sneakoscope 5.3.0 → 5.5.1

package/dist/core/bench.js

@@ -121,17 +121,28 @@ export async function runCoreBench(root = process.cwd(), { iterations = 3, tier
     for (const [label, args, commandRoot] of coreCommands(benchTrustMission)) {
         const values = [];
         const failures = [];
+        // TRUST_VALIDATE_BENCH_COMMAND measures latency of `sks trust validate` against a
+        // mock fixture mission. A --mock `$Naruto` run can never satisfy the real agent
+        // gate, so `sks trust validate` legitimately exits 1 (report.ok === false,
+        // status: 'blocked') every time regardless of environment. This row exists to
+        // measure command latency, not to assert the mock mission's trust status, so a
+        // well-formed trust-validation report (valid JSON with the expected schema) is
+        // accepted even on a nonzero exit; only a crash/unparseable-output counts as a
+        // bench failure for this specific command.
+        const acceptNonZeroExit = label === TRUST_VALIDATE_BENCH_COMMAND;
         for (let i = 0; i < CORE_BENCH_WARMUP_ITERATIONS; i += 1) {
             const result = await runBenchProcess(commandRoot || root, script, args);
-            if (result.code !== 0)
+            if (result.code !== 0 && !(acceptNonZeroExit && isWellFormedTrustValidation(result.stdout))) {
                 failures.push({ phase: 'warmup', code: result.code, stderr_tail: result.stderr.slice(-400), stdout_tail: result.stdout.slice(-400) });
+            }
         }
         for (let i = 0; i < measuredIterations; i += 1) {
             const t0 = performance.now();
             const result = await runBenchProcess(commandRoot || root, script, args);
             values.push(performance.now() - t0);
-            if (result.code !== 0)
+            if (result.code !== 0 && !(acceptNonZeroExit && isWellFormedTrustValidation(result.stdout))) {
                 failures.push({ phase: 'measure', code: result.code, stderr_tail: result.stderr.slice(-400), stdout_tail: result.stdout.slice(-400) });
+            }
         }
         const p95 = Math.round(percentile(values, 95));
         rows.push({
@@ -165,8 +176,19 @@ async function runBenchProcess(root, script, args) {
         env: { SKS_SKIP_NPM_FRESHNESS_CHECK: '1', SKS_DISABLE_UPDATE_CHECK: '1', CI: 'true' }
     });
 }
+function isWellFormedTrustValidation(stdout) {
+    const parsed = parseJsonOutput(stdout);
+    return Boolean(parsed && parsed.schema === 'sks.trust-validation.v1' && typeof parsed.status === 'string');
+}
 async function ensureBenchTrustMission(root, script) {
     const benchRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-core-bench-trust-')).catch(() => root);
+    // `sks run` blocks the agent gate (and skips writing completion-proof.json) when
+    // its cwd is not a git repo (git_collaboration.status -> not_git_repo). The bench
+    // trust-mission scratch dir must be a git repo so completion-proof.json/
+    // trust-report.json/run-classification.json actually get written and
+    // hasBenchTrustArtifacts() can find a usable mission instead of falling back to
+    // a nonexistent 'bench-fixture-missing' id (which always fails trust validate).
+    await runProcess('git', ['init', '-q', '.'], { cwd: benchRoot, timeoutMs: 10_000 }).catch(() => null);
     const beforeMissionIds = await listMissionIds(benchRoot);
     const result = await runProcess(process.execPath, [script, 'run', 'fixture', '--mock', '--json'], {
         cwd: benchRoot,

