sneakoscope 6.0.3 → 6.1.2

package/dist/core/image/image-artifact-path-contract.js

@@ -6,12 +6,14 @@ import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-i
 export async function buildImageArtifactPathContract(root, input) {
     const images = [];
     const blockers = [];
-    const invocationPlan = await resolveCodexNativeInvocationPlan({
-        root,
-        missionId: input.missionId,
-        route: '$Image',
-        desiredCapability: 'image-followup'
-    }).catch(() => null);
+    const invocationPlan = input.skipNativeInvocationPlan === true
+        ? null
+        : await resolveCodexNativeInvocationPlan({
+            root,
+            missionId: input.missionId,
+            route: '$Image',
+            desiredCapability: 'image-followup'
+        }).catch(() => null);
     const followupStrategy = invocationPlan?.selected_strategy === 'codex-app-native' ? 'model-visible-path' : 'artifact-path';
     for (const [index, image] of input.images.entries()) {
         const filePath = path.resolve(root, image.filePath || '');

package/dist/core/image/image-artifact-registry.js

@@ -23,7 +23,11 @@ export async function registerImageArtifact(root, input) {
             stage: input.stage
         }
     ];
-    const contract = await buildImageArtifactPathContract(root, { missionId: input.missionId, images: rows });
+    const contract = await buildImageArtifactPathContract(root, {
+        missionId: input.missionId,
+        images: rows,
+        ...(input.skipNativeInvocationPlan === undefined ? {} : { skipNativeInvocationPlan: input.skipNativeInvocationPlan })
+    });
     await writeJsonAtomic(artifactPath, contract);
     return contract;
 }

package/dist/core/image-ux-review/imagegen-adapter.js

@@ -530,6 +530,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
 }
 async function writeGeneratedImagePathContract(input, outputPath, provider) {
     const root = await resolveImageArtifactRoot(input);
+    const skipNativeInvocationPlan = provider !== 'codex_app_imagegen';
     if (input.mission_id) {
         await registerImageArtifact(root, {
             missionId: input.mission_id,
@@ -537,7 +538,8 @@ async function writeGeneratedImagePathContract(input, outputPath, provider) {
             kind: 'generated_image',
             filePath: outputPath,
             route: '$Image-UX-Review',
-            stage: provider
+            stage: provider,
+            skipNativeInvocationPlan
         });
     }
     return writeImageArtifactPathContract(root, {
@@ -549,7 +551,8 @@ async function writeGeneratedImagePathContract(input, outputPath, provider) {
                 route: '$Image-UX-Review',
                 stage: provider
             }],
-        artifactPath: path.join(input.output_dir, 'image-artifact-path-contract.json')
+        artifactPath: path.join(input.output_dir, 'image-artifact-path-contract.json'),
+        skipNativeInvocationPlan
     });
 }
 async function resolveImageArtifactRoot(input) {

package/dist/core/imagegen/imagegen-capability.js

@@ -2,6 +2,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { codexLbEnvPath, parseShellEnvValue } from '../codex-lb/codex-lb-env.js';
 import { nowIso, readText, runProcess, which } from '../fsx.js';
+import { redactSecrets, redactString } from '../secret-redaction.js';
 import { evaluateImagegenAuthReadiness } from './imagegen-auth-readiness.js';
 export async function detectImagegenCapability(opts = {}) {
     const codexBin = opts.codexBin || await which('codex').catch(() => null);
@@ -160,38 +161,34 @@ async function detectCodexAppImagegen(codexBin, opts = {}) {
     }
     if (!codexBin)
         return { available: false, detector: 'codex_binary_missing', blocker: 'codex_binary_missing', raw: null };
-    const jsonRun = await runProcess(codexBin, ['features', 'list', '--json'], {
+    // Codex 0.144 exposes `features list` as a stable text table and rejects
+    // `--json`. Read the supported surface once; still accept JSON output if a
+    // future CLI returns it from the plain command.
+    const featureRun = await runProcess(codexBin, ['features', 'list'], {
         timeoutMs: opts.timeoutMs || 5000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) }));
     let parsed = null;
     try {
-        const candidate = JSON.parse(jsonRun.stdout || 'null');
+        const candidate = JSON.parse(featureRun.stdout || 'null');
         parsed = hasCodexFeatureSignal(candidate) ? candidate : null;
     }
     catch { }
-    let plainRun = null;
-    if (!parsed) {
-        plainRun = await runProcess(codexBin, ['features', 'list'], {
-            timeoutMs: opts.timeoutMs || 5000,
-            maxOutputBytes: 64 * 1024
-        }).catch((err) => ({ code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) }));
-    }
-    if (!parsed && plainRun?.code !== 0) {
+    if (featureRun.code !== 0) {
         return {
             available: false,
             detector: 'codex_features_list',
             blocker: 'codex_app_imagegen_not_detected',
-            raw: String(plainRun?.stderr || plainRun?.stdout || jsonRun.stderr || '').slice(0, 2000)
+            raw: redactString(String(featureRun.stderr || featureRun.stdout || '').slice(0, 2000))
         };
     }
-    const rawText = String(plainRun?.stdout || plainRun?.stderr || jsonRun.stdout || jsonRun.stderr || '');
+    const rawText = String(featureRun.stdout || featureRun.stderr || '');
     const available = codexFeatureEnabled(parsed, rawText);
     return {
         available,
         detector: 'codex_features_list',
         blocker: available ? null : 'codex_app_imagegen_not_detected',
-        raw: parsed || rawText.slice(0, 2000)
+        raw: parsed ? redactSecrets(parsed) : redactString(rawText.slice(0, 2000))
     };
 }
 function hasCodexFeatureSignal(value) {

package/dist/core/imagegen/require-imagegen.js

@@ -9,10 +9,8 @@ export async function requireCodexImagegen(root, opts = {}) {
         core_ready: false,
         blockers: [err instanceof Error ? err.message : String(err)]
     }));
-    if (capability.core_ready === true) {
-        return { ok: true, capability, repair: null, blocker: null, blockers: [] };
-    }
-    const repair = opts.autoRepair === true
+    const capabilityReadyBeforeRepair = capability.core_ready === true;
+    const repair = opts.autoRepair === true && !capabilityReadyBeforeRepair
         ? await repairCodexImagegen({
             root,
             apply: opts.applyRepair === true,
@@ -27,8 +25,13 @@ export async function requireCodexImagegen(root, opts = {}) {
     const finalCapability = repair
         ? repair.after || capability
         : capability;
-    const ok = finalCapability.core_ready === true || repair?.recovered === true;
-    const blockers = ok ? [] : [
+    const capabilityReady = finalCapability.core_ready === true || repair?.capability_ready === true;
+    const currentTaskToolManifestVerified = repair?.current_task_tool_manifest_verified === true;
+    const generatedOutputVerified = finalCapability.real_output_verified_by_capability_check === true
+        || repair?.real_generation_verified === true;
+    const routeReady = capabilityReady && (currentTaskToolManifestVerified || generatedOutputVerified);
