sneakoscope 6.0.3 → 6.1.2

package/dist/scripts/release-registry-check.js

@@ -4,10 +4,13 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { readCurrentNpmPackProof } from '../core/release/npm-pack-proof.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const expectedRegistry = 'https://registry.npmjs.org/';
 const requireUnpublished = process.argv.includes('--require-unpublished');
 const requirePublishAuth = process.argv.includes('--require-publish-auth');
+const requirePackProof = process.argv.includes('--require-pack-proof');
+const publishAuthMode = String(process.env.SKS_PUBLISH_AUTH_MODE || 'token').trim().toLowerCase();
 const skipNetwork = process.env.SKS_SKIP_REGISTRY_NETWORK_CHECK === '1';
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function fail(message, detail = '') {
@@ -135,21 +138,10 @@ function checkLockfile(pkg) {
     }
 }
 function checkPackedMetadata(pkg) {
-    const env = npmRegistryReadEnv({
-        npm_config_cache: process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache')
-    });
-    const result = run(npmBin, ['pack', '--dry-run', '--json', '--ignore-scripts', '--registry', expectedRegistry], { env });
-    if (result.status !== 0)
-        fail('npm pack dry-run failed', `${result.stdout || ''}\n${result.stderr || ''}`);
-    let info;
-    try {
-        info = JSON.parse(result.stdout)[0];
-    }
-    catch {
-        fail('npm pack dry-run returned non-json output', result.stdout || '');
-    }
-    if (!info)
-        fail('npm pack dry-run returned no package metadata');
+    const packProof = readCurrentNpmPackProof(root);
+    if (!packProof.ok || !packProof.proof)
+        fail('current npm pack proof is required', packProof.blockers.join('\n'));
+    const info = packProof.proof.info;
     if (info.name !== pkg.name || info.version !== pkg.version) {
         fail('packed package metadata differs from package.json', `pack: ${info.name || 'missing'}@${info.version || 'missing'}\npackage.json: ${pkg.name}@${pkg.version}`);
     }
@@ -219,6 +211,13 @@ function isBackfillTag(value) {
     return /^backfill(?:[-_][a-z0-9.-]+)?$/i.test(String(value || ''));
 }
 function checkPublishAuth(pkg) {
+    if (publishAuthMode === 'trusted-publisher') {
+        checkTrustedPublisherAuth(pkg);
+        return;
+    }
+    if (publishAuthMode !== 'token') {
+        fail('unsupported npm publish auth mode', `SKS_PUBLISH_AUTH_MODE=${publishAuthMode}`);
+    }
     if (skipNetwork) {
         fail('publish auth check cannot run when SKS_SKIP_REGISTRY_NETWORK_CHECK=1 is set');
     }
@@ -261,6 +260,48 @@ function checkPublishAuth(pkg) {
     fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
     console.log(`Publish auth check passed: ${pkg.name}@${pkg.version} as ${user}.`);
 }
+function checkTrustedPublisherAuth(pkg) {
+    const expectedRepository = githubRepositorySlug(pkg);
+    const workflowRef = String(process.env.GITHUB_WORKFLOW_REF || '');
+    const blockers = [
+        process.env.GITHUB_ACTIONS === 'true' ? null : 'github_actions_environment_missing',
+        process.env.GITHUB_REF === 'refs/heads/main' ? null : 'trusted_publish_ref_not_main',
+        process.env.GITHUB_REPOSITORY === expectedRepository ? null : 'trusted_publish_repository_mismatch',
+        workflowRef.includes(`${expectedRepository}/.github/workflows/publish-npm.yml@refs/heads/main`)
+            ? null
+            : 'trusted_publish_workflow_ref_mismatch',
+        process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? null : 'oidc_request_url_missing',
+        process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ? null : 'oidc_request_token_missing'
+    ].filter(Boolean);
+    if (blockers.length > 0) {
+        fail('npm trusted-publisher environment is incomplete', `${blockers.join('\n')}\nUse the manual publish-npm.yml workflow on refs/heads/main with id-token: write.`);
+    }
+    const report = {
+        schema: 'sks.release-publish-auth.v1',
+        ok: true,
+        package: pkg.name,
+        version: pkg.version,
+        registry: expectedRegistry,
+        auth_mode: 'trusted-publisher',
+        github_repository: expectedRepository,
+        github_ref: process.env.GITHUB_REF,
+        workflow_file: 'publish-npm.yml',
+        oidc_environment_present: true,
+        identity_verified_by_registry_at_publish: false,
+        generated_at: new Date().toISOString()
+    };
+    const out = path.join(root, '.sneakoscope', 'reports', 'release-publish-auth.json');
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+    console.log(`Trusted-publisher environment check passed: ${pkg.name}@${pkg.version} from ${expectedRepository}.`);
+}
+function githubRepositorySlug(pkg) {
+    const repository = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
+    const match = String(repository || '').match(/github\.com[/:]([^/]+\/[^/#]+?)(?:\.git)?$/i);
+    if (!match?.[1])
+        fail('package.json repository must identify the GitHub trusted-publisher repository');
+    return match[1].replace(/\.git$/i, '');
+}
 function publishAuthRepairInstructions(pkg, authHints) {
     const lines = [];
     if (authHints.length > 0) {
@@ -364,7 +405,11 @@ const pkg = readJson('package.json');
 checkPackagePublishConfig(pkg);
 checkRootNpmrc(pkg);
 checkLockfile(pkg);
-checkPackedMetadata(pkg);
+if (skipNetwork && (requireUnpublished || requirePublishAuth)) {
+    fail('registry network checks cannot be skipped for publish-authorizing validation');
+}
+if (requirePackProof)
+    checkPackedMetadata(pkg);
 checkPublishedVersion(pkg);
 if (requirePublishAuth)
     checkPublishAuth(pkg);

