sneakoscope 6.0.3 → 6.1.2

package/dist/scripts/release-dynamic-presets-check.js

@@ -11,10 +11,19 @@ for (const name of ['release:check:affected', 'release:check:full', 'release:che
     assertGate(Boolean(scripts[name]), `missing package script ${name}`);
 }
 assertGate(String(scripts['release:check']).includes('release:check:affected'), 'release:check must default to affected preset');
-assertGate(String(scripts['release:check:affected']).includes('build:incremental') && String(scripts['release:check:fast']).includes('build:incremental') && String(scripts['release:check:confidence']).includes('--sla 5m'), 'affected/fast/confidence checks must use incremental build and five-minute SLA');
+assertGate(['release:check:affected', 'release:check:fast', 'release:check:confidence'].every((name) => String(scripts[name]).includes('release:ensure-build'))
+    && String(scripts['release:check:confidence']).includes('--sla 5m'), 'affected/fast/confidence checks must reuse a source-bound fresh build and keep the five-minute SLA');
 assertGate(dag.includes('selectAffectedReleaseGates'), 'release DAG must use affected selector');
 assertGate(dagMod.selectReleaseGatePreset(manifest, 'affected').length === releaseCount, 'affected preset must select the release gate universe before affected filtering');
 assertGate(dagMod.selectReleaseGatePreset(manifest, 'fast').length === releaseCount, 'fast preset must select the release gate universe before affected filtering');
+let unknownPresetBlocked = false;
+try {
+    dagMod.selectReleaseGatePreset(manifest, 'unknown-preset');
+}
+catch (error) {
+    unknownPresetBlocked = /release_gate_preset_empty_or_unknown/.test(String(error?.message || error));
+}
+assertGate(unknownPresetBlocked, 'unknown or empty release presets must fail closed');
 assertGate(runner.includes('--changed-since') && runner.includes('--full') && runner.includes('--sla'), 'release DAG runner must parse changed-since/full/sla');
 emitGate('release:dynamic-presets', { presets: 4 });
 //# sourceMappingURL=release-dynamic-presets-check.js.map

package/dist/scripts/release-gate-dag-runner-check.js

@@ -17,11 +17,11 @@ const effectiveReleaseCheck = delegatedReleaseCheck ? String(pkg.scripts[delegat
 assertGate(effectiveReleaseCheck.includes('release-gate-dag-runner.js'), 'release:check must execute DAG runner', { release_check: releaseCheck, delegated_release_check: delegatedReleaseCheck || null, effective_release_check: effectiveReleaseCheck });
 assertGate(!/&&\s*npm run\s+\w/.test(releaseCheck.replace('npm run build --silent &&', '')), 'release:check must not be a giant npm-run chain', releaseCheck);
 assertGate(!/&&\s*npm run\s+\w/.test(effectiveReleaseCheck.replace('npm run build:incremental --silent &&', '').replace('npm run build --silent &&', '')), 'effective release:check must not be a giant npm-run chain', effectiveReleaseCheck);
-assertGate(pkg.scripts['release:check:legacy'], 'release:check:legacy must exist for explicit debugging');
+assertGate(!pkg.scripts['release:check:legacy'], 'retired release:check:legacy alias must stay removed');
+assertGate(pkg.scripts['release:real-check'] === 'node ./dist/scripts/release-real-check.js', 'release:real-check must expose the canonical environment-dependent proof runner');
 assertGate(manifest.schema === 'sks.release-gates.v2' && manifest.gates.length >= 10, 'release-gates.v2 manifest must exist with nodes', manifest);
 for (const gateId of [
     'scheduler:comprehensive',
-    'agent:native-cli-session-swarm-scaling',
     'doctor:fix-proves-codex-read',
     'release:batch-runner-comprehensive',
     'release:parallel-speed-budget'
@@ -37,7 +37,7 @@ assertGate(runner.includes('detached: process.platform') && runner.includes('kil
 assertGate(runner.includes('pruneOldReleaseGateRunDirs') && runner.includes('SKS_RELEASE_GATE_RUN_RETENTION'), 'DAG runner must prune stale release-gate run reports before they exhaust local disk');
 assertGate(runnerCli.includes('ensureCurrentMigrationBeforeCommand') && runnerCli.includes('release-gate-runner-preflight'), 'DAG runner CLI must self-heal project migration before hermetic gates run');
 assertGate(hermeticEnv.includes('SKS_UPDATE_MIGRATION_GATE_DISABLED'), 'hermetic release gates must not rewrite project migration receipts from temporary HOME roots');
-assertGate(hermeticEnv.includes('legacy:update-e2e') && hermeticEnv.includes('migrationGateDisabled'), 'legacy:update-e2e must keep migration gate enabled while testing migration retry/repair behavior');
+assertGate(hermeticEnv.includes("input.gate.id === 'legacy:update-e2e'") && hermeticEnv.includes('delete gateEnv.SKS_UPDATE_MIGRATION_GATE_DISABLED'), 'legacy:update-e2e must explicitly remove an inherited disable flag while testing migration retry/repair behavior');
 const dag = await importDist('core/release/release-gate-dag.js');
 const fsx = await importDist('core/fsx.js');
 const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-release-dag-timeout-'));

