sneakoscope 5.12.0 → 6.0.1

package/README.md

@@ -25,7 +25,7 @@ sneakoscope is a proof-first Codex trust layer for bounded agent workflows, sear
 
 Sneakoscope Codex (`sks`) is a Codex CLI and Codex App harness for people who want parallel AI coding without losing proof. It gives Codex a simple front door, a dynamic worker swarm, a local dashboard, TriWiki project memory, and release gates that separate machine evidence from LLM opinion.
 
-Current release: SKS **5.12.0**. New in this release: operations maturity scorecards, explicit Naruto real-write proof, real CLI negative smokes for high-risk commands, doctor fast/full/fix semantics, upgrade and rollback recovery gates, diagnostics bundles, and stricter SEO metadata/strategy evidence. See [CHANGELOG.md](CHANGELOG.md).
+Current release: SKS **6.0.1**. New in this release: GPT-5.6 Codex App model selection repair, Sol/Terra/Luna compatibility, removal of legacy `multi_agent_v2`/Fast-mode config stamps, renewed Codex App feature flags, safer menu bar and doctor repair paths, and release metadata prepared for `npm publish --ignore-scripts`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Install
 

package/config/bench-baseline.json

@@ -1,7 +1,7 @@
 {
   "schema": "sks.coding-bench-baseline.v1",
   "baseline_version": "5.0.0",
-  "pass_rate": 0,
-  "min_pass_rate": 0,
-  "notes": "Real model coding bench is skipped with no_backend unless SKS_RUN_CODING_BENCH_REAL=1 and a backend credential is present."
+  "pass_rate": 0.5,
+  "min_pass_rate": 0.5,
+  "notes": "Real model coding bench is skipped (status: not_run, ok: false) with no_backend unless SKS_RUN_CODING_BENCH_REAL=1 and a backend credential is present. A fully-skipped run can no longer report ok:true (20차 P0-5)."
 }

package/config/perf-budgets.v1.json

@@ -1,11 +1,16 @@
 {
   "schema": "sks.perf-budgets.v1",
+  "_note": "budget_p50_ms/budget_p95_ms are judged against raw wall-clock time (no node-startup-baseline deduction, 20차 P0-11). Calibrated from raw measurement on a warm dev machine (2026-07-09: version/root/commands/super-search-doctor ~40-70ms, dollar-commands ~50-130ms, doctor --json fast-mode ~40ms, plan --help/status --json/commands/mad-sks --help added after P2-2/P2-5d verification ~45-167ms) with headroom for slower/CI hosts; retighten once real CI raw numbers are collected. Gate-runtime and $Swarm-overhead budgets from the 20차 P2-6 table are NOT covered here — the former needs the P3 gate consolidation (207->~30) done first, the latter needs a real-backend E2E run (P4 E2E-1) to measure against plain `codex exec`, neither of which this repo state has yet.",
   "commands": [
-    { "name": "version", "argv": ["node", "./dist/bin/sks.js", "--version"], "budget_p50_ms": 120, "budget_p95_ms": 140 },
-    { "name": "commands-json", "argv": ["node", "./dist/bin/sks.js", "commands", "--json"], "budget_p50_ms": 200, "budget_p95_ms": 240 },
-    { "name": "root-json", "argv": ["node", "./dist/bin/sks.js", "root", "--json"], "budget_p50_ms": 150, "budget_p95_ms": 180 },
-    { "name": "dollar-commands-json", "argv": ["node", "./dist/bin/sks.js", "dollar-commands", "--json"], "budget_p50_ms": 200, "budget_p95_ms": 240 },
-    { "name": "super-search-doctor-json", "argv": ["node", "./dist/bin/sks.js", "super-search", "doctor", "--json"], "budget_p50_ms": 180, "budget_p95_ms": 220 },
-    { "name": "doctor-json", "argv": ["node", "./dist/bin/sks.js", "doctor", "--json"], "budget_p50_ms": 1000, "budget_p95_ms": 1500 }
+    { "name": "version", "argv": ["node", "./dist/bin/sks.js", "--version"], "budget_p50_ms": 100, "budget_p95_ms": 150 },
+    { "name": "commands-json", "argv": ["node", "./dist/bin/sks.js", "commands", "--json"], "budget_p50_ms": 150, "budget_p95_ms": 220 },
+    { "name": "commands", "argv": ["node", "./dist/bin/sks.js", "commands"], "budget_p50_ms": 250, "budget_p95_ms": 300 },
+    { "name": "root-json", "argv": ["node", "./dist/bin/sks.js", "root", "--json"], "budget_p50_ms": 150, "budget_p95_ms": 220 },
+    { "name": "dollar-commands-json", "argv": ["node", "./dist/bin/sks.js", "dollar-commands", "--json"], "budget_p50_ms": 200, "budget_p95_ms": 300 },
+    { "name": "super-search-doctor-json", "argv": ["node", "./dist/bin/sks.js", "super-search", "doctor", "--json"], "budget_p50_ms": 150, "budget_p95_ms": 220 },
+    { "name": "doctor-json", "argv": ["node", "./dist/bin/sks.js", "doctor", "--json"], "budget_p50_ms": 200, "budget_p95_ms": 300 },
+    { "name": "status-json", "argv": ["node", "./dist/bin/sks.js", "status", "--json"], "budget_p50_ms": 220, "budget_p95_ms": 300 },
+    { "name": "plan-help", "argv": ["node", "./dist/bin/sks.js", "plan", "--help"], "budget_p50_ms": 100, "budget_p95_ms": 150 },
+    { "name": "mad-sks-help", "argv": ["node", "./dist/bin/sks.js", "mad-sks", "--help"], "budget_p50_ms": 100, "budget_p95_ms": 150 }
   ]
 }

