sneakoscope 6.0.3 → 6.1.2

package/dist/core/proof-field.js

@@ -30,14 +30,14 @@ export const PROOF_CONE_DEFINITIONS = Object.freeze([
         id: 'db_safety',
         surfaces: ['database', 'supabase', 'mad-sks'],
         match: [/db-safety|supabase|migration|rls|schema|sql/i],
-        verification: ['npm run packcheck', 'npm run selftest -- --mock', 'sks db scan --json'],
+        verification: ['npm run packcheck', 'sks selftest --mock --json', 'node --test test/unit/db-safety.test.mjs'],
         negative_work: ['browser_ui_e2e', 'visual_snapshot']
     },
     {
         id: 'route_surface',
         surfaces: ['routes', 'skills', 'cli-help', 'docs'],
         match: [/routes\.js|init\.js|codex-app|README|AGENTS|skills/i],
-        verification: ['npm run packcheck', 'npm run selftest -- --mock', 'sks commands --json'],
+        verification: ['npm run packcheck', 'sks selftest --mock --json', 'sks commands --json'],
         negative_work: ['database_migration', 'from_chat_img_forensics']
     },
     {
@@ -65,7 +65,7 @@ export const PROOF_CONE_DEFINITIONS = Object.freeze([
         id: 'visual_forensic',
         surfaces: ['from-chat-img', 'visual', 'qa-loop'],
         match: [/from-chat-img|visual|screenshot|qa-loop|dogfood/i],
-        verification: ['npm run packcheck', 'npm run selftest -- --mock'],
+        verification: ['npm run packcheck', 'sks selftest --mock --json'],
         negative_work: ['database_migration']
     }
 ]);

package/dist/core/provider/model-router.js

@@ -1,3 +1,4 @@
+import { decideSubagentModel, SUBAGENT_EFFORT } from '../subagents/model-policy.js';
 const CATEGORY_POLICY = {
     quick: { reasoning: 'low', serviceTier: 'fast' },
     standard: { reasoning: 'medium', serviceTier: 'fast' },
@@ -9,10 +10,9 @@ const CATEGORY_POLICY = {
     refactor: { reasoning: 'max', serviceTier: 'fast' },
     strategy: { reasoning: 'max', serviceTier: 'fast' }
 };
-export const NARUTO_GPT56_MODELS = ['gpt-5.6-luna', 'gpt-5.6-terra', 'gpt-5.6-sol'];
-const NARUTO_LUNA_WORK_RE = /(e2e|end[-\s]?to[-\s]?end|test_execution|ux_review|browser|chrome|computer[-\s]?use|computer\s+use|gui|visual\s+(?:qa|test|check)|cross[-\s]?app|playwright|selenium|puppeteer|브라우저|컴퓨터\s*유즈|화면\s*검증)/i;
-const NARUTO_SOL_WORK_RE = /(refactor|re-?architect|architecture|architect|planning|\bplan\b|strategy|strategic|integrat|conflict[-_\s]?resolv|patch[-_\s]?rebase|rollback[-_\s]?plan|gpt[-_\s]?final|arbiter|리팩터|아키텍처|기획|전략|통합|충돌\s*해결|롤백\s*계획)/i;
-const NARUTO_MAX_WORK_RE = /(complex|critical|high[-\s]?risk|security|database|migration|release|publish|forensic|flaky|failure|cross[-\s]?app|multi[-\s]?step|복잡|고위험|보안|데이터베이스|마이그레이션|릴리즈|포렌식|실패)/i;
+export const NARUTO_MODELS = ['gpt-5.6-luna', 'gpt-5.6-sol'];
+const NARUTO_EXPLICIT_COMPATIBILITY_MODELS = [...NARUTO_MODELS, 'gpt-5.6-terra'];
+const E2E_WORK_RE = /(e2e|end[-\s]?to[-\s]?end|test_execution|browser|chrome|computer[-\s]?use|computer\s+use|cross[-\s]?app|playwright|selenium|puppeteer|브라우저|컴퓨터\s*유즈)/i;
 export async function routeModel(category, opts = {}) {
     if (opts.narutoOnly) {
         return routeNarutoGpt56Model({
@@ -32,64 +32,70 @@ export async function routeModel(category, opts = {}) {
 }
 export function routeNarutoGpt56Model(input = {}) {
     const category = input.category || 'agentic';
-    const text = `${category} ${String(input.taskText || '')}`;
-    const riskText = `${text} ${String(input.riskText || '')}`;
+    const explicitRequested = String(input.explicitModel || '').trim();
     const explicit = normalizeNarutoGpt56Model(input.explicitModel);
-    const preferred = explicit
-        || (category === 'refactor' || category === 'strategy' || category === 'ultrabrain' || NARUTO_SOL_WORK_RE.test(text)
-            ? 'gpt-5.6-sol'
-            : category === 'e2e' || NARUTO_LUNA_WORK_RE.test(text)
