sneakoscope 6.0.3 → 6.1.2

package/dist/scripts/release-real-check.js

@@ -1,12 +1,34 @@
 #!/usr/bin/env node
 // @ts-nocheck
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { writeJsonAtomic } from '../core/fsx.js';
+import { tmpdir, writeJsonAtomic } from '../core/fsx.js';
+import { buildReleaseRealLiveCoverage, dependencyReleaseRealResult, normalizeReleaseRealProcessResult, releaseRealDependencySatisfied, summarizeReleaseRealPhases, validateReleaseRealSkipProof, validateReleaseRealTaskIds } from '../core/release/release-real-contract.js';
+import { currentDistFreshness } from './lib/ensure-dist-fresh.js';
+import { releaseAuthorizationSnapshot, sameReleaseAuthorizationSnapshot } from '../core/release/release-authorization-snapshot.js';
 const args = process.argv.slice(2);
 const skipReleaseCheck = args.includes('--skip-release-check') || process.env.SKS_RELEASE_REAL_CHECK_SKIP_RELEASE_CHECK === '1';
 const root = process.cwd();
 const concurrency = Math.max(1, Math.min(4, Math.floor(Number(process.env.SKS_RELEASE_REAL_CHECK_CONCURRENCY || 2))));
+const releaseScratchDir = tmpdir('rr-');
+const releaseScratchEnv = {
+    TMPDIR: releaseScratchDir,
+    TMP: releaseScratchDir,
+    TEMP: releaseScratchDir,
+    SKS_TMP_DIR: releaseScratchDir
+};
+const zellijRunId = `${process.pid}-${Date.now().toString(36)}-${randomBytes(3).toString('hex')}`;
+const zellijMissionId = `M-release-real-zellij-${zellijRunId}`;
+const zellijSessionName = `sks-rrz-${zellijRunId}`;
+const zellijSocketDir = path.join('/tmp', `sks-zj-rr-${zellijRunId}`);
+const zellijOwnerToken = randomBytes(24).toString('hex');
+const zellijOwnedEnv = {
+    SKS_REQUIRE_ZELLIJ: '1',
+    SKS_ZELLIJ_CHECK_OWNER_TOKEN: zellijOwnerToken,
+    ZELLIJ_SOCKET_DIR: zellijSocketDir
+};
 const report = {
     schema: 'sks.release-real-check.v1',
     generated_at: new Date().toISOString(),
@@ -17,101 +39,157 @@ const report = {
         concurrency,
         dependency_model: 'dag-with-ordered-zellij-proof-chains'
     },
+    zellij_isolation: {
+        mission_id: zellijMissionId,
+        session_name: zellijSessionName,
+        socket_dir: zellijSocketDir,
+        user_sessions_shared: false
+    },
+    scratch_isolation: {
+        schema: 'sks.release-real-scratch-isolation.v1',
+        root: releaseScratchDir,
+        owned: true,
+        child_environment: ['TMPDIR', 'TMP', 'TEMP', 'SKS_TMP_DIR'],
+        zellij_socket_dir_preserved: true,
+        cleanup: null
+    },
     release_check: null,
+    skip_release_check_proof: null,
+    policy: {
+        schema: 'sks.release-real-policy.v1',
+        release_authorizing_requirement: 'every required check must have outcome=passed and a valid JSON contract',
+        live_optional_requirement: 'valid contracts are required; unavailable external credentials are reported as optional coverage and never counted as a required pass'
+    },
     environment_required_checks: [],
     real_smoke_checks: [],
     real_ui_checks: [],
+    release_authorizing_checks: [],
+    live_coverage: null,
+    emergency_cleanup: null,
     all_checks: [],
     phase_results: [],
     blockers: [],
     warnings: []
 };
+const nodeScript = (name, ...args) => [process.execPath, `./dist/scripts/${name}`, ...args];
+const terminalStatuses = ['failed', 'blocked', 'error', 'unavailable', 'real_required_missing', 'skipped', 'not_run', 'not_requested', 'integration_optional', 'optional', 'not_required', 'skipped_optional_unavailable'];
+const requiredPolicy = (expectedSchemas, options = {}) => ({
+    requirement: 'release_authorizing',
+    expectedSchemas,
+    statusRequired: options.statusRequired === true,
+    passStatuses: options.passStatuses || [],
+    allowedStatuses: [...new Set([...(options.passStatuses || []), ...terminalStatuses])]
+});
+const liveOptionalPolicy = (expectedSchemas, passStatuses = ['passed', 'proven']) => ({
+    requirement: 'live_optional',
+    expectedSchemas,
+    statusRequired: true,
+    passStatuses,
+    allowedStatuses: [...new Set([...passStatuses, ...terminalStatuses])]
+});
 const tasks = [
-    task('codex:actual-config-load-probe', 'codex:actual-config-load-probe', { group: 'environment_required', phase: 'parallel_processing' }),
-    task('codex:0.137-compat:require-real', 'codex:0.137-compat:require-real', { group: 'environment_required', phase: 'parallel_processing', env: { SKS_REQUIRE_CODEX_0137: '1' } }),
-    task('codex:0139-real-probes:require-real', 'codex:0139-real-probes:require-real', { group: 'environment_required', phase: 'parallel_processing' }),