package/dist/scripts/release-runtime-truth-matrix-check.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildRuntimeTruthMatrix, writeRuntimeTruthMatrix } from '../core/proof/runtime-truth-matrix.js';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const matrix = await buildRuntimeTruthMatrix({
+    root,
+    releaseVersion: String(pkg.version || '')
+});
+await writeRuntimeTruthMatrix(root, matrix);
+assertGate(matrix.ok === true, 'runtime truth matrix contains blocking evidence', {
+    blockers: matrix.blockers,
+    required_rows: matrix.rows.filter((row) => row.required_mode)
+});
+emitGate('release:runtime-truth-matrix', {
+    report: `.sneakoscope/reports/runtime-truth-matrix-${pkg.version}.json`,
+    rows: matrix.rows.length,
+    priorities: matrix.priorities
+});
+//# sourceMappingURL=release-runtime-truth-matrix-check.js.map

package/dist/scripts/research-blueprint-densifier-check.js

@@ -12,10 +12,10 @@ const plan = await research.writeResearchPlan(dir, 'blueprint densifier blackbox
 const graph = workGraph.buildResearchWorkGraph(plan);
 await cycleRunner.runResearchCycle({ root: process.cwd(), dir, plan, graph, cycle: 1, backend: 'mock', timeoutMs: 120000, maxParallelStages: 4, mock: true });
 const blueprint = JSON.parse(fs.readFileSync(path.join(dir, 'implementation-blueprint.json'), 'utf8'));
-assertGate(blueprint.repository_aware === true, 'blueprint must be repository-aware', blueprint);
+assertGate(blueprint.repository_aware === true || (blueprint.domain_research === true && blueprint.handoff_route === 'research_validation'), 'blueprint must preserve either a repository-aware implementation boundary or an explicit domain-research validation boundary', blueprint);
 assertGate((blueprint.existing_files || []).length > 0, 'blueprint must list concrete existing files', blueprint);
 assertGate((blueprint.sections || []).length >= 8, 'blueprint must keep required sections', blueprint);
-assertGate((blueprint.test_commands || []).some((cmd) => String(cmd).includes('research:stage-cycle-runtime-blackbox')), 'blueprint must include concrete test commands', blueprint);
+assertGate((blueprint.test_commands || []).some((cmd) => /^(?:procedure:|npm |node |cargo )/.test(String(cmd))), 'blueprint must include concrete verification commands or procedures', blueprint);
 assertGate(fs.existsSync(path.join(dir, 'team-handoff-goal.md')), 'team handoff goal must exist');
 emitGate('research:blueprint-densifier', { dir, sections: blueprint.sections.length, files: blueprint.existing_files.length });
 //# sourceMappingURL=research-blueprint-densifier-check.js.map