-                ? 'gpt-5.6-luna'
-                : 'gpt-5.6-terra');
+    const invalidExplicit = Boolean(explicitRequested && !explicit);
+    const automatic = decideSubagentModel({
+        title: input.taskText,
+        description: input.riskText,
+        role: category,
+        requiresJudgment: category === 'review'
+            || category === 'refactor'
+            || category === 'strategy'
+            || category === 'ultrabrain'
+    });
+    const preferred = explicit || automatic.model;
     const available = input.availableModels == null
-        ? [...NARUTO_GPT56_MODELS]
+        ? [...NARUTO_EXPLICIT_COMPATIBILITY_MODELS]
         : input.availableModels.map(normalizeNarutoGpt56Model).filter((model) => Boolean(model));
     const degraded = new Set((input.degradedModels || []).map((model) => String(model).toLowerCase()));
     const usable = available.filter((model) => !degraded.has(model));
-    const availableEfforts = input.availableModelEfforts == null ? null : input.availableModelEfforts[preferred] || [];
-    const maxWork = NARUTO_MAX_WORK_RE.test(riskText);
-    const intendedReasoning = preferred === 'gpt-5.6-sol'
-        ? 'max'
-        : preferred === 'gpt-5.6-luna'
-            ? maxWork ? 'max' : 'xhigh'
-            : preferred === 'gpt-5.6-terra'
-                ? maxWork || category === 'review' ? 'max' : 'xhigh'
-                : 'xhigh';
-    const model = usable.includes(preferred) && (availableEfforts == null || availableEfforts.includes(intendedReasoning)) ? preferred : '';
+    const availableEfforts = effortsForModel(input.availableModelEfforts, preferred);
+    const intendedReasoning = SUBAGENT_EFFORT;
+    const model = !invalidExplicit && usable.includes(preferred) && (availableEfforts == null || availableEfforts.includes(intendedReasoning)) ? preferred : '';
     return { model, reasoning: intendedReasoning, serviceTier: 'fast' };
 }
 export function isNarutoGpt56Model(value) {
     return normalizeNarutoGpt56Model(value) !== null;
 }
-function normalizeNarutoGpt56Model(value) {
+export function normalizeNarutoGpt56Model(value) {
     const model = String(value || '').trim().toLowerCase();
-    return NARUTO_GPT56_MODELS.includes(model) ? model : null;
+    return NARUTO_EXPLICIT_COMPATIBILITY_MODELS.includes(model) ? model : null;
 }
 export function categoryForWorkerRole(role, taskText = '') {
     const text = `${String(role || '')} ${String(taskText || '')}`.toLowerCase();
-    if (NARUTO_LUNA_WORK_RE.test(text))
-        return 'e2e';
     if (/(refactor|re-?architect|리팩터|아키텍처)/i.test(text))
         return 'refactor';
     if (/(planning|\bplan\b|strategy|strategic|기획|전략)/i.test(text))
         return 'strategy';
+    if (decideSubagentModel({ description: text }).kind === 'expert')
+        return 'review';
+    if (E2E_WORK_RE.test(text))
+        return 'e2e';
     if (/verif|test|qa/.test(text))
         return 'verify';
-    if (/review|critic|judge/.test(text))
-        return 'review';
     if (/research|explore|read|scout/.test(text))
         return 'quick';
-    if (/plan|architect|strategy/.test(text))
-        return 'ultrabrain';
     return 'agentic';
 }
 export function modelRouteReason(category, choice, opts = {}) {
     const model = choice.model || 'codex-selected';
+    if (opts.explicit && !choice.model)
+        return `${category}->blocked (explicit model unavailable)`;
     if (opts.explicit)
         return `${category}->${model} (explicit model preserved)`;
     if (isNarutoGpt56Model(choice.model))
-        return `${category}->${model}@${choice.reasoning} (Naruto GPT-5.6 family policy)`;
+        return `${category}->${model}@${choice.reasoning} (official subagent model policy)`;
