sneakoscope 6.1.0 → 6.2.0

package/dist/core/super-search/runtime.js

@@ -3,8 +3,11 @@ import { ensureDir, nowIso, readJson, sha256, writeJsonAtomic, writeTextAtomic }
 import { runCodexWebSearch } from '../codex/codex-web-search-adapter.js';
 import { humanizeBlockers } from '../errors/blocker-humanizer.js';
 import { ensureProviderCapability } from '../provider/provider-self-heal.js';
-import { buildAttemptLedger, buildClaims, buildConvergence, buildLeads, buildProof, buildXDiscoverySources, dedupeSources, extractFirstUrl, normalizeGenericSourceRows, renderSynthesis, sourceFromUrlFetch, sourceFromWebRow } from './runtime-helpers.js';
+import { buildAttemptLedger, buildClaims, buildConvergence, buildLeads, buildProof, buildXDiscoverySources, dedupeSources, extractFirstUrl, materializeContext7SourceRows, renderSynthesis, sourceFromUrlFetch, sourceFromWebRow } from './runtime-helpers.js';
 export async function runSuperSearch(input) {
+    const operationDeadlineMs = resolveSuperSearchDeadline(input);
+    if (operationDeadlineMs <= Date.now())
+        throw new Error('research_cycle_timeout_exceeded');
     const root = path.resolve(input.root || process.cwd());
     const missionDir = path.resolve(input.missionDir);
     const missionId = input.missionId || path.basename(missionDir);
@@ -27,6 +30,7 @@ export async function runSuperSearch(input) {
     const sourceRows = [];
     const warnings = [...providerPlan.warnings];
     const blockers = [...providerPlan.blockers];
+    const queryExecutionRows = [];
     let providerSelfHeal;
     if (!providerPlan.selected_providers.length && mode !== 'url_acquisition') {
         if (!input.offline) {
@@ -51,28 +55,74 @@ export async function runSuperSearch(input) {
         blockers.push('source_acquisition_unavailable');
     }
     if (input.context7 && providerPlan.selected_providers.includes('context7')) {
-        const raw = await input.context7(queryVariants[0] || input.query);
-        sourceRows.push(...normalizeGenericSourceRows(raw, 'context7', 'official_docs', intent, 'A0'));
+        try {
+            const query = queryVariants[0] || input.query;
+            const raw = await raceSuperSearchOperation(input.context7(query), operationDeadlineMs);
+            const normalized = await materializeContext7SourceRows(raw, artifactDir, intent);
+            sourceRows.push(...normalized);
+            queryExecutionRows.push({ query, status: 'completed', source_count: normalized.length, blockers: [], warnings: [] });
+        }
+        catch (error) {
+            const blocker = `context7_query_failed:${error instanceof Error ? error.message : String(error)}`;
+            blockers.push(blocker);
+            queryExecutionRows.push({ query: queryVariants[0] || input.query, status: 'failed', source_count: 0, blockers: [blocker], warnings: [] });
+        }
     }
     else if (intent === 'official_documentation' && !input.offline) {
         warnings.push('context7_not_invoked_for_docs_query');
     }
     if (providerPlan.selected_providers.includes('codex_web')) {
-        const webEvidence = await runCodexWebSearch(queryVariants[0] || input.query, {
-            ...(input.codexWebSearch ? { search: input.codexWebSearch } : {}),
-            artifactDir,
-            ...(input.offline === undefined ? {} : { offline: input.offline }),
-            ...(input.env ? { env: input.env } : {})
+        const queries = queryVariants.slice(0, queryBudget(mode, input.maxQueryVariants));
+        const webRows = await raceSuperSearchOperation(Promise.all(queries.map(async (query) => {
+            try {
+                const evidence = await runCodexWebSearch(query, {
+                    ...(input.codexWebSearch ? { search: input.codexWebSearch } : {}),
+                    artifactDir,
+                    ...(input.offline === undefined ? {} : { offline: input.offline }),
+                    ...(input.env ? { env: input.env } : {})
+                });
+                return { query, evidence, error: null };
+            }
+            catch (error) {
+                return { query, evidence: null, error: error instanceof Error ? error.message : String(error) };
+            }
+        })), operationDeadlineMs);
+        for (const row of webRows) {