package/dist/scripts/research-real-cycle-no-legacy-final-md-check.js

@@ -3,12 +3,16 @@
 import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const source = readText('src/core/commands/research-command.ts');
 const defaultIndex = source.indexOf('const cycleResult = await runResearchCycle({');
-const legacyIndex = source.indexOf('const legacyResearchCycle');
-const legacyExecIndex = source.indexOf('runCodexExec({');
 assertGate(defaultIndex > 0, 'default research run must call runResearchCycle with object input');
-assertGate(source.includes('--legacy-research-cycle'), 'legacy research cycle flag must exist');
-assertGate(source.includes('SKS_RESEARCH_LEGACY_CYCLE'), 'legacy research cycle env flag must exist');
-assertGate(source.includes('legacy_final_md_loop'), 'legacy final.md loop must be explicitly marked');
-assertGate(legacyExecIndex > legacyIndex, 'runCodexExec final.md path must live after legacy gate');
-emitGate('research:real-cycle-no-legacy-final-md', { defaultIndex, legacyIndex, legacyExecIndex });
+for (const removed of ['SKS_RESEARCH_LEGACY_CYCLE', 'legacy_final_md_loop', 'runCodexExec({', 'runNativeAgentOrchestrator']) {
+    assertGate(!source.includes(removed), `legacy Research runtime token must be absent: ${removed}`);
+}
+assertGate(source.includes('REMOVED_RESEARCH_RUNTIME_FLAGS')
+    && source.includes('Unsupported legacy Research runtime option:'), 'removed Research flags must fail closed');
+for (const removedFlag of ['--legacy-research-cycle', '--native-proof-only']) {
+    assertGate(source.includes(removedFlag), `removed Research flag blocker missing: ${removedFlag}`);
+}
+assertGate(source.includes("source_acquisition: 'super-search'"), 'Research run must record Super Search acquisition');
+assertGate(source.includes("reviewer_workflow: 'official_codex_subagent'"), 'Research run must record official subagent review');
+emitGate('research:real-cycle-no-legacy-final-md', { defaultIndex, legacy_runtime_removed: true, official_subagents: true, super_search: true });
 //# sourceMappingURL=research-real-cycle-no-legacy-final-md-check.js.map

package/dist/scripts/route-proof-artifact-structure-check.js

@@ -69,6 +69,7 @@ async function runNegativeFixture() {
         mission_id: mission,
         status: 'verified',
         route: '$Team',
+        execution_class: 'real',
         summary: { files_changed: 0, commands_run: 0, tests_passed: 0, tests_failed: 0, manual_review_required: false },
         evidence: {
             agents: {

package/dist/scripts/search-visibility-gate-lib.js

@@ -36,7 +36,7 @@ export function makeSearchVisibilityFixture(name = 'search-visibility', options
 }
 export function runSks(args, options = {}) {
     const result = spawnSync(process.execPath, [path.join(root, 'dist', 'bin', 'sks.js'), ...args], {
-        cwd: root,
+        cwd: options.cwd || root,
         encoding: 'utf8',
         stdio: 'pipe',
         env: {