-    task('codex:0139-code-mode-web-search-real', 'codex:0139-code-mode-web-search-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-rich-tool-schema-real', 'codex:0139-rich-tool-schema-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-doctor-env-real', 'codex:0139-doctor-env-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-plugin-marketplace-real', 'codex:0139-plugin-marketplace-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-plugin-cache-real', 'codex:0139-plugin-cache-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-sandbox-profile-alias-real', 'codex:0139-sandbox-profile-alias-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-interrupt-agent-real', 'codex:0139-interrupt-agent-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-image-path-real', 'codex:0139-image-path-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('codex:0139-sandbox-proxy-real', 'codex:0139-sandbox-proxy-real', { group: 'environment_required', phase: 'parallel_processing', deps: ['codex:0139-real-probes:require-real'] }),
-    task('doctor:codex-doctor-parity:actual', 'doctor:codex-doctor-parity:actual', { group: 'environment_required', phase: 'parallel_processing' }),
-    task('publish:dry-run-performance', 'publish:dry-run-performance', { group: 'environment_required', phase: 'parallel_processing' }),
-    task('zellij:capability', 'zellij:capability', { group: 'environment_required', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' } }),
-    task('zellij:layout-valid', 'zellij:layout-valid', { group: 'environment_required', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:capability'] }),
-    task('zellij:real-session-launch:base', 'zellij:real-session-launch', { group: 'environment_required', phase: 'parallel_verification', args: ['--require-real', '--main-only', '--mission', 'M-release-real-zellij', '--session', 'sks-rrz'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:layout-valid'] }),
-    task('zellij:pane-proof:base', 'zellij:pane-proof', { group: 'environment_required', phase: 'parallel_verification', args: ['--require-real', '--mission', 'M-release-real-zellij', '--session', 'sks-rrz', '--expected-lanes', '0'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:real-session-launch:base'] }),
-    task('zellij:screen-proof:base', 'zellij:screen-proof', { group: 'environment_required', phase: 'parallel_verification', args: ['--require-real', '--main-only', '--mission', 'M-release-real-zellij'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:real-session-launch:base'] }),
-    task('zellij:real-session-cleanup:base', 'zellij:real-session-cleanup', { group: 'environment_required', phase: 'aggregation', args: ['--mission', 'M-release-real-zellij', '--session', 'sks-rrz'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:pane-proof:base', 'zellij:screen-proof:base'] }),
-    task('zellij:first-slot-down-stack:real', 'zellij:first-slot-down-stack:real', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:layout-valid'] }),
-    task('zellij:right-column-real-geometry', 'zellij:right-column-real-geometry', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:layout-valid'] }),
-    task('naruto:zellij-dynamic-right-column', 'naruto:zellij-dynamic-right-column', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:layout-valid'] }),
-    task('zellij:worker-pane-real-ui:blackbox', 'zellij:worker-pane-real-ui:blackbox', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:layout-valid'] }),
-    task('zellij:real-session-launch:extra', 'zellij:real-session-launch', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real', '--main-only', '--mission', 'M-release-real-zellij-extra', '--session', 'sks-rrz-extra'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:layout-valid'] }),
-    task('zellij:pane-proof:extra', 'zellij:pane-proof', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real', '--mission', 'M-release-real-zellij-extra', '--session', 'sks-rrz-extra', '--expected-lanes', '0'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:real-session-launch:extra'] }),
-    task('zellij:screen-proof:extra', 'zellij:screen-proof', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real', '--main-only', '--mission', 'M-release-real-zellij-extra'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:real-session-launch:extra'] }),
-    task('zellij:real-session-cleanup:extra', 'zellij:real-session-cleanup', { group: 'real_ui', phase: 'aggregation', args: ['--mission', 'M-release-real-zellij-extra', '--session', 'sks-rrz-extra'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:pane-proof:extra', 'zellij:screen-proof:extra'] }),
-    task('naruto:worktree-coding:blackbox', 'naruto:worktree-coding:blackbox', { group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_GIT_WORKTREE: '1' } }),
-    task('codex-control:real-smoke', 'codex-control:real-smoke', { group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'] }),
-    task('codex-sdk:real-smoke', 'codex-sdk:real-smoke', { group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'] }),
-    task('local-llm:smoke', 'local-llm:smoke', { group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_LOCAL_LLM: '1' } }),
-    task('local-llm:throughput', 'local-llm:throughput', { group: 'real_smoke', phase: 'parallel_verification', env: { SKS_REQUIRE_LOCAL_LLM: '1' }, deps: ['local-llm:smoke'] }),
-    task('local-llm:cache-performance', 'local-llm:cache-performance', { group: 'real_smoke', phase: 'parallel_verification', env: { SKS_REQUIRE_LOCAL_LLM: '1' }, deps: ['local-llm:smoke'] }),
-    task('python-sdk:real-smoke', 'python-sdk:real-smoke', {
