sneakoscope 6.0.0 → 6.0.2

package/dist/scripts/codex-lb-gpt55-fast-profile-check.js

@@ -5,7 +5,6 @@ import path from 'node:path';
 import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, ensureGlobalCodexFastModeDuringInstall, releaseCodexLbAuthHold, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { repairCodexConfigStructure, splitCodexProjectConfigPolicy } from '../core/codex/codex-project-config-policy.js';
 import { parseCodexConfigToml, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
-import { REQUIRED_CODEX_MODEL } from '../core/codex-model-guard.js';
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-gpt55-fast-'));
 const home = path.join(tmp, 'home');
 const root = path.join(tmp, 'project');
@@ -46,7 +45,7 @@ await fs.writeFile(projectConfig, [
     'enabled = true',
     '',
     '[profiles.sks-fast-high]',
-    `model = "${REQUIRED_CODEX_MODEL}"`,
+    'model = "future-codex-model"',
     'service_tier = "fast"',
     ''
 ].join('\n'));
@@ -87,6 +86,7 @@ function assertFastProfile(text, label) {
         ...(parsed.default_profile === undefined ? [] : ['default_profile_legacy_key_present']),
         ...(parsed.user?.fast_mode === undefined ? [] : ['user_fast_mode_legacy_table_present']),
         ...(parsed.profiles?.['sks-fast-high'] === undefined ? [] : ['sks_fast_high_legacy_profile_present']),
+        ...(parsed.model === undefined ? [] : ['codex_app_model_was_injected']),
         ...(provider.requires_openai_auth === true ? [] : ['codex_lb_requires_openai_auth_not_true']),
         ...(provider.wire_api === 'responses' ? [] : ['codex_lb_wire_api_not_responses']),
         ...(desktop.on ? [] : ['desktop_fast_status_off'])
@@ -95,6 +95,7 @@ function assertFastProfile(text, label) {
         label,
         ok: blockers.length === 0,
         default_profile: parsed.default_profile || null,
+        model: parsed.model || null,
         legacy_keys: validation.legacy_keys,
         service_tier: parsed.service_tier || null,
         provider_wire_api: provider.wire_api || null,

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -7,8 +7,8 @@ const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-'));
 const codexHome = path.join(root, 'home', '.codex');
 await fs.mkdir(path.join(root, '.codex'), { recursive: true });
 await fs.mkdir(codexHome, { recursive: true });
-await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model = "gpt-5.5"\nmodel_reasoning_effort = "medium"\nmodel_provider = "codex-lb"\n');
-await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel = "z-ai/glm-5.2"\nmodel_reasoning_effort = "xhigh"\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "gpt-5.5"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n');
+await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model = "future-codex-model"\nmodel_reasoning_effort = "medium"\nmodel_provider = "codex-lb"\n');
+await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel = "legacy-sks-model"\nmodel_reasoning_effort = "xhigh"\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "legacy-profile-model"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n');
 const plan = await repairCodexAppFastUi(root, { codexHome, apply: false });
 const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true });
 const projectAfter = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
@@ -29,12 +29,12 @@ const ok = plan.fast_selector === 'manual_action_required'
     && repaired.fast_selector === 'repaired'
     && repaired.provider_selector === 'manual_action_required'
     && repaired.safe_auto_apply === true
-    && backups.length >= 2
-    && !/^model\s*=/m.test(projectAfter.split(/\n\s*\[/)[0] || '')
-    && !/^model_reasoning_effort\s*=/m.test(projectAfter.split(/\n\s*\[/)[0] || '')
+    && backups.length >= 1
+    && /^model\s*=\s*"future-codex-model"$/m.test(projectAfter.split(/\n\s*\[/)[0] || '')
+    && /^model_reasoning_effort\s*=\s*"medium"$/m.test(projectAfter.split(/\n\s*\[/)[0] || '')
     && !/^model\s*=/m.test(homeTopLevel)
     && !/^model_reasoning_effort\s*=/m.test(homeTopLevel)
-    && !/model_provider\s*=/.test(projectAfter)
+    && /model_provider\s*=\s*"codex-lb"/.test(projectAfter)
     && !/service_tier\s*=/.test(homeTopLevel)
     && /fast_mode = false/.test(homeAfter)
     && /model_provider = "codex-lb"/.test(homeAfter)

