sneakoscope 6.2.0 → 6.4.0

package/dist/core/loops/loop-gate-ladder.js

@@ -13,4 +13,3 @@ export function canEscalateLoopLevel(input) {
 export function sourceMutationRequiresGptFinal(node) {
     return node.level === 'L2-action' || node.risk.requires_gpt_final || node.gates.final.includes('gpt:final-arbiter');
 }
-//# sourceMappingURL=loop-gate-ladder.js.map

package/dist/core/loops/loop-gate-registry.js

@@ -93,4 +93,3 @@ function normalizeSideEffect(value) {
 function shellQuote(value) {
     return `'${String(value).replace(/'/g, `'\\''`)}'`;
 }
-//# sourceMappingURL=loop-gate-registry.js.map

package/dist/core/loops/loop-gate-runner.js

@@ -215,4 +215,3 @@ function isWithinPath(base, target) {
     const resolvedTarget = path.resolve(target);
     return resolvedTarget === resolvedBase || resolvedTarget.startsWith(`${resolvedBase}${path.sep}`);
 }
-//# sourceMappingURL=loop-gate-runner.js.map

package/dist/core/loops/loop-gate-selector.js

@@ -16,9 +16,9 @@ export function selectLoopGates(input) {
         add(local, ['qa-loop:app-handoff-gate-lifecycle']);
     else if (/codex/.test(files) || input.node.loop_id.includes('codex'))
         add(local, ['codex:0139-capability', 'codex-sdk:version-compat']);
-    else if (/mad-db|db-safety/.test(files) || input.node.loop_id.includes('mad-db'))
-        add(local, ['mad-db:safety-conflict-matrix', 'mad-db:operation-lifecycle-ledger']);
-    else if (/agent|scheduler|native-swarm/.test(files) || input.node.loop_id.includes('naruto'))
+    else if (/mad-sks.*sql-plane|db-safety/.test(files) || input.node.loop_id.includes('mad-sks-sql-plane'))
+        add(local, ['mad-sks:sql-plane-capability', 'mad-sks:sql-plane-operation-lifecycle']);
+    else if (/agent|scheduler|worker-runtime/.test(files) || input.node.loop_id.includes('naruto'))
         add(local, ['parallel:runtime-real-blackbox', 'scheduler:utilization-proof']);
     else
         add(local, ['loop:affected']);
@@ -49,4 +49,3 @@ function add(target, values) {
     for (const value of values)
         target.add(value);
 }
-//# sourceMappingURL=loop-gate-selector.js.map

package/dist/core/loops/loop-gpt-final-arbiter.js

@@ -78,4 +78,3 @@ function stringArray(value) {
         return [];
     return value.map((item) => typeof item === 'string' ? item : JSON.stringify(item)).filter(Boolean);
 }
-//# sourceMappingURL=loop-gpt-final-arbiter.js.map

package/dist/core/loops/loop-integration-merge.js

@@ -77,4 +77,3 @@ async function writeHandoff(root, loopId, detail) {
 function safeArtifactId(value) {
     return String(value || 'unknown').replace(/[^A-Za-z0-9_.-]/g, '_').slice(0, 80) || 'unknown';
 }
-//# sourceMappingURL=loop-integration-merge.js.map

package/dist/core/loops/loop-interrupt-registry.js

@@ -115,4 +115,3 @@ function processStillExists(pid) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
-//# sourceMappingURL=loop-interrupt-registry.js.map

package/dist/core/loops/loop-iteration-runner.js

@@ -1,2 +1 @@
 export { runLoopNode } from './loop-runtime.js';
-//# sourceMappingURL=loop-iteration-runner.js.map

package/dist/core/loops/loop-lease.js

@@ -88,4 +88,3 @@ function allDocs(scope) {
     const values = [...scope.files, ...scope.directories];
     return values.length > 0 && values.every((value) => value === 'README.md' || value === 'CHANGELOG.md' || value.startsWith('docs'));
 }
-//# sourceMappingURL=loop-lease.js.map

package/dist/core/loops/loop-merge-strategy.js

@@ -102,4 +102,3 @@ function result(loopId, ok, selectedStrategy, attempts, changedFiles, blockers)
         blockers: [...new Set(blockers)]
     };
 }
-//# sourceMappingURL=loop-merge-strategy.js.map

