sneakoscope 6.0.3 → 6.1.2

package/dist/scripts/release-check-stamp.js

@@ -5,9 +5,14 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { RELEASE_REAL_CHECK_IDS, RELEASE_REAL_OPTIONAL_CHECK_IDS, RELEASE_REAL_REQUIRED_CHECK_IDS } from '../core/release/release-real-contract.js';
+import { RELEASE_AUTHORIZATION_SNAPSHOT_KEYS, releaseAuthorizationSnapshot } from '../core/release/release-authorization-snapshot.js';
+import { releaseGateContractSnapshot } from '../core/release/release-gate-contract.js';
+import { currentDistFreshness } from './lib/ensure-dist-fresh.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const stampPath = process.env.SKS_RELEASE_STAMP_PATH || path.join(root, '.sneakoscope', 'reports', 'release-check-stamp.json');
 const command = process.argv[2] || 'verify';
+const commandArgs = process.argv.slice(3);
 const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function fail(message, detail = '') {
     console.error(`Release check stamp failed: ${message}`);
@@ -18,147 +23,27 @@ function fail(message, detail = '') {
 function readJson(rel) {
     return JSON.parse(fs.readFileSync(path.join(root, rel), 'utf8'));
 }
-function sha256(value) {
-    return crypto.createHash('sha256').update(value).digest('hex');
-}
-function treeDigest(dir, opts = {}) {
-    if (!fs.existsSync(dir))
-        return { digest: null, file_count: 0 };
-    const files = [];
-    collectFiles(dir, files, { baseDir: dir, include: opts.include });
-    const hash = crypto.createHash('sha256');
-    for (const file of files.sort()) {
-        const rel = path.relative(dir, file).split(path.sep).join('/');
-        const stat = fs.statSync(file);
-        hash.update(rel);
-        hash.update('\0');
-        hash.update(String(stat.size));
-        hash.update('\0');
-        hash.update(sha256(fs.readFileSync(file)));
-        hash.update('\0');
-    }
-    return { digest: hash.digest('hex'), file_count: files.length };
-}
-function fileDigestForPackageFiles(pkg) {
-    const hash = crypto.createHash('sha256');
-    const { files, missingEntries } = packageFileSnapshot(pkg);
-    for (const entry of missingEntries.sort()) {
-        hash.update(entry);
-        hash.update('\0');
-        hash.update('missing\0');
-    }
-    for (const file of files) {
-        const full = path.join(root, file);
-        const stat = fs.statSync(full);
-        hash.update(file);
-        hash.update('\0');
-        hash.update(String(stat.size));
-        hash.update('\0');
-        hash.update(sha256(fs.readFileSync(full)));
-        hash.update('\0');
-    }
-    return sha256(hash.digest('hex'));
-}
-function packageFileSnapshot(pkg) {
-    const entries = packageFileEntries(pkg);
-    const candidates = new Set();
-    const missingEntries = [];
-    for (const entry of entries) {
-        if (entry.negated || hasGlob(entry.pattern))
-            continue;
-        const full = path.join(root, entry.pattern);
-        if (!fs.existsSync(full)) {
-            missingEntries.push(entry.pattern);
-            continue;
-        }
-        const stat = fs.statSync(full);
-        if (stat.isDirectory()) {
-            const found = [];
-            collectFiles(full, found, { baseDir: root });
-            for (const file of found)
-                candidates.add(path.relative(root, file).split(path.sep).join('/'));
-        }
-        else if (stat.isFile()) {
-            candidates.add(entry.pattern);
-        }
-    }
-    const files = [...candidates].filter((file) => packageFileIncluded(file, entries)).sort();
-    return { files, missingEntries };
-}
-function packageFileEntries(pkg) {
-    return (Array.isArray(pkg.files) ? pkg.files : [])
-        .map((raw) => {
-        const value = String(raw || '').trim();
-        const negated = value.startsWith('!');
-        const pattern = normalizeRel(negated ? value.slice(1) : value);
-        return pattern ? { negated, pattern } : null;
-    })
+function releaseManifestContract() {
+    const manifest = readJson('release-gates.v2.json');
