sneakoscope 6.1.2 → 6.4.0

package/dist/core/qa-loop.js

@@ -187,7 +187,7 @@ export function inferQaLoopAnswers(prompt = '') {
         CREDENTIAL_STORAGE_ACK: 'never_store_credentials_in_artifacts_or_wiki',
         UI_CHROME_EXTENSION_ACK: UI_SURFACE_ROUTER_ACK,
         QA_VISUAL_REVIEW_IMAGEGEN_REQUIRED: wantsGptImage2Review ? GPT_IMAGE_2_ANNOTATED_REVIEW_REQUIRED_ACK : 'not_required',
-        TEAM_MODE_ALLOWED: 'no_parent_only',
+        SUBAGENT_MODE_ALLOWED: 'no_parent_only',
         MAX_QA_CYCLES: String(DEFAULT_QA_MAX_CYCLES),
         ACCEPTANCE_CRITERIA: acceptance,
         NON_GOALS: [
@@ -250,7 +250,7 @@ export function qaLoopQuestionSlots() {
         { id: 'TEST_CREDENTIALS_RUNTIME_SOURCE', question: 'If login is required, how will test-only credentials be provided without saving the values?', required: true, type: 'enum', options: ['not_required', 'ephemeral_chat_only', 'environment_variables', 'secret_manager'] },
         { id: 'CREDENTIAL_STORAGE_ACK', question: 'Acknowledge credential handling policy.', required: true, type: 'enum', options: ['never_store_credentials_in_artifacts_or_wiki'] },
         { id: 'UI_CHROME_EXTENSION_ACK', question: 'Acknowledge UI E2E evidence policy: QA-LOOP routes local/public web to @Browser, signed-in web to @Chrome, native/cross-app GUI to @Computer, and never treats synthetic artifacts as real proof.', required: true, type: 'enum', options: [UI_SURFACE_ROUTER_ACK, LEGACY_UI_CHROME_EXTENSION_FIRST_ACK] },
-        { id: 'TEAM_MODE_ALLOWED', question: 'May QA-LOOP use Team/subagents where useful?', required: true, type: 'enum', options: ['yes_parallel_where_safe', 'no_parent_only'] },
+        { id: 'SUBAGENT_MODE_ALLOWED', question: 'May QA-LOOP use official subagents where useful?', required: true, type: 'enum', options: ['yes_parallel_where_safe', 'no_parent_only'] },
         { id: 'MAX_QA_CYCLES', question: 'How many no-question QA cycles are allowed before pausing?', required: true, type: 'string' },
         { id: 'ACCEPTANCE_CRITERIA', question: 'List the QA completion criteria.', required: true, type: 'array_or_string' },
         { id: 'NON_GOALS', question: 'List anything QA-LOOP must not test.', required: true, type: 'array_or_string', allow_empty: true },
@@ -850,4 +850,3 @@ function evidenceSourceForSurface(surface) {
         return CODEX_COMPUTER_USE_EVIDENCE_SOURCE;
     return null;
 }
-//# sourceMappingURL=qa-loop.js.map

package/dist/core/quality/competitor-scorecard.js

@@ -113,4 +113,3 @@ function noFailureSignals(record) {
         || (Array.isArray(record.blockers) && record.blockers.length > 0)
         || record.status === 'blocked');
 }
-//# sourceMappingURL=competitor-scorecard.js.map

