sneakoscope 6.0.3 → 6.1.2

package/dist/core/release/package-dist-snapshot.js

@@ -0,0 +1,151 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export function packageDistSnapshot(root, pkg) {
+    const distRoot = path.join(root, 'dist');
+    if (!fs.existsSync(distRoot))
+        return { digest: null, file_count: 0 };
+    const entries = packageFileEntries(pkg);
+    const files = [];
+    collectFiles(distRoot, files);
+    const included = files
+        .filter((file) => packageFileIncluded(`dist/${path.relative(distRoot, file).split(path.sep).join('/')}`, entries))
+        .sort();
+    const hash = crypto.createHash('sha256');
+    for (const file of included) {
+        const rel = path.relative(distRoot, file).split(path.sep).join('/');
+        const bytes = fs.readFileSync(file);
+        hash.update(rel);
+        hash.update('\0');
+        hash.update(String(bytes.length));
+        hash.update('\0');
+        hash.update(crypto.createHash('sha256').update(bytes).digest('hex'));
+        hash.update('\0');
+    }
+    return { digest: hash.digest('hex'), file_count: included.length };
+}
+export function packageFilesSnapshot(root, pkg) {
+    const entries = packageFileEntries(pkg);
+    const candidates = new Set();
+    const missingEntries = [];
+    for (const entry of entries) {
+        if (entry.negated || hasGlob(entry.pattern))
+            continue;
+        const full = path.join(root, entry.pattern);
+        if (!fs.existsSync(full)) {
+            missingEntries.push(entry.pattern);
+            continue;
+        }
+        const stat = fs.statSync(full);
+        if (stat.isDirectory()) {
+            const found = [];
+            collectFiles(full, found);
+            for (const file of found)
+                candidates.add(path.relative(root, file).split(path.sep).join('/'));
+        }
+        else if (stat.isFile()) {
+            candidates.add(entry.pattern);
+        }
+    }
+    const files = [...candidates].filter((file) => packageFileIncluded(file, entries)).sort();
+    const hash = crypto.createHash('sha256');
+    for (const entry of missingEntries.sort()) {
+        hash.update(entry);
+        hash.update('\0missing\0');
+    }
+    for (const file of files) {
+        const bytes = fs.readFileSync(path.join(root, file));
+        hash.update(file);
+        hash.update('\0');
+        hash.update(String(bytes.length));
+        hash.update('\0');
+        hash.update(crypto.createHash('sha256').update(bytes).digest('hex'));
+        hash.update('\0');
+    }
+    return {
+        digest: crypto.createHash('sha256').update(hash.digest('hex')).digest('hex'),
+        file_count: files.length,
+        missing_entries: missingEntries
+    };
+}
+function collectFiles(dir, out) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const file = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            collectFiles(file, out);
+        else if (entry.isFile())
+            out.push(file);
+    }
+}
+function packageFileEntries(pkg) {
+    return (Array.isArray(pkg.files) ? pkg.files : [])
+        .map((raw) => {
+        const value = String(raw || '').trim();
+        const negated = value.startsWith('!');
+        const pattern = normalizeRel(negated ? value.slice(1) : value);
+        return pattern ? { negated, pattern } : null;
+    })
+        .filter((entry) => entry !== null);
+}
+function packageFileIncluded(file, entries) {
+    let included = false;
+    for (const entry of entries) {
+        if (matchesPackagePattern(file, entry.pattern))
+            included = !entry.negated;
+    }
+    return included;
+}
+function matchesPackagePattern(file, pattern) {
+    const rel = normalizeRel(file);
+    const normalized = normalizeRel(pattern);
+    if (!rel || !normalized)
+        return false;
+    if (!hasGlob(normalized))
+        return rel === normalized || rel.startsWith(`${normalized}/`);
+    const re = globPatternToRegExp(normalized);
+    if (re.test(rel))
+        return true;
+    const parts = rel.split('/');
+    parts.pop();
+    while (parts.length) {
+        if (re.test(parts.join('/')))
+            return true;
+        parts.pop();
+    }
+    return false;
+}
+function globPatternToRegExp(pattern) {
+    let out = '^';
+    for (let i = 0; i < pattern.length; i += 1) {
+        const char = pattern[i];
+        if (char === '*') {
+            if (pattern[i + 1] === '*') {
+                if (pattern[i + 2] === '/') {
+                    out += '(?:[^/]+/)*';
+                    i += 2;
+                }
+                else {
+                    out += '.*';
+                    i += 1;
+                }
+            }
+            else {
+                out += '[^/]*';
+            }
+            continue;
+        }
+        if (char === '?') {
+            out += '[^/]';
+            continue;
+        }
+        out += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+    }
+    return new RegExp(`${out}$`);
+}
+function hasGlob(value) {
+    return /[*?]/.test(value);
+}
+function normalizeRel(value) {
+    return String(value || '').split(path.sep).join('/').replace(/^\.\/+/, '').replace(/\/+$/, '');
+}
+//# sourceMappingURL=package-dist-snapshot.js.map