-        group: 'real_smoke',
-        phase: 'parallel_verification',
-        env: { SKS_REQUIRE_PYTHON_CODEX_SDK: '1', SKS_PYTHON_CODEX_SDK_TIMEOUT_MS: '240000' },
-        deps: ['codex-sdk:real-smoke', 'codex-control:real-smoke', 'agent:real-codex-in-zellij-worker-pane'],
-        retries: 2,
-        retryDelayMs: 1500
-    }),
-    task('codex:0.134-runner-truth', 'codex:0.134-runner-truth', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-patch-envelope-smoke', 'agent:real-codex-patch-envelope-smoke', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-parallel-workers', 'agent:real-codex-parallel-workers', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-parallel-workers-5', 'agent:real-codex-parallel-workers-5', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-parallel-workers-10', 'agent:real-codex-parallel-workers-10', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-parallel-workers-20', 'agent:real-codex-parallel-workers-20', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-dynamic-smoke-v2', 'agent:real-codex-dynamic-smoke-v2', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-dynamic-smoke', 'agent:real-codex-dynamic-smoke', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('agent:real-codex-in-zellij-worker-pane', 'agent:real-codex-in-zellij-worker-pane', { group: 'real_ui', phase: 'parallel_verification', args: ['--require-real'], deps: ['zellij:layout-valid'] }),
-    task('imagegen:real-smoke', 'imagegen:real-smoke', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('ux-review:real-imagegen-smoke', 'ux-review:real-imagegen-smoke', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('ppt:real-imagegen-smoke', 'ppt:real-imagegen-smoke', { group: 'real_smoke', phase: 'parallel_processing' }),
-    task('naruto:real-local-gpt-final-smoke', 'naruto:real-local-gpt-final-smoke', { group: 'real_smoke', phase: 'parallel_verification', env: { SKS_REQUIRE_LOCAL_LLM: '1', SKS_REQUIRE_GPT_FINAL: '1' }, deps: ['local-llm:smoke'] }),
-    task('local-collab:gpt-final-performance', 'local-collab:gpt-final-performance', { group: 'real_smoke', phase: 'parallel_verification', env: { SKS_REQUIRE_LOCAL_LLM: '1', SKS_REQUIRE_GPT_FINAL: '1' }, deps: ['local-llm:smoke'] })
+    task('codex:actual-config-load-probe', 'direct', { command: nodeScript('codex-config-load-probe.js', '--actual-codex', '--require-actual-codex', '--json'), group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.codex-config-load-probe.v2']) }),
+    task('codex:0144-core-real-probes:require-real', 'direct', { command: nodeScript('codex-0144-core-real-probes-check.js', '--require-real', '--allow-network'), group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.release-gate.v1']) }),
+    task('codex:0144:app-server-v2:real', 'direct', { command: nodeScript('codex-0144-app-server-v2-check.js'), group: 'environment_required', phase: 'parallel_processing', args: ['--require-real'], policy: requiredPolicy(['sks.release-gate.v1']) }),
+    task('codex:0144:capability:real', 'direct', { command: nodeScript('codex-0144-capability-check.js'), group: 'environment_required', phase: 'parallel_verification', args: ['--require-real'], deps: ['codex:0144:app-server-v2:real'], policy: requiredPolicy(['sks.release-gate.v1']) }),
+    task('doctor:actual', 'direct', { command: [process.execPath, './dist/bin/sks.js', 'doctor', '--json'], group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.doctor-status.v3'], { statusRequired: true, passStatuses: ['fast_readonly_ok', 'ok'] }) }),
+    task('publish:dry-run-performance', 'publish:dry-run-performance', { group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.npm-publish-performance.v1', 'sks.release-gate.v1']) }),
+    task('zellij:capability', 'zellij:capability', { group: 'environment_required', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, policy: requiredPolicy(['sks.zellij-capability.v1', 'sks.zellij-capability-check.v1'], { statusRequired: true, passStatuses: ['ok'] }) }),
+    task('zellij:layout-valid', 'zellij:layout-valid', { group: 'environment_required', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_ZELLIJ: '1' }, deps: ['zellij:capability'], policy: requiredPolicy(['sks.zellij-layout-valid-check.v1']) }),
+    task('zellij:real-session-launch', 'direct', { command: nodeScript('zellij-real-session-launch-check.js'), group: 'real_ui', phase: 'parallel_verification', args: ['--require-real', '--main-only', '--owned-session', '--mission', zellijMissionId, '--session', zellijSessionName], env: zellijOwnedEnv, deps: ['zellij:layout-valid'], policy: requiredPolicy(['sks.zellij-real-session-launch-check.v1']) }),
+    task('zellij:pane-proof', 'direct', { command: nodeScript('zellij-pane-proof-check.js'), group: 'real_ui', phase: 'parallel_verification', args: ['--require-real', '--mission', zellijMissionId, '--session', zellijSessionName, '--expected-lanes', '0'], env: zellijOwnedEnv, deps: ['zellij:real-session-launch'], policy: requiredPolicy(['sks.zellij-pane-proof.v1', 'sks.zellij-pane-proof-check.v1']) }),