+    const preflightReady = capabilityReady;
+    const blockers = preflightReady ? [] : [
         ...new Set([
             ...((finalCapability?.core_blockers || []).map(String)),
             ...((finalCapability?.blockers || []).map(String)),
@@ -36,19 +39,42 @@ export async function requireCodexImagegen(root, opts = {}) {
             'codex_imagegen_unavailable'
         ])
     ];
+    const completionBlockers = routeReady ? [] : [
+        ...new Set([
+            ...(!capabilityReady ? blockers : []),
+            ...(capabilityReady && !currentTaskToolManifestVerified
+                ? ['codex_imagegen_current_task_tool_manifest_unverified']
+                : []),
+            ...(capabilityReady && !generatedOutputVerified
+                ? ['codex_imagegen_real_output_unverified']
+                : [])
+        ])
+    ];
     return {
-        ok,
+        ok: preflightReady,
+        preflight_ready: preflightReady,
+        preflight_only: true,
+        preflight_does_not_satisfy_generated_output_proof: true,
+        capability_ready: capabilityReady,
+        route_ready: routeReady,
+        current_task_tool_manifest_verified: currentTaskToolManifestVerified,
+        generated_output_verified: generatedOutputVerified,
+        completion_blockers: completionBlockers,
         capability: finalCapability,
         repair,
-        blocker: ok ? null : {
+        blocker: preflightReady ? null : {
             schema: 'sks.codex-imagegen-required-blocker.v1',
             blocker: 'codex_imagegen_unavailable',
             status: 'blocked',
             blockers,
             next_actions: repair?.manual_actions || [
-                'Install/update Codex CLI: npm i -g @openai/codex@latest',
-                'Open Codex App settings and enable image_generation / $imagegen.',
-                'Verify with: codex features list --json'
+                ...(capabilityReady ? [] : [
+                    'Install/update Codex CLI: npm i -g @openai/codex@latest',
+                    'Open Codex App settings and enable image_generation / $imagegen.',
+                    'Verify configuration with: codex features list'
+                ]),
+                'Start a fresh Codex/Work task so $imagegen is present in its tool manifest.',
+                'Invoke $imagegen with gpt-image-2 and bind the selected raster output path to route evidence.'
             ]
         },
         blockers

package/dist/core/init/skills.js

@@ -6,6 +6,7 @@ import { buildSksCoreSkillManifest, isCoreSkillName } from '../codex-native/core
 import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
 import { dbSafetyGuardSkillText, madDbSkillText } from '../mad-db/mad-db-policy.js';
 import { SKILL_DREAM_POLICY, skillDreamPolicyText } from '../skill-forge.js';
+import { installOfficialSubagentAgentConfigs } from '../subagents/official-subagent-config.js';
 import { AWESOME_DESIGN_MD_REFERENCE, CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_COMPUTER_USE_ONLY_POLICY, CODEX_IMAGEGEN_EVIDENCE_SOURCE, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_POLICY, DEFAULT_CODEX_APP_PLUGINS, DESIGN_SYSTEM_SSOT, DOLLAR_COMMANDS, DOLLAR_SKILL_NAMES, FROM_CHAT_IMG_CHECKLIST_ARTIFACT, FROM_CHAT_IMG_COVERAGE_ARTIFACT, FROM_CHAT_IMG_QA_LOOP_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS, GETDESIGN_REFERENCE, IMAGEGEN_SOCIAL_SOURCE_POLICY, OPENAI_CHATGPT_IMAGES_2_DOC_URL, OPENAI_GPT_IMAGE_2_MODEL_DOC_URL, OPENAI_IMAGE_GENERATION_DOC_URL, PPT_CONDITIONAL_SKILL_ALLOWLIST, PPT_PIPELINE_MCP_ALLOWLIST, PPT_PIPELINE_SKILL_ALLOWLIST, RECOMMENDED_SKILLS, RESERVED_CODEX_PLUGIN_SKILL_NAMES, SOLUTION_SCOUT_SKILL_NAME, chatCaptureIntakeText, context7ConfigToml, getdesignReferencePolicyText, imageUxReviewPipelinePolicyText, leanEngineeringCompactText, outcomeRubricPolicyText, pptPipelineAllowlistPolicyText, productDesignPluginPolicyText, solutionScoutPolicyText, speedLanePolicyText, stackCurrentDocsPolicyText, triwikiContextTrackingText, triwikiStagePolicyText } from '../routes.js';
 const SKS_SKILL_MANIFEST_FILE = '.sks-generated.json';
 const PACKAGED_SKILLS_MANIFEST_SCHEMA = 'sks.skills-manifest.v1';
@@ -33,7 +34,7 @@ async function installOfficialSkills(root) {
         'sks': `---\nname: sks\ndescription: General Sneakoscope Codex command route for $SKS or $sks usage, setup, status, and workflow help.\n---\n\nUse local SKS commands: bootstrap, deps, commands, quickstart, codex-app, context7, guard, conflicts, reasoning, wiki, pipeline status, pipeline plan, skill-dream. Promote code-changing work to Team unless Answer/DFix/Help/Wiki/safety route fits. Surface route/guard/scope, use TriWiki, do not edit installed harness files outside this engine repo, and require human-approved conflict cleanup. ${skillDreamPolicyText()}\n`,
         'plan': `---\nname: plan\ndescription: Plan scaffold only - writes a fixed-template .sneakoscope/plans/<slug>.md, never touches code. Not project-specific decision-complete planning. 예: $Plan "결제 모듈 리팩터"\n---\n\nUse when the user invokes $Plan or asks for a plan-only frontdoor. Produce a concrete plan artifact under .sneakoscope/plans/<slug>.md with goal, scope, files to inspect, implementation steps, acceptance checks, and rollback notes. Do not edit product/source files, generated harness files, package metadata, or docs beyond the plan artifact. Keep implementation_allowed=false and hand off execution to $Work only after the user or route explicitly moves from planning to work. Finish with what is planned, what remains unimplemented, and Honest Mode.\n`,
         'work': `---\nname: work\ndescription: Execute the latest plan with evidence-gated completion. 예: $Work\n---\n\nUse when the user invokes $Work or asks to execute the latest SKS plan. Resolve the newest .sneakoscope/plans/*.md, route execution through Naruto/Team evidence gates, keep leases and verification artifacts current, and do not claim completion without machine evidence or explicit blocker evidence. If no plan exists, block with a clear next action: run $Plan first or provide a task.\n`,
-        'swarm': `---\nname: swarm\ndescription: Dynamic parallel swarm (naruto) with machine-verified gates. 예: $Swarm "fix all lint errors"\n---\n\nUse when the user invokes $Swarm or asks for dynamic parallel work. Delegate to the Naruto native shadow-clone swarm, preserve lease-safe write boundaries, keep agent ledgers and gate artifacts current, and sort machine verification evidence above LLM opinion. Finish through Naruto gate, reflection when required, and Honest Mode.\n`,
+        'swarm': `---\nname: swarm\ndescription: Deprecated $Swarm compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nWarn once that $Swarm is a deprecated alias, then follow the naruto skill. Use Codex official subagents and agent threads through \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. The parent runs on GPT-5.6 Sol Max, clear bounded worker slices use GPT-5.6 Luna Max, and reasoning-sensitive expert slices use GPT-5.6 Sol Max. Wait for all requested subagents and keep write slices disjoint. SubagentStart/SubagentStop prove lifecycle only; completion requires subagent-parent-summary.json with one structured parent outcome per thread. Canonical artifacts are subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, subagent-evidence.json, naruto-summary.json, and naruto-gate.json. Finish with scoped verification, reflection when required, and Honest Mode.\n`,