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "5.12.0"
+version = "6.0.1"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "5.12.0"
+version = "6.0.1"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 5.11.0"),
+        Some("--version") => println!("sks-rs {}", env!("CARGO_PKG_VERSION")),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/fast-inline.js

@@ -156,3 +156,58 @@ exports.rootJsonFastInline = rootJsonFastInline;
 exports.doctorJsonFastInline = doctorJsonFastInline;
 exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
 exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;

package/dist/bin/sks-dispatch.js

@@ -32,6 +32,13 @@ async function runSks(args) {
         const { hookUserPromptSubmitPerfInline } = await import('./fast-inline.js');
         await hookUserPromptSubmitPerfInline();
     }
+    else if (args[0] === 'hook' && args[1] && process.env.SKS_HOOK_DAEMON === '1') {
+        // 20차 P2-1: opt-in daemon-accelerated hook path. Default hook behavior
+        // (.codex/hooks.json's actual command) is unchanged until this has been
+        // verified and deliberately turned on.
+        const { hookDaemonInline } = await import('../core/daemon/sksd-hook-dispatch.js');
+        await hookDaemonInline(args[1]);
+    }
     else if (args[0] === 'naruto' && (args[1] === 'help' || args.includes('--help')) && args.includes('--json')) {
         const { narutoHelpJsonFastInline } = await import('./fast-inline.js');
         narutoHelpJsonFastInline();
@@ -55,3 +62,25 @@ async function runSks(args) {
 exports.runSks = runSks;
 
 exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;
+
+exports.runSks = runSks;

package/dist/bin/sks.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '5.12.0';
+const { PACKAGE_VERSION } = require('../core/version.js');
 const firstArg = process.argv[2];
 if (firstArg === '--version' || firstArg === '-v' || firstArg === 'version') {
-    process.stdout.write(`sneakoscope ${FAST_PACKAGE_VERSION}\n`);
+    process.stdout.write(`sneakoscope ${PACKAGE_VERSION}\n`);
 }
 else {
     import('./sks-dispatch.js').then(({ runSks }) => runSks(process.argv.slice(2))).catch((err) => {