     const suffix = opts.quotaLow ? 'quota discipline' : 'Codex catalog passthrough';
     return `${category}->${model} (${suffix})`;
 }
+function effortsForModel(catalog, model) {
+    if (catalog == null)
+        return null;
+    const direct = catalog[model];
+    if (direct)
+        return direct.map((effort) => String(effort).toLowerCase());
+    const match = Object.entries(catalog).find(([key]) => key.trim().toLowerCase() === model);
+    return (match?.[1] || []).map((effort) => String(effort).toLowerCase());
+}
 //# sourceMappingURL=model-router.js.map

package/dist/core/recallpulse/policy.js

@@ -48,7 +48,7 @@ export const RECALLPULSE_POLICY = Object.freeze({
         'generated_skill_installation',
         'codex_app_stop_hooks',
         'dfix_ultralight_behavior',
-        'team_minimum_five_lane_review',
+        'official_subagent_risk_scoped_review_with_legacy_team_compatibility',
         'research_xhigh_agent_requirements',
         'db_destructive_operation_blocking',
         'imagegen_evidence_requirements'
@@ -176,37 +176,19 @@ export const RESEARCH_AGENT_PERSONA_CONTRACT = Object.freeze([
         id: 'einstein',
         display_name: 'Einstein Agent',
         historical_inspiration: 'Albert Einstein',
-        persona: 'first-principles reframer',
-        role: 'first_principles_reframer',
-        mandate: 'Strip assumptions, identify invariants, and build decisive thought experiments.',
-        required_outputs: ['eureka_moment', 'assumptions_removed', 'invariant_or_simplifying_frame', 'decisive_thought_experiment']
-    },
-    {
-        id: 'feynman',
-        display_name: 'Feynman Agent',
-        historical_inspiration: 'Richard Feynman',
-        persona: 'explanation experimentalist',
-        role: 'explanation_experimentalist',
-        mandate: 'Make the idea teachable, testable, and hard to hide behind jargon.',
-        required_outputs: ['eureka_moment', 'plain_language_mechanism', 'toy_model', 'cheap_empirical_probe']
-    },
-    {
-        id: 'turing',
-        display_name: 'Turing Agent',
-        historical_inspiration: 'Alan Turing',
-        persona: 'formalization and adversarial cases',
-        role: 'formalization_and_adversarial_cases',
-        mandate: 'Formalize inputs, outputs, algorithms, limits, and countercases.',
-        required_outputs: ['eureka_moment', 'formal_definition', 'algorithmic_shape', 'adversarial_case']
+        persona: 'first-principles reframer and explanation experimentalist',
+        role: 'first_principles_experimental_reframer',
+        mandate: 'Strip assumptions, identify invariants, explain the mechanism plainly, and build decisive thought experiments and cheap probes.',
+        required_outputs: ['eureka_moment', 'assumptions_removed', 'invariant_or_simplifying_frame', 'plain_language_mechanism', 'decisive_thought_experiment', 'cheap_empirical_probe']
     },
     {
         id: 'von_neumann',
         display_name: 'von Neumann Agent',
         historical_inspiration: 'John von Neumann',
-        persona: 'systems strategy agent',
-        role: 'systems_strategy_agent',
-        mandate: 'Map system dynamics, scaling behavior, incentives, and worst-case interactions.',
-        required_outputs: ['eureka_moment', 'system_model', 'scaling_risk', 'robustness_condition']
+        persona: 'formal systems and strategy agent',
+        role: 'formal_systems_strategy_agent',
+        mandate: 'Formalize inputs, outputs, algorithms, limits, system dynamics, scaling behavior, incentives, and worst-case interactions.',
+        required_outputs: ['eureka_moment', 'formal_definition', 'algorithmic_shape', 'adversarial_case', 'system_model', 'scaling_risk', 'robustness_condition']
     },
     {
         id: 'skeptic',
@@ -220,7 +202,9 @@ export const RESEARCH_AGENT_PERSONA_CONTRACT = Object.freeze([