         'review': `---\nname: review\ndescription: Parallel diff review with machine-evidence first findings. 예: $Review 또는 sks review --staged\n---\n\nUse when the user asks for $Review or sks review. Review the selected diff read-only unless --fix is explicitly supplied. Machine evidence such as TypeScript, lint, tests, conflict markers, or secret scans outranks LLM findings and must be tagged evidence: machine; judgment-only findings must be tagged evidence: llm. --fix may attempt at most one machine-evidence fix pass and must re-run verification once. Do not mutate code for LLM-only opinions.\n`,
         'fast-mode': `---\nname: fast-mode\ndescription: Dollar-command route for $Fast-Mode, $Fast-On, and $Fast-Off global Codex Desktop Fast mode toggles.\n---\n\nUse when the user invokes $Fast-Mode, $Fast-On, $Fast-Off, or asks to turn SKS Fast mode on/off. Prefer \`sks fast-mode on|off|status|clear --json\`. By default on/off updates the global Codex Desktop config so GPT 5.5 Fast persists and also keeps .sneakoscope/state/fast-mode.json in sync for SKS workers. Use \`--project\` only when the user explicitly wants project-local worker preference without touching global Codex config. Explicit runtime flags still win: \`--fast\`, \`--no-fast\`, and \`--service-tier standard|fast\` override the saved preference for that run. Finish with a short status and Honest Mode; do not start Team or broad implementation for a toggle-only request.\n`,
         'fast-on': `---\nname: fast-on\ndescription: Alias for $Fast-On global Codex Desktop GPT 5.5 Fast enablement.\n---\n\nUse the same rules as fast-mode. Run or instruct \`sks fast-mode on --json\`, then report Global (desktop), Project (sks workers), state file, and the fact that explicit per-run flags still override the saved preference.\n`,
@@ -41,22 +42,21 @@ async function installOfficialSkills(root) {
         'with-local-llm-on': `---\nname: with-local-llm-on\ndescription: Dollar-command route for $with-local-llm-on local Ollama worker enablement.\n---\n\nUse when the user invokes $with-local-llm-on or asks to enable the optional local Ollama worker backend. Prefer \`sks with-local-llm on --json\`. The command writes the machine-local config at \`~/.sneakoscope/local-model.json\`. Default off means SKS stays GPT-only until this command enables local workers. Enabled mode only lets policy-eligible simple code patch-envelope or read-only collection worker slices use Ollama; GPT/Codex still owns strategy, planning, design, review, verification, safety, and integration. \`--no-ollama\` and \`SKS_OLLAMA_WORKERS=0\` still force local workers off for a run. Finish with a short status and Honest Mode; do not start Team for a toggle-only request.\n`,
         'with-local-llm-off': `---\nname: with-local-llm-off\ndescription: Dollar-command route for $with-local-llm-off local Ollama worker disablement.\n---\n\nUse when the user invokes $with-local-llm-off or asks to disable the optional local Ollama worker backend. Prefer \`sks with-local-llm off --json\`. The command writes the machine-local config at \`~/.sneakoscope/local-model.json\`. Disabled mode keeps SKS GPT-only by default. Strategy, planning, design, review, verification, safety, and integration remain GPT/Codex-owned regardless of this toggle. Finish with a short status and Honest Mode; do not start Team for a toggle-only request.\n`,
         'wiki': `---\nname: wiki\ndescription: Dollar-command route for $Wiki TriWiki refresh, pack, validate, and prune commands.\n---\n\nUse for $Wiki or Korean wiki-refresh requests. Refresh/update/갱신: run sks wiki refresh, then validate .sneakoscope/wiki/context-pack.json. Pack: run sks wiki pack, then validate. Prune/clean/정리: use sks wiki refresh --prune, or sks wiki prune --dry-run for inspection. Report claims, anchors, trust, attention.use_first/hydrate_first, validation, and blockers. Do not start ambiguity-gated implementation, subagents, or unrelated work.\n`,
-        'team': `---\nname: team\ndescription: Deprecated $Team compatibility alias; new execution missions route to $Naruto.\n---\n\nUse only to explain or follow legacy $Team prompts. $Team and \`sks team "<task>"\` are deprecated for new execution and redirect to the Naruto native shadow-clone swarm; legacy \`sks team log|tail|watch|lane|status|event|message|open-zellij|attach-zellij|cleanup-zellij\` remains read-only/observability support for old Team missions. For implementation, load the naruto skill, read pipeline-plan.json, run lease-safe Naruto workers, pass naruto-gate.json, then reflection and Honest Mode. ${leanEngineeringCompactText()} ${outcomeRubricPolicyText()} ${speedLanePolicyText()} ${solutionScoutPolicyText('fix this broken behavior')} ${skillDreamPolicyText()}\n`,
+        'team': `---\nname: team\ndescription: Deprecated $Team compatibility alias; new execution missions use the $Naruto Codex official subagent workflow.\n---\n\nWarn once that $Team and \`sks team "<task>"\` are deprecated for new execution, then redirect implementation to \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Only legacy \`sks team log|tail|watch|lane|status\` remains, and it is strictly read-only observability for old missions. New work uses a GPT-5.6 Sol Max parent, Luna Max worker agents for clear bounded slices, Sol Max expert agents for judgment work, lifecycle-only SubagentStart/SubagentStop evidence, and a durable subagent-parent-summary.json containing one structured outcome per thread. Follow the canonical six-artifact Naruto contract. ${leanEngineeringCompactText()} ${outcomeRubricPolicyText()} ${speedLanePolicyText()} ${solutionScoutPolicyText('fix this broken behavior')} ${skillDreamPolicyText()}\n`,
         'from-chat-img': `---\nname: from-chat-img\ndescription: Explicit $From-Chat-IMG Naruto add-on gate for chat screenshot plus attachment analysis.\n---\n\nUse only for From-Chat-IMG/$From-Chat-IMG. It enters the Naruto pipeline with from_chat_img_required=true and an add-on coverage gate, not the legacy Team pipeline. Treat uploads as chat screenshot plus originals. For web/browser/webapp targets use Codex Chrome Extension first; for native Mac/non-web app surfaces use Codex Computer Use visual inspection when available. List requirements first, match regions to attachments with confidence, write ${FROM_CHAT_IMG_COVERAGE_ARTIFACT}, ${FROM_CHAT_IMG_CHECKLIST_ARTIFACT}, ${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT}, and ${FROM_CHAT_IMG_QA_LOOP_ARTIFACT}, then continue Naruto worker proof, review, reflection, and Honest Mode. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY} The ledger must account for every visible customer request, screenshot image region, and separate attachment; ${FROM_CHAT_IMG_CHECKLIST_ARTIFACT} must have a checked item for each request, image-region/attachment match, work item, scoped QA-LOOP, and verification step; ${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT} stores temporary TriWiki-backed session context with expires_after_sessions=${FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS}. ${FROM_CHAT_IMG_QA_LOOP_ARTIFACT} must prove QA-LOOP ran over the exact customer-request work-order range after implementation, with every work item covered, post-fix verification complete, and zero unresolved findings. naruto-gate.json cannot pass From-Chat-IMG completion until from_chat_img_request_coverage=true, unresolved_items is empty, every checklist box is checked, and scoped_qa_loop_completed=true.\n`,
