sneakoscope 6.0.3 → 6.1.2

package/dist/core/doctor/legacy-global-hook-cleanup.js

@@ -0,0 +1,179 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { ensureDir, nowIso, readText, writeJsonAtomic } from '../fsx.js';
+export const LEGACY_GLOBAL_HOOK_CLEANUP_SCHEMA = 'sks.legacy-global-hook-cleanup.v1';
+export async function cleanupLegacyGlobalSksHooks(input) {
+    const root = path.resolve(input.root);
+    const home = input.home || os.homedir();
+    const globalPath = path.join(home, '.codex', 'hooks.json');
+    const projectPath = path.join(root, '.codex', 'hooks.json');
+    const globalParsed = await readHooks(globalPath);
+    const projectParsed = await readHooks(projectPath);
+    const warnings = [];
+    const blockers = [];
+    if (globalParsed.error)
+        blockers.push(`global_hooks_json_invalid:${globalParsed.error}`);
+    if (projectParsed.error)
+        warnings.push(`project_hooks_json_invalid:${projectParsed.error}`);
+    const projectRefs = projectParsed.value ? collectProjectSksHookRefs(projectParsed.value) : new Set();
+    const pruned = globalParsed.value
+        ? pruneDuplicatedGlobalHooks(globalParsed.value, projectRefs)
+        : { value: globalParsed.value, removed: [] };
+    if (pruned.removed.length && projectRefs.size === 0)
+        blockers.push('project_sks_hooks_missing_no_safe_global_cleanup');
+    let backupPath = null;
+    let rollbackPerformed = false;
+    let applied = false;
+    if (input.apply === true && pruned.removed.length && blockers.length === 0) {
+        backupPath = `${globalPath}.sks-legacy-global-${Date.now().toString(36)}.bak`;
+        try {
+            await ensureDir(path.dirname(globalPath));
+            await fs.copyFile(globalPath, backupPath);
+            await writeJsonAtomic(globalPath, pruned.value);
+            const postcheck = await readHooks(globalPath);
+            const remaining = postcheck.value ? pruneDuplicatedGlobalHooks(postcheck.value, projectRefs).removed : [];
+            if (postcheck.error || remaining.length)
+                throw new Error(postcheck.error || `duplicate_hooks_remain:${remaining.join(',')}`);
+            applied = true;
+            await pruneOldBackups(globalPath, backupPath);
+        }
+        catch (err) {
+            blockers.push(`legacy_global_hook_cleanup_failed:${messageOf(err)}`);
+            if (backupPath) {
+                try {
+                    await fs.copyFile(backupPath, globalPath);
+                    rollbackPerformed = true;
+                }
+                catch (rollbackErr) {
+                    blockers.push(`legacy_global_hook_cleanup_rollback_failed:${messageOf(rollbackErr)}`);
+                }
+            }
+        }
+    }
+    let report = {
+        schema: LEGACY_GLOBAL_HOOK_CLEANUP_SCHEMA,
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        root,
+        apply: input.apply === true,
+        global_hooks_path: globalPath,
+        project_hooks_path: projectPath,
+        project_sks_hook_count: projectRefs.size,
+        duplicate_global_hooks: pruned.removed,
+        removed_count: applied ? pruned.removed.length : 0,
+        applied,
+        backup_path: backupPath,
+        rollback_performed: rollbackPerformed,
+        non_sks_hooks_preserved: true,
+        requires_new_task: applied,
+        restart_app_if_stale: applied,
+        next_actions: applied ? [
+            'Start a new Codex/Work task so only the project-local SKS hooks are loaded.',
+            'If duplicate hook output persists, restart the ChatGPT/Codex desktop app and retry in a new task.'