package/dist/cli/codex-app-command.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import { codexRemoteControlStatus, formatCodexRemoteControlStatus } from '../core/codex-app.js';
-import { forceGpt55CodexConfigArgs } from '../core/codex-model-guard.js';
+import { forceRequiredCodexModelConfigArgs } from '../core/codex-model-guard.js';
 export async function codexAppRemoteControlCommand(args = [], opts = {}) {
     const controlArgs = argsBeforeSeparator(args);
     if (controlArgs.includes('--help') || controlArgs.includes('-h')) {
@@ -25,7 +25,7 @@ export async function codexAppRemoteControlCommand(args = [], opts = {}) {
         process.exitCode = 1;
         return;
     }
-    const passthrough = forceGpt55CodexConfigArgs(stripSeparator(args));
+    const passthrough = forceRequiredCodexModelConfigArgs(stripSeparator(args));
     const spawnFn = opts.spawn || spawn;
     const code = await spawnInherited(spawnFn, status.codex_cli.bin, ['remote-control', ...passthrough], {
         cwd: process.cwd(),

package/dist/cli/install-helpers.js

@@ -23,7 +23,7 @@ import { extractTomlTable, writeCodexConfigGuarded } from '../core/codex/codex-c
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 import { repairCodexImagegen } from '../core/doctor/imagegen-repair.js';
-import { REQUIRED_CODEX_MODEL } from '../core/codex-model-guard.js';
+import { GPT55_CODEX_MODEL, GPT56_CODEX_MODELS, REQUIRED_CODEX_MODEL } from '../core/codex-model-guard.js';
 const CODEX_LB_PROVIDER_NAME = 'openai';
 const CODEX_LB_PROVIDER_ENV_KEY = 'CODEX_LB_API_KEY';
 const CODEX_LB_CANONICAL_FAST_SERVICE_TIER = 'priority';
@@ -993,12 +993,12 @@ function codexLbFastModeConfigStatus(text = '') {
     const globalServiceTier = topLevelTomlString(text, 'service_tier');
     const profileBlock = String(text || '').match(/(^|\n)\[profiles\.sks-fast-high\]([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[2] || '';
     const profileServiceTier = profileBlock.match(/(^|\n)\s*service_tier\s*=\s*"([^"]+)"/)?.[2] || '';
-    const configured = globalServiceTier === 'fast' || globalServiceTier === CODEX_LB_CANONICAL_FAST_SERVICE_TIER || profileServiceTier === 'fast';
+    const configured = globalServiceTier === 'fast' || globalServiceTier === CODEX_LB_CANONICAL_FAST_SERVICE_TIER;
     return {
         schema: 'sks.codex-lb-fast-mode-config.v1',
         configured,
         top_level_service_tier: globalServiceTier || null,
-        profile_service_tier: profileServiceTier || null,
+        legacy_profile_service_tier: profileServiceTier || null,
         codex_request_service_tier: configured ? 'fast' : null,
         codex_lb_upstream_service_tier: configured ? CODEX_LB_CANONICAL_FAST_SERVICE_TIER : null,
         actual_service_tier_verified: false,
@@ -1030,10 +1030,7 @@ export async function repairCodexLbAuth(opts = {}) {
     }
     if (status.env_key_configured && status.base_url && (!status.provider_contract_ok || !status.selected || legacyAuthMigrated || hasTopLevelCodexModeLock(currentConfig) || (opts.forceCodexLbApiKeyAuth === true && !status.ok))) {
         await ensureDir(path.dirname(status.config_path));
-        const preservedUserFastMode = extractTomlTable(currentConfig, 'user.fast_mode');
         let next = upsertCodexLbConfig(currentConfig, status.base_url);
-        if (preservedUserFastMode)
-            next = upsertTomlTable(next, 'user.fast_mode', preservedUserFastMode);
         next = normalizeCodexFastModeUiConfig(next, {
             forceFastMode: opts.forceFastMode === true || opts.forceCodexLbApiKeyAuth === true
         });
@@ -1873,7 +1870,9 @@ export async function ensureGlobalCodexFastModeDuringInstall(opts = {}) {
         });
         if (next === ensureTrailingNewline(current))
             return { status: 'present', config_path: configPath };