-        'naruto': `---\nname: naruto\ndescription: $Naruto Shadow Clone Swarm (影分身 / Kage Bunshin no Jutsu) fans out up to 100 parallel clone sessions on the native agent kernel for high-throughput work.\n---\n\nUse when the user invokes $Naruto, $ShadowClone, $Kagebunshin, $Team, $From-Chat-IMG, or asks to fan out many parallel agent clones for high-throughput sweeps. Naruto is the new execution SSOT: Team is only a deprecated compatibility alias. Prefer \`sks naruto run "<task>" [--clones N] [--backend codex-exec|fake] [--work-items N] [--real] [--readonly] [--json]\` and \`sks naruto status [--mission <id>] [--json]\`. Clones default to the native kernel and are throttled to host capacity (cores/free memory); the requested clone count is the ceiling, not a guarantee, and the scheduler backfills slots as clones complete. Shadow clones always run in fast service tier; \`--no-fast\`/standard requests are not honored for clones. Writes are lease-based and non-overlapping: each clone takes a path lease before writing so parallel clones never edit the same file, and every clone emits its own proof. Keep agent-central-ledger.json, agent-task-board.json, agent-effort-policy.json, agent-scheduler-state.json, agent-proof-evidence.json, naruto-gate.json, and agent-session-cleanup.json; the parent session owns integration, verification, and final claims. Use \`--backend fake\` only for fixtures/selftests; remove it when real clone evidence is intended. Lifecycle: clone roster build, work partition, parallel clone scheduling, lease-based write swarm, per-clone proof, session cleanup, then reflection and Honest Mode. Refresh/validate TriWiki before risky decisions and consume attention.use_first/hydrate_first. Catastrophic safeguards remain active for every clone. Finish with a concise completion summary and Honest Mode covering verified clones, unverified work, and any blockers.\n`,
-        'shadow-clone': `---\nname: shadow-clone\ndescription: $ShadowClone alias for the $Naruto Shadow Clone Swarm high-scale parallel agent route.\n---\n\nUse the same rules as the naruto skill: this is the English alias for $Naruto / Kage Bunshin no Jutsu. Fan out up to 100 lease-safe parallel clone sessions on the native agent kernel via \`sks naruto run "<task>" [--clones N] [--backend codex-exec|fake] [--work-items N] [--json]\`. Clones run in fast service tier, are throttled to host capacity, take path leases for non-overlapping writes, and each emit per-clone proof; the parent integrates and verifies. Keep the same agent ledgers and finish with reflection and Honest Mode.\n`,
-        'kage-bunshin': `---\nname: kage-bunshin\ndescription: $Kagebunshin alias for the $Naruto Shadow Clone Swarm (影分身) high-scale parallel agent route.\n---\n\nUse the same rules as the naruto skill: this is the 影分身 / Kage Bunshin no Jutsu alias for $Naruto. Fan out up to 100 lease-safe parallel clone sessions on the native agent kernel via \`sks naruto run "<task>" [--clones N] [--backend codex-exec|fake] [--work-items N] [--json]\`. Clones run in fast service tier, are throttled to host capacity, take path leases for non-overlapping writes, and each emit per-clone proof; the parent integrates and verifies. Keep the same agent ledgers and finish with reflection and Honest Mode.\n`,
+        'shadow-clone': `---\nname: shadow-clone\ndescription: Deprecated $ShadowClone compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nEmit one deprecation warning, translate the request to $Naruto, and use \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Do not describe the new default as clones, a process swarm, or a native kernel. Follow the naruto skill's Sol Max parent, Luna Max worker, Sol Max expert, lifecycle-only event evidence, structured subagent-parent-summary.json, max_depth=1, canonical six-artifact contract, scoped verification, reflection, and Honest Mode rules.\n`,
+        'kage-bunshin': `---\nname: kage-bunshin\ndescription: Deprecated $Kagebunshin compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nEmit one deprecation warning, translate the request to $Naruto, and use \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Legacy 影分身 terminology is compatibility-only and must not define the new runtime. Follow the naruto skill's Sol Max parent, Luna Max worker, Sol Max expert, lifecycle-only event evidence, structured subagent-parent-summary.json, max_depth=1, canonical six-artifact contract, scoped verification, reflection, and Honest Mode rules.\n`,
         'qa-loop': `---\nname: qa-loop\ndescription: $QA-LOOP dogfoods UI/API as human proxy with safety gates, Codex Chrome Extension-first web UI evidence, safe fixes, rechecks, and a QA report.\n---\n\nUse only $QA-LOOP. Infer scope, target, mutation policy, and login boundary from the prompt plus TriWiki/current-code defaults; do not surface a prequestion sheet. Credentials are runtime-only; never save secrets. Web/browser/webapp UI-level E2E must run the Codex Chrome Extension readiness gate first; if the extension is missing or disabled, rapidly halt and ask the user to set it up, then resume only after the user confirms installation is complete. Codex Computer Use is reserved for native Mac/non-web surfaces and must not satisfy web UI evidence. Playwright, Selenium, Puppeteer, Browser Use, Chrome MCP, screenshots fabricated from code, and prose-only checks do not satisfy web UI/browser verification. ${CODEX_WEB_VERIFICATION_POLICY} Deployed targets are read-only; destructive removal is forbidden. After answer/run, dogfood real flows, apply safe contract-allowed code/test/docs fixes, recheck, and do not pass qa-gate.json with unresolved findings or without post_fix_verification_complete. Finish qa-ledger, date/version report, gate, completion summary, and Honest Mode.\n`,