package/dist/scripts/seo-geo-route-identity-check.js

@@ -1,12 +1,38 @@
 #!/usr/bin/env node
 // @ts-nocheck
-import { assertGate, emitGate, runSksJson } from './search-visibility-gate-lib.js';
-const seo = runSksJson(['run', '$SEO-GEO-OPTIMIZER SEO audit this fixture', '--execute', '--json']).json;
-const geo = runSksJson(['run', '$SEO-GEO-OPTIMIZER Generative Engine Optimization audit AI search visibility', '--execute', '--json']).json;
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, makeSearchVisibilityFixture, runSksJson } from './search-visibility-gate-lib.js';
+const fixture = makeSearchVisibilityFixture('seo-geo-route-identity');
+fs.mkdirSync(path.join(fixture, '.sneakoscope'), { recursive: true });
+let seo;
+let geo;
+let seoMissionIsolated = false;
+let geoMissionIsolated = false;
+const cleanupFixture = () => fs.rmSync(fixture, { recursive: true, force: true });
+process.once('exit', cleanupFixture);
+try {
+    seo = runSksJson(['run', '$SEO-GEO-OPTIMIZER SEO audit this fixture', '--execute', '--json'], { cwd: fixture }).json;
+    seoMissionIsolated = fs.existsSync(path.join(fixture, '.sneakoscope', 'missions', seo.mission_id));
+    geo = runSksJson(['run', '$SEO-GEO-OPTIMIZER Generative Engine Optimization audit AI search visibility', '--execute', '--json'], { cwd: fixture }).json;
+    geoMissionIsolated = fs.existsSync(path.join(fixture, '.sneakoscope', 'missions', geo.mission_id));
+}
+finally {
+    cleanupFixture();
+    process.removeListener('exit', cleanupFixture);
+}
 const seoText = JSON.stringify(seo);
 const geoText = JSON.stringify(geo);
+assertGate(seoMissionIsolated && geoMissionIsolated, 'SEO/GEO route identity missions must stay inside the hermetic fixture', {
+    fixture,
+    seo_mission_id: seo.mission_id,
+    geo_mission_id: geo.mission_id,
+    seo_mission_isolated: seoMissionIsolated,
+    geo_mission_isolated: geoMissionIsolated
+});
 assertGate(/\$SEO-GEO-OPTIMIZER/.test(seoText) && /sks seo-geo-optimizer/.test(seoText) && /--mode seo/.test(seoText), 'sks run --execute must preserve unified optimizer route and execute seo mode path', seo);
 assertGate(/\$SEO-GEO-OPTIMIZER/.test(geoText) && /sks seo-geo-optimizer/.test(geoText) && /--mode geo/.test(geoText), 'sks run --execute must preserve unified optimizer route and execute geo mode path', geo);
 assertGate(!/\$AutoResearch/.test(seoText) && !/\$AutoResearch/.test(geoText), 'SEO/GEO route identity must not collapse into AutoResearch', { seo, geo });
-emitGate('seo-geo:route-identity', { seo_status: seo.status, geo_status: geo.status });
+assertGate(!fs.existsSync(fixture), 'SEO/GEO route identity fixture must be removed after the check', { fixture });
+emitGate('seo-geo:route-identity', { seo_status: seo.status, geo_status: geo.status, hermetic_fixture_removed: true });
 //# sourceMappingURL=seo-geo-route-identity-check.js.map

package/dist/scripts/sizecheck.js

@@ -5,11 +5,11 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { DEFAULT_MAX_PACK_BYTES } from '../core/release/package-size-budget.js';
+import { DEFAULT_MAX_PACK_BYTES, DEFAULT_MAX_UNPACKED_BYTES } from '../core/release/package-size-budget.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const limits = {
     packedBytes: Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES),
-    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 1024),
+    unpackedBytes: Number(process.env.SKS_MAX_UNPACKED_BYTES || DEFAULT_MAX_UNPACKED_BYTES),
     packFiles: Number(process.env.SKS_MAX_PACK_FILES || 2100),
     trackedFileBytes: Number(process.env.SKS_MAX_TRACKED_FILE_BYTES || 384 * 1024)
 };
@@ -20,8 +20,8 @@ const trackedFileSizeAllowlist = new Set([
     'release-gates.v2.json',
     // Generated Codex App Server protocol schemas; handwritten sources remain
     // subject to the 384 KiB split-review limit.
-    'schemas/codex/app-server-0.142/codex_app_server_protocol.schemas.json',
-    'schemas/codex/app-server-0.142/codex_app_server_protocol.v2.schemas.json'
+    'schemas/codex/app-server-0.144/codex_app_server_protocol.schemas.json',
+    'schemas/codex/app-server-0.144/codex_app_server_protocol.v2.schemas.json'
 ]);
 const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function fail(message, detail = '') {