package/dist/core/release/package-size-budget.js

@@ -1,2 +1,7 @@
 export const DEFAULT_MAX_PACK_BYTES = 2414 * 1024;
+// 6.1.2 measured 11,016,751 unpacked bytes after the final official custom-
+// agent catalog, Super Search provenance validation, and live Zellij activity
+// reader were included. Keep a narrow 10.53125 MiB ceiling shared by every
+// package-size gate; packed bytes remain under the existing 2414 KiB limit.
+export const DEFAULT_MAX_UNPACKED_BYTES = 11_042_816;
 //# sourceMappingURL=package-size-budget.js.map

package/dist/core/release/release-authorization-snapshot.js

@@ -0,0 +1,115 @@
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { packageDistSnapshot, packageFilesSnapshot } from './package-dist-snapshot.js';
+export const RELEASE_AUTHORIZATION_SNAPSHOT_KEYS = Object.freeze([
+    'git_commit',
+    'source_digest',
+    'source_file_count',
+    'package_files_sha256',
+    'package_file_count',
+    'release_gate_sha256',
+    'dist_build_sha256',
+    'dist_file_count'
+]);
+export function releaseAuthorizationSnapshot(root, pkg) {
+    const source = releaseSourceSnapshot(root);
+    const packageFiles = packageFilesSnapshot(root, pkg);
+    const dist = packageDistSnapshot(root, pkg);
+    return {
+        git_commit: gitCommit(root),
+        package_files_sha256: packageFiles.digest,
+        package_file_count: packageFiles.file_count,
+        dist_build_sha256: dist.digest,
+        dist_file_count: dist.file_count,
+        release_gate_sha256: releaseGateHash(root, pkg),
+        source_digest: source.digest,
+        source_file_count: source.file_count
+    };
+}
+export function sameReleaseAuthorizationSnapshot(left, right) {
+    return RELEASE_AUTHORIZATION_SNAPSHOT_KEYS.every((key) => left?.[key] === right?.[key]);
+}
+function gitCommit(root) {
+    const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+function releaseGateHash(root, pkg) {
+    const manifests = ['release-gates.v2.json', 'infra-harness-gates.json'].map((rel) => {
+        const file = path.join(root, rel);
+        return fs.existsSync(file) ? `${rel}\0${fs.readFileSync(file, 'utf8')}` : `${rel}\0missing`;
+    }).join('\0');
+    return sha256(`${pkg.scripts?.['release:check'] || ''}\0${pkg.scripts?.['prepublishOnly'] || ''}\0${manifests}`);
+}
+function releaseSourceSnapshot(root) {
+    const files = gitFiles(root).filter(releaseRelevant).sort();
+    const hash = crypto.createHash('sha256');
+    for (const file of files) {
+        const full = path.join(root, file);
+        let stat;
+        try {
+            stat = fs.statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        const bytes = fs.readFileSync(full);
+        hash.update(file);
+        hash.update('\0');
+        hash.update(String(bytes.length));
+        hash.update('\0');
+        hash.update(sha256(bytes));
+        hash.update('\0');
+    }
+    return { digest: hash.digest('hex'), file_count: files.length };
+}
+function gitFiles(root) {
+    const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024
+    });
+    if (result.status !== 0)
+        throw new Error(`unable_to_list_release_files:${result.stderr || result.stdout}`);
+    return result.stdout.split('\0').filter(Boolean);
+}
+function releaseRelevant(file) {
+    if (!file || file.startsWith('.sneakoscope/') || file.startsWith('.codex/') || file.startsWith('.agents/'))
+        return false;
+    if (file.startsWith('node_modules/') || file.startsWith('dist/') || file.startsWith('coverage/'))
+        return false;
+    if (file.startsWith('crates/sks-core/target/'))
+        return false;
+    if (/\.tgz$|\.log$/i.test(file))
+        return false;
+    if (/^(package|package-lock)\.json$/.test(file))
+        return true;
+    if (file === 'release-gates.v2.json' || file === 'infra-harness-gates.json' || file === 'runtime-required-scripts.json')
+        return true;
+    if (file === '.npmignore' || file === '.npmrc' || file === 'LICENSE')
+        return true;
+    if (file.startsWith('config/'))
+        return true;
+    if (/^tsconfig.*\.json$/.test(file))
+        return true;
+    if (/^(README|CHANGELOG|LICENSE)(\.md)?$/i.test(file))
+        return true;
+    return [
+        '.github/workflows/',
+        'bin/',
+        'src/',
+        'scripts/',
+        'test/',
+        'docs/',
+        'schemas/',
+        'crates/sks-core/Cargo.',
+        'crates/sks-core/src/'
+    ].some((prefix) => file.startsWith(prefix));
+}
+function sha256(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+//# sourceMappingURL=release-authorization-snapshot.js.map