-        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-fast-mode-install');
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'codex-fast-mode-install', {
+            preserveFastUiKeys: opts.forceFastModeOff !== true
+        });
         return {
             status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
             config_path: configPath,
@@ -1891,65 +1890,42 @@ export function normalizeCodexFastModeUiConfig(text = '', opts = {}) {
     return normalizeCodexFastModeUiConfigOnce(normalizeCodexFastModeUiConfigOnce(text, opts), opts);
 }
 function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
-    // Keep SKS-owned model/reasoning defaults out of top-level config so Codex
-    // Desktop can expose its native selectors, but preserve a user's deliberate
-    // top-level model/service/reasoning choices across install, update, and doctor.
+    // 2026-07 Codex App renewal (ChatGPT desktop merge): the config schema removed
+    // `default_profile`, `[profiles.<name>]` tables, `[user.fast_mode]`, and
+    // `notice.fast_default_opt_out`. The only documented fast-default mechanism is
+    // the plain top-level `service_tier = "fast"`. This pass strips every legacy
+    // stamp SKS ever wrote and keeps user-authored top-level choices intact.
     let next = String(text || '');
-    const misplacedDefaultProfile = tomlTableString(next, 'user.fast_mode', 'default_profile');
     next = removeLegacyTopLevelCodexModeLocks(next);
-    next = removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
+    next = normalizeCodexAppDefaultModel(next);
+    next = removeTopLevelTomlKeyIfValue(next, 'default_profile', 'sks-fast-high');
+    next = removeTomlTable(next, 'user.fast_mode');
+    next = removeTomlTable(next, 'profiles.sks-fast-high');
     next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
-    next = removeTomlTableKey(next, 'features', 'codex_hooks');
+    // Feature flags SKS wrote in earlier versions that are not in the current
+    // [features] reference (renewal removed/renamed them). They only trigger the
+    // under-development warning now — strip our own stamps.
+    for (const legacyFlag of [
+        'codex_hooks', 'remote_control', 'fast_mode_ui', 'codex_git_commit', 'computer_use',
+        'browser_use', 'browser_use_external', 'image_generation', 'in_app_browser',
+        'guardian_approval', 'tool_suggest', 'plugins'
+    ]) {
+        next = removeTomlTableKey(next, 'features', legacyFlag);
+    }
     if (opts.forceFastMode === true) {
         next = upsertTopLevelTomlString(next, 'service_tier', 'fast');
     }
     else if (opts.forceFastModeOff === true) {
-        next = upsertTopLevelTomlString(next, 'service_tier', 'default');
+        // "off" = remove the tier and let Codex's own default apply. The old code
+        // wrote service_tier = "default", which is not a documented tier value.
+        next = removeTopLevelTomlKey(next, 'service_tier');
     }
-    // Codex App feature flags / fast-mode UI / suppress-warning are SET-IF-ABSENT: a fresh
-    // config still gets SKS's defaults, but SKS NEVER overrides (re-enables) a feature the
-    // user disabled in the App, and never rejects-then-hides UI by forcing an unrecognized
-    // flag on an older App build. This is what stops SKS from "removing/blocking" the App UI.
+    // Documented, currently-valid feature flags are SET-IF-ABSENT: a fresh config
+    // gets SKS's defaults, but SKS never re-enables a feature the user disabled.
     next = upsertTopLevelTomlBooleanIfAbsent(next, 'suppress_unstable_features_warning', true);
-    for (const featureLine of [
-        'hooks = true', 'remote_control = true', 'multi_agent = true', 'fast_mode = true',
-        'fast_mode_ui = true', 'codex_git_commit = true', 'computer_use = true', 'browser_use = true',