package/dist/scripts/install-update-preserves-config-check.js

@@ -23,7 +23,7 @@ const results = [];
     const cfg = path.join(codexDir, 'config.toml');
     const userConfig = [
         '# my hand-tuned Codex config',
-        'model = "gpt-5.1-codex"',
+        'model = "future-codex-model"',
         'service_tier = "standard"',
         'model_reasoning_effort = "high"',
         '',
@@ -36,7 +36,7 @@ const results = [];
     const after = await fs.readFile(cfg, 'utf8');
     const backups = (await fs.readdir(codexDir)).filter((f) => f.startsWith('config.toml.sks-'));
     const ok = res.status === 'updated' &&
-        /^model = "gpt-5\.1-codex"/m.test(after) && // user model preserved
+        /^model = "future-codex-model"/m.test(after) && // arbitrary user model preserved
         /^service_tier = "standard"/m.test(after) && // user tier preserved
         /^model_reasoning_effort = "high"/m.test(after) && // user effort NOT stripped
         /# my hand-tuned Codex config/.test(after) && // user comment preserved
@@ -45,7 +45,7 @@ const results = [];
         !/\[user\.fast_mode\]/.test(after) && // legacy fast UI table stripped
         backups.length >= 1 && // backup created
         Boolean(res.backup_path);
-    results.push({ case: 'preserves_user_config', ok, status: res.status, backups, model_preserved: /gpt-5\.1-codex/.test(after) });
+    results.push({ case: 'preserves_user_config', ok, status: res.status, backups, model_preserved: /future-codex-model/.test(after) });
 }
 // --- Case 2: fresh/empty config gets SKS defaults without forcing fast service tier ---
 {

package/dist/scripts/loop-hardening-check-lib.js

@@ -146,7 +146,7 @@ export async function runLoopHardeningCheck(id) {
     else if (id === 'loop:concurrency-budget' || id === 'loop:concurrency-budget-runtime' || id === 'loop:concurrency-oversubscription-blackbox') {
         const plan = samplePlan('M-check-budget', Array.from({ length: 10 }, (_, i) => sampleNode(`loop-${i}`, 'M-check-budget', 8, 8)));
         const budget = computeLoopConcurrencyBudget({ plan, parallelism: 'extreme', env: { SKS_LOOP_MAX_ACTIVE_WORKERS: '16', SKS_LOOP_MAX_ACTIVE_LOOPS: '4', SKS_LOOP_MAX_MODEL_CALLS: '8' } });
-        assert(budget.max_active_workers === 16 && budget.max_active_loops === 4, 'env concurrency budget overrides apply', budget);
+        assert(budget.max_active_workers === 4 && budget.max_active_loops === 4, 'env concurrency requests cannot raise the desktop-safe loop budget', budget);
         assert(budget.per_loop_worker_budget.reduce((sum, row) => sum + row.maker_workers + row.checker_workers, 0) <= 16, 'per-loop worker budget does not oversubscribe');
     }
     else if (id === 'loop:mesh-production-e2e-blackbox') {

package/dist/scripts/naruto-parallelism-mode-check.js

@@ -3,10 +3,11 @@
 import { decideNarutoConcurrency } from '../core/naruto/naruto-concurrency-governor.js';
 import { DEFAULT_NARUTO_CLONES } from '../core/agents/agent-schema.js';
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
-assertGate(DEFAULT_NARUTO_CLONES === 32, 'default Naruto clones must be 32');
+assertGate(DEFAULT_NARUTO_CLONES === 8, 'default Naruto clone roster must be 8');
 const extreme = decideNarutoConcurrency({ requestedClones: 32, totalWorkItems: 64, backend: 'fake', parallelismMode: 'extreme' });
 const safe = decideNarutoConcurrency({ requestedClones: 32, totalWorkItems: 64, backend: 'fake', parallelismMode: 'safe' });
 assertGate(extreme.parallelism_mode === 'extreme' && safe.parallelism_mode === 'safe', 'governor must record parallelism mode', { extreme, safe });
+assertGate(extreme.safe_active_workers <= 4 && safe.safe_active_workers <= extreme.safe_active_workers, 'all modes must honor the desktop-safe active-worker cap', { extreme, safe });
 assertGate(readText('src/core/commands/naruto-command.ts').includes('--parallelism'), 'Naruto CLI must parse --parallelism');
 emitGate('naruto:parallelism-mode', { extreme, safe });
 //# sourceMappingURL=naruto-parallelism-mode-check.js.map