package/dist/core/release/release-gate-affected-selector.js

@@ -63,7 +63,7 @@ function gateSelectionReason(gate, changedFiles, preset) {
             return 'release_gate_system_changed';
     }
     if (changedFiles.some((file) => isCodexCurrentFile(file))) {
-        if (gate.id.startsWith('codex:0142') || gate.id === 'release:codex-current' || gate.id.startsWith('codex-control:') || gate.id.startsWith('codex-sdk:'))
+        if (gate.id.startsWith('codex:0144') || gate.id.startsWith('codex-control:') || gate.id.startsWith('codex-sdk:'))
             return 'codex_current_surface_changed';
     }
     const matchingReleaseScript = changedFiles.some((file) => releaseScriptGateCandidates(file).includes(gate.id) || (file.startsWith('src/scripts/release-') && gateCommandReferencesScript(gate, file)));
@@ -113,8 +113,8 @@ function selectionResult(all, selected, changedFiles, mode, reasons, skipped) {
         }
     };
 }
-function resolveChangedFiles(root, changedSince) {
-    const base = changedSince === 'auto' ? 'HEAD' : changedSince;
+export function resolveChangedFiles(root, changedSince) {
+    const base = changedSince === 'auto' ? autoChangedFilesBase(root) : changedSince;
     const args = base === 'HEAD'
         ? ['diff', '--name-only', 'HEAD']
         : ['diff', '--name-only', String(base)];
@@ -126,6 +126,18 @@ function resolveChangedFiles(root, changedSince) {
     ].map((file) => file.trim()).filter(Boolean);
     return [...new Set(files)].sort();
 }
+function autoChangedFilesBase(root) {
+    const upstream = spawnSync('git', ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'], {
+        cwd: root,
+        encoding: 'utf8'
+    });
+    const upstreamRef = upstream.status === 0 ? String(upstream.stdout || '').trim() : '';
+    if (!upstreamRef)
+        return 'HEAD';
+    const mergeBase = spawnSync('git', ['merge-base', 'HEAD', upstreamRef], { cwd: root, encoding: 'utf8' });
+    const base = mergeBase.status === 0 ? String(mergeBase.stdout || '').trim() : '';
+    return base || 'HEAD';
+}
 function gateCommandReferencesScript(gate, file) {
     const base = file.replace(/\\/g, '/').split('/').pop()?.replace(/\.(ts|tsx)$/, '') || '';
     if (!base)