-        'browser_use_external = true', 'image_generation = true', 'in_app_browser = true',
-        'guardian_approval = true', 'tool_suggest = true', 'apps = true', 'plugins = true'
-    ]) {
-        const featureKey = featureLine.split('=')[0]?.trim();
-        next = opts.forceFastMode === true && ['fast_mode', 'fast_mode_ui'].includes(String(featureKey || ''))
-            ? upsertTomlTableKey(next, 'features', featureLine)
-            : upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
-    }
-    if (opts.forceFastMode === true || opts.forceFastModeOff === true) {
-        next = upsertTomlTableKey(next, 'user.fast_mode', 'visible = true');
-        next = upsertTomlTableKey(next, 'user.fast_mode', 'enabled = true');
-        next = opts.forceFastMode === true
-            ? upsertTopLevelTomlString(next, 'default_profile', 'sks-fast-high')
-            : removeTopLevelTomlKeyIfValue(next, 'default_profile', 'sks-fast-high');
-    }
-    else {
-        next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'visible = true');
-        next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'enabled = true');
-        if (misplacedDefaultProfile === 'sks-fast-high') {
-            next = upsertTopLevelTomlString(next, 'default_profile', 'sks-fast-high');
-        }
+    for (const featureLine of ['hooks = true', 'multi_agent = true', 'fast_mode = true', 'apps = true']) {
+        next = upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
     }
-    // Keep ONLY the sks-fast-high config-profile table for explicit fast-mode opt-in
-    // and CLI `--profile` use. The other SKS config profiles are
-    // no longer written as `[profiles.sks-*]` tables here (Codex 0.134+ deprecates them);
-    // they are managed as per-file `<name>.config.toml` overlays by
-    // migrateSksProfilesToPerFile (src/core/auto-review.ts), which also writes the
-    // sks-fast-high overlay for CLI `--profile` use.
-    next = upsertTomlTableKey(next, 'profiles.sks-fast-high', `model = "${REQUIRED_CODEX_MODEL}"`);
-    next = upsertTomlTableKey(next, 'profiles.sks-fast-high', 'service_tier = "fast"');
-    next = upsertTomlTableKey(next, 'profiles.sks-fast-high', 'approval_policy = "on-request"');
-    // Do not force a sandbox from the Codex App fast profile. The App/IDE
-    // permissions selector owns full-access vs workspace-write; this profile only
-    // supplies SKS's model, speed, approval, and reasoning defaults.
-    next = removeTomlTableKey(next, 'profiles.sks-fast-high', 'sandbox_mode');
-    next = upsertTomlTableKey(next, 'profiles.sks-fast-high', 'model_reasoning_effort = "high"');
     // Plugin auto-enable is OPT-IN only. Force-writing `[plugins."name@marketplace"] enabled =
     // true` for marketplace plugins the App may not have installed (different build/channel)
     // makes the App reference plugins it cannot load -> broken/blocked plugin UI. It also
@@ -1964,20 +1940,55 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
     }
     return ensureTrailingNewline(next);
 }
+function removeTopLevelTomlKey(text = '', key = '') {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    return lines.filter((line, index) => index >= end || !keyPattern.test(line)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
+}
+function removeTomlTable(text, table) {
+    const lines = String(text || '').trimEnd().split('\n');
+    const header = `[${table}]`;
+    const start = lines.findIndex((x) => x.trim() === header);
+    if (start === -1)
+        return String(text || '');
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i += 1) {
+        const ln = lines[i];
+        if (ln !== undefined && /^\s*\[.+\]\s*$/.test(ln)) {
+            end = i;
+            break;
+        }
+    }
+    return lines.filter((_, index) => index < start || index >= end).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
