sneakoscope 5.3.0 → 5.5.1

package/dist/core/routes.js

@@ -155,6 +155,7 @@ export const ROUTES = [
         context7Policy: 'if_external_docs',
         reasoningPolicy: 'medium',
         stopGate: 'none',
+        coverageExemptReason: 'read-only answer route; never writes or modifies code/files',
         cliEntrypoint: 'implicit question route',
         examples: ['이 파이프라인이 왜 이렇게 동작해?', 'What does this hook do?']
     },
@@ -169,6 +170,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'medium',
         stopGate: 'honest_mode',
+        coverageExemptReason: 'setup/help/status routing only; delegates any real work to the target route it dispatches to',
         cliEntrypoint: 'sks commands',
         examples: ['$SKS show me available workflows']
     },
@@ -213,6 +215,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'single boolean project-config toggle, not a code-changing work order',
         cliEntrypoint: 'sks fast-mode on|off|status|clear [--json]',
         examples: ['$Fast-On', '$Fast-Off', '$Fast-Mode status']
     },
@@ -229,6 +232,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'single boolean project-config toggle, not a code-changing work order',
         cliEntrypoint: 'sks with-local-llm on|off|status|set-model [--json]',
         examples: ['$with-local-llm-on', '$with-local-llm-off', 'sks with-local-llm status --json']
     },
@@ -249,6 +253,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'high',
         stopGate: 'naruto-gate.json',
+        coverage_required: true,
         cliEntrypoint: 'sks team "task" [executor:5 reviewer:6 user:1] | sks team log|tail|watch|lane|status|event|message|open-zellij|attach-zellij|cleanup-zellij',
         examples: ['$Team executor:5 agree on the best plan and implement it', '$From-Chat-IMG 채팅+첨부 이미지 작업 지시서']
     },
@@ -265,6 +270,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'high',
         stopGate: 'naruto-gate.json',
+        coverage_required: true,
         cliEntrypoint: 'sks naruto run "task" [--clones N] [--backend codex-sdk|fake|ollama] [--parallel-write] | sks naruto status',
         examples: ['$Naruto run sweep the codebase for TODO comments with 50 clones', '$Work', '$Swarm "fix all lint errors"']
     },
@@ -353,6 +359,7 @@ export const ROUTES = [
         context7Policy: 'if_external_docs',
         reasoningPolicy: 'medium',
         stopGate: 'loop-graph-proof.json',
+        coverage_required: true,
         cliEntrypoint: 'sks goal create|pause|resume|clear|status',
         examples: ['$Goal persist this migration workflow with native /goal continuation']
     },
@@ -367,6 +374,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'packages already-made changes into one commit; does not itself decide what work to do',
         cliEntrypoint: 'sks commit [--message "msg"] [--json]',
         examples: ['$Commit 이번 작업 커밋해줘']
     },
@@ -381,6 +389,7 @@ export const ROUTES = [
         context7Policy: 'not_required',
         reasoningPolicy: 'low',
         stopGate: 'none',
+        coverageExemptReason: 'packages already-made changes into one commit and pushes; does not itself decide what work to do',
         cliEntrypoint: 'sks commit-and-push [--message "msg"] [--json]',
         examples: ['$Commit-And-Push 커밋하고 바로 푸쉬해줘']
     },
@@ -514,6 +523,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'medium',
         stopGate: 'none',
+        coverageExemptReason: 'single fixed maintenance action (refresh/pack/validate/prune), not a free-form work order',
         cliEntrypoint: 'sks wiki refresh|pack|validate|prune',
         examples: ['$Wiki refresh', '$Wiki prune and validate']
     },
@@ -528,6 +538,7 @@ export const ROUTES = [
         context7Policy: 'optional',
         reasoningPolicy: 'medium',
         stopGate: 'none',
+        coverageExemptReason: 'read-only help/discovery output; never writes or modifies code/files',
         cliEntrypoint: 'sks help',
         examples: ['$Help show available SKS commands']
     }