 ].map((agent) => Object.freeze({
     ...agent,
     persona_boundary: 'persona-inspired cognitive lens only; do not impersonate the historical person',
-    reasoning_effort: 'xhigh',
+    custom_agent: 'research_reviewer',
+    model: 'gpt-5.6-sol',
+    reasoning_effort: 'max',
     service_tier: 'fast'
 })));
 //# sourceMappingURL=policy.js.map

package/dist/core/recallpulse.js

@@ -199,7 +199,7 @@ export async function evaluateRecallPulseFixtures(root, opts = {}) {
             fixture('repeated-stop-hook-blocker', true, 'Duplicate suppression keys collapse repeated blocker text into one durable status row.'),
             fixture('hook-only-status-visibility', true, 'mission-status-ledger.json preserves recoverable user-visible status.'),
             fixture('research-persona-missing', true, 'Research validation blocks missing agent display_name/persona/persona_boundary.'),
-            fixture('research-effort-not-xhigh', true, 'Research validation blocks non-xhigh agent rows.'),
+            fixture('research-model-policy-not-sol-max', true, 'Research validation blocks reviewer rows that are not bound to the research_reviewer GPT-5.6 Sol Max policy.'),
             fixture('research-eureka-missing', true, 'Research validation blocks missing literal Eureka! ideas.'),
             fixture('research-impersonation', true, 'Research validation blocks persona-boundary violations.'),
             fixture('oversized-l1', true, 'L1 token and item limits reject oversized active recall.'),
@@ -368,7 +368,7 @@ export async function buildRecallPulseGovernanceReport(root, opts = {}) {
             ],
             migration_paths: {
                 existing_missions: 'Run sks recallpulse run <mission-id> and sks recallpulse governance <mission-id> to add report-only artifacts.',
-                existing_research_artifacts: 'Research gates now require agent display_name/persona/persona_boundary fields; old ledgers should be migrated by adding those fields before claiming pass.',
+                existing_research_artifacts: 'Research gates require agent display_name/persona/persona_boundary fields and the research_reviewer GPT-5.6 Sol Max binding; old ledgers must be migrated before claiming pass.',
                 generated_skills: 'Do not edit generated installed skills directly; rerun init/bootstrap from engine source when generated text needs refreshing.'
             },
             release_gate: '0.8.0 remains report-only unless packcheck, selftest, sizecheck, registry metadata check, TriWiki validate, and RecallPulse fixture eval pass.'
@@ -397,8 +397,13 @@ export function validateResearchAgentPersonas(agentLedger = {}, geniusSummaryTex
             issues.push(`${expected.id}:persona_boundary_missing`);
         if (row.persona_boundary && !/do not impersonate|not impersonat|lens only/i.test(row.persona_boundary))
             issues.push(`${expected.id}:persona_boundary_not_enforced`);
-        if (row.effort !== 'xhigh' && row.reasoning_effort !== 'xhigh')
-            issues.push(`${expected.id}:effort_not_xhigh`);
+        const modelPolicy = row.model_policy && typeof row.model_policy === 'object' ? row.model_policy : row;
+        if (modelPolicy.custom_agent !== 'research_reviewer')
+            issues.push(`${expected.id}:custom_agent_not_research_reviewer`);
+        if (modelPolicy.model !== 'gpt-5.6-sol')
+            issues.push(`${expected.id}:model_not_sol`);
+        if (modelPolicy.reasoning_effort !== 'max' && modelPolicy.model_reasoning_effort !== 'max')
+            issues.push(`${expected.id}:effort_not_max`);
         if (row.service_tier && row.service_tier !== 'fast')
             issues.push(`${expected.id}:service_tier_not_fast`);
         if (!row.eureka?.idea || row.eureka?.exclamation !== 'Eureka!')
