sneakoscope 6.1.0 → 6.2.0

package/dist/core/recallpulse/policy.js

@@ -48,7 +48,7 @@ export const RECALLPULSE_POLICY = Object.freeze({
         'generated_skill_installation',
         'codex_app_stop_hooks',
         'dfix_ultralight_behavior',
-        'team_minimum_five_lane_review',
+        'official_subagent_risk_scoped_review_with_legacy_team_compatibility',
         'research_xhigh_agent_requirements',
         'db_destructive_operation_blocking',
         'imagegen_evidence_requirements'
@@ -176,37 +176,19 @@ export const RESEARCH_AGENT_PERSONA_CONTRACT = Object.freeze([
         id: 'einstein',
         display_name: 'Einstein Agent',
         historical_inspiration: 'Albert Einstein',
-        persona: 'first-principles reframer',
-        role: 'first_principles_reframer',
-        mandate: 'Strip assumptions, identify invariants, and build decisive thought experiments.',
-        required_outputs: ['eureka_moment', 'assumptions_removed', 'invariant_or_simplifying_frame', 'decisive_thought_experiment']
-    },
-    {
-        id: 'feynman',
-        display_name: 'Feynman Agent',
-        historical_inspiration: 'Richard Feynman',
-        persona: 'explanation experimentalist',
-        role: 'explanation_experimentalist',
-        mandate: 'Make the idea teachable, testable, and hard to hide behind jargon.',
-        required_outputs: ['eureka_moment', 'plain_language_mechanism', 'toy_model', 'cheap_empirical_probe']
-    },
-    {
-        id: 'turing',
-        display_name: 'Turing Agent',
-        historical_inspiration: 'Alan Turing',
-        persona: 'formalization and adversarial cases',
-        role: 'formalization_and_adversarial_cases',
-        mandate: 'Formalize inputs, outputs, algorithms, limits, and countercases.',
-        required_outputs: ['eureka_moment', 'formal_definition', 'algorithmic_shape', 'adversarial_case']
+        persona: 'first-principles reframer and explanation experimentalist',
+        role: 'first_principles_experimental_reframer',
+        mandate: 'Strip assumptions, identify invariants, explain the mechanism plainly, and build decisive thought experiments and cheap probes.',
+        required_outputs: ['eureka_moment', 'assumptions_removed', 'invariant_or_simplifying_frame', 'plain_language_mechanism', 'decisive_thought_experiment', 'cheap_empirical_probe']
     },
     {
         id: 'von_neumann',
         display_name: 'von Neumann Agent',
         historical_inspiration: 'John von Neumann',
-        persona: 'systems strategy agent',
-        role: 'systems_strategy_agent',
-        mandate: 'Map system dynamics, scaling behavior, incentives, and worst-case interactions.',
-        required_outputs: ['eureka_moment', 'system_model', 'scaling_risk', 'robustness_condition']
+        persona: 'formal systems and strategy agent',
+        role: 'formal_systems_strategy_agent',
+        mandate: 'Formalize inputs, outputs, algorithms, limits, system dynamics, scaling behavior, incentives, and worst-case interactions.',
+        required_outputs: ['eureka_moment', 'formal_definition', 'algorithmic_shape', 'adversarial_case', 'system_model', 'scaling_risk', 'robustness_condition']
     },
     {
         id: 'skeptic',
@@ -220,7 +202,9 @@ export const RESEARCH_AGENT_PERSONA_CONTRACT = Object.freeze([
 ].map((agent) => Object.freeze({
     ...agent,
     persona_boundary: 'persona-inspired cognitive lens only; do not impersonate the historical person',
-    reasoning_effort: 'xhigh',
+    custom_agent: 'research_reviewer',
+    model: 'gpt-5.6-sol',