package/dist/core/codex-app/sks-menubar.js

@@ -215,11 +215,22 @@ export async function installSksMenuBar(opts = {}) {
     else {
         if (!target.used_previous_script && await readText(paths.action_script_path, '') !== actionScript) {
             await writeTextAtomic(paths.action_script_path, actionScript);
-            await fs.chmod(paths.action_script_path, 0o755);
             actions.push(`wrote ${paths.action_script_path}`);
         }
-        else if (!target.used_previous_script) {
-            await fs.chmod(paths.action_script_path, 0o755).catch(() => undefined);
+    }
+    // The Swift app executes the action script DIRECTLY (Process.executableURL points at the
+    // script itself), so a lost executable bit breaks every menu action even when the script
+    // content is current. Re-assert the bit on every install run — including the up-to-date
+    // fast path, which previously never touched permissions and therefore could never repair
+    // a 0644 script — and surface chmod failures instead of swallowing them.
+    if (await exists(paths.action_script_path)) {
+        const previouslyExecutable = await fs.access(paths.action_script_path, fs.constants.X_OK).then(() => true).catch(() => false);
+        const chmodError = await fs.chmod(paths.action_script_path, 0o755).then(() => null).catch((err) => (err?.message ? String(err.message) : String(err)));
+        if (chmodError) {
+            warnings.push(`action_script_chmod_failed:${chmodError}`);
+        }
+        else if (!previouslyExecutable) {
+            actions.push('restored action script executable bit');
         }
     }
     if (!stampMatches && !binaryStable) {
@@ -429,10 +440,24 @@ async function resolveCodexBundleId(input) {
     }
     return null;
 }
-async function smokeSksMenuBarAction(actionScriptPath) {
+export async function smokeSksMenuBarAction(actionScriptPath) {
     if (!(await exists(actionScriptPath)))
-        return { ok: false, code: null, output: null, versionDetected: false };
-    const result = await runProcess('/bin/zsh', [actionScriptPath, 'version'], {
+        return { ok: false, code: null, output: null, versionDetected: false, executable: false };
+    // The Swift app runs the script directly (which requires the executable bit), so the smoke
+    // check must invoke it the same way. Running it via `/bin/zsh <script>` — as this check used
+    // to — succeeds even when +x is missing, which let doctor/status report a healthy action
+    // target while the menu bar itself was showing "action script broken".
+    const executable = await fs.access(actionScriptPath, fs.constants.X_OK).then(() => true).catch(() => false);
+    if (!executable) {
+        return {
+            ok: false,
+            code: null,
+            output: 'action script is not executable (missing +x); the menu bar app cannot run it',
+            versionDetected: false,
+            executable: false
+        };
+    }
+    const result = await runProcess(actionScriptPath, ['version'], {
         timeoutMs: 5_000,
         maxOutputBytes: 16 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
@@ -442,7 +467,8 @@ async function smokeSksMenuBarAction(actionScriptPath) {
         ok: result.code === 0 && versionDetected,
         code: result.code,
         output: output ? output.slice(0, 700) : null,
-        versionDetected
+        versionDetected,
+        executable: true
     };
 }
 async function isCodexAppRunningByBundleId(bundleId, env = process.env) {
@@ -485,6 +511,8 @@ export async function inspectSksMenuBarStatus(opts = {}) {
         blockers.push('menubar_app_missing');
     if (installed && launchd.checked && !launchd.ok)
         blockers.push('launchd_not_running');
+    if (installed && !actionSmoke.executable)
+        blockers.push('action_script_not_executable');
     if (installed && !actionSmoke.ok)
         blockers.push('action_script_smoke_failed');
     if (installed && signature.checked && !signature.ok)
@@ -509,6 +537,7 @@ export async function inspectSksMenuBarStatus(opts = {}) {
             smoke_code: actionSmoke.code,
             smoke_output: actionSmoke.output,
             version_detected: actionSmoke.versionDetected,
+            executable: actionSmoke.executable,
             ok: actionSmoke.ok
         },
         codex_sync: codexSync,
@@ -678,6 +707,14 @@ export function actionScriptSource(input) {
     return `#!/bin/zsh
 set -e
 export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$PATH"
+# launchd starts this app with cwd=/. sks treats an unmarked cwd as the project
+# root fallback, and / is neither writable nor a workspace, so give every
+# menu-bar-spawned command a sane home-directory cwd instead.
+cd "$HOME" 2>/dev/null || true
+# Menu-bar actions operate on global state (~/.codex, keychain, launchd), never
+# on a project, so the per-project update-migration gate must not fire here —
+# it would otherwise treat $HOME as a project and run a migration doctor in it.
+export SKS_UPDATE_MIGRATION_GATE_DISABLED=1
 NODE_BIN=${shellQuote(input.nodeBin)}
 SKS_ENTRY=${shellQuote(input.sksEntry)}
 
@@ -770,6 +807,9 @@ export function swiftMenuSource(input) {
 
     func setIconVisible(_ visible: Bool) {
         statusItem.isVisible = visible
+        if visible {
+            reassertControlCenterVisibility()
+        }
     }
 
     func isCodexRunning() -> Bool {
@@ -784,6 +824,9 @@ export function swiftMenuSource(input) {
 
     func setIconVisible(_ visible: Bool) {
         statusItem.isVisible = visible
+        if visible {
+            reassertControlCenterVisibility()
+        }
     }
 
     func isCodexRunning() -> Bool {
@@ -799,6 +842,32 @@ let menubarConfigPath = ${swiftString(input.configPath)}
 let lastActionLogPath = ${swiftString(input.lastActionLogPath)}
 let codexBundleId: String? = ${input.codexBundleId ? swiftString(input.codexBundleId) : 'nil'}
 let packageVersion = ${swiftString(input.packageVersion)}
+let menuBarLabel = ${swiftString(SKS_MENUBAR_LABEL)}
+let controlCenterDomain = ${swiftString(CONTROL_CENTER_DOMAIN)}
+
+/// macOS persists status-item visibility hints per-label in Control Center's
+/// defaults domain (see installSksMenuBar's seedMenuBarPreferredPosition).
+/// Toggling NSStatusItem.isVisible back to true inside a resident process is
+/// not always sufficient to make Control Center re-render a previously
+/// hidden item, so re-show must reassert the same Control Center defaults
+/// the installer seeds, or the icon can stay invisible after a Codex
+/// quit/relaunch cycle even though isVisible is technically true again.
+func reassertControlCenterVisibility() {
+    let defaultsBin = "/usr/bin/defaults"
+    guard FileManager.default.isExecutableFile(atPath: defaultsBin) else { return }
+    let writes: [[String]] = [
+        ["write", controlCenterDomain, "NSStatusItem Visible \\(menuBarLabel)", "-bool", "true"],
+        ["write", controlCenterDomain, "NSStatusItem VisibleCC \\(menuBarLabel)", "-bool", "true"]
+    ]
+    for args in writes {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: defaultsBin)
+        process.arguments = args
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+        try? process.run()
+    }
+}
 