+    const contract = releaseGateContractSnapshot();
+    const allGates = Array.isArray(manifest?.gates) ? manifest.gates : [];
+    const releaseGateIds = allGates
+        .filter((gate) => Array.isArray(gate?.preset) && gate.preset.includes('release'))
+        .map((gate) => String(gate.id || ''))
         .filter(Boolean);
+    return {
+        schema: manifest?.schema || null,
+        totalGateCount: allGates.length,
+        releaseGateIds,
+        releaseGateIdsSorted: [...new Set(releaseGateIds)].sort(),
+        expectedReleaseGateIds: contract.ids,
+        missingExpectedGateIds: contract.ids.filter((id) => !releaseGateIds.includes(id)),
+        unexpectedReleaseGateIds: [...new Set(releaseGateIds)].filter((id) => !contract.ids.includes(id)).sort(),
+        contract
+    };
 }
-function packageFileIncluded(file, entries) {
-    let included = false;
-    for (const entry of entries) {
-        if (matchesPackagePattern(file, entry.pattern))
-            included = !entry.negated;
-    }
-    return included;
-}
-function matchesPackagePattern(file, pattern) {
-    const rel = normalizeRel(file);
-    const normalized = normalizeRel(pattern);
-    if (!rel || !normalized)
-        return false;
-    if (!hasGlob(normalized))
-        return rel === normalized || rel.startsWith(`${normalized}/`);
-    const re = globPatternToRegExp(normalized);
-    if (re.test(rel))
-        return true;
-    const parts = rel.split('/');
-    parts.pop();
-    while (parts.length) {
-        if (re.test(parts.join('/')))
-            return true;
-        parts.pop();
-    }
-    return false;
-}
-function globPatternToRegExp(pattern) {
-    let out = '^';
-    for (let i = 0; i < pattern.length; i += 1) {
-        const char = pattern[i];
-        if (char === '*') {
-            if (pattern[i + 1] === '*') {
-                if (pattern[i + 2] === '/') {
-                    out += '(?:[^/]+/)*';
-                    i += 2;
-                }
-                else {
-                    out += '.*';
-                    i += 1;
-                }
-            }
-            else {
-                out += '[^/]*';
-            }
-            continue;
-        }
-        if (char === '?') {
-            out += '[^/]';
-            continue;
-        }
-        out += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
-    }
-    return new RegExp(`${out}$`);
-}
-function hasGlob(value) {
-    return /[*?]/.test(value);
-}
-function normalizeRel(value) {
-    return String(value || '').split(path.sep).join('/').replace(/^\.\/+/, '').replace(/\/+$/, '');
-}
-function gitCommit() {
-    const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
-    return result.status === 0 ? result.stdout.trim() : null;
+function sha256(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
 }
 function runRefreshCommand() {
     const override = process.env.SKS_RELEASE_CHECK_REFRESH_COMMAND;
@@ -178,115 +63,35 @@ function runRefreshCommand() {
         stdio: 'inherit'
     });
 }
-function releaseGateHash(pkg) {
-    const manifests = ['release-gates.v2.json', 'infra-harness-gates.json'].map((rel) => {
-        const file = path.join(root, rel);
-        return fs.existsSync(file) ? `${rel}\0${fs.readFileSync(file, 'utf8')}` : `${rel}\0missing`;
-    }).join('\0');
-    return sha256(`${pkg.scripts?.['release:check'] || ''}\0${pkg.scripts?.['prepublishOnly'] || ''}\0${manifests}`);
-}
-function collectFiles(dir, out, opts = {}) {
-    const baseDir = opts.baseDir || dir;
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const file = path.join(dir, entry.name);
-        if (entry.isDirectory())
-            collectFiles(file, out, { ...opts, baseDir });
-        else if (entry.isFile()) {
-            const rel = path.relative(baseDir, file).split(path.sep).join('/');
-            if (!opts.include || opts.include(rel, file))
-                out.push(file);
-        }
-    }
-}
-function gitFiles() {
-    const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