+            if (!row.evidence) {
+                const blocker = `codex_web_query_failed:${row.error || 'unknown'}`;
+                blockers.push(blocker);
+                queryExecutionRows.push({ query: row.query, status: 'failed', source_count: 0, blockers: [blocker], warnings: [] });
+                continue;
+            }
+            if (row.evidence.blockers.length)
+                blockers.push(...row.evidence.blockers);
+            warnings.push(...row.evidence.warnings);
+            const normalized = row.evidence.normalized_results.map((result, index) => sourceFromWebRow(result, index, intent));
+            sourceRows.push(...normalized);
+            queryExecutionRows.push({
+                query: row.query,
+                status: row.evidence.status === 'completed' ? 'completed' : 'skipped',
+                source_count: normalized.length,
+                blockers: [...row.evidence.blockers],
+                warnings: [...row.evidence.warnings]
+            });
+        }
+        const hydrated = await hydrateDiscoverySources(sourceRows, artifactDir, intent, {
+            allowLocal: input.allowLocalFetch === true,
+            limit: hydrationBudget(mode, input.maxHydratedSources),
+            deadlineEpochMs: operationDeadlineMs
         });
-        if (webEvidence.blockers.length)
-            blockers.push(...webEvidence.blockers);
-        warnings.push(...webEvidence.warnings);
-        sourceRows.push(...webEvidence.normalized_results.map((row, index) => sourceFromWebRow(row, index, intent)));
+        sourceRows.push(...hydrated.sources);
+        if (hydrated.sources.length)
+            warnings.push(...hydrated.blockers.map((blocker) => `partial_hydration:${blocker}`));
+        else
+            blockers.push(...hydrated.blockers);
+        warnings.push(...hydrated.warnings);
     }
     if (mode === 'url_acquisition') {
         const url = extractFirstUrl(input.query);
         if (url) {
-            const fetched = await sourceFromUrlFetch(url, artifactDir, intent, { allowLocal: input.allowLocalFetch === true });
+            const fetched = await sourceFromUrlFetch(url, artifactDir, intent, { allowLocal: input.allowLocalFetch === true, deadlineEpochMs: operationDeadlineMs });
             sourceRows.push(fetched.source);
             blockers.push(...fetched.blockers);
             warnings.push(...fetched.warnings);
@@ -102,6 +152,13 @@ export async function runSuperSearch(input) {
         intent,
         axes,
         query_variants: queryVariants,
+        query_execution: {
+            schema: 'sks.super-search-query-execution.v1',
+            planned: queryExecutionRows.length,
+            completed: queryExecutionRows.filter((row) => row.status === 'completed').length,
+            failed: queryExecutionRows.filter((row) => row.status === 'failed').length,
+            rows: queryExecutionRows
+        },
         provider_plan: providerPlan,
         sources: deduped,
         leads,
@@ -250,6 +307,7 @@ async function writeArtifacts(artifactDir, result) {
     await writeJsonAtomic(path.join(artifactDir, 'intent.json'), { schema: 'sks.super-search-intent.v1', intent: result.intent, mode: result.mode });
     await writeJsonAtomic(path.join(artifactDir, 'axes.json'), { schema: 'sks.super-search-axes.v1', axes: result.axes });
     await writeJsonAtomic(path.join(artifactDir, 'query-variants.json'), { schema: 'sks.super-search-query-variants.v1', query_variants: result.query_variants });
+    await writeJsonAtomic(path.join(artifactDir, 'query-execution.json'), result.query_execution);
     await writeJsonAtomic(path.join(artifactDir, 'provider-plan.json'), { schema: 'sks.super-search-provider-plan.v1', ...result.provider_plan });
     await writeJsonAtomic(path.join(artifactDir, 'source-ledger.json'), { schema: 'sks.super-search-source-ledger.v1', sources: result.sources });
     await writeJsonAtomic(path.join(artifactDir, 'lead-ledger.json'), { schema: 'sks.super-search-lead-ledger.v1', leads: result.leads });
@@ -271,7 +329,9 @@ async function writeArtifacts(artifactDir, result) {
         passed: result.proof.ok,
         execution_class: 'production',
         mock_only: false,