package/dist/scripts/naruto-shadow-clone-swarm-check.js

@@ -1,9 +1,8 @@
 #!/usr/bin/env node
 // @ts-nocheck
 // $Naruto Shadow Clone Swarm gate.
-// Proves the high-scale mode lifts the standard 20-agent ceiling to 100 clones WITHOUT
-// changing it for any other route, and that an end-to-end `sks naruto run` actually
-// schedules >20 concurrent clone sessions to completion with proof.
+// Proves Naruto can queue a 100-clone roster while active work stays bounded by
+// the desktop-safe resource governor.
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -16,11 +15,11 @@ const effortPolicy = await importDist('core/agents/agent-effort-policy.js');
 // 1) Naruto ceiling exists and is 100; standard ceiling untouched at 20.
 assertGate(schema.MAX_NARUTO_AGENT_COUNT === 100, 'MAX_NARUTO_AGENT_COUNT must be 100', { value: schema.MAX_NARUTO_AGENT_COUNT });
 assertGate(schema.MAX_AGENT_COUNT === 20, 'MAX_AGENT_COUNT must remain 20 (standard ceiling)', { value: schema.MAX_AGENT_COUNT });
-// 2) Cap is lifted ONLY when the naruto max is passed; default callers still clamp to 20.
+// 2) Roster size can reach 100, but every scheduler caller stays desktop-safe.
 const narutoSlots = scheduler.normalizeTargetActiveSlots(100, schema.MAX_NARUTO_AGENT_COUNT);
 const defaultSlots = scheduler.normalizeTargetActiveSlots(100);
-assertGate(narutoSlots === 100, 'normalizeTargetActiveSlots(100, naruto-max) must be 100', { narutoSlots });
-assertGate(defaultSlots === 20, 'normalizeTargetActiveSlots(100) default must stay clamped to 20', { defaultSlots });
+assertGate(narutoSlots === 4, 'normalizeTargetActiveSlots(100, naruto-max) must retain the desktop-safe cap', { narutoSlots });
+assertGate(defaultSlots === 4, 'normalizeTargetActiveSlots(100) must stay desktop-safe', { defaultSlots });
 // 3) A 100-clone roster builds 100 unique clones (no unique-persona ceiling).
 const fullRoster = roster.buildNarutoCloneRoster({ clones: 100, maxAgentCount: schema.MAX_NARUTO_AGENT_COUNT });
 const uniqueIds = new Set(fullRoster.roster.map((row) => row.id)).size;
@@ -40,9 +39,9 @@ const tiers = new Set(effortRoster.roster.map((row) => row.service_tier));
 const fastFlags = new Set(effortRoster.roster.map((row) => row.fast_mode));
 assertGate([...efforts].every((e) => e === 'low' || e === 'medium'), 'naruto clone efforts must be only low/medium (never high/xhigh)', { efforts: [...efforts] });
 assertGate(efforts.has('low') && efforts.has('medium'), 'naruto effort must be dynamic: a no-tool prompt must yield both low and medium clones', { efforts: [...efforts] });
-assertGate([...modelTiers].every((tier) => tier === 'gpt-5.4-mini' || tier === 'gpt-5.5-low'), 'ordinary naruto clone model tiers must be mini or gpt-5.5-low', { modelTiers: [...modelTiers] });
-assertGate(modelTiers.has('gpt-5.4-mini') && modelTiers.has('gpt-5.5-low'), 'naruto model allocation must dynamically mix gpt-5.4-mini and gpt-5.5-low', { modelTiers: [...modelTiers] });
-assertGate([...modelEfforts].length === 1 && modelEfforts.has('low'), 'ordinary naruto clone model reasoning must stay at low', { modelEfforts: [...modelEfforts] });
+assertGate([...modelTiers].every((tier) => tier === 'codex-selected-low' || tier === 'codex-selected-medium'), 'Naruto must inherit the Codex-selected model and vary only reasoning effort', { modelTiers: [...modelTiers] });
+assertGate(modelTiers.has('codex-selected-low') && modelTiers.has('codex-selected-medium'), 'Naruto effort allocation must dynamically mix low and medium without changing model IDs', { modelTiers: [...modelTiers] });
+assertGate([...modelEfforts].every((effort) => effort === 'low' || effort === 'medium'), 'ordinary Naruto clone model reasoning must stay low/medium', { modelEfforts: [...modelEfforts] });
 assertGate([...tiers].length === 1 && tiers.has('fast'), 'every naruto clone must be fast service tier', { tiers: [...tiers] });
 assertGate([...fastFlags].length === 1 && fastFlags.has(true), 'every naruto clone must have fast_mode=true', { fastFlags: [...fastFlags] });
 // 4c) Unit rule: no tool use -> low; any tool use -> medium; always fast.
@@ -51,9 +50,9 @@ const toolWrite = effortPolicy.decideNarutoCloneEffort({ readonly: false, prompt
 const toolReadCmd = effortPolicy.decideNarutoCloneEffort({ readonly: true, prompt: 'run the build and apply the migration' });
 const simpleWrite = effortPolicy.decideNarutoCloneEffort({ readonly: false, prompt: 'simple one-line typo fix' });
 assertGate(simple.reasoning_effort === 'low' && simple.service_tier === 'fast', 'no-tool read-only work must be low + fast', { simple });
-assertGate(simple.model === 'gpt-5.4-mini' && simple.model_reasoning_effort === 'low', 'no-tool read-only work must downshift to gpt-5.4-mini', { simple });