package/dist/core/loops/loop-mutation-ledger.js

@@ -100,4 +100,3 @@ export async function mutationLedgerFromLoopProofs(input) {
     }
     return events;
 }
-//# sourceMappingURL=loop-mutation-ledger.js.map

package/dist/core/loops/loop-observability.js

@@ -16,4 +16,3 @@ export function summarizeLoopGraphProof(proof) {
         blocked_loop_ids: proof.blockers
     };
 }
-//# sourceMappingURL=loop-observability.js.map

package/dist/core/loops/loop-owner-inference.js

@@ -57,4 +57,3 @@ function intersection(a, b) {
     const rhs = new Set(b);
     return a.filter((value) => rhs.has(value));
 }
-//# sourceMappingURL=loop-owner-inference.js.map

package/dist/core/loops/loop-owner-ledger.js

@@ -1,2 +1 @@
 export { acquireLoopLease, releaseLoopLease, detectLoopLeaseConflicts } from './loop-lease.js';
-//# sourceMappingURL=loop-owner-ledger.js.map

package/dist/core/loops/loop-planner.js

@@ -203,4 +203,3 @@ function hintAppliesToNode(hint, node) {
     const scopes = [...node.owner_scope.files, ...node.owner_scope.directories].map((value) => value.replace(/^\.?\//, ''));
     return scopes.some((scope) => scope === hint.scope || scope.startsWith(`${hint.scope}/`) || hint.scope.startsWith(`${scope}/`));
 }
-//# sourceMappingURL=loop-planner.js.map

package/dist/core/loops/loop-proof-summary.js

@@ -7,4 +7,3 @@ export function renderLoopProofSummary(proof) {
         `Blocked: ${proof.blockers.length ? proof.blockers.join(', ') : 'none'}`
     ].join('\n');
 }
-//# sourceMappingURL=loop-proof-summary.js.map

package/dist/core/loops/loop-proof.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=loop-proof.js.map

package/dist/core/loops/loop-risk-classifier.js

@@ -7,11 +7,11 @@ export function classifyLoopRisk(node) {
     ].join(' ').toLowerCase();
     const reasons = [];
     let level = 'low';
-    if (/(db|mad-db|mcp|token|auth|postinstall|publish|global config)/.test(scope)) {
+    if (/(db|mad-sks.*sql-plane|mcp|token|auth|postinstall|publish|global config)/.test(scope)) {
         level = 'critical';
         reasons.push('critical_scope');
     }
-    else if (/(release-gates|worktree|scheduler|zellij|codex-control|agent|native-swarm)/.test(scope)) {
+    else if (/(release-gates|worktree|scheduler|zellij|codex-control|agent|worker-runtime)/.test(scope)) {
         level = 'high';
         reasons.push('runtime_or_scheduler_scope');
     }
@@ -39,4 +39,3 @@ export function loopLevelAllowedUnattended(node) {
         && node.gates.local.length > 0
         && !node.risk.requires_human_handoff;
 }
-//# sourceMappingURL=loop-risk-classifier.js.map

package/dist/core/loops/loop-runtime-control.js

@@ -24,4 +24,3 @@ export async function checkpointCancelledLoop(root, node, iteration, phase) {
         resumable: true
     });
 }
-//# sourceMappingURL=loop-runtime-control.js.map

package/dist/core/loops/loop-runtime.js

@@ -314,4 +314,3 @@ function emptyGate() {
 function emptyDiff() {
     return { changed_files: [], patch_bytes: 0, diff_stat: '', blockers: [] };
 }
-//# sourceMappingURL=loop-runtime.js.map

package/dist/core/loops/loop-scheduler.js

@@ -66,4 +66,3 @@ export function graphProofFromLoopProofs(input) {
         blockers
     };
 }
-//# sourceMappingURL=loop-scheduler.js.map

package/dist/core/loops/loop-schema.js

@@ -60,4 +60,3 @@ export function validateLoopBudget(budget) {
 export function allGateIds(gates) {
     return [...new Set([...gates.triage, ...gates.local, ...gates.checker, ...gates.integration, ...gates.final])];
 }
-//# sourceMappingURL=loop-schema.js.map