+        ] : [],
+        blockers,
+        warnings
+    };
+    if (input.reportPath !== null) {
+        const reportPath = input.reportPath || path.join(root, '.sneakoscope', 'reports', 'legacy-global-hook-cleanup.json');
+        await writeJsonAtomic(reportPath, report).catch((err) => {
+            report = { ...report, report_write_failed: true, warnings: [...warnings, `report_write_failed:${messageOf(err)}`] };
+        });
+        report.report_path = reportPath;
+    }
+    return report;
+}
+function collectProjectSksHookRefs(value) {
+    const refs = new Set();
+    forEachHook(value, (event, matcher, hook) => {
+        const command = projectSksHookCommand(hook?.command);
+        if (command && hook?.type === 'command')
+            refs.add(hookRef(event, matcher, command));
+    });
+    return refs;
+}
+function pruneDuplicatedGlobalHooks(value, projectRefs) {
+    const next = structuredClone(value);
+    const container = hookContainer(next);
+    const removed = [];
+    for (const [event, groups] of Object.entries(container)) {
+        if (!Array.isArray(groups))
+            continue;
+        const keptGroups = groups.flatMap((group) => {
+            if (!group || !Array.isArray(group.hooks))
+                return [group];
+            const hooks = group.hooks.filter((hook) => {
+                const command = legacyGlobalSksHookCommand(hook?.command);
+                const ref = hookRef(event, group?.matcher, command || '');
+                if (hook?.type !== 'command' || !command || !projectRefs.has(ref))
+                    return true;
+                removed.push(ref);
+                return false;
+            });
+            return hooks.length ? [{ ...group, hooks }] : [];
+        });
+        if (keptGroups.length)
+            container[event] = keptGroups;
+        else
+            delete container[event];
+    }
+    return { value: next, removed };
+}
+function forEachHook(value, visit) {
+    for (const [event, groups] of Object.entries(hookContainer(value))) {
+        if (!Array.isArray(groups))
+            continue;
+        for (const group of groups) {
+            for (const hook of Array.isArray(group?.hooks) ? group.hooks : [])
+                visit(event, group?.matcher, hook);
+        }
+    }
+}
+function hookContainer(value) {
+    return value?.hooks && typeof value.hooks === 'object' && !Array.isArray(value.hooks) ? value.hooks : value;
+}
+function legacyGlobalSksHookCommand(value) {
+    const command = String(value || '').trim();
+    if (/[;&|`$<>\r\n]/.test(command))
+        return null;
+    return command.match(/^(?:\S*\/)?sks\s+hook\s+([a-z0-9-]+)$/i)?.[1] || null;
+}
+function projectSksHookCommand(value) {
+    const command = String(value || '').trim();
+    if (/[;&|`$<>\r\n]/.test(command))
+        return null;
+    return command.match(/^node\s+\.\/dist\/bin\/sks\.js\s+hook\s+([a-z0-9-]+)$/i)?.[1] || null;
+}
+function hookRef(event, matcher, command) {
+    return `${event}:${String(matcher ?? '')}:${command}`;
+}
+async function readHooks(file) {
+    const text = await readText(file, '');
+    if (!text.trim())
+        return { value: null, error: null };
+    try {
+        const value = JSON.parse(text);
+        return value && typeof value === 'object' ? { value, error: null } : { value: null, error: 'root_not_object' };
+    }
+    catch (err) {
+        return { value: null, error: messageOf(err) };
+    }
+}
+async function pruneOldBackups(globalPath, keepPath) {
+    const dir = path.dirname(globalPath);
+    const prefix = `${path.basename(globalPath)}.sks-legacy-global-`;
+    const directoryEntries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = directoryEntries
+        .filter((entry) => entry.isFile() && entry.name.startsWith(prefix) && entry.name.endsWith('.bak'))
+        .map((entry) => path.join(dir, entry.name));
+    const ranked = await Promise.all(entries.map(async (file) => ({ file, mtime: (await fs.stat(file)).mtimeMs })));
+    ranked.sort((a, b) => b.mtime - a.mtime);
+    for (const row of ranked.slice(3))
+        if (row.file !== keepPath)
+            await fs.rm(row.file, { force: true }).catch(() => undefined);
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=legacy-global-hook-cleanup.js.map

package/dist/core/feature-fixture-executor.js

@@ -59,7 +59,8 @@ export async function runFeatureFixture(feature, { root = process.cwd() } = {})
         };
     }
     const tokens = tokenizeCommand(fixture.command);
-    const spawnEnv = { ...process.env, CI: 'true', SKS_SKIP_NPM_FRESHNESS_CHECK: '1', SKS_ENSURE_DIST_NO_REBUILD: '1' };
+    const fixtureEnv = fixture.codex_app_session === true ? { SKS_NARUTO_APP_SESSION: '1' } : {};