-assertGate(toolWrite.reasoning_effort === 'medium' && toolWrite.service_tier === 'fast' && toolWrite.model === 'gpt-5.5' && toolWrite.model_reasoning_effort === 'low', 'writing clone (tool use) must be medium + gpt-5.5 low', { toolWrite });
-assertGate(simpleWrite.model === 'gpt-5.4-mini' && simpleWrite.model_reasoning_effort === 'low', 'simple write work must downshift native workers to gpt-5.4-mini', { simpleWrite });
+assertGate(simple.model === '' && simple.model_reasoning_effort === 'low', 'no-tool read-only work must inherit the Codex model at low effort', { simple });
+assertGate(toolWrite.reasoning_effort === 'medium' && toolWrite.service_tier === 'fast' && toolWrite.model === '' && toolWrite.model_reasoning_effort === 'medium', 'writing clone must inherit the Codex model at medium effort', { toolWrite });
+assertGate(simpleWrite.model === '' && simpleWrite.model_reasoning_effort === 'low', 'simple write work must inherit the Codex model at low effort', { simpleWrite });
 assertGate(toolReadCmd.reasoning_effort === 'medium' && toolReadCmd.service_tier === 'fast' && toolReadCmd.model_reasoning_effort === 'high', 'risky read-only command/migration work must escalate model reasoning to high', { toolReadCmd });
 // 5) System-safe concurrency: never spawn the whole count at once; throttle to host capacity.
 const fakeSafe = roster.systemSafeNarutoConcurrency({ backend: 'fake' });
@@ -64,22 +63,18 @@ const lowFreeButCapable = roster.systemSafeNarutoConcurrency({
     freeBytes: 512 * 1024 * 1024,
     totalBytes: 16 * 1024 * 1024 * 1024
 });
-assertGate(fakeSafe.cap >= 1 && fakeSafe.cap <= schema.MAX_NARUTO_AGENT_COUNT, 'fake-backend concurrency cap must be in [1, 100]', { fakeSafe });
-// codex-sdk workers are network-bound (each mostly idle awaiting the Codex API),
-// so concurrency is bounded by MEMORY + the 100-clone ceiling, NOT by CPU cores: a
-// capable host may run up to MAX_NARUTO_AGENT_COUNT in parallel.
-assertGate(heavySafe.cap >= 1 && heavySafe.cap <= schema.MAX_NARUTO_AGENT_COUNT, 'heavy-backend concurrency cap must be in [1, 100]', { heavySafe });
+assertGate(fakeSafe.cap >= 1 && fakeSafe.cap <= 4, 'fake-backend active concurrency cap must stay in [1, 4]', { fakeSafe });
+assertGate(heavySafe.cap >= 1 && heavySafe.cap <= 4, 'heavy-backend active concurrency cap must stay in [1, 4]', { heavySafe });
 assertGate(heavySafe.cap <= fakeSafe.cap, 'heavy backend must throttle no looser than the light backend', { heavySafe, fakeSafe });
 assertGate(heavySafe.cores >= 1, 'must detect at least one core', { cores: heavySafe.cores });
-assertGate(lowFreeButCapable.cap >= 4, 'capable hosts must not collapse Naruto codex-sdk concurrency to 1 just because free memory is low', { lowFreeButCapable });
-// A big-memory host is NOT throttled by core count: simulate 64 GB and assert the
-// heavy backend scales well past the old 16-core-derived ceiling toward 100.
+assertGate(lowFreeButCapable.cap === 1, 'low free memory must collapse active Codex concurrency to one worker', { lowFreeButCapable });
 const bigMemoryHost = roster.systemSafeNarutoConcurrency({ backend: 'codex-sdk', cores: 4, freeBytes: 48 * 1024 * 1024 * 1024, totalBytes: 64 * 1024 * 1024 * 1024 });
-assertGate(bigMemoryHost.cap >= 64, 'a 64 GB host must allow >= 64 parallel codex-sdk workers regardless of core count (network-bound, memory-budgeted)', { bigMemoryHost });
-// 6) End-to-end run: 24 clones (> standard 20 -> ceiling lifted) all complete, while
-//    release verification keeps live slots bounded so the gate stays hermetic under DAG load.
-const proofClones = 24;
-const proofConcurrency = 6;
+assertGate(bigMemoryHost.cap >= 1 && bigMemoryHost.cap <= 4, 'large memory must not bypass the interactive CPU cap', { bigMemoryHost });
+// 6) A small end-to-end run proves the same queue/drain path. The direct roster
+//    assertions above cover the 100-clone ceiling without making this release
+//    gate create dozens of unnecessary worker processes.
+const proofClones = 6;
+const proofConcurrency = 4;
 const cli = path.join(root, 'dist', 'bin', 'sks.js');
 const isolatedWorktreeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-shadow-wt-'));
 const childEnv = { ...process.env, SKS_WORKTREE_ROOT: isolatedWorktreeRoot, SKS_DISABLE_GIT_WORKTREE: '1' };
@@ -101,13 +96,13 @@ const parsed = parseJson(run.stdout);
 assertGate(parsed !== null, 'sks naruto run must emit JSON', { stdout: tail(run.stdout) });
 assertGate(parsed.ok === true, 'naruto run must be ok', { ok: parsed.ok });
 assertGate(parsed.mode === 'NARUTO' && parsed.jutsu === 'kage_bunshin_no_jutsu', 'naruto run must report NARUTO mode', { mode: parsed.mode, jutsu: parsed.jutsu });