+    reasoning_effort: 'max',
     service_tier: 'fast'
 })));
 //# sourceMappingURL=policy.js.map

package/dist/core/recallpulse.js

@@ -199,7 +199,7 @@ export async function evaluateRecallPulseFixtures(root, opts = {}) {
             fixture('repeated-stop-hook-blocker', true, 'Duplicate suppression keys collapse repeated blocker text into one durable status row.'),
             fixture('hook-only-status-visibility', true, 'mission-status-ledger.json preserves recoverable user-visible status.'),
             fixture('research-persona-missing', true, 'Research validation blocks missing agent display_name/persona/persona_boundary.'),
-            fixture('research-effort-not-xhigh', true, 'Research validation blocks non-xhigh agent rows.'),
+            fixture('research-model-policy-not-sol-max', true, 'Research validation blocks reviewer rows that are not bound to the research_reviewer GPT-5.6 Sol Max policy.'),
             fixture('research-eureka-missing', true, 'Research validation blocks missing literal Eureka! ideas.'),
             fixture('research-impersonation', true, 'Research validation blocks persona-boundary violations.'),
             fixture('oversized-l1', true, 'L1 token and item limits reject oversized active recall.'),
@@ -368,7 +368,7 @@ export async function buildRecallPulseGovernanceReport(root, opts = {}) {
             ],
             migration_paths: {
                 existing_missions: 'Run sks recallpulse run <mission-id> and sks recallpulse governance <mission-id> to add report-only artifacts.',
-                existing_research_artifacts: 'Research gates now require agent display_name/persona/persona_boundary fields; old ledgers should be migrated by adding those fields before claiming pass.',
+                existing_research_artifacts: 'Research gates require agent display_name/persona/persona_boundary fields and the research_reviewer GPT-5.6 Sol Max binding; old ledgers must be migrated before claiming pass.',
                 generated_skills: 'Do not edit generated installed skills directly; rerun init/bootstrap from engine source when generated text needs refreshing.'
             },
             release_gate: '0.8.0 remains report-only unless packcheck, selftest, sizecheck, registry metadata check, TriWiki validate, and RecallPulse fixture eval pass.'
@@ -397,8 +397,13 @@ export function validateResearchAgentPersonas(agentLedger = {}, geniusSummaryTex
             issues.push(`${expected.id}:persona_boundary_missing`);
         if (row.persona_boundary && !/do not impersonate|not impersonat|lens only/i.test(row.persona_boundary))
             issues.push(`${expected.id}:persona_boundary_not_enforced`);
-        if (row.effort !== 'xhigh' && row.reasoning_effort !== 'xhigh')
-            issues.push(`${expected.id}:effort_not_xhigh`);
+        const modelPolicy = row.model_policy && typeof row.model_policy === 'object' ? row.model_policy : row;
+        if (modelPolicy.custom_agent !== 'research_reviewer')
+            issues.push(`${expected.id}:custom_agent_not_research_reviewer`);
+        if (modelPolicy.model !== 'gpt-5.6-sol')
+            issues.push(`${expected.id}:model_not_sol`);
+        if (modelPolicy.reasoning_effort !== 'max' && modelPolicy.model_reasoning_effort !== 'max')
+            issues.push(`${expected.id}:effort_not_max`);
         if (row.service_tier && row.service_tier !== 'fast')
             issues.push(`${expected.id}:service_tier_not_fast`);
         if (!row.eureka?.idea || row.eureka?.exclamation !== 'Eureka!')