-        replacement_state: result.proof.ok ? 'usable_provider_independent_runtime' : 'replacement_incomplete',
+        replacement_state: result.proof.ok
+            ? (result.proof.provider_independent ? 'usable_provider_independent_runtime' : 'usable_verified_runtime')
+            : 'replacement_incomplete',
         blockers: result.proof.blockers,
         human_summary: blockerDiagnostics.human_summary,
         next_actions: [
@@ -288,7 +348,7 @@ async function writeArtifacts(artifactDir, result) {
     await writeJsonAtomic(path.join(artifactDir, 'super-search-result.json'), result);
 }
 async function readCache(artifactDir, query, mode) {
-    const key = sha256(JSON.stringify({ query: query.trim().toLowerCase(), mode, adapter: 'super-search-runtime-v1' })).slice(0, 16);
+    const key = sha256(JSON.stringify({ query: query.trim().toLowerCase(), mode, adapter: 'super-search-runtime-v2' })).slice(0, 16);
     const artifact = path.join(artifactDir, 'cache', `${key}.json`);
     const ttl_ms = mode === 'x_search' ? 2 * 60 * 1000 : mode === 'offline_cache' ? 7 * 24 * 60 * 60 * 1000 : 10 * 60 * 1000;
     const cached = await readJson(artifact, null);
@@ -297,4 +357,69 @@ async function readCache(artifactDir, query, mode) {
     const age_ms = Date.now() - Date.parse(cached.generated_at);
     return { key, artifact, ttl_ms, hit: true, stale: age_ms > ttl_ms, age_ms, result: cached };
 }
+function queryBudget(mode, explicit) {
+    if (Number.isFinite(Number(explicit)))
+        return Math.max(1, Math.min(8, Math.floor(Number(explicit))));
+    if (mode === 'fast' || mode === 'url_acquisition' || mode === 'offline_cache')
+        return 1;
+    if (mode === 'balanced' || mode === 'x_search')
+        return 3;
+    if (mode === 'deep')
+        return 5;
+    return 8;
+}
+function hydrationBudget(mode, explicit) {
+    if (Number.isFinite(Number(explicit)))
+        return Math.max(0, Math.min(8, Math.floor(Number(explicit))));
+    if (mode === 'fast' || mode === 'url_acquisition' || mode === 'offline_cache')
+        return 1;
+    if (mode === 'balanced' || mode === 'x_search')
+        return 3;
+    if (mode === 'deep')
+        return 5;
+    return 8;
+}
+async function hydrateDiscoverySources(sources, artifactDir, intent, opts) {
+    const urls = [...new Set(sources
+            .filter((source) => source.acquisition_verdict !== 'verified_content')
+            .map((source) => source.canonical_url || source.original_url)
+            .filter((url) => Boolean(url)))]
+        .slice(0, opts.limit);
+    if (!urls.length)
+        return { sources: [], blockers: [], warnings: [] };
+    const rows = await raceSuperSearchOperation(Promise.all(urls.map((url) => sourceFromUrlFetch(url, artifactDir, intent, { allowLocal: opts.allowLocal, deadlineEpochMs: opts.deadlineEpochMs }))), opts.deadlineEpochMs);
+    const verified = rows.filter((row) => row.source.acquisition_verdict === 'verified_content').map((row) => row.source);
+    const blockers = rows.flatMap((row) => row.source.acquisition_verdict === 'verified_content' ? [] : row.blockers);
+    const warnings = rows.flatMap((row) => row.warnings);
+    return { sources: verified, blockers, warnings };
+}
+function resolveSuperSearchDeadline(input) {
+    const hard = Number(input.hardTimeoutMs);
+    const absolute = Number(input.deadlineEpochMs);
+    const candidates = [
+        Number.isFinite(hard) && hard > 0 ? Date.now() + hard : Number.POSITIVE_INFINITY,
+        Number.isFinite(absolute) && absolute > 0 ? absolute : Number.POSITIVE_INFINITY
+    ];
+    const deadline = Math.min(...candidates);
+    return Number.isFinite(deadline) ? deadline : Date.now() + 120_000;
+}
+async function raceSuperSearchOperation(promise, deadlineEpochMs) {
+    const remainingMs = Math.max(0, Math.floor(deadlineEpochMs - Date.now()));
+    if (remainingMs <= 0)
+        throw new Error('research_cycle_timeout_exceeded');
+    let timer = null;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error('research_cycle_timeout_exceeded')), remainingMs);
+                timer.unref?.();
+            })
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 //# sourceMappingURL=runtime.js.map

package/dist/core/super-search/source-records.js