 func shellQuote(_ value: String) -> String {
     return "'" + value.replacingOccurrences(of: "'", with: "'\\\\''") + "'"
@@ -1316,7 +1385,11 @@ async function launchWithLaunchctl(input) {
             ...stdio
         }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
         if (kickstart.code !== 0) {
-            const printedWork = waitForLaunchctlRunning(input.launchctl, service);
+            // A kickstart timeout does not mean the relaunch failed — under heavy
+            // system load (e.g. mid `npm install -g`) the app can take well past the
+            // kickstart timeout to reach running state, so give the recheck a much
+            // longer window before declaring the whole install blocked.
+            const printedWork = waitForLaunchctlRunning(input.launchctl, service, 20);
             const printed = input.quiet === true ? await printedWork : await withHeartbeat('launchctl SKS menu bar wait', printedWork, { warnAfterMs: 10_000 });
             if (printed.running) {
                 return {
@@ -1364,9 +1437,9 @@ async function launchWithLaunchctl(input) {
         error: String(bootstrap.stderr || bootstrap.stdout || '').trim() || 'launchctl_bootstrap_failed'
     };
 }
-async function waitForLaunchctlRunning(launchctl, service) {
+async function waitForLaunchctlRunning(launchctl, service, attempts = 6) {
     let lastCode = null;
-    for (let attempt = 0; attempt < 6; attempt += 1) {
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
         const printed = await runProcess(launchctl, ['print', service], {
             timeoutMs: 1_000,
             maxOutputBytes: 32 * 1024

package/dist/core/commands/agent-command.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { findLatestMission, loadMission } from '../mission.js';
+import { findLatestMission, loadMission, missionDir } from '../mission.js';
 import { readJson, readText, sksRoot, writeJsonAtomic } from '../fsx.js';
 import { runNativeAgentOrchestrator } from '../agents/agent-orchestrator.js';
 import { parseAgentCommandArgs } from '../agents/agent-command-surface.js';
@@ -23,6 +23,9 @@ export async function agentCommand(commandOrArgs = 'agent', maybeArgs = []) {
 }
 async function agentRun(parsed) {
     const result = await runNativeAgentOrchestrator({ ...parsed, routeCommand: 'sks agent run', routeBlackboxKind: 'actual_agent_command' });
+    if (normalizeRouteName(parsed.route) === 'release-review' && result.mission_id) {
+        await writeReleaseReviewNativeAgentPlan(parsed, result);
+    }
     return emit(parsed, result, () => {
         console.log('Native agent mission: ' + result.mission_id);
         console.log('Backend: ' + result.backend);
@@ -30,6 +33,37 @@ async function agentRun(parsed) {
         console.log('Proof: ' + result.proof.status);
     });
 }
+function normalizeRouteName(route = '') {
+    return String(route || '').replace(/^\$/, '').trim().toLowerCase();
+}
+/**
+ * $Release-Review runs through the generic native agent orchestrator (sks agent run
+ * --route "$Release-Review"), which does not itself know it is a release-review run.
+ * Write the route-specific release-review-native-agent-plan.json summary artifact here
+ * so `route-release-review`'s fixture contract (plan file + agent proof evidence +
+ * agent effort policy) is genuinely satisfied by this command rather than only partially.
+ */
+async function writeReleaseReviewNativeAgentPlan(parsed, result) {
+    const root = await sksRoot();
+    const dir = missionDir(root, result.mission_id);
+    const plan = {
+        schema: 'sks.release-review-native-agent-plan.v1',
+        ok: Boolean(result.ok),
+        mission_id: result.mission_id,
+        route: '$Release-Review',
+        route_command: 'sks agent run',
+        backend: result.backend,
+        prompt: parsed.prompt,
+        roster: {
+            agent_count: result.roster?.agent_count ?? parsed.agents ?? null,
+            concurrency: result.roster?.concurrency ?? parsed.concurrency ?? null
+        },
+        proof_status: result.proof?.status || null,
+        agent_proof_evidence: 'agents/agent-proof-evidence.json',
+        agent_effort_policy: 'agents/agent-effort-policy.json'
+    };
+    await writeJsonAtomic(path.join(dir, 'release-review-native-agent-plan.json'), plan);
+}
 async function agentPlan(parsed) {
     const root = await sksRoot();
     const roster = buildAgentRoster({ agents: parsed.agents, concurrency: parsed.concurrency, prompt: parsed.prompt, readonly: parsed.readonly });