-        cwd: root,
-        encoding: 'utf8',
-        maxBuffer: 64 * 1024 * 1024
-    });
-    if (result.status !== 0)
-        fail('unable to list release-relevant files', result.stderr || result.stdout);
-    return result.stdout.split('\0').filter(Boolean);
-}
-function releaseRelevant(file) {
-    if (!file || file.startsWith('.sneakoscope/') || file.startsWith('.codex/') || file.startsWith('.agents/'))
-        return false;
-    if (file.startsWith('node_modules/') || file.startsWith('dist/') || file.startsWith('coverage/'))
-        return false;
-    if (file.startsWith('crates/sks-core/target/'))
-        return false;
-    if (/\.tgz$|\.log$/i.test(file))
-        return false;
-    if (/^(package|package-lock)\.json$/.test(file))
-        return true;
-    if (file === 'release-gates.v2.json' || file === 'infra-harness-gates.json')
-        return true;
-    if (/^tsconfig.*\.json$/.test(file))
-        return true;
-    if (/^(README|CHANGELOG|LICENSE)(\.md)?$/i.test(file))
-        return true;
-    return [
-        'bin/',
-        'src/',
-        'scripts/',
-        'test/',
-        'docs/',
-        'crates/sks-core/Cargo.',
-        'crates/sks-core/src/'
-    ].some((prefix) => file.startsWith(prefix));
-}
-function releaseSnapshot() {
-    const files = gitFiles().filter(releaseRelevant).sort();
-    const hash = crypto.createHash('sha256');
-    for (const file of files) {
-        const full = path.join(root, file);
-        let stat;
-        try {
-            stat = fs.statSync(full);
-        }
-        catch {
-            continue;
-        }
-        if (!stat.isFile())
-            continue;
-        const contentHash = sha256(fs.readFileSync(full));
-        hash.update(file);
-        hash.update('\0');
-        hash.update(String(stat.size));
-        hash.update('\0');
-        hash.update(contentHash);
-        hash.update('\0');
-    }
-    return {
-        digest: hash.digest('hex'),
-        file_count: files.length
-    };
-}
 function currentStampPayload() {
     const pkg = readJson('package.json');
-    const snapshot = releaseSnapshot();
-    const packageEntries = packageFileEntries(pkg);
-    const dist = treeDigest(path.join(root, 'dist'), {
-        include: (rel) => packageFileIncluded(`dist/${rel}`, packageEntries)
-    });
+    const authorization = releaseAuthorizationSnapshot(root, pkg);
+    const freshness = currentDistFreshness();
+    const gateContract = releaseGateContractSnapshot();
     return {
-        schema: 'sks.release-check-stamp.v1',
+        schema: 'sks.release-check-stamp.v2',
         package_name: pkg.name,
         package_version: pkg.version,
-        git_commit: gitCommit(),
         package_json_sha256: sha256(fs.readFileSync(path.join(root, 'package.json'))),
-        package_files_sha256: fileDigestForPackageFiles(pkg),
-        dist_build_sha256: dist.digest,
-        dist_file_count: dist.file_count,
-        release_gate_sha256: releaseGateHash(pkg),
+        ...authorization,
+        dist_source_digest: freshness.source_digest,
+        dist_source_file_count: freshness.source_file_count,
         release_check_sha256: sha256(pkg.scripts?.['release:check'] || ''),
-        source_digest: snapshot.digest,
-        source_file_count: snapshot.file_count
+        release_gate_contract_schema: gateContract.schema,
+        release_gate_contract_count: gateContract.count,
+        release_gate_contract_sha256: gateContract.sha256
     };
 }
 function writeStamp() {
+    const before = currentStampPayload();
+    const releaseGateProof = fullReleaseGateProofForWrite(before);
+    const current = currentStampPayload();
+    const changedDuringWrite = stampIdentityKeys().filter((key) => before[key] !== current[key]);
+    if (changedDuringWrite.length)
+        fail('release inputs changed while writing the stamp', changedDuringWrite.join('\n'));
     const payload = {
-        ...currentStampPayload(),
+        ...current,
+        release_gate_proof: releaseGateProof,