package/dist/scripts/sks-1-11-gate-lib.js

@@ -4,7 +4,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { tmpdir } from '../core/fsx.js';
 export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const fixtureMissionRoots = new Map();
+const fixtureRoots = new Set();
+let fixtureCleanupRegistered = false;
 export function assertGate(condition, message, detail = {}) {
     if (condition)
         return;
@@ -14,14 +18,15 @@ export function assertGate(condition, message, detail = {}) {
 export function emitGate(name, detail = {}) {
     console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate: name, ...detail }, null, 2));
 }
-export function runSksJson(args) {
+export function runSksJson(args, options = {}) {
     const entrypoint = path.join(root, 'dist', 'bin', 'sks.js');
     assertGate(fs.existsSync(entrypoint), 'dist entrypoint missing; run npm run build first', { entrypoint });
+    const mappedMissionRoot = args.map((arg) => fixtureMissionRoots.get(String(arg))).find(Boolean);
     const result = spawnSync(process.execPath, [entrypoint, ...args], {
-        cwd: root,
+        cwd: options.cwd || mappedMissionRoot || root,
         encoding: 'utf8',
         timeout: Number(process.env.SKS_GATE_TIMEOUT_MS || 120_000),
-        env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' }
+        env: { ...process.env, SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true', ...(options.env || {}) }
     });
     let parsed = null;
     try {
@@ -36,7 +41,10 @@ export function runSksJson(args) {
     return { ...parsed, _process_status: result.status, _stderr_tail: String(result.stderr || '').slice(-600) };
 }
 export function runPptReview(action = 'review') {
-    const json = runSksJson(['ppt', 'fixture', '--mock', '--json']);
+    const json = runHermeticRouteFixture('ppt', ['ppt', 'fixture', '--mock', '--json'], {
+        SKS_TEST_FAKE_IMAGEGEN: '1',
+        SKS_TEST_FAKE_EXTRACTOR: '1'
+    });
     const proof = readMissionJson(json.mission_id, 'completion-proof.json');
     const review = json.artifacts || json.imagegen_review || {};
     json.proof_evidence = proof.evidence?.ppt_review || json.artifacts?.proof_evidence || {};
@@ -54,7 +62,7 @@ export function runPptReview(action = 'review') {
     return json;
 }
 export function runDfixFixture() {
-    const json = runSksJson(['dfix', 'fixture', '--json']);
+    const json = runHermeticRouteFixture('dfix', ['dfix', 'fixture', '--json']);
     json.gate = json.gate || json.artifacts?.gate;
     assertGate(json.ok === true, 'dfix fixture blocked', json);
     assertGate(json.gate?.passed === true, 'dfix gate did not pass', json.gate);
@@ -66,7 +74,8 @@ export function runUxFixture() {
     return json;
 }
 export function missionFile(missionId, file) {
-    return path.join(root, '.sneakoscope', 'missions', missionId, file);
+    const missionRoot = fixtureMissionRoots.get(missionId) || root;
+    return path.join(missionRoot, '.sneakoscope', 'missions', missionId, file);
 }
 export function readMissionJson(missionId, file) {
     const absolute = missionFile(missionId, file);
@@ -77,4 +86,42 @@ export function hasRelationType(missionId, type) {
     const ledger = readMissionJson(missionId, 'image-voxel-ledger.json');
     return (ledger.relations || []).some((relation) => relation.type === type);
 }
+function createHermeticRouteFixtureRoot(label) {
+    const fixtureRoot = tmpdir(`${label}-release-fixture-`);
+    fs.writeFileSync(path.join(fixtureRoot, 'package.json'), `${JSON.stringify({ name: `sks-${label}-release-fixture`, private: true })}\n`);
+    fixtureRoots.add(fixtureRoot);
+    if (!fixtureCleanupRegistered) {
+        fixtureCleanupRegistered = true;
+        process.once('exit', () => {
+            for (const candidate of fixtureRoots)
+                fs.rmSync(candidate, { recursive: true, force: true });
+        });
+    }
+    return fixtureRoot;
+}
+function runHermeticRouteFixture(label, args, env = {}) {
+    const fixtureRoot = createHermeticRouteFixtureRoot(label);
+    const fixtureHome = path.join(fixtureRoot, 'home');
+    const json = runSksJson(args, {
+        cwd: fixtureRoot,
+        env: {
+            HOME: fixtureHome,
+            CODEX_HOME: path.join(fixtureHome, '.codex'),
+            SKS_GLOBAL_ROOT: path.join(fixtureHome, '.sneakoscope-global'),
+            TMPDIR: fixtureRoot,
+            TMP: fixtureRoot,
+            TEMP: fixtureRoot,
+            PWD: fixtureRoot,
+            SKS_TEST_ISOLATION: '1',
+            SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
+            NODE_ENV: 'test',
+            CI: 'true',
+            ...env
+        }
+    });
+    if (json.mission_id)
+        fixtureMissionRoots.set(json.mission_id, fixtureRoot);
+    json.fixture_root = fixtureRoot;
+    return json;
+}
 //# sourceMappingURL=sks-1-11-gate-lib.js.map