         'ppt': `---\nname: ppt\ndescription: $PPT information-first HTML/PDF presentation pipeline with inferred STP, audience, pain-point, format, research, design-system, and verification contract.\n---\n\nUse only when the user invokes $PPT or asks to create a presentation, deck, slides, pitch deck, proposal deck, HTML presentation, or PDF presentation artifact. Before artifact work, auto-seal presentation-specific answers from prompt, TriWiki/current-code defaults, and conservative policy: delivery context, target audience profile including role/average age/job/industry/topic familiarity/decision power, STP strategy, decision context and objections, and 3+ pain-point to solution mappings with expected aha moments. Do not surface a prequestion sheet. Presentation design must be simple, restrained, and information-first: avoid over-designed decoration, ornamental gradients, nested cards, and effects that compete with the message. Design detail should be embedded through typography hierarchy, spacing, alignment, thin rules, source clarity, and subtle accents. ${pptPipelineAllowlistPolicyText()} Use Product Design plugin first for context, ideation, prototype direction, audit, design QA, and share handoff. Use design.md only as an existing project-local cache or fallback SSOT when Product Design is unavailable; if fallback creation is needed, use docs/Design-Sys-Prompt.md plus getdesign-reference and curated DESIGN.md examples from ${AWESOME_DESIGN_MD_REFERENCE.url} only as source inputs, then fuse them into route-local PPT style tokens with a recorded design_ssot instead of treating references as parallel authorities. The $PPT route always loads imagegen as a required skill, checks Codex App imagegen at route start, and runs SKS auto-repair once before any image-dependent build/review work. If repair fails, stop with codex_imagegen_unavailable and do not continue with image-free or API-substituted evidence. When the sealed contract needs a generated raster asset or generated slide visual critique, immediately invoke Codex App \`$imagegen\` with gpt-image-2, move/copy the selected output into the mission assets or review evidence path, and record the real file path in ppt-image-asset-ledger.json or ppt-review-ledger.json before building or passing the gate. Direct API fallback, placeholder files, HTML/CSS stand-ins, and prose-only substitutes do not satisfy the route gate. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY} Use web or Context7 evidence only when external facts/libraries/current docs are required by the PPT contract, record verified claims in ppt-fact-ledger.json, record generated image asset plans/results/blockers in ppt-image-asset-ledger.json, then create the PDF plus editable source HTML under source-html/, keep independent strategy/render/file-write phases parallel where inputs allow, record ppt-parallel-report.json, run the bounded ppt-review-policy/ppt-review-ledger/ppt-iteration-report loop, and verify readability, overlap, format fit, source coverage, export state, unsupported-claim status, image-asset completion, review-loop termination, and temporary build files cleanup. Finish with reflection and Honest Mode.\n`,
         'computer-use-fast': `---\nname: computer-use-fast\ndescription: Alias for the maximum-speed $Computer-Use/$CU native Codex Computer Use lane.\n---\n\nUse the same rules as computer-use: skip Team debate, QA-LOOP clarification, upfront TriWiki refresh, Context7, subagents, and reflection unless explicitly requested. Use Codex Computer Use directly only for native macOS, desktop-app, OS-settings, or non-web visual tasks. Browser, localhost, website, webapp, and web-based app verification must use the Codex Chrome Extension path first and must halt if that extension is not installed/enabled. At the end only, refresh/pack TriWiki, validate it, then provide a concise completion summary plus Honest Mode. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}\n`,
         'cu': `---\nname: cu\ndescription: Short alias for the maximum-speed native $Computer-Use Codex Computer Use lane.\n---\n\nUse the same rules as computer-use. This is a speed lane for native macOS, desktop-app, OS-settings, and non-web visual tasks requiring Codex Computer Use evidence, with TriWiki refresh/validate and Honest Mode deferred to final closeout. Web/browser/webapp verification must use Codex Chrome Extension first and stop if the extension is not installed/enabled. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}\n`,
         'goal': `---\nname: goal\ndescription: Fast $Goal/$goal bridge overlay for Codex native persisted /goal workflows.\n---\n\nUse when the user invokes $Goal/$goal or asks to persist a workflow with Codex native /goal continuation. Prepare with sks goal create or the $Goal route, write only the lightweight bridge artifacts, then use native Codex /goal create, pause, resume, and clear controls where available. Goal does not replace Team, QA, DB, or other SKS execution routes; continue implementation through the selected route and use Context7 only when external API/library docs are involved. Do not recreate the old no-question loop.\n`,
-        'release-review': `---\nname: release-review\ndescription: Native release review route for $Release-Review multi-session agent release audits.\n---\n\nUse only when the user invokes $Release-Review or asks for release-readiness review with native multi-session agents. Prefer \`sks agent run \"release audit\" --route \"$Release-Review\" --agents <n> --concurrency <n> --mock --json\` for deterministic fixtures and remove \`--mock\` only when real backend evidence is intended. Manual scaling is explicit: \`--agents N\` controls total agents and \`--concurrency M\` controls simultaneous sessions; keep leases/no-overlap proof, agent-central-ledger.json, agent-task-board.json, agent-effort-policy.json, agent-proof-evidence.json, and agent-session-cleanup.json. Dynamic effort is assigned by the main session per slice; parent owns integration and final release claims. Removed legacy multi-agent commands do not satisfy release collaboration proof. Finish with release-readiness verification and Honest Mode.\n`,
+        'release-review': `---\nname: release-review\ndescription: Official Codex subagent release review route for $Release-Review.\n---\n\nUse only when the user invokes $Release-Review or asks for a release-readiness review. Run it through \`sks naruto run \"$Release-Review release audit\" --agents <n> --read-only --json\` or the current Codex parent session. The parent owns decomposition, waits for every official worker/expert thread, integrates one structured outcome per thread, and records subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, and subagent-evidence.json. Do not also start \`sks agent run\` or another scheduler for the same mission. The historical native process fixture is available only with explicit \`--legacy-native-runtime --mock\` and cannot satisfy current release collaboration proof. Finish with release-readiness verification and Honest Mode.\n`,
         'commit': `---\nname: commit\ndescription: Simple git-only route for $Commit requests that stage current changes and create one commit without the full SKS pipeline.\n---\n\nUse only when the user invokes $Commit or explicitly asks to commit the current repository changes without pushing. Keep this route lightweight: inspect git status and the relevant diff summary, avoid Team/pipeline/TriWiki route work unless separately requested, stage the intended current changes, and create one git commit. The commit message must summarize the actual work and include exactly one trailer: Co-authored-by: Codex <noreply@openai.com>. Do not push. If there are no changes, report that no commit was created. Finish with a concise result and a one-line Honest Mode covering the commit hash and any unverified items.\n`,