+    task('zellij:screen-proof', 'direct', { command: nodeScript('zellij-screen-proof-check.js'), group: 'real_ui', phase: 'parallel_verification', args: ['--require-real', '--main-only', '--mission', zellijMissionId], env: zellijOwnedEnv, deps: ['zellij:real-session-launch'], policy: requiredPolicy(['sks.zellij-screen-proof.v1', 'sks.zellij-screen-proof-check.v1']) }),
+    task('zellij:real-session-cleanup', 'direct', { command: nodeScript('zellij-real-session-cleanup-check.js'), group: 'real_ui', phase: 'aggregation', args: ['--mission', zellijMissionId, '--session', zellijSessionName, '--owned-socket-dir', zellijSocketDir], env: zellijOwnedEnv, deps: ['zellij:pane-proof', 'zellij:screen-proof'], alwaysRun: true, policy: requiredPolicy(['sks.zellij-real-session-cleanup-check.v1']) }),
+    task('naruto:worktree-coding:blackbox', 'direct', { command: nodeScript('naruto-worktree-coding-blackbox.js'), group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_GIT_WORKTREE: '1' }, policy: requiredPolicy(['sks.release-gate.v1']) }),
+    task('codex-sdk:real-smoke', 'direct', { command: nodeScript('codex-sdk-real-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], policy: requiredPolicy(['sks.release-gate.v1'], { statusRequired: true, passStatuses: ['proven'] }) }),
+    task('agent:real-codex-parallel-workers-5', 'direct', { command: nodeScript('agent-real-codex-parallel-workers-5-check.js'), group: 'real_smoke', phase: 'parallel_processing', policy: liveOptionalPolicy(['sks.release-gate.v1', 'sks.real-codex-parallel-gate.v1']) }),
+    task('imagegen:real-smoke', 'direct', { command: nodeScript('imagegen-real-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', policy: liveOptionalPolicy(['sks.imagegen-real-smoke.v1'], ['passed']) }),
+    task('ux-review:real-imagegen-smoke', 'direct', { command: nodeScript('ux-review-real-imagegen-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', deps: ['imagegen:real-smoke'], policy: liveOptionalPolicy(['sks.ux-real-imagegen-smoke.v1'], ['passed']) }),
+    task('ppt:real-imagegen-smoke', 'direct', { command: nodeScript('ppt-real-imagegen-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', deps: ['imagegen:real-smoke'], policy: liveOptionalPolicy(['sks.ppt-real-imagegen-smoke.v1'], ['passed']) })
 ];
+const taskContract = validateReleaseRealTaskIds(tasks.map((row) => row.id));
+report.task_contract = taskContract;
+let ownedCleanupSucceeded = false;
+let emergencyCleanupPromise = null;
+let terminating = false;
+let skipProofRevalidated = false;
+let scratchCleanupSucceeded = false;
+const activeChildren = new Set();
 main().catch(async (err) => {
+    terminating = true;
     report.blockers.push(`release_real_check_exception:${err?.message || String(err)}`);
-    await finish(false);
+    await stopActiveChildren('SIGTERM');
+    await bestEffortOwnedZellijCleanup('exception');
+    await finish(false, 'exception');
 });
+for (const [signal, exitCode] of [['SIGINT', 130], ['SIGTERM', 143]]) {
+    process.once(signal, async () => {
+        if (terminating)
+            return;
+        terminating = true;
+        report.blockers.push(`release_real_check_signal:${signal}`);
+        await stopActiveChildren(signal);
+        await bestEffortOwnedZellijCleanup(`signal:${signal}`);
+        await finish(false, `signal:${signal}`);
+        process.exit(exitCode);
+    });
+}
 async function main() {
+    if (!taskContract.ok) {
+        report.blockers.push(...taskContract.missing_ids.map((id) => `release_real_task_missing:${id}`));
+        report.blockers.push(...taskContract.unexpected_ids.map((id) => `release_real_task_unexpected:${id}`));
+        report.blockers.push(...taskContract.duplicate_ids.map((id) => `release_real_task_duplicate:${id}`));
+        return await finish(false);
+    }
     if (!skipReleaseCheck) {
-        report.release_check = await runNpm(task('release:check', 'release:check', { group: 'design', phase: 'design' }));
+        report.release_check = await runNpm(task('release:check', 'release:check', { group: 'design', phase: 'design', policy: requiredPolicy(['sks.gate-result.v1']) }));
+        if (terminating)
+            return;
         collect(report.release_check);
         if (!report.release_check.ok)
             return await finish(false);
     }
     else {
+        const proof = buildSkipReleaseCheckProof();
+        report.skip_release_check_proof = proof;
         report.release_check = {
             id: 'release:check',
             script: 'release:check',
             group: 'design',
             phase: 'design',
-            ok: true,
+            requirement: 'release_authorizing',
+            required_for_release: true,
+            release_blocking: proof.ok !== true,
+            outcome: proof.ok === true ? 'passed' : 'blocked',
+            passed: proof.ok === true,
+            ok: proof.ok === true,
+            process_ok: null,
+            contract_ok: proof.ok === true,
             skipped: true,
-            note: 'Skipped because caller already verified release:check in this workspace.'