@@ -923,13 +928,13 @@ function preservedRoutePersonality(routeId = '', routeName = '') {
         DFix: 'ultralight direct-fix path stays tiny and does not start the full pipeline',
         Answer: 'answer-only path stays conversational and does not start implementation',
         SKS: 'general SKS discovery/help personality stays simple',
-        Team: 'Team keeps analysis, debate, executor, and five-lane review identity',
+        Team: 'Team redirects to the bounded official Naruto workflow with parent-owned integration and risk-scoped review',
         QALoop: 'QA-LOOP keeps dogfood, checklist, remediation, and reverification identity',
         PPT: 'PPT keeps restrained information-first HTML/PDF delivery identity',
         ImageUXReview: 'Image UX Review keeps gpt-image-2 annotated raster review identity',
         ComputerUse: 'Computer Use keeps maximum-speed native Mac/non-web visual lane identity',
         Goal: 'Goal stays a native /goal persistence bridge, not a heavyweight route',
-        Research: 'Research keeps named xhigh persona agent council, Eureka, debate, paper, and falsification identity',
+        Research: 'Research keeps Super Search evidence, three composite Sol Max adversarial lenses, bounded revision, paper, and falsification identity',
         AutoResearch: 'AutoResearch keeps iterative experiment loop identity',
         DB: 'DB keeps conservative read-first destructive-operation safety identity',
         MadSKS: 'MAD-SKS keeps explicit scoped high-risk authorization identity',

package/dist/core/release/npm-pack-proof.js

@@ -0,0 +1,247 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const NPM_PACK_PROOF_SCHEMA = 'sks.npm-pack-proof.v1';
+export const NPM_PACK_PROOF_COMMAND = Object.freeze(['npm', 'pack', '--dry-run', '--ignore-scripts', '--json']);
+export const PACKLIST_PERFORMANCE_REPORT_SCHEMA = 'sks.packlist-performance.v1';
+export const PACKAGE_SURFACE_BUDGET_REPORT_SCHEMA = 'sks.package-surface-budget.v1';
+export function npmPackProofPath(root) {
+    return path.join(root, '.sneakoscope', 'reports', 'npm-pack-proof.json');
+}
+export function writeNpmPackProof(root, info, packMs) {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    const inputDigest = currentNpmPackInputDigest(root);
+    const normalizedInfo = normalizeNpmPackInfo(info);
+    const infoDigest = sha256Json(normalizedInfo);
+    const fileListDigest = sha256Json(normalizedInfo.files);
+    const proof = {
+        schema: NPM_PACK_PROOF_SCHEMA,
+        ok: true,
+        generated_at: new Date().toISOString(),
+        command: NPM_PACK_PROOF_COMMAND,
+        input_digest: inputDigest,
+        info_digest: infoDigest,
+        file_list_digest: fileListDigest,
+        proof_id: sha256Text(`${NPM_PACK_PROOF_SCHEMA}\n${inputDigest}\n${infoDigest}\n${fileListDigest}\n${String(pkg.name || '')}@${String(pkg.version || '')}`),
+        package_name: String(pkg.name || ''),
+        package_version: String(pkg.version || ''),
+        pack_ms: Math.max(0, Math.floor(Number(packMs) || 0)),
+        info
+    };
+    const file = npmPackProofPath(root);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(proof, null, 2)}\n`);
+    return proof;
+}
+export function readCurrentNpmPackProof(root) {
+    const blockers = [];
+    const file = npmPackProofPath(root);
+    let proof = null;
+    try {
+        proof = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        blockers.push('npm_pack_proof_missing_or_invalid');
+        return { ok: false, proof: null, blockers };
+    }
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    if (proof?.schema !== NPM_PACK_PROOF_SCHEMA || proof?.ok !== true)
+        blockers.push('npm_pack_proof_schema_invalid');
+    if (!sameStringList([...(proof?.command || [])], [...NPM_PACK_PROOF_COMMAND]))
+        blockers.push('npm_pack_proof_command_invalid');
+    if (proof?.package_name !== pkg.name || proof?.package_version !== pkg.version)
+        blockers.push('npm_pack_proof_package_identity_mismatch');