package/dist/core/release/release-gate-cache-v2.js

@@ -5,6 +5,7 @@ import { normalizeReleaseCacheInputForBehavior } from './release-cache-key.js';
 import { computeTriWikiCacheKey } from '../triwiki/triwiki-cache-key.js';
 import { createTriWikiProofCard } from '../triwiki/triwiki-proof-card.js';
 import { readReusableTriWikiProofCard, writeTriWikiProofCard } from '../triwiki/triwiki-proof-bank.js';
+import { readCurrentNpmPackGateArtifacts } from './npm-pack-proof.js';
 export const RELEASE_GATE_CACHE_V2_SCHEMA = 'sks.release-gate-cache.v2';
 export function releaseGateCacheFile(root) {
     return path.join(root, '.sneakoscope', 'reports', 'release-gates', 'cache-v2.json');
@@ -139,6 +140,18 @@ export function readReleaseGateCacheRecord(root, gate) {
     const key = releaseGateCacheKey(root, gate);
     const proof = readReusableTriWikiProofCard({ root, subjectId: gate.id, cacheKey: key });
     if (proof.hit && proof.card) {
+        const artifactBlockers = releaseGateCacheArtifactBlockers(root, gate);
+        if (artifactBlockers.length) {
+            writeReleaseCacheBridgeReport(root, {
+                gate_id: gate.id,
+                cache_key: key,
+                bridge: 'triwiki-to-release-v2',
+                source: proof.path || null,
+                duration_ms: Math.max(0, Math.floor(Number(proof.card.duration_ms) || 0)),
+                disagreement: `required_artifact_invalid:${artifactBlockers.join(',')}`
+            });
+            return null;
+        }
         writeReleaseCacheBridgeReport(root, {
             gate_id: gate.id,
             cache_key: key,
@@ -161,6 +174,18 @@ export function readReleaseGateCacheRecord(root, gate) {
         const record = readCacheRecord(file, key);
         if (!record || record.ok !== true)
             continue;
+        const artifactBlockers = releaseGateCacheArtifactBlockers(root, gate);
+        if (artifactBlockers.length) {
+            writeReleaseCacheBridgeReport(root, {
+                gate_id: gate.id,
+                cache_key: key,
+                bridge: 'release-v2-to-triwiki',
+                source: file,
+                duration_ms: Math.max(0, Math.floor(Number(record.duration_ms) || 0)),
+                disagreement: `required_artifact_invalid:${artifactBlockers.join(',')}`
+            });
+            return null;
+        }
         writeTriWikiProofFromReleaseCacheRecord(root, gate, key, record, file);
         writeReleaseCacheBridgeReport(root, {
             gate_id: gate.id,
@@ -182,6 +207,11 @@ export function readReleaseGateCacheRecord(root, gate) {
     }
     return null;
 }
+function releaseGateCacheArtifactBlockers(root, gate) {
+    if (!['publish:packlist-performance', 'package:published-contract'].includes(gate.id))
+        return [];
+    return readCurrentNpmPackGateArtifacts(root).blockers;
+}
 export function writeReleaseGateCacheHit(root, gate, durationMs = 0) {
     const key = releaseGateCacheKey(root, gate);
     const record = {