package/dist/core/stop-gate/stop-gate-check.js

@@ -145,6 +145,10 @@ export async function checkStopGate(input) {
         missingFields.push('regression_test_added');
     if (bugfixMission && normalizedGate.evidence.regression_test_failed_before_fix !== true)
         missingFields.push('regression_test_failed_before_fix');
+    if (normalizedGate.evidence.required_coverage_passed === false)
+        missingFields.push('coverage_required_but_not_passed');
+    if ((normalizedGate.evidence.uncovered_required_count ?? 0) > 0)
+        missingFields.push(`work_order_uncovered_count:${normalizedGate.evidence.uncovered_required_count}`);
     if (normalizedGate.status === 'passed'
         && normalizedGate.passed === true
         && normalizedGate.blockers.length === 0

package/dist/core/stop-gate/stop-gate-writer.js

@@ -140,6 +140,10 @@ function evidenceMissingBlockers(evidence) {
         blockers.push('regression_test_not_added');
     if (evidence.regression_test_failed_before_fix === false)
         blockers.push('regression_test_failed_before_fix_missing');
+    if (evidence.required_coverage_passed === false)
+        blockers.push('coverage_required_but_not_passed');
+    if ((evidence.uncovered_required_count ?? 0) > 0)
+        blockers.push(`work_order_uncovered_count:${evidence.uncovered_required_count}`);
     return blockers;
 }
 //# sourceMappingURL=stop-gate-writer.js.map

package/dist/core/trust-kernel/trust-report.js

@@ -54,7 +54,14 @@ export async function latestTrustReport(root, missionArg = 'latest') {
         return staleTrustReport(report, temporalIssues);
     }
     if (!proof) {
-        return {
+        // Persist this computed report even though it's a blocked result: `trust report`
+        // is expected to leave a durable trust-report.json behind for anyone (a human or
+        // a later `sks trust report <mission>` call) to inspect, the same way the
+        // completion-proof-present path below does via writeTrustArtifactsForProof(). An
+        // in-memory-only "blocked" result that vanishes after this call returns is
+        // surprising and was the reason `sks trust report latest --json` could exit 0
+        // with a blocked status yet leave no artifact on disk.
+        const report = {
             schema: TRUST_REPORT_SCHEMA,
             ...trustKernelMetadata(),
             ok: false,
@@ -62,6 +69,8 @@ export async function latestTrustReport(root, missionArg = 'latest') {
             status: 'blocked',
             issues: ['completion_proof_missing']
         };
+        await writeJsonAtomic(trustReportPath(root, missionId), report).catch(() => undefined);
+        return report;
     }
     const rebuilt = await writeTrustArtifactsForProof(root, proof);
     if (!rebuilt) {

package/dist/core/update/update-migration-state.js

@@ -477,6 +477,13 @@ export async function ensureCurrentMigrationBeforeCommand(input) {
     if (input.skipMigrationGate === true || commandSkipsMigrationGate(command)) {
         return { ...empty, ok: true, status: 'skipped', receipt: null, doctor: null, failed_stage_id: null, blockers: [], warnings: [`skip_migration_gate_command:${command}`] };
     }
+    // projectRoot() falls back to the raw cwd when no project marker is found.
+    // launchd-spawned callers (the SKS menu bar app) run with cwd=/ — there is
+    // no project to migrate there, and proceeding would mkdir /.sneakoscope and
+    // crash the whole command before it starts.
+    if (root === path.parse(root).root) {
+        return { ...empty, ok: true, status: 'skipped', receipt: null, doctor: null, failed_stage_id: null, blockers: [], warnings: ['no_project_workspace_at_filesystem_root'] };
+    }
     const [epoch, receipt] = await Promise.all([
         ensureInstallationEpoch('first-command-gate'),
         readProjectUpdateMigrationReceipt(root)
@@ -738,7 +745,14 @@ function delay(ms) {
 }
 async function withUpdateMigrationLock(root, base, fn, options = {}) {
     const lockPath = path.join(root, '.sneakoscope', 'update', 'migration.lock');
-    await ensureDir(path.dirname(lockPath));
+    try {
+        await ensureDir(path.dirname(lockPath));
+    }
+    catch (err) {
+        // An unwritable root (read-only mount, cwd outside any workspace) must fail
+        // the gate with a reportable blocker, not crash the whole CLI dispatch.
+        return { ...base, ok: false, status: 'blocked', receipt: null, doctor: null, failed_stage_id: 'migration-lock', blockers: [`update_migration_lock_dir_unwritable:${err?.message || String(err)}`], warnings: [] };
+    }
     const recheck = options.recheck ?? null;
     const deadline = Date.now() + (options.maxWaitMs ?? MIGRATION_LOCK_WAIT_MS);
     let reapedStale = false;