+    if (proof?.input_digest !== currentNpmPackInputDigest(root))
+        blockers.push('npm_pack_proof_stale');
+    if (!proof?.info || !Array.isArray(proof.info.files))
+        blockers.push('npm_pack_proof_files_missing');
+    if (proof?.info) {
+        const normalizedInfo = normalizeNpmPackInfo(proof.info);
+        const infoDigest = sha256Json(normalizedInfo);
+        const fileListDigest = sha256Json(normalizedInfo.files);
+        const expectedProofId = sha256Text(`${NPM_PACK_PROOF_SCHEMA}\n${proof.input_digest}\n${infoDigest}\n${fileListDigest}\n${String(pkg.name || '')}@${String(pkg.version || '')}`);
+        if (proof.info_digest !== infoDigest)
+            blockers.push('npm_pack_proof_info_digest_mismatch');
+        if (proof.file_list_digest !== fileListDigest)
+            blockers.push('npm_pack_proof_file_list_digest_mismatch');
+        if (proof.proof_id !== expectedProofId)
+            blockers.push('npm_pack_proof_id_mismatch');
+    }
+    return { ok: blockers.length === 0, proof, blockers };
+}
+export function readCurrentNpmPackGateArtifacts(root) {
+    const proofResult = readCurrentNpmPackProof(root);
+    const blockers = [...proofResult.blockers];
+    const packlistReport = readJsonReport(path.join(root, '.sneakoscope', 'reports', 'packlist-performance.json'));
+    const packageSurfaceReport = readJsonReport(path.join(root, '.sneakoscope', 'reports', 'package-surface-budget.json'));
+    if (!packlistReport)
+        blockers.push('packlist_performance_report_missing_or_invalid');
+    else {
+        if (packlistReport.schema !== PACKLIST_PERFORMANCE_REPORT_SCHEMA || packlistReport.ok !== true)
+            blockers.push('packlist_performance_report_schema_invalid');
+        if (Array.isArray(packlistReport.blockers) && packlistReport.blockers.length > 0)
+            blockers.push('packlist_performance_report_has_blockers');
+        if (Array.isArray(packlistReport.forbidden) && packlistReport.forbidden.length > 0)
+            blockers.push('packlist_performance_report_forbidden_files');
+        if (Array.isArray(packlistReport.runtime_required_missing) && packlistReport.runtime_required_missing.length > 0)
+            blockers.push('packlist_performance_report_runtime_files_missing');
+    }
+    if (!packageSurfaceReport)
+        blockers.push('package_surface_report_missing_or_invalid');
+    else {
+        if (packageSurfaceReport.schema !== PACKAGE_SURFACE_BUDGET_REPORT_SCHEMA || packageSurfaceReport.ok !== true)
+            blockers.push('package_surface_report_schema_invalid');
+        if (Array.isArray(packageSurfaceReport.blockers) && packageSurfaceReport.blockers.length > 0)
+            blockers.push('package_surface_report_has_blockers');
+        if (Array.isArray(packageSurfaceReport.forbidden_findings) && packageSurfaceReport.forbidden_findings.length > 0)
+            blockers.push('package_surface_report_forbidden_files');
+    }
+    const info = proofResult.proof?.info;
+    if (info && packlistReport) {
+        if (packlistReport.pack_proof_id !== proofResult.proof?.proof_id)
+            blockers.push('packlist_performance_report_proof_id_mismatch');
+        if (packlistReport.pack_info_sha256 !== proofResult.proof?.info_digest)
+            blockers.push('packlist_performance_report_info_digest_mismatch');
+        if (packlistReport.pack_file_list_sha256 !== proofResult.proof?.file_list_digest)
+            blockers.push('packlist_performance_report_file_list_digest_mismatch');
+        if (!sameNumber(packlistReport.entryCount, info.entryCount))
+            blockers.push('packlist_performance_report_entry_count_mismatch');
+        if (!sameNumber(packlistReport.size, info.size))
+            blockers.push('packlist_performance_report_size_mismatch');
+        if (!sameNumber(packlistReport.unpackedSize, info.unpackedSize))
+            blockers.push('packlist_performance_report_unpacked_size_mismatch');
+    }
+    if (info && packageSurfaceReport) {
+        if (packageSurfaceReport.pack_proof_id !== proofResult.proof?.proof_id)