package/dist/core/release/release-gate-contract.js

@@ -0,0 +1,161 @@
+import crypto from 'node:crypto';
+export const RELEASE_GATE_CONTRACT_SCHEMA = 'sks.release-gate-contract.v1';
+export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
+    'agent:message-bus-reader',
+    'all-features:deep-completion',
+    'appshots:thread-attachment-discovery',
+    'architecture:guard',
+    'certificate:sla',
+    'codex-app:agent-role-comprehensive',
+    'codex-app:execution-profile',
+    'codex-app:fast-ui-preservation',
+    'codex-app:handoff',
+    'codex-control:all-pipelines',
+    'codex-control:event-stream-ledger',
+    'codex-lb:comprehensive',
+    'codex-native:agent-role-content',
+    'codex-native:feature-broker-comprehensive',
+    'codex-native:hook-lifecycle-proof',
+    'codex-plugin:app-template-policy',
+    'codex-sdk:all-pipelines',
+    'codex-sdk:integration-comprehensive',
+    'codex:0.134-runner-truth',
+    'codex:0.137-compat',
+    'codex:0138-capability-comprehensive',
+    'codex:0138-doctor',
+    'codex:0144:app-server-v2',
+    'codex:0144:binary-identity',
+    'codex:0144:capability',
+    'codex:0144:manifest',
+    'codex:0144:policy',
+    'codex:0144:thread-store',
+    'codex:app-handoff-comprehensive',
+    'codex:product-design-plugin-routing',
+    'config:managed-merge',
+    'context7:evidence-dedupe',
+    'core-skill:card-schema-deployment-snapshot',
+    'core-skill:heldout-validation',
+    'core-skill:no-inference-optimizer',
+    'core-skill:patch',
+    'core-skill:route-runtime-integration',
+    'dfix:fixture',
+    'dfix:patch-handoff',
+    'dfix:patch-swarm-route-blackbox',
+    'dfix:verification',
+    'dfix:verification-recommendation',
+    'docs:truthfulness',
+    'doctor:codex-app-harness',
+    'doctor:fix-proves-codex-read',
+    'doctor:fixes-codex-app-fast-ui',
+    'evidence:flagship-coverage',
+    'fast:codex-service-tier-proof',
+    'geo:comprehensive',
+    'git-collaboration:e2e',
+    'git:worktree-checkpoint-rebase-sync',
+    'git:worktree-diff-apply-pipeline',
+    'git:worktree-diff-envelope',
+    'git:worktree-dirty-lock',
+    'git:worktree-dirty-main-detection',
+    'git:worktree-manifest-append',
+    'goal:artifact-compat',
+    'hook:latency-budget',
+    'hooks:concurrent-session-collision',
+    'image:artifact-path-contract',
+    'init-deep:backup-retention',
+    'legacy:gate-inventory',
+    'legacy:gate-purge',
+    'legacy:strong-inventory',
+    'legacy:update-e2e',
+    'local-collab:all-pipelines-final-gpt',
+    'loop-integration-finalizer-check',
+    'mad-db:capability',
+    'mad-db:command',
+    'mad-db:mad-command',
+    'mad-db:operation-lifecycle',
+    'mad-sks:app-ui-no-mutation',
+    'mad:preflight-blocks-unreadable-config',
+    'mcp:plugin-inventory',
+    'migration:upgrade-safety',
+    'model-call:concurrency',
+    'naruto:canonical-stop-gate',
+    'naruto:worktree-coding:blackbox',
+    'native-capability:repair-matrix',
+    'native:image-generation-repair',
+    'package:published-contract',
+    'pipeline:codex-native-routing-comprehensive',
+    'policy:gate-audit',
+    'ppt:full-e2e-blackbox',
+    'ppt:real-export-adapter',
+    'ppt:real-imagegen-wiring',
+    'ppt:reexport-rereview',
+    'probes:memoization',
+    'prompt:placeholder-guard',
+    'proof:root-cause-policy',
+    'provider:badge-context',
+    'publish:packlist-performance',
+    'python-sdk:all-pipelines',
+    'qa-loop:comprehensive-verification',
+    'release:aggressive-resource-governor',
+    'release:batch-runner-comprehensive',
+    'release:cache-key-comprehensive',
+    'release:dag-runner',
+    'release:gate-budget',
+    'release:gate-selection-comprehensive',
+    'release:metadata-current',
+    'release:parallel-speed-budget',
+    'release:proof-truth',
+    'release:provenance',
+    'release:runtime-truth-matrix',
+    'research:claim-builder-blueprint-comprehensive',
+    'research:complete-package-final-review-comprehensive',
+    'research:execution-profile-routing',
+    'responses:retry-policy-centralized',
+    'runtime:proof-summary',
+    'safety:mutation-callsite-coverage',
+    'scheduler:comprehensive',
+    'schema:check',
+    'secret:preservation',
+    'seo-geo:route-identity-comprehensive',
+    'seo-geo:skill-rich-content',
+    'seo:comprehensive',
+    'shared-memory:check',
+    'side-effect:runtime-report',
+    'skill:name-canonicalizer',
+    'sksd:daemon',
+    'super-search:provider-interface',
+    'test:code-index-agent-bridge-regression',
+    'test:codex-runtime-recovery',
+    'test:commands-regression',
+    'test:core-root-regression',
+    'test:dfix-ppt-gate',
+    'test:mad-sks-regression',
+    'test:menubar-doctor',
+    'test:official-subagent-policy',
+    'test:proof-stop-gate',
+    'test:triwiki-voxel-integrity',
+    'triwiki:cache-key',
+    'triwiki:proof-comprehensive',
+    'trust:check',
+    'type-surface:codex-app',
+    'typecheck',
+    'ultra-router:auto-router',
+    'ux-review:extract-wires-real-extractor',
+    'ux-review:imagegen-blackbox',
+    'ux-review:patch-diff-recheck',
+    'ux-review:run-wires-imagegen',
+    'wrongness:check'
+]);
+export function releaseGateContractSnapshot() {
+    const ids = [...RELEASE_GATE_CONTRACT_IDS];
+    const sha256 = crypto
+        .createHash('sha256')
+        .update(`${RELEASE_GATE_CONTRACT_SCHEMA}\n${ids.join('\n')}\n`)
+        .digest('hex');
+    return {
+        schema: RELEASE_GATE_CONTRACT_SCHEMA,
+        ids,
+        count: ids.length,
+        sha256
+    };
+}
+//# sourceMappingURL=release-gate-contract.js.map