+    const spawnEnv = { ...process.env, ...fixtureEnv, CI: 'true', SKS_SKIP_NPM_FRESHNESS_CHECK: '1', SKS_ENSURE_DIST_NO_REBUILD: '1' };
     const isSksCommand = tokens[0] === 'sks';
     const [spawnCommand, spawnArgs] = isSksCommand
         ? [process.execPath, [resolveSksEntrypoint(root), ...tokens.slice(1)]]
@@ -85,13 +86,16 @@ export async function runFeatureFixture(feature, { root = process.cwd() } = {})
     const missionIdFromOutput = extractMissionId(spawnResult.stdout);
     const latestMissionId = missionIdFromOutput
         ?? (kind === 'execute_and_validate_artifacts' ? await findLatestMission(root).catch(() => null) : null);
+    const stdoutJson = parseJsonOutput(spawnResult.stdout);
+    const stdoutFieldFailures = expectedFieldFailures('stdout', stdoutJson, fixture.expected_stdout_fields);
     const artifacts = kind === 'execute_and_validate_artifacts'
-        ? expected.map((artifact) => inspectArtifact(root, artifact, latestMissionId))
+        ? expected.map((artifact) => inspectArtifact(root, artifact, latestMissionId, fixture.expected_artifact_fields?.[artifact.path]))
         : [];
     const artifactFailures = artifacts.filter((artifact) => !artifact.ok).map((artifact) => `${id}:${artifact.path}:${artifact.failure || 'artifact_invalid'}`);
     const blockers = [];
     if (!exitOk)
         blockers.push(timedOut ? `${id}:command_timeout_${timeoutMs}` : `${id}:command_exit_${spawnResult.status}`);
+    blockers.push(...stdoutFieldFailures.map((failure) => `${id}:${failure}`));
     blockers.push(...artifactFailures);
     const ok = blockers.length === 0;
     const actualStatus = ok ? 'pass' : 'blocked';
@@ -125,6 +129,13 @@ export async function runFeatureFixture(feature, { root = process.cwd() } = {})
         stdout_bytes: Buffer.byteLength(spawnResult.stdout || ''),
         stderr_bytes: Buffer.byteLength(spawnResult.stderr || ''),
         stderr_tail: String(spawnResult.stderr || '').slice(-800),
+        completion_semantics: fixture.completion_semantics || null,
+        stdout_contract: {
+            expected_fields: fixture.expected_stdout_fields || null,
+            parsed: Boolean(stdoutJson),
+            ok: stdoutFieldFailures.length === 0,
+            failures: stdoutFieldFailures
+        },
         artifacts,
         blockers,
         resolved_mission_id: latestMissionId
@@ -171,13 +182,24 @@ function extractMissionId(stdout) {
     }
     return null;
 }
-function inspectArtifact(root, artifact, latestMissionId) {
+function inspectArtifact(root, artifact, latestMissionId, expectedFields = undefined) {
     const file = resolveExpectedArtifactPath(root, artifact.path, { latestMissionId });
     const exists = fs.existsSync(file);
     const relPath = path.isAbsolute(artifact.path) ? artifact.path : artifact.path;
     if (!exists) {
         return { path: relPath, schema: artifact.schema, exists: false, ok: Boolean(artifact.optional), failure: artifact.optional ? undefined : 'missing' };
     }
+    if (file.endsWith('.jsonl')) {
+        const lines = fs.readFileSync(file, 'utf8').split('\n').map((line) => line.trim()).filter(Boolean);
+        try {
+            for (const line of lines)
+                JSON.parse(line);
+            return { path: relPath, schema: artifact.schema, exists: true, ok: true, record_count: lines.length };
+        }
+        catch {
+            return { path: relPath, schema: artifact.schema, exists: true, ok: false, failure: 'jsonl_parse' };
+        }
+    }
     if (!file.endsWith('.json')) {
         const content = fs.readFileSync(file, 'utf8');
         return { path: relPath, schema: artifact.schema, exists: true, ok: content.trim().length > 0, failure: content.trim().length ? undefined : 'empty' };
@@ -189,10 +211,52 @@ function inspectArtifact(root, artifact, latestMissionId) {
     catch {
         return { path: relPath, schema: artifact.schema, exists: true, ok: false, failure: 'json_parse' };
     }
-    if (!artifact.schema)
-        return { path: relPath, schema: null, exists: true, ok: true };
-    const schemaOk = parsed.schema === artifact.schema || parsed.schema_version != null;
-    return { path: relPath, schema: artifact.schema, exists: true, ok: schemaOk, failure: schemaOk ? undefined : 'schema_mismatch', actual_schema: parsed.schema || null };
+    const fieldFailures = expectedFieldFailures(`artifact:${artifact.path}`, parsed, expectedFields);
+    const schemaOk = !artifact.schema || parsed.schema === artifact.schema || parsed.schema_version != null;
+    const ok = schemaOk && fieldFailures.length === 0;
+    return {
+        path: relPath,