package/dist/core/update-check.js

@@ -1,5 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { PACKAGE_VERSION, packageRoot, readJson, runProcess, throttleLines, which } from './fsx.js';
 import { createRequestedScopeContract } from './safety/requested-scope-contract.js';
 import { guardedPackageInstall, guardContextForRoute } from './safety/mutation-guard.js';
@@ -351,7 +352,10 @@ export async function runSksUpdateNow(options = {}) {
             stage('project_receipt', migrationCurrent, migrationCurrent ? 'current' : 'failed', { root: projectReceiptRoot });
             if (migrationCurrent)
                 sksMenuBar = await installUpdateSksMenuBar({ root: projectReceiptRoot, env, stage, quiet: machineOutput });
-            await runUpdateGlobalSkillsReconcile(stage, { quiet: machineOutput });
+            await runUpdateGlobalSkillsReconcile(stage, {
+                quiet: machineOutput,
+                newPackageRoot: newBinary ? path.resolve(path.dirname(newBinary), '..', '..') : null
+            });
         }
     }
     const verification = await runFinalUpdateVerification({ installOk, newBinary, installVersion, env, projectReceiptRoot });
@@ -392,8 +396,46 @@ export async function runSksUpdateNow(options = {}) {
     });
 }
 async function runUpdateGlobalSkillsReconcile(stage, opts = {}) {
+    const targetDir = path.join(os.homedir(), '.agents', 'skills');
+    // reconcileSkills stamps ~/.agents/skills/.sks-generated.json with the
+    // PACKAGE_VERSION compiled into whichever module runs it. This function
+    // executes inside the OLD (driver) binary, so after a real version install
+    // an in-process reconcile would overwrite the manifest the new binary's
+    // migration doctor just wrote and make final self-verification report
+    // skills_manifest stale forever. Delegate to the freshly installed package.
+    if (opts.newPackageRoot) {
+        const moduleHref = pathToFileURL(path.join(opts.newPackageRoot, 'dist', 'core', 'init', 'skills.js')).href;
+        const script = [
+            `const m = await import(${JSON.stringify(moduleHref)});`,
+            `const r = await m.reconcileSkills({ targetDir: ${JSON.stringify(targetDir)}, scope: 'global', fix: true });`,
+            'console.log(JSON.stringify(r));',
+            'if (r && (r.ok === false || r.error)) process.exit(1);'
+        ].join('\n');
+        const work = runProcess(process.execPath, ['--input-type=module', '-e', script], {
+            timeoutMs: 120_000,
+            maxOutputBytes: 1024 * 1024
+        }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+        const run = opts.quiet ? await work : await withHeartbeat('skills reconcile', work, { warnAfterMs: 30_000 });
+        let parsed = null;
+        for (const line of String(run.stdout || '').trim().split('\n').reverse()) {
+            try {
+                parsed = JSON.parse(line);
+                break;
+            }
+            catch { /* not the JSON result line */ }
+        }
+        const ok = run.code === 0 && parsed?.ok !== false && !parsed?.error;
+        stage('global_skills_reconcile', ok, ok ? 'reconciled' : 'failed', {
+            via: 'new_package_binary',
+            installed: Array.isArray(parsed?.installed) ? parsed.installed.length : null,
+            updated: Array.isArray(parsed?.updated) ? parsed.updated.length : null,
+            removed: Array.isArray(parsed?.removed) ? parsed.removed.length : null,
+            error: ok ? null : parsed?.error || String(run.stderr || '').trim().slice(-400) || `exit_${run.code}`
+        });
+        return parsed || { schema: 'sks.skill-reconcile.v1', ok };
+    }
     const work = reconcileSkills({
-        targetDir: path.join(os.homedir(), '.agents', 'skills'),
+        targetDir,
         scope: 'global',
         fix: true
     }).catch((err) => ({ schema: 'sks.skill-reconcile.v1', ok: false, error: err?.message || String(err) }));