package/dist/core/questions.js

@@ -215,13 +215,13 @@ export function inferAnswersForPrompt(prompt, explicitAnswers = {}) {
     const inferred = {};
     const notes = {};
     const normalizedPrompt = String(prompt || '')
-        .replace(/^\s*\$(?:Team|SKS|Goal|team|sks|goal)\b/i, '')
+        .replace(/^\s*\$(?:SKS|Goal|sks|goal)\b/i, '')
         .replace(/\b(?:executor|reviewer|planner|user)\s*:\s*\d+\b/gi, '')
         .replace(/\s+/g, ' ')
         .trim();
     const version = String(text || '').match(/\bv?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/)?.[1] || null;
     const versionWork = /버전|version|bump|release|publish:dry|npm\s+pack/.test(lower);
-    const installWork = /bootstrap|postinstall|doctor|deps|tmux|homebrew|first install|최초\s*설치|설치\s*ux|셋업|setup/.test(lower);
+    const installWork = /bootstrap|postinstall|doctor|deps|zellij|homebrew|first install|최초\s*설치|설치\s*ux|셋업|setup/.test(lower);
     const questionGateWork = /모호|ambiguity|clarification|질문|triwiki|추론|infer|predict|예측|answers?\.json|decision-contract/.test(lower);
     const requestIntakeWork = /(모호|ambiguity|ambiguous|vague|rough|의도|intent|요청사항|requirements?|프롬프트|prompt|triwiki|위키|wiki)/.test(lower)
         && /(파이프라인|pipeline|변환|transform|rewrite|compile|리스트|list|누락|missing|의도|intent|request[- ]?intake|intake)/.test(lower);
@@ -237,7 +237,7 @@ export function inferAnswersForPrompt(prompt, explicitAnswers = {}) {
     const authWork = /로그인|auth|session|token|인증/.test(lower);
     const prioritySignalWork = /화|짜증|답답|;;|!!|강력|기억|우선|자주|반복|카운팅|count|frequency|frequent|priority|weight/.test(lower);
     const cliSurfaceWork = /\b(cli|command|route|usage|help|sks)\b|명령|커맨드|사용법/.test(lower);
-    const explicitRouteWork = /^\s*(?:\$|\[\$)(?:research|team|goal|dfix|ppt|qa-loop|image-ux-review|ux-review|visual-review|ui-ux-review|wiki|db|gx|computer-use|cu|autoresearch|sks|answer|help)\b/i.test(String(prompt || ''));
+    const explicitRouteWork = /^\s*(?:\$|\[\$)(?:research|naruto|work|goal|dfix|ppt|qa-loop|image-ux-review|ux-review|visual-review|ui-ux-review|wiki|db|gx|computer-use|cu|autoresearch|sks|answer|help)\b/i.test(String(prompt || ''));
     const triwikiAuditWork = /(triwiki|tri\s*wiki|wiki|복셀|voxel)/.test(lower)
         && /(검수|연구|개선|정상|동작|작동|반복|실수|mistake|repeat|audit|inspect|prevent|방지)/.test(lower);
     const chatCaptureWork = hasFromChatImgSignal(text)
@@ -762,4 +762,3 @@ export async function writeQuestions(dir, schema) {
     await writeJsonAtomic(path.join(dir, 'required-answers.schema.json'), schema);
     await writeTextAtomic(path.join(dir, 'questions.md'), questionsMarkdown(schema));
 }
-//# sourceMappingURL=questions.js.map

package/dist/core/recallpulse/policy.js

@@ -48,7 +48,7 @@ export const RECALLPULSE_POLICY = Object.freeze({
         'generated_skill_installation',
         'codex_app_stop_hooks',
         'dfix_ultralight_behavior',
-        'official_subagent_risk_scoped_review_with_legacy_team_compatibility',
+        'official_subagent_risk_scoped_review',
         'research_xhigh_agent_requirements',
         'db_destructive_operation_blocking',
         'imagegen_evidence_requirements'
@@ -207,4 +207,3 @@ export const RESEARCH_AGENT_PERSONA_CONTRACT = Object.freeze([
     reasoning_effort: 'max',
     service_tier: 'fast'
 })));
-//# sourceMappingURL=policy.js.map