@@ -923,13 +928,13 @@ function preservedRoutePersonality(routeId = '', routeName = '') {
         DFix: 'ultralight direct-fix path stays tiny and does not start the full pipeline',
         Answer: 'answer-only path stays conversational and does not start implementation',
         SKS: 'general SKS discovery/help personality stays simple',
-        Team: 'Team keeps analysis, debate, executor, and five-lane review identity',
+        Team: 'Team redirects to the bounded official Naruto workflow with parent-owned integration and risk-scoped review',
         QALoop: 'QA-LOOP keeps dogfood, checklist, remediation, and reverification identity',
         PPT: 'PPT keeps restrained information-first HTML/PDF delivery identity',
         ImageUXReview: 'Image UX Review keeps gpt-image-2 annotated raster review identity',
         ComputerUse: 'Computer Use keeps maximum-speed native Mac/non-web visual lane identity',
         Goal: 'Goal stays a native /goal persistence bridge, not a heavyweight route',
-        Research: 'Research keeps named xhigh persona agent council, Eureka, debate, paper, and falsification identity',
+        Research: 'Research keeps Super Search evidence, three composite Sol Max adversarial lenses, bounded revision, paper, and falsification identity',
         AutoResearch: 'AutoResearch keeps iterative experiment loop identity',
         DB: 'DB keeps conservative read-first destructive-operation safety identity',
         MadSKS: 'MAD-SKS keeps explicit scoped high-risk authorization identity',

package/dist/core/release/gate-manifest.js

@@ -23,7 +23,7 @@ export const ALWAYS_ON_GATES = new Set([
     'runtime:no-tmux',
     'runtime:ts-rust-boundary',
     'safety:side-effect-zero',
-    'safety:mutation-callsite-coverage:repo-wide',
+    'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',
     'core-skill:no-inference-optimizer',
     'core-skill:heldout-validation',
@@ -31,7 +31,10 @@ export const ALWAYS_ON_GATES = new Set([
     'core-skill:legacy-promotion-api-audit',
     'postinstall:safe-side-effects',
     'publish:packlist-performance',
-    'legacy:upgrade-zero-break',
+    'legacy:gate-inventory',
+    'legacy:gate-purge',
+    'legacy:strong-inventory',
+    'migration:upgrade-safety',
     'release:proof-truth',
     'release:dynamic-performance',
     'release:provenance',
@@ -44,20 +47,22 @@ export const REQUIRED_FOR_PUBLISH = new Set([
     'runtime:dist-parity',
     'runtime:ts-rust-boundary',
     'safety:side-effect-zero',
-    'safety:mutation-callsite-coverage:repo-wide',
+    'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',
     'release:proof-truth',
     'release:provenance',
-    'release:codex-current',
-    'codex:0142:manifest',
-    'codex:0142:binary-identity',
-    'codex:0142:policy',
-    'codex:0142:app-server-v2',
-    'codex:0142:thread-store',
-    'codex:0142:capability',
+    'codex:0144:manifest',
+    'codex:0144:binary-identity',
+    'codex:0144:policy',
+    'codex:0144:app-server-v2',
+    'codex:0144:thread-store',
+    'codex:0144:capability',
     'publish:packlist-performance',
     'postinstall:safe-side-effects',
-    'legacy:upgrade-zero-break',
+    'legacy:gate-inventory',
+    'legacy:gate-purge',
+    'legacy:strong-inventory',
+    'migration:upgrade-safety',
     'core-skill:card-schema',
     'core-skill:patch',
     'core-skill:heldout-validation',
@@ -67,7 +72,7 @@ export const REQUIRED_FOR_PUBLISH = new Set([
     'zellij:launch-command-truth',
     'zellij:ui-design'
 ]);
-const P0_PREFIXES = ['architecture:', 'core-skill:', 'safety:', 'side-effect:', 'runtime:', 'release:', 'legacy:', 'publish:', 'postinstall:', 'zellij:'];
+const P0_PREFIXES = ['architecture:', 'core-skill:', 'safety:', 'side-effect:', 'runtime:', 'release:', 'legacy:', 'migration:', 'publish:', 'postinstall:', 'zellij:'];
 function tierFor(id) {
     if (P0_PREFIXES.some((p) => id.startsWith(p)))
         return 'P0';
@@ -94,6 +99,7 @@ export function affectedGlobsFor(id) {
         case 'side-effect':
             return ['src/core/safety/**', 'src/scripts/side-effect-runtime-report-check.ts', '.sneakoscope/missions/**/mutation-ledger.jsonl', '.sneakoscope/mutation-ledger.jsonl'];
         case 'legacy':
+        case 'migration':
             return ['src/core/migration/**', 'src/core/codex/**', 'src/core/init.ts', 'src/cli/install-helpers.ts', 'src/scripts/legacy-upgrade-matrix-check.ts'];