@@ -17,8 +17,16 @@ export function makeSource(opts) {
     const now = nowIso();
     const canonical = opts.url ? canonicalizeUrl(opts.url) : null;
     const domain = canonical ? safeDomain(canonical) : null;
-    const content = `${opts.title}\n${opts.snippet}`;
-    const verified = opts.verdict === 'verified_content';
+    const verifiedArtifact = Boolean(opts.contentArtifact)
+        && /^[a-f0-9]{32,}$/i.test(String(opts.contentSha256 || ''))
+        && Number(opts.contentLength || 0) > 0;
+    const requestedVerified = opts.verdict === 'verified_content';
+    const verdict = requestedVerified && !verifiedArtifact ? 'weak_content' : opts.verdict;
+    const verified = verdict === 'verified_content';
+    const blockers = [
+        ...(opts.blockers || []),
+        ...(requestedVerified && !verifiedArtifact ? ['verified_content_artifact_missing'] : [])
+    ];
     return {
         source_id: `src-${sha256(`${opts.providerId}:${canonical || opts.title}:${opts.snippet}`).slice(0, 12)}`,
         provider_id: opts.providerId,
@@ -35,23 +43,56 @@ export function makeSource(opts) {
         language: null,
         snippet: opts.snippet,
         content_artifact: opts.contentArtifact ?? null,
-        content_sha256: opts.contentSha256 ?? (content.trim() ? sha256(content) : null),
-        content_length: opts.contentLength ?? (content.trim().length || null),
-        acquisition_verdict: opts.verdict,
+        content_sha256: opts.contentSha256 ?? null,
+        content_length: opts.contentLength ?? null,
+        acquisition_verdict: verdict,
         acquisition_path: opts.path,
         authority_tier: opts.authority,
         freshness_score: 0.5,
         relevance_score: 0.6,
-        trust_score: verified ? 0.9 : opts.verdict === 'weak_content' ? 0.55 : 0.35,
+        trust_score: verified ? 0.9 : verdict === 'weak_content' ? 0.55 : 0.35,
         primary_source: opts.primary,
         authenticated_source: false,
         local_only_raw: false,
         duplicate_cluster_id: null,
-        independence_cluster_id: domain || opts.providerId,
+        independence_cluster_id: independenceClusterForDomain(domain) || opts.providerId,
         warnings: opts.warnings || [],
-        blockers: opts.blockers || []
+        blockers
     };
 }
+export function independenceClusterForDomain(value) {
+    const host = String(value || '').trim().toLowerCase().replace(/^\.+|\.+$/g, '');
+    if (!host)
+        return null;
+    const ownership = knownOwnershipCluster(host);
+    if (ownership)
+        return ownership;
+    const labels = host.split('.').filter(Boolean);
+    if (labels.length <= 2)
+        return host;
+    const publicSuffix = labels.slice(-2).join('.');
+    const multiLabelSuffixes = new Set([
+        'co.uk', 'org.uk', 'ac.uk', 'gov.uk', 'com.au', 'net.au', 'org.au',
+        'co.jp', 'ne.jp', 'or.jp', 'com.br', 'com.cn', 'com.sg', 'co.kr', 'co.nz'
+    ]);
+    return multiLabelSuffixes.has(publicSuffix)
+        ? labels.slice(-3).join('.')
+        : labels.slice(-2).join('.');
+}
+function knownOwnershipCluster(host) {
+    const groups = [
+        ['owner:openai', ['openai.com', 'chatgpt.com']],
+        ['owner:x', ['x.com', 'twitter.com']],
+        ['owner:github', ['github.com', 'githubusercontent.com', 'githubassets.com']],
+        ['owner:google', ['google.com', 'youtube.com', 'googleusercontent.com']],
+        ['owner:microsoft', ['microsoft.com', 'azure.com', 'visualstudio.com']]
+    ];
+    for (const [cluster, domains] of groups) {
+        if (domains.some((domain) => host === domain || host.endsWith(`.${domain}`)))
+            return cluster;
+    }
+    return null;
+}
 function canonicalizeUrl(raw) {
     try {
         const url = new URL(raw);

package/dist/core/team-review-policy.js

@@ -1,6 +1,21 @@
 export const MIN_TEAM_REVIEWER_LANES = 5;
 export const MIN_TEAM_REVIEW_STAGE_AGENT_SESSIONS = MIN_TEAM_REVIEWER_LANES;
 export const MIN_TEAM_REVIEW_POLICY_TEXT = `Minimum Team review policy: run at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final, even when the requested reviewer role count is lower.`;
+export const DEFAULT_OFFICIAL_REVIEWER_LANES = 1;
+export const MAX_AUTOMATIC_OFFICIAL_REVIEWER_LANES = 2;
+export const MAX_CRITICAL_OFFICIAL_REVIEWER_LANES = 3;