package/dist/core/release/release-gate-dag.js

@@ -24,13 +24,45 @@ export function loadReleaseGateManifest(root, file = 'release-gates.v2.json') {
     }
     return validation.manifest;
 }
+export function selectReleaseGateClosure(manifest, requestedGateIds) {
+    const requested = [...new Set([...requestedGateIds].map(String).filter(Boolean))];
+    const byId = new Map(manifest.gates.map((gate) => [gate.id, gate]));
+    const unknown = requested.filter((id) => !byId.has(id)).sort();
+    if (unknown.length)
+        throw new Error(`release_gate_only_selection_unknown:${unknown.join(',')}`);
+    const selected = new Set();
+    const visiting = new Set();
+    const stack = [];
+    const visit = (id) => {
+        if (selected.has(id))
+            return;
+        if (visiting.has(id)) {
+            const cycleStart = stack.indexOf(id);
+            const cycle = [...stack.slice(Math.max(0, cycleStart)), id];
+            throw new Error(`release_gate_only_selection_dependency_cycle:${cycle.join('->')}`);
+        }
+        const gate = byId.get(id);
+        if (!gate)
+            throw new Error(`release_gate_only_selection_missing_dependency:${stack.at(-1) || 'requested'}:${id}`);
+        visiting.add(id);
+        stack.push(id);
+        for (const dep of gate.deps || [])
+            visit(dep);
+        stack.pop();
+        visiting.delete(id);
+        selected.add(id);
+    };
+    for (const id of requested)
+        visit(id);
+    return manifest.gates.filter((gate) => selected.has(gate.id));
+}
 export async function runReleaseGateDag(input) {
     const root = path.resolve(input.root);
     const preset = input.preset || 'release';
     const manifest = loadReleaseGateManifest(root);
     const onlyGateIds = new Set((input.onlyGateIds || []).map(String).filter(Boolean));
     const presetGates = onlyGateIds.size
-        ? manifest.gates.filter((gate) => onlyGateIds.has(gate.id))
+        ? selectReleaseGateClosure(manifest, onlyGateIds)
         : selectReleaseGatePreset(manifest, preset);
     const forceFullSelection = input.full === true || onlyGateIds.size > 0;
     const affected = (preset === 'affected' || preset === 'fast' || preset === 'confidence') && !forceFullSelection
@@ -57,6 +89,11 @@ export async function runReleaseGateDag(input) {
     const affectedExternalSatisfiedDeps = affected.selection.mode === 'affected'
         ? new Set(selected.flatMap((gate) => gate.deps || []).filter((dep) => !selectedIds.has(dep)))
         : new Set();
+    const missingSelectedDeps = selected.flatMap((gate) => (gate.deps || [])
+        .filter((dep) => !selectedIds.has(dep) && !affectedExternalSatisfiedDeps.has(dep))
+        .map((dep) => `${gate.id}->${dep}`));
+    if (missingSelectedDeps.length)
+        throw new Error(`release_gate_selection_missing_dependencies:${[...new Set(missingSelectedDeps)].sort().join(',')}`);
     const runId = `rg-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
     const retentionBefore = await pruneOldReleaseGateRunDirs(root);
     await sweepSksTempDirs(root, { maxAgeHours: 24 }).catch(() => null);
@@ -131,6 +168,7 @@ export async function runReleaseGateDag(input) {
             failures,
             affected_graph: affectedGraph,
             completion_certificate: completionCertificate,
+            release_authorization_snapshot: input.releaseAuthorizationSnapshot || null,
             triwiki_affected_graph: triwikiGraph,
             triwiki_selection_used: triwikiSelectionUsed,
             triwiki_selected_gates: triwikiGraph ? selected.map((gate) => gate.id) : [],
@@ -266,7 +304,10 @@ export async function runReleaseGateDag(input) {
 }
 export function selectReleaseGatePreset(manifest, preset) {
     const effectivePreset = preset === 'affected' || preset === 'fast' || preset === 'confidence' ? 'release' : preset;
-    return manifest.gates.filter((gate) => gate.preset.includes(effectivePreset));
+    const selected = manifest.gates.filter((gate) => gate.preset.includes(effectivePreset));
+    if (!selected.length)
+        throw new Error(`release_gate_preset_empty_or_unknown:${preset}`);
+    return selected;
 }
 function buildAffectedGraph(input) {
     return {
@@ -407,7 +448,7 @@ function tail(value, limit = 1200) {
     return value.length > limit ? value.slice(-limit) : value;
 }
 export async function pruneOldReleaseGateRunDirs(root, opts = {}) {
-    const keep = Math.max(1, Math.floor(Number(opts.keep ?? process.env.SKS_RELEASE_GATE_RUN_RETENTION ?? 20) || 20));
+    const keep = Math.max(1, Math.floor(Number(opts.keep ?? process.env.SKS_RELEASE_GATE_RUN_RETENTION ?? 5) || 5));
     const preserveRunId = opts.preserveRunId || null;
     const base = path.join(root, '.sneakoscope', 'reports', 'release-gates');
     const report = {