+        schema: artifact.schema,
+        exists: true,
+        ok,
+        failure: !schemaOk ? 'schema_mismatch' : fieldFailures[0],
+        actual_schema: parsed.schema || null,
+        expected_fields: expectedFields || null,
+        field_failures: fieldFailures
+    };
+}
+function parseJsonOutput(stdout) {
+    const text = String(stdout || '').trim();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch { }
+    const candidates = [];
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        try {
+            candidates.push(JSON.parse(trimmed));
+        }
+        catch { }
+    }
+    return candidates.at(-1) || null;
+}
+function expectedFieldFailures(scope, actual, expected) {
+    if (!expected || typeof expected !== 'object' || Array.isArray(expected))
+        return [];
+    if (!actual || typeof actual !== 'object' || Array.isArray(actual))
+        return [`${scope}:json_missing`];
+    const failures = [];
+    for (const [field, expectedValue] of Object.entries(expected)) {
+        const actualValue = field.split('.').reduce((value, key) => value && typeof value === 'object' ? value[key] : undefined, actual);
+        if (JSON.stringify(actualValue) !== JSON.stringify(expectedValue))
+            failures.push(`${scope}:field_mismatch:${field}`);
+    }
+    return failures;
 }
 function normalizeExpectedArtifacts(items = []) {
     return (items || []).map((artifact) => {

package/dist/core/feature-fixture-runner.js

@@ -13,7 +13,10 @@ export function runFeatureFixture(feature, { root = process.cwd(), tempRoot = fs
     const latestAfter = execution?.mission_id || latestMissionId(projectRoot) || latestBefore;
     const shouldValidateArtifacts = validateArtifacts && (fixture.kind === 'execute_and_validate_artifacts' || execution);
     const artifacts = shouldValidateArtifacts
-        ? expected.map((artifact) => inspectExpectedArtifact(projectRoot, tempRoot, artifact, { latestMissionId: latestAfter }))
+        ? expected.map((artifact) => inspectExpectedArtifact(projectRoot, tempRoot, artifact, {
+            latestMissionId: latestAfter,
+            expectedFields: fixture.expected_artifact_fields?.[artifact.path]
+        }))
         : expected.map((artifact) => ({ path: artifact.path, requested_path: artifact.path, schema: artifact.schema || inferSchema(artifact.path), exists: null, schema_ok: null, content_ok: null, skipped: 'static_contract' }));
     const artifactFailures = shouldValidateArtifacts
         ? artifacts.filter((artifact) => !artifact.exists || !artifact.schema_ok || !artifact.content_ok).map((artifact) => `${feature.id}:${artifact.path}:${artifact.failure || 'artifact_invalid'}`)
@@ -58,28 +61,38 @@ function executeCommand(sourceRoot, projectRoot, spec, fixture = {}) {
         ...(fixture.root_mode === 'source_checkout_required' ? [] : [['setup', '--local-only', '--json']]),
         ...(normalized.setup || [])
     ];
-    const setupResults = setup.map((args) => spawnSks(sourceRoot, projectRoot, args));
+    const fixtureEnv = fixture.codex_app_session === true ? { SKS_NARUTO_APP_SESSION: '1' } : {};
+    const setupResults = setup.map((args) => spawnSks(sourceRoot, projectRoot, args, fixtureEnv));
     const command = normalized.command || normalized.args || [];
-    const result = command.length ? spawnSks(sourceRoot, projectRoot, command) : { status: 0, signal: null, ok: true, stdout_bytes: 0, stderr_bytes: 0, args: [] };
+    const result = command.length ? spawnSks(sourceRoot, projectRoot, command, fixtureEnv) : { status: 0, signal: null, ok: true, stdout_bytes: 0, stderr_bytes: 0, args: [] };
     const missionId = result.mission_id || [...setupResults].reverse().find((row) => row.mission_id)?.mission_id || null;
+    const expectationFailures = expectedFieldFailures('stdout', result.stdout_json, fixture.expected_stdout_fields);
     return {
         args: command,
         setup: setupResults,
         mission_id: missionId,
         status: result.status,
         signal: result.signal || null,
-        ok: setupResults.every((row) => row.ok) && result.ok,
+        ok: setupResults.every((row) => row.ok) && result.ok && expectationFailures.length === 0,
         stdout_bytes: result.stdout_bytes,
-        stderr_bytes: result.stderr_bytes
+        stderr_bytes: result.stderr_bytes,
+        completion_semantics: fixture.completion_semantics || null,
+        stdout_contract: {
+            expected_fields: fixture.expected_stdout_fields || null,
+            parsed: Boolean(result.stdout_json),
+            ok: expectationFailures.length === 0,
+            failures: expectationFailures
+        },
+        expectation_failures: expectationFailures