+}
 function removeLegacyTopLevelCodexModeLocks(text = '') {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
     const end = firstTable === -1 ? lines.length : firstTable;
     const topLevelModel = topLevelTomlString(text, 'model');
-    const removeSksOwnedModeLock = topLevelModel === REQUIRED_CODEX_MODEL;
+    const removeSksOwnedModeLock = isLegacySksCodexModelStamp(topLevelModel);
     return lines.filter((line, index) => {
         if (index >= end)
             return true;
         if (!removeSksOwnedModeLock)
             return true;
-        return !/^\s*(?:model|model_reasoning_effort)\s*=/.test(line);
+        return !/^\s*model_reasoning_effort\s*=/.test(line);
     }).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
 }
+function normalizeCodexAppDefaultModel(text = '') {
+    const currentModel = topLevelTomlString(text, 'model');
+    if (!currentModel)
+        return upsertTopLevelTomlString(text, 'model', REQUIRED_CODEX_MODEL);
+    if (isLegacySksCodexModelStamp(currentModel))
+        return upsertTopLevelTomlString(text, 'model', REQUIRED_CODEX_MODEL);
+    return String(text || '');
+}
+function isLegacySksCodexModelStamp(value = '') {
+    const model = String(value || '').trim().toLowerCase();
+    return model === REQUIRED_CODEX_MODEL || model === GPT55_CODEX_MODEL || GPT56_CODEX_MODELS.includes(model);
+}
 function removeTopLevelTomlKeyIfValue(text = '', key = '', value = '') {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
@@ -2134,31 +2145,29 @@ async function backupCodexConfig(configPath, text, tag) {
 //   - refuse to WRITE a result that would not parse (e.g. a regex helper mangled a multiline
 //     string), leaving the existing config untouched,
 //   - otherwise back up the prior config before mutating.
-export async function safeWriteCodexConfigToml(configPath, current, next, tag = 'codex-lb') {
+export async function safeWriteCodexConfigToml(configPath, current, next, tag = 'codex-lb', opts = {}) {
     return writeCodexConfigGuarded({
         configPath,
         before: String(current || ''),
         cause: tag,
         removeTopLevelModeLocks: true,
+        ...(opts.preserveFastUiKeys === undefined ? {} : { preserveFastUiKeys: opts.preserveFastUiKeys }),
         mutate: () => String(next || '')
     });
 }
 export function codexFastModeDesktopStatus(text = '') {
     const validation = validateCodexConfigRoundTrip(String(text || ''));
-    const profile = validation.parsed?.profiles?.['sks-fast-high'];
-    const globalOn = validation.ok
-        && validation.default_profile === 'sks-fast-high'
-        && profile?.model === REQUIRED_CODEX_MODEL
-        && profile?.service_tier === 'fast';
+    // Post-renewal contract: the fast default is the plain top-level
+    // service_tier = "fast". default_profile/[profiles.*]/[user.fast_mode] are
+    // gone from the Codex config schema and are only reported as legacy_keys.
+    const globalOn = validation.ok && validation.service_tier === 'fast';
     return {
-        schema: 'sks.codex-fast-mode-desktop-status.v1',
+        schema: 'sks.codex-fast-mode-desktop-status.v2',
         ok: validation.ok,
         on: Boolean(globalOn),
-        default_profile: validation.default_profile || null,
-        top_level_default_profile: validation.top_level_default_profile === true,
-        user_fast_mode_default_profile: validation.user_fast_mode_default_profile,
-        profile_model: profile?.model || null,
-        profile_service_tier: profile?.service_tier || null,
+        service_tier: validation.service_tier ?? null,
+        model: validation.model ?? null,
+        legacy_keys: validation.legacy_keys,
         validation
     };
 }
@@ -3397,8 +3406,14 @@ export async function selftestCodexLb(tmp) {
     });