package/dist/core/recallpulse.js

@@ -175,7 +175,7 @@ export function buildEvidenceEnvelope(decision = {}) {
         stale_rules: ['stale_when_stage_changes', 'stale_when_gate_updates', 'stale_when_source_hash_changes'],
         route_extensions: {
             Research: ['source_layer_ids', 'agent_persona_ids', 'falsification_cases'],
-            Team: ['team_roster', 'review_lanes', 'runtime_task_ids'],
+            Naruto: ['official_subagent_roster', 'review_lanes', 'runtime_task_ids'],
             DB: ['db_scan_id', 'destructive_operation_zero'],
             QALoop: ['qa_report', 'checklist_status'],
             imagegen: ['generated_image_ledger', 'issue_ledger'],
@@ -259,7 +259,7 @@ export async function buildRecallPulseGovernanceReport(root, opts = {}) {
     const missionId = opts.missionId || null;
     const inventory = buildRouteGateInventory();
     const missions = await listMissionRows(root);
-    const requestedSamples = ['Research', 'Team', 'DFix', 'DB', 'QALoop'];
+    const requestedSamples = ['Research', 'Naruto', 'DFix', 'DB', 'QALoop'];
     const samples = [];
     for (const routeId of requestedSamples) {
         const mission = routeId === 'DFix' ? null : latestMissionForRoute(missions, routeId);
@@ -603,7 +603,7 @@ async function buildL2(root, dir) {
     const pipelinePlan = await readJson(path.join(dir, 'pipeline-plan.json'), null);
     const contract = await readJson(path.join(dir, 'decision-contract.json'), null);
     const statusLedger = await readJson(path.join(dir, MISSION_STATUS_LEDGER_ARTIFACT), null);
-    const gateFiles = ['naruto-gate.json', 'research-gate.evaluated.json', 'research-gate.json', 'db-review.json', 'qa-gate.json', 'ppt-gate.json', 'image-ux-review-gate.json', 'gx-gate.json', 'hard-blocker.json', 'team-gate.json']; // team-gate is legacy read-only recall for old missions.
+    const gateFiles = ['naruto-gate.json', 'research-gate.evaluated.json', 'research-gate.json', 'db-review.json', 'qa-gate.json', 'ppt-gate.json', 'image-ux-review-gate.json', 'gx-gate.json', 'hard-blocker.json'];
     const gates = [];
     for (const file of gateFiles) {
         const gate = await readJson(path.join(dir, file), null);
@@ -653,7 +653,7 @@ function buildL3(pack = {}, { stageId = '', routeId = '', l1 = {} } = {}) {
         reason: row?.[1] || 'hydrate_source',
         selected_in_l1: selectedIds.has(row?.[0])
     })).filter((row) => row.id);
-    const broadRoute = /team|research|db|release|version|security/i.test(`${routeId} ${stageId}`);
+    const broadRoute = /naruto|research|db|release|version|security/i.test(`${routeId} ${stageId}`);
     return {
         tier: 'L3',
         label: RECALLPULSE_POLICY.cache.l3.label,
@@ -928,7 +928,7 @@ function preservedRoutePersonality(routeId = '', routeName = '') {
         DFix: 'ultralight direct-fix path stays tiny and does not start the full pipeline',
         Answer: 'answer-only path stays conversational and does not start implementation',
         SKS: 'general SKS discovery/help personality stays simple',
-        Team: 'Team redirects to the bounded official Naruto workflow with parent-owned integration and risk-scoped review',
+        Naruto: 'Naruto keeps the bounded official subagent workflow with parent-owned integration and risk-scoped review',
         QALoop: 'QA-LOOP keeps dogfood, checklist, remediation, and reverification identity',
         PPT: 'PPT keeps restrained information-first HTML/PDF delivery identity',
         ImageUXReview: 'Image UX Review keeps gpt-image-2 annotated raster review identity',
@@ -974,7 +974,7 @@ function latestMissionForRoute(missions = [], routeId = '') {
     const aliases = {
         qaloop: ['qaloop', 'qa', 'qa-loop'],
         db: ['db', 'database'],
-        team: ['team'],
+        naruto: ['naruto'],
         research: ['research'],
         goal: ['goal']
     }[target] || [target];
@@ -1018,4 +1018,3 @@ function range(start, end) {
 function escapeRegex(text = '') {
     return String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-//# sourceMappingURL=recallpulse.js.map

package/dist/core/release/critical-path-ledger.js

@@ -9,4 +9,3 @@ export function writeCriticalPathLedger(root, ledger) {
     fs.writeFileSync(file, `${JSON.stringify(ledger, null, 2)}\n`);
     return file;
 }
-//# sourceMappingURL=critical-path-ledger.js.map

package/dist/core/release/extreme-parallel-scheduler.js

@@ -196,4 +196,3 @@ function writeResourceClaimTimeline(root, runId, timeline) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-//# sourceMappingURL=extreme-parallel-scheduler.js.map