     };
 }
-function spawnSks(sourceRoot, projectRoot, args = []) {
+function spawnSks(sourceRoot, projectRoot, args = [], fixtureEnv = {}) {
     const entrypoint = resolveSksEntrypoint(sourceRoot);
     const result = spawnSync(process.execPath, [entrypoint, ...args], {
         cwd: projectRoot,
         encoding: 'utf8',
         timeout: FEATURE_FIXTURE_COMMAND_TIMEOUT_MS,
-        env: { ...process.env, CI: 'true', SKS_SKIP_NPM_FRESHNESS_CHECK: '1' }
+        env: { ...process.env, ...fixtureEnv, CI: 'true', SKS_SKIP_NPM_FRESHNESS_CHECK: '1' }
     });
     const parsed = parseJsonOutput(result.stdout || '');
     const timedOut = result.error?.code === 'ETIMEDOUT';
@@ -92,6 +105,7 @@ function spawnSks(sourceRoot, projectRoot, args = []) {
         timeout_ms: FEATURE_FIXTURE_COMMAND_TIMEOUT_MS,
         error_code: result.error?.code || null,
         mission_id: parsed?.mission_id || parsed?.id || parsed?.proof?.mission_id || parsed?.completion_proof?.mission_id || null,
+        stdout_json: parsed,
         stdout_bytes: Buffer.byteLength(result.stdout || ''),
         stderr_bytes: Buffer.byteLength(result.stderr || ''),
         stderr_tail: String(result.stderr || '').slice(-600)
@@ -100,6 +114,8 @@ function spawnSks(sourceRoot, projectRoot, args = []) {
 function fixtureExecutionFailure(featureId, execution) {
     if (execution?.timed_out)
         return `${featureId}:command_timeout_${execution.timeout_ms || 'unknown'}`;
+    if (execution?.expectation_failures?.length)
+        return `${featureId}:${execution.expectation_failures[0]}`;
     return `${featureId}:command_exit_${execution?.status}`;
 }
 function resolveSksEntrypoint(sourceRoot) {
@@ -173,6 +189,17 @@ function inspectExpectedArtifact(root, tempRoot, artifact, ctx = {}) {
         return { ...result, failure: 'missing' };
     if (file.endsWith('.md'))
         return { ...result, schema_ok: true, content_ok: fs.readFileSync(file, 'utf8').trim().length > 0 };
+    if (file.endsWith('.jsonl')) {
+        const lines = fs.readFileSync(file, 'utf8').split('\n').map((line) => line.trim()).filter(Boolean);
+        try {
+            for (const line of lines)
+                JSON.parse(line);
+            return { ...result, schema_ok: true, content_ok: true, record_count: lines.length };
+        }
+        catch {
+            return { ...result, failure: 'jsonl_parse' };
+        }
+    }
     let parsed;
     try {
         parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -180,20 +207,34 @@ function inspectExpectedArtifact(root, tempRoot, artifact, ctx = {}) {
     catch {
         return { ...result, failure: 'json_parse' };
     }
+    const fieldFailures = expectedFieldFailures(`artifact:${artifact.path}`, parsed, ctx.expectedFields);
     if (schema === 'sks.completion-proof.v1')
-        return { ...result, schema_ok: parsed.schema === schema, content_ok: ['verified', 'verified_partial', 'mock_only', 'blocked'].includes(parsed.status), status: parsed.status };
+        return { ...result, schema_ok: parsed.schema === schema, content_ok: ['verified', 'verified_partial', 'mock_only', 'blocked'].includes(parsed.status) && fieldFailures.length === 0, status: parsed.status, field_failures: fieldFailures };
     if (schema === 'sks.image-voxel-ledger.v1') {
         const anchorCount = Array.isArray(parsed.anchors) ? parsed.anchors.length : 0;
         const relationCount = Array.isArray(parsed.relations) ? parsed.relations.length : 0;
         const requireAnchors = artifact.require_anchors !== false;
         const requireRelations = artifact.require_relations === true;
-        return { ...result, schema_ok: parsed.schema === schema, content_ok: (!requireAnchors || anchorCount >= 1) && (!requireRelations || relationCount >= 1), anchor_count: anchorCount, relation_count: relationCount };
+        return { ...result, schema_ok: parsed.schema === schema, content_ok: (!requireAnchors || anchorCount >= 1) && (!requireRelations || relationCount >= 1) && fieldFailures.length === 0, anchor_count: anchorCount, relation_count: relationCount, field_failures: fieldFailures };
     }
     if (schema === 'sks.visual-anchors.v1')
-        return { ...result, schema_ok: parsed.schema === schema, content_ok: Array.isArray(parsed.anchors) && (artifact.require_anchors === false || parsed.anchors.length >= 1), anchor_count: parsed.anchors?.length || 0 };
+        return { ...result, schema_ok: parsed.schema === schema, content_ok: Array.isArray(parsed.anchors) && (artifact.require_anchors === false || parsed.anchors.length >= 1) && fieldFailures.length === 0, anchor_count: parsed.anchors?.length || 0, field_failures: fieldFailures };