         case 'publish':
             return ['package.json', '.npmignore', 'src/scripts/packlist-performance-check.ts', 'src/scripts/npm-publish-performance-check.ts', 'dist/**'];

package/dist/core/release/gate-pack-manifest.js

@@ -47,7 +47,7 @@ export function buildGatePackManifest(root, gates) {
 export function packForGateId(id) {
     if (id.startsWith('triwiki:'))
         return 'triwiki';
-    if (id.startsWith('codex:') || id.includes('0140') || id.includes('0142'))
+    if (id.startsWith('codex:') || id.includes('0140') || id.includes('0144'))
         return 'codex-current';
     if (id.startsWith('doctor:'))
         return 'doctor-production';

package/dist/core/release/npm-pack-proof.js

@@ -0,0 +1,247 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const NPM_PACK_PROOF_SCHEMA = 'sks.npm-pack-proof.v1';
+export const NPM_PACK_PROOF_COMMAND = Object.freeze(['npm', 'pack', '--dry-run', '--ignore-scripts', '--json']);
+export const PACKLIST_PERFORMANCE_REPORT_SCHEMA = 'sks.packlist-performance.v1';
+export const PACKAGE_SURFACE_BUDGET_REPORT_SCHEMA = 'sks.package-surface-budget.v1';
+export function npmPackProofPath(root) {
+    return path.join(root, '.sneakoscope', 'reports', 'npm-pack-proof.json');
+}
+export function writeNpmPackProof(root, info, packMs) {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    const inputDigest = currentNpmPackInputDigest(root);
+    const normalizedInfo = normalizeNpmPackInfo(info);
+    const infoDigest = sha256Json(normalizedInfo);
+    const fileListDigest = sha256Json(normalizedInfo.files);
+    const proof = {
+        schema: NPM_PACK_PROOF_SCHEMA,
+        ok: true,
+        generated_at: new Date().toISOString(),
+        command: NPM_PACK_PROOF_COMMAND,
+        input_digest: inputDigest,
+        info_digest: infoDigest,
+        file_list_digest: fileListDigest,
+        proof_id: sha256Text(`${NPM_PACK_PROOF_SCHEMA}\n${inputDigest}\n${infoDigest}\n${fileListDigest}\n${String(pkg.name || '')}@${String(pkg.version || '')}`),
+        package_name: String(pkg.name || ''),
+        package_version: String(pkg.version || ''),
+        pack_ms: Math.max(0, Math.floor(Number(packMs) || 0)),
+        info
+    };
+    const file = npmPackProofPath(root);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(proof, null, 2)}\n`);
+    return proof;
+}
+export function readCurrentNpmPackProof(root) {
+    const blockers = [];
+    const file = npmPackProofPath(root);
+    let proof = null;
+    try {
+        proof = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        blockers.push('npm_pack_proof_missing_or_invalid');
+        return { ok: false, proof: null, blockers };
+    }
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    if (proof?.schema !== NPM_PACK_PROOF_SCHEMA || proof?.ok !== true)
+        blockers.push('npm_pack_proof_schema_invalid');
+    if (!sameStringList([...(proof?.command || [])], [...NPM_PACK_PROOF_COMMAND]))
+        blockers.push('npm_pack_proof_command_invalid');
+    if (proof?.package_name !== pkg.name || proof?.package_version !== pkg.version)
+        blockers.push('npm_pack_proof_package_identity_mismatch');
+    if (proof?.input_digest !== currentNpmPackInputDigest(root))
+        blockers.push('npm_pack_proof_stale');
+    if (!proof?.info || !Array.isArray(proof.info.files))
+        blockers.push('npm_pack_proof_files_missing');
+    if (proof?.info) {
+        const normalizedInfo = normalizeNpmPackInfo(proof.info);
+        const infoDigest = sha256Json(normalizedInfo);
+        const fileListDigest = sha256Json(normalizedInfo.files);
+        const expectedProofId = sha256Text(`${NPM_PACK_PROOF_SCHEMA}\n${proof.input_digest}\n${infoDigest}\n${fileListDigest}\n${String(pkg.name || '')}@${String(pkg.version || '')}`);
+        if (proof.info_digest !== infoDigest)
+            blockers.push('npm_pack_proof_info_digest_mismatch');
+        if (proof.file_list_digest !== fileListDigest)
+            blockers.push('npm_pack_proof_file_list_digest_mismatch');
+        if (proof.proof_id !== expectedProofId)
+            blockers.push('npm_pack_proof_id_mismatch');
+    }
+    return { ok: blockers.length === 0, proof, blockers };
+}
+export function readCurrentNpmPackGateArtifacts(root) {
+    const proofResult = readCurrentNpmPackProof(root);
+    const blockers = [...proofResult.blockers];