         generated_at: new Date().toISOString()
     };
     fs.mkdirSync(path.dirname(stampPath), { recursive: true });
@@ -314,10 +119,13 @@ function inspectStamp() {
     }
     const current = currentStampPayload();
     const mismatches = [];
-    for (const key of ['schema', 'package_name', 'package_version', 'package_json_sha256', 'package_files_sha256', 'dist_build_sha256', 'dist_file_count', 'release_gate_sha256', 'release_check_sha256', 'source_digest', 'source_file_count']) {
+    for (const key of stampIdentityKeys()) {
         if (stamp[key] !== current[key])
             mismatches.push(`${key}: stamp=${stamp[key] || 'missing'} current=${current[key] || 'missing'}`);
     }
+    const proofInspection = inspectFullReleaseGateProof(stamp.release_gate_proof, current);
+    if (!proofInspection.ok)
+        mismatches.push(...proofInspection.blockers.map((blocker) => `release_gate_proof:${blocker}`));
     if (mismatches.length) {
         return {
             ok: false,
@@ -328,6 +136,283 @@ function inspectStamp() {
     }
     return { ok: true, current };
 }
+function stampIdentityKeys() {
+    return [
+        'schema',
+        'package_name',
+        'package_version',
+        'package_json_sha256',
+        ...RELEASE_AUTHORIZATION_SNAPSHOT_KEYS,
+        'dist_source_digest',
+        'dist_source_file_count',
+        'release_check_sha256',
+        'release_gate_contract_schema',
+        'release_gate_contract_count',
+        'release_gate_contract_sha256'
+    ];
+}
+function fullReleaseGateProofForWrite(currentPayload) {
+    const preset = argValue('--preset');
+    const full = commandArgs.includes('--full');
+    if (preset !== 'release' || !full) {
+        fail('full release proof required to write publish stamp', 'Use `npm run release:check:full`; affected/fast/confidence checks cannot authorize publish.');
+    }
+    const explicit = argValue('--summary');
+    const summaryPath = explicit ? path.resolve(root, explicit) : latestFullReleaseSummaryPath();
+    if (!summaryPath)
+        fail('full release DAG summary missing', 'Run `npm run release:check:full` before writing the publish stamp.');
+    const reportRoot = path.resolve(root, '.sneakoscope', 'reports', 'release-gates');
+    const relative = path.relative(reportRoot, summaryPath);
+    if (relative.startsWith('..') || path.isAbsolute(relative))
+        fail('release DAG summary is outside the managed report root');
+    let summary;
+    let summaryBytes;
+    try {
+        summaryBytes = fs.readFileSync(summaryPath);
+        summary = JSON.parse(summaryBytes.toString('utf8'));
+    }
+    catch (error) {
+        fail('unable to read full release DAG summary', error?.message || String(error));
+    }
+    const validation = validateFullReleaseSummary(summary);
+    if (validation.length)
+        fail('release DAG summary is not full publish proof', validation.join('\n'));
+    const explicitRealSummary = argValue('--real-summary');
+    const realSummaryPath = explicitRealSummary
+        ? path.resolve(root, explicitRealSummary)
+        : path.join(root, '.sneakoscope', 'reports', 'release-real-check.json');
+    const managedReports = path.resolve(root, '.sneakoscope', 'reports');
+    const realRelative = path.relative(managedReports, realSummaryPath);
+    if (realRelative.startsWith('..') || path.isAbsolute(realRelative))
+        fail('release real-check summary is outside the managed report root');
+    let realSummary;
+    try {
+        realSummary = JSON.parse(fs.readFileSync(realSummaryPath, 'utf8'));
+    }
+    catch (error) {
+        fail('unable to read release real-check summary', error?.message || String(error));
+    }
+    const summarySha256 = sha256(summaryBytes);
+    const realValidation = validateReleaseRealSummary(realSummary, { runId: summary.run_id, summarySha256, currentPayload });
+    if (realValidation.length)
+        fail('release real-check summary is not publish proof', realValidation.join('\n'));