     if (schema === 'sks.fixture-artifact.v1')
-        return { ...result, schema_ok: Boolean(parsed.schema || parsed.schema_version || Object.hasOwn(parsed, 'passed') || Object.hasOwn(parsed, 'ok')), content_ok: true };
-    return { ...result, schema_ok: schema ? parsed.schema === schema || parsed.schema_version != null : true, content_ok: true };
+        return { ...result, schema_ok: Boolean(parsed.schema || parsed.schema_version || Object.hasOwn(parsed, 'passed') || Object.hasOwn(parsed, 'ok')), content_ok: fieldFailures.length === 0, field_failures: fieldFailures };
+    return { ...result, schema_ok: schema ? parsed.schema === schema || parsed.schema_version != null : true, content_ok: fieldFailures.length === 0, field_failures: fieldFailures };
+}
+function expectedFieldFailures(scope, actual, expected) {
+    if (!expected || typeof expected !== 'object' || Array.isArray(expected))
+        return [];
+    if (!actual || typeof actual !== 'object' || Array.isArray(actual))
+        return [`${scope}:json_missing`];
+    const failures = [];
+    for (const [field, expectedValue] of Object.entries(expected)) {
+        const actualValue = field.split('.').reduce((value, key) => value && typeof value === 'object' ? value[key] : undefined, actual);
+        if (JSON.stringify(actualValue) !== JSON.stringify(expectedValue))
+            failures.push(`${scope}:field_mismatch:${field}`);
+    }
+    return failures;
 }
 function normalizeExpectedArtifacts(items = []) {
     return (items || []).map((artifact) => {

package/dist/core/feature-fixtures.js

@@ -84,7 +84,6 @@ const FIXTURES = Object.freeze({
     'cli-with-local-llm': fixture('execute', 'sks with-local-llm status --json', [], 'pass'),
     'cli-dfix': fixture('execute_and_validate_artifacts', 'sks dfix fixture --json', ['completion-proof.json', 'dfix-gate.json', 'dfix-verification.json'], 'pass'),
     'cli-wiki': fixture('execute_and_validate_artifacts', 'sks wiki image-ingest test/fixtures/images/one-by-one.png --json', [{ path: '.sneakoscope/wiki/image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1', require_anchors: false }], 'pass'),
-    'cli-db': fixture('execute', 'sks db policy', [], 'pass'),
     'cli-wizard': fixture('execute', 'sks wizard', [], 'pass'),
     'cli-bootstrap': fixture('execute', 'sks bootstrap --dry-run', [], 'pass'),
     'cli-deps': fixture('execute', 'sks deps check --json', [], 'pass'),
@@ -116,11 +115,11 @@ const FIXTURES = Object.freeze({
     'cli-init': fixture('execute', 'sks init --local-only --dry-run', [], 'pass'),
     'cli-eval': fixture('execute', 'sks eval run --mock --json', [], 'pass'),
     'cli-harness': fixture('execute', 'sks harness fixture --mock --json', [], 'pass'),
-    'cli-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['completion-proof.json', 'naruto-gate.json'], 'pass'),
-    'cli-team': fixture('execute_and_validate_artifacts', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json'], 'pass', { timeout_ms: 90000 }),
+    'cli-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --agents 4 --max-threads 4 --json', ['subagent-plan.json', 'subagent-events.jsonl', 'subagent-evidence.json', 'naruto-summary.json', 'naruto-gate.json', 'work-order-ledger.json'], 'pass', preparationFixtureContract()),
+    'cli-team': fixture('execute_and_validate_artifacts', 'sks team "fixture" --agents 4 --max-threads 4 --json', ['subagent-plan.json', 'subagent-events.jsonl', 'subagent-evidence.json', 'naruto-summary.json', 'naruto-gate.json', 'team-alias-to-naruto.json', 'work-order-ledger.json'], 'pass', preparationFixtureContract({ timeout_ms: 90000 })),
     'cli-reasoning': fixture('execute', 'sks reasoning status --json', [], 'pass'),
     'cli-profile': fixture('execute', 'sks profile status --json', [], 'pass'),
-    'skill-db-safety-guard': fixture('execute_and_validate_artifacts', 'sks db check --sql "SELECT 1" --json', ['db-operation-report.json', 'completion-proof.json'], 'pass'),
+    'skill-db-safety-guard': fixture('execute', 'node --test test/unit/db-safety.test.mjs', [], 'pass', { root_mode: 'source_checkout_required' }),
     'skill-honest-mode': fixture('execute_and_validate_artifacts', 'sks proof smoke --json', ['completion-proof.json', 'trust-report.json'], 'pass'),
     'skill-imagegen': fixture('execute_and_validate_artifacts', 'sks image-ux-review fixture --mock --json', ['image-ux-generated-review-ledger.json', 'image-voxel-ledger.json'], 'pass'),
     'ux-review:run-wires-imagegen': fixture('execute_and_validate_artifacts', 'npm run ux-review:run-wires-imagegen --silent', [{ path: 'image-ux-review-gate.json', schema: 'sks.image-ux-review-gate.v2', optional: true }], 'pass', {