+    const packlistReport = readJsonReport(path.join(root, '.sneakoscope', 'reports', 'packlist-performance.json'));
+    const packageSurfaceReport = readJsonReport(path.join(root, '.sneakoscope', 'reports', 'package-surface-budget.json'));
+    if (!packlistReport)
+        blockers.push('packlist_performance_report_missing_or_invalid');
+    else {
+        if (packlistReport.schema !== PACKLIST_PERFORMANCE_REPORT_SCHEMA || packlistReport.ok !== true)
+            blockers.push('packlist_performance_report_schema_invalid');
+        if (Array.isArray(packlistReport.blockers) && packlistReport.blockers.length > 0)
+            blockers.push('packlist_performance_report_has_blockers');
+        if (Array.isArray(packlistReport.forbidden) && packlistReport.forbidden.length > 0)
+            blockers.push('packlist_performance_report_forbidden_files');
+        if (Array.isArray(packlistReport.runtime_required_missing) && packlistReport.runtime_required_missing.length > 0)
+            blockers.push('packlist_performance_report_runtime_files_missing');
+    }
+    if (!packageSurfaceReport)
+        blockers.push('package_surface_report_missing_or_invalid');
+    else {
+        if (packageSurfaceReport.schema !== PACKAGE_SURFACE_BUDGET_REPORT_SCHEMA || packageSurfaceReport.ok !== true)
+            blockers.push('package_surface_report_schema_invalid');
+        if (Array.isArray(packageSurfaceReport.blockers) && packageSurfaceReport.blockers.length > 0)
+            blockers.push('package_surface_report_has_blockers');
+        if (Array.isArray(packageSurfaceReport.forbidden_findings) && packageSurfaceReport.forbidden_findings.length > 0)
+            blockers.push('package_surface_report_forbidden_files');
+    }
+    const info = proofResult.proof?.info;
+    if (info && packlistReport) {
+        if (packlistReport.pack_proof_id !== proofResult.proof?.proof_id)
+            blockers.push('packlist_performance_report_proof_id_mismatch');
+        if (packlistReport.pack_info_sha256 !== proofResult.proof?.info_digest)
+            blockers.push('packlist_performance_report_info_digest_mismatch');
+        if (packlistReport.pack_file_list_sha256 !== proofResult.proof?.file_list_digest)
+            blockers.push('packlist_performance_report_file_list_digest_mismatch');
+        if (!sameNumber(packlistReport.entryCount, info.entryCount))
+            blockers.push('packlist_performance_report_entry_count_mismatch');
+        if (!sameNumber(packlistReport.size, info.size))
+            blockers.push('packlist_performance_report_size_mismatch');
+        if (!sameNumber(packlistReport.unpackedSize, info.unpackedSize))
+            blockers.push('packlist_performance_report_unpacked_size_mismatch');
+    }
+    if (info && packageSurfaceReport) {
+        if (packageSurfaceReport.pack_proof_id !== proofResult.proof?.proof_id)
+            blockers.push('package_surface_report_proof_id_mismatch');
+        if (packageSurfaceReport.pack_info_sha256 !== proofResult.proof?.info_digest)
+            blockers.push('package_surface_report_info_digest_mismatch');
+        if (packageSurfaceReport.pack_file_list_sha256 !== proofResult.proof?.file_list_digest)
+            blockers.push('package_surface_report_file_list_digest_mismatch');
+        if (!sameNumber(packageSurfaceReport.actual_file_count, info.entryCount))
+            blockers.push('package_surface_report_entry_count_mismatch');
+        if (!sameNumber(packageSurfaceReport.actual_tarball_bytes, info.size))
+            blockers.push('package_surface_report_size_mismatch');
+    }
+    return {
+        ok: blockers.length === 0,
+        proof: proofResult.proof,
+        packlist_report: packlistReport,
+        package_surface_report: packageSurfaceReport,
+        blockers: [...new Set(blockers)]
+    };
+}
+export function currentNpmPackInputDigest(root) {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    const roots = new Set(['package.json', 'package-lock.json', 'npm-shrinkwrap.json', '.npmignore', '.gitignore']);
+    for (const entry of fs.readdirSync(root)) {
+        if (/^(?:README|LICEN[CS]E|NOTICE)(?:\.|$)/i.test(entry))
+            roots.add(entry);
+    }
+    for (const raw of Array.isArray(pkg.files) ? pkg.files : []) {
+        const value = String(raw || '').trim();
+        if (!value || value.startsWith('!'))