+    if (fs.statSync(realSummaryPath).mtimeMs < fs.statSync(summaryPath).mtimeMs)
+        fail('release real-check predates the full release DAG summary');
+    return {
+        schema: 'sks.release-check-full-proof.v1',
+        preset: 'release',
+        full: true,
+        run_id: summary.run_id,
+        summary_path: path.relative(root, summaryPath).split(path.sep).join('/'),
+        summary_sha256: summarySha256,
+        release_preset_gate_ids_sha256: sha256([...summary.selected_gate_ids].sort().join('\n')),
+        release_gate_contract_sha256: currentPayload.release_gate_contract_sha256,
+        selected_gates: summary.selected_gates,
+        completed: summary.completed,
+        failed: summary.failed,
+        affected_mode: summary.affected_selection?.mode,
+        confidence: summary.completion_certificate?.confidence || null,
+        real_check_path: path.relative(root, realSummaryPath).split(path.sep).join('/'),
+        real_check_sha256: sha256(fs.readFileSync(realSummaryPath)),
+        real_check_count: realSummary.all_checks.length
+    };
+}
+function latestFullReleaseSummaryPath() {
+    const reportRoot = path.join(root, '.sneakoscope', 'reports', 'release-gates');
+    if (!fs.existsSync(reportRoot))
+        return null;
+    return fs.readdirSync(reportRoot, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => path.join(reportRoot, entry.name, 'summary.json'))
+        .filter((file) => fs.existsSync(file))
+        .map((file) => ({ file, stat: fs.statSync(file) }))
+        .sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs)
+        .map((row) => row.file)
+        .find((file) => {
+        try {
+            return validateFullReleaseSummary(JSON.parse(fs.readFileSync(file, 'utf8'))).length === 0;
+        }
+        catch {
+            return false;
+        }
+    }) || null;
+}
+function validateFullReleaseSummary(summary) {
+    const blockers = [];
+    const contract = releaseManifestContract();
+    const selectedRaw = Array.isArray(summary?.selected_gate_ids) ? summary.selected_gate_ids.map(String).filter(Boolean) : [];
+    const selectedUnique = [...new Set(selectedRaw)].sort();
+    if (summary?.schema !== 'sks.release-gate-dag-run.v1')
+        blockers.push('summary_schema_invalid');
+    if (summary?.ok !== true)
+        blockers.push('summary_not_ok');
+    if (summary?.selected_preset !== 'release')
+        blockers.push('preset_not_release');
+    if (summary?.affected_selection?.mode !== 'full')
+        blockers.push('affected_mode_not_full');
+    if (!Number.isInteger(summary?.selected_gates) || summary.selected_gates <= 0)
+        blockers.push('selected_gates_empty');
+    if (contract.schema !== 'sks.release-gates.v2')
+        blockers.push('release_manifest_schema_invalid');
+    if (contract.releaseGateIds.length !== contract.releaseGateIdsSorted.length)
+        blockers.push('release_manifest_duplicate_gate_ids');
+    if (contract.missingExpectedGateIds.length)
+        blockers.push(`release_manifest_missing_contract_ids:${contract.missingExpectedGateIds.join(',')}`);
+    if (contract.unexpectedReleaseGateIds.length)
+        blockers.push(`release_manifest_unexpected_contract_ids:${contract.unexpectedReleaseGateIds.join(',')}`);
+    if (summary?.total_gates !== contract.totalGateCount)
+        blockers.push('manifest_total_gate_count_mismatch');
+    if (summary?.selected_gates !== contract.contract.count)
+        blockers.push('release_preset_gate_count_mismatch');
+    if (summary?.failed !== 0)
+        blockers.push('failed_gates_present');
+    if (summary?.completed !== summary?.selected_gates)
+        blockers.push('not_all_selected_gates_completed');
+    if (!Array.isArray(summary?.selected_gate_ids) || summary.selected_gate_ids.length !== summary.selected_gates)
+        blockers.push('selected_gate_ids_incomplete');
+    if (selectedRaw.length !== selectedUnique.length)
+        blockers.push('selected_gate_ids_duplicate');
+    if (!sameStringList(selectedUnique, contract.expectedReleaseGateIds))