package/dist/core/release/file-ownership.js

@@ -0,0 +1,153 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+export const RELEASE_FILE_OWNERSHIP_REPORT_SCHEMA = 'sks.release-file-ownership-report.v1';
+export function readReleaseFileOwnershipManifest(file) {
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (value?.schema !== 'sks.release-file-ownership.v1')
+        throw new Error('release file ownership manifest schema is invalid');
+    if (!value.baseline || !value.workstreams || typeof value.workstreams !== 'object') {
+        throw new Error('release file ownership manifest is incomplete');
+    }
+    if (value.overlap_policy !== 'fail_closed')
+        throw new Error('release file ownership manifest must use fail_closed overlap policy');
+    return value;
+}
+export function inspectReleaseFileOwnership(input) {
+    const canonicalBase = gitCommit(input.root, input.base);
+    const canonicalHead = gitCommit(input.root, input.head);
+    const changedFiles = canonicalBase && canonicalHead ? gitChangedFiles(input.root, canonicalBase, canonicalHead) : [];
+    const workstream = input.workstream || inferWorkstream(input.manifest, changedFiles);
+    const allowedPatterns = workstream ? input.manifest.workstreams[workstream] || [] : [];
+    const sharedPatterns = input.manifest.shared_files || [];
+    const requestPrefix = workstream ? `.sneakoscope/release/6.3.0/shared-file-requests/${workstream}` : '';
+    const sharedFileChanges = changedFiles.filter((file) => matchesAny(file, sharedPatterns));
+    const outOfScopeChanges = changedFiles.filter((file) => {
+        if (requestPrefix && isWorkstreamRequest(file, workstream || ''))
+            return false;
+        return !matchesAny(file, allowedPatterns);
+    });
+    const ambiguousOwnerChanges = changedFiles.flatMap((file) => {
+        const owners = Object.entries(input.manifest.workstreams)
+            .filter(([, patterns]) => matchesAny(file, patterns))
+            .map(([owner]) => owner);
+        return owners.length > 1 ? [{ file, owners }] : [];
+    });
+    const blockers = [];
+    if (!workstream)
+        blockers.push('workstream_unresolved');
+    else if (!input.manifest.workstreams[workstream])
+        blockers.push(`workstream_unknown:${workstream}`);
+    if (!canonicalBase)
+        blockers.push('base_commit_invalid');
+    if (!canonicalHead)
+        blockers.push('head_commit_invalid');
+    if (input.manifest.overlap_policy !== 'fail_closed')
+        blockers.push('overlap_policy_not_fail_closed');
+    if (canonicalBase && input.manifest.baseline !== canonicalBase)
+        blockers.push('base_does_not_match_manifest_baseline');
+    if (canonicalBase && canonicalHead && !gitOk(input.root, ['merge-base', '--is-ancestor', canonicalBase, canonicalHead]))
+        blockers.push('base_not_ancestor_of_head');
+    if (changedFiles.length === 0)
+        blockers.push('worker_diff_empty');
+    for (const file of sharedFileChanges)
+        blockers.push(`shared_file_changed:${file}`);
+    for (const file of outOfScopeChanges)
+        blockers.push(`out_of_scope_change:${file}`);
+    for (const entry of ambiguousOwnerChanges)
+        blockers.push(`ambiguous_file_owner:${entry.file}:${entry.owners.join(',')}`);
+    return {
+        schema: RELEASE_FILE_OWNERSHIP_REPORT_SCHEMA,
+        ok: blockers.length === 0,
+        base: canonicalBase || input.base,
+        head: canonicalHead || input.head,
+        workstream,
+        changed_files: changedFiles,