package/dist/core/commands/basic-cli.js

@@ -8,6 +8,7 @@ import { PACKAGE_VERSION, ensureDir, exists, nowIso, projectRoot, readJson, sksR
 import { COMMAND_CATALOG, DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, USAGE_TOPICS, routePrompt, routeReasoning, reasoningInstruction } from '../routes.js';
 import { initProject, normalizeInstallScope, sksCommandPrefix } from '../init.js';
 import { buildFeatureRegistry, validateFeatureRegistry } from '../feature-registry.js';
+import { runFeatureFixture } from '../feature-fixture-executor.js';
 import { hooksExplainReport } from '../../cli/feature-commands.js';
 import { writeSelftestRouteProof } from '../proof/selftest-proof-fixtures.js';
 import { createMission } from '../mission.js';
@@ -279,6 +280,8 @@ export async function postinstallCommand(args = []) {
     return postinstall({ bootstrap: bootstrapCommand, args });
 }
 export async function selftestCommand(args = []) {
+    if (flag(args, '--real'))
+        return selftestRealCommand(args);
     process.env.CI = 'true';
     const root = await projectRoot();
     const tmp = tmpdir('sks-selftest-');
@@ -307,6 +310,62 @@ export async function selftestCommand(args = []) {
         return printJson(result);
     console.log('SKS selftest passed');
 }
+/**
+ * `sks selftest --real`: actually spawns every feature fixture whose kind is
+ * 'execute' or 'execute_and_validate_artifacts', derives real pass/fail status
+ * from the process exit code (and, for execute_and_validate_artifacts, from
+ * whether the declared expected_artifacts actually exist and match their
+ * declared schema), and writes a JSON report that explicitly lists fixtures
+ * skipped because they are mock/wiring_only kind rather than silently omitting
+ * them. This is additive: plain `sks selftest --mock` behavior is unchanged.
+ */
+export async function selftestRealCommand(args = []) {
+    process.env.CI = 'true';
+    const root = await projectRoot();
+    const registry = await buildFeatureRegistry({ root });
+    const executableKinds = new Set(['execute', 'execute_and_validate_artifacts']);
+    const results = [];
+    const skippedWiringOnly = [];
+    for (const feature of registry.features || []) {
+        const fx = feature.fixture || {};
+        if (executableKinds.has(fx.kind)) {
+            const run = await runFeatureFixture(feature, { root });
+            results.push(run);
+        }
+        else if (fx.kind === 'mock' || fx.kind === 'wiring_only' || fx.quality === 'wiring_only') {
+            skippedWiringOnly.push({ id: feature.id, kind: fx.kind, reason: fx.reason || 'mock_or_wiring_only_kind_not_executed' });
+        }
+    }
+    const failures = results.filter((row) => !row.ok);
+    const ok = failures.length === 0;
+    const report = {
+        schema: 'sks.selftest-real.v1',
+        ok,
+        version: PACKAGE_VERSION,
+        generated_at: nowIso(),
+        root,
+        checked: results.length,
+        passed: results.filter((row) => row.ok).length,
+        failed: failures.length,
+        results,
+        skipped_wiring_only: skippedWiringOnly,
+        skipped_wiring_only_count: skippedWiringOnly.length,
+        blockers: failures.flatMap((row) => row.blockers || [])
+    };
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'selftest-real-report.json');
+    await writeJsonAtomic(reportPath, report);
+    const output = { ...report, report_file: path.relative(root, reportPath) };
+    if (flag(args, '--json'))
+        return printJson(output);
+    console.log(`SKS selftest --real: ${ok ? 'passed' : 'blocked'} (checked=${results.length}, skipped_wiring_only=${skippedWiringOnly.length})`);
+    console.log(`Report: ${path.relative(root, reportPath)}`);
+    if (!ok) {
+        for (const blocker of report.blockers)
+            console.log(`- ${blocker}`);
+        process.exitCode = 1;
+    }
+    return output;
+}
 export async function reasoningCommand(args = []) {
     const prompt = args.filter((arg) => !String(arg).startsWith('--')).join(' ').trim();
     const route = routePrompt(prompt || '$SKS');