+        blockers.push('selected_gate_ids_not_release_contract');
+    const affectedSelected = [...new Set((Array.isArray(summary?.affected_selection?.selected_gate_ids) ? summary.affected_selection.selected_gate_ids : []).map(String).filter(Boolean))].sort();
+    if (!sameStringList(affectedSelected, contract.expectedReleaseGateIds))
+        blockers.push('affected_selected_gate_ids_not_release_contract');
+    if (Array.isArray(summary?.skipped_by_affected) && summary.skipped_by_affected.length > 0)
+        blockers.push('full_release_has_skipped_gates');
+    if (summary?.completion_certificate?.confidence !== 'full-release-proof')
+        blockers.push('completion_confidence_not_full');
+    if (summary?.completion_certificate?.full_release_proof !== 'current_run')
+        blockers.push('full_release_proof_not_current_run');
+    if (summary?.completion_certificate?.ok !== true)
+        blockers.push('completion_certificate_not_ok');
+    return blockers;
+}
+function validateReleaseRealSummary(summary, context = {}) {
+    const blockers = [];
+    if (summary?.schema !== 'sks.release-real-check.v1')
+        blockers.push('real_check_schema_invalid');
+    if (summary?.ok !== true)
+        blockers.push('real_check_not_ok');
+    if (!Array.isArray(summary?.blockers) || summary.blockers.length > 0)
+        blockers.push('real_check_blockers_present');
+    const rows = Array.isArray(summary?.all_checks) ? summary.all_checks : [];
+    const rowIds = rows.map((row) => String(row?.id || '')).filter(Boolean);
+    const uniqueRowIds = [...new Set(rowIds)];
+    const expectedIds = [...RELEASE_REAL_CHECK_IDS];
+    if (!rows.length)
+        blockers.push('real_check_empty');
+    if (rowIds.length !== uniqueRowIds.length)
+        blockers.push('real_check_duplicate_ids');
+    if (!sameStringList([...uniqueRowIds].sort(), [...expectedIds].sort()))
+        blockers.push('real_check_ids_not_contract');
+    if (rows.some((row) => row?.ok !== true || row?.contract_ok !== true || row?.release_blocking === true))
+        blockers.push('real_check_failures_present');
+    const requiredIds = new Set(RELEASE_REAL_REQUIRED_CHECK_IDS);
+    const optionalIds = new Set(RELEASE_REAL_OPTIONAL_CHECK_IDS);
+    for (const row of rows) {
+        const id = String(row?.id || '');
+        if (requiredIds.has(id) && !(row?.required_for_release === true && row?.requirement === 'release_authorizing' && row?.outcome === 'passed' && row?.passed === true && row?.process_ok === true)) {
+            blockers.push(`real_required_check_not_passed:${id}`);
+        }
+        if (optionalIds.has(id) && !(row?.required_for_release === false && row?.requirement === 'live_optional'))
+            blockers.push(`real_optional_check_contract_invalid:${id}`);
+    }
+    const authorizingIds = [...new Set((Array.isArray(summary?.release_authorizing_checks) ? summary.release_authorizing_checks : []).map((row) => String(row?.id || '')).filter(Boolean))].sort();
+    if (!sameStringList(authorizingIds, [...RELEASE_REAL_REQUIRED_CHECK_IDS].sort()))
+        blockers.push('real_authorizing_check_ids_not_contract');
+    if (summary?.task_contract?.ok !== true || !sameStringList([...(summary?.task_contract?.actual_ids || [])].sort(), [...expectedIds].sort()))
+        blockers.push('real_task_contract_invalid');
+    if (!(summary?.release_check?.id === 'release:check' && summary?.release_check?.ok === true && summary?.release_check?.outcome === 'passed' && summary?.release_check?.required_for_release === true))
+        blockers.push('real_release_check_invalid');
+    const skipProof = summary?.skip_release_check_proof;
+    if (!(skipProof?.ok === true && skipProof?.stable_through_real_checks === true && skipProof?.final_revalidation?.ok === true))
+        blockers.push('real_skip_proof_invalid');
+    if (context.runId && (skipProof?.run_id !== context.runId || skipProof?.final_revalidation?.run_id !== context.runId))
+        blockers.push('real_skip_proof_run_mismatch');
