

@@ -27,7 +27,7 @@ const harnessNonZellij = harnessIds.filter((id) => !id.startsWith('zellij:'));
 const releasePresetLeaks = release.gates.filter((gate) => !Array.isArray(gate.preset) || !gate.preset.includes('release')).map((gate) => gate.id);
 const harnessPresetLeaks = harness.gates.filter((gate) => !Array.isArray(gate.preset) || !gate.preset.includes('harness') || gate.preset.includes('release')).map((gate) => gate.id);
 const npmRunGates = release.gates.concat(harness.gates).filter((gate) => /\bnpm\s+run\b/.test(String(gate.command))).map((gate) => gate.id);
-assertGate(release.gates.length <= 200, 'release preset gate budget exceeded', { release_gates: release.gates.length, limit: 200 });
+assertGate(release.gates.length <= 220, 'release preset gate budget exceeded', { release_gates: release.gates.length, limit: 220 });
 assertGate(Object.keys(scripts).length <= PACKAGE_SCRIPT_BUDGET, 'package.json script budget exceeded', { scripts: Object.keys(scripts).length, limit: PACKAGE_SCRIPT_BUDGET });
 assertGate(duplicateAcrossManifests.length === 0, 'gate appears in both release and harness manifests', { duplicateAcrossManifests });
 assertGate(releaseZellij.length === 0, 'zellij gates must live in infra-harness-gates.json, not release-gates.v2.json', { releaseZellij });