         'commit-and-push': `---\nname: commit-and-push\ndescription: Simple git-only route for $Commit-And-Push requests that stage current changes, create one commit, and push without the full SKS pipeline.\n---\n\nUse only when the user invokes $Commit-And-Push or explicitly asks to commit and push the current repository changes. Keep this route lightweight: inspect git status and the relevant diff summary, avoid Team/pipeline/TriWiki route work unless separately requested, stage the intended current changes, create one git commit, then push the current branch. The commit message must summarize the actual work and include exactly one trailer: Co-authored-by: Codex <noreply@openai.com>. If there are no changes, do not create an empty commit unless the user explicitly asks for one. Finish with a concise result and a one-line Honest Mode covering the commit hash, pushed branch, and any unverified items.\n`,
-        'research': `---\nname: research\ndescription: Dollar-command route for $Research or $research frontier discovery workflows.\n---\n\nUse when the user invokes $Research/$research or asks for research, hypotheses, new mechanisms, falsification, or testable predictions. Prefer sks research prepare and sks research run. Research is not an implementation route: do not edit repository source, docs, package metadata, generated skills, or harness files; write only route-local mission artifacts under .sneakoscope/missions/<mission-id>/. Run the genius-lens agent council with named persona-inspired cognitive roles: Einstein Agent, Feynman Agent, Turing Agent, von Neumann Agent, and Skeptic Agent. These are lenses only; do not impersonate the historical people. Every Research agent ledger row must include display_name, persona, persona_boundary, effort=xhigh, reasoning_effort=xhigh, service_tier when available, one literal "Eureka!" idea, falsifiers, cheap_probes, and challenge_or_response before synthesis. This is not a fixed three-cycle route: repeat source gathering, Eureka ideas, evidence-bound debate, falsification, and synthesis pressure until every agent records final agreement, or until the explicit max-cycle safety cap pauses with an unpassed gate. Create research-source-skill.md as a route-local Skill Creator artifact, then maximize layered public web/source search across latest papers, official/government or leading-institution data, standards/primary docs, current news, public discourse, developer/practitioner sources, traditional background sources, and counterevidence before synthesis. Record research-source-skill.md, source-ledger.json, agent-ledger.json, debate-ledger.json, novelty-ledger.json, falsification-ledger.json, research-report.md, research-paper.md, genius-opinion-summary.md, and research-gate.json. debate-ledger.json must include consensus_iterations, unanimous_consensus, and per-agent agreements; research-gate.json cannot pass until unanimous_consensus=true with every agent agreement recorded. Context7 is optional and only needed when the research topic depends on external package/API/framework docs; do not use it as the default research evidence layer. Normal Research may take one or two hours when needed; favor real source collection, cross-layer comparison, falsification, and a concise paper manuscript over speed. Do not use --mock except for selftests or dry harness checks; if live source execution is unavailable, record a blocker and keep the gate unpassed. Do not use for ordinary code edits.\n`,
+        'research': `---\nname: research\ndescription: Dollar-command route for $Research or $research frontier discovery workflows.\n---\n\nUse when the user invokes $Research/$research or asks for research, hypotheses, new mechanisms, falsification, or testable predictions. Prefer sks research prepare and sks research run. Research is not an implementation route: do not edit repository source, docs, package metadata, generated skills, or harness files; write only route-local mission artifacts under .sneakoscope/missions/<mission-id>/. First run layered Super Search across current papers, primary/official sources, standards, public discourse, practitioner evidence, background sources, and explicit counterevidence; only verified-content source rows may support real-run reviewer claims. Then run exactly three independent official Codex subagent threads using the project custom agent research_reviewer with GPT-5.6 Sol Max: Einstein Agent (first principles, explanation, experiments), von Neumann Agent (formal systems, algorithms, strategy, scaling), and Skeptic Agent (counterevidence, base rates, replication). These are composite persona-inspired lenses, not impersonations. Do not launch a custom debate scheduler, worker pool, or synthetic model fanout. Each reviewer must return the structured adversarial outcome, one literal "Eureka!" idea, source ids, falsifiers, cheap probes, and zero unresolved objections before approval. If any reviewer requests revision, revise the manuscript and run a fresh three-thread review cycle within the bounded cycle cap; convergence requires unanimous approval and trustworthy parent outcomes for all threads. agent-ledger.json and debate-ledger.json are compatibility projections from official reviewer outcomes, not independent runtime proof. Record research-source-skill.md, source-ledger.json, claim-evidence-matrix.json, novelty-ledger.json, falsification-ledger.json, research-report.md, the dated research paper, research-adversarial-review.json, research-revision-ledger.json, research-adversarial-convergence.json, genius-opinion-summary.md, research-honest-mode.json, and research-gate.json. Context7 is required only when the topic depends on current package/API/framework docs. Do not use --mock except for selftests; if live source execution is unavailable, record a blocker and keep the gate unpassed. Do not use for ordinary code edits.\n`,
         'autoresearch': `---\nname: autoresearch\ndescription: Dollar-command route for $AutoResearch or $autoresearch iterative experiment loops.\n---\n\nUse for $AutoResearch, iterative improvement, ranking, workflow, benchmark, or experiments. Define program, hypothesis, experiment, metric, keep/discard, falsification, next step, and Honest Mode. Do not become the parent identity for SEO/GEO; $SEO-GEO-OPTIMIZER may call research as a child stage for query, market, or competitor discovery while keeping the parent mission, gate, and Completion Proof on $SEO-GEO-OPTIMIZER.\n`,
-        'db': `---\nname: db\ndescription: Dollar-command route for $DB or $db database and Supabase safety checks.\n---\n\nUse when the user invokes $DB/$db or the task touches SQL, Supabase, Postgres, migrations, Prisma, Drizzle, Knex, MCP database tools, or production data. Run or follow sks db policy, sks db scan, sks db classify, and sks db check. Destructive database operations remain forbidden.\n`,
+        'db': `---\nname: db\ndescription: Dollar-command route for $DB or $db database and Supabase safety checks.\n---\n\nUse when the user invokes $DB/$db or the task touches SQL, Supabase, Postgres, migrations, Prisma, Drizzle, Knex, MCP database tools, or production data. The $DB route automatically materializes db-safety-scan.json and db-review.json from the internal DB safety engine; inspect those artifacts and current source/docs evidence instead of invoking a separate CLI. The legacy sks db command is removed and must remain unknown. Keep analysis read-only by default. Destructive database operations remain forbidden; explicitly authorized SQL-plane work uses sks mad-sks plan|sql|apply-migration under an active scoped permission mission.\n`,