package/dist/core/loops/loop-side-effect-scanner.js

@@ -88,4 +88,3 @@ function normalize(file) {
 export function loopSideEffectLedgerPath(root, missionId) {
     return loopMutationLedgerPath(root, missionId);
 }
-//# sourceMappingURL=loop-side-effect-scanner.js.map

package/dist/core/loops/loop-state.js

@@ -58,4 +58,3 @@ export function initialLoopState(input) {
         updated_at: new Date().toISOString()
     };
 }
-//# sourceMappingURL=loop-state.js.map

package/dist/core/loops/loop-worker-prompts.js

@@ -42,4 +42,3 @@ function ownerScopeText(node) {
         ...node.owner_scope.directories.map((dir) => `dir:${dir}`)
     ].join(', ') || 'none';
 }
-//# sourceMappingURL=loop-worker-prompts.js.map

package/dist/core/loops/loop-worker-runtime.js

@@ -85,7 +85,6 @@ async function runLoopWorkerNative(input) {
         maxAgentCount: Math.max(1, workerCount),
         targetActiveSlots: Math.max(1, workerCount),
         visualLaneCount: visiblePaneCap,
-        narutoMode: true,
         narutoWorkGraph: workGraph,
         ...zellijPlacementOpts,
         env: {
@@ -267,7 +266,7 @@ function buildLoopNarutoWorkGraph(input, workerCount, executionProfile, invocati
     return {
         schema: 'sks.naruto-work-graph.v1',
         route: '$Naruto',
-        requested_clones: workerCount,
+        requested_workers: workerCount,
         total_work_items: workItems.length,
         readonly: input.phase === 'checker',
         write_capable: input.phase === 'maker',
@@ -339,4 +338,3 @@ function effectiveLoopWorkerCount(input) {
     const budget = computeLoopConcurrencyBudget({ plan: input.plan });
     return loopWorkerBudgetFor(budget, input.node.loop_id, input.phase, requested);
 }
-//# sourceMappingURL=loop-worker-runtime.js.map

package/dist/core/loops/loop-worktree-runtime.js

@@ -89,4 +89,3 @@ function stringArray(value) {
         return [];
     return value.map((item) => String(item || '').trim()).filter(Boolean);
 }
-//# sourceMappingURL=loop-worktree-runtime.js.map

package/dist/core/mad-sks/audit-ledger.js

@@ -43,4 +43,3 @@ export async function writeMadSksAuditLedger(file, ledger) {
     await writeJsonAtomic(file, ledger);
     return ledger;
 }
-//# sourceMappingURL=audit-ledger.js.map

package/dist/core/mad-sks/authorization-manifest.js

@@ -55,4 +55,3 @@ export function validateMadSksAuthorizationManifest(value) {
 function hashAuthorizationPayload(payload) {
     return sha256(stableJson(payload));
 }
-//# sourceMappingURL=authorization-manifest.js.map

package/dist/core/mad-sks/executors/computer-use-executor.js

@@ -70,4 +70,3 @@ async function runVisualHandoff(input, context, scope, dryRun) {
         extra: { guard, handoff: true, local_only_artifact_policy: true }
     });
 }
-//# sourceMappingURL=computer-use-executor.js.map

package/dist/core/mad-sks/executors/db-write-executor.js

@@ -31,7 +31,7 @@ export async function runDbWrite(input, context, dryRun = Boolean(input.dry_run)
     });
     if (!guard.ok)
         blockers.push(...guard.issues);
-    // db-write-executor has no execution engine — it never calls runMadDbCycle (or any
+    // db-write-executor has no execution engine — it never calls the MAD-SKS SQL-plane cycle (or any
     // adapter) to actually run SQL against a database. It can only produce a preview
     // plan. A real apply must therefore always be blocked here rather than fabricate
     // an 'applied' result; the actual execution route is the sql-plane executor.
@@ -62,4 +62,3 @@ export async function runDbWrite(input, context, dryRun = Boolean(input.dry_run)
         extra: { guard, sql_classification: sqlClassification, migration_file: migrationFile, migration_hash: migrationHash, affected_tables: input.affected_tables || [] }
     });
 }
-//# sourceMappingURL=db-write-executor.js.map