+        allowed_patterns: allowedPatterns,
+        shared_file_changes: sharedFileChanges,
+        out_of_scope_changes: outOfScopeChanges,
+        ambiguous_owner_changes: ambiguousOwnerChanges,
+        blockers,
+        checked_at: new Date().toISOString()
+    };
+}
+function inferWorkstream(manifest, changedFiles) {
+    const requestOwners = [...new Set(changedFiles.flatMap((file) => {
+            const match = file.match(/^\.sneakoscope\/release\/6\.3\.0\/shared-file-requests\/(W\d+)(?:-[^/]+)?\.json$/);
+            return match?.[1] ? [match[1]] : [];
+        }))];
+    const requestOwner = requestOwners[0];
+    if (requestOwners.length === 1 && requestOwner && manifest.workstreams[requestOwner])
+        return requestOwner;
+    const candidates = Object.entries(manifest.workstreams)
+        .filter(([owner, patterns]) => changedFiles.every((file) => isWorkstreamRequest(file, owner) || matchesAny(file, patterns)))
+        .map(([owner]) => owner);
+    return candidates.length === 1 ? candidates[0] || null : null;
+}
+function gitChangedFiles(root, base, head) {
+    const result = spawnSync('git', ['diff', '--name-status', '-z', '--find-renames', '--diff-filter=ACDMRTUXB', `${base}..${head}`, '--'], {
+        cwd: root,
+        encoding: 'buffer',
+        maxBuffer: 16 * 1024 * 1024
+    });
+    if (result.status !== 0)
+        throw new Error(String(result.stderr?.toString('utf8') || result.stdout?.toString('utf8') || 'git diff failed').trim());
+    const tokens = result.stdout.toString('utf8').split('\0');
+    const files = [];
+    for (let index = 0; index < tokens.length;) {
+        const status = tokens[index++] || '';
+        if (!status)
+            break;
+        const first = normalize(tokens[index++] || '');
+        if (first)
+            files.push(first);
+        if (/^[RC]/.test(status)) {
+            const second = normalize(tokens[index++] || '');
+            if (second)
+                files.push(second);
+        }
+    }
+    return [...new Set(files)].sort();
+}
+function gitCommit(root, value) {
+    const result = spawnSync('git', ['rev-parse', '--verify', `${value}^{commit}`], { cwd: root, encoding: 'utf8' });
+    const commit = result.status === 0 ? String(result.stdout || '').trim() : '';
+    return /^[a-f0-9]{40}$/i.test(commit) ? commit : '';
+}
+function gitOk(root, args) {
+    return spawnSync('git', args, { cwd: root, stdio: 'ignore' }).status === 0;
+}
+function matchesAny(file, patterns) {
+    return patterns.some((pattern) => globToRegExp(normalize(pattern)).test(normalize(file)));
+}
+function isWorkstreamRequest(file, owner) {
+    return new RegExp(`^\\.sneakoscope/release/6\\.3\\.0/shared-file-requests/${escapeRegExp(owner)}(?:-[^/]+)?\\.json$`).test(file);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function globToRegExp(pattern) {
+    let source = '^';
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index] || '';
+        if (char === '*') {
+            if (pattern[index + 1] === '*') {
+                index += 1;
+                source += '.*';
+            }
+            else {
+                source += '[^/]*';
+            }
+        }
+        else if (char === '?') {
+            source += '[^/]';
+        }
+        else {
+            source += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+        }
+    }
+    return new RegExp(`${source}$`);
+}
+function normalize(value) {
+    return value.trim().split(path.sep).join('/').replace(/^\.\//, '');
+}