+            blockers.push('package_surface_report_proof_id_mismatch');
+        if (packageSurfaceReport.pack_info_sha256 !== proofResult.proof?.info_digest)
+            blockers.push('package_surface_report_info_digest_mismatch');
+        if (packageSurfaceReport.pack_file_list_sha256 !== proofResult.proof?.file_list_digest)
+            blockers.push('package_surface_report_file_list_digest_mismatch');
+        if (!sameNumber(packageSurfaceReport.actual_file_count, info.entryCount))
+            blockers.push('package_surface_report_entry_count_mismatch');
+        if (!sameNumber(packageSurfaceReport.actual_tarball_bytes, info.size))
+            blockers.push('package_surface_report_size_mismatch');
+    }
+    return {
+        ok: blockers.length === 0,
+        proof: proofResult.proof,
+        packlist_report: packlistReport,
+        package_surface_report: packageSurfaceReport,
+        blockers: [...new Set(blockers)]
+    };
+}
+export function currentNpmPackInputDigest(root) {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    const roots = new Set(['package.json', 'package-lock.json', 'npm-shrinkwrap.json', '.npmignore', '.gitignore']);
+    for (const entry of fs.readdirSync(root)) {
+        if (/^(?:README|LICEN[CS]E|NOTICE)(?:\.|$)/i.test(entry))
+            roots.add(entry);
+    }
+    for (const raw of Array.isArray(pkg.files) ? pkg.files : []) {
+        const value = String(raw || '').trim();
+        if (!value || value.startsWith('!'))
+            continue;
+        const prefix = value.split(/[*?]/, 1)[0]?.replace(/\/+$/, '') || '';
+        if (prefix)
+            roots.add(prefix);
+    }
+    addPackagePath(roots, pkg.main);
+    addPackagePath(roots, pkg.browser);
+    if (typeof pkg.bin === 'string')
+        addPackagePath(roots, pkg.bin);
+    else if (pkg.bin && typeof pkg.bin === 'object')
+        for (const value of Object.values(pkg.bin))
+            addPackagePath(roots, value);
+    if (typeof pkg.man === 'string')
+        addPackagePath(roots, pkg.man);
+    else if (Array.isArray(pkg.man))
+        for (const value of pkg.man)
+            addPackagePath(roots, value);
+    addPackagePath(roots, pkg.directories?.bin);
+    const files = new Set();
+    for (const relative of roots)
+        collectRoot(root, relative, files);
+    const hash = crypto.createHash('sha256');
+    for (const relative of [...files].sort()) {
+        const file = path.join(root, relative);
+        const stat = fs.statSync(file);
+        hash.update(relative.replace(/\\/g, '/'));
+        hash.update('\0');
+        hash.update(String(stat.size));
+        hash.update('\0');
+        hash.update(crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'));
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+export function normalizeNpmPackInfo(info = {}) {
+    const files = (Array.isArray(info.files) ? info.files : [])
+        .map((file) => ({
+        path: String(file?.path || '').replace(/\\/g, '/'),
+        size: Number(file?.size || 0),
+        mode: Number(file?.mode || 0)
+    }))
+        .filter((file) => file.path)
+        .sort((left, right) => left.path.localeCompare(right.path));
+    return {
+        id: String(info.id || ''),
+        name: String(info.name || ''),
+        version: String(info.version || ''),
+        filename: String(info.filename || ''),
+        size: Number(info.size || 0),
+        unpackedSize: Number(info.unpackedSize || 0),
+        shasum: String(info.shasum || ''),
+        integrity: String(info.integrity || ''),
+        entryCount: Number(info.entryCount || files.length),
+        files
+    };
+}
+function addPackagePath(roots, value) {
+    const relative = String(value || '').trim().replace(/^\.\//, '');
+    if (relative && !path.isAbsolute(relative) && !relative.startsWith('../'))
+        roots.add(relative);
+}
+function sha256Json(value) {
+    return sha256Text(JSON.stringify(value));
+}
+function sha256Text(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function collectRoot(root, relative, out) {