     if (brokenChain.ok || brokenChain.status !== 'previous_response_not_found' || brokenChain.chain_unhealthy !== true)
         throw new Error('selftest: codex-lb response chain health check did not detect previous_response_not_found');
-    if (!codexLbConfig.includes('hooks = true') || hasDeprecatedCodexHooksFeatureFlag(codexLbConfig) || !codexLbConfig.includes('remote_control = true') || !codexLbConfig.includes('multi_agent = true') || !codexLbConfig.includes('fast_mode = true') || !codexLbConfig.includes('fast_mode_ui = true') || !codexLbConfig.includes('codex_git_commit = true') || !codexLbConfig.includes('computer_use = true') || !codexLbConfig.includes('browser_use = true') || !codexLbConfig.includes('browser_use_external = true') || !codexLbConfig.includes('guardian_approval = true') || !codexLbConfig.includes('tool_suggest = true') || !codexLbConfig.includes('apps = true') || !codexLbConfig.includes('plugins = true') || !codexLbConfig.includes('[plugins."latex@openai-bundled"]') || !codexLbConfig.includes('[plugins."documents@openai-primary-runtime"]') || !codexLbConfig.includes('[user.fast_mode]') || !codexLbConfig.includes('visible = true') || !codexLbConfig.includes('enabled = true') || !/\[profiles\.custom\][\s\S]*?model_reasoning_effort = "low"/.test(codexLbConfig) || !/\[profiles\.sks-fast-high\][\s\S]*?service_tier = "fast"/.test(codexLbConfig) || codexLbConfig.includes('fast_default_opt_out = true') || hasTopLevelCodexModeLock(codexLbConfig))
-        throw new Error('selftest: codex-lb setup did not preserve Codex App feature flags, default plugins, profile-scoped reasoning effort, explicit Fast profile, Codex Git commit generation, or migrate the hooks feature flag');
+    // 2026-07 renewal contract: only documented [features] flags remain; the flags,
+    // [user.fast_mode], [profiles.sks-fast-high], and notice.fast_default_opt_out SKS
+    // used to write must be STRIPPED by setup. User-authored tables ([profiles.custom])
+    // are preserved untouched even though the schema dropped profile tables.
+    const legacyStamps = ['remote_control = true', 'fast_mode_ui = true', 'codex_git_commit = true', 'computer_use = true', 'browser_use = true', 'browser_use_external = true', 'guardian_approval = true', 'tool_suggest = true', 'plugins = true', '[user.fast_mode]', '[profiles.sks-fast-high]', 'fast_default_opt_out = true'];
+    const survivingLegacy = legacyStamps.filter((stamp) => codexLbConfig.includes(stamp));
+    if (!codexLbConfig.includes('hooks = true') || hasDeprecatedCodexHooksFeatureFlag(codexLbConfig) || !codexLbConfig.includes('multi_agent = true') || !codexLbConfig.includes('fast_mode = true') || !codexLbConfig.includes('apps = true') || survivingLegacy.length || !/\[profiles\.custom\][\s\S]*?model_reasoning_effort = "low"/.test(codexLbConfig) || hasTopLevelCodexModeLock(codexLbConfig))
+        throw new Error(`selftest: codex-lb setup did not enforce the renewed feature-flag contract (documented flags present, legacy stamps stripped, user profile tables preserved)${survivingLegacy.length ? ` — surviving legacy stamps: ${survivingLegacy.join(', ')}` : ''}`);
     if (!hasCodexUnstableFeatureWarningSuppression(codexLbConfig))
         throw new Error('selftest: codex-lb setup did not suppress Codex unstable feature warning');
     const codexLbLaunch = `source ${path.join(tmp, '.codex', 'sks-codex-lb.env')} && codex '--model' '${REQUIRED_CODEX_MODEL}'`;
@@ -3414,7 +3429,7 @@ function hasTopLevelCodexModeLock(text = '') {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
     const top = (firstTable === -1 ? lines : lines.slice(0, firstTable)).join('\n');
-    return /(^|\n)\s*(?:model|model_reasoning_effort)\s*=/.test(top);
+    return /(^|\n)\s*model_reasoning_effort\s*=/.test(top);
 }
 function hasDeprecatedCodexHooksFeatureFlag(text = '') {
     const lines = String(text || '').split('\n');