+export const OFFICIAL_SUBAGENT_REVIEW_POLICY_TEXT = 'Official subagent review policy: start with one focused reviewer, expand to two only for independent review domains, and use at most three automatic reviewers for critical multi-domain risk. The parent owns integration and may honor a larger explicit operator request.';
+export function officialSubagentReviewLaneBudget(input = {}) {
+    if (Number.isFinite(Number(input.explicit)) && Number(input.explicit) > 0) {
+        return { requested: Math.floor(Number(input.explicit)), source: 'explicit_operator' };
+    }
+    const domains = Math.max(0, Math.floor(Number(input.independentDomains || 0)));
+    const ceiling = input.critical === true ? MAX_CRITICAL_OFFICIAL_REVIEWER_LANES : MAX_AUTOMATIC_OFFICIAL_REVIEWER_LANES;
+    return {
+        requested: Math.max(DEFAULT_OFFICIAL_REVIEWER_LANES, Math.min(ceiling, domains || DEFAULT_OFFICIAL_REVIEWER_LANES)),
+        source: 'risk_scoped_automatic'
+    };
+}
 function numericCount(value, fallback = 0) {
     const number = Number(value);
     return Number.isFinite(number) ? Math.max(0, Math.floor(number)) : fallback;

package/dist/core/triwiki/code-pack-head-freshness.js

@@ -0,0 +1,291 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { readJson, runProcess, writeJsonAtomic } from '../fsx.js';
+const CODE_PACK_METADATA_PATHS = new Set([
+    '.sneakoscope/wiki/code-pack.json',
+    '.sneakoscope/wiki/code-pack.prev.json'
+]);
+const COMMIT_MARKER = '@SKS-CODE-PACK';
+const ADVISORY_CACHE_SCHEMA = 'sks.code-pack-head-freshness-cache.v1';
+const ADVISORY_CACHE_PATH = path.join('.sneakoscope', 'cache', 'code-pack-head-freshness.json');
+export async function inspectCodePackHeadFreshness(root, packShaInput, opts = {}) {
+    const timeoutMs = Math.max(1, Math.floor(opts.timeoutMs ?? 5_000));
+    const startedAt = Date.now();
+    const packSha = normalizeGitSha(packShaInput);
+    const fastHead = await readGitHeadFromAdminFiles(root);
+    if (!packSha)
+        return staleWithCurrentHead(root, null, timeoutMs, fastHead, false, 'invalid_pack_sha');
+    if (fastHead === packSha)
+        return freshness(true, true, 'exact_head', fastHead, packSha, false, []);
+    // Only the non-blocking hook consumes this cache. Authoritative wiki
+    // validation always replays Git history and never trusts advisory state.
+    if (opts.advisoryCache && fastHead) {
+        const cached = await readAdvisoryCache(root, packSha, fastHead);
+        if (cached)
+            return cached;
+    }
+    // One common-path Git process returns HEAD plus every committed path after
+    // the pack was generated. Excluding all parents of packSha keeps packSha in
+    // the walk (including a root commit), so its presence proves ancestry. We
+    // keep scanning after the pack marker because a later merge can introduce
+    // sibling-branch commits that Git orders after packSha. `-m` exposes merge
+    // resolution paths and `--no-renames` makes touched paths auditable.
+    const history = await runProcess('git', [
+        '-c',
+        'core.quotepath=true',
+        'log',
+        '--topo-order',
+        '-m',
+        '--no-ext-diff',
+        `--format=${COMMIT_MARKER}%x09%H`,
+        '--name-status',
+        '--no-renames',
+        'HEAD',
+        '--not',
+        `${packSha}^@`,
+        '--'
+    ], {
+        cwd: root,
+        timeoutMs,
+        maxOutputBytes: 64 * 1024,
+        env: gitEnvironment({
+            GIT_NO_REPLACE_OBJECTS: '1',
+            GIT_OPTIONAL_LOCKS: '0',
+            LC_ALL: 'C'
+        })
+    }).catch(() => null);
+    if (!history || history.code !== 0 || history.timedOut) {
+        return staleWithCurrentHead(root, packSha, remainingMs(startedAt, timeoutMs), fastHead, false, history?.timedOut ? 'git_timeout' : 'git_failed');
+    }
+    const parsed = parseHistory(history.stdout, packSha);
+    if (history.truncated || !parsed.currentSha || parsed.invalid) {
+        const currentSha = parsed.currentSha
+            || fastHead
+            || await readCurrentHead(root, remainingMs(startedAt, timeoutMs));
+        return freshness(false, false, history.truncated ? 'history_truncated' : 'history_parse_invalid', currentSha, packSha, false, parsed.changedPaths);