+            execution: 'reused_full_release_proof',
+            parsed_status: proof.ok === true ? 'proven_by_full_release_receipt' : 'skip_proof_invalid',
+            blockers: proof.blockers || [],
+            warnings: [],
+            duration_ms: 0,
+            note: proof.ok === true
+                ? 'Execution skipped only because the latest full release receipt is bound to the current source digest.'
+                : 'Skip denied because no current full release receipt is bound to this source digest.',
+            proof
         };
+        collect(report.release_check);
+        if (!report.release_check.ok)
+            return await finish(false);
     }
     const result = await runDag(tasks, concurrency);
+    if (terminating)
+        return;
     report.all_checks = result.results;
     report.environment_required_checks = result.results.filter((row) => row.group === 'environment_required');
     report.real_smoke_checks = result.results.filter((row) => row.group === 'real_smoke');
     report.real_ui_checks = result.results.filter((row) => row.group === 'real_ui');
-    report.phase_results = summarizePhases(result.results);
+    report.release_authorizing_checks = result.results.filter((row) => row.required_for_release === true);
+    report.live_coverage = buildReleaseRealLiveCoverage(result.results);
+    report.phase_results = summarizeReleaseRealPhases(['design', 'parallel_processing', 'parallel_verification', 'aggregation'], result.results, report.release_check);
     for (const row of result.results)
         collect(row);
     await finish(result.results.every((row) => row.ok));
@@ -120,11 +198,14 @@ function task(id, script, options = {}) {
     return {
         id,
         script,
+        command: options.command || null,
         group: options.group || 'real_smoke',
         phase: options.phase || 'parallel_processing',
         args: options.args || [],
         env: options.env || {},
         deps: options.deps || [],
+        alwaysRun: options.alwaysRun === true,
+        policy: options.policy || requiredPolicy(['sks.release-gate.v1']),
         retries: Number(options.retries || 0),
         retryDelayMs: Number(options.retryDelayMs || 0)
     };
@@ -135,16 +216,23 @@ async function runDag(taskList, maxConcurrency) {
     const completed = new Map();
     const results = [];
     while (pending.size || running.size) {
+        if (terminating) {
+            await Promise.allSettled([...running.values()]);
+            return { results };
+        }
         for (const [id, row] of [...pending]) {
-            const failedDeps = row.deps.filter((dep) => completed.has(dep) && !completed.get(dep).ok);
-            if (failedDeps.length) {
+            const depsComplete = row.deps.every((dep) => completed.has(dep));
+            const unsatisfiedDeps = depsComplete
+                ? row.deps.filter((dep) => !releaseRealDependencySatisfied(completed.get(dep)))
+                : [];
+            if (unsatisfiedDeps.length && !row.alwaysRun) {
                 pending.delete(id);
-                const blocked = blockedResult(row, failedDeps);
+                const blocked = dependencyReleaseRealResult(row, unsatisfiedDeps.map((dep) => completed.get(dep)));
                 completed.set(id, blocked);
                 results.push(blocked);
             }
         }
-        const ready = [...pending.values()].filter((row) => row.deps.every((dep) => completed.get(dep)?.ok === true));
+        const ready = [...pending.values()].filter((row) => row.deps.every((dep) => completed.has(dep) && (row.alwaysRun || releaseRealDependencySatisfied(completed.get(dep)))));
         while (running.size < maxConcurrency && ready.length) {
             const row = ready.shift();
             pending.delete(row.id);
@@ -154,7 +242,8 @@ async function runDag(taskList, maxConcurrency) {
         if (!running.size) {
             if (pending.size) {
                 for (const row of pending.values()) {
-                    const blocked = blockedResult(row, row.deps.filter((dep) => !completed.get(dep)?.ok));
+                    const dependencies = row.deps.map((dep) => completed.get(dep) || { id: dep, outcome: 'blocked', ok: false });
+                    const blocked = dependencyReleaseRealResult(row, dependencies);
                     completed.set(row.id, blocked);
                     results.push(blocked);
                 }
@@ -175,67 +264,59 @@ async function runNpm(row) {
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
         const result = await runNpmOnce(row, attempt);
         attempts.push(compactAttempt(result));
-        if (result.ok || attempt >= maxAttempts) {
-            return {
+        if (terminating || result.ok || attempt >= maxAttempts) {
+            const finalResult = {
                 ...result,
                 attempt,
                 attempts,
                 retried: attempts.length > 1
             };
+            if (row.id === 'zellij:real-session-cleanup' && finalResult.outcome === 'passed')
+                ownedCleanupSucceeded = true;
+            return finalResult;
         }
         await sleep(Math.max(0, Number(row.retryDelayMs || 0)));
     }