-assertGate(parsed.clones === proofClones, 'clone fan-out must use the requested count (> standard 20 ceiling)', { clones: parsed.clones });
+assertGate(parsed.clones === proofClones, 'clone fan-out must use the requested queued count', { clones: parsed.clones });
 assertGate(parsed.max_clones === 100, 'naruto run must advertise the 100 ceiling', { max_clones: parsed.max_clones });
 assertGate(parsed.proof === 'passed', 'naruto run proof must pass', { proof: parsed.proof });
 // Throttle invariant: active concurrency never exceeds the requested count nor the host cap.
 assertGate(parsed.target_active_slots >= 1 && parsed.target_active_slots <= proofClones, 'active slots must be in [1, clones]', { target_active_slots: parsed.target_active_slots });
 assertGate(parsed.target_active_slots <= fakeSafe.cap, 'active slots must be throttled to the system-safe cap', { target_active_slots: parsed.target_active_slots, cap: fakeSafe.cap });
-assertGate(parsed.target_active_slots === proofConcurrency, 'release proof must keep Naruto live slots bounded while fan-out stays >20', { target_active_slots: parsed.target_active_slots, proofConcurrency });
+assertGate(parsed.target_active_slots <= proofConcurrency && parsed.target_active_slots <= 4, 'release proof must keep Naruto live slots desktop-safe while queued fan-out remains larger', { target_active_slots: parsed.target_active_slots, proofConcurrency });
 // Task 9.1: fan-out (clones) and live concurrency (target_active_slots) are reported
 // distinctly, and concurrency_capped truthfully reflects "N clones, running M at a time".
 assertGate(typeof parsed.concurrency_capped === 'boolean', 'naruto run must report concurrency_capped', { concurrency_capped: parsed.concurrency_capped });
@@ -124,13 +119,11 @@ assertGate(new Set(writePaths).size > 1, 'naruto command default patch-envelope
 assertGate(commandGraph.active_waves.some((wave) => wave.write_paths.length > 1), 'naruto command graph must contain a parallel write wave when route-local patch envelopes do not overlap', { waves: commandGraph.active_waves.slice(0, 3) });
 const state = parsed.run?.scheduler?.state || parsed.run?.scheduler || {};
 assertGate(Number(state.completed_count) === Number(parsed.work_graph?.total_work_items || 0) && Number(state.completed_count) >= proofClones, 'all clone work items must complete despite throttling', { completed_count: state.completed_count, total_work_items: parsed.work_graph?.total_work_items, proofClones });
-const explicitConcurrency = spawnSync(process.execPath, [cli, 'naruto', 'run', 'explicit concurrency', '--clones', '6', '--backend', 'fake', '--work-items', '6', '--concurrency', '6', '--json', '--no-open-zellij'], { cwd: root, env: childEnv, encoding: 'utf8', timeout: 600000, maxBuffer: 4 * 1024 * 1024 });
-const explicitParsed = parseJson(explicitConcurrency.stdout);
-assertGate(explicitConcurrency.status === 0 && explicitParsed?.target_active_slots === 6, 'explicit --concurrency must let Naruto use the requested parallel slot count', { status: explicitConcurrency.status, target_active_slots: explicitParsed?.target_active_slots });
-// 7) A small request is NOT throttled below what was asked (cap only ever reduces, never inflates).
+assertGate(parsed.target_active_slots <= 4, 'explicit --concurrency cannot bypass the desktop-safe cap', { target_active_slots: parsed.target_active_slots });
+// 7) A small request is never inflated; live pressure may still reduce it.
 const small = spawnSync(process.execPath, [cli, 'naruto', 'run', 'tiny', '--clones', '2', '--backend', 'fake', '--work-items', '2', '--json', '--no-open-zellij'], { cwd: root, env: childEnv, encoding: 'utf8', timeout: 600000, maxBuffer: 4 * 1024 * 1024 });
 const smallParsed = parseJson(small.stdout);
-assertGate(small.status === 0 && smallParsed?.target_active_slots === 2, 'a 2-clone run must run 2 concurrently (no over-throttle)', { status: small.status, target_active_slots: smallParsed?.target_active_slots });
+assertGate(small.status === 0 && smallParsed?.target_active_slots >= 1 && smallParsed?.target_active_slots <= 2, 'a 2-clone run must stay within [1, 2] active workers', { status: small.status, target_active_slots: smallParsed?.target_active_slots });
 // 8) Naruto clones always run fast. Per-route --no-fast / standard-tier requests
 //    are intentionally not honored for shadow clones.
 const standardOptOut = spawnSync(process.execPath, [cli, 'naruto', 'run', 'fast opt-out ignored', '--clones', '2', '--backend', 'fake', '--work-items', '2', '--no-fast', '--service-tier', 'standard', '--json', '--no-open-zellij'], { cwd: root, env: childEnv, encoding: 'utf8', timeout: 600000, maxBuffer: 4 * 1024 * 1024 });