+    const target = path.join(root, relative);
+    if (!fs.existsSync(target))
+        return;
+    const stat = fs.statSync(target);
+    if (stat.isFile()) {
+        out.add(path.relative(root, target));
+        return;
+    }
+    if (!stat.isDirectory())
+        return;
+    for (const entry of fs.readdirSync(target, { withFileTypes: true })) {
+        const child = path.join(relative, entry.name);
+        if (entry.isDirectory())
+            collectRoot(root, child, out);
+        else if (entry.isFile())
+            out.add(child);
+    }
+}
+function sameStringList(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function readJsonReport(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function sameNumber(left, right) {
+    const leftNumber = Number(left);
+    const rightNumber = Number(right);
+    return Number.isFinite(leftNumber) && Number.isFinite(rightNumber) && leftNumber === rightNumber;
+}
+//# sourceMappingURL=npm-pack-proof.js.map

package/dist/core/release/package-dist-snapshot.js

@@ -0,0 +1,151 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export function packageDistSnapshot(root, pkg) {
+    const distRoot = path.join(root, 'dist');
+    if (!fs.existsSync(distRoot))
+        return { digest: null, file_count: 0 };
+    const entries = packageFileEntries(pkg);
+    const files = [];
+    collectFiles(distRoot, files);
+    const included = files
+        .filter((file) => packageFileIncluded(`dist/${path.relative(distRoot, file).split(path.sep).join('/')}`, entries))
+        .sort();
+    const hash = crypto.createHash('sha256');
+    for (const file of included) {
+        const rel = path.relative(distRoot, file).split(path.sep).join('/');
+        const bytes = fs.readFileSync(file);
+        hash.update(rel);
+        hash.update('\0');
+        hash.update(String(bytes.length));
+        hash.update('\0');
+        hash.update(crypto.createHash('sha256').update(bytes).digest('hex'));
+        hash.update('\0');
+    }
+    return { digest: hash.digest('hex'), file_count: included.length };
+}
+export function packageFilesSnapshot(root, pkg) {
+    const entries = packageFileEntries(pkg);
+    const candidates = new Set();
+    const missingEntries = [];
+    for (const entry of entries) {
+        if (entry.negated || hasGlob(entry.pattern))
+            continue;
+        const full = path.join(root, entry.pattern);
+        if (!fs.existsSync(full)) {
+            missingEntries.push(entry.pattern);
+            continue;
+        }
+        const stat = fs.statSync(full);
+        if (stat.isDirectory()) {
+            const found = [];
+            collectFiles(full, found);
+            for (const file of found)
+                candidates.add(path.relative(root, file).split(path.sep).join('/'));
+        }
+        else if (stat.isFile()) {
+            candidates.add(entry.pattern);
+        }
+    }
+    const files = [...candidates].filter((file) => packageFileIncluded(file, entries)).sort();
+    const hash = crypto.createHash('sha256');
+    for (const entry of missingEntries.sort()) {
+        hash.update(entry);
+        hash.update('\0missing\0');
+    }
+    for (const file of files) {
+        const bytes = fs.readFileSync(path.join(root, file));
+        hash.update(file);
+        hash.update('\0');
+        hash.update(String(bytes.length));
+        hash.update('\0');
+        hash.update(crypto.createHash('sha256').update(bytes).digest('hex'));
+        hash.update('\0');
+    }
+    return {
+        digest: crypto.createHash('sha256').update(hash.digest('hex')).digest('hex'),
+        file_count: files.length,
+        missing_entries: missingEntries
+    };
+}
+function collectFiles(dir, out) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const file = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            collectFiles(file, out);
+        else if (entry.isFile())
+            out.push(file);
+    }
+}
+function packageFileEntries(pkg) {
+    return (Array.isArray(pkg.files) ? pkg.files : [])