package/dist/core/mad-sks/executors/executor-base.js

@@ -170,4 +170,3 @@ export function redactedCommand(command) {
         return command.map((part) => redactMadSksSecrets(part)).join(' ');
     return redactMadSksSecrets(command || '');
 }
-//# sourceMappingURL=executor-base.js.map

package/dist/core/mad-sks/executors/file-write-executor.js

@@ -136,4 +136,3 @@ export async function runFileWrite(input, context, dryRun = Boolean(input.dry_ru
         extra: { target_path: target, before_hash: beforeHash, after_hash: afterHash, guard }
     });
 }
-//# sourceMappingURL=file-write-executor.js.map

package/dist/core/mad-sks/executors/index.js

@@ -44,4 +44,3 @@ export async function runMadSksExecutor(input) {
     const context = createMadSksExecutorContext({ ...input, permission_model });
     return input.dry_run ? executor.dryRun(input, context) : executor.apply(input, context);
 }
-//# sourceMappingURL=index.js.map

package/dist/core/mad-sks/executors/package-install-executor.js

@@ -86,4 +86,3 @@ function packageArgv(input) {
     const packages = Array.isArray(input.packages) ? input.packages.map(String) : [];
     return [manager, operation, ...packages];
 }
-//# sourceMappingURL=package-install-executor.js.map

package/dist/core/mad-sks/executors/service-control-executor.js

@@ -68,4 +68,3 @@ function serviceArgv(input) {
         return ['npm', 'run', String(input.script || 'dev')];
     return [command, String(input.operation || 'status'), String(input.service || '')].filter(Boolean);
 }
-//# sourceMappingURL=service-control-executor.js.map

package/dist/core/mad-sks/executors/shell-command-executor.js

@@ -126,4 +126,3 @@ function spawnArgv(argv, cwd) {
         child.on('close', (code) => resolve({ code, stdout, stderr }));
     });
 }
-//# sourceMappingURL=shell-command-executor.js.map