package/dist/core/release/gate-cache.js

@@ -41,4 +41,3 @@ export function recordGateResult(cache, key, gateId, ok, durationMs) {
 export function lookupGateResult(cache, key) {
     return cache.records[key] ?? null;
 }
-//# sourceMappingURL=gate-cache.js.map

package/dist/core/release/gate-manifest.js

@@ -6,9 +6,7 @@ export const FORBIDDEN_RECURSIVE_GATES = new Set([
     'release:check:dynamic:execute',
     'release:real-check',
     'release:publish',
-    'publish:ignore-scripts',
     'publish:npm',
-    'publish:dry',
     'prepublishOnly'
 ]);
 // Gates that always run on a release check regardless of which files changed.
@@ -20,7 +18,7 @@ export const ALWAYS_ON_GATES = new Set([
     'runtime:dist-parity',
     'runtime:ts-source-of-truth',
     'runtime:no-src-mjs',
-    'runtime:no-tmux',
+    'runtime:terminal-current',
     'runtime:ts-rust-boundary',
     'safety:side-effect-zero',
     'safety:mutation-callsite-coverage',
@@ -31,11 +29,13 @@ export const ALWAYS_ON_GATES = new Set([
     'core-skill:legacy-promotion-api-audit',
     'postinstall:safe-side-effects',
     'publish:packlist-performance',
+    'publish:runtime-script-closure',
     'legacy:gate-inventory',
     'legacy:gate-purge',
     'legacy:strong-inventory',
     'migration:upgrade-safety',
     'release:proof-truth',
+    'release:latency-slo',
     'release:dynamic-performance',
     'release:provenance',
     'changelog:check'
@@ -50,6 +50,7 @@ export const REQUIRED_FOR_PUBLISH = new Set([
     'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',
     'release:proof-truth',
+    'release:latency-slo',
     'release:provenance',
     'codex:0144:manifest',
     'codex:0144:binary-identity',
@@ -58,6 +59,7 @@ export const REQUIRED_FOR_PUBLISH = new Set([
     'codex:0144:thread-store',
     'codex:0144:capability',
     'publish:packlist-performance',
+    'publish:runtime-script-closure',
     'postinstall:safe-side-effects',
     'legacy:gate-inventory',
     'legacy:gate-purge',
@@ -79,7 +81,7 @@ function tierFor(id) {
     return 'P1';
 }
 function costFor(id) {
-    if (id.includes(':require-real') || id.includes(':actual') || id.startsWith('agent:real-codex') || id.includes('real-session') || id === 'zellij:pane-proof' || id === 'zellij:screen-proof' || id === 'publish:dry-run-performance') {
+    if (id.includes(':require-real') || id.includes(':actual') || id.startsWith('agent:real-codex') || id.includes('real-session') || id === 'zellij:pane-proof' || id === 'zellij:screen-proof') {
         return 'real';
     }
     return 'hermetic';
@@ -89,7 +91,7 @@ export function affectedGlobsFor(id) {
     const prefix = id.split(':')[0];
     switch (prefix) {
         case 'architecture':
-            return ['src/core/safety/ssot-guard.ts', 'src/core/pipeline-internals/runtime-core.ts', 'src/core/pipeline-internals/runtime-gates.ts', 'src/core/commands/team-command.ts', 'src/scripts/release-parallel-check.ts', 'src/scripts/architecture-guard-check.ts', 'docs/architecture-ts-rust-boundary.md', 'package.json'];
+            return ['src/core/safety/ssot-guard.ts', 'src/core/pipeline-internals/runtime-core.ts', 'src/core/pipeline-internals/runtime-gates.ts', 'src/core/commands/naruto-command.ts', 'src/scripts/release-parallel-check.ts', 'src/scripts/architecture-guard-check.ts', 'docs/architecture-ts-rust-boundary.md', 'package.json'];
         case 'core-skill':
             return ['src/core/skills/**', 'schemas/skills/**', 'src/scripts/core-skill-*.ts'];
         case 'zellij':
@@ -100,7 +102,7 @@ export function affectedGlobsFor(id) {
             return ['src/core/safety/**', 'src/scripts/side-effect-runtime-report-check.ts', '.sneakoscope/missions/**/mutation-ledger.jsonl', '.sneakoscope/mutation-ledger.jsonl'];
         case 'legacy':
         case 'migration':
-            return ['src/core/migration/**', 'src/core/codex/**', 'src/core/init.ts', 'src/cli/install-helpers.ts', 'src/scripts/legacy-upgrade-matrix-check.ts'];
+            return ['src/core/migration/**', 'src/core/codex/**', 'src/core/init.ts', 'src/cli/install-helpers.ts', 'src/scripts/current-upgrade-matrix-check.ts'];
         case 'publish':
             return ['package.json', '.npmignore', 'src/scripts/packlist-performance-check.ts', 'src/scripts/npm-publish-performance-check.ts', 'dist/**'];
         case 'postinstall':
@@ -108,7 +110,6 @@ export function affectedGlobsFor(id) {
         case 'runtime':
             return ['src/**', 'src/scripts/runtime-*.ts', 'src/scripts/build-dist.ts', 'src/scripts/clean-dist.ts', 'package.json'];
         case 'agent':
-        case 'team':
         case 'research':
         case 'qa':
         case 'naruto':
@@ -201,4 +202,3 @@ export function selectGates(gates, changedFiles, opts = {}) {
     }
     return { selected, skipped };
 }
-//# sourceMappingURL=gate-manifest.js.map

package/dist/core/release/gate-pack-assertion.js

@@ -55,4 +55,3 @@ function readJson(file) {
         return null;
     }
 }
-//# sourceMappingURL=gate-pack-assertion.js.map

package/dist/core/release/gate-pack-fixture-cache.js

@@ -72,4 +72,3 @@ function cleanupOldRuns(runsDir, keep) {
     for (const run of runs.slice(Math.max(0, keep)))
         fs.rmSync(run.dir, { recursive: true, force: true });
 }
-//# sourceMappingURL=gate-pack-fixture-cache.js.map

package/dist/core/release/gate-pack-manifest.js

@@ -115,4 +115,3 @@ function resourceClassesForPack(id) {
         return ['remote-model-real'];
     return ['cpu-light', 'fs-read'];
 }
-//# sourceMappingURL=gate-pack-manifest.js.map

package/dist/core/release/gate-pack-runner.js

@@ -170,4 +170,3 @@ function spawnNpmScript(root, scriptName, env) {
         child.on('close', (status) => resolve({ status, stdout, stderr }));
     });
 }
-//# sourceMappingURL=gate-pack-runner.js.map