package/dist/scripts/release-gate-dag-runner.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { runReleaseGateDag } from '../core/release/release-gate-dag.js';
+import { releaseAuthorizationSnapshot } from '../core/release/release-authorization-snapshot.js';
 import { ensureDistFresh } from './lib/ensure-dist-fresh.js';
 import { ensureCurrentMigrationBeforeCommand } from '../core/update/update-migration-state.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
@@ -31,21 +33,38 @@ const presetIndex = args.indexOf('--preset');
 const preset = presetIndex >= 0 ? args[presetIndex + 1] : 'release';
 const gateIndex = args.indexOf('--gate');
 const gate = gateIndex >= 0 ? args[gateIndex + 1] : null;
+if (gateIndex >= 0 && (!gate || gate.startsWith('--')))
+    failRunner('release_gate_only_selection_id_missing');
 const changedSinceIndex = args.indexOf('--changed-since');
 const changedSince = changedSinceIndex >= 0 ? (args[changedSinceIndex + 1] || null) : null;
 const slaIndex = args.indexOf('--sla');
 const slaMs = slaIndex >= 0 ? parseDurationMs(args[slaIndex + 1] || '') : null;
-const result = await runReleaseGateDag({
-    root,
-    ...(gate ? { onlyGateIds: [gate] } : preset === undefined ? {} : { preset }),
-    changedSince,
-    slaMs,
-    full: args.includes('--full'),
-    explain: args.includes('--explain'),
-    noCache: args.includes('--no-cache'),
-    failFast: args.includes('--fail-fast'),
-    useGatePacks: args.includes('--use-gate-packs')
-});
+let authorizationSnapshot;
+try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    authorizationSnapshot = releaseAuthorizationSnapshot(root, pkg);
+}
+catch (error) {
+    failRunner(`release_authorization_snapshot_failed:${error instanceof Error ? error.message : String(error)}`);
+}
+let result;
+try {
+    result = await runReleaseGateDag({
+        root,
+        ...(gate ? { onlyGateIds: [gate] } : preset === undefined ? {} : { preset }),
+        changedSince,
+        slaMs,
+        full: args.includes('--full'),
+        explain: args.includes('--explain'),
+        noCache: args.includes('--no-cache'),
+        failFast: args.includes('--fail-fast'),
+        useGatePacks: args.includes('--use-gate-packs'),
+        releaseAuthorizationSnapshot: authorizationSnapshot
+    });
+}
+catch (error) {
+    failRunner(error instanceof Error ? error.message : String(error || 'release_gate_dag_failed'));
+}
 console.log(`SKS Release DAG
   gates: ${result.total_gates} total, ${result.selected_gates} selected, ${result.cached} cached
   affected: ${result.affected_selection?.mode || 'full'} selected=${result.selected_gate_ids.length} skipped=${result.skipped_by_affected.length}
@@ -78,6 +97,11 @@ if (!result.ok) {
     }
     process.exit(1);
 }
+function failRunner(blocker) {
+    console.error(`SKS Release DAG blocked: ${blocker}`);
+    console.log(JSON.stringify({ schema: 'sks.gate-result.v1', ok: false, blockers: [blocker] }));
+    process.exit(1);
+}
 function parseDurationMs(value) {
     const match = String(value || '').trim().match(/^(\d+(?:\.\d+)?)(ms|s|m)?$/i);
     if (!match)

package/dist/scripts/release-gate-existence-audit.js

@@ -12,12 +12,11 @@ const releaseIds = new Set(releaseGates.map((gate) => gate.id));
 const harnessIds = new Set(harnessGates.map((gate) => gate.id));
 const allGates = [...releaseGates, ...harnessGates];
 const requiredRelease = [
+    'architecture:guard',
     'codex:app-handoff-comprehensive',
     'qa-loop:comprehensive-verification',
     'loop-integration-finalizer-check',
     'naruto:canonical-stop-gate',
-    'agent:native-cli-session-swarm-scaling',
-    'agent:fast-mode-policy',
     'codex-control:event-stream-ledger',
     'runtime:proof-summary',
     'release:dag-runner',

package/dist/scripts/release-gate-script-parity-check.js

@@ -31,7 +31,7 @@ export const REQUIRED_3110_RELEASE_IDS = [
     'update:preserves-supabase-keys',
     'update:secret-preservation-guard',
     'update:secret-migration-journal',
-    'config:managed-merge-callsite-coverage',
+    'safety:mutation-callsite-coverage',
     'release:gate-script-parity',
     'release:wiring-3110-blackbox',
     'sks:3112-all-feature-regression'