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '5.3.0';
+export const PACKAGE_VERSION = '5.5.1';
 //# sourceMappingURL=version.js.map

package/dist/core/work-order-ledger.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from './fsx.js';
 import { ARTIFACT_FILES, validateWorkOrderLedger } from './artifact-schemas.js';
+import { promptRequirementItems } from './questions.js';
 export function createWorkOrderLedger({ missionId = 'unassigned', route = 'team', requests = [], sourcesComplete = false } = {}) {
     const items = requests.map((request, index) => ({
         id: `WO-${String(index + 1).padStart(3, '0')}`,
@@ -38,6 +39,27 @@ export async function writeWorkOrderLedger(dir, ledger) {
 export async function readWorkOrderLedger(dir) {
     return readJson(path.join(dir, ARTIFACT_FILES.work_order_ledger), null);
 }
+export function evaluateWorkOrderCoverage(ledger) {
+    if (!ledger)
+        return { ok: true, blockers: [], uncovered_count: 0 };
+    const blockers = [];
+    if (!ledger.source_inventory_complete)
+        blockers.push('work_order_inventory_truncated');
+    if (!ledger.all_customer_requests_mapped)
+        blockers.push('work_order_requests_not_mapped');
+    if (!ledger.all_work_items_verified)
+        blockers.push('work_order_items_not_verified');
+    let uncovered_count = 0;
+    for (const item of (ledger.items || [])) {
+        const isVerified = item.status === 'verified';
+        const isBlockedWithEvidence = item.status === 'blocked' && item.blocker?.blocked === true;
+        if (!isVerified && !isBlockedWithEvidence) {
+            uncovered_count += 1;
+            blockers.push(`work_order_uncovered:${item.id}:"${item.source?.verbatim?.slice(0, 40) || ''}"`);
+        }
+    }
+    return { ok: blockers.length === 0, blockers, uncovered_count };
+}
 export function updateWorkOrderItem(ledger, id, patch = {}) {
     return {
         ...ledger,
@@ -51,4 +73,42 @@ export function updateWorkOrderItem(ledger, id, patch = {}) {
         })
     };
 }
+/**
+ * Parses a free-form work-order prompt into WO-001..N ledger items (via
+ * promptRequirementItems) and persists the ledger at mission creation time,
+ * so every item is registered verbatim before any execution starts.
+ */
+export async function createAndWriteWorkOrderLedgerForPrompt(dir, { missionId, route, prompt } = {}) {
+    const { items, truncated } = promptRequirementItems(String(prompt || ''));
+    const requests = items.map((item) => ({
+        type: 'chat_text',
+        verbatim: item.text,
+        location: `prompt:${item.id}`
+    }));
+    const ledger = createWorkOrderLedger({ missionId, route, requests, sourcesComplete: !truncated });
+    await writeWorkOrderLedger(dir, ledger);
+    return ledger;
+}
+/**
+ * Closes out every item in a mission's ledger to a terminal state once the
+ * route's own gate has decided ok/not-ok, so evaluateStop's coverage gate
+ * (which blocks stop while any item sits in 'pending') can never wait
+ * forever: an item is either verified (route succeeded) or honestly
+ * blocked (route failed, real blockers recorded), never left hanging.
+ * This is coarser than true per-item tracking, but it closes the loop.
+ */
+export async function closeWorkOrderLedgerForRouteResult(dir, { ok, blockers = [] }) {
+    const ledger = await readWorkOrderLedger(dir);
+    if (!ledger || !Array.isArray(ledger.items) || ledger.items.length === 0)
+        return null;
+    let next = ledger;
+    for (const item of ledger.items) {
+        const patch = ok
+            ? { status: 'verified', implementation_tasks: item.implementation_tasks?.length ? item.implementation_tasks : ['route_completion'] }
+            : { status: 'blocked', blocker: { blocked: true, reason: blockers.join(', ') || 'route_completion_blocked', needed_to_unblock: 'resolve the route blockers and re-run' } };
+        next = updateWorkOrderItem(next, item.id, patch);
+    }
+    await writeWorkOrderLedger(dir, next);
+    return next;
+}
 //# sourceMappingURL=work-order-ledger.js.map