package/dist/cli/router.js

@@ -76,32 +76,39 @@ async function dispatchInner(argv) {
         return result;
     }
     const entry = COMMAND_MANIFEST_BY_NAME[command];
-    const commandGate = await ensureActiveRouteCommandGate(command, rest);
-    if (!commandGate.ok) {
-        console.error(commandGate.message);
-        process.exitCode = 1;
-        return commandGate;
-    }
-    const { ensureCurrentMigrationBeforeCommand } = await import('../core/update/update-migration-state.js');
-    const migrationGate = await ensureCurrentMigrationBeforeCommand({
-        command,
-        args: rest,
-        skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true
-    });
-    if (!migrationGate.ok) {
-        console.error('SKS project migration blocked.');
-        console.error(`Scope: ${migrationGate.scope || 'project'}`);
-        console.error(`Stage: ${migrationGate.failed_stage_id || migrationGate.status}`);
-        if (migrationGate.failed_stage_id)
-            console.error(`Failed stage: ${migrationGate.failed_stage_id}`);
-        for (const blocker of migrationGate.blockers)
-            console.error(`Required blocker: ${blocker}`);
-        for (const warning of migrationGate.warnings)
-            console.error(`Optional warning: ${warning}`);
-        console.error(`Receipt: ${migrationGate.receipt_path}`);
-        console.error('Remedies: run `sks doctor --fix --yes`, then retry; diagnostics that must bypass this gate are marked skipMigrationGate in the command registry.');
-        process.exitCode = 1;
-        return migrationGate;
+    const helpRequest = isHelpRequest(rest);
+    if (!helpRequest) {
+        const commandGate = await ensureActiveRouteCommandGate(command, rest);
+        if (!commandGate.ok) {
+            console.error(commandGate.message);
+            process.exitCode = 1;
+            return commandGate;
+        }
+        // 20차 P2-2: --help/-h/help must never wait on (or be blocked by) the
+        // migration gate's lock — a stuck/contended migration lock previously
+        // made `sks <cmd> --help` take the full MIGRATION_LOCK_WAIT_MS (20s) and
+        // then fail, for a request that only wants usage text.
+        const { ensureCurrentMigrationBeforeCommand } = await import('../core/update/update-migration-state.js');
+        const migrationGate = await ensureCurrentMigrationBeforeCommand({
+            command,
+            args: rest,
+            skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true
+        });
+        if (!migrationGate.ok) {
+            console.error('SKS project migration blocked.');
+            console.error(`Scope: ${migrationGate.scope || 'project'}`);
+            console.error(`Stage: ${migrationGate.failed_stage_id || migrationGate.status}`);
+            if (migrationGate.failed_stage_id)
+                console.error(`Failed stage: ${migrationGate.failed_stage_id}`);
+            for (const blocker of migrationGate.blockers)
+                console.error(`Required blocker: ${blocker}`);
+            for (const warning of migrationGate.warnings)
+                console.error(`Optional warning: ${warning}`);
+            console.error(`Receipt: ${migrationGate.receipt_path}`);
+            console.error('Remedies: run `sks doctor --fix --yes`, then retry; diagnostics that must bypass this gate are marked skipMigrationGate in the command registry.');
+            process.exitCode = 1;
+            return migrationGate;
+        }
     }
     const { COMMANDS } = await import('./command-registry.js');
     const commandEntry = COMMANDS[command];
@@ -110,6 +117,16 @@ async function dispatchInner(argv) {
         throw new Error(`Command ${command} must export run(command, args)`);
     return mod.run(rawCommand || command, rest);
 }
+// --help/-h/help must skip the active-route and migration gates regardless
+// of where it appears in args — a pure usage-text request should never wait
+// on (or be blocked by) project state (20차 P2-2).
+function isHelpRequest(args) {
+    // --help/-h are unambiguous flags wherever they appear; bare "help" is
+    // only treated as the request when it's the subcommand position (args[0])
+    // so an arbitrary value elsewhere (e.g. a commit message of "help") can't
+    // accidentally bypass the gates.
+    return args.includes('--help') || args.includes('-h') || String(args[0] || '').toLowerCase() === 'help';
+}
 async function ensureActiveRouteCommandGate(command, args) {
     const entry = COMMAND_MANIFEST_BY_NAME[command];
     if (command === 'route' || entry.readonly === true || entry.allowedDuringActiveRoute === true && entry.mutatesRouteState !== true) {

package/dist/commands/doctor.js

@@ -254,10 +254,9 @@ async function runDoctor(args = [], root, doctorFix) {
             global_skills: installScope === 'global' && !flag(args, '--local-only')
                 ? deepDiagnostics ? await (await import('../cli/install-helpers.js')).ensureGlobalCodexSkillsDuringInstall({ force: true }) : { status: 'skipped', reason: 'default_doctor_no_global_skill_regeneration' }
                 : { status: 'skipped', reason: 'project or local-only repair' },
-            // Re-seed the Codex App Fast-mode UI table ([user.fast_mode] visible/enabled/
-            // default_profile) in the global ~/.codex/config.toml so existing installs whose
-            // config predates the Fast-mode UI keys get the App speed selector back. Safe:
-            // backs up + parse-validates before writing, no-op when already present.
+            // Normalize global Codex fast-mode config to the 2026-07 schema: preserve
+            // service_tier="fast" when requested, strip legacy [user.fast_mode] and
+            // [profiles.sks-fast-high] stamps, and parse-validate before writing.
             codex_app_fast_mode: flag(args, '--local-only')
                 ? { status: 'skipped', reason: 'local-only repair' }
                 : await (await import('../cli/install-helpers.js')).ensureGlobalCodexFastModeDuringInstall().catch((err) => ({ status: 'failed', error: err?.message || String(err) }))