 }
 function runNpmOnce(row, attempt) {
-    const npmArgs = ['run', row.script, '--silent'];
-    if (row.args?.length)
-        npmArgs.push('--', ...row.args);
+    const direct = Array.isArray(row.command) && row.command.length > 0;
+    const bin = direct ? row.command[0] : 'npm';
+    const processArgs = direct
+        ? [...row.command.slice(1), ...(row.args || [])]
+        : ['run', row.script, '--silent', ...(row.args?.length ? ['--', ...row.args] : [])];
+    const commandLine = [bin, ...processArgs];
     const started = Date.now();
     let stdout = '';
     let stderr = '';
     return new Promise((resolve) => {
-        const child = spawn('npm', npmArgs, {
+        const child = spawn(bin, processArgs, {
             cwd: root,
-            env: { ...process.env, ...(row.env || {}) },
+            env: { ...process.env, ...(row.env || {}), ...releaseScratchEnv },
+            detached: process.platform !== 'win32',
             stdio: ['ignore', 'pipe', 'pipe']
         });
+        activeChildren.add(child);
         child.stdout.on('data', (chunk) => { stdout = appendTail(stdout, chunk); });
         child.stderr.on('data', (chunk) => { stderr = appendTail(stderr, chunk); });
         child.on('error', (err) => {
-            resolve(normalizeResult(row, npmArgs, 1, null, { code: err.code, message: err.message }, stdout, stderr, Date.now() - started, attempt));
+            activeChildren.delete(child);
+            resolve(normalizeResult(row, commandLine, 1, null, { code: err.code, message: err.message }, stdout, stderr, Date.now() - started, attempt));
         });
         child.on('close', (code, signal) => {
-            resolve(normalizeResult(row, npmArgs, code, signal, null, stdout, stderr, Date.now() - started, attempt));
+            activeChildren.delete(child);
+            resolve(normalizeResult(row, commandLine, code, signal, null, stdout, stderr, Date.now() - started, attempt));
         });
     });
 }
-function normalizeResult(row, npmArgs, code, signal, error, stdout, stderr, durationMs, attempt) {
-    const parsed = parseJson(stdout);
-    return {
-        id: row.id,
-        script: row.script,
-        group: row.group,
-        phase: row.phase,
-        deps: row.deps || [],
-        command: ['npm', ...npmArgs],
-        ok: code === 0,
-        attempt,
-        exit_code: code,
-        signal,
-        duration_ms: durationMs,
-        error,
-        parsed_schema: parsed?.schema || null,
-        parsed_ok: typeof parsed?.ok === 'boolean' ? parsed.ok : null,
-        blockers: extractList(parsed, 'blockers'),
-        warnings: extractList(parsed, 'warnings'),
-        stdout_tail: tail(stdout),
-        stderr_tail: tail(stderr)
-    };
+function normalizeResult(row, commandLine, code, signal, error, stdout, stderr, durationMs, attempt) {
+    return normalizeReleaseRealProcessResult({ task: row, commandLine, code, signal, error, stdout, stderr, durationMs, attempt });
 }
 function compactAttempt(result) {
     return {
         attempt: result.attempt,
         ok: result.ok,
+        outcome: result.outcome,
+        contract_ok: result.contract_ok,
         exit_code: result.exit_code,
         duration_ms: result.duration_ms,
         blockers: result.blockers || [],
@@ -245,89 +326,175 @@ function compactAttempt(result) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function blockedResult(row, failedDeps) {
-    return {
-        id: row.id,
-        script: row.script,
-        group: row.group,
-        phase: row.phase,
-        deps: row.deps || [],
-        command: ['npm', 'run', row.script, '--silent'],
-        ok: false,
-        blocked: true,
-        exit_code: null,
-        signal: null,
-        duration_ms: 0,
-        error: null,
-        parsed_schema: null,
-        parsed_ok: null,
-        blockers: failedDeps.map((dep) => `blocked_by_failed_dependency:${dep}`),
-        warnings: [],
-        stdout_tail: '',
-        stderr_tail: `blocked by failed dependency: ${failedDeps.join(', ')}`
-    };
-}
-function collect(result) {
-    for (const blocker of result.blockers || []) {
+async function stopActiveChildren(signal = 'SIGTERM') {
+    const children = [...activeChildren];
+    if (!children.length)
+        return { ok: true, stopped: 0, escalated: 0 };
+    for (const child of children)
+        signalChildTree(child, signal);
+    await settleWithTimeout(children.map(waitForChildClose), 5_000);
+    const remaining = children.filter((child) => child.exitCode === null && child.signalCode === null);
+    for (const child of remaining)
+        signalChildTree(child, 'SIGKILL');
+    if (remaining.length)
+        await settleWithTimeout(remaining.map(waitForChildClose), 1_000);
+    const survivors = remaining.filter((child) => child.exitCode === null && child.signalCode === null);
+    if (survivors.length) {
+        const blocker = `release_real_child_cleanup_not_proven:${survivors.length}`;
         if (!report.blockers.includes(blocker))
             report.blockers.push(blocker);
+        if (!report.warnings.includes(blocker))
+            report.warnings.push(blocker);
+    }
+    return { ok: survivors.length === 0, stopped: children.length, escalated: remaining.length };