package/dist/scripts/gate-policy-audit-check.js

@@ -26,9 +26,9 @@ const directCodexConfigWrites = scanDirectCodexConfigWrites();
 const commandGateContract = scanCommandGateContract();
 const directMkdtempCalls = scanDirectMkdtempCalls();
 const rustTempdirCalls = scanRustTempdirCalls();
-if (releaseGates.length > 200)
+if (releaseGates.length > 220)
     blockers.push(`release_preset_gate_budget_exceeded:${releaseGates.length}`);
-if (gates.length > 200)
+if (gates.length > 220)
     blockers.push(`release_manifest_gate_budget_exceeded:${gates.length}`);
 if (Object.keys(pkg.scripts || {}).length > 100)
     blockers.push(`package_script_budget_exceeded:${Object.keys(pkg.scripts || {}).length}`);

package/dist/scripts/packlist-performance-check.js

@@ -7,7 +7,13 @@ import { spawnSync } from 'node:child_process';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
 const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 1024);
-const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2300 * 1024);
+// Raised from 2300 KiB after the 5.4.0 dollar-command hardening pass added
+// src/core/feature-fixture-executor.ts and expanded several command modules
+// (route-success-helpers.ts, seo-command.ts, ppt-command.ts, qa-loop-command.ts,
+// research-command.ts, image-ux-review-command.ts, mad-sks-command.ts,
+// sks-menubar.ts) with genuine new production logic, pushing the packed size
+// to ~2306 KiB. Kept modest headroom rather than a large jump.
+const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2340 * 1024);
 function runNpmPack() {
     const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
     const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');

package/dist/scripts/release-dag-full-coverage-check.js

@@ -42,7 +42,7 @@ const schemaComplete = [...releaseManifest.gates, ...harnessManifest.gates].ever
 const report = {
     schema: 'sks.release-dag-full-coverage-check.v2',
     ok: schemaComplete
-        && releasePreset.length <= 200
+        && releasePreset.length <= 220
         && missingRequiredReleasePreset.length === 0
         && missingRequiredHarnessPreset.length === 0
         && duplicateAcrossManifests.length === 0

package/dist/scripts/release-gate-existence-audit.js

@@ -42,7 +42,7 @@ const releaseCheckTarget = releaseCheck.includes('release:check:affected')
     ? String(scripts['release:check:affected'] || '')
     : releaseCheck;
 assertGate(releaseCheckTarget.includes('release-gate-dag-runner') && /--preset\s+(?:release|affected)/.test(releaseCheckTarget), 'release:check must use the v2 DAG release/affected preset', { release_check: scripts['release:check'], resolved_release_check: releaseCheckTarget });
-assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { gate_count: releaseGates.length });
+assertGate(releaseGates.length > 0 && releaseGates.length <= 220, 'release v2 manifest must include 1..220 release gates', { gate_count: releaseGates.length });
 const PACKAGE_SCRIPT_BUDGET = 150;
 assertGate(Object.keys(scripts).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(scripts).length, limit: PACKAGE_SCRIPT_BUDGET });
 for (const id of requiredRelease)

package/dist/scripts/release-gate-planner.js

@@ -27,7 +27,7 @@ const harnessNonZellij = harnessIds.filter((id) => !id.startsWith('zellij:'));
 const releasePresetLeaks = release.gates.filter((gate) => !Array.isArray(gate.preset) || !gate.preset.includes('release')).map((gate) => gate.id);
 const harnessPresetLeaks = harness.gates.filter((gate) => !Array.isArray(gate.preset) || !gate.preset.includes('harness') || gate.preset.includes('release')).map((gate) => gate.id);
 const npmRunGates = release.gates.concat(harness.gates).filter((gate) => /\bnpm\s+run\b/.test(String(gate.command))).map((gate) => gate.id);
-assertGate(release.gates.length <= 200, 'release preset gate budget exceeded', { release_gates: release.gates.length, limit: 200 });
+assertGate(release.gates.length <= 220, 'release preset gate budget exceeded', { release_gates: release.gates.length, limit: 220 });
 assertGate(Object.keys(scripts).length <= PACKAGE_SCRIPT_BUDGET, 'package.json script budget exceeded', { scripts: Object.keys(scripts).length, limit: PACKAGE_SCRIPT_BUDGET });
 assertGate(duplicateAcrossManifests.length === 0, 'gate appears in both release and harness manifests', { duplicateAcrossManifests });
 assertGate(releaseZellij.length === 0, 'zellij gates must live in infra-harness-gates.json, not release-gates.v2.json', { releaseZellij });