package/dist/core/commands/command-utils.js

@@ -1,8 +1,17 @@
 import { findLatestMission, listSessionStates } from '../mission.js';
 import { DOLLAR_SKILL_NAMES, RECOMMENDED_SKILLS } from '../routes.js';
 export const flag = (args = [], name) => args.includes(name);
-export function promptOf(args = []) {
-    return args.filter((x) => !String(x).startsWith('--')).join(' ').trim();
+// Blindly dropping every "--"-prefixed argv token (the previous behavior of
+// promptOf/positionalArgs) silently deletes any part of an unquoted work-order
+// prompt that happens to contain a flag-lookalike phrase (e.g. "--files 로
+// 확인해라"). Only strip tokens that are actually recognized boolean/global
+// flags; anything else stays in the reconstructed prompt.
+const KNOWN_BOOLEAN_FLAGS = new Set([
+    '--json', '--mock', '--execute', '--auto', '--visual', '--research', '--db',
+    '--legacy-goal-runtime', '--help', '-h'
+]);
+export function promptOf(args = [], knownFlags = KNOWN_BOOLEAN_FLAGS) {
+    return args.filter((x) => !knownFlags.has(String(x))).join(' ').trim();
 }
 export async function resolveMissionId(root, arg) {
     if (arg && arg !== 'latest')
@@ -56,8 +65,9 @@ export function positionalArgs(args = []) {
             i += 1;
             continue;
         }
-        if (!arg.startsWith('--'))
-            out.push(arg);
+        if (KNOWN_BOOLEAN_FLAGS.has(arg))
+            continue;
+        out.push(arg);
     }
     return out;
 }

package/dist/core/commands/goal-command.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { exists, readJson, sksRoot } from '../fsx.js';
 import { initProject } from '../init.js';
 import { createMission, loadMission, setCurrent, stateFile } from '../mission.js';
+import { createAndWriteWorkOrderLedgerForPrompt, closeWorkOrderLedgerForRouteResult } from '../work-order-ledger.js';
 import { GOAL_BRIDGE_ARTIFACT, GOAL_WORKFLOW_ARTIFACT, updateGoalWorkflow, writeGoalWorkflow } from '../goal-workflow.js';
 import { flag, promptOf, resolveMissionId } from './command-utils.js';
 import { compileGoalToLoopPlan } from '../loops/goal-to-loop-compat.js';
@@ -37,11 +38,13 @@ async function goalCreate(args) {
     if (flag(args, '--legacy-goal-runtime') || process.env.SKS_LEGACY_GOAL_RUNTIME === '1')
         return legacyGoalCreate(root, prompt, args);
     const { id, dir, mission } = await createMission(root, { mode: 'goal', prompt });
+    await createAndWriteWorkOrderLedgerForPrompt(dir, { missionId: id, route: 'Goal', prompt });
     const workflow = await writeGoalWorkflow(dir, mission, { action: 'create', prompt });
     const plan = await compileGoalToLoopPlan({ root, missionId: id, goalText: prompt, legacyGoalOptions: { native_goal: workflow.native_goal } });
     const result = await runLoopPlan({ root, plan, parallelism: 'balanced' });
     const gate = await evaluateLocalGate({ root, missionId: id, gateFile: 'loop-graph-proof.json' });
     const ok = result.ok === true && gate.ok === true;
+    await closeWorkOrderLedgerForRouteResult(dir, { ok, blockers: gate.blockers || [] });
     await setCurrent(root, { mission_id: id, mode: 'GOAL', route: 'Goal', route_command: '$Goal', phase: ok ? 'GOAL_LOOP_COMPLETED' : 'GOAL_LOOP_BLOCKED', questions_allowed: true, implementation_allowed: true, native_goal: workflow.native_goal, stop_gate: 'loop-graph-proof.json', stop_gate_blockers: gate.blockers }, { replace: true });
     if (!ok)
         process.exitCode = 1;

package/dist/core/commands/image-ux-review-command.js

@@ -13,6 +13,7 @@ import { sha256File, imageDimensions } from '../wiki-image/image-hash.js';
 import { writeRouteCollaborationArtifacts } from '../agents/route-collaboration-ledger.js';
 import { codexChromeExtensionStatus } from '../codex-app.js';
 import { requireCodexImagegen } from '../imagegen/require-imagegen.js';
+import { evaluateGate } from '../stop-gate/gate-evaluator.js';
 const ONE_BY_ONE_PNG_BASE64 = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMB/axX7V8AAAAASUVORK5CYII=';
 const IMAGE_UX_REVIEW_ARTIFACT_PATHS = {
     policy: IMAGE_UX_REVIEW_POLICY_ARTIFACT,
@@ -358,9 +359,11 @@ async function statusImageUxReview(root, args = []) {
     const gate = await readJson(path.join(dir, 'image-ux-review-gate.json'), null);
     const issueLedger = await readJson(path.join(dir, IMAGE_UX_REVIEW_ISSUE_LEDGER_ARTIFACT), null);
     const generatedLedger = await readJson(path.join(dir, IMAGE_UX_REVIEW_GENERATED_REVIEW_LEDGER_ARTIFACT), null);
-    const result = { schema: 'sks.image-ux-review-status.v2', ok: true, mission_id: missionId, gate, issue_ledger: issueLedger, generated_review_ledger: generatedLedger };
+    const gateVerdict = await evaluateGate(root, missionId, 'image-ux-review-gate.json');
+    const result = { schema: 'sks.image-ux-review-status.v2', ok: true, mission_id: missionId, gate, gate_verdict: gateVerdict, issue_ledger: issueLedger, generated_review_ledger: generatedLedger };
     if (flag(args, '--json'))
         return printJson(result);
+    console.log(gateVerdict.verdict);
     console.log(`Image UX Review mission: ${missionId}`);
     console.log(`Gate: ${gate?.status || (gate?.passed ? 'passed' : gate ? 'present' : 'missing')}`);
     if (gate?.verified_level)