+}
+function signalChildTree(child, signal) {
+    if (!child?.pid || child.exitCode !== null || child.signalCode !== null)
+        return;
+    try {
+        if (process.platform === 'win32')
+            child.kill(signal);
+        else
+            process.kill(-child.pid, signal);
+    }
+    catch (error) {
+        if (error?.code !== 'ESRCH') {
+            const warning = `release_real_child_signal_failed:${child.pid}:${signal}:${error?.code || 'unknown'}`;
+            if (!report.warnings.includes(warning))
+                report.warnings.push(warning);
+        }
+    }
+}
+function waitForChildClose(child) {
+    if (child.exitCode !== null || child.signalCode !== null)
+        return Promise.resolve();
+    return new Promise((resolve) => child.once('close', resolve));
+}
+async function settleWithTimeout(promises, timeoutMs) {
+    let timer = null;
+    try {
+        await Promise.race([
+            Promise.allSettled(promises),
+            new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); })
+        ]);
     }
-    if (!result.ok && !(result.blockers || []).length) {
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function bestEffortOwnedZellijCleanup(trigger) {
+    if (ownedCleanupSucceeded) {
+        report.emergency_cleanup = { trigger, ok: true, outcome: 'already_cleaned' };
+        return report.emergency_cleanup;
+    }
+    if (emergencyCleanupPromise)
+        return emergencyCleanupPromise;
+    const cleanupTask = tasks.find((row) => row.id === 'zellij:real-session-cleanup');
+    emergencyCleanupPromise = cleanupTask
+        ? runNpm(cleanupTask).then((result) => {
+            report.emergency_cleanup = { trigger, ...result };
+            if (!result.ok)
+                report.warnings.push(`zellij_emergency_cleanup_not_proven:${trigger}`);
+            return report.emergency_cleanup;
+        }).catch((error) => {
+            report.emergency_cleanup = { trigger, ok: false, outcome: 'failed', error: error?.message || String(error) };
+            report.warnings.push(`zellij_emergency_cleanup_exception:${trigger}`);
+            return report.emergency_cleanup;
+        })
+        : Promise.resolve({ trigger, ok: false, outcome: 'failed', error: 'cleanup_task_missing' });
+    return emergencyCleanupPromise;
+}
+function collect(result) {
+    if (result.release_blocking === true || result.ok === false) {
+        for (const blocker of result.blockers || []) {
+            if (!report.blockers.includes(blocker))
+                report.blockers.push(blocker);
+        }
+    }
+    if ((result.release_blocking === true || result.ok === false) && !(result.blockers || []).length) {
         const blocker = `${result.id.replace(/[^A-Za-z0-9]+/g, '_')}_failed`;
         if (!report.blockers.includes(blocker))
             report.blockers.push(blocker);
     }
+    if (result.requirement === 'live_optional' && result.outcome !== 'passed') {
+        const warning = `optional_live_coverage_not_proven:${result.id}:${result.outcome}`;
+        if (!report.warnings.includes(warning))
+            report.warnings.push(warning);
+    }
     for (const warning of result.warnings || []) {
         if (!report.warnings.includes(warning))
             report.warnings.push(warning);
     }
 }
-function summarizePhases(results) {
-    return ['design', 'parallel_processing', 'parallel_verification', 'aggregation'].map((phase) => {
-        const rows = phase === 'design' ? [report.release_check].filter(Boolean) : results.filter((row) => row.phase === phase);
-        return {
-            phase,
-            total: rows.length,
-            passed: rows.filter((row) => row.ok).length,
-            failed: rows.filter((row) => !row.ok).length,
-            duration_ms: rows.reduce((sum, row) => sum + Number(row.duration_ms || 0), 0)
+async function finish(ok, trigger = 'finish') {
+    if (skipReleaseCheck && report.skip_release_check_proof?.ok === true && !skipProofRevalidated) {
+        skipProofRevalidated = true;
+        const initialProof = report.skip_release_check_proof;
+        const finalProof = buildSkipReleaseCheckProof();
+        const identityMatches = finalProof.ok === true
+            && finalProof.run_id === initialProof.run_id
+            && finalProof.latest_summary_sha256 === initialProof.latest_summary_sha256
+            && sameReleaseAuthorizationSnapshot(finalProof, initialProof)
+            && finalProof.dist_source_digest === initialProof.dist_source_digest
+            && finalProof.dist_source_file_count === initialProof.dist_source_file_count
+            && finalProof.dist_stamp_source_digest === initialProof.dist_stamp_source_digest;
+        report.skip_release_check_proof = {
+            ...initialProof,
+            stable_through_real_checks: identityMatches,
+            final_revalidation: finalProof
         };
-    });
-}
-async function finish(ok) {
+        if (report.release_check?.proof)
+            report.release_check.proof = report.skip_release_check_proof;
+        if (!identityMatches) {
+            const blocker = 'release_real_skip_proof_changed_during_run';
+            if (!report.blockers.includes(blocker))