package/dist/core/release/release-gate-hermetic-env.js

@@ -12,26 +12,37 @@ export function createReleaseGateHermeticEnv(input) {
     fs.mkdirSync(codexHome, { recursive: true });
     fs.mkdirSync(cacheHome, { recursive: true });
     fs.mkdirSync(reportDir, { recursive: true });
-    const migrationGateDisabled = input.gate.id === 'legacy:update-e2e' ? undefined : '1';
+    const gateEnv = {
+        ...process.env,
+        SKS_GATE_ID: input.gate.id,
+        SKS_GATE_RUN_ID: input.runId,
+        SKS_REPORT_DIR: reportDir,
+        SKS_TMP_DIR: tmpRoot,
+        TMPDIR: tmpRoot,
+        TMP: tmpRoot,
+        TEMP: tmpRoot,
+        HOME: input.gate.isolation.home === 'temp' ? home : process.env.HOME,
+        CODEX_HOME: input.gate.isolation.codex_home === 'temp' ? codexHome : process.env.CODEX_HOME,
+        XDG_CACHE_HOME: cacheHome,
+        SKS_DISABLE_REAL_MODEL_CALLS: input.gate.preset.includes('real-check') ? process.env.SKS_DISABLE_REAL_MODEL_CALLS || '0' : '1',
+        SKS_DISABLE_GLOBAL_CONFIG_MUTATION: '1',
+        // Gates must never spawn a real GUI menu bar status item into the user's
+        // live session. Belt to the temp-path launch guard in installSksMenuBar.
+        SKS_SKIP_SKS_MENUBAR_LAUNCH: '1'
+    };
+    if (input.gate.id === 'legacy:update-e2e') {
+        // This gate exercises the migration path itself. An ambient disable flag
+        // from the parent Codex/SKS process must not turn the fixture into a false
+        // successful skip.
+        delete gateEnv.SKS_UPDATE_MIGRATION_GATE_DISABLED;
+    }
+    else {
+        gateEnv.SKS_UPDATE_MIGRATION_GATE_DISABLED = '1';
+    }
     return {
         tmp_dir: tmpRoot,
         report_dir: reportDir,
-        env: {
-            ...process.env,
-            SKS_GATE_ID: input.gate.id,
-            SKS_GATE_RUN_ID: input.runId,
-            SKS_REPORT_DIR: reportDir,
-            SKS_TMP_DIR: tmpRoot,
-            HOME: input.gate.isolation.home === 'temp' ? home : process.env.HOME,
-            CODEX_HOME: input.gate.isolation.codex_home === 'temp' ? codexHome : process.env.CODEX_HOME,
-            XDG_CACHE_HOME: cacheHome,
-            ...(migrationGateDisabled ? { SKS_UPDATE_MIGRATION_GATE_DISABLED: migrationGateDisabled } : {}),
-            SKS_DISABLE_REAL_MODEL_CALLS: input.gate.preset.includes('real-check') ? process.env.SKS_DISABLE_REAL_MODEL_CALLS || '0' : '1',
-            SKS_DISABLE_GLOBAL_CONFIG_MUTATION: '1',
-            // Gates must never spawn a real GUI menu bar status item into the user's
-            // live session. Belt to the temp-path launch guard in installSksMenuBar.
-            SKS_SKIP_SKS_MENUBAR_LAUNCH: '1'
-        }
+        env: gateEnv
     };
 }
 export function cleanupReleaseGateHermeticEnv(env) {