@@ -135,18 +134,18 @@ const FIXTURES = Object.freeze({
     'cli-proof': fixture('execute_and_validate_artifacts', 'sks proof smoke --json', ['.sneakoscope/proof/latest.json'], 'pass'),
     'cli-trust': fixture('execute_and_validate_artifacts', 'sks trust report latest --json', ['trust-report.json'], 'pass'),
     'cli-wrongness': fixture('execute_and_validate_artifacts', 'sks wrongness add --kind missing_evidence --claim "fixture wrongness" --json', ['.sneakoscope/wiki/wrongness-ledger.json'], 'pass'),
-    'route-team': fixture('execute_and_validate_artifacts', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json', 'work-order-ledger.json'], 'pass', { timeout_ms: 90000 }),
-    'route-team-alias': fixture('execute_and_validate_artifacts', 'sks team "fixture" --mock --clones 4 --backend fake --work-items 4 --json', ['naruto-gate.json', 'team-alias-to-naruto.json'], 'pass'),
-    'route-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --clones 4 --backend fake --work-items 4 --json', ['agents/agent-proof-evidence.json', 'agents/agent-scheduler-state.json', 'work-order-ledger.json'], 'pass', { timeout_ms: 90000 }),
-    'route-work': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['naruto-gate.json', 'work-order-ledger.json'], 'pass', { timeout_ms: 285000, reason: 'naruto-command.ts never invokes the route-finalizer/completion-proof pipeline; naruto-gate.json is the real artifact it writes.' }),
-    'route-swarm': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['naruto-gate.json', 'work-order-ledger.json'], 'pass', { timeout_ms: 285000, reason: 'Same as route-work: naruto-command.ts never invokes the completion-proof pipeline.' }),
+    'route-team': fixture('execute_and_validate_artifacts', 'sks team "fixture" --agents 4 --max-threads 4 --json', ['subagent-plan.json', 'subagent-events.jsonl', 'subagent-evidence.json', 'naruto-summary.json', 'naruto-gate.json', 'team-alias-to-naruto.json', 'work-order-ledger.json'], 'pass', preparationFixtureContract({ timeout_ms: 90000 })),
+    'route-team-alias': fixture('execute_and_validate_artifacts', 'sks team "fixture" --agents 4 --max-threads 4 --json', ['subagent-plan.json', 'subagent-events.jsonl', 'subagent-evidence.json', 'naruto-summary.json', 'naruto-gate.json', 'team-alias-to-naruto.json'], 'pass', preparationFixtureContract()),
+    'route-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --agents 4 --max-threads 4 --json', ['subagent-plan.json', 'subagent-events.jsonl', 'subagent-evidence.json', 'naruto-summary.json', 'naruto-gate.json', 'work-order-ledger.json'], 'pass', preparationFixtureContract({ timeout_ms: 90000 })),
+    'route-work': fixture('static', '$Work compatibility alias for the Naruto Codex official subagent workflow', [], 'pass', { quality: 'wiring_only', reason: 'Pure alias of $Naruto; official workflow execution is covered by route-naruto.' }),
+    'route-swarm': fixture('static', '$Swarm compatibility alias for the Naruto Codex official subagent workflow', [], 'pass', { quality: 'wiring_only', reason: 'Pure alias of $Naruto; official workflow execution is covered by route-naruto.' }),
     'route-plan': fixture('execute', 'sks plan "fixture" --json', [], 'pass'),
     'route-review': fixture('execute', 'sks review --diff HEAD --json', [], 'pass'),
-    'route-shadowclone': fixture('static', '$ShadowClone alias of $Naruto shadow-clone swarm route', [], 'pass', {
+    'route-shadowclone': fixture('static', '$ShadowClone compatibility alias for the Naruto Codex official subagent workflow', [], 'pass', {
         quality: 'wiring_only',
         reason: 'Pure alias of $Naruto; no independent behavior to verify beyond route-naruto\'s own execute_and_validate_artifacts fixture.'
     }),
-    'route-kagebunshin': fixture('static', '$Kagebunshin alias of $Naruto shadow-clone swarm route', [], 'pass', {
+    'route-kagebunshin': fixture('static', '$Kagebunshin compatibility alias for the Naruto Codex official subagent workflow', [], 'pass', {
         quality: 'wiring_only',
         reason: 'Pure alias of $Naruto; no independent behavior to verify beyond route-naruto\'s own execute_and_validate_artifacts fixture.'
     }),
@@ -178,7 +177,7 @@ const FIXTURES = Object.freeze({
         reason: 'hasFromChatImgSignal() routes $From-Chat-IMG to the full Naruto multi-agent work-order pipeline (routes.ts routeById(\'Naruto\')), which requires real chat-screenshot attachments to produce from-chat-img-work-order.md; there is no lightweight deterministic `--mock` single-command invocation that produces this route\'s specific work-order/coverage artifacts the way route-naruto\'s generic fixture prompt does. Left as documented mock.'