package/dist/scripts/npm-publish-performance-check.js

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
-const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2300 * 1024);
+const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2410 * 1024);
 const BUDGET_MS = Number(process.env.SKS_PACK_BUDGET_MS || 30000);
 function runNpmPack() {
     const npmCli = process.env.npm_execpath; // set when invoked via `npm run`

package/dist/scripts/release-aggressive-resource-governor-check.js

@@ -4,8 +4,8 @@ process.env.SKS_RELEASE_MAX_CPU_LIGHT = '7';
 process.env.SKS_RELEASE_MAX_TOTAL = '2';
 const governor = await importDist('core/release/release-gate-resource-governor.js');
 const budget = governor.defaultReleaseGateBudget();
-assertGate(budget['cpu-light'] === 7, 'resource governor must honor SKS_RELEASE_MAX_CPU_LIGHT', budget);
-assertGate(governor.defaultReleaseGateMaxTotal() >= 8 && governor.defaultReleaseGateMaxTotal() <= 32, 'resource governor default total cap must be bounded by host capacity', { max_total: governor.defaultReleaseGateMaxTotal() });
+assertGate(budget['cpu-light'] >= 1 && budget['cpu-light'] <= 4, 'resource governor env requests must not raise the desktop-safe cpu-light cap', budget);
+assertGate(governor.defaultReleaseGateMaxTotal() >= 1 && governor.defaultReleaseGateMaxTotal() <= 4, 'resource governor default total cap must stay desktop-safe', { max_total: governor.defaultReleaseGateMaxTotal() });
 const gate = (id) => ({ id, resource: ['cpu-light'], deps: [], command: 'true', side_effect: 'hermetic', timeout_ms: 1000, cache: { enabled: false, inputs: [] }, isolation: { report_dir: 'per-gate' }, preset: ['release'] });
 const fsGate = (id) => ({ ...gate(id), resource: ['fs-read'] });
 const timingGate = (id) => ({ ...gate(id), resource: ['timing-sensitive'] });