package/dist/core/release/gate-timing.js

@@ -102,4 +102,3 @@ function tail(value) {
     const text = String(value || '');
     return text.length > 4000 ? text.slice(text.length - 4000) : text;
 }
-//# sourceMappingURL=gate-timing.js.map

package/dist/core/release/macos-menubar-proof.js

@@ -0,0 +1,167 @@
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { releaseProofDir, writeReleaseJson } from './release-pack-receipt.js';
+export const MACOS_MENUBAR_PROOF_SCHEMA = 'sks.macos-menubar-proof.v1';
+export const MACOS_MENUBAR_REQUIRED_CHECKS = Object.freeze([
+    'swift_parse',
+    'swift_compile',
+    'appkit_link',
+    'source_inventory',
+    'resources',
+    'plist_icon',
+    'app_icon_load',
+    'codesign',
+    'codesign_identifier',
+    'install_idempotence',
+    'previous_app_rollback',
+    'resource_hash',
+    'source_hash',
+    'build_stamp_binding',
+    'notification_actions',
+    'accessibility',
+    'reduced_motion',
+    'action_script',
+    'launch_agent'
+]);
+export const MACOS_INSTALL_REQUIRED_CHECKS = Object.freeze([
+    'install_ok',
+    'app_bundle_exists',
+    'swift_compile',
+    'swift_parse',
+    'source_inventory',
+    'resources_inventory',
+    'expected_resources_present',
+    'info_plist_icon_verified',
+    'app_icon_load_smoke',
+    'codesign_strict_verified',
+    'codesign_identifier_verified',
+    'action_script_executable',
+    'launch_agent_safe',
+    'notification_action_test',
+    'accessibility_smoke',
+    'reduced_motion_smoke',
+    'build_stamp_version_source_binding',
+    'is_idempotent',
+    'previous_app_rollback_verified'
+]);
+export function validateMacosInstallReportOutcome(value) {
+    const report = value;
+    const blockers = [];
+    if (report?.ok !== true)
+        blockers.push('not_ok');
+    if (!Array.isArray(report?.failed_checks) || report.failed_checks.length > 0)
+        blockers.push('failed_checks_present');
+    if (!Array.isArray(report?.blockers) || report.blockers.length > 0)
+        blockers.push('blockers_present');
+    return { ok: blockers.length === 0, blockers };
+}
+export function validateMacosMenubarProof(value, expected = {}) {
+    const proof = value;
+    const blockers = [];
+    if (!proof || proof.schema !== MACOS_MENUBAR_PROOF_SCHEMA)
+        blockers.push('macos_proof_schema_invalid');
+    if (proof?.ok !== true)
+        blockers.push('macos_proof_not_ok');
+    if (proof?.runner_os !== 'macOS')
+        blockers.push('macos_runner_identity_invalid');
+    if (!proof?.swift_version)
+        blockers.push('swift_version_missing');
+    if (!proof?.xcode_version)
+        blockers.push('xcode_version_missing');
+    if (!proof?.app_path)
+        blockers.push('app_path_missing');
+    if (!proof?.install_report_path || path.isAbsolute(proof.install_report_path) || !proof.install_report_path.startsWith('.sneakoscope/reports/'))
+        blockers.push('install_report_path_invalid');
+    if (!/^[a-f0-9]{64}$/i.test(String(proof?.install_report_sha256 || '')))
+        blockers.push('install_report_hash_missing');
+    if (proof?.install_report?.schema !== 'sks.sks-menubar-install-check.v2')
+        blockers.push('install_report_schema_invalid');
+    if (!proof?.install_report?.checks || Object.keys(proof.install_report.checks).length === 0)
+        blockers.push('install_report_checks_missing');
+    else {
+        for (const key of MACOS_INSTALL_REQUIRED_CHECKS)
+            if (proof.install_report.checks[key] !== true)
+                blockers.push(`install_report_check_failed:${key}`);
+        for (const [key, ok] of Object.entries(proof.install_report.checks))
+            if (ok !== true)
+                blockers.push(`install_report_check_failed:${key}`);
+    }
+    if (!Array.isArray(proof?.install_report?.failed_checks) || proof.install_report.failed_checks.length > 0)
+        blockers.push('install_report_failed_checks_present');
+    for (const key of ['resources_sha256', 'source_sha256', 'build_stamp_resources_sha256', 'build_stamp_source_sha256']) {
+        if (!/^[a-f0-9]{64}$/i.test(String(proof?.install_report?.[key] || '')))
+            blockers.push(`install_report_hash_invalid:${key}`);
+    }
+    if (proof?.install_report?.build_stamp_schema !== 'sks.sks-menubar-build-stamp.v2')