+    }
+    if (!parsed.sawPack) {
+        return freshness(false, true, 'pack_not_ancestor', parsed.currentSha, packSha, false, parsed.changedPaths);
+    }
+    const metadataOnly = parsed.changedPaths.every((value) => CODE_PACK_METADATA_PATHS.has(value));
+    const exactHead = parsed.currentSha === packSha;
+    const result = freshness(metadataOnly, true, metadataOnly ? 'metadata_only_history' : 'source_change_history', parsed.currentSha, packSha, metadataOnly && !exactHead, parsed.changedPaths);
+    if (opts.advisoryCache && fastHead === parsed.currentSha) {
+        await writeAdvisoryCache(root, result).catch(() => undefined);
+    }
+    return result;
+}
+function parseHistory(stdout, packSha) {
+    let currentSha = null;
+    let activeCommit = null;
+    let sawPack = false;
+    let invalid = false;
+    const changedPaths = [];
+    const seenPaths = new Set();
+    for (const line of String(stdout || '').split(/\r?\n/)) {
+        if (line === '')
+            continue;
+        const marker = line.match(/^@SKS-CODE-PACK\t([0-9a-f]{40,64})$/i);
+        if (marker) {
+            activeCommit = String(marker[1]).toLowerCase();
+            currentSha ||= activeCommit;
+            if (activeCommit === packSha)
+                sawPack = true;
+            continue;
+        }
+        if (!activeCommit) {
+            invalid = true;
+            break;
+        }
+        const separator = line.indexOf('\t');
+        const status = separator > 0 ? line.slice(0, separator) : '';
+        const pathText = separator > 0 ? line.slice(separator + 1) : '';
+        if (!/^[A-Z][0-9]*$/.test(status) || !pathText) {
+            invalid = true;
+            break;
+        }
+        if (activeCommit === packSha)
+            continue;
+        // Do not trim Git paths: leading/trailing whitespace is meaningful and
+        // must never be normalized into an allowlisted metadata path.
+        for (const changedPath of pathText.split('\t')) {
+            if (!changedPath || seenPaths.has(changedPath))
+                continue;
+            seenPaths.add(changedPath);
+            changedPaths.push(changedPath);
+        }
+    }
+    return { currentSha, sawPack, invalid, changedPaths };
+}
+async function readAdvisoryCache(root, packSha, currentSha) {
+    const cached = await readJson(path.join(root, ADVISORY_CACHE_PATH), null).catch(() => null);
+    if (cached?.schema !== ADVISORY_CACHE_SCHEMA)
+        return null;
+    if (normalizeGitSha(cached.pack_sha) !== packSha || normalizeGitSha(cached.current_sha) !== currentSha)
+        return null;
+    const changedPaths = Array.isArray(cached.changed_paths)
+        ? cached.changed_paths.filter((value) => typeof value === 'string').slice(0, 64)
+        : [];
+    const fresh = cached.fresh === true;
+    if (fresh && (cached.metadata_only_drift !== true || changedPaths.some((value) => !CODE_PACK_METADATA_PATHS.has(value)))) {
+        return null;
+    }
+    return freshness(fresh, true, 'advisory_cache', currentSha, packSha, fresh, changedPaths);
+}
+async function writeAdvisoryCache(root, result) {
+    if (!result.pack_sha || !result.current_sha)
+        return;
+    await writeJsonAtomic(path.join(root, ADVISORY_CACHE_PATH), {
+        schema: ADVISORY_CACHE_SCHEMA,
+        pack_sha: result.pack_sha,
+        current_sha: result.current_sha,
+        fresh: result.fresh,
+        reason: result.reason,
+        metadata_only_drift: result.metadata_only_drift,
+        changed_paths: result.changed_paths.slice(0, 64),
+        checked_at: new Date().toISOString()
+    });
+}
+async function staleWithCurrentHead(root, packSha, timeoutMs, knownCurrentSha = null, conclusive = true, reason = 'git_failed') {
+    const currentSha = knownCurrentSha || await readCurrentHead(root, timeoutMs);
+    return freshness(false, conclusive, reason, currentSha, packSha, false, []);
+}
+async function readCurrentHead(root, timeoutMs) {
+    if (timeoutMs <= 0)
+        return null;
+    const head = await runProcess('git', ['rev-parse', 'HEAD'], {
+        cwd: root,
+        timeoutMs,
+        maxOutputBytes: 4 * 1024,
+        env: gitEnvironment({
+            GIT_NO_REPLACE_OBJECTS: '1',