package/dist/core/commands/mad-sks-command.js

@@ -26,6 +26,7 @@ import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
 import { buildMadGlmLaunchArtifact, buildMadGlmLaunchProfileNoWrite, resolveMadGlmLaunchKey, writeMadGlmCodexWrapper } from '../providers/glm/glm-mad-launch.js';
 import { GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
 import { assertNonGlmMadRoute } from '../routes/model-mode-router.js';
+import { evaluateGate } from '../stop-gate/gate-evaluator.js';
 const MAD_SKS_DEFAULT_TTL_MS = 10 * 60 * 1000;
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
@@ -1013,6 +1014,12 @@ async function madSksSubcommand(subcommand, args = []) {
     if (subcommand === 'doctor' || subcommand === 'status') {
         const protectedCore = resolveProtectedCore({ packageRoot: packageRoot(), targetRoot });
         const before = await snapshotProtectedCore(packageRoot(), 'status');
+        const statusMissionId = await findLatestMission(root);
+        const gateVerdict = statusMissionId
+            ? await evaluateGate(root, statusMissionId, 'mad-sks-gate.json')
+            : await evaluateGate(root, 'no-mission', 'mad-sks-gate.json');
+        if (!json)
+            console.log(gateVerdict.verdict);
         return emit({
             schema: subcommand === 'doctor' ? 'sks.mad-sks-doctor.v1' : 'sks.mad-sks-status.v1',
             ok: true,
@@ -1022,7 +1029,9 @@ async function madSksSubcommand(subcommand, args = []) {
             protected_core_snapshot: before,
             protected_core_immutable: !protectedCore.engine_source_exception,
             protected_core_write_allowed: protectedCore.engine_source_exception,
-            permission_active: false
+            permission_active: false,
+            mission_id: statusMissionId,
+            gate_verdict: gateVerdict
         }, json);
     }
     if (subcommand === 'close' || subcommand === 'revoke') {