package/dist/scripts/sks-3-1-4-directive-check-lib.js

@@ -122,9 +122,15 @@ async function codexAppGate(id) {
         }
         if (id === 'codex-app:agent-role-sync') {
             const mod = await importDist('core/codex-app/codex-agent-role-sync.js');
-            const report = await mod.syncCodexAgentRoles({ root: rootDir, codexHome: path.join(rootDir, 'codex-home'), apply: true, agentTypeSupported: true });
+            const manifest = await importDist('core/managed-assets/managed-assets-manifest.js');
+            const codexHome = path.join(rootDir, 'codex-home');
+            const report = await mod.syncCodexAgentRoles({ root: rootDir, codexHome, apply: true, agentTypeSupported: true });
+            const expectedRoles = manifest.MANAGED_OFFICIAL_SUBAGENT_ROLES.map((role) => role.codex_name);
             assertGate(report.fallback === 'agent_type', 'agent role sync should use agent_type when supported', report);
-            return emitGate(id, { roles: report.directive_roles.length });
+            assertGate(report.directive_roles.length === 0 && report.official_roles.join(',') === expectedRoles.join(','), 'agent role sync must expose the official project custom-agent catalog', report);
+            assertGate(manifest.MANAGED_OFFICIAL_SUBAGENT_ROLES.every((role) => fs.existsSync(path.join(rootDir, '.codex', 'agents', role.filename))), 'official project agent catalog missing', report);
+            assertGate(!fs.existsSync(path.join(codexHome, 'agents')), 'agent role sync must not create global directive roles', report);
+            return emitGate(id, { roles: report.official_roles.length });
         }
         if (id === 'codex-app:init-deep') {
             const mod = await importDist('core/codex-app/codex-init-deep.js');

package/dist/scripts/sks-3-1-5-directive-check-lib.js

@@ -267,8 +267,9 @@ async function richContentGate(id) {
         const mod = await importDist('core/codex-app/codex-agent-role-sync.js');
         const codexHome = path.join(rootDir, 'codex-home');
         const report = await mod.syncCodexAgentRoles({ root: rootDir, codexHome, apply: true });
-        const role = fs.readFileSync(path.join(codexHome, 'agents', 'sks-checker.toml'), 'utf8');
-        assertGate(/SKS managed \d+\.\d+\.\d+ directive role/.test(role) && role.includes('Execution role strategy'), 'managed agent role must include rich directive content', { role, report });
+        const role = fs.readFileSync(path.join(rootDir, '.codex', 'agents', 'expert.toml'), 'utf8');
+        assertGate(role.includes('model = "gpt-5.6-sol"') && role.includes('Do not spawn another subagent.'), 'official expert role must include Sol Max and no-nesting instructions', { role, report });
+        assertGate(!fs.existsSync(path.join(codexHome, 'agents')), 'rich-content sync must not create global directive roles', report);
         emitGate(id, { roles: report.created.length });
     }
     finally {

package/dist/scripts/sks-3-1-6-directive-check-lib.js

@@ -278,9 +278,11 @@ async function agentRoleContent(id) {
     try {
         const tmp = await tempRoot(id);
         const mod = await importDist('core/codex-app/codex-agent-role-sync.js');
-        const report = await mod.syncCodexAgentRoles({ root: tmp, codexHome: path.join(tmp, 'codex-home'), apply: true });
-        const role = fs.readFileSync(path.join(tmp, 'codex-home', 'agents', 'sks-implementer.toml'), 'utf8');
-        assertGate(role.includes('Bounded ownership') && role.includes('Maker/checker separation') && role.includes('Required proof artifacts'), 'agent role content incomplete', { role, report });
+        const codexHome = path.join(tmp, 'codex-home');
+        const report = await mod.syncCodexAgentRoles({ root: tmp, codexHome, apply: true });
+        const role = fs.readFileSync(path.join(tmp, '.codex', 'agents', 'worker.toml'), 'utf8');
+        assertGate(role.includes('model = "gpt-5.6-luna"') && role.includes('Work only on the exact slice assigned by the parent agent.'), 'official worker role content incomplete', { role, report });
+        assertGate(!fs.existsSync(path.join(codexHome, 'agents')), 'agent role content gate must not create global directive roles', report);
     }
     finally {
         restoreEnv(previous);