+        blockers.push('install_report_build_stamp_schema_invalid');
+    if (expected.version && proof?.install_report?.build_stamp_package_version !== expected.version)
+        blockers.push('install_report_build_stamp_version_mismatch');
+    if (proof?.install_report?.resources_sha256 !== proof?.install_report?.build_stamp_resources_sha256)
+        blockers.push('install_report_resource_hash_binding_mismatch');
+    if (proof?.install_report?.source_sha256 !== proof?.install_report?.build_stamp_source_sha256)
+        blockers.push('install_report_source_hash_binding_mismatch');
+    if (expected.version && proof?.version !== expected.version)
+        blockers.push('macos_proof_version_mismatch');
+    if (expected.sourceCommit && proof?.source_commit !== expected.sourceCommit)
+        blockers.push('macos_proof_source_commit_mismatch');
+    for (const key of MACOS_MENUBAR_REQUIRED_CHECKS) {
+        if (proof?.checks?.[key] !== true)
+            blockers.push(`macos_check_failed:${key}`);
+    }
+    if (!proof?.generated_at || Number.isNaN(Date.parse(String(proof.generated_at))))
+        blockers.push('macos_proof_generated_at_invalid');
+    if (!Array.isArray(proof?.blockers) || proof.blockers.length > 0)
+        blockers.push('macos_proof_blockers_present');
+    return { ok: blockers.length === 0, proof: proof || null, blockers };
+}
+export function validateMacosMenubarProofArtifacts(root, value, expected = {}) {
+    const validation = validateMacosMenubarProof(value, expected);
+    const proof = validation.proof;
+    const blockers = [...validation.blockers];
+    const file = proof?.install_report_path ? path.resolve(root, proof.install_report_path) : '';
+    const reportRoot = path.resolve(root, '.sneakoscope', 'reports');
+    const relative = file ? path.relative(reportRoot, file) : '..';
+    if (!file || relative.startsWith('..') || path.isAbsolute(relative) || !fs.existsSync(file))
+        blockers.push('install_report_artifact_missing_or_unsafe');
+    else {
+        const bytes = fs.readFileSync(file);
+        if (crypto.createHash('sha256').update(bytes).digest('hex') !== proof?.install_report_sha256)
+            blockers.push('install_report_artifact_hash_mismatch');
+        try {
+            const report = JSON.parse(bytes.toString('utf8'));
+            if (report?.schema !== proof?.install_report?.schema)
+                blockers.push('install_report_artifact_schema_mismatch');
+            blockers.push(...validateMacosInstallReportOutcome(report).blockers.map((blocker) => `install_report_artifact_${blocker}`));
+            if (JSON.stringify(report?.checks || {}) !== JSON.stringify(proof?.install_report?.checks || {}))
+                blockers.push('install_report_artifact_checks_mismatch');
+            if (String(report?.resources_sha256 || '') !== proof?.install_report?.resources_sha256)
+                blockers.push('install_report_artifact_resource_hash_mismatch');
+            if (String(report?.source_sha256 || '') !== proof?.install_report?.source_sha256)
+                blockers.push('install_report_artifact_source_hash_mismatch');
+            const stamp = report?.result?.build_stamp || report?.build_stamp || {};
+            if (String(stamp?.schema || '') !== proof?.install_report?.build_stamp_schema
+                || String(stamp?.package_version || '') !== proof?.install_report?.build_stamp_package_version
+                || String(stamp?.resources_sha256 || '') !== proof?.install_report?.build_stamp_resources_sha256
+                || String(stamp?.source_sha256 || '') !== proof?.install_report?.build_stamp_source_sha256)
+                blockers.push('install_report_artifact_build_stamp_mismatch');
+        }
+        catch {
+            blockers.push('install_report_artifact_json_invalid');
+        }
+    }
+    return { ok: blockers.length === 0, proof, blockers: [...new Set(blockers)] };
+}
+export function writeMacosMenubarProof(root, proof) {
+    const file = path.join(releaseProofDir(root, proof.version), 'macos-menubar-proof.json');
+    writeReleaseJson(file, proof);
+    return file;
+}
+export function readMacosMenubarProof(root, version) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(releaseProofDir(root, version), 'macos-menubar-proof.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}