package/dist/scripts/release-gate-script-parity-check.js

@@ -4,10 +4,6 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { assertGate, emitGate, readJson, root } from './sks-1-18-gate-lib.js';
 import { writeJsonAtomic } from '../core/fsx.js';
-import { REQUIRED_3112_REAL_CHECK_IDS, REQUIRED_3112_RELEASE_IDS } from './release-3112-required-gates.js';
-import { REQUIRED_3113_REAL_CHECK_IDS, REQUIRED_3113_RELEASE_IDS } from './release-3113-required-gates.js';
-import { REQUIRED_4000_REAL_CHECK_IDS, REQUIRED_4000_RELEASE_IDS } from './release-4000-required-gates.js';
-import { REQUIRED_4002_REAL_CHECK_IDS, REQUIRED_4002_RELEASE_IDS } from './release-4002-required-gates.js';
 export const REQUIRED_3110_RELEASE_IDS = [
     'core-skill:manifest',
     'core-skill:immutable-sync',
@@ -63,36 +59,52 @@ export function buildReleaseGateScriptParityReport() {
     const gates = Array.isArray(manifest.gates) ? manifest.gates : [];
     const gateById = new Map(gates.map((gate) => [gate.id, gate]));
     const releaseGateIds = gates.filter((gate) => gate.preset?.includes('release')).map((gate) => gate.id);
-    const requiredReleaseIds = [...new Set([...REQUIRED_3110_RELEASE_IDS, ...REQUIRED_3112_RELEASE_IDS, ...REQUIRED_3113_RELEASE_IDS, ...REQUIRED_4000_RELEASE_IDS, ...REQUIRED_4002_RELEASE_IDS, 'codex:0140-real-probes'])];
-    const requiredRealCheckIds = [...new Set([...REQUIRED_3112_REAL_CHECK_IDS, ...REQUIRED_3113_REAL_CHECK_IDS, ...REQUIRED_4000_REAL_CHECK_IDS, ...REQUIRED_4002_REAL_CHECK_IDS])];
+    const requiredReleaseIds = releaseGateIds;
+    const requiredRealCheckIds = gates.filter((gate) => gate.preset?.includes('real-check')).map((gate) => gate.id);
     const requiredAllIds = [...new Set([...requiredReleaseIds, ...requiredRealCheckIds])];
-    const missingScripts = [...new Set([
-            ...releaseGateIds.filter((id) => !scripts[id]),
-            ...requiredAllIds.filter((id) => !scripts[id])
-        ])].sort();
+    const requiredEntryScripts = [
+        'build',
+        'build:incremental',
+        'typecheck',
+        'release:check',
+        'release:metadata',
+        'release:check:affected',
+        'release:check:fast',
+        'release:check:confidence',
+        'release:check:full',
+        'prepublishOnly',
+        'publish:prep-ignore-scripts',
+        'publish:ignore-scripts',
+        'gates:run',
+        'policy:gate-audit'
+    ];
+    const missingEntryScripts = requiredEntryScripts.filter((id) => !scripts[id]).sort();
     const missingGates = requiredAllIds.filter((id) => !gateById.has(id)).sort();
     const missingReleasePreset = requiredReleaseIds.filter((id) => !gateById.get(id)?.preset?.includes('release')).sort();
     const missingRealCheckPreset = requiredRealCheckIds.filter((id) => !gateById.get(id)?.preset?.includes('real-check')).sort();
     const wrongCommands = requiredAllIds
-        .map((id) => ({ id, expected: `npm run ${id} --silent`, actual: gateById.get(id)?.command || '' }))
-        .filter((row) => row.actual !== row.expected);
+        .map((id) => {
+        const actual = gateById.get(id)?.command || '';
+        return { id, actual, reason: directManifestCommandIssue(actual) };
+    })
+        .filter((row) => row.reason);
     const missingSourceTargets = requiredAllIds
-        .map((id) => ({ id, source: sourceTargetForScript(scripts[id]) }))
+        .map((id) => ({ id, source: sourceTargetForScript(gateById.get(id)?.command) }))
         .filter((row) => row.source && !fs.existsSync(path.join(root, row.source)))
         .map((row) => row.source)
         .sort();
     const missingDistTargets = requiredAllIds
-        .map((id) => ({ id, dist: distTargetForScript(scripts[id]) }))
+        .map((id) => ({ id, dist: distTargetForScript(gateById.get(id)?.command) }))
         .filter((row) => row.dist && fs.existsSync(path.join(root, 'dist')) && !fs.existsSync(path.join(root, row.dist)))
         .map((row) => row.dist)
         .sort();
     return {
         schema: 'sks.release-gate-script-parity.v1',
-        ok: missingScripts.length === 0 && missingGates.length === 0 && missingReleasePreset.length === 0 && missingRealCheckPreset.length === 0 && wrongCommands.length === 0 && missingSourceTargets.length === 0 && missingDistTargets.length === 0,
+        ok: missingEntryScripts.length === 0 && missingGates.length === 0 && missingReleasePreset.length === 0 && missingRealCheckPreset.length === 0 && wrongCommands.length === 0 && missingSourceTargets.length === 0 && missingDistTargets.length === 0,
         release_gate_count: releaseGateIds.length,
         package_script_count: Object.keys(scripts).length,
         checked_required_ids: requiredAllIds.length,
-        missing_scripts: missingScripts,
+        missing_entry_scripts: missingEntryScripts,
         missing_gates: missingGates,
         missing_release_preset: missingReleasePreset,
         missing_real_check_preset: missingRealCheckPreset,
@@ -101,6 +113,22 @@ export function buildReleaseGateScriptParityReport() {
         missing_dist_targets: missingDistTargets
     };
 }
+function directManifestCommandIssue(command) {
+    const text = String(command || '');
+    if (!text)
+        return 'missing_command';
+    if (/\bnpm\s+run\b/.test(text))
+        return 'gate_command_must_not_require_package_script_alias';
+    const segments = text.split(/\s+(?:&&|\|\|)\s+/).map((part) => part.trim()).filter(Boolean);
+    const invalid = segments.find((part) => !(/^node\s+\.\/dist\/scripts\/[^\s]+\.js\b/.test(part)
+        || /^node\s+\.\/dist\/bin\/sks\.js\b/.test(part)
+        || /^node\s+--test\b/.test(part)
+        || /^tsc\s+-p\s+tsconfig\.json\s+--noEmit$/.test(part)));
+    if (invalid) {
+        return 'gate_command_must_execute_dist_script_or_typecheck_directly';
+    }
+    return '';
+}
 function distTargetForScript(script) {
     const match = String(script || '').match(/node\s+\.\/dist\/scripts\/([^\s]+\.js)/);
     return match ? `dist/scripts/${match[1]}` : null;

package/dist/scripts/release-metadata-1-19-check.js

@@ -370,9 +370,9 @@ assertGate(releaseCheckScript.startsWith('npm run release:check:parallel')
     || releaseCheckScript.includes('release:check:affected'), 'release:check must use release:check:parallel, release:check:affected, or the release gate DAG runner');
 assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate manifest schema mismatch', { schema: releaseManifest?.schema || null });
 assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
-assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { release_gates: releaseGates.length });
+assertGate(releaseGates.length > 0 && releaseGates.length <= 220, 'release v2 manifest must include 1..220 release gates', { release_gates: releaseGates.length });
 assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
-const PACKAGE_SCRIPT_BUDGET = 150;
+const PACKAGE_SCRIPT_BUDGET = 100;
 assertGate(Object.keys(pkg.scripts || {}).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: PACKAGE_SCRIPT_BUDGET });
 for (const script of requiredPackageScripts)
     assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);