+    if (context.summarySha256 && (skipProof?.latest_summary_sha256 !== context.summarySha256 || skipProof?.final_revalidation?.latest_summary_sha256 !== context.summarySha256))
+        blockers.push('real_skip_proof_summary_hash_mismatch');
+    if (context.currentPayload) {
+        for (const [label, proof] of [['initial', skipProof], ['final', skipProof?.final_revalidation]]) {
+            for (const key of RELEASE_AUTHORIZATION_SNAPSHOT_KEYS) {
+                if (proof?.[key] !== context.currentPayload[key])
+                    blockers.push(`real_skip_${label}_${key}_not_current`);
+            }
+            if (proof?.dist_source_digest !== context.currentPayload.dist_source_digest)
+                blockers.push(`real_skip_${label}_dist_source_digest_not_current`);
+            if (proof?.dist_source_file_count !== context.currentPayload.dist_source_file_count)
+                blockers.push(`real_skip_${label}_dist_source_file_count_not_current`);
+        }
+    }
+    return blockers;
+}
+function sameStringList(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function inspectFullReleaseGateProof(proof, currentPayload) {
+    const blockers = [];
+    let boundSummary = null;
+    let boundSummarySha256 = null;
+    if (proof?.schema !== 'sks.release-check-full-proof.v1')
+        blockers.push('proof_schema_invalid');
+    if (proof?.preset !== 'release' || proof?.full !== true)
+        blockers.push('proof_not_full_release');
+    if (proof?.release_gate_contract_sha256 !== currentPayload.release_gate_contract_sha256)
+        blockers.push('release_gate_contract_hash_mismatch');
+    const summaryPath = proof?.summary_path ? path.resolve(root, proof.summary_path) : null;
+    const reportRoot = path.resolve(root, '.sneakoscope', 'reports', 'release-gates');
+    if (!summaryPath || !fs.existsSync(summaryPath))
+        blockers.push('summary_missing');
+    else {
+        const relative = path.relative(reportRoot, summaryPath);
+        if (relative.startsWith('..') || path.isAbsolute(relative))
+            blockers.push('summary_outside_managed_reports');
+        else {
+            const bytes = fs.readFileSync(summaryPath);
+            if (sha256(bytes) !== proof.summary_sha256)
+                blockers.push('summary_hash_mismatch');
+            try {
+                const summary = JSON.parse(bytes);
+                boundSummary = summary;
+                boundSummarySha256 = sha256(bytes);
+                blockers.push(...validateFullReleaseSummary(summary));
+                if (summary.run_id !== proof.run_id || summary.selected_gates !== proof.selected_gates || summary.completed !== proof.completed || summary.failed !== proof.failed)
+                    blockers.push('summary_identity_mismatch');
+                if (sha256([...summary.selected_gate_ids].sort().join('\n')) !== proof.release_preset_gate_ids_sha256)
+                    blockers.push('release_preset_gate_ids_hash_mismatch');
+            }
+            catch {
+                blockers.push('summary_parse_failed');
+            }
+        }
+    }
+    const realCheckPath = proof?.real_check_path ? path.resolve(root, proof.real_check_path) : null;
+    if (!realCheckPath || !fs.existsSync(realCheckPath))
+        blockers.push('real_check_summary_missing');
+    else {
+        const relative = path.relative(path.resolve(root, '.sneakoscope', 'reports'), realCheckPath);
+        if (relative.startsWith('..') || path.isAbsolute(relative))
+            blockers.push('real_check_summary_outside_managed_reports');
+        else {
+            const bytes = fs.readFileSync(realCheckPath);
+            if (sha256(bytes) !== proof.real_check_sha256)
+                blockers.push('real_check_summary_hash_mismatch');
+            try {
+                const realSummary = JSON.parse(bytes);
+                blockers.push(...validateReleaseRealSummary(realSummary, { runId: boundSummary?.run_id || proof.run_id, summarySha256: boundSummarySha256 || proof.summary_sha256, currentPayload }));