package/dist/scripts/release-parallel-full-coverage-check.js

@@ -2,12 +2,18 @@
 // @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
-import { assertGate, emitGate, importDist, packageScripts, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/release-parallel-full-coverage.js');
-const pkgScripts = packageScripts();
-const parallelSource = fs.readFileSync(path.join(root, 'src/scripts/release-parallel-check.ts'), 'utf8');
-const current = [...new Set(Object.keys(pkgScripts).filter((name) => parallelSource.includes(name)).concat(Object.keys(pkgScripts).filter((name) => /^super-search|^super-search|^source-intelligence|^codex-web|^goal-mode|^agent:main-no-scout|^agent:worker-scout-limited|^agent:background-terminals|^agent:zellij-runtime|^agent:visual-consistency|^release:parallel-full-coverage|^priority:full-closure/.test(name))))];
+const manifest = JSON.parse(fs.readFileSync(path.join(root, 'release-gates.v2.json'), 'utf8'));
+const current = (Array.isArray(manifest?.gates) ? manifest.gates : [])
+    .filter((gate) => Array.isArray(gate?.preset) && gate.preset.includes('release'))
+    .map((gate) => String(gate.id || ''))
+    .filter(Boolean);
 const report = mod.evaluateReleaseParallelFullCoverage(current);
-assertGate(report.ok === true, 'release parallel DAG must preserve previous gates and include 1.18 gates', report);
-emitGate('release:parallel-full-coverage', { previous_gate_count: report.previous_gate_count, current_gate_count: report.current_gate_count });
+assertGate(report.ok === true, 'manifest-backed release parallel DAG is missing trust-critical gates', report);
+emitGate('release:parallel-full-coverage', {
+    critical_gate_count: report.critical_gate_count,
+    current_gate_count: report.current_gate_count,
+    authoritative_source: report.authoritative_source
+});
 //# sourceMappingURL=release-parallel-full-coverage-check.js.map

package/dist/scripts/release-parallel-speed-budget-check.js

@@ -14,9 +14,19 @@ const slowest = slowestGateResults(latest.dir);
 const warnOnly = process.env.SKS_RELEASE_SPEED_BUDGET_WARN_ONLY === '1';
 const budgetMs = Number(process.env.SKS_RELEASE_SPEED_BUDGET_MS || 20 * 60 * 1000);
 const cachedBudgetMs = Number(process.env.SKS_RELEASE_CACHED_SPEED_BUDGET_MS || 4 * 60 * 1000);
+const fastSlaMs = Number(process.env.SKS_RELEASE_FAST_SLA_MS || 5 * 60 * 1000);
 const cachedRatio = Number(summary.cached || 0) / Math.max(1, Number(summary.completed || summary.selected_gates || 1));
 const cachedRun = cachedRatio >= 0.5;
-const parallelismOk = cachedRun || summary.parallelism_gain >= 2;
+const parallelismGainTarget = 2;
+const parallelismPeakTarget = 2;
+const fastSlaMet = Number(summary.wall_ms || 0) <= fastSlaMs;
+// A long critical-path gate can keep measured gain below 2 even while the DAG
+// executes independent work concurrently and finishes inside the release SLA.
+// Preserve a real parallelism requirement, but accept either measured gain or
+// observed concurrent execution paired with the five-minute certificate SLA.
+const parallelismOk = cachedRun
+    || Number(summary.parallelism_gain || 0) >= parallelismGainTarget
+    || (Number(summary.peak_running || 0) >= parallelismPeakTarget && fastSlaMet);
 const wallOk = cachedRun ? summary.wall_ms <= cachedBudgetMs : summary.wall_ms <= budgetMs;
 const failureIds = Array.isArray(summary.failures) ? summary.failures.map((entry) => String(entry?.id || '')).filter(Boolean) : [];
 const selfFailureIds = new Set(['release:parallel-speed-budget', 'release:stability-report']);
@@ -43,11 +53,17 @@ const report = {
     target_full_wall_ms: budgetMs,
     target_cached_wall_ms: cachedBudgetMs,
     target_changed_file_wall_ms: 90 * 1000,
+    target_fast_sla_ms: fastSlaMs,
+    fast_sla_met: fastSlaMet,
     parallelism_gain: summary.parallelism_gain,
+    parallelism_gain_target: parallelismGainTarget,
+    peak_running: summary.peak_running,
+    parallelism_peak_target: parallelismPeakTarget,
+    parallel_execution_proven: parallelismOk,
     warn_only: warnOnly,
     blockers: [
         ...(summaryOk ? [] : ['release_summary_has_failures']),
-        ...(parallelismOk ? [] : ['parallelism_gain_below_2']),
+        ...(parallelismOk ? [] : ['parallel_execution_not_proven']),
         ...(wallOk || warnOnly ? [] : [cachedRun ? 'cached_release_wall_budget_exceeded' : 'release_wall_budget_exceeded']),
         ...(Number.isFinite(Number(summary.critical_path_ms)) ? [] : ['critical_path_ms_missing']),
         ...(Array.isArray(slowest) && slowest.length ? [] : ['slowest_gates_missing'])