     }),
     'route-ux-review': fixture('mock', 'sks image-ux-review fixture --mock --json', ['completion-proof.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'image-ux-generated-review-ledger.json'], 'pass', { reason: 'Alias of route-image-ux-review ($UX-Review -> $Image-UX-Review); shares the identical underlying command and the same intentional exit-1/ok:false mock-fixture hardening in imageUxFixture().' }),
-    'route-db': fixture('execute_and_validate_artifacts', 'sks db check --sql "SELECT 1" --json', ['completion-proof.json', 'db-operation-report.json'], 'pass', { timeout_ms: 120000 }),
+    'route-db': fixture('execute', 'node ./dist/scripts/db-route-materialization-check.js', [], 'pass', { root_mode: 'source_checkout_required' }),
     'route-mad-db': fixture('mock', '$MAD-DB deprecated alias to $MAD-SKS sql-plane contract', ['mad-sks-gate.json', 'completion-proof.json'], 'pass', {
         reason: 'Deprecated alias of $MAD-SKS; shares the same gap as route-mad-sks (mad-sks-gate.json is only written via the real Codex App route dispatch pipeline, not any safe single sks CLI invocation). Left as documented mock alongside route-mad-sks.'
     }),
@@ -216,9 +215,9 @@ const FIXTURES = Object.freeze({
     'route-commit-and-push': fixture('mock', '$Commit-And-Push git route', ['completion-proof.json'], 'pass', {
         reason: 'Dollar-command alias of cli-commit-and-push; dispatches to the same simpleGitCommitCommand() that performs a real commit and `git push` with no working --dry-run mode. Left as documented mock alongside cli-commit-and-push.'
     }),
-    'route-release-review': fixture('execute_and_validate_artifacts', 'sks agent run "release audit" --route "$Release-Review" --agents 10 --concurrency 4 --mock --json', ['release-review-native-agent-plan.json', 'agents/agent-proof-evidence.json', 'agents/agent-effort-policy.json'], 'pass', { timeout_ms: 90000 }),
+    'route-release-review': fixture('execute_and_validate_artifacts', 'sks agent run "release audit" --route "$Release-Review" --agents 10 --concurrency 4 --legacy-native-runtime --mock --json', ['release-review-native-agent-plan.json', 'agents/agent-proof-evidence.json', 'agents/agent-effort-policy.json'], 'pass', { timeout_ms: 90000, note: 'legacy compatibility fixture only; the public $Release-Review route uses official Codex subagents' }),
     'route-native-agent-intake': fixture('execute_and_validate_artifacts', 'sks agent run "fixture" --route "$Team" --agents 5 --concurrency 4 --mock --json', ['agents/agent-central-ledger.json', 'agents/agent-task-board.json', 'agents/agent-leases.json', 'agents/agent-no-overlap-proof.json', 'agents/agent-session-cleanup.json', 'agents/agent-proof-evidence.json', 'agents/agent-effort-policy.json'], 'pass', { timeout_ms: 90000 }),
-    'proof-agent-evidence': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['naruto-gate.json', 'agents/agent-proof-evidence.json'], 'pass', { timeout_ms: 240000 })
+    'proof-agent-evidence': fixture('execute_and_validate_artifacts', 'sks agent run "fixture" --mock --json', ['agents/agent-proof-evidence.json'], 'pass', { timeout_ms: 120000 })
 });
 const STATIC_CONTRACT_FEATURES = new Set([
     'cli-wizard',
@@ -240,6 +239,21 @@ const STATIC_CONTRACT_FEATURES = new Set([
     'cli-team',
     'cli-reasoning',
     'cli-profile',
+    'cli-gates',
+    'cli-postinstall',
+    'cli-menubar',
+    'cli-zellij-lane',
+    'cli-zellij-slot-pane',
+    'cli-zellij-monitor-pane',
+    'cli-zellij-viewport-pane',
+    'cli-zellij-slot-column-anchor',
+    'cli-glm',
+    'cli-mad-db',
+    'cli-stop-gate',
+    'cli-route',
+    'cli-loop',
+    'cli-autoresearch',
+    'cli-hook',
     'handler-$',
     'handler-autoresearch',
     'handler-autoreview',
@@ -324,6 +338,25 @@ function fixture(kind, command, expected_artifacts, status, extra = {}) {
         ...extra
     };
 }
+function preparationFixtureContract(extra = {}) {
+    return {
+        timeout_ms: 90000,
+        codex_app_session: true,
+        completion_semantics: 'preparation_only',
+        expected_stdout_fields: {
+            ok: false,
+            status: 'delegation_context_ready',
+            completion_evidence: false
+        },
+        expected_artifact_fields: {
+            'naruto-gate.json': {
+                passed: false
+            }
+        },
+        reason: 'Codex App execution prepares delegation in the current parent. The fixture passes only when stdout remains ok:false/status:delegation_context_ready and naruto-gate.json remains passed:false.',
+        ...extra
+    };
+}
 function qualityForKind(kind) {
     if (kind === 'execute' || kind === 'execute_and_validate_artifacts')
         return 'runtime_verified';