package/dist/core/mad-sks/executors/sql-plane-executor.js

@@ -1,9 +1,9 @@
 import path from 'node:path';
 import { classifySql } from '../../db-safety.js';
 import { readText } from '../../fsx.js';
-import { runMadDbCycle } from '../../mad-db/mad-db-coordinator.js';
-import { isMadDbControlPlaneDeniedTool, madDbOperationClassesFromClassification } from '../../mad-db/mad-db-policy.js';
-import { withMadDbLock } from '../../mad-db/mad-db-lock.js';
+import { runMadSksSqlPlaneCycle } from '../sql-plane/coordinator.js';
+import { isMadSksSqlPlaneControlPlaneDeniedTool, madSksSqlPlaneOperationClassesFromClassification } from '../sql-plane/policy.js';
+import { withMadSksSqlPlaneLock } from '../sql-plane/lock.js';
 import { madSksCatastrophicSqlExplicitlyRequested } from '../../permission-gates.js';
 import { runMadSksGuardMiddleware } from '../guard-middleware.js';
 import { madSksAuditAction } from '../audit-ledger.js';
@@ -31,7 +31,7 @@ async function runSqlPlane(input, context, dryRun = Boolean(input.dry_run)) {
     const toolName = String(input.tool_name || (action === 'apply-migration' ? 'apply_migration' : 'execute_sql'));
     const userIntent = String(input.user_intent || context.permission_model?.user_intent || 'MAD-SKS SQL-plane execution');
     const classification = classifySql(sql || userIntent);
-    const operationClasses = madDbOperationClassesFromClassification({ ...classification, toolName });
+    const operationClasses = madSksSqlPlaneOperationClassesFromClassification({ ...classification, toolName });
     const catastrophic = madSksCatastrophicSqlExplicitlyRequested({ classification, userIntent, sql });
     const rollbackKind = rollbackSql
         ? 'compensating_sql'
@@ -41,8 +41,8 @@ async function runSqlPlane(input, context, dryRun = Boolean(input.dry_run)) {
     const blockers = [];
     if (!sql.trim() && action !== 'apply-migration')
         blockers.push('sql_required_for_sql_plane_executor');
-    if (isMadDbControlPlaneDeniedTool(toolName))
-        blockers.push('mad_db_control_plane_tool_denied');
+    if (isMadSksSqlPlaneControlPlaneDeniedTool(toolName))
+        blockers.push('mad_sks_sql_plane_control_plane_tool_denied');
     if (catastrophic.required && !catastrophic.ok)
         blockers.push('catastrophic_sql_literal_request_missing');
     if (!dryRun && ['write', 'destructive'].includes(String(classification.level || '')) && !verifySql)
@@ -125,7 +125,7 @@ async function runSqlPlane(input, context, dryRun = Boolean(input.dry_run)) {
         action,
         task: userIntent,
         sql: sql || null,
-        migrationName: String(input.migration_name || input.name || `mad_sks_${Date.now()}`),
+        migrationName: String(input.migration_name || input.name || `mad_sks_sql_plane_${Date.now()}`),
         migrationFile: migrationFile || null,
         verifySql: verifySql || null,
         verifyExpectedRowCount,
@@ -136,7 +136,7 @@ async function runSqlPlane(input, context, dryRun = Boolean(input.dry_run)) {
     const readBackPassed = result.read_back ? result.read_back.ok === true : result.execution?.ok === true;
     const profileClosed = result.capability_closed === true && result.read_only_restoration?.ok === true;
     const verification = [{
-            kind: 'mad_db_cycle',
+            kind: 'mad_sks_sql_plane_cycle',
             ok: result.ok === true,
             execution_ok: result.execution?.ok === true,
             read_back_passed: readBackPassed,
@@ -170,7 +170,7 @@ async function runSqlPlane(input, context, dryRun = Boolean(input.dry_run)) {
             catastrophic,
             rollback_kind: rollbackKind,
             operation_classes: result.operation?.operation_classes || operationClasses,
-            mad_db_cycle_result: result,
+            mad_sks_sql_plane_cycle_result: result,
             sql_plane: sqlPlaneSummary(readBackPassed, profileClosed, result, result.operation?.operation_classes || operationClasses)
         }
     });
@@ -185,10 +185,10 @@ async function resolveSqlPlaneSql(input, context, migrationFile) {
     return String(await readText(resolved, '') || '');
 }
 async function runSqlPlaneCycle(input, context, cycleInput) {
-    const fixture = input.__test_mad_db_cycle_result;
-    if (fixture && (process.env.NODE_ENV === 'test' || process.env.SKS_TEST_MOCK_MAD_DB_CYCLE === '1'))
+    const fixture = input.__test_mad_sks_sql_plane_cycle_result;
+    if (fixture && (process.env.NODE_ENV === 'test' || process.env.SKS_TEST_MOCK_MAD_SKS_SQL_PLANE_CYCLE === '1'))
         return fixture;
-    return withMadDbLock(context.target_root, String(input.mission_id || input.missionId || ''), 'mad-sks-sql-plane', () => runMadDbCycle(cycleInput));
+    return withMadSksSqlPlaneLock(context.target_root, String(input.mission_id || input.missionId || ''), 'mad-sks-sql-plane', () => runMadSksSqlPlaneCycle(cycleInput));
 }
 function sqlPlaneSummary(readBackPassed, profileClosed, result, operationClasses) {
     return {
@@ -199,4 +199,3 @@ function sqlPlaneSummary(readBackPassed, profileClosed, result, operationClasses
         profile_closed: profileClosed
     };
 }
-//# sourceMappingURL=sql-plane-executor.js.map

package/dist/core/mad-sks/guard-middleware.js

@@ -132,4 +132,3 @@ function isInside(candidate, root) {
     const rel = path.relative(root, candidate);
     return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
 }
-//# sourceMappingURL=guard-middleware.js.map

package/dist/core/mad-sks/immutable-harness-guard.js

@@ -275,4 +275,3 @@ async function realPathForCheck(candidate) {
         return path.resolve(candidate);
     }
 }
-//# sourceMappingURL=immutable-harness-guard.js.map