package/dist/scripts/sks-menubar-install-check.js

@@ -92,6 +92,7 @@ const hasVisibleStatusSource = generatedSource.includes('NSStatusItem.variableLe
     && generatedSource.includes('configureStatusButton(button, title: state.title)')
     && generatedSource.includes('SKS ⚠')
     && generatedSource.includes('SKS ↑')
+    && generatedSource.includes('SKS ⬆')
     && generatedSource.includes('SKS ⋯')
     && generatedSource.includes('Timer.scheduledTimer(withTimeInterval: 30.0');
 const hasBackgroundReadonlyActions = generatedSource.includes('runSksBackground(["codex-lb", "fast-check"]')
@@ -99,6 +100,10 @@ const hasBackgroundReadonlyActions = generatedSource.includes('runSksBackground(
     && generatedSource.includes('runSksBackground(["fast-mode", "off", "--json"]')
     && generatedSource.includes('runSksSilent(["fast-mode", "status", "--json"]')
     && generatedSource.includes('runSksBackground(["update", "check"]')
+    && generatedSource.includes('runSksSilent(args)')
+    && generatedSource.includes('["codex", "update-status", "--json"]')
+    && generatedSource.includes('runSksBackground(["codex", "update", "--json"]')
+    && generatedSource.includes('runSksBackground(["doctor", "--fix", "--global-only", "--json"]')
     && generatedSource.includes('display notification')
     && !generatedSource.includes('runSksInTerminal')
     && !generatedSource.includes('runInTerminal');
@@ -170,6 +175,9 @@ const expectedMenuItems = [
     'Fast Check',
     'SKS Version Check',
     'Update SKS Now',
+    'Codex CLI Version',
+    'Update Codex CLI Now',
+    'Run sks doctor --fix',
     'View Last Log'
 ];
 const missingExpectedItems = expectedMenuItems.filter((item) => !result.menu_items.includes(item));

package/dist/scripts/sks-uninstall-regression-check.js

@@ -17,7 +17,7 @@ await writeText(path.join(home, '.codex', 'config.toml'), [
     'default_profile = "sks-fast-high"',
     'service_tier = "fast"',
     '[profiles.sks-fast-high]',
-    'model = "gpt-5.5"',
+    'model = "gpt-5.6-terra"',
     '[user.fast_mode]',
     'enabled = true',
     '[mcp_servers.user]',

package/dist/scripts/sksd-daemon-check.js

@@ -1,9 +1,19 @@
 // @ts-nocheck
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/daemon/sksd-client.js');
-const state = mod.runSksdClient(root, 'status');
-const start = mod.runSksdClient(root, 'start');
-assertGate(state.schema === 'sks.sksd-state.v1', 'sksd status schema mismatch', state);
-assertGate(start.protocol_ok === true && start.status === 'running', 'sksd start must record protocol-ready state', start);
-emitGate('sksd:daemon', { status: start.status });
+const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-sksd-daemon-check-'));
+try {
+    const state = mod.runSksdClient(fixtureRoot, 'status');
+    const start = mod.runSksdClient(fixtureRoot, 'start');
+    assertGate(state.schema === 'sks.sksd-state.v1', 'sksd status schema mismatch', state);
+    assertGate(start.protocol_ok === true && start.status === 'running', 'sksd start must record protocol-ready state', start);
+    assertGate(start.build_proof_ready === false, 'hermetic sksd protocol fixture must not build or mutate the source checkout', start);
+    emitGate('sksd:daemon', { status: start.status, hermetic_fixture: true, build_started: false });
+}
+finally {
+    await fs.rm(fixtureRoot, { recursive: true, force: true });
+}
 //# sourceMappingURL=sksd-daemon-check.js.map