+        .map((raw) => {
+        const value = String(raw || '').trim();
+        const negated = value.startsWith('!');
+        const pattern = normalizeRel(negated ? value.slice(1) : value);
+        return pattern ? { negated, pattern } : null;
+    })
+        .filter((entry) => entry !== null);
+}
+function packageFileIncluded(file, entries) {
+    let included = false;
+    for (const entry of entries) {
+        if (matchesPackagePattern(file, entry.pattern))
+            included = !entry.negated;
+    }
+    return included;
+}
+function matchesPackagePattern(file, pattern) {
+    const rel = normalizeRel(file);
+    const normalized = normalizeRel(pattern);
+    if (!rel || !normalized)
+        return false;
+    if (!hasGlob(normalized))
+        return rel === normalized || rel.startsWith(`${normalized}/`);
+    const re = globPatternToRegExp(normalized);
+    if (re.test(rel))
+        return true;
+    const parts = rel.split('/');
+    parts.pop();
+    while (parts.length) {
+        if (re.test(parts.join('/')))
+            return true;
+        parts.pop();
+    }
+    return false;
+}
+function globPatternToRegExp(pattern) {
+    let out = '^';
+    for (let i = 0; i < pattern.length; i += 1) {
+        const char = pattern[i];
+        if (char === '*') {
+            if (pattern[i + 1] === '*') {
+                if (pattern[i + 2] === '/') {
+                    out += '(?:[^/]+/)*';
+                    i += 2;
+                }
+                else {
+                    out += '.*';
+                    i += 1;
+                }
+            }
+            else {
+                out += '[^/]*';
+            }
+            continue;
+        }
+        if (char === '?') {
+            out += '[^/]';
+            continue;
+        }
+        out += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+    }
+    return new RegExp(`${out}$`);
+}
+function hasGlob(value) {
+    return /[*?]/.test(value);
+}
+function normalizeRel(value) {
+    return String(value || '').split(path.sep).join('/').replace(/^\.\/+/, '').replace(/\/+$/, '');
+}
+//# sourceMappingURL=package-dist-snapshot.js.map

package/dist/core/release/package-size-budget.js

@@ -1,2 +1,5 @@
-export const DEFAULT_MAX_PACK_BYTES = 2414 * 1024;
+// 6.2.0 measured ceiling: next narrow packed boundary.
+export const DEFAULT_MAX_PACK_BYTES = 2428 * 1024;
+// 6.2.0 measured ceiling: next narrow unpacked boundary.
+export const DEFAULT_MAX_UNPACKED_BYTES = 11_141_120;
 //# sourceMappingURL=package-size-budget.js.map

package/dist/core/release/release-authorization-snapshot.js

@@ -0,0 +1,115 @@
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { packageDistSnapshot, packageFilesSnapshot } from './package-dist-snapshot.js';
+export const RELEASE_AUTHORIZATION_SNAPSHOT_KEYS = Object.freeze([
+    'git_commit',
+    'source_digest',
+    'source_file_count',
+    'package_files_sha256',
+    'package_file_count',
+    'release_gate_sha256',
+    'dist_build_sha256',
+    'dist_file_count'
+]);
+export function releaseAuthorizationSnapshot(root, pkg) {
+    const source = releaseSourceSnapshot(root);
+    const packageFiles = packageFilesSnapshot(root, pkg);
+    const dist = packageDistSnapshot(root, pkg);
+    return {
+        git_commit: gitCommit(root),
+        package_files_sha256: packageFiles.digest,
+        package_file_count: packageFiles.file_count,
+        dist_build_sha256: dist.digest,
+        dist_file_count: dist.file_count,
+        release_gate_sha256: releaseGateHash(root, pkg),
+        source_digest: source.digest,
+        source_file_count: source.file_count
+    };
+}
+export function sameReleaseAuthorizationSnapshot(left, right) {
+    return RELEASE_AUTHORIZATION_SNAPSHOT_KEYS.every((key) => left?.[key] === right?.[key]);
+}
+function gitCommit(root) {
+    const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+function releaseGateHash(root, pkg) {
+    const manifests = ['release-gates.v2.json', 'infra-harness-gates.json'].map((rel) => {