package/dist/core/commands/naruto-command.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { ui as cliUi } from '../../cli/cli-theme.js';
 import { createMission, findLatestMission, loadMission, setCurrent } from '../mission.js';
+import { createAndWriteWorkOrderLedgerForPrompt, closeWorkOrderLedgerForRouteResult } from '../work-order-ledger.js';
 import { nowIso, readJson, sksRoot, writeJsonAtomic } from '../fsx.js';
 import { runNativeAgentOrchestrator } from '../agents/agent-orchestrator.js';
 import { classifyOllamaWorkerSlice } from '../agents/agent-runner-ollama.js';
@@ -95,6 +96,7 @@ async function narutoRun(parsed) {
         maxAgentCount: MAX_NARUTO_AGENT_COUNT
     });
     const mission = await createMission(root, { mode: 'naruto', prompt: parsed.prompt });
+    await createAndWriteWorkOrderLedgerForPrompt(mission.dir, { missionId: mission.id, route: 'Naruto', prompt: parsed.prompt });
     await writeCodex0138CapabilityArtifacts(root, { missionId: mission.id }).catch(() => null);
     await writeCodex0139CapabilityArtifacts(root, { missionId: mission.id }).catch(() => null);
     const gitWorktreeCapability = writeCapable
@@ -280,13 +282,13 @@ async function narutoRun(parsed) {
         rebalance_ready: rebalancePolicy.ok === true,
         concurrency_governor_ready: true,
         active_pool_simulated: activePool.ok === true,
-        verification_dag_ready: true,
-        gpt_final_pack_ready: true,
+        verification_dag_ready: Array.isArray(verificationDag?.tasks),
+        gpt_final_pack_ready: Boolean(gptFinalPack?.schema),
         zellij_dashboard_ready: zellijDashboard.ok === true,
         native_agent_proof: false,
         final_arbiter_accepted: false,
         session_cleanup: false,
-        blockers: [],
+        blockers: [...(workGraph.blockers || []), ...(allocationPolicy.blockers || [])],
         updated_at: nowIso()
     });
     await setCurrent(root, {
@@ -417,9 +419,11 @@ async function narutoRun(parsed) {
     const regressionProof = summarizeRegressionProof(workGraph, result);
     await writeJsonAtomic(path.join(mission.dir, 'regression-proof-summary.json'), regressionProof);
     const tddOk = !regressionProof.required || (regressionProof.regression_test_added && regressionProof.regression_test_failed_before_fix && regressionProof.regression_test_passed_after_fix);
+    const narutoGateFullPassed = result.ok === true && nativeProofOk && finalAccepted && parallelRuntimeOk && tddOk && workGraph.ok === true && allocationPolicy.ok === true;
+    const narutoGateFullBlockers = [...(result.proof?.blockers || []), ...(parallelRuntimeOk ? [] : ['naruto_parallel_runtime_proof_below_gate']), ...(tddOk ? [] : ['tdd_evidence_missing']), ...(workGraph.blockers || []), ...(allocationPolicy.blockers || [])];
     await writeJsonAtomic(path.join(mission.dir, 'naruto-gate.json'), {
         schema: 'sks.naruto-gate.v1',
-        passed: result.ok === true && nativeProofOk && finalAccepted && parallelRuntimeOk && tddOk,
+        passed: narutoGateFullPassed,
         mission_id: mission.id,
         clone_roster_built: true,
         clone_count: roster.agent_count,
@@ -429,8 +433,8 @@ async function narutoRun(parsed) {
         rebalance_ready: rebalancePolicy.ok === true,
         concurrency_governor_ready: true,
         active_pool_simulated: activePool.ok === true,
-        verification_dag_ready: true,
-        gpt_final_pack_ready: true,
+        verification_dag_ready: Array.isArray(verificationDag?.tasks),
+        gpt_final_pack_ready: Boolean(gptFinalPack?.schema),
         zellij_dashboard_ready: zellijDashboard.ok === true,
         native_agent_proof: nativeProofOk,
         parallel_runtime_proof: parallelRuntimeOk,
@@ -440,9 +444,10 @@ async function narutoRun(parsed) {
         regression_proof: 'regression-proof-summary.json',
         final_arbiter_accepted: finalAccepted,
         session_cleanup: result.proof?.all_sessions_closed === true || nativeProofOk,
-        blockers: [...(result.proof?.blockers || []), ...(parallelRuntimeOk ? [] : ['naruto_parallel_runtime_proof_below_gate']), ...(tddOk ? [] : ['tdd_evidence_missing'])],
+        blockers: narutoGateFullBlockers,
         updated_at: nowIso()
     });
+    await closeWorkOrderLedgerForRouteResult(mission.dir, { ok: narutoGateFullPassed, blockers: narutoGateFullBlockers });
     const clones = result.roster?.agent_count ?? roster.agent_count;
     const localWorkerSummary = summarizeNarutoLocalWorkerResult(localWorker, result);
     // Finalizer policy: when local LLM workers contributed patches, the GPT

package/dist/core/commands/ppt-command.js

@@ -337,6 +337,45 @@ function mockPptFixtureGate(gate = {}) {
         blockers: ['ppt_fixture_mode_cannot_claim_real']
     };
 }
+// The image-asset-ledger's `assets` array (see buildPptImageAssetLedger in ../ppt.ts) is the
+// authoritative list of raster/bitmap image assets planned or generated for the deck; every
+// entry in it is a raster PNG produced (or pending) via Codex App $imagegen/gpt-image-2. When the
+// ledger omits `imagegen_evidence` outright, we must NOT assume the imagegen-required policy was
+// satisfied. Instead derive a safe default from that asset list: any raster asset present forces
+// the derived evidence to fail-closed (required + not passed) rather than silently pass.
+function deriveImagegenEvidenceDefault(imageAssetLedger) {
+    if (imageAssetLedger?.imagegen_evidence)
+        return imageAssetLedger.imagegen_evidence;
+    const rasterAssets = Array.isArray(imageAssetLedger?.assets) ? imageAssetLedger.assets : [];
+    const rasterAssetCount = rasterAssets.length;
+    if (rasterAssetCount === 0) {
+        return {
+            schema: 'sks.ppt-imagegen-evidence.v1',
+            required: false,
+            passed: true,
+            blockers: [],
+            derived: true,
+            derivation_basis: { raster_asset_count: 0, source: 'derived_default_no_raster_assets' }
+        };
+    }
+    return {
+        schema: 'sks.ppt-imagegen-evidence.v1',
+        required: true,
+        passed: false,
+        required_count: imageAssetLedger?.required_count || rasterAssetCount,
+        generated_count: imageAssetLedger?.generated_count || 0,
+        generated_image_evidence: false,
+        assets: [],
+        blockers: ['imagegen_evidence_missing'],
+        derived: true,
+        derivation_basis: {
+            raster_asset_count: rasterAssetCount,
+            source: 'derived_default_raster_assets_present',
+            note: `imagegen_evidence section was absent from the image-asset-ledger while ${rasterAssetCount} raster asset(s) were present; failing closed instead of silently passing.`
+        },
+        passed_note: 'imagegen_evidence_missing: ledger omitted imagegen_evidence despite raster assets requiring Codex App imagegen verification'
+    };
+}
 export async function evaluatePptGateArtifacts(dir, baseGate = {}) {
     const factLedger = await readJson(path.join(dir, PPT_FACT_LEDGER_ARTIFACT), null);
     const imageAssetLedger = await readJson(path.join(dir, PPT_IMAGE_ASSET_LEDGER_ARTIFACT), null);
@@ -370,7 +409,7 @@ export async function evaluatePptGateArtifacts(dir, baseGate = {}) {
     const renderReportPassed = renderReport?.passed === true;
     const factLedgerPassed = factLedger?.passed === true && Number(factLedger.unsupported_critical_claims_count || 0) === 0;
     const imageAssetLedgerPassed = imageAssetLedger?.passed === true;
-    const imagegenEvidence = imageAssetLedger?.imagegen_evidence || { schema: 'sks.ppt-imagegen-evidence.v1', required: false, passed: true, blockers: [] };
+    const imagegenEvidence = deriveImagegenEvidenceDefault(imageAssetLedger);
     const imagegenEvidencePassed = imagegenEvidence?.required === true ? imagegenEvidence?.passed === true : true;
     const reviewLedgerPassed = reviewLedger?.passed === true;
     const iterationReportPassed = iterationReport?.passed === true;