package/dist/scripts/trust-fixture-check.js

@@ -5,6 +5,9 @@ import os from 'node:os';
 import path from 'node:path';
 import { runProcess } from '../core/fsx.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-trust-fixture-'));
+const home = path.join(root, '.home');
+const globalRoot = path.join(root, '.sneakoscope-global');
+await fs.mkdir(path.join(home, '.codex'), { recursive: true });
 await fs.writeFile(path.join(root, 'package.json'), '{"private":true,"name":"sks-trust-fixture"}\n');
 await runProcess('git', ['init', '-q'], {
     cwd: root,
@@ -16,18 +19,21 @@ const sks = path.join(process.cwd(), 'dist', 'bin', 'sks.js');
 const run = await runJson(root, sks, ['run', 'fixture', '--mock', '--json'], { allowNonZero: true });
 const trust = await runJson(root, sks, ['trust', 'validate', run.mission_id, '--json'], { allowNonZero: true });
 const issues = [...new Set([...(run.trust_report?.issues || []), ...(trust.issues || [])])];
-const ok = run.ok === false
-    && run.status === 'mock_only'
-    && run.trust_status === 'blocked'
-    && trust.status === 'blocked'
-    && issues.includes('agent_gate_not_passed');
+const fakeSuccessBlocked = run.ok === false && run.status === 'mock_only';
+const runTrustStatus = String(run.trust_status || '');
+const trustStatus = String(trust.status || '');
+const ok = fakeSuccessBlocked
+    && ['blocked', 'mock_only'].includes(runTrustStatus)
+    && ['blocked', 'mock_only'].includes(trustStatus)
+    && trust.ok !== true;
 console.log(JSON.stringify({
     schema: 'sks.trust-fixture-check.v1',
     ok,
     mission_id: run.mission_id,
     run_status: run.status,
-    trust_status: trust.status,
-    fake_success_blocked: run.ok === false && run.status === 'mock_only',
+    run_trust_status: runTrustStatus,
+    trust_status: trustStatus,
+    fake_success_blocked: fakeSuccessBlocked,
     issues
 }, null, 2));
 if (!ok)
@@ -35,12 +41,28 @@ if (!ok)
 async function runJson(rootDir, sksBin, args, opts = {}) {
     const result = await runProcess(process.execPath, [sksBin, ...args], {
         cwd: rootDir,
-        timeoutMs: 60_000,
+        timeoutMs: 120_000,
         maxOutputBytes: 512 * 1024,
-        env: { SKS_SKIP_NPM_FRESHNESS_CHECK: '1', CI: 'true' }
+        env: {
+            HOME: home,
+            CODEX_HOME: path.join(home, '.codex'),
+            SKS_GLOBAL_ROOT: globalRoot,
+            SKS_TEST_ISOLATION: '1',
+            SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
+            SKS_SKIP_NPM_FRESHNESS_CHECK: '1',
+            CI: 'true'
+        }
     });
     if (result.code !== 0 && opts.allowNonZero !== true)
         throw new Error(`${args.join(' ')} failed: ${result.stderr || result.stdout}`);
-    return JSON.parse(result.stdout);
+    if (!result.stdout.trim()) {
+        throw new Error(`${args.join(' ')} returned no JSON: exit=${result.code} timed_out=${result.timedOut} stderr=${result.stderr}`);
+    }
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch (err) {
+        throw new Error(`${args.join(' ')} returned invalid JSON: ${err instanceof Error ? err.message : String(err)} stdout=${result.stdout.slice(-2000)} stderr=${result.stderr.slice(-2000)}`);
+    }
 }
 //# sourceMappingURL=trust-fixture-check.js.map

package/dist/scripts/write-build-manifest.js

@@ -5,6 +5,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { writeTextAtomic } from '../core/fsx.js';
 import { writeDistFreshStamp, sourceSnapshot } from './lib/ensure-dist-fresh.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
@@ -22,7 +23,7 @@ const compiledDtsCount = sorted.filter((f) => f.endsWith('.d.ts')).length;
 const source = sourceSnapshot();
 const distStamp = writeDistFreshStamp();
 const srcMjsRuntimeFiles = await collectSrcMjsRuntimeFiles();
-await fsp.writeFile(path.join(distRoot, 'build-manifest.json'), `${JSON.stringify({
+await writeTextAtomic(path.join(distRoot, 'build-manifest.json'), `${JSON.stringify({
     schema: 'sks.dist-build.v2',
     version: pkg.version,
     package_version: pkg.version,

package/dist/scripts/wrongness-fixture-check.js

@@ -23,7 +23,7 @@ await ledger.recordDbSafetyMismatchWrongness(root, {
     mission_id: 'M-fixture',
     expected: 'blocked',
     actual: 'safe',
-    command: 'sks db check --sql "DROP TABLE users"',
+    command: '$DB internal safety check: DROP TABLE users',
     sql: 'DROP TABLE users'
 });
 await ledger.recordHookPolicyMismatchWrongness(root, {