         'mad-db': `---\nname: mad-db\ndescription: Deprecated $MAD-DB compatibility alias; merged into mad-sks.\n---\n\n$MAD-DB and \`sks mad-db run|exec|apply-migration\` are deprecated aliases for MAD-SKS sql-plane. Warn the operator, translate to \`sks mad-sks sql|apply-migration\`, and follow the mad-sks skill as the single current authority.\n`,
         'mad-sks': `---\nname: mad-sks\ndescription: Explicit high-risk authorization modifier plus merged SQL-plane executor for $MAD-SKS.\n---\n\nUse only when the user explicitly invokes $MAD-SKS, top-level sks --mad, or \`sks mad-sks plan|run|apply|sql|apply-migration|status|close|rollback-apply\`. MAD-SKS is the single high-risk MAD route: it combines scoped permission widening across approved target-project surfaces with the former MAD-DB SQL-plane execution model. It can be combined with another route, such as $MAD-SKS $Team or $DB ... $MAD-SKS; in that case the other command remains the primary workflow and MAD-SKS is the temporary permission grant or sql-plane executor. The widened permission applies only while the active mission gate is open, must be deactivated when the task ends, and can open approved scopes such as target-project file writes, shell commands, package installs, local service control, network operations, browser/Computer Use workflows, generated assets, file permissions, migrations, Supabase MCP database writes, column/schema cleanup, direct execute SQL, and normal targeted DB writes.\n\nMerged SQL-plane policy from mad-db:\n${mergedMadDbSqlPlanePolicy}\n\nCatastrophic SQL boundary: TRUNCATE, all-row UPDATE/DELETE, table/schema/database DROP, and equivalent reset operations are allowed only through the sql-plane executor and only when the user's prompt or CLI SQL statement literally names that operation. Other MAD-SKS executors, including db-write, keep those catastrophic categories blocked. Whole database/schema/table removal outside sql-plane, dangerous project/branch management, credential exfiltration, persistent security weakening, destructive delete without explicit confirmation, and unrequested fallback implementation remain blocked. Do not carry MAD-SKS permission into later prompts or routes. The permission profile source is centralized in src/core/permission-gates.ts and emitted as dist/core/permission-gates.js so skill/hook/MCP-style gates share one decision function.\n`,
         'gx': `---\nname: gx\ndescription: Dollar-command route for $GX or $gx deterministic GX visual context cartridges.\n---\n\nUse when the user invokes $GX/$gx or asks for architecture/context visualization through SKS. Prefer sks gx init, render, validate, drift, and snapshot. vgraph.json remains the source of truth.\n`,
@@ -79,7 +79,7 @@ async function installOfficialSkills(root) {
         'gx-visual-read': `---\nname: gx-visual-read\ndescription: Read a Sneakoscope Codex deterministic visual sheet and produce context notes.\n---\n\nExtract nodes, edges, invariants, tests, risks, uncertainties, and RGBA anchors from source/render/snapshot. Do not infer hidden nodes.\n`,
         'gx-visual-validate': `---\nname: gx-visual-validate\ndescription: Validate render metadata against vgraph.json and beta.json.\n---\n\nRun sks gx validate and drift; fail stale or incomplete hashes, nodes, edges, invariants, or anchors.\n`,
         'turbo-context-pack': `---\nname: turbo-context-pack\ndescription: Build ultra-low-token context packet with Q4 bits, Q3 tags, top-K claims, and minimal evidence.\n---\n\nDefault to Q4/Q3 plus TriWiki RGBA anchors and attention.use_first. Add Q2/Q1 only when needed or when attention.hydrate_first says source hydration is required. Keep id, hash, path, and coordinate tuple for hydration.\n`,
-        'research-discovery': `---\nname: research-discovery\ndescription: Run SKS Research Mode for frontier-style research, hypotheses, novelty ledgers, falsification, and experiments.\n---\n\nFrame criteria, map assumptions, run maximum available web/source search, generate xhigh agent intake findings through Einstein Agent, Feynman Agent, Turing Agent, von Neumann Agent, and Skeptic Agent persona-inspired lenses, require each agent to record display_name/persona/persona_boundary plus a literal "Eureka!" idea, run evidence-bound debate, falsify, keep surviving insights, and record source ids, novelty/confidence/falsifiers/next experiments. Do not impersonate historical people and do not overclaim.\n`,
+        'research-discovery': `---\nname: research-discovery\ndescription: Run SKS Research Mode for frontier-style research, hypotheses, novelty ledgers, falsification, and experiments.\n---\n\nFrame criteria, map assumptions, and run layered Super Search before synthesis. Use exactly three independent official research_reviewer threads on GPT-5.6 Sol Max: Einstein Agent for first-principles explanation and experiments, von Neumann Agent for formal systems/algorithms/strategy, and Skeptic Agent for counterevidence/base rates/replication. Treat them as composite persona-inspired lenses, never impersonations. Require structured source-bound outcomes, one literal "Eureka!" idea per reviewer, falsifiers, cheap probes, and unanimous zero-objection approval. Revise and rerun a fresh three-thread cycle when challenged; do not use the removed custom debate scheduler. Keep agent/debate ledgers as compatibility projections only and do not overclaim genius, novelty, breakthrough, or publication acceptance.\n`,
         'performance-evaluator': `---\nname: performance-evaluator\ndescription: Evaluate SKS performance, token-saving, accuracy-proxy, context-compression, or workflow improvements.\n---\n\nUse sks eval run/compare before claims. Report token_savings_pct, accuracy_delta/proxy, required_recall, support, and meaningful_improvement.\n`,
         'image-ux-review': imageUxReviewSkill('image-ux-review'),
         'ux-review': imageUxReviewSkill('ux-review'),
@@ -541,27 +541,11 @@ async function removeDirIfEmpty(dir) {
     catch { }
 }
 export async function installCodexAgents(root) {
-    const agents = {
-        'analysis-scout.toml': `name = "analysis_scout"\ndescription = "SKS analysis scout with bounded write capability retained for stale Codex agent-role config repair."\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS analysis scout.\nInherit the model and reasoning level selected by Codex; never replace or constrain its model catalog.\nOnly edit bounded files assigned by the parent orchestrator; otherwise inspect only and return concise source-backed findings.\n"""\n`,