package/dist/core/mad-sks/permission-model.js

@@ -176,4 +176,3 @@ export function stableJson(value) {
     }
     return JSON.stringify(value);
 }
-//# sourceMappingURL=permission-model.js.map

package/dist/core/mad-sks/proof-evidence.js

@@ -35,4 +35,3 @@ export async function writeMadSksProofEvidence(file, evidence) {
     await writeJsonAtomic(file, evidence);
     return evidence;
 }
-//# sourceMappingURL=proof-evidence.js.map

package/dist/core/mad-sks/rollback-apply.js

@@ -169,4 +169,3 @@ function blocked(reason, extra = {}) {
         ...extra
     };
 }
-//# sourceMappingURL=rollback-apply.js.map

package/dist/core/mad-sks/rollback-plan.js

@@ -24,4 +24,3 @@ export async function writeMadSksRollbackPlan(file, plan) {
     await writeJsonAtomic(file, plan);
     return plan;
 }
-//# sourceMappingURL=rollback-plan.js.map

package/dist/core/mad-sks/shell-argv-classifier.js

@@ -276,4 +276,3 @@ function isInside(candidate, root) {
     const rel = path.relative(root, candidate);
     return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
 }
-//# sourceMappingURL=shell-argv-classifier.js.map

package/dist/core/mad-sks/sql-plane/capability.js

@@ -0,0 +1,202 @@
+import path from 'node:path';
+import { appendJsonlBounded, nowIso, readJson, sha256, writeJsonAtomic } from '../../fsx.js';
+import { findLatestMission, missionDir } from '../../mission.js';
+import { withMadSksSqlPlaneLock } from './lock.js';
+import { MAD_SKS_SQL_PLANE_POLICY } from './policy.js';
+import { MAD_SKS_SQL_PLANE_CAPABILITY_FILE, MAD_SKS_SQL_PLANE_CLOSED_CAPABILITY_FILE, MAD_SKS_SQL_PLANE_LEDGER_FILE, madSksSqlPlaneDir, madSksSqlPlaneRelativePath } from './paths.js';
+export const MAD_SKS_SQL_PLANE_CAPABILITY_SCHEMA = 'sks.mad-sks-sql-plane-capability.v2';
+export { MAD_SKS_SQL_PLANE_CAPABILITY_FILE } from './paths.js';
+export const MAD_SKS_SQL_PLANE_ACK = 'I AUTHORIZE ONE-CYCLE DB BREAK-GLASS';
+export const MAD_SKS_SQL_PLANE_DEFAULT_TTL_MS = MAD_SKS_SQL_PLANE_POLICY.ttl.default_ms;
+export const MAD_SKS_SQL_PLANE_MAX_TTL_MS = MAD_SKS_SQL_PLANE_POLICY.ttl.hard_max_ms;
+export async function createMadSksSqlPlaneCapability(root, input) {
+    if (input.ack !== MAD_SKS_SQL_PLANE_ACK)
+        throw new Error('mad_sks_sql_plane_ack_phrase_mismatch');
+    const createdAt = nowIso();
+    const ttlMs = Math.min(MAD_SKS_SQL_PLANE_MAX_TTL_MS, Math.max(1, Math.floor(Number(input.ttlMs || MAD_SKS_SQL_PLANE_DEFAULT_TTL_MS))));
+    const projectRef = String(input.projectRef || process.env.SKS_MAD_SKS_SQL_PLANE_PROJECT_REF || process.env.SKS_MAD_SKS_SQL_PLANE_E2E_PROJECT_REF || 'fixture-project-ref').trim();
+    const profilePath = input.profilePath || `.sneakoscope/missions/<mission>/${madSksSqlPlaneRelativePath('runtime', 'codex-mad-sks-sql-plane.config.toml')}`;
+    const profileSha256 = input.profileSha256 || sha256(`${input.missionId}:${projectRef}:placeholder-profile`);
+    const capability = {
+        schema: MAD_SKS_SQL_PLANE_CAPABILITY_SCHEMA,
+        revision: 1,
+        mission_id: input.missionId,
+        cycle_id: input.cycleId || `mad-sks-sql-plane-${Date.now().toString(36)}`,
+        project_root_hash: sha256(path.resolve(input.cwd || root)).slice(0, 24),
+        project_ref: projectRef,
+        target_environment: input.targetEnvironment || 'production',
+        allowed_schemas: input.allowedSchemas?.length ? input.allowedSchemas : ['public'],
+        codex_thread_id: input.codexThreadId ?? null,
+        runtime_session_id: input.runtimeSessionId || `mad-sks-sql-plane-session-${Date.now().toString(36)}`,
+        operator_intent_hash: sha256(input.operatorIntent || input.ack || 'mad-sks-sql-plane').slice(0, 32),
+        operator_ack_hash: sha256(input.ack).slice(0, 32),