+            continue;
+        const prefix = value.split(/[*?]/, 1)[0]?.replace(/\/+$/, '') || '';
+        if (prefix)
+            roots.add(prefix);
+    }
+    addPackagePath(roots, pkg.main);
+    addPackagePath(roots, pkg.browser);
+    if (typeof pkg.bin === 'string')
+        addPackagePath(roots, pkg.bin);
+    else if (pkg.bin && typeof pkg.bin === 'object')
+        for (const value of Object.values(pkg.bin))
+            addPackagePath(roots, value);
+    if (typeof pkg.man === 'string')
+        addPackagePath(roots, pkg.man);
+    else if (Array.isArray(pkg.man))
+        for (const value of pkg.man)
+            addPackagePath(roots, value);
+    addPackagePath(roots, pkg.directories?.bin);
+    const files = new Set();
+    for (const relative of roots)
+        collectRoot(root, relative, files);
+    const hash = crypto.createHash('sha256');
+    for (const relative of [...files].sort()) {
+        const file = path.join(root, relative);
+        const stat = fs.statSync(file);
+        hash.update(relative.replace(/\\/g, '/'));
+        hash.update('\0');
+        hash.update(String(stat.size));
+        hash.update('\0');
+        hash.update(crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'));
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+export function normalizeNpmPackInfo(info = {}) {
+    const files = (Array.isArray(info.files) ? info.files : [])
+        .map((file) => ({
+        path: String(file?.path || '').replace(/\\/g, '/'),
+        size: Number(file?.size || 0),
+        mode: Number(file?.mode || 0)
+    }))
+        .filter((file) => file.path)
+        .sort((left, right) => left.path.localeCompare(right.path));
+    return {
+        id: String(info.id || ''),
+        name: String(info.name || ''),
+        version: String(info.version || ''),
+        filename: String(info.filename || ''),
+        size: Number(info.size || 0),
+        unpackedSize: Number(info.unpackedSize || 0),
+        shasum: String(info.shasum || ''),
+        integrity: String(info.integrity || ''),
+        entryCount: Number(info.entryCount || files.length),
+        files
+    };
+}
+function addPackagePath(roots, value) {
+    const relative = String(value || '').trim().replace(/^\.\//, '');
+    if (relative && !path.isAbsolute(relative) && !relative.startsWith('../'))
+        roots.add(relative);
+}
+function sha256Json(value) {
+    return sha256Text(JSON.stringify(value));
+}
+function sha256Text(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function collectRoot(root, relative, out) {
+    const target = path.join(root, relative);
+    if (!fs.existsSync(target))
+        return;
+    const stat = fs.statSync(target);
+    if (stat.isFile()) {
+        out.add(path.relative(root, target));
+        return;
+    }
+    if (!stat.isDirectory())
+        return;
+    for (const entry of fs.readdirSync(target, { withFileTypes: true })) {
+        const child = path.join(relative, entry.name);
+        if (entry.isDirectory())
+            collectRoot(root, child, out);
+        else if (entry.isFile())
+            out.add(child);
+    }
+}
+function sameStringList(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function readJsonReport(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function sameNumber(left, right) {
+    const leftNumber = Number(left);
+    const rightNumber = Number(right);
+    return Number.isFinite(leftNumber) && Number.isFinite(rightNumber) && leftNumber === rightNumber;
+}
+//# sourceMappingURL=npm-pack-proof.js.map