package/dist/scripts/release-metadata-1-19-check.js

@@ -370,7 +370,7 @@ assertGate(releaseCheckScript.startsWith('npm run release:check:parallel')
     || releaseCheckScript.includes('release:check:affected'), 'release:check must use release:check:parallel, release:check:affected, or the release gate DAG runner');
 assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate manifest schema mismatch', { schema: releaseManifest?.schema || null });
 assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
-assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release v2 manifest must include 1..200 release gates', { release_gates: releaseGates.length });
+assertGate(releaseGates.length > 0 && releaseGates.length <= 220, 'release v2 manifest must include 1..220 release gates', { release_gates: releaseGates.length });
 assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
 const PACKAGE_SCRIPT_BUDGET = 100;
 assertGate(Object.keys(pkg.scripts || {}).length <= PACKAGE_SCRIPT_BUDGET, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: PACKAGE_SCRIPT_BUDGET });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "5.3.0",
+  "version": "5.5.1",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -63,6 +63,8 @@
     "build": "npm run build:clean",
     "build:clean": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true}); fs.rmSync('.sneakoscope/cache/tsbuildinfo',{recursive:true,force:true})\" && tsc -p tsconfig.json && node ./dist/scripts/ensure-bin-executable.js && node ./dist/scripts/build-dist.js",
     "build:incremental": "tsc -p tsconfig.json && node ./dist/scripts/ensure-bin-executable.js && node ./dist/scripts/build-dist.js",
+    "test": "node --test --test-concurrency=1 dist/core/__tests__/*.test.js dist/core/proof/__tests__/*.test.js dist/core/stop-gate/__tests__/*.test.js dist/core/commands/__tests__/*.test.js dist/core/dfix/__tests__/*.test.js dist/core/ppt/__tests__/*.test.js dist/core/mad-sks/__tests__/*.test.js dist/core/codex-app/__tests__/*.test.js dist/core/doctor/__tests__/*.test.js dist/cli/__tests__/*.test.js",
+    "selftest:real": "node ./dist/bin/sks.js selftest --real --json",
     "check": "npm run release:check:affected",
     "dev:sks": "npm run build:incremental --silent && node ./dist/bin/sks.js",
     "prepublishOnly": "npm run release:check:affected",
@@ -73,6 +75,8 @@
     "release:check": "npm run release:check:affected --silent",
     "release:metadata": "node ./dist/scripts/release-metadata-check.js",
     "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",
+    "ppt:real-imagegen-wiring": "node ./dist/scripts/ppt-real-imagegen-wiring-check.js",
+    "ux-review:run-wires-imagegen": "node ./dist/scripts/ux-review-run-wires-imagegen-check.js",
     "release:check:parallel": "npm run build --silent && node ./dist/scripts/release-parallel-check.js && node ./dist/scripts/release-check-stamp.js write",
     "release:check:legacy": "npm run release:check:parallel --silent",
     "release:dag-full-coverage": "node ./dist/scripts/release-dag-full-coverage-check.js",

package/schemas/release/release-gate-node.schema.json

@@ -24,6 +24,7 @@
           "side_effect": { "enum": ["hermetic", "real-env"] },
           "timeout_ms": { "type": "integer", "minimum": 1 },
           "output_contract": { "const": "sks.gate-result.v1" },
+          "contract_note": { "type": "string", "minLength": 1 },
           "cache": {
             "type": "object",
             "required": ["enabled", "inputs"],