-        'native-agent-intake.toml': `name = "native_agent"\ndescription = "Team native agent with bounded write capability. Maps one independent repo/docs/tests/API/risk/user-friction slice and can produce patch-envelope work when assigned."\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS Team native agent.\nInherit the model and reasoning level selected by Codex; never replace or constrain its model catalog.\nOnly edit bounded files assigned by the parent orchestrator.\nOwn exactly one investigation or implementation slice assigned by the parent orchestrator.\nUse a capability-advertised reasoning level when the runtime supplies a per-task override; otherwise keep the current Codex selection.\nMap relevant source files, docs, tests, APIs, DB or safety risks, UX friction, and likely implementation boundaries.\nReturn concise source-backed claims suitable for team-analysis.md and TriWiki ingestion: claim, source path, evidence hash or quoted anchor, risk, confidence, and recommended implementation slice.\nDo not debate the final plan. Implement only when the assigned slice includes write paths.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
-        'team-consensus.toml': `name = "team_consensus"\ndescription = "Planning and debate specialist for SKS Team mode with bounded write capability. Maps options, constraints, role-persona risks, and proposes the agreed objective before implementation starts."\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are the SKS Team consensus specialist.\nInherit the model and reasoning level selected by Codex; never replace or constrain its model catalog.\nOnly edit bounded files assigned by the parent orchestrator.\nUse a capability-advertised reasoning level when the runtime supplies a per-task override; otherwise keep the current Codex selection.\nMap the affected code paths, viable approaches, constraints, risks, and acceptance criteria.\nRun the debate as role-persona synthesis: final users are low-context, self-interested, stubborn, and inconvenience-averse; executors are capable developers; reviewers are strict.\nArgue for the smallest coherent objective that can be handed to a fresh executor_N development team.\nPlan for at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final.\nReturn: recommended objective, rejected alternatives, implementation slices, required reviewers, user-friction risks, and unresolved risks.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
-        'implementation-worker.toml': `name = "implementation_worker"\ndescription = "Implementation specialist for SKS Team mode. Owns one bounded write set and coordinates with other executor_N workers."\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS Team executor/developer in the fresh development bundle.\nInherit the model and reasoning level selected by Codex; never replace or constrain its model catalog.\nYou are not alone in the codebase. Other executor_N workers may be editing disjoint files.\nUse a capability-advertised reasoning level when the runtime supplies a per-task override; otherwise keep the current Codex selection.\nOnly edit the files or module slice assigned to you.\nDo not revert or overwrite edits made by others.\nRead local patterns first, make the smallest correct change, avoid adding user friction, run focused verification for your slice, and report changed paths plus evidence.\nDo not create fallback implementation code, substitute behavior, mock behavior, or compatibility shims unless the user or sealed decision contract explicitly requested them.\nRespect all SKS hooks, DB safety rules, no-question run rules, and H-Proof completion gates.\nAlso return concise LIVE_EVENT lines for started, blocked, changed files, verification, and final result so the parent can record them.\n"""\n`,
-        'db-safety-reviewer.toml': `name = "db_safety_reviewer"\ndescription = "Database safety reviewer with bounded write capability for SQL, migrations, Supabase, RLS, destructive-operation risk, and rollback safety."\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are a database safety reviewer.\nInherit the model and reasoning level selected by Codex; never replace or constrain its model catalog.\nOnly edit bounded files assigned by the parent orchestrator. Never execute destructive commands.\nReview migrations, SQL, Supabase RLS, transaction boundaries, rollback safety, and MCP database tool usage.\nBlock DROP, TRUNCATE, mass DELETE/UPDATE, db reset, db push, project deletion, branch reset/merge/delete, RLS disabling, and live execute_sql writes.\nReturn concrete risks, exact file references, and required fixes.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
-        'qa-reviewer.toml': `name = "qa_reviewer"\ndescription = "Strict verification reviewer with bounded write capability for correctness, regressions, missing tests, user friction, and final evidence."\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS Team strict reviewer.\nInherit the model and reasoning level selected by Codex; never replace or constrain its model catalog.\nOnly edit bounded files assigned by the parent orchestrator.\nReview correctness, edge cases, regression risk, missing tests, unsupported claims, and whether the final evidence proves the claimed outcome.\nTeam review must cover at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final; flag missing review lane evidence.\nAlso evaluate practical friction from the viewpoint of a stubborn, low-context final user who dislikes inconvenience.\nPrioritize concrete findings with file references and focused verification suggestions.\nFlag any unrequested fallback implementation code, substitute behavior, mock behavior, or compatibility shim as a blocking finding unless the user or sealed decision contract explicitly requested it.\nReturn no findings if the implementation is sound, and clearly list residual test gaps.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`
-    };
-    const dir = path.join(root, '.codex', 'agents');
-    await ensureDir(dir);
-    for (const [file, content] of Object.entries(agents)) {
-        await writeTextAtomic(path.join(dir, file), content);
-    }
-    return {
-        installed_agents: Object.keys(agents),
-        generated_files: Object.keys(agents).map((file) => `.codex/agents/${file}`).sort()
-    };
+    return installOfficialSubagentAgentConfigs(root, { apply: true });
 }
-export function currentGeneratedFileInventory(skillInstall = {}, agentInstall = {}) {
+export function currentGeneratedFileInventory(skillInstall = {}, agentInstall = {}, opts = {}) {
     return Array.from(new Set([
-        '.codex/config.toml',
+        ...(opts.includeCodexConfig === false ? [] : ['.codex/config.toml']),
         '.codex/SNEAKOSCOPE.md',
         '.codex/hooks.json',
         '.sneakoscope/harness-guard.json',
@@ -602,12 +586,14 @@ function normalizeGeneratedRelPath(value) {
 function isPrunableGeneratedPath(rel) {
     if (rel.startsWith('.agents/skills/'))
         return true;
+    // Inventory drift alone never proves agent-file ownership. The official
+    // installer separately removes exact marker-backed legacy SKS templates;
+    // this generic pruner preserves user-authored or modified role TOMLs.
     if (rel.startsWith('.codex/agents/'))
-        return true;
+        return false;
     if (rel.startsWith('.codex/skills/'))
         return true;
     return new Set([
-        '.codex/config.toml',
         '.codex/SNEAKOSCOPE.md',
         '.codex/hooks.json',
         '.sneakoscope/harness-guard.json',