package/dist/core/commands/qa-loop-command.js

@@ -14,6 +14,7 @@ import { maybeFinalizeRoute } from '../proof/auto-finalize.js';
 import { runNativeAgentOrchestrator } from '../agents/agent-orchestrator.js';
 import { flag, promptOf, readBoundedIntegerFlag, readFlagValue, readMaxCycles, resolveMissionId, safeReadTextFile } from './command-utils.js';
 import { runCodexAppHandoff, qaLoopShouldRequestAppHandoff } from '../codex-app/codex-app-handoff.js';
+import { evaluateGate } from '../stop-gate/gate-evaluator.js';
 import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-capability.js';
 import { writeCodexAccountUsageArtifacts } from '../usage/codex-account-usage.js';
 import { buildQaLoopBudgetPolicy, selectQaLoopEscalatedEffort } from '../qa-loop/qa-loop-budget-policy.js';
@@ -441,8 +442,10 @@ async function qaLoopStatus(args) {
     const desktop = await readJson(path.join(dir, 'qa-loop', 'app-handoff.json'), null);
     const desktopConfirmation = await readJson(path.join(dir, 'qa-loop', 'app-handoff-confirmation.json'), null);
     const desktopReviewComplete = desktopConfirmation?.verdict === 'pass';
+    const gateVerdict = await evaluateGate(root, id, 'qa-gate.json');
     if (flag(args, '--json'))
-        return console.log(JSON.stringify({ mission, state, qa: status, desktop_app_handoff: desktop, desktop_app_confirmation: desktopConfirmation, desktop_review_complete: desktopReviewComplete, native_agent_plan: nativeAgentPlan, agent_sessions: agentSessions?.sessions || null }, null, 2));
+        return console.log(JSON.stringify({ mission, state, qa: status, desktop_app_handoff: desktop, desktop_app_confirmation: desktopConfirmation, desktop_review_complete: desktopReviewComplete, native_agent_plan: nativeAgentPlan, agent_sessions: agentSessions?.sessions || null, gate_verdict: gateVerdict }, null, 2));
+    console.log(gateVerdict.verdict);
     console.log('SKS QA-LOOP Status\n');
     console.log(`Mission:   ${id}`);
     console.log(`Phase:     ${state.phase || mission.phase}`);

package/dist/core/commands/release-command.js

@@ -27,7 +27,7 @@ export async function releaseCommand(args = []) {
     await writeTextAtomic(stdoutPath, String(result.stdout || ''));
     await writeTextAtomic(stderrPath, String(result.stderr || ''));
     const readiness = await findReleaseReadinessReport(root);
-    const requiredSections = ['five_lane_review', 'integration_evidence', 'session_cleanup'];
+    const requiredSections = [];
     const missingSections = requiredSections.filter((section) => readiness.report?.[section] == null);
     if (readiness.report)
         await writeJsonAtomic(path.join(mission.dir, 'release-readiness-report.json'), readiness.report);
@@ -53,14 +53,14 @@ export async function releaseCommand(args = []) {
         stdout_tail: tail(String(result.stdout || '')),
         stderr_tail: tail(String(result.stderr || ''))
     };
+    if (!report.ok)
+        process.exitCode = result.status || 1;
     if (json)
         return printJson(report);
     if (result.stdout)
         process.stdout.write(result.stdout);
     if (result.stderr)
         process.stderr.write(result.stderr);
-    if (!report.ok)
-        process.exitCode = result.status || 1;
     return report;
 }
 async function findReleaseReadinessReport(root) {