+        scope: {
+            sql_plane: 'all_mutations',
+            control_plane: 'deny',
+            operations: input.operations?.length ? input.operations : [...MAD_SKS_SQL_PLANE_POLICY.sql_plane_allowed]
+        },
+        transport: {
+            profile_path: profilePath,
+            profile_sha256: profileSha256,
+            server_url_redacted: input.serverUrlRedacted || 'https://mcp.supabase.com/mcp?project_ref=<redacted>&features=database',
+            features: ['database'],
+            write_capable: true
+        },
+        issued_at: createdAt,
+        expires_at: new Date(Date.now() + ttlMs).toISOString(),
+        closed_at: null,
+        status: input.status || 'issued',
+        counters: {
+            attempts: 0,
+            reserved: 0,
+            succeeded: 0,
+            failed: 0
+        }
+    };
+    const dir = madSksSqlPlaneDir(root, input.missionId);
+    await writeJsonAtomic(path.join(dir, MAD_SKS_SQL_PLANE_CAPABILITY_FILE), capability);
+    await appendJsonlBounded(path.join(dir, MAD_SKS_SQL_PLANE_LEDGER_FILE), {
+        ts: nowIso(),
+        type: 'capability.created',
+        schema: capability.schema,
+        mission_id: capability.mission_id,
+        cycle_id: capability.cycle_id,
+        project_ref_hash: sha256(capability.project_ref).slice(0, 16),
+        runtime_session_id: capability.runtime_session_id,
+        expires_at: capability.expires_at,
+        status: capability.status
+    });
+    return capability;
+}
+export async function readMadSksSqlPlaneCapability(root, missionId) {
+    const value = await readJson(path.join(madSksSqlPlaneDir(root, missionId), MAD_SKS_SQL_PLANE_CAPABILITY_FILE), null);
+    if (value?.schema === MAD_SKS_SQL_PLANE_CAPABILITY_SCHEMA)
+        return value;
+    return null;
+}
+export async function resolveMadSksSqlPlaneMissionId(root, state = {}, explicitMissionId = null) {
+    if (explicitMissionId && explicitMissionId !== 'latest')
+        return explicitMissionId;
+    if (state?.mad_sks_sql_plane_capability_mission_id)
+        return String(state.mad_sks_sql_plane_capability_mission_id);
+    if (state?.mission_id)
+        return String(state.mission_id);
+    return findLatestMission(root, { mode: 'mad-sks' });
+}
+export function isMadSksSqlPlaneCapabilityActive(capability, nowMs = Date.now()) {
+    if (!capability)
+        return false;
+    const expires = Date.parse(capability.expires_at || '');
+    return capability.schema === MAD_SKS_SQL_PLANE_CAPABILITY_SCHEMA
+        && ['transport_ready', 'active'].includes(capability.status)
+        && Boolean(capability.project_ref)
+        && capability.transport?.write_capable === true
+        && capability.transport?.features?.[0] === 'database'
+        && Number.isFinite(expires)
+        && expires > nowMs;
+}
+export async function activateMadSksSqlPlaneCapability(root, missionId) {
+    return updateMadSksSqlPlaneCapability(root, missionId, (capability) => ({
+        ...capability,
+        status: capability.status === 'issued' ? 'active' : capability.status
+    }));
+}
+export async function markMadSksSqlPlaneTransportReady(root, missionId) {
+    return updateMadSksSqlPlaneCapability(root, missionId, (capability) => ({
+        ...capability,
+        status: capability.status === 'issued' ? 'transport_ready' : capability.status
+    }));
+}
+export async function updateMadSksSqlPlaneCapabilityCounters(root, missionId, delta) {
+    return updateMadSksSqlPlaneCapability(root, missionId, (capability) => ({
+        ...capability,
+        counters: {
+            attempts: capability.counters.attempts + Number(delta.attemptsDelta || 0),