+        const file = path.join(root, rel);
+        return fs.existsSync(file) ? `${rel}\0${fs.readFileSync(file, 'utf8')}` : `${rel}\0missing`;
+    }).join('\0');
+    return sha256(`${pkg.scripts?.['release:check'] || ''}\0${pkg.scripts?.['prepublishOnly'] || ''}\0${manifests}`);
+}
+function releaseSourceSnapshot(root) {
+    const files = gitFiles(root).filter(releaseRelevant).sort();
+    const hash = crypto.createHash('sha256');
+    for (const file of files) {
+        const full = path.join(root, file);
+        let stat;
+        try {
+            stat = fs.statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        const bytes = fs.readFileSync(full);
+        hash.update(file);
+        hash.update('\0');
+        hash.update(String(bytes.length));
+        hash.update('\0');
+        hash.update(sha256(bytes));
+        hash.update('\0');
+    }
+    return { digest: hash.digest('hex'), file_count: files.length };
+}
+function gitFiles(root) {
+    const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024
+    });
+    if (result.status !== 0)
+        throw new Error(`unable_to_list_release_files:${result.stderr || result.stdout}`);
+    return result.stdout.split('\0').filter(Boolean);
+}
+function releaseRelevant(file) {
+    if (!file || file.startsWith('.sneakoscope/') || file.startsWith('.codex/') || file.startsWith('.agents/'))
+        return false;
+    if (file.startsWith('node_modules/') || file.startsWith('dist/') || file.startsWith('coverage/'))
+        return false;
+    if (file.startsWith('crates/sks-core/target/'))
+        return false;
+    if (/\.tgz$|\.log$/i.test(file))
+        return false;
+    if (/^(package|package-lock)\.json$/.test(file))
+        return true;
+    if (file === 'release-gates.v2.json' || file === 'infra-harness-gates.json' || file === 'runtime-required-scripts.json')
+        return true;
+    if (file === '.npmignore' || file === '.npmrc' || file === 'LICENSE')
+        return true;
+    if (file.startsWith('config/'))
+        return true;
+    if (/^tsconfig.*\.json$/.test(file))
+        return true;
+    if (/^(README|CHANGELOG|LICENSE)(\.md)?$/i.test(file))
+        return true;
+    return [
+        '.github/workflows/',
+        'bin/',
+        'src/',
+        'scripts/',
+        'test/',
+        'docs/',
+        'schemas/',
+        'crates/sks-core/Cargo.',
+        'crates/sks-core/src/'
+    ].some((prefix) => file.startsWith(prefix));
+}
+function sha256(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+//# sourceMappingURL=release-authorization-snapshot.js.map

package/dist/core/release/release-gate-affected-selector.js

@@ -113,8 +113,8 @@ function selectionResult(all, selected, changedFiles, mode, reasons, skipped) {
         }
     };
 }
-function resolveChangedFiles(root, changedSince) {
-    const base = changedSince === 'auto' ? 'HEAD' : changedSince;
+export function resolveChangedFiles(root, changedSince) {
+    const base = changedSince === 'auto' ? autoChangedFilesBase(root) : changedSince;
     const args = base === 'HEAD'
         ? ['diff', '--name-only', 'HEAD']
         : ['diff', '--name-only', String(base)];
@@ -126,6 +126,18 @@ function resolveChangedFiles(root, changedSince) {
     ].map((file) => file.trim()).filter(Boolean);
     return [...new Set(files)].sort();
 }
+function autoChangedFilesBase(root) {
+    const upstream = spawnSync('git', ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'], {
+        cwd: root,
+        encoding: 'utf8'
+    });
+    const upstreamRef = upstream.status === 0 ? String(upstream.stdout || '').trim() : '';
+    if (!upstreamRef)
+        return 'HEAD';
+    const mergeBase = spawnSync('git', ['merge-base', 'HEAD', upstreamRef], { cwd: root, encoding: 'utf8' });
+    const base = mergeBase.status === 0 ? String(mergeBase.stdout || '').trim() : '';
+    return base || 'HEAD';
+}
 function gateCommandReferencesScript(gate, file) {
     const base = file.replace(/\\/g, '/').split('/').pop()?.replace(/\.(ts|tsx)$/, '') || '';
     if (!base)