+            GIT_OPTIONAL_LOCKS: '0',
+            LC_ALL: 'C'
+        })
+    }).catch(() => null);
+    return head && head.code === 0 && !head.truncated ? normalizeGitSha(head.stdout) : null;
+}
+async function readGitHeadFromAdminFiles(root) {
+    const gitDir = await resolveGitDir(root);
+    if (!gitDir)
+        return null;
+    const headText = await readSmallText(path.join(gitDir, 'HEAD'), 4 * 1024);
+    if (!headText)
+        return null;
+    const detached = normalizeGitSha(headText);
+    if (detached)
+        return detached;
+    const symbolic = headText.match(/^ref:\s*(refs\/[^\r\n]+)\s*$/);
+    const ref = symbolic ? String(symbolic[1]) : '';
+    if (!safeGitRef(ref))
+        return null;
+    const commonDir = await resolveCommonDir(gitDir);
+    for (const base of [...new Set([gitDir, commonDir])]) {
+        const loose = await readLooseRef(base, ref);
+        if (loose)
+            return loose;
+    }
+    return readPackedRef(commonDir, ref);
+}
+async function resolveGitDir(root) {
+    const dotGit = path.join(root, '.git');
+    const stat = await fsp.stat(dotGit).catch(() => null);
+    if (!stat)
+        return null;
+    if (stat.isDirectory())
+        return dotGit;
+    if (!stat.isFile())
+        return null;
+    const text = await readSmallText(dotGit, 4 * 1024);
+    const match = text?.match(/^gitdir:\s*(.+?)\s*$/m);
+    return match ? path.resolve(path.dirname(dotGit), String(match[1])) : null;
+}
+async function resolveCommonDir(gitDir) {
+    const text = await readSmallText(path.join(gitDir, 'commondir'), 4 * 1024);
+    return text?.trim() ? path.resolve(gitDir, text.trim()) : gitDir;
+}
+async function readLooseRef(base, ref) {
+    const file = safeRefPath(base, ref);
+    if (!file)
+        return null;
+    return normalizeGitSha(await readSmallText(file, 4 * 1024));
+}
+async function readPackedRef(commonDir, ref) {
+    const text = await readSmallText(path.join(commonDir, 'packed-refs'), 4 * 1024 * 1024);
+    if (!text)
+        return null;
+    for (const line of text.split(/\r?\n/)) {
+        if (!line || line.startsWith('#') || line.startsWith('^'))
+            continue;
+        const separator = line.indexOf(' ');
+        if (separator <= 0 || line.slice(separator + 1) !== ref)
+            continue;
+        return normalizeGitSha(line.slice(0, separator));
+    }
+    return null;
+}
+async function readSmallText(file, maxBytes) {
+    const stat = await fsp.stat(file).catch(() => null);
+    if (!stat?.isFile() || stat.size > maxBytes)
+        return null;
+    return fsp.readFile(file, 'utf8').catch(() => null);
+}
+function safeGitRef(ref) {
+    return /^refs\/[A-Za-z0-9._/-]+$/.test(ref)
+        && !ref.includes('..')
+        && !ref.includes('//')
+        && !ref.includes('@{')
+        && !ref.endsWith('/')
+        && !ref.endsWith('.')
+        && !ref.endsWith('.lock');
+}
+function safeRefPath(base, ref) {
+    if (!safeGitRef(ref))
+        return null;
+    const candidate = path.resolve(base, ...ref.split('/'));
+    const relative = path.relative(path.resolve(base), candidate);
+    return relative && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative) ? candidate : null;
+}
+function remainingMs(startedAt, timeoutMs) {
+    return Math.max(0, timeoutMs - (Date.now() - startedAt));
+}
+function gitEnvironment(extra = {}) {
+    return {
+        GIT_ALTERNATE_OBJECT_DIRECTORIES: undefined,
+        GIT_COMMON_DIR: undefined,
+        GIT_CONFIG: undefined,
+        GIT_CONFIG_COUNT: '0',
+        GIT_CONFIG_GLOBAL: undefined,
+        GIT_CONFIG_NOSYSTEM: undefined,
+        GIT_CONFIG_PARAMETERS: undefined,
+        GIT_CONFIG_SYSTEM: undefined,
+        GIT_DIR: undefined,
+        GIT_DISCOVERY_ACROSS_FILESYSTEM: undefined,
+        GIT_EXTERNAL_DIFF: undefined,
+        GIT_GRAFT_FILE: undefined,
+        GIT_INDEX_FILE: undefined,
+        GIT_NAMESPACE: undefined,
+        GIT_OBJECT_DIRECTORY: undefined,
+        GIT_QUARANTINE_PATH: undefined,
+        GIT_REPLACE_REF_BASE: undefined,
+        GIT_SHALLOW_FILE: undefined,
+        GIT_WORK_TREE: undefined,
+        ...extra
+    };
+}
+function freshness(fresh, conclusive, reason, currentSha, packSha, metadataOnlyDrift, changedPaths) {
+    return {