+            reserved: capability.counters.reserved + Number(delta.reservedDelta || 0),
+            succeeded: capability.counters.succeeded + Number(delta.succeededDelta || 0),
+            failed: capability.counters.failed + Number(delta.failedDelta || 0)
+        }
+    }));
+}
+export async function updateMadSksSqlPlaneCapability(root, missionId, mutator) {
+    return withMadSksSqlPlaneLock(root, missionId, 'capability', async () => {
+        const current = await readMadSksSqlPlaneCapability(root, missionId);
+        if (!current)
+            return null;
+        const next = mutator(current);
+        const updated = {
+            ...next,
+            revision: Number(current.revision || 0) + 1
+        };
+        const dir = madSksSqlPlaneDir(root, missionId);
+        await writeJsonAtomic(path.join(dir, MAD_SKS_SQL_PLANE_CAPABILITY_FILE), updated);
+        await appendJsonlBounded(path.join(dir, MAD_SKS_SQL_PLANE_LEDGER_FILE), {
+            ts: nowIso(),
+            type: 'capability.updated',
+            mission_id: missionId,
+            cycle_id: updated.cycle_id,
+            revision: updated.revision,
+            status: updated.status,
+            counters: updated.counters
+        });
+        return updated;
+    });
+}
+export async function recordMadSksSqlPlaneOperation(root, missionId, input = {}) {
+    const capability = await readMadSksSqlPlaneCapability(root, missionId);
+    if (!capability)
+        return null;
+    await appendJsonlBounded(path.join(madSksSqlPlaneDir(root, missionId), MAD_SKS_SQL_PLANE_LEDGER_FILE), {
+        ts: nowIso(),
+        type: 'db_operation.recorded',
+        mission_id: missionId,
+        cycle_id: capability.cycle_id,
+        operation_id: input.operationId || null,
+        tool_name: input.toolName || null,
+        sql_hash: input.sqlHash || null
+    });
+    return capability;
+}
+export async function consumeMadSksSqlPlaneCapability(root, missionId, input = {}) {
+    return closeMadSksSqlPlaneCycle(root, missionId, '', input.consumedBy || input.reason || 'mad_sks_sql_plane_cycle_closed');
+}
+export async function closeMadSksSqlPlaneCycle(root, missionId, cycleId = '', reason = 'mad_sks_sql_plane_cycle_closed') {
+    const closed = await updateMadSksSqlPlaneCapability(root, missionId, (capability) => {
+        if (cycleId && capability.cycle_id !== cycleId)
+            return capability;
+        return {
+            ...capability,
+            status: capability.status === 'revoked' ? 'revoked' : 'closed',
+            closed_at: nowIso()
+        };
+    });
+    if (closed) {
+        await writeJsonAtomic(path.join(madSksSqlPlaneDir(root, missionId), MAD_SKS_SQL_PLANE_CLOSED_CAPABILITY_FILE), {
+            schema: closed.schema,
+            mission_id: closed.mission_id,
+            cycle_id: closed.cycle_id,
+            closed_at: closed.closed_at,
+            close_reason: reason,
+            counters: closed.counters,
+            project_ref_hash: sha256(closed.project_ref).slice(0, 16)
+        });
+    }
+    return closed;
+}
+export async function revokeMadSksSqlPlaneCapability(root, missionId, reason = 'operator_revoked') {
+    const revoked = await updateMadSksSqlPlaneCapability(root, missionId, (capability) => ({
+        ...capability,
+        status: 'revoked',
+        closed_at: nowIso()
+    }));
+    if (revoked) {
+        await appendJsonlBounded(path.join(madSksSqlPlaneDir(root, missionId), MAD_SKS_SQL_PLANE_LEDGER_FILE), {
+            ts: nowIso(),
+            type: 'capability.revoked',
+            mission_id: missionId,
+            cycle_id: revoked.cycle_id,
+            reason
+        });
+    }
+    return revoked;
+}