package/dist/scripts/release-parallel-check.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { buildVerificationDag } from '../core/verification/verification-dag.js';
@@ -298,7 +297,7 @@ tasks.push(task('release:metadata', 'npm run release:metadata --silent', { depen
 const dag = buildVerificationDag(tasks);
 const result = await runVerificationDag(dag, {
     cwd: root,
-    concurrency: Number(process.env.SKS_VERIFY_CONCURRENCY || os.cpus().length || 2),
+    concurrency: Math.min(4, Number(process.env.SKS_VERIFY_CONCURRENCY || 2)),
     logDir,
     failFast: false
 });

package/dist/scripts/release-real-check.js

@@ -6,7 +6,7 @@ import { writeJsonAtomic } from '../core/fsx.js';
 const args = process.argv.slice(2);
 const skipReleaseCheck = args.includes('--skip-release-check') || process.env.SKS_RELEASE_REAL_CHECK_SKIP_RELEASE_CHECK === '1';
 const root = process.cwd();
-const concurrency = Math.max(1, Math.floor(Number(process.env.SKS_RELEASE_REAL_CHECK_CONCURRENCY || 4)));
+const concurrency = Math.max(1, Math.min(4, Math.floor(Number(process.env.SKS_RELEASE_REAL_CHECK_CONCURRENCY || 2))));
 const report = {
     schema: 'sks.release-real-check.v1',
     generated_at: new Date().toISOString(),

package/dist/scripts/sizecheck.js

@@ -7,9 +7,9 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const limits = {
-    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 1536 * 1024),
-    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 6400 * 1024),
-    packFiles: Number(process.env.SKS_MAX_PACK_FILES || 1200),
+    packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || 2410 * 1024),
+    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 1024),
+    packFiles: Number(process.env.SKS_MAX_PACK_FILES || 2100),
     trackedFileBytes: Number(process.env.SKS_MAX_TRACKED_FILE_BYTES || 384 * 1024)
 };
 const trackedFileSizeAllowlist = new Set([

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "Proof-first Codex trust layer for bounded agent workflows, search visibility evidence, and release integrity gates.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -139,7 +139,8 @@
     "release:check:full": "npm run build:clean --silent && node ./dist/bin/sks.js doctor --fix --yes --json >/tmp/sks-release-check-full-doctor.json && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-gate-dag-runner.js --preset bench --full && node ./dist/scripts/release-check-stamp.js write",
     "publish:packlist-performance": "node ./dist/scripts/packlist-performance-check.js",
     "publish:dry": "npm run publish:prep-ignore-scripts && npm publish --dry-run --ignore-scripts --json",
-    "publish:prep-ignore-scripts": "npm run build:incremental --silent && npm run release:version-truth --silent && npm run publish:packlist-performance --silent && node ./dist/scripts/package-published-contract-check.js && node ./dist/scripts/release-registry-check.js --require-unpublished --require-publish-auth && npm run publish-tag:check --silent",
+    "publish:verify-ignore-scripts": "npm run build:clean --silent && npm run typecheck --silent && npm test --silent && npm run release:version-truth --silent && npm run release:dist-freshness --silent && npm run publish:packlist-performance --silent && node ./dist/scripts/package-published-contract-check.js && npm run publish-tag:check --silent && npm pack --dry-run --ignore-scripts --json",
+    "publish:prep-ignore-scripts": "npm run publish:verify-ignore-scripts --silent && node ./dist/scripts/release-registry-check.js --require-unpublished --require-publish-auth",
     "publish:ignore-scripts": "npm run publish:prep-ignore-scripts && npm publish --ignore-scripts",
     "gates:run": "node ./dist/scripts/release-gate-dag-runner.js",
     "policy:gate-audit": "node ./dist/scripts/gate-policy-audit-check.js",