+        fresh,
+        conclusive,
+        reason,
+        current_sha: currentSha,
+        pack_sha: packSha,
+        metadata_only_drift: metadataOnlyDrift,
+        changed_paths: changedPaths
+    };
+}
+function normalizeGitSha(value) {
+    const text = String(value || '').trim();
+    return /^[0-9a-f]{40,64}$/i.test(text) && !/^0+$/.test(text) ? text.toLowerCase() : null;
+}
+//# sourceMappingURL=code-pack-head-freshness.js.map

package/dist/core/triwiki/triwiki-module-card.js

@@ -14,7 +14,7 @@ export const DEFAULT_TRIWIKI_MODULE_CARDS = [
     moduleCard('doctor-dirty-repair', ['src/core/doctor/doctor-dirty-planner.ts', 'src/core/doctor/doctor-repair-postcheck.ts', 'src/scripts/doctor-dirty-*.ts'], ['doctor:dirty'], ['doctor-production'], 'high'),
     moduleCard('startup-config-repair', ['src/core/doctor/*startup*.ts', 'src/scripts/doctor-startup-*.ts'], ['doctor:startup'], ['doctor-production'], 'high'),
     moduleCard('context7-mcp', ['src/core/doctor/*context7*.ts', 'src/commands/context7.ts'], ['doctor:context7', 'context7:'], ['startup-mcp'], 'critical'),
-    moduleCard('supabase-mcp', ['src/core/doctor/*supabase*.ts', 'src/commands/db.ts'], ['doctor:supabase', 'db:'], ['startup-mcp'], 'critical'),
+    moduleCard('supabase-mcp', ['src/core/doctor/*supabase*.ts', 'src/core/db-safety.ts', 'src/core/pipeline-internals/runtime-core.ts'], ['doctor:supabase', 'mad-db:', 'mad-sks:'], ['startup-mcp'], 'critical'),
     moduleCard('native-capability', ['src/core/codex-native/**', 'src/scripts/native-*.ts'], ['native:', 'codex-native:'], ['native-capability'], 'high'),
     moduleCard('secret-preservation', ['src/core/**/secret*.ts', 'src/scripts/secret-*.ts', 'safety-mutation-allowlist.json'], ['secret:', 'supabase-secret'], ['doctor-production'], 'critical'),
     moduleCard('core-skill', ['.agents/skills/**', 'src/scripts/core-skill-*.ts'], ['core-skill:'], ['core-skill'], 'high'),

package/dist/core/triwiki-wrongness/wrongness-ledger.js

@@ -65,7 +65,14 @@ async function writeWrongnessLedgerUnlocked(root, ledger) {
 export async function readCombinedWrongnessRecords(root, missionId = null) {
     const project = await readWrongnessLedger(root, null);
     const mission = missionId ? await readWrongnessLedger(root, missionId) : emptyWrongnessLedger('mission', missionId);
-    return dedupeRecords([...project.records, ...mission.records]);
+    // The project ledger is also the cross-mission index, so it contains copies
+    // of mission-scoped records. A mission proof must inherit only truly global
+    // project records plus rows owned by that mission; otherwise unrelated old
+    // missions can block every future route forever.
+    const projectRecords = missionId
+        ? project.records.filter((record) => !record.mission_id || record.mission_id === missionId)
+        : project.records;
+    return dedupeRecords([...projectRecords, ...mission.records]);
 }
 export async function addWrongnessRecord(root, input = {}, opts = {}) {
     const row = asRecord(input);
@@ -291,7 +298,7 @@ export async function recordDbSafetyMismatchWrongness(root, input = {}) {
         wrongness_kind: kind,
         severity: kind === 'db_safety_false_negative' ? 'high' : 'medium',
         claim: { text: `DB safety expected ${expected} but classified ${actual}.` },
-        detected_by: { source: 'db_safety_check', command: typeof row.command === 'string' ? row.command : 'sks db check', artifact: typeof row.artifact === 'string' ? row.artifact : null, detail: typeof row.sql === 'string' ? row.sql : null },
+        detected_by: { source: 'db_safety_check', command: typeof row.command === 'string' ? row.command : '$DB internal safety check', artifact: typeof row.artifact === 'string' ? row.artifact : null, detail: typeof row.sql === 'string' ? row.sql : null },
         root_cause: { category: 'missing_db_policy', explanation: 'A DB safety expectation did not match the current classifier output.' },
         corrective_action: { summary: 'Adjust the policy/classifier or fixture expectation, then rerun DB safety validation.', required_evidence: ['db-operation-report.json'], patch_status: 'pending' },
         links: { artifacts: typeof row.artifact === 'string' ? [row.artifact] : [] }