+                report.blockers.push(blocker);
+            ok = false;
+        }
+    }
+    const scratchCleanup = cleanupReleaseScratch(trigger);
+    if (!scratchCleanup.ok)
+        ok = false;
     report.ok = ok && report.blockers.length === 0;
     await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'release-real-check.json'), report);
     console.log(JSON.stringify(report, null, 2));
     if (!report.ok)
         process.exitCode = 1;
 }
-function parseJson(text) {
-    const value = String(text || '').trim();
-    if (!value)
-        return null;
-    const start = value.indexOf('{');
-    if (start < 0)
-        return null;
+function cleanupReleaseScratch(trigger) {
+    if (scratchCleanupSucceeded) {
+        const cleanup = { trigger, ok: true, removed: true, outcome: 'already_removed' };
+        report.scratch_isolation.cleanup = cleanup;
+        return cleanup;
+    }
+    let error = null;
     try {
-        return JSON.parse(value.slice(start));
+        fs.rmSync(releaseScratchDir, { recursive: true, force: true });
     }
-    catch {
-        return null;
+    catch (caught) {
+        error = caught?.message || String(caught);
     }
-}
-function extractList(parsed, key) {
-    if (!parsed || typeof parsed !== 'object')
-        return [];
-    const values = [];
-    const top = parsed[key];
-    const nested = parsed.report && typeof parsed.report === 'object' ? parsed.report[key] : null;
-    for (const list of [top, nested]) {
-        if (Array.isArray(list))
-            values.push(...list);
+    const removed = !fs.existsSync(releaseScratchDir);
+    scratchCleanupSucceeded = removed;
+    const cleanup = {
+        trigger,
+        ok: removed,
+        removed,
+        outcome: removed ? 'removed' : 'cleanup_not_proven',
+        ...(error ? { error } : {})
+    };
+    report.scratch_isolation.cleanup = cleanup;
+    if (!removed) {
+        const blocker = 'release_real_scratch_cleanup_not_proven';
+        if (!report.blockers.includes(blocker))
+            report.blockers.push(blocker);
+        if (!report.warnings.includes(blocker))
+            report.warnings.push(blocker);
     }
-    return [...new Set(values)];
+    return cleanup;
 }
-function appendTail(previous, chunk, limit = 50 * 1024) {
+function appendTail(previous, chunk, limit = 2 * 1024 * 1024) {
     const text = previous + String(chunk || '');
     return text.length <= limit ? text : text.slice(-limit);
 }
@@ -335,4 +502,70 @@ function tail(value, limit = 4000) {
     const text = String(value || '');
     return text.length <= limit ? text : text.slice(-limit);
 }
+function buildSkipReleaseCheckProof() {
+    const summaryPath = latestReleaseGateSummaryPath();
+    const summary = readJson(summaryPath);
+    const freshness = currentDistFreshness();
+    const pkg = readJson(path.join(root, 'package.json'));
+    const authorizationSnapshot = releaseAuthorizationSnapshot(root, pkg);
+    const summaryMtimeMs = fileMtime(summaryPath);
+    const distStampMtimeMs = fileMtime(freshness.stamp_path);
+    const maxAgeMs = Math.max(60_000, Number(process.env.SKS_RELEASE_REAL_SKIP_MAX_AGE_MS || 6 * 60 * 60 * 1000));
+    return validateReleaseRealSkipProof({
+        summary,
+        expectedReleaseGateIds: releasePresetGateIds(),
+        summaryPath: summaryPath ? path.relative(root, summaryPath).split(path.sep).join('/') : null,
+        summaryMtimeMs,
+        summarySha256: summaryPath ? sha256File(summaryPath) : null,
+        distStamp: freshness.stamp,
+        distStampPath: freshness.stamp_path ? path.relative(root, freshness.stamp_path).split(path.sep).join('/') : null,
+        distStampMtimeMs,
+        authorizationSnapshot,
+        currentDistSourceDigest: freshness.source_digest || null,
+        currentDistSourceFileCount: Number.isInteger(freshness.source_file_count) ? freshness.source_file_count : null,
+        nowMs: Date.now(),
+        maxAgeMs
+    });
+}
+function releasePresetGateIds() {
+    const manifest = readJson(path.join(root, 'release-gates.v2.json'));
+    return (Array.isArray(manifest?.gates) ? manifest.gates : [])
+        .filter((gate) => Array.isArray(gate?.preset) && gate.preset.includes('release'))
+        .map((gate) => String(gate.id || ''))
+        .filter(Boolean);
+}
+function latestReleaseGateSummaryPath() {
+    const dir = path.join(root, '.sneakoscope', 'reports', 'release-gates');
+    if (!fs.existsSync(dir))
+        return null;
+    return fs.readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => path.join(dir, entry.name, 'summary.json'))
+        .filter((file) => fs.existsSync(file))
+        .sort((left, right) => Number(fileMtime(right) || 0) - Number(fileMtime(left) || 0))[0] || null;
+}
+function readJson(file) {
+    try {
+        return file ? JSON.parse(fs.readFileSync(file, 'utf8')) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function fileMtime(file) {
+    try {
+        return file ? fs.statSync(file).mtimeMs : null;
+    }
+    catch {
+        return null;
+    }
+}
+function sha256File(file) {
+    try {
+        return createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=release-real-check.js.map