+                if (realSummary.all_checks?.length !== proof.real_check_count)
+                    blockers.push('real_check_identity_mismatch');
+            }
+            catch {
+                blockers.push('real_check_summary_parse_failed');
+            }
+        }
+    }
+    return { ok: blockers.length === 0, blockers: [...new Set(blockers)] };
+}
+function argValue(name) {
+    const index = commandArgs.indexOf(name);
+    return index >= 0 ? commandArgs[index + 1] || null : null;
+}
 function verifyStamp() {
     const result = inspectStamp();
     if (!result.ok)
@@ -359,5 +444,5 @@ else if (command === 'verify')
 else if (command === 'ensure')
     ensureStamp();
 else
-    fail(`unknown command ${command}`, 'Usage: node ./dist/scripts/release-check-stamp.js <write|verify|ensure>');
+    fail(`unknown command ${command}`, 'Usage: node ./dist/scripts/release-check-stamp.js <write --preset release --full [--summary path]|verify|ensure>');
 //# sourceMappingURL=release-check-stamp.js.map

package/dist/scripts/release-dag-full-coverage-check.js

@@ -2,6 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { releaseGateContractSnapshot } from '../core/release/release-gate-contract.js';
 const packageJson = readPackageJson(path.join(root, 'package.json'));
 const releaseManifest = readReleaseGateManifest(path.join(root, 'release-gates.v2.json'), 'sks.release-gates.v2');
 const harnessManifest = readReleaseGateManifest(path.join(root, 'infra-harness-gates.json'), 'sks.infra-harness-gates.v1');
@@ -9,21 +10,8 @@ const releasePreset = releaseManifest.gates.filter((gate) => gate.preset.include
 const harnessPreset = harnessManifest.gates.filter((gate) => gate.preset.includes('harness'));
 const releaseIds = new Set(releasePreset.map((gate) => gate.id));
 const harnessIds = new Set(harnessPreset.map((gate) => gate.id));
-const requiredReleasePresetIds = [
-    'codex:app-handoff-comprehensive',
-    'qa-loop:comprehensive-verification',
-    'loop-integration-finalizer-check',
-    'naruto:canonical-stop-gate',
-    'agent:native-cli-session-swarm-scaling',
-    'agent:fast-mode-policy',
-    'codex-control:event-stream-ledger',
-    'release:dag-runner',
-    'release:gate-budget',
-    'release:gate-selection-comprehensive',
-    'policy:gate-audit',
-    'runtime:proof-summary',
-    'typecheck'
-];
+const releaseContract = releaseGateContractSnapshot();
+const requiredReleasePresetIds = releaseContract.ids;
 const requiredHarnessPresetIds = [
     'zellij:layout-valid',
     'zellij:compact-slot-renderer',
@@ -33,6 +21,7 @@ const requiredHarnessPresetIds = [
     'zellij:right-column-geometry-proof'
 ];
 const missingRequiredReleasePreset = requiredReleasePresetIds.filter((id) => !releaseIds.has(id));
+const unexpectedReleasePreset = [...releaseIds].filter((id) => !requiredReleasePresetIds.includes(id)).sort();
 const missingRequiredHarnessPreset = requiredHarnessPresetIds.filter((id) => !harnessIds.has(id));
 const duplicateAcrossManifests = [...releaseIds].filter((id) => harnessIds.has(id));
 const releaseZellij = [...releaseIds].filter((id) => id.startsWith('zellij:'));
@@ -44,6 +33,7 @@ const report = {
     ok: schemaComplete
         && releasePreset.length <= 200
         && missingRequiredReleasePreset.length === 0
+        && unexpectedReleasePreset.length === 0
         && missingRequiredHarnessPreset.length === 0
         && duplicateAcrossManifests.length === 0
         && releaseZellij.length === 0
@@ -53,6 +43,8 @@ const report = {
     harness_gate_count: harnessPreset.length,
     required_release_preset_ids: requiredReleasePresetIds,
     missing_required_release_preset: missingRequiredReleasePreset,
+    unexpected_release_preset: unexpectedReleasePreset,
+    release_gate_contract: releaseContract,
     required_harness_preset_ids: requiredHarnessPresetIds,
     missing_required_harness_preset: missingRequiredHarnessPreset,
     duplicate_across_manifests: duplicateAcrossManifests,